Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 00402000 > $ 68 C2B54000 PUSH sfbypass.0040B5C2 ; /Buffer = sfbypass.0040B5C2
- 00402005 . 68 FF000000 PUSH 0FF ; |BufSize = FF (255.)
- 0040200A . FF15 CEC04000 CALL DWORD PTR DS:[<&KERNEL32.GetTempPat>; \GetTempPathA
- 00402010 . 68 C1B64000 PUSH sfbypass.0040B6C1 ; /TempName = sfbypass.0040B6C1
- 00402015 . 6A 00 PUSH 0 ; |Unique = 0
- 00402017 . 68 24B84000 PUSH sfbypass.0040B824 ; |Prefix = ""
- 0040201C . 68 C2B54000 PUSH sfbypass.0040B5C2 ; |Path = ""
- 00402021 . FF15 CAC04000 CALL DWORD PTR DS:[<&KERNEL32.GetTempFil>; \GetTempFileNameA
- 00402027 . 68 C1B64000 PUSH sfbypass.0040B6C1 ; /FileName = ""
- 0040202C . FF15 AEC04000 CALL DWORD PTR DS:[<&KERNEL32.DeleteFile>; \DeleteFileA
- 00402032 . 6A 00 PUSH 0
- 00402034 . 68 C1B64000 PUSH sfbypass.0040B6C1 ; /path = ""
- 00402039 . FF15 CCC14000 CALL DWORD PTR DS:[<&crtdll._mkdir>] ; \_mkdir
- 0040203F . 83C4 08 ADD ESP,8
- 00402042 . 68 C1B64000 PUSH sfbypass.0040B6C1 ; /Path = ""
- 00402047 . FF15 8AC14000 CALL DWORD PTR DS:[<&shlwapi.PathAddBack>; \PathAddBackslashA
- 0040204D . E8 04000000 CALL sfbypass.00402056
- 00402052 . 6232 BOUND ESI,QWORD PTR DS:[EDX]
- 00402054 65 DB 65 ; CHAR 'e'
- 00402055 00 DB 00
- 00402056 . 68 C1B64000 PUSH sfbypass.0040B6C1 ; |ConcatString = ""
- 0040205B . FF15 C6C04000 CALL DWORD PTR DS:[<&KERNEL32.lstrcatA>] ; \lstrcatA
- 00402061 . 89C6 MOV ESI,EAX
- 00402063 . 6A 00 PUSH 0 ; /hTemplateFile = NULL
- 00402065 . 68 80000000 PUSH 80 ; |Attributes = NORMAL
- 0040206A . 6A 02 PUSH 2 ; |Mode = CREATE_ALWAYS
- 0040206C . 6A 00 PUSH 0 ; |pSecurity = NULL
- 0040206E . 6A 00 PUSH 0 ; |ShareMode = 0
- 00402070 . 68 00000040 PUSH 40000000 ; |Access = GENERIC_WRITE
- 00402075 . 68 C1B64000 PUSH sfbypass.0040B6C1 ; |FileName = ""
- 0040207A . FF15 AAC04000 CALL DWORD PTR DS:[<&KERNEL32.CreateFile>; \CreateFileA
- 00402080 . 3B05 90B94000 CMP EAX,DWORD PTR DS:[40B990]
- 00402086 . A3 90B94000 MOV DWORD PTR DS:[40B990],EAX
- 0040208B . 6A 00 PUSH 0 ; /pOverlapped = NULL
- 0040208D . 68 94B94000 PUSH sfbypass.0040B994 ; |pBytesWritten = sfbypass.0040B994
- 00402092 . 68 C2070000 PUSH 7C2 ; |nBytesToWrite = 7C2 (1986.)
- 00402097 . 68 00AE4000 PUSH sfbypass.0040AE00 ; |Buffer = sfbypass.0040AE00
- 0040209C . FF35 90B94000 PUSH DWORD PTR DS:[40B990] ; |hFile = FFFFFFFF
- 004020A2 . FF15 BEC04000 CALL DWORD PTR DS:[<&KERNEL32.WriteFile>>; \WriteFile
- 004020A8 . 813D 94B94000 >CMP DWORD PTR DS:[40B994],7C2
- 004020B2 . FF35 90B94000 PUSH DWORD PTR DS:[40B990] ; /hObject = FFFFFFFF
- 004020B8 . FF15 A6C04000 CALL DWORD PTR DS:[<&KERNEL32.CloseHandl>; \CloseHandle
- 004020BE . E8 05000000 CALL sfbypass.004020C8
- 004020C3 . 2E: PREFIX CS: ; Superfluous prefix
- 004020C4 . 64:6C INS BYTE PTR ES:[EDI],DX ; I/O command
- 004020C6 . 6C INS BYTE PTR ES:[EDI],DX ; I/O command
- 004020C7 00 DB 00
- 004020C8 . 68 C1B64000 PUSH sfbypass.0040B6C1 ; |ConcatString = ""
- 004020CD . FF15 C6C04000 CALL DWORD PTR DS:[<&KERNEL32.lstrcatA>] ; \lstrcatA
- 004020D3 . 6A 00 PUSH 0 ; /hTemplateFile = NULL
- 004020D5 . 68 80000000 PUSH 80 ; |Attributes = NORMAL
- 004020DA . 6A 02 PUSH 2 ; |Mode = CREATE_ALWAYS
- 004020DC . 6A 00 PUSH 0 ; |pSecurity = NULL
- 004020DE . 6A 00 PUSH 0 ; |ShareMode = 0
- 004020E0 . 68 00000040 PUSH 40000000 ; |Access = GENERIC_WRITE
- 004020E5 . 68 C1B64000 PUSH sfbypass.0040B6C1 ; |FileName = ""
- 004020EA . FF15 AAC04000 CALL DWORD PTR DS:[<&KERNEL32.CreateFile>; \CreateFileA
- 004020F0 . 3B05 90B94000 CMP EAX,DWORD PTR DS:[40B990]
- 004020F6 . A3 90B94000 MOV DWORD PTR DS:[40B990],EAX
- 004020FB . 6A 00 PUSH 0 ; /pOverlapped = NULL
- 004020FD . 68 94B94000 PUSH sfbypass.0040B994 ; |pBytesWritten = sfbypass.0040B994
- 00402102 . 68 007E0000 PUSH 7E00 ; |nBytesToWrite = 7E00 (32256.)
- 00402107 . 68 00304000 PUSH sfbypass.00403000 ; |Buffer = sfbypass.00403000
- 0040210C . FF35 90B94000 PUSH DWORD PTR DS:[40B990] ; |hFile = FFFFFFFF
- 00402112 . FF15 BEC04000 CALL DWORD PTR DS:[<&KERNEL32.WriteFile>>; \WriteFile
- 00402118 . 813D 94B94000 >CMP DWORD PTR DS:[40B994],7E00
- 00402122 . 74 00 JE SHORT sfbypass.00402124
- 00402124 > 833D 90B94000 >CMP DWORD PTR DS:[40B990],-1
- 0040212B . 74 0C JE SHORT sfbypass.00402139
- 0040212D . FF35 90B94000 PUSH DWORD PTR DS:[40B990] ; /hObject = FFFFFFFF
- 00402133 . FF15 A6C04000 CALL DWORD PTR DS:[<&KERNEL32.CloseHandl>; \CloseHandle
- 00402139 > 68 C1B64000 PUSH sfbypass.0040B6C1 ; /FileName = ""
- 0040213E . FF15 BAC04000 CALL DWORD PTR DS:[<&KERNEL32.LoadLibrar>; \LoadLibraryA
- 00402144 . A3 87B94000 MOV DWORD PTR DS:[40B987],EAX
- 00402149 . E8 04000000 CALL sfbypass.00402152
- 0040214E . 42 INC EDX
- 0040214F . 3245 00 XOR AL,BYTE PTR SS:[EBP]
- 00402152 /$ FF35 87B94000 PUSH DWORD PTR DS:[40B987] ; |hModule = NULL
- 00402158 |. FF15 C2C04000 CALL DWORD PTR DS:[<&KERNEL32.GetProcAdd>; \GetProcAddress
- 0040215E |. A3 8BB94000 MOV DWORD PTR DS:[40B98B],EAX
- 00402163 |. 31C0 XOR EAX,EAX
- 00402165 |. FF15 8BB94000 CALL DWORD PTR DS:[40B98B]
- 0040216B |. FF35 87B94000 PUSH DWORD PTR DS:[40B987] ; /hLibModule = NULL
- 00402171 |. FF15 B6C04000 CALL DWORD PTR DS:[<&KERNEL32.FreeLibrar>; \FreeLibrary
- 00402177 |. 68 C1B64000 PUSH sfbypass.0040B6C1 ; /FileName = ""
- 0040217C |. FF15 AEC04000 CALL DWORD PTR DS:[<&KERNEL32.DeleteFile>; \DeleteFileA
- 00402182 |. 68 C1B64000 PUSH sfbypass.0040B6C1 ; /Path = ""
- 00402187 |. FF15 86C14000 CALL DWORD PTR DS:[<&shlwapi.PathRemoveF>; \PathRemoveFileSpecA
- 0040218D |. 6A 00 PUSH 0
- 0040218F |. 68 C1B64000 PUSH sfbypass.0040B6C1 ; /path = ""
- 00402194 |. FF15 C8C14000 CALL DWORD PTR DS:[<&crtdll._rmdir>] ; \_rmdir
- 0040219A |. 83C4 08 ADD ESP,8
- 0040219D |. FF35 94B94000 PUSH DWORD PTR DS:[40B994] ; /ExitCode = 0
- 004021A3 \. FF15 B2C04000 CALL DWORD PTR DS:[<&KERNEL32.ExitProces>; \ExitProcess
Advertisement
Add Comment
Please, Sign In to add comment
