/*

	============================

	      .:[OllyScript Editor v2.0]:.

	      Author: GaBoR RES]

	      Packer: Thinstall 2.521

	      Script for: Thinstall 2.521 packed appz

	      Level: Intermediate

	      Date: Monday, November 28, 2005

              Thanks to: MaDMAn_H3rCul3s, haggar

              for their tutorials on Thinstall

	 ============================

						*/

var GetEnvironmentVariableA

var v

gpa "GetEnvironmentVariableA","kernel32.dll"

mov GetEnvironmentVariableA,$RESULT

bp GetEnvironmentVariableA

run

run

run

rtu

bc GetEnvironmentVariableA

find eip,#83BDE4FEFFFF00#

bp $RESULT

run

bc $RESULT

sto

sto

sto

sto

sto

sti

find eip,#0F84#

bphws $RESULT,"x"

run

bphwc $RESULT

cmp eax,0

jne change

cont:

rtr

/*

uncomment the following line if you don't have "After Executing till RET, step over RET" enabled in "Debugging Options->Trace'"

*/

//sto

find eip,#5968FA000000#

bp $RESULT

run

bc $RESULT

find eip,#83601000#

mov v,$RESULT

add v,24

bp v

run

bc v

sti

cmt eip,"OEP reached"

msg "Dump & fix IAT"

ret

change:

repl eip,#0F84#,#0F85#,2

jmp cont