;Beginning Address was : 640F27
PUSHFD //save regs
PUSHAD //save flags, since I'm using a CMP below, which alters ZF
CMP DWORD PTR SS:[ESP+18],218 //do we write the whole key? NO, do normal WF; YES, do my code
JNZ SHORT Test.00640F88 //NO, do normal WF ^
MOV ECX,97 //making ECX 0x97 (the length of "C:\Application Data\..." in UNICODE)
MOV EAX,DWORD PTR SS:[ESP+24] //putting flashfxp.key's handle in EAX
MOV DWORD PTR DS:[640F93],EAX //saving it in temp location
MOV EDI,Test.00641000 //setting destination for copied unicode string
MOV ESI,DWORD PTR SS:[ESP-3CC] //setting source where unicode string is in stack
REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] //copying it
POPAD //restoring regs
POPFD //restoring flags
CALL <JMP.&kernel32.WriteFile> //execute normal code located original at 40B0C0; .key gets written so it should be 560 bytes now..
PUSHAD //saving regs again
PUSH Test.00640F99 //location of "kernel32.dll" string; pushing it
CALL <JMP.&kernel32.LoadLibraryA> //and loading kernel32.dll ^; result is in EAX
PUSH Test.00640FA6 //location of "SetFileAttributesW" API string; pushing it
PUSH EAX //pushing address of loaded library from earlier (kernel32.dll)
CALL <JMP.&kernel32.GetProcAddress> //getting address of SetFileAttributesW API; result is in EAX
PUSH 1 //1 = set file to READ_ONLY
PUSH EAX //pushing address of SFAW API for later use
PUSH DWORD PTR DS:[640F93] //pushing file handle
CALL <JMP.&kernel32.CloseHandle> //and closing the handle, so then I could..
POP EAX //return SFAW API in EAX
PUSH Test.00641000 //push unicode string buffer for file location (flashfxp.key)
CALL EAX //and calling SFAW to set file to READ_ONLY =]
POPAD //restoring regs
JMP Test.0040B0C5 //returning to original code
POPAD //this is where I land in case CMP at beginning fails (NO case)
POPFD //restoring flags and registers
CALL <JMP.&kernel32.WriteFile> //calling original instruction at 40B0C0
JMP Test.0040B0C5 //and returning to normal code
;End Address was : 640F8F
;Beginning Address was : 40B0C0
JMP Test.00640F27 //jumping to cave where "hook" is..
;End Address was : 40B0C0