All pastes #2061935 Raw Edit

Stuff

public text v1 · immutable
#2061935 ·published 2011-05-17 04:54 UTC
rendered paste body
 pushad
     mov DWORD [ ebp + moduleStart - startOfBaseShell ], eax
     virtual at eax
           dos IMAGE_DOS_HEADER
     end virtual
     mov bx, WORD [ dos.e_magic ]
     cmp bx,               0x5a4d
     jne failToLink
     mov ebx, DWORD [ dos.e_lfanew ]; mov offset to new header into ebx
     lea eax, [eax + ebx] ; eax is now pointer to IMAGE_NT_HEADERS
     virtual at eax
             nt IMAGE_NT_HEADERS
     end virtual
     mov ebx, [ eax + nt.Signature ]
     cmp ebx, 0x00004550
failToLink:
     mov DWORD [ esp + (7*4) ], 0
     jmp short .retval
     mov [ esp + (7*4) ], eax
.retval:
     popad
     retn