var adr

var table

var api

VAR case

var c

var d

var e

VAR x

VAR y

VAR count

var z



LOG "/////////////////////////////////////////////////////////////////////////"

LOG "              ROR PACKER 0.3 API CALLS SCRIPT BY absolutzero"

LOG "/////////////////////////////////////////////////////////////////////////"

MOV count,0

LOG "Repairing api calls..."

CALL apicalls

call hex2dec

eval "Resolved {count} api calls."

log $RESULT

ret

///////////////////////////////////////////////////////////////////////////////



apicalls:

MOV table,[441e3b]  //base of 2. TLS callback funciton memory area + 4

ADD table,3560  //pointer to api calls table address

mov table,[table]   //address of api calls table

apicalls1:

MOV adr,[table]

CMP adr,0

JE endapi

SUB adr,5             //address of api call

MOV api,[table+4]     //address of api in IAT

finding:

MOV case,[table+8]

CMP case,3

JE thruret

CMP case,1C

JE thruebx

CMP case,3C

JE thruedi

CMP case,34

JE thruesi

CMP case,2

JE thruret1

CMP case,2C

JE thruebp

CMP case,14

JE thruedx

CMP case,0C

JE thruecx



thrueax:

mov [adr],A1

mov [adr+1],api

JMP nexttable

 

thruret:

mov [adr],0FF

mov [adr+1],15

MOV [adr+2],api

JMP nexttable



thruret1:

mov [adr],0FF

mov [adr+1],25

MOV [adr+2],api

JMP nexttable



thruebx:

mov [adr],8B

mov [adr+1],1D

MOV [adr+2],api

JMP nexttable



thruedi:

mov [adr],8B

mov [adr+1],3D

MOV [adr+2],api

JMP nexttable



thruesi:

mov [adr],8B

mov [adr+1],35

MOV [adr+2],api

JMP nexttable



thruebp:

mov [adr],8B

mov [adr+1],2D

MOV [adr+2],api

JMP nexttable



thruedx:

mov [adr],8B

mov [adr+1],15

MOV [adr+2],api

JMP nexttable



thruecx:

mov [adr],8B

mov [adr+1],0D

MOV [adr+2],api



nexttable:

INC count             //count of api calls

ADD table,0c

JMP apicalls1

endapi:

RET



hex2dec:

mov cnt,count

mov e,0a

div count,e

cmp count,0

je endhex2dec

mov z,count

mul z,e

sub cnt,z

mov y,cnt

inc c

div:

mov cnt,count   

div count,e     

mov z,count    

mul z,e        

sub cnt,z      

mov d,c

mul d,4

shl cnt,d      

or y,cnt       

inc c          

cmp count,0

jne div

mov count,y

ret

endhex2dec:

mov count,cnt

ret