Jump to content
begood

Anonymous wallpaper [de editat]

Recommended Posts

begood, hit me with a nice text like

004010A2   . 8B45 08        mov     eax, dword ptr ss:[ebp+8]
004010A5 . 05 30000000 add eax, 30
004010AA . E9 05000000 jmp temp1.004010B4
004010AF . E9 02000000 jmp temp1.004010B6
004010B4 > 40 inc eax
004010B5 . 48 dec eax
004010B6 > 8945 84 mov dword ptr ss:[ebp-7C], eax
004010B9 . 8B45 84 mov eax, dword ptr ss:[ebp-7C]
004010BC . 8D65 F4 lea esp, dword ptr ss:[ebp-C]

source: nytro

Link to comment
Share on other sites

begood, hit me with a nice text like

004010A2   . 8B45 08        mov     eax, dword ptr ss:[ebp+8]
004010A5 . 05 30000000 add eax, 30
004010AA . E9 05000000 jmp temp1.004010B4
004010AF . E9 02000000 jmp temp1.004010B6
004010B4 > 40 inc eax
004010B5 . 48 dec eax
004010B6 > 8945 84 mov dword ptr ss:[ebp-7C], eax
004010B9 . 8B45 84 mov eax, dword ptr ss:[ebp-7C]
004010BC . 8D65 F4 lea esp, dword ptr ss:[ebp-C]

source: nytro

CPU Disasm
Address Hex dump Command Comments
00C05910 FF15 EC60C000 CALL DWORD PTR DS:[0C060EC]
00C05916 85C0 TEST EAX,EAX
00C05918 74 1B JE SHORT 00C05935
00C0591A 89C3 MOV EBX,EAX
00C0591C 68 3380C000 PUSH OFFSET 00C08033 ; ASCII "DecodePointer"
00C05921 56 PUSH ESI
00C05922 FF15 EC60C000 CALL DWORD PTR DS:[0C060EC]
00C05928 74 0B JE SHORT 00C05935
00C0592A 891D 1080C000 MOV DWORD PTR DS:[0C08010],EBX
00C05930 A3 1480C000 MOV DWORD PTR DS:[0C08014],EAX
00C05935 56 PUSH ESI
00C05936 FF15 E860C000 CALL DWORD PTR DS:[0C060E8]
00C0593C 5B POP EBX
00C0593D 5E POP ESI
00C0593E 58 POP EAX
00C0593F C3 RETN
00C05940 55 PUSH EBP
00C05941 89E5 MOV EBP,ESP
00C05943 E8 9FFFFFFF CALL 00C058E7
00C05948 5D POP EBP
00C05949 ^ FF25 1080C000 JMP DWORD PTR DS:[0C08010]
00C0594F 55 PUSH EBP
00C05950 89E5 MOV EBP,ESP
00C05952 E8 90FFFFFF CALL 00C058E7
00C05957 5D POP EBP
00C05958 ^ FF25 1480C000 JMP DWORD PTR DS:[0C08014]
00C0595E 55 PUSH EBP
00C0595F 8BEC MOV EBP,ESP
00C05961 56 PUSH ESI
00C05962 57 PUSH EDI
00C05963 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]
00C05966 8B75 0C MOV ESI,DWORD PTR SS:[EBP+0C]
00C05969 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
00C0596C F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[
00C0596E 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00C05971 5F POP EDI
00C05972 5E POP ESI
00C05973 5D POP EBP
00C05974 C3 RETN
00C05975 55 PUSH EBP
00C05976 8BEC MOV EBP,ESP
00C05978 57 PUSH EDI
00C05979 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]
00C0597C 8A45 0C MOV AL,BYTE PTR SS:[EBP+0C]
00C0597F 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
00C05982 F3:AA REP STOS BYTE PTR ES:[EDI]
00C05984 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00C05987 5F POP EDI
00C05988 5D POP EBP
00C05989 C3 RETN
00C0598A CC INT3
00C0598B C3 RETN
00C0598C FF7424 04 PUSH DWORD PTR SS:[ESP+4]
00C05990 6A 00 PUSH 0
00C05992 FF15 C460C000 CALL DWORD PTR DS:[0C060C4]
00C05998 50 PUSH EAX
00C05999 FF15 C060C000 CALL DWORD PTR DS:[0C060C0]
00C0599F C3 RETN
00C059A0 FF7424 04 PUSH DWORD PTR SS:[ESP+4]
00C059A4 6A 00 PUSH 0
00C059A6 FF15 C460C000 CALL DWORD PTR DS:[0C060C4]
00C059AC 50 PUSH EAX
00C059AD FF15 C860C000 CALL DWORD PTR DS:[0C060C8]
00C059B3 C3 RETN
00C059B4 8D4424 0C LEA EAX,[ESP+0C]
00C059B8 50 PUSH EAX
00C059B9 FF7424 0C PUSH DWORD PTR SS:[ESP+0C]
00C059BD FF7424 0C PUSH DWORD PTR SS:[ESP+0C]
00C059C1 FF15 1C61C000 CALL DWORD PTR DS:[0C0611C]
00C059C7 C3 RETN
00C059C8 55 PUSH EBP
00C059C9 8BEC MOV EBP,ESP
00C059CB 83EC 44 SUB ESP,44
00C059CE 56 PUSH ESI
00C059CF FF15 D460C000 CALL DWORD PTR DS:[0C060D4]
00C059D5 8BF0 MOV ESI,EAX
00C059D7 8A06 MOV AL,BYTE PTR DS:[ESI]
00C059D9 3C 22 CMP AL,22
00C059DB 75 14 JNE SHORT 00C059F1
00C059DD 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
00C059E0 46 INC ESI
00C059E1 84C0 TEST AL,AL
00C059E3 74 04 JE SHORT 00C059E9
00C059E5 3C 22 CMP AL,22
00C059E7 ^ 75 F4 JNE SHORT 00C059DD
00C059E9 803E 22 CMP BYTE PTR DS:[ESI],22
00C059EC 75 0D JNE SHORT 00C059FB
00C059EE 46 INC ESI
00C059EF EB 0A JMP SHORT 00C059FB
00C059F1 3C 20 CMP AL,20

asta vrei ?

http://pastebin.com/n6sCYvwy moar

editeaza-l cum vrei, daca nu vrei sa apara cuvinte ca truecrypt

Edited by begood
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...