rendered paste body pushad
mov DWORD [ ebp + moduleStart - startOfBaseShell ], eax
virtual at eax
dos IMAGE_DOS_HEADER
end virtual
mov bx, WORD [ dos.e_magic ]
cmp bx, 0x5a4d
jne failToLink
mov ebx, DWORD [ dos.e_lfanew ]; mov offset to new header into ebx
lea eax, [eax + ebx] ; eax is now pointer to IMAGE_NT_HEADERS
virtual at eax
nt IMAGE_NT_HEADERS
end virtual
mov ebx, [ eax + nt.Signature ]
cmp ebx, 0x00004550
failToLink:
mov DWORD [ esp + (7*4) ], 0
jmp short .retval
mov [ esp + (7*4) ], eax
.retval:
popad
retn