//code by skylly

//for csdsjkk

msg "忽略所有异常"

gpa "CreateThread","kernel32.dll"

cmp $RESULT,0

je err

var CreateThread

mov CreateThread,$RESULT



#log

gpa "OpenEventA","KERNEL32.DLL"

bphws $RESULT,"x"

esto

bphwc $RESULT



exec

push eax

push 0

push 0

push 0

call CreateEventA

ende

rtu



//去垃圾异常

find eip,#CDF5#

cmp $RESULT,0

je pipi

mov [$RESULT],#9090#



find eip,#CDF7#

cmp $RESULT,0

je err

mov [$RESULT],#33C0#



find eip,#CDF7#

cmp $RESULT,0

je err

mov [$RESULT],#33C0#



pipi:



find eip,#E9????0000#

cmp $RESULT,0

je err

var start

mov start,$RESULT



find eip,#F783#  //test dword ptr ds:[ebx+40213F],2

cmp $RESULT,0

je err

var loping

mov loping,$RESULT







var temp

//开始创建副线程

bphws CreateThread,"x"

esto

bphwc CreateThread

mov temp,esp

add temp,c

mov temp,[temp]

bp temp

esto

bc temp

//进入副线程



//1号子线程 检测代码完整性

bphws CreateThread,"x"

esto

bphwc CreateThread

mov temp,esp

add temp,14

mov [temp],4      //让其挂起

rtu



//2号子线程 解压代码

bphws CreateThread,"x"

esto

bphwc CreateThread

mov temp,esp

add temp,c

var newep

mov newep,[temp]

rtu



find eip,#81A3#

cmp $RESULT,0

je err

mov eip,$RESULT



//3号子线程 检测API 让其死在摇篮里

find CreateThread,#FF7518#

mov [$RESULT],#6A0490#



//到解码线程开始处

bp newep

esto

bc newep

cmp eip,newep

jne err



//去掉无聊异常

find newep,#CDF7#

cmp $RESULT,0

je err

mov [$RESULT],#33C0#



find newep,#CDF7#

cmp $RESULT,0

je haoxi            //有的程序没有这个异常

mov [$RESULT],#33C0#



haoxi:

find eip,#83A3#

cmp $RESULT,0

je err

go $RESULT

add $RESULT,1



find $RESULT,#83A3#

cmp $RESULT,0

je err

mov eip,$RESULT



find eip,#C20400#

cmp $RESULT,0

je err

dec $RESULT



go $RESULT

//解码完毕





//继续主线程路线

bp loping

esto

bc loping

mov eip,start         //新建EIP

sti

sti

var temp

mov temp,eip

sub temp,1000



kill:

find temp,#CDF7#

cmp $RESULT,0

je final

mov [$RESULT],#33C0#       //这个eax会被用来破坏正常代码

jmp kill



final:

find eip,#6A005250#   //解码完毕

cmp $RESULT,0

je err

find $RESULT,#8B93#

cmp $RESULT,0

je err

go $RESULT



find eip,#83FE00#

cmp $RESULT,0

je err

go $RESULT

var iidstart

mov iidstart,esi

eval "dump now,iidstart:{iidstart}"

msg $RESULT



find eip,#8BBB#

cmp $RESULT,0

je err

go $RESULT       //iat解码完毕



find eip,#3383#     //此时计算oep

cmp $RESULT,0

je err

go $RESULT

var oep

mov oep,eax

log oep



find eip,#3507000080#

cmp $RESULT,0

je err

mov [$RESULT],#33C0909090# //死循环



find eip,#C3#

cmp $RESULT,0

je err

go $RESULT

sti           //跳oep



OEP:

cmt eip,"OEP"

ret



err:

msg "error"

ret