Advertisement
Guest User

Untitled

a guest
Jun 26th, 2017
56
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.23 KB | None | 0 0
  1. [enable]
  2. alloc(mscrc,100)
  3. alloc(hscrc,100)
  4. alloc(copy,1024)
  5. alloc(dump,10482664)
  6. createthread(copy)
  7. label(exitmscrc)
  8. label(mscrcret)
  9. label(hscrcret)
  10. label(llop)
  11. label(getoutahere)
  12.  
  13. mscrc:
  14. cmp ecx,00401000
  15. jl exitmscrc
  16. cmp ecx,00E00000
  17. jg exitmscrc
  18. sub ecx,00401000
  19. push eax
  20. lea eax,[dump]
  21. add ecx,eax
  22. pop eax
  23. exitmscrc:
  24. movzx ecx,byte ptr [ecx]
  25. mov edx,[ebp+14]
  26. jmp mscrcret
  27.  
  28. copy:
  29. mov eax,00401000
  30. lea ecx,[dump]
  31. llop:
  32. xor ebx,ebx
  33. movzx ebx,byte ptr [eax]
  34. mov byte ptr [ecx],bl
  35. inc eax
  36. inc ecx
  37. cmp eax,00E00000
  38. jg getoutahere
  39. jmp llop
  40. getoutahere:
  41. lea ebx,[dump]
  42. add ebx,749cdb//B4ACDB - 401000
  43. xor eax,eax
  44. mov al,0F
  45. mov byte ptr [ebx],al
  46. inc ebx
  47. mov al,B6
  48. mov byte ptr [ebx],al
  49. inc ebx
  50. mov al,09
  51. mov byte ptr [ebx],al
  52. inc ebx
  53. mov al,8B
  54. mov byte ptr [ebx],al
  55. inc ebx
  56. mov al,55
  57. mov byte ptr [ebx],al
  58. ret
  59.  
  60. hscrc:
  61. mov eax,fs:[20]
  62. cmp eax,[esp+0c]
  63. jne hscrcret
  64. mov fs:[34],57
  65. xor eax,eax
  66. ret 000c
  67.  
  68. hscrcret:
  69. mov edi,edi
  70. push ebp
  71. mov ebp,esp
  72. jmp OpenProcess+05
  73.  
  74. 00B4EF15:
  75. jmp mscrc
  76. db 14
  77. mscrcret:
  78.  
  79. OpenProcess:
  80. jmp hscrc
  81.  
  82. [disable]
  83. 00B4EF15:
  84. db 0F B6 09 8B 55 14
  85. OpenProcess:
  86. db 8B FF 55 8B EC
  87.  
  88. dealloc(mscrc)
  89. dealloc(hscrc)
  90. dealloc(dump)
  91. dealloc(copy)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement