rendered paste bodyint 3
mov eax,fs:[30h] ; PEB base
mov eax,[eax+0ch] ; goto PEB_LDR_DATA
; first entry in InInitializationOrderModuleList
mov esi,[eax+1ch]
lodsd ; forward to next LIST_ENTRY
mov ebx,[eax+08h] ; Kernel32 base memory
mov esi,dword ptr [ebx+3Ch] ;to PE Header
add esi,ebx
mov esi,dword ptr [esi+78h] ; EXPORT TABLE RVA
add esi,ebx ; EXPORT TABLE VA
mov edi,dword ptr [esi+20h] ;to export name table
add edi,ebx ; NAME PTR VA
mov ecx,dword ptr [esi+14h] ;number of exported function
push esi ; save export table
xor eax,eax ;our counter
theloop:
mov edx, [ edi + eax * 4]
add edx, ebx ; edx has function name
cmp dword ptr [ edx ], 050746547h
jne incre
cmp dword ptr [ edx + 4], 041636F72h
je DONE
incre:
inc eax
cmp eax, ecx
jge DONE
jmp theloop
DONE:
pop esi
mov eax, [ esi + eax * 4 ]
add eax, ebx