Unknown

#include "functions.h"

USHORT xor_ror_hash(CHAR *str)
{
    CHAR *strptr = str;
    USHORT hash = 0;
    while (*strptr != NULL)
    {
        hash ^= *(USHORT*)strptr;
        hash >>= 1;
        strptr++;
    }
    return hash;
}

DWORD _declspec(naked) PEB_kernel32base()
{
    __asm
    {
        push ESI
        MOV ESI, FS:[0x30] //PEB base
        MOV ESI, [ESI + 0x0C] //PEB->Ldr
        MOV ESI, [ESI + 0x1C] //PEB->Ldr.InInitOrder
_kernel32base_next_module:
        CMP [ESI + 0x20 + 0x18], 0 //module_name[12] == 0? (unicode)
        JE _kernel32base_found_module //found
        MOV ESI, [ESI] //InInitOrder.flink (next module)
        JMP _kernel32base_next_module //loop
_kernel32base_found_module:
        MOV EAX, [ESI + 0x08] //InInitOrder.base_address
        pop ESI
        RET
    }
}

BYTE _declspec(naked) PEB_beingdebugged()
{
    __asm
    {
        MOV EAX, FS:[0x30]
        MOV EAX, [EAX + 0x02]
        RET
    }
}

DWORD getfuncaddress(DWORD mbase, CHAR *funcname)
{
    if (mbase == NULL) mbase = PEB_kernel32base();
    if (mbase == NULL) return NULL;

    USHORT funcnamehash = xor_ror_hash(funcname);
    DWORD address; address = NULL;
    DWORD name_pointer; name_pointer = NULL;
    DWORD address_pointer; address_pointer = NULL;
    WORD ord_pointer; ord_pointer = NULL;

    IMAGE_DOS_HEADER *dos = (IMAGE_DOS_HEADER*)mbase;
    if (dos->e_magic != IMAGE_DOS_SIGNATURE) return 0;

    IMAGE_NT_HEADERS *nt = (IMAGE_NT_HEADERS*)((DWORD)dos + dos->e_lfanew);
    if (nt->Signature != IMAGE_NT_SIGNATURE) return 0;

    IMAGE_EXPORT_DIRECTORY *exportdir = (IMAGE_EXPORT_DIRECTORY*)((DWORD)dos +
        nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

    DWORD i; i = 0;
    CHAR *name; name = NULL;
    DWORD *name_ptr = (DWORD*)((DWORD)dos + exportdir->AddressOfNames);
    WORD *ord_ptr = (WORD*)((DWORD)dos + exportdir->AddressOfNameOrdinals);
    DWORD *addr_ptr = (DWORD*)((DWORD)dos + exportdir->AddressOfFunctions);

    for (i = 0; i < exportdir->NumberOfNames; i++)
    {
        name = (CHAR*)((DWORD)dos + name_ptr[i]);
        if (xor_ror_hash(name) == funcnamehash) break;
    }
    if (i == exportdir->NumberOfNames) return 0;

    DWORD addr = (DWORD)dos + addr_ptr[ord_ptr[i]];
    return addr;
}

DWORD kernel32base = PEB_kernel32base();
MUD_HeapCreate = (_HeapCreate)getfuncaddress(kernel32base, "HeapCreate");
MUD_HeapDestroy = (_HeapDestroy)getfuncaddress(kernel32base, "HeapDestroy");
MUD_HeapAlloc = (_HeapAlloc)getfuncaddress(kernel32base, "HeapAlloc");
MUD_HeapReAlloc = (_HeapReAlloc)getfuncaddress(kernel32base, "HeapReAlloc");
MUD_HeapFree = (_HeapFree)getfuncaddress(kernel32base, "HeapFree");
MUD_HeapSize = (_HeapSize)getfuncaddress(kernel32base, "HeapSize");
MUD_GetProcessHeap = (_GetProcessHeap)getfuncaddress(kernel32base, "GetProcessHeap");