ZProtect 1.3 - 1.6 Full Decryption + Inline Patcher v1.0

<!
DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<link rel="dns-prefetch" href="https://assets-cdn.github.com">
<link rel="dns-prefetch" href="https://avatars0.githubusercontent.com">
<link rel="dns-prefetch" href="https://github-cloud.s3.amazonaws.com">
<link rel="dns-prefetch" href="https://user-images.githubusercontent.com/">
<link crossorigin="anonymous" media="all" integrity="sha512-

Z0JAar9+DkI1NjGVdZr3GivARUgJtA0o2eHlTv7Ou2gshR5awWVf8QGsq11Ns9ZxQLEs+G5/SuARmvpOLMz
ulw==" rel="stylesheet" href="https://assets-cdn.github.com/assets/frameworks-
95aff0b550d3fe338b645a4deebdcb1b.css" />
<link crossorigin="anonymous" media="all" integrity="sha512-
h5cEqWTuBT7ANPGSQLt1mH+ozRnf2uZHIo5hzaBUEaFGGVZkq/aXrTxFNXPfCm9ir2ztHtlW4AAMl2IxBKc
1pQ==" rel="stylesheet" href="https://assets-cdn.github.com/assets/github-
e6bb18b320358b77abe040d2eb46b547.css" />
<link crossorigin="anonymous" media="all"

integrity="sha512-/YdlYmXBl0rVnTX/ANGx7YStBlWdlnfFUtRTlTr8eBpzeBkOUj1GjReYy1/BdJ4wM
wOXzQEri+e91nqx5xrwGg==" rel="stylesheet" href="https://assets-
cdn.github.com/assets/site-d3b91707396b15f2783f5f891bc6d36e.css" />
<meta name="viewport" content="width=device-width">
<title>OllyDbg-Scripts/ZProtect 1.3 - 1.6 Full Decryption + Inline Patcher

v1.0.txt at master · ThomasThelen/OllyDbg-Scripts · GitHub</title>
<meta name="description" content="Unpacking scripts for Ollydbg.">
<link rel="search" type="application/opensearchdescription+xml"
href="/opensearch.xml" title="GitHub">
<link rel="fluid-icon" href="https://github.com/fluidicon.png" title="GitHub">
<meta property="fb:app_id" content="1401488693436528">
<meta property="og:image"
content="https://avatars0.githubusercontent.com/u/9289652?s=400&v=4" /><meta
property="og:site_name" content="GitHub" /><meta property="og:type"
content="object" /><meta property="og:title" content="ThomasThelen/OllyDbg-Scripts"
/><meta property="og:url" content="https://github.com/ThomasThelen/OllyDbg-Scripts"
/><meta property="og:description" content="OllyDbg-Scripts - Unpacking scripts for
Ollydbg." />
<link rel="assets" href="https://assets-cdn.github.com/">
<meta name="pjax-timeout" content="1000">

<meta name="request-id" content="C665:7C4D:1FD47D5:4139C2C:5B7521A9" data-pjax-
transient>
<meta name="selected-link" value="repo_source" data-pjax-transient>
<meta name="google-site-verification"
content="KT5gs8h0wvaagLKAVWq8bbeNwnZZK1r1XQysX3xurLU">
<meta name="google-site-verification" content="ZzhVyEFwb7w3e0-
uOTltm8Jsck2F5StVihD0exw2fsA">
<meta name="google-site-verification" content="GXs5KoUUkNCoaAZn7wPN-
t01Pywp9M3sEjnt_3_ZWPc">
<meta name="google-analytics" content="UA-3769691-2">
<meta name="octolytics-host" content="collector.githubapp.com" /><meta

name="octolytics-app-id" content="github" /><meta name="octolytics-event-url"
content="https://collector.githubapp.com/github-external/browser_event" /><meta
name="octolytics-dimension-request_id" content="C665:7C4D:1FD47D5:4139C2C:5B7521A9"
/><meta name="octolytics-dimension-region_edge" content="iad" /><meta
name="octolytics-dimension-region_render" content="iad" />
<meta name="analytics-location" content="/<user-name>/<repo-
name>/blob/show" data-pjax-transient="true" />
<meta class="js-ga-set" name="dimension1" content="Logged Out">
<meta name="hostname" content="github.com">

<meta name="user-login" content="">
<meta name="expected-hostname" content="github.com">

<meta name="js-proxy-site-detection-payload"
content="YTgyNDQ1ODA0MTg4ZDAwZDA0ZjQ3MGI0MTg5MmFkYTJhYjlhMThmNmI0NWI4MTNlOWMwNTU3OD
AyMzQ4MTU0Mnx7InJlbW90ZV9hZGRyZXNzIjoiMTgxLjU4LjIyNy43NCIsInJlcXVlc3RfaWQiOiJDNjY1O
jdDNEQ6MUZENDdENTo0MTM5QzJDOjVCNzUyMUE5IiwidGltZXN0YW1wIjoxNTM0NDAzMDAyLCJob3N0Ijoi
Z2l0aHViLmNvbSJ9">
<meta name="enabled-features"
content="DASHBOARD_V2_LAYOUT_OPT_IN,EXPLORE_DISCOVER_REPOSITORIES,UNIVERSE_BANNER,F
REE_TRIALS,MARKETPLACE_INSIGHTS,MARKETPLACE_PLAN_RESTRICTION_EDITOR,MARKETPLACE_SEA
RCH,MARKETPLACE_INSIGHTS_CONVERSION_PERCENTAGES">
<meta name="html-safe-nonce" content="06d4fc8ab06c4988e10983bb9f387b4edf708a6b">
<meta http-equiv="x-pjax-version" content="60e4fa41ffbcbd51f51925bcc7ea1d9f">
<link href="https://github.com/ThomasThelen/OllyDbg-
Scripts/commits/master.atom" rel="alternate" title="Recent Commits to OllyDbg-
Scripts:master" type="application/atom+xml">
<meta name="go-import" content="github.com/ThomasThelen/OllyDbg-Scripts git

https://github.com/ThomasThelen/OllyDbg-Scripts.git">
<meta name="octolytics-dimension-user_id" content="9289652" /><meta
name="octolytics-dimension-user_login" content="ThomasThelen" /><meta
name="octolytics-dimension-repository_id" content="42685941" /><meta
name="octolytics-dimension-repository_nwo" content="ThomasThelen/OllyDbg-
Scripts" /><meta name="octolytics-dimension-repository_public" content="true"
/><meta name="octolytics-dimension-repository_is_fork" content="false" /><meta
name="octolytics-dimension-repository_network_root_id" content="42685941" /><meta
name="octolytics-dimension-repository_network_root_nwo"
content="ThomasThelen/OllyDbg-Scripts" /><meta name="octolytics-dimension-
repository_explore_github_marketplace_ci_cta_shown" content="false" />
<link rel="canonical" href="https://github.com/ThomasThelen/OllyDbg-

Scripts/blob/master/ZProtect/ZProtect%201.3%20-%201.6%20Full%20Decryption%20%2B
%20Inline%20Patcher%20v1.0.txt" data-pjax-transient>
<meta name="browser-stats-url"
content="https://api.github.com/_private/browser/stats">
<meta name="browser-errors-url"
content="https://api.github.com/_private/browser/errors">
<link rel="mask-icon" href="https://assets-cdn.github.com/pinned-octocat.svg"

color="#000000">
<link rel="icon" type="image/x-icon" class="js-site-favicon"
href="https://assets-cdn.github.com/favicon.ico">
<meta name="theme-color" content="#1e2327">
<meta name="u2f-support" content="true">
<link rel="manifest" href="/manifest.json" crossOrigin="use-credentials">
</head>
<body class="logged-out env-production page-blob">
<div class="position-relative js-header-wrapper ">

<a href="#start-of-content" tabindex="1" class="px-2 py-4 bg-blue text-white
show-on-focus js-skip-to-content">Skip to content</a>
<div id="js-pjax-loader-bar" class="pjax-loader-bar"><div
class="progress"></div></div>
<header class="Header header-logged-out position-relative f4 py-3" role="banner"

>
<div class="container-lg d-flex px-3">
<div class="d-flex flex-justify-between flex-items-center">
<a class="header-logo-invertocat my-0" href="https://github.com/" aria-
label="Homepage" data-ga-click="(Logged out) Header, go to homepage, icon:logo-
wordmark; experiment:site_header_dropdowns; group:control">
<svg height="32" class="octicon octicon-mark-github" viewBox="0 0 16 16"
version="1.1" width="32" aria-hidden="true"><path fill-rule="evenodd" d="M8 0C3.58
0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-
2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01
1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-
3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18
1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08
2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0
1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0 0 16 8c0-4.42-3.58-8-8-
8z"/></svg>
</a>
</div>
<div class="HeaderMenu d-flex flex-justify-between flex-auto">

<nav class="mt-0">
<ul class="d-flex list-style-none">
<li class="ml-2">
<a class="js-selected-navigation-item HeaderNavlink px-0 py-2 m-
0" data-ga-click="Header, click, Nav menu - item:features;
experiment:site_header_dropdowns; group:control" data-selected-links="/features
/features/project-management /features/code-review /features/project-management
/features/integrations /features" href="/features">
Features
</a> </li>
<li class="ml-4">
0" data-ga-click="Header, click, Nav menu - item:business;
experiment:site_header_dropdowns; group:control" data-selected-links="/business
/business/security /business/customers /business" href="/business">
Business
</a> </li>
<li class="ml-4">
0" data-ga-click="Header, click, Nav menu - item:explore;
experiment:site_header_dropdowns; group:control" data-selected-links="/explore
/trending /trending/developers /integrations /integrations/feature/code
/integrations/feature/collaborate /integrations/feature/ship showcases
showcases_search showcases_landing /explore" href="/explore">
Explore
</a> </li>
<li class="ml-4">
<a class="js-selected-navigation-item HeaderNavlink px-0 py-2
m-0" data-ga-click="Header, click, Nav menu - item:marketplace;
experiment:site_header_dropdowns; group:control" data-selected-links="
/marketplace" href="/marketplace">
Marketplace
</a> </li>
<li class="ml-4">
0" data-ga-click="Header, click, Nav menu - item:pricing;
experiment:site_header_dropdowns; group:control" data-selected-links="/pricing
/pricing/developer /pricing/team /pricing/business-hosted /pricing/business-
enterprise /pricing" href="/pricing">
Pricing
</a> </li>
</ul>
</nav>
<div class="d-flex">
<div class="d-lg-flex flex-items-center mr-3">
<div class="header-search scoped-search site-scoped-search js-site-
search position-relative js-jump-to"
role="search combobox"
aria-owns="jump-to-results"
aria-label="Search or jump to"
aria-haspopup="listbox"
aria-expanded="true"
>
<div class="position-relative">
</option></form><form class="js-site-
search-form" data-scope-type="Repository" data-scope-id="42685941" data-scoped-
search-url="/ThomasThelen/OllyDbg-Scripts/search" data-unscoped-search-
url="/search" action="/ThomasThelen/OllyDbg-Scripts/search" accept-charset="UTF-8"
method="get"><input name="utf8" type="hidden" value="✓" />
<label class="form-control header-search-wrapper header-search-wrapper-jump-
to position-relative d-flex flex-justify-between flex-items-center js-chromeless-
input-container">
<input type="text"
class="form-control header-search-input jump-to-field js-jump-to-field
js-site-search-focus js-site-search-field is-clearable"
data-hotkey="s,/"
name="q"
value=""
placeholder="Search"
data-unscoped-placeholder="Search GitHub"
data-scoped-placeholder="Search"
autocapitalize="off"
aria-autocomplete="list"
aria-controls="jump-to-results"
data-jump-to-suggestions-
path="/_graphql/GetSuggestedNavigationDestinations#csrf-
token=D6DTvzXnMphLbHVxGdHMNoKcu/ha8kBiVxWlI8d/P57y9Z+CDXYzLpiTkPedhBmac00vf7mgIIpIi
lOqFM05dA=="
spellcheck="false"
autocomplete="off"
>
<input type="hidden" class="js-site-search-type-field" name="type" >
<img src="https://assets-cdn.github.com/images/search-shortcut-
hint.svg" alt="" class="mr-2 header-search-key-slash">
<div class="Box position-absolute overflow-hidden d-none jump-to-

suggestions js-jump-to-suggestions-container">
<ul class="d-none js-jump-to-suggestions-template-container">
<li class="d-flex flex-justify-start flex-items-center p-0 f5
navigation-item js-navigation-item">
<a tabindex="-1" class="no-underline d-flex flex-auto flex-items-
center p-2 jump-to-suggestions-path js-jump-to-suggestion-path js-navigation-open"
href="">
<div class="jump-to-octicon js-jump-to-octicon mr-2 text-center
d-none"></div>
<img class="avatar mr-2 flex-shrink-0 js-jump-to-suggestion-
avatar" alt="" aria-label="Team" src="" width="28" height="28">
<div class="jump-to-suggestion-name js-jump-to-suggestion-name

flex-auto overflow-hidden text-left no-wrap css-truncate css-truncate-target">
</div>
<div class="border rounded-1 flex-shrink-0 bg-gray px-1 text-

gray-light ml-1 f6 d-none js-jump-to-badge-search">
<span class="js-jump-to-badge-search-text-default d-none"
aria-label="in this repository">
In this repository
</span>
<span class="js-jump-to-badge-search-text-global d-none"
aria-label="in all of GitHub">
All GitHub
</span>
<span aria-hidden="true" class="d-inline-block ml-1 v-align-
middle">↵</span>
</div>
<div aria-hidden="true" class="border rounded-1 flex-shrink-0

bg-gray px-1 text-gray-light ml-1 f6 d-none d-on-nav-focus js-jump-to-badge-jump">
Jump to
<span class="d-inline-block ml-1 v-align-middle">↵</span>
</div>
</a>
</li>
<svg height="16" width="16" class="octicon octicon-repo flex-
shrink-0 js-jump-to-repo-octicon-template" title="Repository" aria-
label="Repository" viewBox="0 0 12 16" version="1.1" role="img"><path fill-
rule="evenodd" d="M4 9H3V8h1v1zm0-3H3v1h1V6zm0-2H3v1h1V4zm0-2H3v1h1V2zm8-1v12c0 .
55-.45 1-1 1H6v2l-1.5-1.5L3 16v-2H1c-.55 0-1-.45-1-1V1c0-.55.45-1 1-1h10c.55 0 1 .
45 1 1zm-1 10H1v2h2v-1h3v1h5v-2zm0-10H2v9h9V1z"/></svg>
<svg height="16" width="16" class="octicon octicon-project flex-
shrink-0 js-jump-to-project-octicon-template" title="Project" aria-label="Project"
viewBox="0 0 15 16" version="1.1" role="img"><path fill-rule="evenodd" d="M10
12h3V2h-3v10zm-4-2h3V2H6v8zm-4 4h3V2H2v12zm-1 1h13V1H1v14zM14 0H1a1 1 0 0 0-1
1v14a1 1 0 0 0 1 1h13a1 1 0 0 0 1-1V1a1 1 0 0 0-1-1z"/></svg>
<svg height="16" width="16" class="octicon octicon-search flex-
shrink-0 js-jump-to-search-octicon-template" title="Search" aria-label="Search"
viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M15.7
13.3l-3.81-3.83A5.93 5.93 0 0 0 13 6c0-3.31-2.69-6-6-6S1 2.69 1 6s2.69 6 6 6c1.3 0
2.48-.41 3.47-1.11l3.83 3.81c.19.2.45.3.7.3.25 0 .52-.09.7-.3a.996.996 0 0 0 0-
1.41v.01zM7 10.7c-2.59 0-4.7-2.11-4.7-4.7 0-2.59 2.11-4.7 4.7-4.7 2.59 0 4.7 2.11
4.7 4.7 0 2.59-2.11 4.7-4.7 4.7z"/></svg>
</ul>
<ul class="d-none js-jump-to-no-results-template-container">
<li class="d-flex flex-justify-center flex-items-center p-3 f5 d-
none">
<span class="text-gray">No suggested jump to results</span>
</li>
</ul>
<ul id="jump-to-results" class="js-navigation-container jump-to-

suggestions-results-container js-jump-to-suggestions-results-container" >
<li class="d-flex flex-justify-center flex-items-center p-0 f5">
<img src="https://assets-cdn.github.com/images/spinners/octocat-
spinner-128.gif" alt="Octocat Spinner Icon" class="m-2" width="28">
</li>
</ul>
</div>
</label>
</form> </div>
</div>
</div>
<span class="d-inline-block">
<div class="HeaderNavlink px-0 py-2 m-0">
<a class="text-bold text-white no-underline" href="/login?
return_to=%2FThomasThelen%2FOllyDbg-Scripts%2Fblob%2Fmaster%2FZProtect%2FZProtect
%25201.3%2520-%25201.6%2520Full%2520Decryption%2520%252B%2520Inline%2520Patcher
%2520v1.0.txt" data-ga-click="(Logged out) Header, clicked Sign in, text:sign-in;
experiment:site_header_dropdowns; group:control">Sign in</a>
<span class="text-gray">or</span>
<a class="text-bold text-white no-underline" href="/join?
source=header-repo" data-ga-click="(Logged out) Header, clicked Sign up, text:sign-
up; experiment:site_header_dropdowns; group:control">Sign up</a>
</div>
</span>
</div>
</div>
</div>
</header>
</div>
<div id="start-of-content" class="show-on-focus"></div>
<div id="js-flash-container">
</div>
<div role="main" class="application-main ">

<div itemscope itemtype="http://schema.org/SoftwareSourceCode" class="">
<div id="js-repo-pjax-container" data-pjax-container >
<div class="pagehead repohead instapaper_ignore readability-menu experiment-repo-

nav ">
<div class="repohead-details-container clearfix container">
<ul class="pagehead-actions">
<li>
<a href="/login?return_to=%2FThomasThelen%2FOllyDbg-Scripts"
class="btn btn-sm btn-with-count tooltipped tooltipped-s"
aria-label="You must be signed in to watch a repository" rel="nofollow">
<svg class="octicon octicon-eye v-align-text-bottom" viewBox="0 0 16 16"
version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd"
d="M8.06 2C3 2 0 8 0 8s3 6 8.06 6C13 14 16 8 16 8s-3-6-7.94-6zM8 12c-2.2 0-4-1.78-
4-4 0-2.2 1.8-4 4-4 2.22 0 4 1.8 4 4 0 2.22-1.78 4-4 4zm2-4c0 1.11-.89 2-2 2-1.11
0-2-.89-2-2 0-1.11.89-2 2-2 1.11 0 2 .89 2 2z"/></svg>
Watch
</a>
<a class="social-count" href="/ThomasThelen/OllyDbg-Scripts/watchers"
aria-label="6 users are watching this repository">
6
</a>
</li>
<li>
aria-label="You must be signed in to star a repository" rel="nofollow">
<svg class="octicon octicon-star v-align-text-bottom" viewBox="0 0 14 16"
d="M14 6l-4.9-.64L7 1 4.9 5.36 0 6l3.6 3.26L2.67 14 7 11.67 11.33 14l-.93-4.74L14
6z"/></svg>
Star
</a>
<a class="social-count js-social-count" href="/ThomasThelen/OllyDbg-

Scripts/stargazers"
aria-label="16 users starred this repository">
16
</a>
</li>
<li>
aria-label="You must be signed in to fork a repository" rel="nofollow">
<svg class="octicon octicon-repo-forked v-align-text-bottom" viewBox="0 0
10 16" version="1.1" width="10" height="16" aria-hidden="true"><path fill-
rule="evenodd" d="M8 1a1.993 1.993 0 0 0-1 3.72V6L5 8 3 6V4.72A1.993 1.993 0 0 0 2
1a1.993 1.993 0 0 0-1 3.72V6.5l3 3v1.78A1.993 1.993 0 0 0 5 15a1.993 1.993 0 0 0 1-
3.72V9.5l3-3V4.72A1.993 1.993 0 0 0 8 1zM2 4.2C1.34 4.2.8 3.65.8 3c0-.65.55-1.2
1.2-1.2.65 0 1.2.55 1.2 1.2 0 .65-.55 1.2-1.2 1.2zm3 10c-.66 0-1.2-.55-1.2-1.2
0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2 1.2 0 .65-.55 1.2-1.2 1.2zm3-10c-.66 0-
1.2-.55-1.2-1.2 0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2 1.2 0 .65-.55 1.2-1.2
1.2z"/></svg>
Fork
</a>
<a href="/ThomasThelen/OllyDbg-Scripts/network/members" class="social-count"

aria-label="13 users forked this repository">
13
</a>
</li>
</ul>
<h1 class="public ">

<svg class="octicon octicon-repo" viewBox="0 0 12 16" version="1.1" width="12"
height="16" aria-hidden="true"><path fill-rule="evenodd" d="M4 9H3V8h1v1zm0-
3H3v1h1V6zm0-2H3v1h1V4zm0-2H3v1h1V2zm8-1v12c0 .55-.45 1-1 1H6v2l-1.5-1.5L3 16v-
2H1c-.55 0-1-.45-1-1V1c0-.55.45-1 1-1h10c.55 0 1 .45 1 1zm-1 10H1v2h2v-1h3v1h5v-
2zm0-10H2v9h9V1z"/></svg>
<span class="author" itemprop="author"><a class="url fn" rel="author"
href="/ThomasThelen">ThomasThelen</a></span><span class="path-divider">/</span><strong itemprop="name"><a data-pjax="#js-repo-pjax-container"
href="/ThomasThelen/OllyDbg-Scripts">OllyDbg-Scripts</a></strong>
</h1>
</div>
<nav class="reponav js-repo-nav js-sidenav-container-pjax container"

itemscope
itemtype="http://schema.org/BreadcrumbList"
role="navigation"
data-pjax="#js-repo-pjax-container">
<span itemscope itemtype="http://schema.org/ListItem" itemprop="itemListElement">

<a class="js-selected-navigation-item selected reponav-item" itemprop="url"
data-hotkey="g c" data-selected-links="repo_source repo_downloads repo_commits
repo_releases repo_tags repo_branches repo_packages /ThomasThelen/OllyDbg-Scripts"
href="/ThomasThelen/OllyDbg-Scripts">
<svg class="octicon octicon-code" viewBox="0 0 14 16" version="1.1"
width="14" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M9.5 3L8 4.5
11.5 8 8 11.5 9.5 13 14 8 9.5 3zm-5 0L0 8l4.5 5L6 11.5 2.5 8 6 4.5 4.5 3z"/></svg>
<span itemprop="name">Code</span>
<meta itemprop="position" content="1">
</a> </span>
<span itemscope itemtype="http://schema.org/ListItem"

itemprop="itemListElement">
<a itemprop="url" data-hotkey="g i" class="js-selected-navigation-item
reponav-item" data-selected-links="repo_issues repo_labels repo_milestones
/ThomasThelen/OllyDbg-Scripts/issues" href="/ThomasThelen/OllyDbg-Scripts/issues">
<svg class="octicon octicon-issue-opened" viewBox="0 0 14 16" version="1.1"
width="14" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M7 2.3c3.14
0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-
5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0
6H6v2h2v-2z"/></svg>
<span itemprop="name">Issues</span>
<span class="Counter">0</span>
</a> </span>
<span itemscope itemtype="http://schema.org/ListItem" itemprop="itemListElement">

<a data-hotkey="g p" itemprop="url" class="js-selected-navigation-item reponav-
item" data-selected-links="repo_pulls checks /ThomasThelen/OllyDbg-Scripts/pulls"
href="/ThomasThelen/OllyDbg-Scripts/pulls">
<svg class="octicon octicon-git-pull-request" viewBox="0 0 12 16"
d="M11 11.28V5c-.03-.78-.34-1.47-.94-2.06C9.46 2.35 8.78 2.03 8 2H7V0L4 3l3
3V4h1c.27.02.48.11.69.31.21.2.3.42.31.69v6.28A1.993 1.993 0 0 0 10 15a1.993 1.993 0
0 0 1-3.72zm-1 2.92c-.66 0-1.2-.55-1.2-1.2 0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2 1.2
0 .65-.55 1.2-1.2 1.2zM4 3c0-1.11-.89-2-2-2a1.993 1.993 0 0 0-1 3.72v6.56A1.993
1.993 0 0 0 2 15a1.993 1.993 0 0 0 1-3.72V4.72c.59-.34 1-.98 1-1.72zm-.8 10c0 .
66-.55 1.2-1.2 1.2-.65 0-1.2-.55-1.2-1.2 0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2
1.2zM2 4.2C1.34 4.2.8 3.65.8 3c0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2 1.2 0 .65-.55
1.2-1.2 1.2z"/></svg>
<span itemprop="name">Pull requests</span>
<span class="Counter">0</span>
</a> </span>
<a data-hotkey="g b" class="js-selected-navigation-item reponav-item" data-

selected-links="repo_projects new_repo_project repo_project /ThomasThelen/OllyDbg-
Scripts/projects" href="/ThomasThelen/OllyDbg-Scripts/projects">
<svg class="octicon octicon-project" viewBox="0 0 15 16" version="1.1"
width="15" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M10 12h3V2h-
3v10zm-4-2h3V2H6v8zm-4 4h3V2H2v12zm-1 1h13V1H1v14zM14 0H1a1 1 0 0 0-1 1v14a1 1 0 0
0 1 1h13a1 1 0 0 0 1-1V1a1 1 0 0 0-1-1z"/></svg>
Projects
<span class="Counter" >0</span>
</a>
<a class="js-selected-navigation-item reponav-item" data-selected-

links="repo_graphs repo_contributors dependency_graph pulse /ThomasThelen/OllyDbg-
Scripts/pulse" href="/ThomasThelen/OllyDbg-Scripts/pulse">
<svg class="octicon octicon-graph" viewBox="0 0 16 16" version="1.1" width="16"
height="16" aria-hidden="true"><path fill-rule="evenodd" d="M16 14v1H0V0h1v14h15zM5
13H3V8h2v5zm4 0H7V3h2v10zm4 0h-2V6h2v7z"/></svg>
Insights
</a>
</nav>
</div>
<div class="container new-discussion-timeline experiment-repo-nav ">

<div class="repository-content ">
<a class="d-none js-permalink-shortcut" data-hotkey="y"

href="/ThomasThelen/OllyDbg-
Scripts/blob/a1956715a19f49edc910a633f3d4d9fb323b76d7/ZProtect/ZProtect%201.3%20-
%201.6%20Full%20Decryption%20%2B%20Inline%20Patcher%20v1.0.txt">Permalink</a>

<div class="signup-prompt-bg rounded-1">

<div class="signup-prompt p-4 text-center mb-4 rounded-1">
<div class="position-relative">
</option></form><form
action="/site/dismiss_signup_prompt" accept-charset="UTF-8" method="post"><input
name="utf8" type="hidden" value="✓" /><input type="hidden"
name="authenticity_token"
value="x9U8jT2WcNmyV0UMOKfIsm6Ov3uQXVd2gNn+tj47Gdemt0Hi+j43hmm5DWcyoj6ziw+S83sDtSpG
Wa1bnt9C5w==" />
<button type="submit" class="position-absolute top-0 right-0 btn-link
link-gray" data-ga-click="(Logged out) Sign up prompt, clicked Dismiss,
text:dismiss">
Dismiss
</button>
</form> <h3 class="pt-2">Join GitHub today</h3>
<p class="col-6 mx-auto">GitHub is home to over 28 million developers
working together to host and review code, manage projects, and build software
together.</p>
<a class="btn btn-primary" href="/join?source=prompt-blob-show" data-ga-
click="(Logged out) Sign up prompt, clicked Sign up, text:sign-up">Sign up</a>
</div>
</div>
</div>
<div class="file-navigation">
<div class="select-menu branch-select-menu js-menu-container js-select-menu float-

left">
<button class=" btn btn-sm select-menu-button js-menu-target css-truncate" data-
hotkey="w"
type="button" aria-label="Switch branches or tags" aria-expanded="false" aria-

haspopup="true">
<i>Branch:</i>
<span class="js-select-button css-truncate-target">master</span>
</button>
<div class="select-menu-modal-holder js-menu-content js-navigation-container"

data-pjax>
<div class="select-menu-modal">
<div class="select-menu-header">
<svg class="octicon octicon-x js-menu-close" role="img" aria-label="Close"
viewBox="0 0 12 16" version="1.1" width="12" height="16"><path fill-rule="evenodd"
d="M7.48 8l3.75 3.75-1.48 1.48L6 9.48l-3.75 3.75-1.48-1.48L4.52 8 .77 4.25l1.48-
1.48L6 6.52l3.75-3.75 1.48 1.48L7.48 8z"/></svg>
<span class="select-menu-title">Switch branches/tags</span>
</div>
<div class="select-menu-filters">
<div class="select-menu-text-filter">
<input type="text" aria-label="Filter branches/tags" id="context-
commitish-filter-field" class="form-control js-filterable-field js-navigation-
enable" placeholder="Filter branches/tags">
</div>
<div class="select-menu-tabs">
<ul>
<li class="select-menu-tab">
<a href="#" data-tab-filter="branches" data-filter-
placeholder="Filter branches/tags" class="js-select-menu-tab"
role="tab">Branches</a>
</li>
<li class="select-menu-tab">
<a href="#" data-tab-filter="tags" data-filter-placeholder="Find a
tag…" class="js-select-menu-tab" role="tab">Tags</a>
</li>
</ul>
</div>
</div>
<div class="select-menu-list select-menu-tab-bucket js-select-menu-tab-

bucket" data-tab-filter="branches" role="menu">
<div data-filterable-for="context-commitish-filter-field" data-filterable-

type="substring">
<a class="select-menu-item js-navigation-item js-navigation-open
selected"
href="/ThomasThelen/OllyDbg-Scripts/blob/master/ZProtect/ZProtect
%201.3%20-%201.6%20Full%20Decryption%20+%20Inline%20Patcher%20v1.0.txt"
data-name="master"
data-skip-pjax="true"
rel="nofollow">
<svg class="octicon octicon-check select-menu-item-icon" viewBox="0 0
12 16" version="1.1" width="12" height="16" aria-hidden="true"><path fill-
rule="evenodd" d="M12 5l-8 8-4-4 1.5-1.5L4 10l6.5-6.5L12 5z"/></svg>
<span class="select-menu-item-text css-truncate-target js-select-
menu-filter-text">
master
</span>
</a>
</div>
<div class="select-menu-no-results">Nothing to show</div>

</div>
<div class="select-menu-list select-menu-tab-bucket js-select-menu-tab-

bucket" data-tab-filter="tags">
<div data-filterable-for="context-commitish-filter-field" data-filterable-
type="substring">
</div>
<div class="select-menu-no-results">Nothing to show</div>

</div>
</div>
</div>
</div>
<div class="BtnGroup float-right">

<a href="/ThomasThelen/OllyDbg-Scripts/find/master"
class="js-pjax-capture-input btn btn-sm BtnGroup-item"
data-pjax
data-hotkey="t">
Find file
</a>
<clipboard-copy for="blob-path" class="btn btn-sm BtnGroup-item">
Copy path
</clipboard-copy>
</div>
<div id="blob-path" class="breadcrumb">
<span class="repo-root js-repo-root"><span class="js-path-segment"><a data-
pjax="true" href="/ThomasThelen/OllyDbg-Scripts"><span>OllyDbg-
Scripts</span></a></span></span><span class="separator">/</span><span class="js-
path-segment"><a data-pjax="true" href="/ThomasThelen/OllyDbg-
Scripts/tree/master/ZProtect"><span>ZProtect</span></a></span><span
class="separator">/</span><strong class="final-path">ZProtect 1.3 - 1.6 Full
Decryption + Inline Patcher v1.0.txt</strong>
</div>
</div>
<include-fragment src="/ThomasThelen/OllyDbg-
Scripts/contributors/master/ZProtect/ZProtect%201.3%20-%201.6%20Full%20Decryption
%20+%20Inline%20Patcher%20v1.0.txt" class="commit-tease commit-loader">
<div>
Fetching contributors…
</div>
<div class="commit-tease-contributors">
<img alt="" class="loader-loading float-left" src="https://assets-
cdn.github.com/images/spinners/octocat-spinner-32-EAF2F5.gif" width="16"
height="16" />
<span class="loader-error">Cannot retrieve contributors at this time</span>
</div>
</include-fragment>
<div class="file">
<div class="file-header">
<div class="file-actions">
<div class="BtnGroup">
<a id="raw-url" class="btn btn-sm BtnGroup-item" href="/ThomasThelen/OllyDbg-
Scripts/raw/master/ZProtect/ZProtect%201.3%20-%201.6%20Full%20Decryption%20%2B
%20Inline%20Patcher%20v1.0.txt">Raw</a>
<a class="btn btn-sm js-update-url-with-hash BtnGroup-item" data-hotkey="b"
href="/ThomasThelen/OllyDbg-Scripts/blame/master/ZProtect/ZProtect%201.3%20-
%201.6%20Full%20Decryption%20%2B%20Inline%20Patcher%20v1.0.txt">Blame</a>
<a rel="nofollow" class="btn btn-sm BtnGroup-item"
href="/ThomasThelen/OllyDbg-Scripts/commits/master/ZProtect/ZProtect%201.3%20-
%201.6%20Full%20Decryption%20%2B%20Inline%20Patcher%20v1.0.txt">History</a>
</div>
<a class="btn-octicon tooltipped tooltipped-nw"

href="https://desktop.github.com"
aria-label="Open this file in GitHub Desktop"
data-ga-click="Repository, open with desktop, type:windows">
<svg class="octicon octicon-device-desktop" viewBox="0 0 16 16"
d="M15 2H1c-.55 0-1 .45-1 1v9c0 .55.45 1 1 1h5.34c-.25.61-.86 1.39-2.34 2h8c-
1.48-.61-2.09-1.39-2.34-2H15c.55 0 1-.45 1-1V3c0-.55-.45-1-1-1zm0
9H1V3h14v8z"/></svg>
</a>
<button type="button" class="btn-octicon disabled tooltipped tooltipped-nw"

aria-label="You must be signed in to make or propose changes">
<svg class="octicon octicon-pencil" viewBox="0 0 14 16" version="1.1"
width="14" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M0 12v3h3l8-
8-3-3-8 8zm3 2H1v-2h1v1h1v1zm10.3-9.3L12 6 9 3l1.3-1.3a.996.996 0 0 1 1.41 0l1.59
1.59c.39.39.39 1.02 0 1.41z"/></svg>
</button>
<button type="button" class="btn-octicon btn-octicon-danger disabled
tooltipped tooltipped-nw"
aria-label="You must be signed in to make or propose changes">
<svg class="octicon octicon-trashcan" viewBox="0 0 12 16" version="1.1"
width="12" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M11
2H9c0-.55-.45-1-1-1H5c-.55 0-1 .45-1 1H2c-.55 0-1 .45-1 1v1c0 .55.45 1 1 1v9c0 .
55.45 1 1 1h7c.55 0 1-.45 1-1V5c.55 0 1-.45 1-1V3c0-.55-.45-1-1-1zm-1
12H3V5h1v8h1V5h1v8h1V5h1v8h1V5h1v9zm1-10H2V3h9v1z"/></svg>
</button>
</div>
<div class="file-info">
5059 lines (2504 sloc)
<span class="file-info-divider"></span>
61.8 KB
</div>
</div>
<div itemprop="text" class="blob-wrapper data type-text">

<table class="highlight tab-size js-file-line-container" data-tab-size="8">
<tr>
<td id="L1" class="blob-num js-line-number" data-line-number="1"></td>
<td id="LC1" class="blob-code blob-code-inner js-file-
line">////////////////////////Château-Saint-
Martin///////////////////////////////////////////////////////////////////////////
</td>
</tr>
<tr>
<td id="LC2" class="blob-code blob-code-inner js-file-line">//
//////////////////////////////////////////////</td>
</tr>
<tr>
<td id="LC3" class="blob-code blob-code-inner js-file-line">// FileName
: ZProtect Full DeCryption & InLine Patcher
1.0 /////////////////////////////////////////////</td>
</tr>
<tr>
<td id="LC4" class="blob-code blob-code-inner js-file-line">// Features
: ///////////////////////////
/////////////////</td>
</tr>
<tr>
With this script you can get the DeCrypt
string ///////////////////////////////////////////</td>
</tr>
<tr>
which allow you to bypass the HWID reg
sheme //////////////////////////////////////////</td>
</tr>
<tr>
without to have a valid HWID Name and
Key.This /////////////////////////////////////////</td>
</tr>
<tr>
script also support's a InLine technic to
patch ////////////////////////////////////////</td>
</tr>
<tr>
your new DeCrypt string permanently in your
target. ///////////////////////////////////////</td>
</tr>
<tr>
It find and re-calc also the old & new CRC
DWORD. //////////////////////////////////////</td>
</tr>
<tr>
Dll files are also possible to
patch. /////////////////////////////////////</td>
</tr>
<tr>
////////////////////////////////////</td>
</tr>
<tr>
*************************************************** ///////////////////////////////
////</td>
</tr>
<tr>
( 1.) DeCrypt String Find & Patching / Break at OEP
* //////////////////////////////////</td>
</tr>
<tr>
* /////////////////////////////////</td>
</tr>
<tr>
( 2.) DeCrypt InLine Patching
* ////////////////////////////////</td>
</tr>
<tr>
* ///////////////////////////////</td>
</tr>
<tr>
( 3.) Double API Hook Patching
* //////////////////////////////</td>
</tr>
<tr>
* /////////////////////////////</td>
</tr>
<tr>
( 4.) Creating a fast & short DeCrypt Script
* ////////////////////////////</td>
</tr>
<tr>
* ///////////////////////////</td>
</tr>
<tr>
( 5.) New & Old CRC DWORD Calculation x3
* //////////////////////////</td>
</tr>
<tr>
* /////////////////////////</td>
</tr>
<tr>
( 6.) DLL DeCrypt Patch & Dynamic ImageBase Support * ////////////////////////
</td>
</tr>
<tr>
* ///////////////////////</td>
</tr>
<tr>
( 7.) ZProtect 1.4.x - 1.6.x * //////////////////////</td>
</tr>
<tr>
* /////////////////////</td>
</tr>
<tr>
How to Use Information's | Step List Choice * ////////////////////</td>
</tr>
<tr>
*************************************************** ///////////////////</td>
</tr>
<tr>
You have 3 Steps | Choose this way | 1. 2. 3. * //////////////////</td>
</tr>
<tr>
* /////////////////</td>
</tr>
<tr>
*1 <- Let patch & LOG the new DeCrypt Infos * ////////////////</td>
</tr>
<tr>
*2 <- Add a new section called .MaThiO * ///////////////</td>
</tr>
<tr>
*3 <- Add 3 API Imports * //////////////</td>
</tr>
<tr>
*4 <- Let write the DeCrypt InLine Template /save * /////////////</td>
</tr>
<tr>
*5 <- Change EP / Set section to writabe * ////////////</td>
</tr>
<tr>
*6 <- Find new CRC DWORD / save * ///////////</td>
</tr>
<tr>
*7 <- Done! * //////////</td>
</tr>
<tr>
*************************************************** /////////</td>
</tr>
<tr>
Environment : WinXP,OllyDbg V1.10,OllyScript v1.77.3, ////////</td>
</tr>
<tr>
Import Adder Tool - LordPE, SecAdd Tool ///////</td>
</tr>
<tr>
////// /
/////</td>
</tr>
<tr>
<td id="LC43" class="blob-code blob-code-inner js-file-line">// Author
: LCF-AT /////</td>
</tr>
<tr>
<td id="LC44" class="blob-code blob-code-inner js-file-line">// Date
: 2010-16-10 | October ////</td>
</tr>
<tr>
///</td>
</tr>
<tr>
///</td>
</tr>
<tr>
line">///////////////WILLST DU SPAREN,DANN MUßT DU SPAREN!/////////////////////
</td>
</tr>
<tr>
<td id="LC48" class="blob-code blob-code-inner js-file-line">BC</td>
</tr>
<tr>
<td id="LC49" class="blob-code blob-code-inner js-file-line">BPMC</td>
</tr>
<tr>
<td id="LC50" class="blob-code blob-code-inner js-file-line">BPHWC</td>
</tr>
<tr>
<td id="LC51" class="blob-code blob-code-inner js-file-line">call VARS</td>
</tr>
<tr>
<td id="LC52" class="blob-code blob-code-inner js-file-line">pause</td>
</tr>
<tr>
<td id="LC53" class="blob-code blob-code-inner js-file-line">LC</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC55" class="blob-code blob-code-inner js-file-line">GPI
EXEFILENAME</td>
</tr>
<tr>
<td id="LC56" class="blob-code blob-code-inner js-file-line">mov
EXEFILENAME, $RESULT</td>
</tr>
<tr>
<td id="LC57" class="blob-code blob-code-inner js-file-line">len
EXEFILENAME</td>
</tr>
<tr>
EXEFILENAME_COUNT, $RESULT</td>
</tr>
<tr>
<td id="LC59" class="blob-code blob-code-inner js-file-line">sub
EXEFILENAME_COUNT, 03</td>
</tr>
<tr>
<td id="LC60" class="blob-code blob-code-inner js-file-line">alloc 1000
</td>
</tr>
<tr>
<td id="LC61" class="blob-code blob-code-inner js-file-line">mov testsec,
$RESULT</td>
</tr>
<tr>
<td id="LC62" class="blob-code blob-code-inner js-file-line">mov [testsec],
EXEFILENAME</td>
</tr>
<tr>
<td id="LC63" class="blob-code blob-code-inner js-file-line">add testsec,
EXEFILENAME_COUNT</td>
</tr>
<tr>
<td id="LC64" class="blob-code blob-code-inner js-file-line">scmpi
[testsec], "exe"</td>
</tr>
<tr>
<td id="LC65" class="blob-code blob-code-inner js-file-line">je FOUNDEND
</td>
</tr>
<tr>
[testsec], "EXE"</td>
</tr>
<tr>
</td>
</tr>
<tr>
[testsec], "dll"</td>
</tr>
<tr>
</td>
</tr>
<tr>
[testsec], "DLL"</td>
</tr>
<tr>
</td>
</tr>
<tr>
<td id="LC72" class="blob-code blob-code-inner js-file-line">eval "
{scriptname} \r\n\r\n{points} \r\n\r\nYour loaded file is no DLL or Exe so fix this
and try it again! \r\n\r\nChange to dll or exe! \r\n\r\n{points} \r\n{ME}"
</td>
</tr>
<tr>
<td id="LC73" class="blob-code blob-code-inner js-file-line">msg $RESULT
</td>
</tr>
<tr>
<td id="LC74" class="blob-code blob-code-inner js-file-line">jmp FULL_END
</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC76" class="blob-code blob-code-inner js-file-line">ret</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC78" class="blob-code blob-code-inner js-file-line">FOUNDEND:</td>
</tr>
<tr>
<td id="LC79" class="blob-code blob-code-inner js-file-line">readstr
[testsec], 03</td>
</tr>
<tr>
<td id="LC80" class="blob-code blob-code-inner js-file-line">str $RESULT
</td>
</tr>
<tr>
<td id="LC81" class="blob-code blob-code-inner js-file-line">mov CHAR,
$RESULT</td>
</tr>
<tr>
<td id="LC82" class="blob-code blob-code-inner js-file-line">sub testsec,
</tr>
<tr>
<td id="LC83" class="blob-code blob-code-inner js-file-line">free testsec
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC86" class="blob-code blob-code-inner js-file-line">GPI PROCESSID
</td>
</tr>
<tr>
<td id="LC87" class="blob-code blob-code-inner js-file-line">mov PROCESSID,
$RESULT</td>
</tr>
<tr>
PROCESSNAME</td>
</tr>
<tr>
PROCESSNAME, $RESULT</td>
</tr>
<tr>
PROCESSNAME_2, $RESULT</td>
</tr>
<tr>
<td id="LC91" class="blob-code blob-code-inner js-file-line">len
PROCESSNAME</td>
</tr>
<tr>
PROCESSNAME_COUNT, $RESULT</td>
</tr>
<tr>
<td id="LC93" class="blob-code blob-code-inner js-file-line">buf
PROCESSNAME_COUNT</td>
</tr>
<tr>
</td>
</tr>
<tr>
PROCESSNAME_FREE_SPACE, $RESULT</td>
</tr>
<tr>
PROCESSNAME_FREE_SPACE_2, $RESULT</td>
</tr>
<tr>
<td id="LC97" class="blob-code blob-code-inner js-file-line">mov EIP_STORE,
eip</td>
</tr>
<tr>
<td id="LC98" class="blob-code blob-code-inner js-file-line">mov eip,
PROCESSNAME_FREE_SPACE</td>
</tr>
<tr>
[PROCESSNAME_FREE_SPACE], PROCESSNAME</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
line">PROCESSNAME_CHECK:</td>
</tr>
<tr>
<td id="LC102" class="blob-code blob-code-inner js-file-line">cmp
[PROCESSNAME_FREE_SPACE],00</td>
</tr>
<tr>
<td id="LC103" class="blob-code blob-code-inner js-file-line">je
PROCESSNAME_CHECK_02</td>
</tr>
<tr>
[PROCESSNAME_FREE_SPACE],#20#, 01</td>
</tr>
<tr>
</tr>
<tr>
[PROCESSNAME_FREE_SPACE],#2E#, 01</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC108" class="blob-code blob-code-inner js-file-line">inc
</tr>
<tr>
<td id="LC109" class="blob-code blob-code-inner js-file-line">jmp
PROCESSNAME_CHECK</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
line">PROCESSNAME_CHECK_01:</td>
</tr>
<tr>
[PROCESSNAME_FREE_SPACE], #5F#, 01</td>
</tr>
<tr>
PROCESSNAME_CHECK</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
line">PROCESSNAME_CHECK_02:</td>
</tr>
<tr>
[PROCESSNAME_FREE_SPACE_2], 08</td>
</tr>
<tr>
PROCESSNAME, $RESULT</td>
</tr>
<tr>
<td id="LC118" class="blob-code blob-code-inner js-file-line">str
PROCESSNAME</td>
</tr>
<tr>
EIP_STORE</td>
</tr>
<tr>
<td id="LC120" class="blob-code blob-code-inner js-file-line">free
</tr>
<tr>
<td id="LC121" class="blob-code blob-code-inner js-file-line">/////</td>
</tr>
<tr>
<td id="LC122" class="blob-code blob-code-inner js-file-line">refresh eip
</td>
</tr>
<tr>
<td id="LC123" class="blob-code blob-code-inner js-file-line">GMA
PROCESSNAME, MODULEBASE</td>
</tr>
<tr>
<td id="LC124" class="blob-code blob-code-inner js-file-line">cmp $RESULT,
0</td>
</tr>
<tr>
<td id="LC125" class="blob-code blob-code-inner js-file-line">jne
MODULEBASE</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC129" class="blob-code blob-code-inner js-file-line">MODULEBASE:
</td>
</tr>
<tr>
MODULEBASE, $RESULT</td>
</tr>
<tr>
PE_HEADER, $RESULT</td>
</tr>
<tr>
CURRENTDIR</td>
</tr>
<tr>
CURRENTDIR, $RESULT</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC135" class="blob-code blob-code-inner js-file-line">gmemi
PE_HEADER, MEMORYSIZE</td>
</tr>
<tr>
PE_HEADER_SIZE, $RESULT</td>
</tr>
<tr>
<td id="LC137" class="blob-code blob-code-inner js-file-line">add
CODESECTION, MODULEBASE</td>
</tr>
<tr>
CODESECTION, PE_HEADER_SIZE</td>
</tr>
<tr>
<td id="LC139" class="blob-code blob-code-inner js-file-line">GMI
MODULEBASE, MODULESIZE</td>
</tr>
<tr>
MODULESIZE, $RESULT</td>
</tr>
<tr>
MODULEBASE_and_MODULESIZE, MODULEBASE</td>
</tr>
<tr>
MODULEBASE_and_MODULESIZE, MODULESIZE</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
CODESECTION, MEMORYSIZE</td>
</tr>
<tr>
CODESECTION_SIZE, $RESULT</td>
</tr>
<tr>
PE_HEADER, 03C</td>
</tr>
<tr>
PE_SIGNATURE, PE_HEADER</td>
</tr>
<tr>
PE_HEADER, 03C</td>
</tr>
<tr>
<td id="LC149" class="blob-code blob-code-inner js-file-line">mov PE_SIZE,
[PE_SIGNATURE]</td>
</tr>
<tr>
PE_INFO_START, PE_HEADER</td>
</tr>
<tr>
PE_INFO_START, PE_SIZE</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC153" class="blob-code blob-code-inner js-file-line">mov PE_TEMP,
PE_INFO_START</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC156" class="blob-code blob-code-inner js-file-line">mov SECTIONS,
[PE_TEMP+06], 01</td>
</tr>
<tr>
<td id="LC157" class="blob-code blob-code-inner js-file-line">itoa
SECTIONS, 10.</td>
</tr>
<tr>
<td id="LC158" class="blob-code blob-code-inner js-file-line">mov SECTIONS,
$RESULT</td>
</tr>
<tr>
ENTRYPOINT, [PE_TEMP+028]</td>
</tr>
<tr>
BASE_OF_CODE, [PE_TEMP+02C]</td>
</tr>
<tr>
IMAGEBASE, [PE_TEMP+034]</td>
</tr>
<tr>
IMAGEBASE, MODULEBASE</td>
</tr>
<tr>
<td id="LC163" class="blob-code blob-code-inner js-file-line">je PE_GO</td>
</tr>
<tr>
<td id="LC164" class="blob-code blob-code-inner js-file-line">mov IBS,
IMAGEBASE</td>
</tr>
<tr>
IMAGEBASE, MODULEBASE</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC167" class="blob-code blob-code-inner js-file-line">PE_GO:</td>
</tr>
<tr>
SIZE_OF_IMAGE, [PE_TEMP+050]</td>
</tr>
<tr>
TLS_TABLE_ADDRESS, [PE_TEMP+0C0]</td>
</tr>
<tr>
TLS_TABLE_SIZE, [PE_TEMP+0C4]</td>
</tr>
<tr>
IMPORT_TABLE_ADDRESS, [PE_TEMP+080]</td>
</tr>
<tr>
IMPORT_TABLE_SIZE, [PE_TEMP+084]</td>
</tr>
<tr>
IMPORT_ADDRESS_TABLE, [PE_TEMP+0D8]</td>
</tr>
<tr>
<td id="LC174" class="blob-code blob-code-inner js-file-line">mov IATSTORE,
[PE_TEMP+0D8]</td>
</tr>
<tr>
ENTRYPOINT, IMAGEBASE</td>
</tr>
<tr>
<td id="LC176" class="blob-code blob-code-inner js-file-line">mov KULI,01
</td>
</tr>
<tr>
{PROCESSNAME_2}_Some_Infos.txt"</td>
</tr>
<tr>
<td id="LC178" class="blob-code blob-code-inner js-file-line">mov sFileA,
$RESULT</td>
</tr>
<tr>
<td id="LC179" class="blob-code blob-code-inner js-file-line">wrta sFileA,
$RESULT</td>
</tr>
<tr>
" "</td>
</tr>
<tr>
{scriptname} \r\n\r\n{points} \r\n\r\nPress >>> YES <<< to find
and patch the new CRC DWORD <<<-- 3 Step = LAST STEP\r\n\r\n{points}
\r\n{ME}"</td>
</tr>
<tr>
<td id="LC182" class="blob-code blob-code-inner js-file-line">msgyn $RESULT
</td>
</tr>
<tr>
01</td>
</tr>
<tr>
START_OF_CRCCHECK</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC186" class="blob-code blob-code-inner js-file-line">je EIP_CHECK
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC191" class="blob-code blob-code-inner js-file-line">EIP_CHECK:
</td>
</tr>
<tr>
<td id="LC192" class="blob-code blob-code-inner js-file-line">cmp CHAR,
"exe"</td>
</tr>
<tr>
EIP_CHECK_IN_A</td>
</tr>
<tr>
"EXE"</td>
</tr>
<tr>
EIP_CHECK_IN_A</td>
</tr>
<tr>
<td id="LC196" class="blob-code blob-code-inner js-file-line">jmp START
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
line">EIP_CHECK_IN_A:</td>
</tr>
<tr>
<td id="LC199" class="blob-code blob-code-inner js-file-line">mov STUCK, 01
</td>
</tr>
<tr>
{scriptname} \r\n\r\n{points} \r\n\r\nDo you want to enter a OEP address?
\r\n\r\n{points} \r\n{ME}"</td>
</tr>
<tr>
</td>
</tr>
<tr>
01</td>
</tr>
<tr>
EIP_CHECK_IN</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC205" class="blob-code blob-code-inner js-file-line">ASKME:</td>
</tr>
<tr>
<td id="LC206" class="blob-code blob-code-inner js-file-line">Ask
"Enter OEP address if you already know and if you want to use it!"</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC208" class="blob-code blob-code-inner js-file-line">je ASKME</td>
</tr>
<tr>
-1</td>
</tr>
<tr>
<td id="LC210" class="blob-code blob-code-inner js-file-line">je ASKME</td>
</tr>
<tr>
<td id="LC211" class="blob-code blob-code-inner js-file-line">mov OEP,
$RESULT</td>
</tr>
<tr>
<td id="LC212" class="blob-code blob-code-inner js-file-line">bphws OEP,
"x"</td>
</tr>
<tr>
OEP_EXTRA, 01</td>
</tr>
<tr>
<td id="LC214" class="blob-code blob-code-inner js-file-line">jmp START
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC216" class="blob-code blob-code-inner js-file-line">EIP_CHECK_IN:
</td>
</tr>
<tr>
<td id="LC217" class="blob-code blob-code-inner js-file-line">mov KULI, 00
</td>
</tr>
<tr>
ENTRYPOINT, eip</td>
</tr>
<tr>
<td id="LC219" class="blob-code blob-code-inner js-file-line">je START</td>
</tr>
<tr>
<td id="LC220" class="blob-code blob-code-inner js-file-line">bphws
ENTRYPOINT, "x"</td>
</tr>
<tr>
<td id="LC221" class="blob-code blob-code-inner js-file-line">bp ENTRYPOINT
</td>
</tr>
<tr>
<td id="LC222" class="blob-code blob-code-inner js-file-line">esto</td>
</tr>
<tr>
<td id="LC223" class="blob-code blob-code-inner js-file-line">bphwc</td>
</tr>
<tr>
<td id="LC224" class="blob-code blob-code-inner js-file-line">bc</td>
</tr>
<tr>
EIP_CHECK_IN</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC227" class="blob-code blob-code-inner js-file-line">START:</td>
</tr>
<tr>
{scriptname} \r\n\r\n{points} \r\n\r\nPress >>> YES <<< to find
& patch & create the new DeCrypt string <<<-- 1 Step
\r\n\r\nPress >>> NO <<< for patching the DeCrypt InLine Template
<<<-- 2 Step \r\n\r\n{points} \r\n{ME}"
</td>
</tr>
<tr>
</td>
</tr>
<tr>
00</td>
</tr>
<tr>
START_OF_INLINE</td>
</tr>
<tr>
01</td>
</tr>
<tr>
<td id="LC233" class="blob-code blob-code-inner js-file-line">je START_2S
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC238" class="blob-code blob-code-inner js-file-line">START_2S:
</td>
</tr>
<tr>
OEP_EXTRA, 01</td>
</tr>
<tr>
ESP_TRICK_2</td>
</tr>
<tr>
<td id="LC241" class="blob-code blob-code-inner js-file-line">mov 1ESP, eip
</td>
</tr>
<tr>
<td id="LC242" class="blob-code blob-code-inner js-file-line">cmp [eip],
#60#, 01</td>
</tr>
<tr>
<td id="LC243" class="blob-code blob-code-inner js-file-line">je STI_TEST
</td>
</tr>
<tr>
<td id="LC244" class="blob-code blob-code-inner js-file-line">sti</td>
</tr>
<tr>
<td id="LC245" class="blob-code blob-code-inner js-file-line">jmp START_2S
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC247" class="blob-code blob-code-inner js-file-line">STI_TEST:
</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC249" class="blob-code blob-code-inner js-file-line">cmp eip, 1ESP
</td>
</tr>
<tr>
<td id="LC250" class="blob-code blob-code-inner js-file-line">je STI_TEST
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC252" class="blob-code blob-code-inner js-file-line">ESP_TRICK:
</td>
</tr>
<tr>
<td id="LC253" class="blob-code blob-code-inner js-file-line">mov STUCK, 01
</td>
</tr>
<tr>
<td id="LC254" class="blob-code blob-code-inner js-file-line">mov ESP_OEP,
esp</td>
</tr>
<tr>
ESP_OEP, "r"</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC257" class="blob-code blob-code-inner js-file-line">ESP_TRICK_2:
</td>
</tr>
<tr>
VirtualAlloc, "x"</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC260" class="blob-code blob-code-inner js-file-line">cmp eip,
VirtualAlloc</td>
</tr>
<tr>
CODESECTION_STOP_CHECK</td>
</tr>
<tr>
<td id="LC262" class="blob-code blob-code-inner js-file-line">rtr</td>
</tr>
<tr>
<td id="LC263" class="blob-code blob-code-inner js-file-line">mov ZPSEC,
eax</td>
</tr>
<tr>
ZPSEC_SIZE, [esp+08]</td>
</tr>
<tr>
DialogBoxIndirectParamA, "x"</td>
</tr>
<tr>
</tr>
<tr>
DialogBoxIndirectParamA</td>
</tr>
<tr>
<td id="LC268" class="blob-code blob-code-inner js-file-line">je NEW_HERE
</td>
</tr>
<tr>
VirtualAlloc</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
<td id="LC272" class="blob-code blob-code-inner js-file-line">bphwc
VirtualAlloc</td>
</tr>
<tr>
<td id="LC273" class="blob-code blob-code-inner js-file-line">find ZPSEC,
#7?????????????????3D2C230000#</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC275" class="blob-code blob-code-inner js-file-line">jne SIGN_2
</td>
</tr>
<tr>
<td id="LC276" class="blob-code blob-code-inner js-file-line"></td>
</tr>
<tr>
#7???????????????????3D2C230000#</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC279" class="blob-code blob-code-inner js-file-line">je BOX</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC283" class="blob-code blob-code-inner js-file-line">SIGN_2:</td>
</tr>
<tr>
<td id="LC284" class="blob-code blob-code-inner js-file-line">mov SIGN,
$RESULT</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC286" class="blob-code blob-code-inner js-file-line">mov [SIGN],
#EB#, 01</td>
</tr>
<tr>
<td id="LC287" class="blob-code blob-code-inner js-file-line">mov TONNE, 01
</td>
</tr>
<tr>
<td id="LC288" class="blob-code blob-code-inner js-file-line">jmp FIND</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC290" class="blob-code blob-code-inner js-file-line">BOX:</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC293" class="blob-code blob-code-inner js-file-line">NEW_HERE:
</td>
</tr>
<tr>
<td id="LC294" class="blob-code blob-code-inner js-file-line">// esto</td>
</tr>
<tr>
VirtualAlloc</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
<td id="LC299" class="blob-code blob-code-inner js-file-line">mov TONNE, 01
</td>
</tr>
<tr>
DialogRet</td>
</tr>
<tr>
<td id="LC301" class="blob-code blob-code-inner js-file-line">mov eax, 232C
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC303" class="blob-code blob-code-inner js-file-line">FIND:</td>
</tr>
<tr>
CODESECTION, "w"</td>
</tr>
<tr>
</tr>
<tr>
CODESECTION</td>
</tr>
<tr>
<td id="LC307" class="blob-code blob-code-inner js-file-line">gmemi eip,
MEMORYBASE</td>
</tr>
<tr>
<td id="LC308" class="blob-code blob-code-inner js-file-line">mov DECR,
$RESULT</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC310" class="blob-code blob-code-inner js-file-line">A1:</td>
</tr>
<tr>
</tr>
<tr>
#F3A566A5A4#</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC314" class="blob-code blob-code-inner js-file-line">je A1_1</td>
</tr>
<tr>
STRING_NEW, $RESULT</td>
</tr>
<tr>
STRING_NEW, 07</td>
</tr>
<tr>
STRING_NEW, [STRING_NEW]</td>
</tr>
<tr>
STRING_NEW_2, [STRING_NEW]</td>
</tr>
<tr>
STRING_NEW_3, [STRING_NEW+04]</td>
</tr>
<tr>
</tr>
<tr>
[STRING_NEW_3], 10</td>
</tr>
<tr>
STRING_NEW_3, $RESULT</td>
</tr>
<tr>
STRING_NEW_3</td>
</tr>
<tr>
</tr>
<tr>
STRING_NEW_2, 02C</td>
</tr>
<tr>
[STRING_NEW_2], 10</td>
</tr>
<tr>
STRING_NEW_2, $RESULT</td>
</tr>
<tr>
STRING_NEW_2</td>
</tr>
<tr>
</tr>
<tr>
STRING_NEW_2, STRING_NEW_3</td>
</tr>
<tr>
<td id="LC331" class="blob-code blob-code-inner js-file-line">je A1_1</td>
</tr>
<tr>
STRING_NEW_2, 00</td>
</tr>
<tr>
<td id="LC333" class="blob-code blob-code-inner js-file-line">jne A1_1</td>
</tr>
<tr>
STRING_NEW_3, 00</td>
</tr>
<tr>
<td id="LC335" class="blob-code blob-code-inner js-file-line">je STOPPO
</td>
</tr>
<tr>
STRING_NEW_2, STRING_NEW_3</td>
</tr>
<tr>
<td id="LC337" class="blob-code blob-code-inner js-file-line">jmp A1_1</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC339" class="blob-code blob-code-inner js-file-line">STOPPO:</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC341" class="blob-code blob-code-inner js-file-line">NO_STRING
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC346" class="blob-code blob-code-inner js-file-line">A1_1:</td>
</tr>
<tr>
<td id="LC347" class="blob-code blob-code-inner js-file-line">find DECR,
#8360140083601000C70001234567C7400489ABCDEFC74008FEDCBA98C7400C76543210C3#</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC349" class="blob-code blob-code-inner js-file-line">je A2</td>
</tr>
<tr>
<td id="LC350" class="blob-code blob-code-inner js-file-line">jmp A_AUS
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC352" class="blob-code blob-code-inner js-file-line">A2:</td>
</tr>
<tr>
<td id="LC353" class="blob-code blob-code-inner js-file-line">find DECR,
#C70001234567C7400489ABCDEFC74008FEDCBA98C7400C76543210#</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC355" class="blob-code blob-code-inner js-file-line">je Not_Found
</td>
</tr>
<tr>
<td id="LC356" class="blob-code blob-code-inner js-file-line">mov other, 01
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC358" class="blob-code blob-code-inner js-file-line">A_AUS:</td>
</tr>
<tr>
<td id="LC359" class="blob-code blob-code-inner js-file-line">mov P1,
$RESULT</td>
</tr>
<tr>
<td id="LC360" class="blob-code blob-code-inner js-file-line">bphws P1,
"x"</td>
</tr>
<tr>
<td id="LC361" class="blob-code blob-code-inner js-file-line">bp P1</td>
</tr>
<tr>
</tr>
<tr>
#8B450C83C40C85C07E??#</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC365" class="blob-code blob-code-inner js-file-line">je A_AUS_2
</td>
</tr>
<tr>
<td id="LC366" class="blob-code blob-code-inner js-file-line">mov TT_1,
$RESULT</td>
</tr>
<tr>
<td id="LC367" class="blob-code blob-code-inner js-file-line">add TT_1, 06
</td>
</tr>
<tr>
<td id="LC368" class="blob-code blob-code-inner js-file-line">bp TT_1</td>
</tr>
<tr>
<td id="LC369" class="blob-code blob-code-inner js-file-line">bphws TT_1,
"x"</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC373" class="blob-code blob-code-inner js-file-line">A_AUS_2:</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
<td id="LC377" class="blob-code blob-code-inner js-file-line">cmp eip, TT_1
</td>
</tr>
<tr>
<td id="LC378" class="blob-code blob-code-inner js-file-line">jne A_AUS_3
</td>
</tr>
<tr>
<td id="LC379" class="blob-code blob-code-inner js-file-line">bphwc P1</td>
</tr>
<tr>
<td id="LC380" class="blob-code blob-code-inner js-file-line">log "
"</td>
</tr>
<tr>
<td id="LC381" class="blob-code blob-code-inner js-file-line">log
"ZProtect 1.6 Detected!"</td>
</tr>
<tr>
"</td>
</tr>
<tr>
<td id="LC383" class="blob-code blob-code-inner js-file-line">mov other, 03
</td>
</tr>
<tr>
<td id="LC384" class="blob-code blob-code-inner js-file-line">mov TAFF,
"1.6_VERSION!"</td>
</tr>
<tr>
<td id="LC385" class="blob-code blob-code-inner js-file-line">jmp A_AUS_4
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC391" class="blob-code blob-code-inner js-file-line">bphwc TT_1
</td>
</tr>
<tr>
<td id="LC392" class="blob-code blob-code-inner js-file-line">cmp eip, P1
</td>
</tr>
<tr>
<td id="LC393" class="blob-code blob-code-inner js-file-line">jne No_Break
</td>
</tr>
<tr>
<td id="LC394" class="blob-code blob-code-inner js-file-line">bphwc P1</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC396" class="blob-code blob-code-inner js-file-line">sto</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC401" class="blob-code blob-code-inner js-file-line">mov check,
eip</td>
</tr>
<tr>
<td id="LC402" class="blob-code blob-code-inner js-file-line">bphws check,
"x"</td>
</tr>
<tr>
<td id="LC403" class="blob-code blob-code-inner js-file-line">bp check</td>
</tr>
<tr>
{PROCESSNAME_2}_Session_Infos.txt"</td>
</tr>
<tr>
<td id="LC405" class="blob-code blob-code-inner js-file-line">mov sFile,
$RESULT</td>
</tr>
<tr>
<td id="LC406" class="blob-code blob-code-inner js-file-line">wrt sFile,
$RESULT</td>
</tr>
<tr>
" "</td>
</tr>
<tr>
check_add, check</td>
</tr>
<tr>
<td id="LC409" class="blob-code blob-code-inner js-file-line">gmemi check,
MEMORYBASE</td>
</tr>
<tr>
check_add, $RESULT</td>
</tr>
<tr>
<td id="LC411" class="blob-code blob-code-inner js-file-line">eval ":
{check_add}"</td>
</tr>
<tr>
<td id="LC412" class="blob-code blob-code-inner js-file-line">wrta sFile,
$RESULT</td>
</tr>
<tr>
"\r\n"</td>
</tr>
<tr>
<td id="LC414" class="blob-code blob-code-inner js-file-line">findop check,
#C3#</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC416" class="blob-code blob-code-inner js-file-line">jne RET_FOUND
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC420" class="blob-code blob-code-inner js-file-line">RET_FOUND:
</td>
</tr>
<tr>
<td id="LC421" class="blob-code blob-code-inner js-file-line">mov RETURNER,
$RESULT</td>
</tr>
<tr>
RETURNER, MEMORYBASE</td>
</tr>
<tr>
<td id="LC423" class="blob-code blob-code-inner js-file-line">sub RETURNER,
$RESULT</td>
</tr>
<tr>
{RETURNER}"</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
"\r\n"</td>
</tr>
<tr>
{ZPSEC_SIZE}"</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
"\r\n"</td>
</tr>
<tr>
<td id="LC430" class="blob-code blob-code-inner js-file-line">mov DC1, esp
</td>
</tr>
<tr>
[DC1], 10</td>
</tr>
<tr>
<td id="LC432" class="blob-code blob-code-inner js-file-line">mov DC1_IN,
$RESULT</td>
</tr>
<tr>
<td id="LC433" class="blob-code blob-code-inner js-file-line">buf DC1_IN
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
<td id="LC436" class="blob-code blob-code-inner js-file-line">cmp other, 03
</td>
</tr>
<tr>
RET_FOUND_2</td>
</tr>
<tr>
<td id="LC438" class="blob-code blob-code-inner js-file-line">mov RECALC,
STRING_NEW_2</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC440" class="blob-code blob-code-inner js-file-line">ROUND_FILL:
</td>
</tr>
<tr>
check</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC443" class="blob-code blob-code-inner js-file-line">mov [esp],
STRING_NEW_2</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
ROUND_FILL</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC449" class="blob-code blob-code-inner js-file-line">RET_FOUND_2:
</td>
</tr>
<tr>
</td>
</tr>
<tr>
<td id="LC451" class="blob-code blob-code-inner js-file-line">je R1</td>
</tr>
<tr>
<td id="LC452" class="blob-code blob-code-inner js-file-line">mov SEC_A,
ebx</td>
</tr>
<tr>
SEC_A_SIZE, [esp+1C]</td>
</tr>
<tr>
SEC_A_SIZE, SEC_A</td>
</tr>
<tr>
<td id="LC455" class="blob-code blob-code-inner js-file-line">jmp R1A</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC457" class="blob-code blob-code-inner js-file-line">R1:</td>
</tr>
<tr>
<td id="LC458" class="blob-code blob-code-inner js-file-line">mov SEC_A,
edi</td>
</tr>
<tr>
SEC_A_SIZE, ebx</td>
</tr>
<tr>
SEC_A_SIZE, SEC_A</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC462" class="blob-code blob-code-inner js-file-line">R1A:</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
check</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC467" class="blob-code blob-code-inner js-file-line">mov DC2, esp
</td>
</tr>
<tr>
[DC2], 10</td>
</tr>
<tr>
<td id="LC469" class="blob-code blob-code-inner js-file-line">mov DC2_IN,
$RESULT</td>
</tr>
<tr>
<td id="LC470" class="blob-code blob-code-inner js-file-line">buf DC2_IN
</td>
</tr>
<tr>
</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC473" class="blob-code blob-code-inner js-file-line">mov SEC_B,
ebx</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC477" class="blob-code blob-code-inner js-file-line">mov SEC_B,
edi</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
check</td>
</tr>
<tr>
</tr>
<tr>
</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC486" class="blob-code blob-code-inner js-file-line">mov SEC_C,
ebx</td>
</tr>
<tr>
<td id="LC487" class="blob-code blob-code-inner js-file-line">mov SEC_ALL,
ebx</td>
</tr>
<tr>
SEC_C_SIZE, [esp+1C]</td>
</tr>
<tr>
SEC_C_SIZE, SEC_C</td>
</tr>
<tr>
SEC_ALL_SIZE, SEC_C_SIZE</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC494" class="blob-code blob-code-inner js-file-line">mov SEC_C,
edi</td>
</tr>
<tr>
edi</td>
</tr>
<tr>
SEC_C_SIZE, ebx</td>
</tr>
<tr>
SEC_C_SIZE, SEC_C</td>
</tr>
<tr>
SEC_ALL_SIZE, SEC_C_SIZE</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC501" class="blob-code blob-code-inner js-file-line">mov TAMAX,
SEC_C_SIZE</td>
</tr>
<tr>
<td id="LC502" class="blob-code blob-code-inner js-file-line">mov $RESULT,
TAMAX</td>
</tr>
<tr>
MEMORYBASE</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC505" class="blob-code blob-code-inner js-file-line">jne NAK</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC509" class="blob-code blob-code-inner js-file-line">NAK:</td>
</tr>
<tr>
<td id="LC510" class="blob-code blob-code-inner js-file-line">mov SAUER,
$RESULT</td>
</tr>
<tr>
<td id="LC511" class="blob-code blob-code-inner js-file-line">find SAUER,
#891437E?#</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC513" class="blob-code blob-code-inner js-file-line">je KEK</td>
</tr>
<tr>
<td id="LC514" class="blob-code blob-code-inner js-file-line">mov APILOG,
$RESULT</td>
</tr>
<tr>
<td id="LC515" class="blob-code blob-code-inner js-file-line">// bphws
APILOG, "x"</td>
</tr>
<tr>
<td id="LC516" class="blob-code blob-code-inner js-file-line">bp APILOG
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC518" class="blob-code blob-code-inner js-file-line">KEK:</td>
</tr>
<tr>
#890C3AE?# // ecx</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC521" class="blob-code blob-code-inner js-file-line">je NAK_2A
</td>
</tr>
<tr>
<td id="LC522" class="blob-code blob-code-inner js-file-line">mov APILOG_2,
$RESULT</td>
</tr>
<tr>
APILOG_2, "x"</td>
</tr>
<tr>
<td id="LC524" class="blob-code blob-code-inner js-file-line">bp APILOG_2
</td>
</tr>
<tr>
<td id="LC525" class="blob-code blob-code-inner js-file-line">mov HAMMER,
01</td>
</tr>
<tr>
<td id="LC526" class="blob-code blob-code-inner js-file-line">jmp NAK_2A
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC528" class="blob-code blob-code-inner js-file-line">NAK_2A:</td>
</tr>
<tr>
#890C02E?# // ecx</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC531" class="blob-code blob-code-inner js-file-line">je ZERO</td>
</tr>
<tr>
<td id="LC532" class="blob-code blob-code-inner js-file-line">mov APILOG_3,
$RESULT</td>
</tr>
<tr>
APILOG_3, "x"</td>
</tr>
<tr>
<td id="LC534" class="blob-code blob-code-inner js-file-line">bp APILOG_3
</td>
</tr>
<tr>
<td id="LC535" class="blob-code blob-code-inner js-file-line">mov HAMMER,
01</td>
</tr>
<tr>
<td id="LC536" class="blob-code blob-code-inner js-file-line">jmp ZERO</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC538" class="blob-code blob-code-inner js-file-line">MAK_1:</td>
</tr>
<tr>
</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC541" class="blob-code blob-code-inner js-file-line">mov SEC_D,
ebx</td>
</tr>
<tr>
ebx</td>
</tr>
<tr>
SEC_D_SIZE, [esp+1C]</td>
</tr>
<tr>
SEC_D_SIZE, SEC_D</td>
</tr>
<tr>
SEC_ALL_SIZE, SEC_D_SIZE</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
edi</td>
</tr>
<tr>
edi</td>
</tr>
<tr>
SEC_D_SIZE, ebx</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
SEC_D_SIZE</td>
</tr>
<tr>
TAMAX</td>
</tr>
<tr>
</tr>
<tr>
line">//////////////////////////////</td>
</tr>
<tr>
<td id="LC560" class="blob-code blob-code-inner js-file-line">MAK_2:</td>
</tr>
<tr>
</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC563" class="blob-code blob-code-inner js-file-line">mov SEC_E,
ebx</td>
</tr>
<tr>
ebx</td>
</tr>
<tr>
SEC_E_SIZE, [esp+1C]</td>
</tr>
<tr>
SEC_E_SIZE, SEC_E</td>
</tr>
<tr>
SEC_ALL_SIZE, SEC_E_SIZE</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
edi</td>
</tr>
<tr>
edi</td>
</tr>
<tr>
SEC_E_SIZE, ebx</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
SEC_E_SIZE</td>
</tr>
<tr>
TAMAX</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC582" class="blob-code blob-code-inner js-file-line">ZERO:</td>
</tr>
<tr>
TAMAX</td>
</tr>
<tr>
<td id="LC584" class="blob-code blob-code-inner js-file-line">mov ENDOF,
$RESULT</td>
</tr>
<tr>
<td id="LC585" class="blob-code blob-code-inner js-file-line">mov ENDOF_2,
$RESULT</td>
</tr>
<tr>
<td id="LC586" class="blob-code blob-code-inner js-file-line">sub ENDOF_2,
20 // 10</td>
</tr>
<tr>
<td id="LC587" class="blob-code blob-code-inner js-file-line">sub ENDOF, 20
// 10</td>
</tr>
<tr>
[ENDOF], 10</td>
</tr>
<tr>
<td id="LC589" class="blob-code blob-code-inner js-file-line">mov STRING_A,
$RESULT</td>
</tr>
<tr>
<td id="LC590" class="blob-code blob-code-inner js-file-line">buf STRING_A
</td>
</tr>
<tr>
<td id="LC591" class="blob-code blob-code-inner js-file-line">cmp heller,
01</td>
</tr>
<tr>
<td id="LC592" class="blob-code blob-code-inner js-file-line">je NEW_SEARCH
</td>
</tr>
<tr>
{scriptname} \r\n\r\n{points} \r\n\r\nPress >>> YES <<< to use
the DeCrypt Method 1 <<<-- Use this first! \r\n\r\nPress >>> NO
<<< to use the DeCrypt Method 2 <<<-- Use this second!
</tr>
<tr>
</td>
</tr>
<tr>
<td id="LC595" class="blob-code blob-code-inner js-file-line">mov heller,
$RESULT</td>
</tr>
<tr>
01</td>
</tr>
<tr>
<td id="LC597" class="blob-code blob-code-inner js-file-line">je NEW_SEARCH
</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC599" class="blob-code blob-code-inner js-file-line">je SECWAY
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC603" class="blob-code blob-code-inner js-file-line">SECWAY:</td>
</tr>
<tr>
</td>
</tr>
<tr>
<td id="LC605" class="blob-code blob-code-inner js-file-line">cmp [ENDOF],
STRING_A ,10</td>
</tr>
<tr>
NEW_SEARCH</td>
</tr>
<tr>
</td>
</tr>
<tr>
STRING_A ,10</td>
</tr>
<tr>
NEW_SEARCH</td>
</tr>
<tr>
</td>
</tr>
<tr>
STRING_A ,10</td>
</tr>
<tr>
NEW_SEARCH</td>
</tr>
<tr>
<td id="LC613" class="blob-code blob-code-inner js-file-line">jmp ZERO_2
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC615" class="blob-code blob-code-inner js-file-line">NEW_SEARCH:
</td>
</tr>
<tr>
</td>
</tr>
<tr>
<td id="LC617" class="blob-code blob-code-inner js-file-line">mov TEST_SEC,
$RESULT</td>
</tr>
<tr>
TEST_SEC_BAK, $RESULT</td>
</tr>
<tr>
TEST_SEC_BAK_2, $RESULT</td>
</tr>
<tr>
TEST_SEC_BAK, 50</td>
</tr>
<tr>
TEST_SEC_BAK_2, 50</td>
</tr>
<tr>
[TEST_SEC],
#60B8AAAAAAAAB9BBBBBBBB8338007433813890909090742B8B103950107524395020751F395030751A
8B580439581475128B5808395818750A8B580C39581C750233DB83C0103BC172C161909090#</td>
</tr>
<tr>
[TEST_SEC+02], SEC_ALL</td>
</tr>
<tr>
[TEST_SEC+07], SEC_ALL_SIZE</td>
</tr>
<tr>
<td id="LC625" class="blob-code blob-code-inner js-file-line">bp
TEST_SEC+4B</td>
</tr>
<tr>
TEST_SEC+41</td>
</tr>
<tr>
TEST_SEC</td>
</tr>
<tr>
<td id="LC628" class="blob-code blob-code-inner js-file-line">mov TEST_END,
TEST_SEC+4B</td>
</tr>
<tr>
TEST_FOUND, TEST_SEC+41</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC631" class="blob-code blob-code-inner js-file-line">NEW_SEARCH_2:
</td>
</tr>
<tr>
<td id="LC632" class="blob-code blob-code-inner js-file-line">run</td>
</tr>
<tr>
TEST_FOUND</td>
</tr>
<tr>
NOTHING_IN</td>
</tr>
<tr>
NSTRING_A, eax</td>
</tr>
<tr>
eax</td>
</tr>
<tr>
[eax], 10</td>
</tr>
<tr>
<td id="LC638" class="blob-code blob-code-inner js-file-line">mov AA,
$RESULT</td>
</tr>
<tr>
<td id="LC639" class="blob-code blob-code-inner js-file-line">buf AA</td>
</tr>
<tr>
[TEST_SEC_BAK], AA</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC642" class="blob-code blob-code-inner js-file-line">inc COUNT
</td>
</tr>
<tr>
<td id="LC643" class="blob-code blob-code-inner js-file-line">cmp COUNT, 06
</td>
</tr>
<tr>
<td id="LC644" class="blob-code blob-code-inner js-file-line">jb
NEW_SEARCH_2</td>
</tr>
<tr>
<td id="LC645" class="blob-code blob-code-inner js-file-line">bc TEST_FOUND
</td>
</tr>
<tr>
<td id="LC646" class="blob-code blob-code-inner js-file-line">run</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC648" class="blob-code blob-code-inner js-file-line">NEW_SEARCH_3:
</td>
</tr>
<tr>
<td id="LC649" class="blob-code blob-code-inner js-file-line">bc TEST_END
</td>
</tr>
<tr>
</td>
</tr>
<tr>
</tr>
<tr>
[TEST_SEC_BAK_2], 10</td>
</tr>
<tr>
<td id="LC653" class="blob-code blob-code-inner js-file-line">mov C1,
$RESULT</td>
</tr>
<tr>
<td id="LC654" class="blob-code blob-code-inner js-file-line">buf C1</td>
</tr>
<tr>
[TEST_SEC_BAK], 10</td>
</tr>
<tr>
<td id="LC656" class="blob-code blob-code-inner js-file-line">mov C2,
$RESULT</td>
</tr>
<tr>
<td id="LC657" class="blob-code blob-code-inner js-file-line">buf C2</td>
</tr>
<tr>
<td id="LC658" class="blob-code blob-code-inner js-file-line">cmp C2, C1
</td>
</tr>
<tr>
<td id="LC659" class="blob-code blob-code-inner js-file-line">je IN_THERE
</td>
</tr>
<tr>
NOTHING_IN_2</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC662" class="blob-code blob-code-inner js-file-line">IN_THERE:
</td>
</tr>
<tr>
[ENDOF_2], C1, 10</td>
</tr>
<tr>
<td id="LC664" class="blob-code blob-code-inner js-file-line">je IN_THERE_2
</td>
</tr>
<tr>
<td id="LC665" class="blob-code blob-code-inner js-file-line">find ebx, C1
</td>
</tr>
<tr>
00</td>
</tr>
<tr>
<td id="LC667" class="blob-code blob-code-inner js-file-line">jne INSERT
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC671" class="blob-code blob-code-inner js-file-line">INSERT:</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC674" class="blob-code blob-code-inner js-file-line">IN_THERE_2:
</td>
</tr>
<tr>
check</td>
</tr>
<tr>
<td id="LC676" class="blob-code blob-code-inner js-file-line">free TEST_SEC
</td>
</tr>
<tr>
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC679" class="blob-code blob-code-inner js-file-line">NOTHING_IN:
</td>
</tr>
<tr>
</td>
</tr>
<tr>
<td id="LC681" class="blob-code blob-code-inner js-file-line">cmp COUNT, 00
</td>
</tr>
<tr>
NEW_SEARCH_3</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC684" class="blob-code blob-code-inner js-file-line">NOTHING_IN_2:
</td>
</tr>
<tr>
<td id="LC685" class="blob-code blob-code-inner js-file-line">bc TEST_END
</td>
</tr>
<tr>
</td>
</tr>
<tr>
check</td>
</tr>
<tr>
<td id="LC688" class="blob-code blob-code-inner js-file-line">free TEST_SEC
</td>
</tr>
<tr>
<td id="LC689" class="blob-code blob-code-inner js-file-line">mov COUNT, 00
</td>
</tr>
<tr>
<td id="LC690" class="blob-code blob-code-inner js-file-line">jmp NO_SAME
</td>
</tr>
<tr>
</td>
</tr>
<tr>
line">//////////////////////////////</td>
</tr>
<tr>
</td>
</tr>
<tr>
STRING_A ,10</td>
</tr>
<tr>
<td id="LC695" class="blob-code blob-code-inner js-file-line">jne NO_SAME
</td>
</tr>
<tr>
</td>
</tr>
<tr>
STRING_A ,10</td>
</tr>
<tr>
<td id="LC698" class="blob-code blob-code-inner js-file-line">jne NO_SAME
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC700" class="blob-code blob-code-inner js-file-line">ZERO_2:</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
[ENDOF_2], 10</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
<td id="LC705" class="blob-code blob-code-inner js-file-line">buf RECALC
</td>
</tr>
<tr>
<td id="LC706" class="blob-code blob-code-inner js-file-line">mov SP1,
[ENDOF_2]</td>
</tr>
<tr>
[ENDOF_2+04] </td>
</tr>
<tr>
[ENDOF_2+08]</td>
</tr>
<tr>
[ENDOF_2+0C]</td>
</tr>
<tr>
{PROCESSNAME_2}_String.txt"</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
" "</td>
</tr>
<tr>
{RECALC}"</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
check</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC720" class="blob-code blob-code-inner js-file-line">cmp SEC_D, 00
</td>
</tr>
<tr>
<td id="LC721" class="blob-code blob-code-inner js-file-line">jne SEMPA
</td>
</tr>
<tr>
</td>
</tr>
<tr>
</tr>
<tr>
ebx</td>
</tr>
<tr>
ebx</td>
</tr>
<tr>
SEC_D_SIZE, [esp+1C]</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
edi</td>
</tr>
<tr>
edi</td>
</tr>
<tr>
SEC_D_SIZE, ebx</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC740" class="blob-code blob-code-inner js-file-line">SEMPA:</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
check</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
check</td>
</tr>
<tr>
</tr>
<tr>
</td>
</tr>
<tr>
</tr>
<tr>
ebx</td>
</tr>
<tr>
ebx</td>
</tr>
<tr>
SEC_E_SIZE, [esp+1C]</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
edi</td>
</tr>
<tr>
edi</td>
</tr>
<tr>
SEC_E_SIZE, ebx</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
check</td>
</tr>
<tr>
</tr>
<tr>
</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC774" class="blob-code blob-code-inner js-file-line">mov SEC_F,
ebx</td>
</tr>
<tr>
ebx</td>
</tr>
<tr>
SEC_F_SIZE, [esp+1C]</td>
</tr>
<tr>
SEC_F_SIZE, SEC_F</td>
</tr>
<tr>
SEC_ALL_SIZE, SEC_F_SIZE</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC782" class="blob-code blob-code-inner js-file-line">mov SEC_F,
edi</td>
</tr>
<tr>
edi</td>
</tr>
<tr>
SEC_F_SIZE, ebx</td>
</tr>
<tr>
SEC_F_SIZE, SEC_F</td>
</tr>
<tr>
SEC_ALL_SIZE, SEC_F_SIZE</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
check</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
check</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC799" class="blob-code blob-code-inner js-file-line">NO_SAME:</td>
</tr>
<tr>
<td id="LC800" class="blob-code blob-code-inner js-file-line">sto </td>
</tr>
<tr>
</tr>
<tr>
<td id="LC802" class="blob-code blob-code-inner js-file-line">mov H1, 00
</td>
</tr>
<tr>
</td>
</tr>
<tr>
</td>
</tr>
<tr>
</td>
</tr>
<tr>
</td>
</tr>
<tr>
<td id="LC807" class="blob-code blob-code-inner js-file-line">mov SEC_HELP,
SEC_ALL_SIZE</td>
</tr>
<tr>
<td id="LC808" class="blob-code blob-code-inner js-file-line">sub SEC_HELP,
10</td>
</tr>
<tr>
[SEC_HELP], 10</td>
</tr>
<tr>
<td id="LC810" class="blob-code blob-code-inner js-file-line">mov H1,
$RESULT</td>
</tr>
<tr>
<td id="LC811" class="blob-code blob-code-inner js-file-line">buf H1</td>
</tr>
<tr>
10</td>
</tr>
<tr>
[SEC_HELP], 10</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
</tr>
<tr>
10</td>
</tr>
<tr>
[SEC_HELP], 10</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
</tr>
<tr>
10</td>
</tr>
<tr>
[SEC_HELP], 10</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
</tr>
<tr>
10</td>
</tr>
<tr>
[SEC_HELP], 10</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC828" class="blob-code blob-code-inner js-file-line">sto </td>
</tr>
<tr>
</tr>
<tr>
check</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC832" class="blob-code blob-code-inner js-file-line">cmp SEC_D, 00
</td>
</tr>
<tr>
<td id="LC833" class="blob-code blob-code-inner js-file-line">je MAK_1</td>
</tr>
<tr>
<td id="LC834" class="blob-code blob-code-inner js-file-line">cmp SEC_E, 00
</td>
</tr>
<tr>
<td id="LC835" class="blob-code blob-code-inner js-file-line">je MAK_2</td>
</tr>
<tr>
<td id="LC836" class="blob-code blob-code-inner js-file-line">jmp MAK_2
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC840" class="blob-code blob-code-inner js-file-line">No_Break:
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
<td id="LC843" class="blob-code blob-code-inner js-file-line">bprm
CODESECTION, CODESECTION_SIZE</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC845" class="blob-code blob-code-inner js-file-line">bpmc</td>
</tr>
<tr>
<td id="LC846" class="blob-code blob-code-inner js-file-line">cmt eip,
"OEP & ZProtect!"</td>
</tr>
<tr>
{scriptname} \r\n\r\n{points} \r\n\r\nThis target does not use a En-Cryption!
</tr>
<tr>
</td>
</tr>
<tr>
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC853" class="blob-code blob-code-inner js-file-line">Not_Found:
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
line">CODESECTION_STOP_CHECK:</td>
</tr>
<tr>
check</td>
</tr>
<tr>
<td id="LC859" class="blob-code blob-code-inner js-file-line">jne TA_1</td>
</tr>
<tr>
<td id="LC860" class="blob-code blob-code-inner js-file-line">bc check</td>
</tr>
<tr>
<td id="LC861" class="blob-code blob-code-inner js-file-line">bphwc check
</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC864" class="blob-code blob-code-inner js-file-line">TA_1:</td>
</tr>
<tr>
APILOG</td>
</tr>
<tr>
<td id="LC866" class="blob-code blob-code-inner js-file-line">je TA_4</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
APILOG_2</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
APILOG_3</td>
</tr>
<tr>
</tr>
<tr>
CODESECTION_STOP_CHECK_2</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC878" class="blob-code blob-code-inner js-file-line">// bc APILOG
</td>
</tr>
<tr>
<td id="LC879" class="blob-code blob-code-inner js-file-line">// bphwc
APILOG</td>
</tr>
<tr>
<td id="LC880" class="blob-code blob-code-inner js-file-line">jmp TAA</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC883" class="blob-code blob-code-inner js-file-line">bc APILOG_2
</td>
</tr>
<tr>
APILOG_2</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC888" class="blob-code blob-code-inner js-file-line">bc APILOG_3
</td>
</tr>
<tr>
APILOG_3</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC892" class="blob-code blob-code-inner js-file-line">TAA:</td>
</tr>
<tr>
</td>
</tr>
<tr>
SECTION_T, $RESULT</td>
</tr>
<tr>
SECTION_T_BAK, $RESULT</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC897" class="blob-code blob-code-inner js-file-line">APIROUND:
</td>
</tr>
<tr>
<td id="LC898" class="blob-code blob-code-inner js-file-line">// bc APILOG
</td>
</tr>
<tr>
<td id="LC899" class="blob-code blob-code-inner js-file-line">// bphwc
APILOG</td>
</tr>
<tr>
<td id="LC900" class="blob-code blob-code-inner js-file-line">gopi eip, 1,
ADDR</td>
</tr>
<tr>
[SECTION_T], $RESULT</td>
</tr>
<tr>
SECTION_T, 04</td>
</tr>
<tr>
APILOG</td>
</tr>
<tr>
<td id="LC904" class="blob-code blob-code-inner js-file-line">je REG_0</td>
</tr>
<tr>
APILOG_2</td>
</tr>
<tr>
</tr>
<tr>
APILOG_3</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC912" class="blob-code blob-code-inner js-file-line">REG_0:</td>
</tr>
<tr>
[SECTION_T], edx</td>
</tr>
<tr>
<td id="LC914" class="blob-code blob-code-inner js-file-line">jmp REG_2
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
[SECTION_T], ecx</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
</tr>
<tr>
SECTION_T, 04</td>
</tr>
<tr>
</tr>
<tr>
APILOG, "x"</td>
</tr>
<tr>
<td id="LC923" class="blob-code blob-code-inner js-file-line">// bp APILOG
</td>
</tr>
<tr>
</tr>
<tr>
APILOG</td>
</tr>
<tr>
<td id="LC926" class="blob-code blob-code-inner js-file-line">je APIROUND
</td>
</tr>
<tr>
APILOG_2</td>
</tr>
<tr>
</td>
</tr>
<tr>
APILOG_3</td>
</tr>
<tr>
</td>
</tr>
<tr>
CODESECTION_STOP_CHECK_2</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
line">CODESECTION_STOP_CHECK_2:</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
MEMORYBASE</td>
</tr>
<tr>
CODESECTION, $RESULT</td>
</tr>
<tr>
<td id="LC938" class="blob-code blob-code-inner js-file-line">je OEP</td>
</tr>
<tr>
<td id="LC939" class="blob-code blob-code-inner js-file-line">bprm
CODESECTION, CODESECTION_SIZE</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC941" class="blob-code blob-code-inner js-file-line">bpmc</td>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC945" class="blob-code blob-code-inner js-file-line">OEP:</td>
</tr>
<tr>
"OEP / Near at OEP!"</td>
</tr>
<tr>
<td id="LC947" class="blob-code blob-code-inner js-file-line">mov OEP, eip
</td>
</tr>
<tr>
<td id="LC948" class="blob-code blob-code-inner js-file-line">cmp TONNE, 01
</td>
</tr>
<tr>
<td id="LC949" class="blob-code blob-code-inner js-file-line">je OVER_OEP
</td>
</tr>
<tr>
<td id="LC950" class="blob-code blob-code-inner js-file-line">cmp SIGN, 01
</td>
</tr>
<tr>
<td id="LC951" class="blob-code blob-code-inner js-file-line">je OVER_OEP
</td>
</tr>
<tr>
{scriptname} \r\n\r\n{points} \r\n\r\nFound nothing to DeCrypt! \r\n\r\nNo HWID
used! \r\n\r\n{points} \r\n{ME}"</td>
</tr>
<tr>
</td>
</tr>
<tr>
</td>
</tr>
<tr>
</tr>
<tr>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC958" class="blob-code blob-code-inner js-file-line">OVER_OEP:
</td>
</tr>
<tr>
CODESECTION_bak, CODESECTION</td>
</tr>
<tr>
<td id="LC960" class="blob-code blob-code-inner js-file-line">mov SEC_2,
CODESECTION</td>
</tr>
<tr>
<td id="LC961" class="blob-code blob-code-inner js-file-line">add SEC_2,
CODESECTION_SIZE</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC963" class="blob-code blob-code-inner js-file-line">DECRYPT:</td>
</tr>
<tr>
</tr>
<tr>
</td>
</tr>
<tr>
<td id="LC966" class="blob-code blob-code-inner js-file-line">je DECRYPT_2S
</td>
</tr>
<tr>
</tr>
<tr>
<td id="LC968" class="blob-code blob-code-inner js-file-line">cmp RECALC,
00</td>
</tr>
<tr>
<td id="LC969" class="blob-code blob-code-inner js-file-line">jne DECRYPT_2
</td>
</tr>
<tr>
<td id="LC970" class="blob-code blob-code-inner js-file-line">cmp DC1_IN,
DC2_IN</td>
</tr>
<tr>
DECRYPT_GONE</td>
</tr>
<tr>
{scriptname} \r\n\r\n{points} \r\n\r\nThe DeCrypt String has not changed!
\r\n\r\nSo in this case your target should not need a DeCrypt String! \r\n\r\nUse
this now!Press "YES" to use this. \r\n\r\n{DC1_IN} \r\n\r\n{points}
\r\n\r\n{ME}"</td>
</tr>
<tr>
</td>
</tr>
<tr>
00</td>
</tr>
<tr>
DECRYPT_GONE</td>
</tr>
<tr>
DC1_IN</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC978" class="blob-code blob-code-inner js-file-line">DECRYPT_2S:
</td>
</tr>
<tr>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
" "</td>
</tr>
<tr>
{RECALC}"</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
<td id="LC985" class="blob-code blob-code-inner js-file-line">jmp DECRYPT_2
</td>
</tr>
<tr>
line">////////////////////</td>
</tr>
<tr>
<td id="LC987" class="blob-code blob-code-inner js-file-line">DECRYPT_GONE:
</td>
</tr>
<tr>
{scriptname} \r\n\r\n{points} \r\n\r\nThe script has not found the real decrypt
string so in this case you have to choose between 1-5 \r\n\r\nNow just enter 1 for
string 1 or 2 or 3 or 4 or 5 \r\n\r\nIf it this time not works then choose a other
nummber on the next round.\r\n\r\n{points} \r\n\r\n1.) {H1} \r\n2.) {H2} \r\n3.)
{H3} \r\n4.) {H4} \r\n5.) {H5} \r\n\r\nIn some cases there is no DeCrypt string
needed!So try just to run the app now!\r\n\r\n{ME}"</td>
</tr>
<tr>
</td>
</tr>
<tr>
</td>
</tr>
<tr>
<td id="LC991" class="blob-code blob-code-inner js-file-line">eval
"The script has not found the real decrypt string so in this case you have to
choose between 1-5"</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
<td id="LC993" class="blob-code blob-code-inner js-file-line">log $RESULT,
""</td>
</tr>
<tr>
" "</td>
</tr>
<tr>
"Now just enter 1 for string 1 or 2 or 3 or 4 or 5"</td>
</tr>
<tr>
$RESULT</td>
</tr>
<tr>
""</td>
</tr>
<tr>
" "</td>
</tr>
<tr>
<td id="LC999" class="blob-code blob-code-inner js-file-line">eval "If
it this time not works then choose a other nummber on the next round."</td>
</tr>
<tr>
<td id="L1000" class="blob-num js-line-number" data-line-
number="1000"></td>
$RESULT</td>
</tr>
<tr>
number="1001"></td>
""</td>
</tr>
<tr>
number="1002"></td>
" "</td>
</tr>
<tr>
number="1003"></td>
"1.) {H1}"</td>
</tr>
<tr>
number="1004"></td>
$RESULT</td>
</tr>
<tr>
number="1005"></td>
""</td>
</tr>
<tr>
number="1006"></td>
" "</td>
</tr>
<tr>
number="1007"></td>
"2.) {H2}"</td>
</tr>
<tr>
number="1008"></td>
$RESULT</td>
</tr>
<tr>
number="1009"></td>
""</td>
</tr>
<tr>
number="1010"></td>
" "</td>
</tr>
<tr>
number="1011"></td>
"3.) {H3}"</td>
</tr>
<tr>
number="1012"></td>
$RESULT</td>
</tr>
<tr>
number="1013"></td>
""</td>
</tr>
<tr>
number="1014"></td>
" "</td>
</tr>
<tr>
number="1015"></td>
"4.) {H4}"</td>
</tr>
<tr>
number="1016"></td>
$RESULT</td>
</tr>
<tr>
number="1017"></td>
""</td>
</tr>
<tr>
number="1018"></td>
" "</td>
</tr>
<tr>
number="1019"></td>
"5.) {H5}"</td>
</tr>
<tr>
number="1020"></td>
$RESULT</td>
</tr>
<tr>
number="1021"></td>
""</td>
</tr>
<tr>
number="1022"></td>
" "</td>
</tr>
<tr>
number="1023"></td>
"In some cases there is no DeCrypt string needed!So try just to run the app
now!"</td>
</tr>
<tr>
number="1024"></td>
$RESULT</td>
</tr>
<tr>
number="1025"></td>
""</td>
</tr>
<tr>
number="1026"></td>
" "</td>
</tr>
<tr>
number="1027"></td>
00</td>
</tr>
<tr>
number="1028"></td>
<td id="LC1028" class="blob-code blob-code-inner js-file-line">mov KARA, 01
</td>
</tr>
<tr>
number="1029"></td>
line">////////////////////</td>
</tr>
<tr>
number="1030"></td>
<td id="LC1030" class="blob-code blob-code-inner js-file-line">ASKME:</td>
</tr>
<tr>
number="1031"></td>
<td id="LC1031" class="blob-code blob-code-inner js-file-line">ask
"Now enter the nummber for on string"</td>
</tr>
<tr>
number="1032"></td>
00</td>
</tr>
<tr>
number="1033"></td>
<td id="LC1033" class="blob-code blob-code-inner js-file-line">je ASKME
</td>
</tr>
<tr>
number="1034"></td>
01</td>
</tr>
<tr>
number="1035"></td>
<td id="LC1035" class="blob-code blob-code-inner js-file-line">jne AS_2
</td>
</tr>
<tr>
number="1036"></td>
H1</td>
</tr>
<tr>
number="1037"></td>
ASKME_END</td>
</tr>
<tr>
number="1038"></td>
line">////////////////////</td>
</tr>
<tr>
number="1039"></td>
<td id="LC1039" class="blob-code blob-code-inner js-file-line">AS_2:</td>
</tr>
<tr>
number="1040"></td>
02</td>
</tr>
<tr>
number="1041"></td>
</td>
</tr>
<tr>
number="1042"></td>
H2</td>
</tr>
<tr>
number="1043"></td>
ASKME_END</td>
</tr>
<tr>
number="1044"></td>
line">////////////////////</td>
</tr>
<tr>
number="1045"></td>
</tr>
<tr>
number="1046"></td>
03</td>
</tr>
<tr>
number="1047"></td>
</td>
</tr>
<tr>
number="1048"></td>
H3</td>
</tr>
<tr>
number="1049"></td>
ASKME_END</td>
</tr>
<tr>
number="1050"></td>
line">////////////////////</td>
</tr>
<tr>
number="1051"></td>
</tr>
<tr>
number="1052"></td>
04</td>
</tr>
<tr>
number="1053"></td>
</td>
</tr>
<tr>
number="1054"></td>
H4</td>
</tr>
<tr>
number="1055"></td>
ASKME_END</td>
</tr>
<tr>
number="1056"></td>
</tr>
<tr>
number="1057"></td>
05</td>
</tr>
<tr>
number="1058"></td>
<td id="LC1058" class="blob-code blob-code-inner js-file-line">jne ASKME
</td>
</tr>
<tr>
number="1059"></td>
H5</td>
</tr>
<tr>
number="1060"></td>
ASKME_END</td>
</tr>
<tr>
number="1061"></td>
line">////////////////////</td>
</tr>
<tr>
number="1062"></td>
<td id="LC1062" class="blob-code blob-code-inner js-file-line">ASKME_END:
</td>
</tr>
<tr>
number="1063"></td>
<td id="LC1063" class="blob-code blob-code-inner js-file-line">cmp KARA, 00
</td>
</tr>
<tr>
number="1064"></td>
<td id="LC1064" class="blob-code blob-code-inner js-file-line">je DECRYPT_2
</td>
</tr>
<tr>
number="1065"></td>
</tr>
<tr>
number="1066"></td>
$RESULT</td>
</tr>
<tr>
number="1067"></td>
$RESULT</td>
</tr>
<tr>
number="1068"></td>
" "</td>
</tr>
<tr>
number="1069"></td>
{RECALC}"</td>
</tr>
<tr>
number="1070"></td>
$RESULT</td>
</tr>
<tr>
number="1071"></td>
line">////////////////////</td>
</tr>
<tr>
number="1072"></td>
<td id="LC1072" class="blob-code blob-code-inner js-file-line">DECRYPT_2:
</td>
</tr>
<tr>
number="1073"></td>
</tr>
<tr>
number="1074"></td>
<td id="LC1074" class="blob-code blob-code-inner js-file-line">cmp other,
03</td>
</tr>
<tr>
number="1075"></td>
<td id="LC1075" class="blob-code blob-code-inner js-file-line">je FULL_END
</td>
</tr>
<tr>
number="1076"></td>
</tr>
<tr>
number="1077"></td>
</tr>
<tr>
number="1078"></td>
#5633F683E801740F83E8017514B8????????89040A5E#</td>
</tr>
<tr>
number="1079"></td>
00</td>
</tr>
<tr>
number="1080"></td>
DECRYPT_2_A</td>
</tr>
<tr>
number="1081"></td>
<td id="LC1081" class="blob-code blob-code-inner js-file-line">mov SAUER_2,
$RESULT</td>
</tr>
<tr>
number="1082"></td>
<td id="LC1082" class="blob-code blob-code-inner js-file-line">add SAUER_2,
0D</td>
</tr>
<tr>
number="1083"></td>
<td id="LC1083" class="blob-code blob-code-inner js-file-line">mov SAUER_2,
[SAUER_2+01]</td>
</tr>
<tr>
number="1084"></td>
<td id="LC1084" class="blob-code blob-code-inner js-file-line">find
CODESECTION, SAUER_2</td>
</tr>
<tr>
number="1085"></td>
00</td>
</tr>
<tr>
number="1086"></td>
DECRYPT_2_A</td>
</tr>
<tr>
number="1087"></td>
<td id="LC1087" class="blob-code blob-code-inner js-file-line">mov GMHA,
$RESULT</td>
</tr>
<tr>
number="1088"></td>
line">////////////////////</td>
</tr>
<tr>
number="1089"></td>
<td id="LC1089" class="blob-code blob-code-inner js-file-line">DECRYPT_2_A:
</td>
</tr>
<tr>
number="1090"></td>
</td>
</tr>
<tr>
number="1091"></td>
NSECTION, $RESULT</td>
</tr>
<tr>
number="1092"></td>
[NSECTION], DC2_IN</td>
</tr>
<tr>
number="1093"></td>
[NSECTION+10], RECALC</td>
</tr>
<tr>
number="1094"></td>
[NSECTION+30], CODESECTION</td>
</tr>
<tr>
number="1095"></td>
[NSECTION+34], SEC_C</td>
</tr>
<tr>
number="1096"></td>
NSECTION+40</td>
</tr>
<tr>
number="1097"></td>
<td id="LC1097" class="blob-code blob-code-inner js-file-line">mov [eip],
#60B8AAAAAAAAB9BBBBBBBBBACCCCCCCCBDDDDDDDDDBF000000008B1A3E8B75003118313083C00483C2
0483C504473BC17409770783FF0474D2EBDF619090#</td>
</tr>
<tr>
number="1098"></td>
line">////////////////////</td>
</tr>
<tr>
number="1099"></td>
<td id="LC1099" class="blob-code blob-code-inner js-file-line">FILL_UP:
</td>
</tr>
<tr>
number="1100"></td>
[eip+02], SEC_A // CODESECTION_bak</td>
</tr>
<tr>
number="1101"></td>
[eip+07], SEC_A_SIZE // SEC_C</td>
</tr>
<tr>
number="1102"></td>
[eip+0C], NSECTION</td>
</tr>
<tr>
number="1103"></td>
NSECTION, 10</td>
</tr>
<tr>
number="1104"></td>
[eip+11], NSECTION</td>
</tr>
<tr>
number="1105"></td>
NSECTION, 10</td>
</tr>
<tr>
number="1106"></td>
<td id="LC1106" class="blob-code blob-code-inner js-file-line">bp eip+3C
</td>
</tr>
<tr>
number="1107"></td>
</tr>
<tr>
number="1108"></td>
</tr>
<tr>
number="1109"></td>
<td id="LC1109" class="blob-code blob-code-inner js-file-line">cmp SEC_C,
00</td>
</tr>
<tr>
number="1110"></td>
DECRYPT_END</td>
</tr>
<tr>
number="1111"></td>
<td id="LC1111" class="blob-code blob-code-inner js-file-line">sub eip, 3C
</td>
</tr>
<tr>
number="1112"></td>
[eip+02], SEC_C</td>
</tr>
<tr>
number="1113"></td>
[eip+07], SEC_C_SIZE </td>
</tr>
<tr>
number="1114"></td>
</td>
</tr>
<tr>
number="1115"></td>
</tr>
<tr>
number="1116"></td>
</tr>
<tr>
number="1117"></td>
<td id="LC1117" class="blob-code blob-code-inner js-file-line">cmp SEC_D,
00</td>
</tr>
<tr>
number="1118"></td>
DECRYPT_END</td>
</tr>
<tr>
number="1119"></td>
</td>
</tr>
<tr>
number="1120"></td>
[eip+02], SEC_D</td>
</tr>
<tr>
number="1121"></td>
[eip+07], SEC_D_SIZE </td>
</tr>
<tr>
number="1122"></td>
</td>
</tr>
<tr>
number="1123"></td>
</tr>
<tr>
number="1124"></td>
</tr>
<tr>
number="1125"></td>
<td id="LC1125" class="blob-code blob-code-inner js-file-line">cmp SEC_E,
00</td>
</tr>
<tr>
number="1126"></td>
DECRYPT_END</td>
</tr>
<tr>
number="1127"></td>
</td>
</tr>
<tr>
number="1128"></td>
[eip+02], SEC_E</td>
</tr>
<tr>
number="1129"></td>
[eip+07], SEC_E_SIZE </td>
</tr>
<tr>
number="1130"></td>
</td>
</tr>
<tr>
number="1131"></td>
</tr>
<tr>
number="1132"></td>
</tr>
<tr>
number="1133"></td>
<td id="LC1133" class="blob-code blob-code-inner js-file-line">cmp SEC_F,
00</td>
</tr>
<tr>
number="1134"></td>
DECRYPT_END</td>
</tr>
<tr>
number="1135"></td>
</td>
</tr>
<tr>
number="1136"></td>
[eip+02], SEC_F</td>
</tr>
<tr>
number="1137"></td>
[eip+07], SEC_F_SIZE </td>
</tr>
<tr>
number="1138"></td>
</td>
</tr>
<tr>
number="1139"></td>
</tr>
<tr>
number="1140"></td>
</tr>
<tr>
number="1141"></td>
DECRYPT_END</td>
</tr>
<tr>
number="1142"></td>
</tr>
<tr>
number="1143"></td>
</tr>
<tr>
number="1144"></td>
[CODESECTION_bak], 10</td>
</tr>
<tr>
number="1145"></td>
<td id="LC1145" class="blob-code blob-code-inner js-file-line">mov TEMP,
$RESULT</td>
</tr>
<tr>
number="1146"></td>
<td id="LC1146" class="blob-code blob-code-inner js-file-line">buf TEMP
</td>
</tr>
<tr>
number="1147"></td>
<td id="LC1147" class="blob-code blob-code-inner js-file-line">xor TEMP,
DC2_IN</td>
</tr>
<tr>
number="1148"></td>
<td id="LC1148" class="blob-code blob-code-inner js-file-line">xor TEMP,
RECALC</td>
</tr>
<tr>
number="1149"></td>
[CODESECTION_bak], TEMP</td>
</tr>
<tr>
number="1150"></td>
CODESECTION_bak, 10</td>
</tr>
<tr>
number="1151"></td>
CODESECTION_bak, SEC_2</td>
</tr>
<tr>
number="1152"></td>
<td id="LC1152" class="blob-code blob-code-inner js-file-line">jb DECRYPT
</td>
</tr>
<tr>
number="1153"></td>
DECRYPT_END</td>
</tr>
<tr>
number="1154"></td>
line">////////////////////</td>
</tr>
<tr>
number="1155"></td>
<td id="LC1155" class="blob-code blob-code-inner js-file-line">DECRYPT_END:
</td>
</tr>
<tr>
number="1156"></td>
</tr>
<tr>
number="1157"></td>
</tr>
<tr>
number="1158"></td>
<td id="LC1158" class="blob-code blob-code-inner js-file-line">mov eip, OEP
</td>
</tr>
<tr>
number="1159"></td>
NSECTION</td>
</tr>
<tr>
number="1160"></td>
line">////////////////////</td>
</tr>
<tr>
number="1161"></td>
<td id="LC1161" class="blob-code blob-code-inner js-file-line">FIX_APIS:
</td>
</tr>
<tr>
number="1162"></td>
SECTION_T, 00</td>
</tr>
<tr>
number="1163"></td>
DECRYPT_END_2</td>
</tr>
<tr>
number="1164"></td>
SECTION_T, SECTION_T_BAK</td>
</tr>
<tr>
number="1165"></td>
<td id="LC1165" class="blob-code blob-code-inner js-file-line">mov TT_1,
eax</td>
</tr>
<tr>
number="1166"></td>
line">////////////////////</td>
</tr>
<tr>
number="1167"></td>
<td id="LC1167" class="blob-code blob-code-inner js-file-line">FIX_APIS_2:
</td>
</tr>
<tr>
number="1168"></td>
[SECTION_T_BAK], 00</td>
</tr>
<tr>
number="1169"></td>
FIX_APIS_3</td>
</tr>
<tr>
number="1170"></td>
<td id="LC1170" class="blob-code blob-code-inner js-file-line">mov eax,
[SECTION_T]</td>
</tr>
<tr>
number="1171"></td>
<td id="LC1171" class="blob-code blob-code-inner js-file-line">mov [eax],
[SECTION_T+04]</td>
</tr>
<tr>
number="1172"></td>
SECTION_T, 08</td>
</tr>
<tr>
number="1173"></td>
SECTION_T_BAK, 08</td>
</tr>
<tr>
number="1174"></td>
FIX_APIS_2</td>
</tr>
<tr>
number="1175"></td>
line">////////////////////</td>
</tr>
<tr>
number="1176"></td>
<td id="LC1176" class="blob-code blob-code-inner js-file-line">FIX_APIS_3:
</td>
</tr>
<tr>
number="1177"></td>
SECTION_T</td>
</tr>
<tr>
number="1178"></td>
<td id="LC1178" class="blob-code blob-code-inner js-file-line">mov eax,
TT_1</td>
</tr>
<tr>
number="1179"></td>
line">////////////////////</td>
</tr>
<tr>
number="1180"></td>
line">DECRYPT_END_2:</td>
</tr>
<tr>
number="1181"></td>
<td id="LC1181" class="blob-code blob-code-inner js-file-line">cmp SAUER_2,
00</td>
</tr>
<tr>
number="1182"></td>
DECRYPT_END_3</td>
</tr>
<tr>
number="1183"></td>
<td id="LC1183" class="blob-code blob-code-inner js-file-line">cmp GMHA, 00
</td>
</tr>
<tr>
number="1184"></td>
DECRYPT_END_3</td>
</tr>
<tr>
number="1185"></td>
<td id="LC1185" class="blob-code blob-code-inner js-file-line">mov [GMHA],
SAUER_2</td>
</tr>
<tr>
number="1186"></td>
line">////////////////////</td>
</tr>
<tr>
number="1187"></td>
line">DECRYPT_END_3:</td>
</tr>
<tr>
number="1188"></td>
<td id="LC1188" class="blob-code blob-code-inner js-file-line">cmp RECALC,
00</td>
</tr>
<tr>
number="1189"></td>
<td id="LC1189" class="blob-code blob-code-inner js-file-line">je NO_SCRIPT
</td>
</tr>
<tr>
number="1190"></td>
</td>
</tr>
<tr>
number="1191"></td>
SCRIPTSEC, $RESULT</td>
</tr>
<tr>
number="1192"></td>
[SCRIPTSEC],
#70617573650D0A62706877630D0A62630D0A62706D630D0A7661722076610D0A7661722076615F7369
7A650D0A7661722073746F707065720D0A76617220636F756E740D0A76617220737472696E670D0A766
172204F45500D0A7661722045500D0A76617220686F6C6465720D0A766172204469616C6F67426F7849
6E646972656374506172616D410D0A766172205669727475616C416C6C6F630D0A0D0A6D6F762045502
C2020202020202020200D0A6D6F76204F45502C2020202020202020200D0A6D6F7620737472696E672C
20233031303130313031303130313031303130313031303130313031303130313031230D0A6D6F76207
3746F707065722C#</td>
</tr>
<tr>
number="1193"></td>
[SCRIPTSEC+100],
#2020202020202020200D0A6D6F762076615F73697A652C2020202020202020200D0A6D6F7620686F6C
6465722C2020202020202020200D0A6270687773204F45502C202278220D0A67706120224469616C6F6
7426F78496E646972656374506172616D41222C20227573657233322E646C6C220D0A6D6F7620446961
6C6F67426F78496E646972656374506172616D412C2020202024524553554C540D0A677061202256697
27475616C416C6C6F63222C20226B65726E656C33322E646C6C220D0A6D6F7620205669727475616C41
6C6C6F632C20202024524553554C540D0A2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F0D0A53544
152543A0D0A636D70#</td>
</tr>
<tr>
number="1194"></td>
[SCRIPTSEC+201],
#206569702C2045500D0A6A652053544152545F320D0A62706877732045502C202278220D0A62702045
500D0A6573746F0D0A636D70206569702C2045500D0A6A6E652053544152540D0A62706877630D0A626
30D0A2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F0D0A53544152545F323A0D0A62706877732056
69727475616C416C6C6F632C202278220D0A6573746F0D0A7274720D0A636D70205B6573702B30385D2
C2076615F73697A650D0A6A6E652053544152545F320D0A6D6F762076612C206561780D0A6573746F0D
0A6270687763205669727475616C416C6C6F630D0A6164642073746F707065722C2076610D0A6270207
3746F707065720D#</td>
</tr>
<tr>
number="1195"></td>
[SCRIPTSEC+301],
#0A62706877732073746F707065722C202278220D0A636D7020686F6C6465722C2030300D0A6A6E6520
50415443480D0A6270687773204469616C6F67426F78496E646972656374506172616D412C202278220
D0A62632073746F707065720D0A6573746F0D0A636D70206569702C204F45500D0A6A6520454E440D0A
66696E64206569702C2023433231343030230D0A6D6F76206569702C2024524553554C540D0A6270687
763204469616C6F67426F78496E646972656374506172616D410D0A6D6F76206561782C20323332430D
0A62702073746F707065720D0A62706877732073746F707065722C202278220D0A6A6D702046494C4C5
F49540D0A2F2F2F#</td>
</tr>
<tr>
number="1196"></td>
[SCRIPTSEC+401],
#2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F0D0A50415443483A0D0A61646420686F6C6465722C207661
0D0A6D6F76205B686F6C6465725D2C20234542232C2030310D0A2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2
F2F2F2F2F0D0A46494C4C5F49543A0D0A6573746F0D0A636D70206569702C204F45500D0A6A6520454E
440D0A696E6320636F756E740D0A73746F0D0A6573746F0D0A636D70206569702C204F45500D0A6A652
0454E440D0A696E6320636F756E740D0A636D7020636F756E742C2030320D0A6A652046494C4C5F5354
52494E470D0A2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F0D0A46494C4C5F535452494E473A0D0
A6D6F76205B65#</td>
</tr>
<tr>
number="1197"></td>
[SCRIPTSEC+500],
#73705D2C20737472696E670D0A6D6F7620636F756E742C2030300D0A73746F0D0A6A6D702046494C4C
5F49540D0A2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F2F0D0A454E443A0D0A62706877630D0A626
30D0A72657400#</td>
</tr>
<tr>
number="1198"></td>
{ENTRYPOINT}"</td>
</tr>
<tr>
number="1199"></td>
ENTRYPOINT, $RESULT</td>
</tr>
<tr>
number="1200"></td>
ENTRYPOINT</td>
</tr>
<tr>
number="1201"></td>
{OEP}"</td>
</tr>
<tr>
number="1202"></td>
<td id="LC1202" class="blob-code blob-code-inner js-file-line">mov OEP,
$RESULT</td>
</tr>
<tr>
number="1203"></td>
<td id="LC1203" class="blob-code blob-code-inner js-file-line">buf OEP</td>
</tr>
<tr>
number="1204"></td>
""{RECALC}""</td>
</tr>
<tr>
number="1205"></td>
##+$RESULT</td>
</tr>
<tr>
number="1206"></td>
</td>
</tr>
<tr>
number="1207"></td>
<td id="LC1207" class="blob-code blob-code-inner js-file-line">mov SECTEMP,
$RESULT</td>
</tr>
<tr>
number="1208"></td>
[SECTEMP], RECALC</td>
</tr>
<tr>
number="1209"></td>
<td id="LC1209" class="blob-code blob-code-inner js-file-line">inc SECTEMP
</td>
</tr>
<tr>
number="1210"></td>
<td id="LC1210" class="blob-code blob-code-inner js-file-line">inc SECTEMP
</td>
</tr>
<tr>
number="1211"></td>
[SECTEMP], 20</td>
</tr>
<tr>
number="1212"></td>
$RESULT</td>
</tr>
<tr>
number="1213"></td>
<td id="LC1213" class="blob-code blob-code-inner js-file-line">// buf
RECALC</td>
</tr>
<tr>
number="1214"></td>
<td id="LC1214" class="blob-code blob-code-inner js-file-line">dec SECTEMP
</td>
</tr>
<tr>
number="1215"></td>
<td id="LC1215" class="blob-code blob-code-inner js-file-line">dec SECTEMP
</td>
</tr>
<tr>
number="1216"></td>
<td id="LC1216" class="blob-code blob-code-inner js-file-line">free SECTEMP
</td>
</tr>
<tr>
number="1217"></td>
""{RECALC}""</td>
</tr>
<tr>
number="1218"></td>
##+$RESULT</td>
</tr>
<tr>
number="1219"></td>
[SCRIPTSEC+0A7], ENTRYPOINT</td>
</tr>
<tr>
number="1220"></td>
[SCRIPTSEC+0BA], OEP</td>
</tr>
<tr>
number="1221"></td>
[SCRIPTSEC+0D0], RECALC</td>
</tr>
<tr>
number="1222"></td>
[SCRIPTSEC+0D0], #23#,01</td>
</tr>
<tr>
number="1223"></td>
[SCRIPTSEC+0F1], #23#,01</td>
</tr>
<tr>
number="1224"></td>
<td id="LC1224" class="blob-code blob-code-inner js-file-line">gmemi check,
MEMORYBASE</td>
</tr>
<tr>
number="1225"></td>
<td id="LC1225" class="blob-code blob-code-inner js-file-line">sub check,
$RESULT</td>
</tr>
<tr>
number="1226"></td>
{check}"</td>
</tr>
<tr>
number="1227"></td>
<td id="LC1227" class="blob-code blob-code-inner js-file-line">mov check,
$RESULT</td>
</tr>
<tr>
number="1228"></td>
<td id="LC1228" class="blob-code blob-code-inner js-file-line">buf check
</td>
</tr>
<tr>
number="1229"></td>
[SCRIPTSEC+101], check</td>
</tr>
<tr>
number="1230"></td>
{ZPSEC_SIZE}"</td>
</tr>
<tr>
number="1231"></td>
ZPSEC_SIZE, $RESULT</td>
</tr>
<tr>
number="1232"></td>
ZPSEC_SIZE</td>
</tr>
<tr>
number="1233"></td>
[SCRIPTSEC+118], ZPSEC_SIZE</td>
</tr>
<tr>
number="1234"></td>
<td id="LC1234" class="blob-code blob-code-inner js-file-line">cmp SIGN, 00
</td>
</tr>
<tr>
number="1235"></td>
<td id="LC1235" class="blob-code blob-code-inner js-file-line">je NULLER
</td>
</tr>
<tr>
number="1236"></td>
<td id="LC1236" class="blob-code blob-code-inner js-file-line">gmemi SIGN,
MEMORYBASE</td>
</tr>
<tr>
number="1237"></td>
<td id="LC1237" class="blob-code blob-code-inner js-file-line">sub SIGN,
$RESULT</td>
</tr>
<tr>
number="1238"></td>
{SIGN}"</td>
</tr>
<tr>
number="1239"></td>
<td id="LC1239" class="blob-code blob-code-inner js-file-line">mov SIGN,
$RESULT</td>
</tr>
<tr>
number="1240"></td>
<td id="LC1240" class="blob-code blob-code-inner js-file-line">buf SIGN
</td>
</tr>
<tr>
number="1241"></td>
[SCRIPTSEC+12E], SIGN</td>
</tr>
<tr>
number="1242"></td>
<td id="LC1242" class="blob-code blob-code-inner js-file-line">jmp NULLER_2
</td>
</tr>
<tr>
number="1243"></td>
line">////////////////////</td>
</tr>
<tr>
number="1244"></td>
<td id="LC1244" class="blob-code blob-code-inner js-file-line">NULLER:</td>
</tr>
<tr>
number="1245"></td>
[SCRIPTSEC+12E], ##+"00000000"</td>
</tr>
<tr>
number="1246"></td>
line">////////////////////</td>
</tr>
<tr>
number="1247"></td>
<td id="LC1247" class="blob-code blob-code-inner js-file-line">NULLER_2:
</td>
</tr>
<tr>
number="1248"></td>
{PROCESSNAME_2}_DeCrypt_Script.txt"</td>
</tr>
<tr>
number="1249"></td>
<td id="LC1249" class="blob-code blob-code-inner js-file-line">dma
SCRIPTSEC, 558, $RESULT</td>
</tr>
<tr>
number="1250"></td>
SCRIPTSEC</td>
</tr>
<tr>
number="1251"></td>
line">////////////////////</td>
</tr>
<tr>
number="1252"></td>
<td id="LC1252" class="blob-code blob-code-inner js-file-line">NO_SCRIPT:
</td>
</tr>
<tr>
number="1253"></td>
</td>
</tr>
<tr>
number="1254"></td>
</tr>
<tr>
number="1255"></td>
</tr>
<tr>
number="1256"></td>
line">////////////////////</td>
</tr>
<tr>
number="1257"></td>
<td id="LC1257" class="blob-code blob-code-inner js-file-line">VARS:</td>
</tr>
<tr>
number="1258"></td>
<td id="LC1258" class="blob-code blob-code-inner js-file-line">var STUCK
</td>
</tr>
<tr>
number="1259"></td>
<td id="LC1259" class="blob-code blob-code-inner js-file-line">var TAFF
</td>
</tr>
<tr>
number="1260"></td>
<td id="LC1260" class="blob-code blob-code-inner js-file-line">var SIGN
</td>
</tr>
<tr>
number="1261"></td>
<td id="LC1261" class="blob-code blob-code-inner js-file-line">var
PROCESSNAME_2</td>
</tr>
<tr>
number="1262"></td>
<td id="LC1262" class="blob-code blob-code-inner js-file-line">var SECTEMP
</td>
</tr>
<tr>
number="1263"></td>
SCRIPTSEC</td>
</tr>
<tr>
number="1264"></td>
<td id="LC1264" class="blob-code blob-code-inner js-file-line">var SAUER_2
</td>
</tr>
<tr>
number="1265"></td>
<td id="LC1265" class="blob-code blob-code-inner js-file-line">var COUNT
</td>
</tr>
<tr>
number="1266"></td>
SEC_ALL_SIZE</td>
</tr>
<tr>
number="1267"></td>
<td id="LC1267" class="blob-code blob-code-inner js-file-line">var SEC_ALL
</td>
</tr>
<tr>
number="1268"></td>
<td id="LC1268" class="blob-code blob-code-inner js-file-line">var HAMMER
</td>
</tr>
<tr>
number="1269"></td>
<td id="LC1269" class="blob-code blob-code-inner js-file-line">var SAUER
</td>
</tr>
<tr>
number="1270"></td>
<td id="LC1270" class="blob-code blob-code-inner js-file-line">var TT_1
</td>
</tr>
<tr>
number="1271"></td>
SECTION_T</td>
</tr>
<tr>
number="1272"></td>
SECTION_T_BAK</td>
</tr>
<tr>
number="1273"></td>
<td id="LC1273" class="blob-code blob-code-inner js-file-line">var APILOG
</td>
</tr>
<tr>
number="1274"></td>
<td id="LC1274" class="blob-code blob-code-inner js-file-line">var APILOG_2
</td>
</tr>
<tr>
number="1275"></td>
<td id="LC1275" class="blob-code blob-code-inner js-file-line">var APILOG_3
</td>
</tr>
<tr>
number="1276"></td>
<td id="LC1276" class="blob-code blob-code-inner js-file-line">var other
</td>
</tr>
<tr>
number="1277"></td>
<td id="LC1277" class="blob-code blob-code-inner js-file-line">var TAMAX
</td>
</tr>
<tr>
number="1278"></td>
SEC_F_SIZE</td>
</tr>
<tr>
number="1279"></td>
SEC_E_SIZE</td>
</tr>
<tr>
number="1280"></td>
SEC_D_SIZE</td>
</tr>
<tr>
number="1281"></td>
SEC_C_SIZE</td>
</tr>
<tr>
number="1282"></td>
SEC_A_SIZE</td>
</tr>
<tr>
number="1283"></td>
<td id="LC1283" class="blob-code blob-code-inner js-file-line">var NSECTION
</td>
</tr>
<tr>
number="1284"></td>
<td id="LC1284" class="blob-code blob-code-inner js-file-line">var SEC_2
</td>
</tr>
<tr>
number="1285"></td>
CODESECTION_bak</td>
</tr>
<tr>
number="1286"></td>
<td id="LC1286" class="blob-code blob-code-inner js-file-line">var TEMP
</td>
</tr>
<tr>
number="1287"></td>
<td id="LC1287" class="blob-code blob-code-inner js-file-line">var RECALC
</td>
</tr>
<tr>
number="1288"></td>
<td id="LC1288" class="blob-code blob-code-inner js-file-line">var ENDOF_2
</td>
</tr>
<tr>
number="1289"></td>
<td id="LC1289" class="blob-code blob-code-inner js-file-line">var STRING_A
</td>
</tr>
<tr>
number="1290"></td>
<td id="LC1290" class="blob-code blob-code-inner js-file-line">var ENDOF
</td>
</tr>
<tr>
number="1291"></td>
<td id="LC1291" class="blob-code blob-code-inner js-file-line">var P1</td>
</tr>
<tr>
number="1292"></td>
<td id="LC1292" class="blob-code blob-code-inner js-file-line">var SEC_A
</td>
</tr>
<tr>
number="1293"></td>
<td id="LC1293" class="blob-code blob-code-inner js-file-line">var SEC_B
</td>
</tr>
<tr>
number="1294"></td>
<td id="LC1294" class="blob-code blob-code-inner js-file-line">var SEC_C
</td>
</tr>
<tr>
number="1295"></td>
<td id="LC1295" class="blob-code blob-code-inner js-file-line">var SEC_D
</td>
</tr>
<tr>
number="1296"></td>
<td id="LC1296" class="blob-code blob-code-inner js-file-line">var SEC_E
</td>
</tr>
<tr>
number="1297"></td>
<td id="LC1297" class="blob-code blob-code-inner js-file-line">var SEC_F
</td>
</tr>
<tr>
number="1298"></td>
<td id="LC1298" class="blob-code blob-code-inner js-file-line">var DC1</td>
</tr>
<tr>
number="1299"></td>
<td id="LC1299" class="blob-code blob-code-inner js-file-line">var DC2</td>
</tr>
<tr>
number="1300"></td>
<td id="LC1300" class="blob-code blob-code-inner js-file-line">var DC1_IN
</td>
</tr>
<tr>
number="1301"></td>
<td id="LC1301" class="blob-code blob-code-inner js-file-line">var DC2_IN
</td>
</tr>
<tr>
number="1302"></td>
<td id="LC1302" class="blob-code blob-code-inner js-file-line">var check
</td>
</tr>
<tr>
number="1303"></td>
PROCESSID</td>
</tr>
<tr>
number="1304"></td>
PROCESSNAME</td>
</tr>
<tr>
number="1305"></td>
</tr>
<tr>
number="1306"></td>
</tr>
<tr>
number="1307"></td>
PROCESSNAME_FREE_SPACE_2</td>
</tr>
<tr>
number="1308"></td>
EIP_STORE</td>
</tr>
<tr>
number="1309"></td>
MODULEBASE</td>
</tr>
<tr>
number="1310"></td>
PE_HEADER</td>
</tr>
<tr>
number="1311"></td>
CURRENTDIR</td>
</tr>
<tr>
number="1312"></td>
PE_HEADER_SIZE</td>
</tr>
<tr>
number="1313"></td>
CODESECTION</td>
</tr>
<tr>
number="1314"></td>
</tr>
<tr>
number="1315"></td>
MODULESIZE</td>
</tr>
<tr>
number="1316"></td>
MODULEBASE_and_MODULESIZE</td>
</tr>
<tr>
number="1317"></td>
PE_SIGNATURE</td>
</tr>
<tr>
number="1318"></td>
<td id="LC1318" class="blob-code blob-code-inner js-file-line">var PE_SIZE
</td>
</tr>
<tr>
number="1319"></td>
PE_INFO_START</td>
</tr>
<tr>
number="1320"></td>
ENTRYPOINT</td>
</tr>
<tr>
number="1321"></td>
BASE_OF_CODE</td>
</tr>
<tr>
number="1322"></td>
IMAGEBASE</td>
</tr>
<tr>
number="1323"></td>
SIZE_OF_IMAGE</td>
</tr>
<tr>
number="1324"></td>
TLS_TABLE_ADDRESS</td>
</tr>
<tr>
number="1325"></td>
TLS_TABLE_SIZE</td>
</tr>
<tr>
number="1326"></td>
IMPORT_ADDRESS_TABLE</td>
</tr>
<tr>
number="1327"></td>
IMPORT_ADDRESS_SIZE</td>
</tr>
<tr>
number="1328"></td>
<td id="LC1328" class="blob-code blob-code-inner js-file-line">var SECTIONS
</td>
</tr>
<tr>
number="1329"></td>
SECTION_01</td>
</tr>
<tr>
number="1330"></td>
SECTION_01_NAME</td>
</tr>
<tr>
number="1331"></td>
MAJORLINKERVERSION</td>
</tr>
<tr>
number="1332"></td>
MINORLINKERVERSION</td>
</tr>
<tr>
number="1333"></td>
PROGRAMLANGUAGE</td>
</tr>
<tr>
number="1334"></td>
IMPORT_TABLE_ADDRESS</td>
</tr>
<tr>
number="1335"></td>
IMPORT_TABLE_ADDRESS_END</td>
</tr>
<tr>
number="1336"></td>
IMPORT_TABLE_ADDRESS_CALC</td>
</tr>
<tr>
number="1337"></td>
IMPORT_TABLE_SIZE</td>
</tr>
<tr>
number="1338"></td>
IAT_BEGIN</td>
</tr>
<tr>
number="1339"></td>
IMPORT_ADDRESS_TABLE_END</td>
</tr>
<tr>
number="1340"></td>
<td id="LC1340" class="blob-code blob-code-inner js-file-line">var API_IN
</td>
</tr>
<tr>
number="1341"></td>
<td id="LC1341" class="blob-code blob-code-inner js-file-line">var API_NAME
</td>
</tr>
<tr>
number="1342"></td>
<td id="LC1342" class="blob-code blob-code-inner js-file-line">var MODULE
</td>
</tr>
<tr>
number="1343"></td>
IMPORT_FUNCTIONS</td>
</tr>
<tr>
number="1344"></td>
IATSTORE_SECTION</td>
</tr>
<tr>
number="1345"></td>
<td id="LC1345" class="blob-code blob-code-inner js-file-line">var IATSTORE
</td>
</tr>
<tr>
number="1346"></td>
</tr>
<tr>
number="1347"></td>
GetModuleHandleA</td>
</tr>
<tr>
number="1348"></td>
VirtualAlloc</td>
</tr>
<tr>
number="1349"></td>
MapViewOfFile</td>
</tr>
<tr>
number="1350"></td>
DialogRet</td>
</tr>
<tr>
number="1351"></td>
<td id="LC1351" class="blob-code blob-code-inner js-file-line">var 1ESP
</td>
</tr>
<tr>
number="1352"></td>
<td id="LC1352" class="blob-code blob-code-inner js-file-line">var ESP_OEP
</td>
</tr>
<tr>
number="1353"></td>
<td id="LC1353" class="blob-code blob-code-inner js-file-line">var DECR
</td>
</tr>
<tr>
number="1354"></td>
<td id="LC1354" class="blob-code blob-code-inner js-file-line">var GMHA
</td>
</tr>
<tr>
number="1355"></td>
<td id="LC1355" class="blob-code blob-code-inner js-file-line">var heller
</td>
</tr>
<tr>
number="1356"></td>
<td id="LC1356" class="blob-code blob-code-inner js-file-line">var sFile
</td>
</tr>
<tr>
number="1357"></td>
check_add</td>
</tr>
<tr>
number="1358"></td>
<td id="LC1358" class="blob-code blob-code-inner js-file-line">var RETURNER
</td>
</tr>
<tr>
number="1359"></td>
<td id="LC1359" class="blob-code blob-code-inner js-file-line">var ALOC
</td>
</tr>
<tr>
number="1360"></td>
<td id="LC1360" class="blob-code blob-code-inner js-file-line">var EXTRA_2
</td>
</tr>
<tr>
number="1361"></td>
<td id="LC1361" class="blob-code blob-code-inner js-file-line">var EXTRA
</td>
</tr>
<tr>
number="1362"></td>
<td id="LC1362" class="blob-code blob-code-inner js-file-line">var VA</td>
</tr>
<tr>
number="1363"></td>
<td id="LC1363" class="blob-code blob-code-inner js-file-line">var VP</td>
</tr>
<tr>
number="1364"></td>
<td id="LC1364" class="blob-code blob-code-inner js-file-line">var DC</td>
</tr>
<tr>
number="1365"></td>
<td id="LC1365" class="blob-code blob-code-inner js-file-line">var API</td>
</tr>
<tr>
number="1366"></td>
CMP_PATCH</td>
</tr>
<tr>
number="1367"></td>
SECOND_LOOP</td>
</tr>
<tr>
number="1368"></td>
<td id="LC1368" class="blob-code blob-code-inner js-file-line">var STRING_2
</td>
</tr>
<tr>
number="1369"></td>
<td id="LC1369" class="blob-code blob-code-inner js-file-line">var counta
</td>
</tr>
<tr>
number="1370"></td>
<td id="LC1370" class="blob-code blob-code-inner js-file-line">var test
</td>
</tr>
<tr>
number="1371"></td>
<td id="LC1371" class="blob-code blob-code-inner js-file-line">var STRING
</td>
</tr>
<tr>
number="1372"></td>
<td id="LC1372" class="blob-code blob-code-inner js-file-line">var CALC
</td>
</tr>
<tr>
number="1373"></td>
<td id="LC1373" class="blob-code blob-code-inner js-file-line">var I1</td>
</tr>
<tr>
number="1374"></td>
</tr>
<tr>
number="1375"></td>
</tr>
<tr>
number="1376"></td>
</tr>
<tr>
number="1377"></td>
<td id="LC1377" class="blob-code blob-code-inner js-file-line">var ME</td>
</tr>
<tr>
number="1378"></td>
<td id="LC1378" class="blob-code blob-code-inner js-file-line">var points
</td>
</tr>
<tr>
number="1379"></td>
<td id="LC1379" class="blob-code blob-code-inner js-file-line">var sFile
</td>
</tr>
<tr>
number="1380"></td>
scriptname</td>
</tr>
<tr>
number="1381"></td>
<td id="LC1381" class="blob-code blob-code-inner js-file-line">var PLUS_1
</td>
</tr>
<tr>
number="1382"></td>
<td id="LC1382" class="blob-code blob-code-inner js-file-line">var PLUS_2
</td>
</tr>
<tr>
number="1383"></td>
<td id="LC1383" class="blob-code blob-code-inner js-file-line">var SIZE_OF
</td>
</tr>
<tr>
number="1384"></td>
<td id="LC1384" class="blob-code blob-code-inner js-file-line">var TEMP
</td>
</tr>
<tr>
number="1385"></td>
PATCH_ADDR</td>
</tr>
<tr>
number="1386"></td>
<td id="LC1386" class="blob-code blob-code-inner js-file-line">var CHECK
</td>
</tr>
<tr>
number="1387"></td>
TEMP_CHECK</td>
</tr>
<tr>
number="1388"></td>
TEMP_CHECK_IN</td>
</tr>
<tr>
number="1389"></td>
PATCH_ADDR</td>
</tr>
<tr>
number="1390"></td>
INLINE_YES</td>
</tr>
<tr>
number="1391"></td>
SetWindowTextA</td>
</tr>
<tr>
number="1392"></td>
<td id="LC1392" class="blob-code blob-code-inner js-file-line">var patched
</td>
</tr>
<tr>
number="1393"></td>
DWORD_1_TEMP</td>
</tr>
<tr>
number="1394"></td>
<td id="LC1394" class="blob-code blob-code-inner js-file-line">var run</td>
</tr>
<tr>
number="1395"></td>
<td id="LC1395" class="blob-code blob-code-inner js-file-line">var DWORD
</td>
</tr>
<tr>
number="1396"></td>
<td id="LC1396" class="blob-code blob-code-inner js-file-line">var DWORD_1
</td>
</tr>
<tr>
number="1397"></td>
<td id="LC1397" class="blob-code blob-code-inner js-file-line">var DWORD_2
</td>
</tr>
<tr>
number="1398"></td>
<td id="LC1398" class="blob-code blob-code-inner js-file-line">var END_CRC
</td>
</tr>
<tr>
number="1399"></td>
<td id="LC1399" class="blob-code blob-code-inner js-file-line">var CRC_CODE
</td>
</tr>
<tr>
number="1400"></td>
<td id="LC1400" class="blob-code blob-code-inner js-file-line">var NEW_CRC
</td>
</tr>
<tr>
number="1401"></td>
<td id="LC1401" class="blob-code blob-code-inner js-file-line">var OLD_CRC
</td>
</tr>
<tr>
number="1402"></td>
CRC_ADDRESS</td>
</tr>
<tr>
number="1403"></td>
MAPPEDFILE</td>
</tr>
<tr>
number="1404"></td>
<td id="LC1404" class="blob-code blob-code-inner js-file-line">var CRC</td>
</tr>
<tr>
number="1405"></td>
<td id="LC1405" class="blob-code blob-code-inner js-file-line">var CRCBASE
</td>
</tr>
<tr>
number="1406"></td>
<td id="LC1406" class="blob-code blob-code-inner js-file-line">var ALOC
</td>
</tr>
<tr>
number="1407"></td>
<td id="LC1407" class="blob-code blob-code-inner js-file-line">var A_SIZE
</td>
</tr>
<tr>
number="1408"></td>
A_ADDRESS</td>
</tr>
<tr>
number="1409"></td>
<td id="LC1409" class="blob-code blob-code-inner js-file-line">var B_SIZE
</td>
</tr>
<tr>
number="1410"></td>
B_ADDRESS</td>
</tr>
<tr>
number="1411"></td>
<td id="LC1411" class="blob-code blob-code-inner js-file-line">var C_SIZE
</td>
</tr>
<tr>
number="1412"></td>
C_ADDRESS</td>
</tr>
<tr>
number="1413"></td>
<td id="LC1413" class="blob-code blob-code-inner js-file-line">var D_SIZE
</td>
</tr>
<tr>
number="1414"></td>
D_ADDRESS</td>
</tr>
<tr>
number="1415"></td>
<td id="LC1415" class="blob-code blob-code-inner js-file-line">var E_SIZE
</td>
</tr>
<tr>
number="1416"></td>
E_ADDRESS</td>
</tr>
<tr>
number="1417"></td>
MapViewOfFile</td>
</tr>
<tr>
number="1418"></td>
VirtualAlloc</td>
</tr>
<tr>
number="1419"></td>
<td id="LC1419" class="blob-code blob-code-inner js-file-line">var ort</td>
</tr>
<tr>
number="1420"></td>
<td id="LC1420" class="blob-code blob-code-inner js-file-line">var test
</td>
</tr>
<tr>
number="1421"></td>
<td id="LC1421" class="blob-code blob-code-inner js-file-line">var place
</td>
</tr>
<tr>
number="1422"></td>
<td id="LC1422" class="blob-code blob-code-inner js-file-line">var mem</td>
</tr>
<tr>
number="1423"></td>
<td id="LC1423" class="blob-code blob-code-inner js-file-line">var ID</td>
</tr>
<tr>
number="1424"></td>
<td id="LC1424" class="blob-code blob-code-inner js-file-line">var ID2</td>
</tr>
<tr>
number="1425"></td>
<td id="LC1425" class="blob-code blob-code-inner js-file-line">var ID_1
</td>
</tr>
<tr>
number="1426"></td>
<td id="LC1426" class="blob-code blob-code-inner js-file-line">var ID_2
</td>
</tr>
<tr>
number="1427"></td>
<td id="LC1427" class="blob-code blob-code-inner js-file-line">var FOUND
</td>
</tr>
<tr>
number="1428"></td>
<td id="LC1428" class="blob-code blob-code-inner js-file-line">var VMBASE
</td>
</tr>
<tr>
number="1429"></td>
<td id="LC1429" class="blob-code blob-code-inner js-file-line">var baceip
</td>
</tr>
<tr>
number="1430"></td>
DeviceIoControl</td>
</tr>
<tr>
number="1431"></td>
VirtualProtect</td>
</tr>
<tr>
number="1432"></td>
PROCESSID</td>
</tr>
<tr>
number="1433"></td>
PROCESSNAME</td>
</tr>
<tr>
number="1434"></td>
PROCESSNAME_2</td>
</tr>
<tr>
number="1435"></td>
</tr>
<tr>
number="1436"></td>
</tr>
<tr>
number="1437"></td>
PROCESSNAME_FREE_SPACE_2</td>
</tr>
<tr>
number="1438"></td>
EIP_STORE</td>
</tr>
<tr>
number="1439"></td>
MODULEBASE</td>
</tr>
<tr>
number="1440"></td>
PE_HEADER</td>
</tr>
<tr>
number="1441"></td>
CURRENTDIR</td>
</tr>
<tr>
number="1442"></td>
PE_HEADER_SIZE</td>
</tr>
<tr>
number="1443"></td>
CODESECTION</td>
</tr>
<tr>
number="1444"></td>
</tr>
<tr>
number="1445"></td>
MODULESIZE</td>
</tr>
<tr>
number="1446"></td>
</tr>
<tr>
number="1447"></td>
PE_SIGNATURE</td>
</tr>
<tr>
number="1448"></td>
<td id="LC1448" class="blob-code blob-code-inner js-file-line">var PE_SIZE
</td>
</tr>
<tr>
number="1449"></td>
PE_INFO_START</td>
</tr>
<tr>
number="1450"></td>
ENTRYPOINT</td>
</tr>
<tr>
number="1451"></td>
BASE_OF_CODE</td>
</tr>
<tr>
number="1452"></td>
IMAGEBASE</td>
</tr>
<tr>
number="1453"></td>
SIZE_OF_IMAGE</td>
</tr>
<tr>
number="1454"></td>
TLS_TABLE_ADDRESS</td>
</tr>
<tr>
number="1455"></td>
TLS_TABLE_SIZE</td>
</tr>
<tr>
number="1456"></td>
IMPORT_ADDRESS_TABLE</td>
</tr>
<tr>
number="1457"></td>
IMPORT_ADDRESS_SIZE</td>
</tr>
<tr>
number="1458"></td>
<td id="LC1458" class="blob-code blob-code-inner js-file-line">var SECTIONS
</td>
</tr>
<tr>
number="1459"></td>
SECTION_01</td>
</tr>
<tr>
number="1460"></td>
SECTION_01_NAME</td>
</tr>
<tr>
number="1461"></td>
MAJORLINKERVERSION</td>
</tr>
<tr>
number="1462"></td>
MINORLINKERVERSION</td>
</tr>
<tr>
number="1463"></td>
PROGRAMLANGUAGE</td>
</tr>
<tr>
number="1464"></td>
IMPORT_TABLE_ADDRESS</td>
</tr>
<tr>
number="1465"></td>
IMPORT_TABLE_ADDRESS_END</td>
</tr>
<tr>
number="1466"></td>
IMPORT_TABLE_ADDRESS_CALC</td>
</tr>
<tr>
number="1467"></td>
IMPORT_TABLE_SIZE</td>
</tr>
<tr>
number="1468"></td>
IAT_BEGIN</td>
</tr>
<tr>
number="1469"></td>
IMPORT_ADDRESS_TABLE_END</td>
</tr>
<tr>
number="1470"></td>
<td id="LC1470" class="blob-code blob-code-inner js-file-line">var API_IN
</td>
</tr>
<tr>
number="1471"></td>
<td id="LC1471" class="blob-code blob-code-inner js-file-line">var API_NAME
</td>
</tr>
<tr>
number="1472"></td>
<td id="LC1472" class="blob-code blob-code-inner js-file-line">var MODULE
</td>
</tr>
<tr>
number="1473"></td>
IMPORT_FUNCTIONS</td>
</tr>
<tr>
number="1474"></td>
IATSTORE_SECTION</td>
</tr>
<tr>
number="1475"></td>
<td id="LC1475" class="blob-code blob-code-inner js-file-line">var IATSTORE
</td>
</tr>
<tr>
number="1476"></td>
<td id="LC1476" class="blob-code blob-code-inner js-file-line">var OTHERCRC
</td>
</tr>
<tr>
number="1477"></td>
<td id="LC1477" class="blob-code blob-code-inner js-file-line">var dll</td>
</tr>
<tr>
number="1478"></td>
<td id="LC1478" class="blob-code blob-code-inner js-file-line">var call
</td>
</tr>
<tr>
number="1479"></td>
<td id="LC1479" class="blob-code blob-code-inner js-file-line">var ZAM</td>
</tr>
<tr>
number="1480"></td>
<td id="LC1480" class="blob-code blob-code-inner js-file-line">var VMBASE_2
</td>
</tr>
<tr>
number="1481"></td>
<td id="LC1481" class="blob-code blob-code-inner js-file-line">var BADBOY
</td>
</tr>
<tr>
number="1482"></td>
<td id="LC1482" class="blob-code blob-code-inner js-file-line">var TALYOR
</td>
</tr>
<tr>
number="1483"></td>
<td id="LC1483" class="blob-code blob-code-inner js-file-line">var NEWPATCH
</td>
</tr>
<tr>
number="1484"></td>
<td id="LC1484" class="blob-code blob-code-inner js-file-line">var FACE
</td>
</tr>
<tr>
number="1485"></td>
TEMP_EXTRA</td>
</tr>
<tr>
number="1486"></td>
<td id="LC1486" class="blob-code blob-code-inner js-file-line">var Temp_1
</td>
</tr>
<tr>
number="1487"></td>
</td>
</tr>
<tr>
number="1488"></td>
<td id="LC1488" class="blob-code blob-code-inner js-file-line">var testsec
</td>
</tr>
<tr>
number="1489"></td>
EXEFILENAME</td>
</tr>
<tr>
number="1490"></td>
</tr>
<tr>
number="1491"></td>
<td id="LC1491" class="blob-code blob-code-inner js-file-line">var CHAR
</td>
</tr>
<tr>
number="1492"></td>
</td>
</tr>
<tr>
number="1493"></td>
</td>
</tr>
<tr>
number="1494"></td>
<td id="LC1494" class="blob-code blob-code-inner js-file-line">var NO_CODE
</td>
</tr>
<tr>
number="1495"></td>
<td id="LC1495" class="blob-code blob-code-inner js-file-line">var AA</td>
</tr>
<tr>
number="1496"></td>
<td id="LC1496" class="blob-code blob-code-inner js-file-line">var CRCSET
</td>
</tr>
<tr>
number="1497"></td>
<td id="LC1497" class="blob-code blob-code-inner js-file-line">var file
</td>
</tr>
<tr>
number="1498"></td>
<td id="LC1498" class="blob-code blob-code-inner js-file-line">var sFileA
</td>
</tr>
<tr>
number="1499"></td>
<td id="LC1499" class="blob-code blob-code-inner js-file-line">var sFileB
</td>
</tr>
<tr>
number="1500"></td>
<td id="LC1500" class="blob-code blob-code-inner js-file-line">var KULI
</td>
</tr>
<tr>
number="1501"></td>
<td id="LC1501" class="blob-code blob-code-inner js-file-line">var KARA
</td>
</tr>
<tr>
number="1502"></td>
<td id="LC1502" class="blob-code blob-code-inner js-file-line">var TONNE
</td>
</tr>
<tr>
number="1503"></td>
<td id="LC1503" class="blob-code blob-code-inner js-file-line">var IBS</td>
</tr>
<tr>
number="1504"></td>
<td id="LC1504" class="blob-code blob-code-inner js-file-line">var U1</td>
</tr>
<tr>
number="1505"></td>
OEP_EXTRA</td>
</tr>
<tr>
number="1506"></td>
<td id="LC1506" class="blob-code blob-code-inner js-file-line">gpa
"DialogBoxIndirectParamA", "user32.dll"</td>
</tr>
<tr>
number="1507"></td>
DialogBoxIndirectParamA, $RESULT</td>
</tr>
<tr>
number="1508"></td>
DialogBoxIndirectParamA, #C21400#</td>
</tr>
<tr>
number="1509"></td>
DialogRet, $RESULT</td>
</tr>
<tr>
number="1510"></td>
"GetModuleHandleA", "kernel32.dll"</td>
</tr>
<tr>
number="1511"></td>
GetModuleHandleA, $RESULT</td>
</tr>
<tr>
number="1512"></td>
"VirtualAlloc", "kernel32.dll"</td>
</tr>
<tr>
number="1513"></td>
VirtualAlloc, $RESULT</td>
</tr>
<tr>
number="1514"></td>
"VirtualProtect", "kernel32.dll"</td>
</tr>
<tr>
number="1515"></td>
VirtualProtect, $RESULT</td>
</tr>
<tr>
number="1516"></td>
"MapViewOfFile", "kernel32.dll"</td>
</tr>
<tr>
number="1517"></td>
MapViewOfFile, $RESULT</td>
</tr>
<tr>
number="1518"></td>
scriptname, "ZProtect Full DeCryption & InLine Patcher 1.0"</td>
</tr>
<tr>
number="1519"></td>
<td id="LC1519" class="blob-code blob-code-inner js-file-line">mov points,
"******************************************************"</td>
</tr>
<tr>
number="1520"></td>
<td id="LC1520" class="blob-code blob-code-inner js-file-line">mov ME,
"LCF-AT"</td>
</tr>
<tr>
number="1521"></td>
</tr>
<tr>
number="1522"></td>
line">////////////////////</td>
</tr>
<tr>
number="1523"></td>
line">START_OF_INLINE:</td>
</tr>
<tr>
number="1524"></td>
line">////////////////////</td>
</tr>
<tr>
number="1525"></td>
<td id="LC1525" class="blob-code blob-code-inner js-file-line">NAME_FIND:
</td>
</tr>
<tr>
number="1526"></td>
<td id="LC1526" class="blob-code blob-code-inner js-file-line">mov STUCK,
00</td>
</tr>
<tr>
number="1527"></td>
<td id="LC1527" class="blob-code blob-code-inner js-file-line">add PE_TEMP,
0F8</td>
</tr>
<tr>
number="1528"></td>
line">////////////////////</td>
</tr>
<tr>
number="1529"></td>
<td id="LC1529" class="blob-code blob-code-inner js-file-line">NAME_FIND_2:
</td>
</tr>
<tr>
number="1530"></td>
[PE_TEMP], 07</td>
</tr>
<tr>
number="1531"></td>
<td id="LC1531" class="blob-code blob-code-inner js-file-line">mov NAME,
$RESULT</td>
</tr>
<tr>
number="1532"></td>
<td id="LC1532" class="blob-code blob-code-inner js-file-line">str NAME
</td>
</tr>
<tr>
number="1533"></td>
<td id="LC1533" class="blob-code blob-code-inner js-file-line">cmp NAME,
".MaThiO"</td>
</tr>
<tr>
number="1534"></td>
NAME_FOUND</td>
</tr>
<tr>
number="1535"></td>
<td id="LC1535" class="blob-code blob-code-inner js-file-line">add PE_TEMP,
28</td>
</tr>
<tr>
number="1536"></td>
[PE_TEMP], 00</td>
</tr>
<tr>
number="1537"></td>
NAME_FIND_2</td>
</tr>
<tr>
number="1538"></td>
""</td>
</tr>
<tr>
number="1539"></td>
</td>
</tr>
<tr>
number="1540"></td>
</tr>
<tr>
number="1541"></td>
$RESULT</td>
</tr>
<tr>
number="1542"></td>
$RESULT</td>
</tr>
<tr>
number="1543"></td>
" "</td>
</tr>
<tr>
number="1544"></td>
" "</td>
</tr>
<tr>
number="1545"></td>
"No .MaThiO section found!Inline is not posible now!"</td>
</tr>
<tr>
number="1546"></td>
" "</td>
</tr>
<tr>
number="1547"></td>
"Add a new section called .MaThiO with a min size of 1000!"</td>
</tr>
<tr>
number="1548"></td>
<td id="LC1548" class="blob-code blob-code-inner js-file-line">log "No
.MaThiO section found!Inline is not posible now!Add a new section called .MaThiO
with a min size of 1000!"</td>
</tr>
<tr>
number="1549"></td>
""</td>
</tr>
<tr>
number="1550"></td>
{scriptname} \r\n\r\n{points} \r\n\r\nThe last section name is not .MaThiO!
\r\n\r\nSo add a new section called .MaThiO with a min size of 1000!
</tr>
<tr>
number="1551"></td>
</td>
</tr>
<tr>
number="1552"></td>
</td>
</tr>
<tr>
number="1553"></td>
line">////////////////////</td>
</tr>
<tr>
number="1554"></td>
<td id="LC1554" class="blob-code blob-code-inner js-file-line">NAME_FOUND:
</td>
</tr>
<tr>
number="1555"></td>
"The last section name is {NAME}"</td>
</tr>
<tr>
number="1556"></td>
""</td>
</tr>
<tr>
number="1557"></td>
""</td>
</tr>
<tr>
number="1558"></td>
<td id="LC1558" class="blob-code blob-code-inner js-file-line">mov SIZE_OF,
[PE_TEMP+08]</td>
</tr>
<tr>
number="1559"></td>
[PE_TEMP+08], 1000</td>
</tr>
<tr>
number="1560"></td>
<td id="LC1560" class="blob-code blob-code-inner js-file-line">je SIZE_OK
</td>
</tr>
<tr>
number="1561"></td>
<td id="LC1561" class="blob-code blob-code-inner js-file-line">ja SIZE_OK
</td>
</tr>
<tr>
number="1562"></td>
[PE_TEMP+08]</td>
</tr>
<tr>
number="1563"></td>
<td id="LC1563" class="blob-code blob-code-inner js-file-line">mov SIZE_OF,
[PE_TEMP+08]</td>
</tr>
<tr>
number="1564"></td>
{scriptname} \r\n\r\n{points} \r\n\r\nThe last section {NAME} has a size of {TEMP}
but this is too low!Min size you need is 1000! \r\n\r\n{points} \r\n{ME}"</td>
</tr>
<tr>
number="1565"></td>
</td>
</tr>
<tr>
number="1566"></td>
"The last section {NAME} has a size of {TEMP} but this is too low!Min size you
need is 1000!"</td>
</tr>
<tr>
number="1567"></td>
""</td>
</tr>
<tr>
number="1568"></td>
""</td>
</tr>
<tr>
number="1569"></td>
</td>
</tr>
<tr>
number="1570"></td>
line">////////////////////</td>
</tr>
<tr>
number="1571"></td>
<td id="LC1571" class="blob-code blob-code-inner js-file-line">SIZE_OK:
</td>
</tr>
<tr>
number="1572"></td>
[PE_TEMP+0C]</td>
</tr>
<tr>
number="1573"></td>
TEMP_EXTRA, [PE_TEMP+0C]</td>
</tr>
<tr>
number="1574"></td>
<td id="LC1574" class="blob-code blob-code-inner js-file-line">add TEMP,
IMAGEBASE</td>
</tr>
<tr>
number="1575"></td>
PATCH_ADDR, TEMP</td>
</tr>
<tr>
number="1576"></td>
[TEMP], 1000</td>
</tr>
<tr>
number="1577"></td>
<td id="LC1577" class="blob-code blob-code-inner js-file-line">mov CHECK,
$RESULT</td>
</tr>
<tr>
number="1578"></td>
<td id="LC1578" class="blob-code blob-code-inner js-file-line">buf CHECK
</td>
</tr>
<tr>
number="1579"></td>
</td>
</tr>
<tr>
number="1580"></td>
TEMP_CHECK, $RESULT</td>
</tr>
<tr>
number="1581"></td>
[TEMP_CHECK], 1000</td>
</tr>
<tr>
number="1582"></td>
TEMP_CHECK_IN, $RESULT</td>
</tr>
<tr>
number="1583"></td>
TEMP_CHECK_IN</td>
</tr>
<tr>
number="1584"></td>
TEMP_CHECK_IN, CHECK</td>
</tr>
<tr>
number="1585"></td>
SECTION_IS_FREE</td>
</tr>
<tr>
number="1586"></td>
""</td>
</tr>
<tr>
number="1587"></td>
"The last section {NAME} | {PATCH_ADDR} | {SIZE_OF} is not empty!Can I
overwrite this section?"</td>
</tr>
<tr>
number="1588"></td>
""</td>
</tr>
<tr>
number="1589"></td>
""</td>
</tr>
<tr>
number="1590"></td>
{scriptname} \r\n\r\n{points} \r\n\r\nThe last section {NAME} | {PATCH_ADDR} |
{SIZE_OF} is not empty!Can I overwrite this section? \r\n\r\n{points}
\r\n{ME}"</td>
</tr>
<tr>
number="1591"></td>
<td id="LC1591" class="blob-code blob-code-inner js-file-line">msgyn
$RESULT</td>
</tr>
<tr>
number="1592"></td>
01</td>
</tr>
<tr>
number="1593"></td>
SECTION_IS_FREE</td>
</tr>
<tr>
number="1594"></td>
</td>
</tr>
<tr>
number="1595"></td>
line">////////////////////</td>
</tr>
<tr>
number="1596"></td>
line">SECTION_IS_FREE:</td>
</tr>
<tr>
number="1597"></td>
TEMP_CHECK</td>
</tr>
<tr>
number="1598"></td>
TEMP_CHECK, 00</td>
</tr>
<tr>
number="1599"></td>
<td id="LC1599" class="blob-code blob-code-inner js-file-line">fill
PATCH_ADDR, SIZE_OF, 00</td>
</tr>
<tr>
number="1600"></td>
[PATCH_ADDR],
#60A1AAAAAAAA68AAAAAAAA6A40680001000050FF15AAAAAAAAA1AAAAAAAA8B08880DBBBBBBBB408B08
890DCCCCCCCC61#</td>
</tr>
<tr>
number="1601"></td>
[PATCH_ADDR+030], #60A1AAAAAAAAC600E983C0058B0DFFFFFFFF2BC883E804890861#</td>
</tr>
<tr>
number="1602"></td>
[PATCH_ADDR+04A],
#803DCCCCCCCC00757F90909090E9F2E6FBFF9090817C2408DDDDDDDD750B90909090C605CCCCCCCC01
#</td>
</tr>
<tr>
number="1603"></td>
[PATCH_ADDR+073], #60A1AAAAAAAA8B0DCCCCCCCC8808408B0DCCCCCCCC890861#</td>
</tr>
<tr>
number="1604"></td>
[PATCH_ADDR+08B], #608B4C2420890DCCCCCCCC61#</td>
</tr>
<tr>
number="1605"></td>
[PATCH_ADDR+097],
#608B4C24208B118915CCCCCCCC83C1048B11668915CCCCCCCC83E904C601E983C1058B1DFFFFFFFF2B
D98959FC61#</td>
</tr>
<tr>
number="1606"></td>
[PATCH_ADDR+0C5], #FE05CCCCCCCCFF25AAAAAAAA90#</td>
</tr>
<tr>
number="1607"></td>
[PATCH_ADDR+0D2], #60A1CCCCCCCC8B0DCCCCCCCC890883C0048B0DCCCCCCCC66890861#</td>
</tr>
<tr>
number="1608"></td>
[PATCH_ADDR+0ED], #803DCCCCCCCC01740A90909090FF25CCCCCCCCA3CCCCCCCC#</td>
</tr>
<tr>
number="1609"></td>
[PATCH_ADDR+105], #60A1AAAAAAAA8B0DCCCCCCCC8808408B0DCCCCCCCC890861#</td>
</tr>
<tr>
number="1610"></td>
[PATCH_ADDR+11D],
#60A1AAAAAAAA68AAAAAAAA6A40680001000050FF15AAAAAAAAA1AAAAAAAA8B08880DCCCCCCCC408B08
890DCCCCCCCC61#</td>
</tr>
<tr>
number="1611"></td>
[PATCH_ADDR+14D], #60A1AAAAAAAAC600E983C0058B0DCCCCCCCC2BC883E804890861#</td>
</tr>
<tr>
number="1612"></td>
[PATCH_ADDR+167], #FF25CCCCCCCC9090909090909090909090909090#</td>
</tr>
<tr>
number="1613"></td>
[PATCH_ADDR+17B], #60A1AAAAAAAA8B0DCCCCCCCC8808408B0DCCCCCCCC890861#</td>
</tr>
<tr>
number="1614"></td>
[PATCH_ADDR+193],
#60A1CCCCCCCC05BBBBBBBBA3CCCCCCCC8B08890DCCCCCCCC83C0048B08890DCCCCCCCC83E80483C005
8B0DFFFFFFFF2BC8C640FBE98948FCA1CCCCCCCC05BBBBBBBBA3CCCCCCCC61#</td>
</tr>
<tr>
number="1615"></td>
[PATCH_ADDR+1DB], #FF25AAAAAAAA9090909090909090909090#</td>
</tr>
<tr>
number="1616"></td>
[PATCH_ADDR+1DA],
#8B08890DAAAAAAAA83C0048B08890DBBBBBBBB408B0DCCCCCCCC2BC8C640FBE98948FC61B82C230000
C214009090909090#</td>
</tr>
<tr>
number="1617"></td>
[PATCH_ADDR+224],
#FE05AAAAAAAA60B8BBBBBBBB8B008B0DCCCCCCCC8B15DDDDDDDD890889500461803DEEEEEEEE02740F
EB68#</td>
</tr>
<tr>
number="1618"></td>
[PATCH_ADDR+24F],
#90909090909090FF25FFFFFFFFC70424AAAAAAAAC7442404BBBBBBBBC7442408CCCCCCCCC744240CDD
DDDDDDC705EEEEEEEE00000000EB30#</td>
</tr>
<tr>
number="1619"></td>
[PATCH_ADDR+287],
#60A1FFFFFFFF8B0DAAAAAAAA8B15BBBBBBBB8908895004A1CCCCCCCC8B0DDDDDDDDD83C0052BC8C640
FBE98948FC61#</td>
</tr>
<tr>
number="1620"></td>
[PATCH_ADDR+2B6], #C360A1EEEEEEEE8B0DFFFFFFFF83C0052BC8C640FBE98948FC61EB84#</td>
</tr>
<tr>
number="1621"></td>
PATCH_ADDR</td>
</tr>
<tr>
number="1622"></td>
PATCH_ADDR</td>
</tr>
<tr>
number="1623"></td>
</tr>
<tr>
number="1624"></td>
<td id="LC1624" class="blob-code blob-code-inner js-file-line">var NEFF
</td>
</tr>
<tr>
number="1625"></td>
</td>
</tr>
<tr>
number="1626"></td>
<td id="LC1626" class="blob-code blob-code-inner js-file-line">mov NEFF,
$RESULT</td>
</tr>
<tr>
number="1627"></td>
{PROCESSNAME_2}_Version.txt"</td>
</tr>
<tr>
number="1628"></td>
<td id="LC1628" class="blob-code blob-code-inner js-file-line">lm NEFF,
100, $RESULT</td>
</tr>
<tr>
number="1629"></td>
<td id="LC1629" class="blob-code blob-code-inner js-file-line">cmp [NEFF],
5F362E31, 04</td>
</tr>
<tr>
number="1630"></td>
WRITE_GO_HOP</td>
</tr>
<tr>
number="1631"></td>
[PATCH_ADDR+24B], #EB#</td>
</tr>
<tr>
number="1632"></td>
</tr>
<tr>
number="1633"></td>
</tr>
<tr>
number="1634"></td>
</tr>
<tr>
number="1635"></td>
line">////////////////////</td>
</tr>
<tr>
number="1636"></td>
line">WRITE_GO_HOP:</td>
</tr>
<tr>
number="1637"></td>
<td id="LC1637" class="blob-code blob-code-inner js-file-line">add P1, 0E0C
</td>
</tr>
<tr>
number="1638"></td>
"push {P1}"</td>
</tr>
<tr>
number="1639"></td>
<td id="LC1639" class="blob-code blob-code-inner js-file-line">asm P2+06,
$RESULT</td>
</tr>
<tr>
number="1640"></td>
"push {P1}"</td>
</tr>
<tr>
number="1641"></td>
$RESULT</td>
</tr>
<tr>
number="1642"></td>
<td id="LC1642" class="blob-code blob-code-inner js-file-line">sub P1, 0E0C
</td>
</tr>
<tr>
number="1643"></td>
<td id="LC1643" class="blob-code blob-code-inner js-file-line">add P1, 0E10
</td>
</tr>
<tr>
number="1644"></td>
"MOV BYTE PTR DS:[{P1}],CL"</td>
</tr>
<tr>
number="1645"></td>
$RESULT</td>
</tr>
<tr>
number="1646"></td>
"MOV ECX,DWORD PTR DS:[{P1}]"</td>
</tr>
<tr>
number="1647"></td>
$RESULT</td>
</tr>
<tr>
number="1648"></td>
</tr>
<tr>
number="1649"></td>
<td id="LC1649" class="blob-code blob-code-inner js-file-line">asm P2+10B,
$RESULT</td>
</tr>
<tr>
number="1650"></td>
"MOV BYTE PTR DS:[{P1}],CL"</td>
</tr>
<tr>
number="1651"></td>
<td id="LC1651" class="blob-code blob-code-inner js-file-line">asm P2+13D,
$RESULT</td>
</tr>
<tr>
number="1652"></td>
</tr>
<tr>
number="1653"></td>
$RESULT</td>
</tr>
<tr>
number="1654"></td>
<td id="LC1654" class="blob-code blob-code-inner js-file-line">sub P1, 0E10
</td>
</tr>
<tr>
number="1655"></td>
</td>
</tr>
<tr>
number="1656"></td>
[P2+02B], P1</td>
</tr>
<tr>
number="1657"></td>
[P2+084], P1</td>
</tr>
<tr>
number="1658"></td>
[P2+116], P1</td>
</tr>
<tr>
number="1659"></td>
[P2+148], P1</td>
</tr>
<tr>
number="1660"></td>
[P2+18C], P1</td>
</tr>
<tr>
number="1661"></td>
</td>
</tr>
<tr>
number="1662"></td>
</td>
</tr>
<tr>
number="1663"></td>
[P2+04C], P1</td>
</tr>
<tr>
number="1664"></td>
[P2+0C7], P1</td>
</tr>
<tr>
number="1665"></td>
</td>
</tr>
<tr>
number="1666"></td>
"jmp {ENTRYPOINT}"</td>
</tr>
<tr>
number="1667"></td>
$RESULT</td>
</tr>
<tr>
number="1668"></td>
</td>
</tr>
<tr>
number="1669"></td>
[P2+06E], P1</td>
</tr>
<tr>
number="1670"></td>
[P2+0EF], P1</td>
</tr>
<tr>
number="1671"></td>
</td>
</tr>
<tr>
number="1672"></td>
</td>
</tr>
<tr>
number="1673"></td>
[P2+092], P1</td>
</tr>
<tr>
number="1674"></td>
[P2+0D4], P1</td>
</tr>
<tr>
number="1675"></td>
[P2+0FC], P1</td>
</tr>
<tr>
number="1676"></td>
[P2+169], P1</td>
</tr>
<tr>
number="1677"></td>
</td>
</tr>
<tr>
number="1678"></td>
</td>
</tr>
<tr>
number="1679"></td>
[P2+0A0], P1</td>
</tr>
<tr>
number="1680"></td>
[P2+0DA], P1</td>
</tr>
<tr>
number="1681"></td>
</td>
</tr>
<tr>
number="1682"></td>
</td>
</tr>
<tr>
number="1683"></td>
[P2+0AC], P1</td>
</tr>
<tr>
number="1684"></td>
[P2+0E5], P1</td>
</tr>
<tr>
number="1685"></td>
</td>
</tr>
<tr>
number="1686"></td>
</td>
</tr>
<tr>
number="1687"></td>
[P2+0BB], P1</td>
</tr>
<tr>
number="1688"></td>
</td>
</tr>
<tr>
number="1689"></td>
</td>
</tr>
<tr>
number="1690"></td>
[P2+101], P1</td>
</tr>
<tr>
number="1691"></td>
[P2+195], P1</td>
</tr>
<tr>
number="1692"></td>
[P2+1CC], P1</td>
</tr>
<tr>
number="1693"></td>
</td>
</tr>
<tr>
number="1694"></td>
</td>
</tr>
<tr>
number="1695"></td>
[P2+03E], P1</td>
</tr>
<tr>
number="1696"></td>
<td id="LC1696" class="blob-code blob-code-inner js-file-line">mov [P1],
P2+05E</td>
</tr>
<tr>
number="1697"></td>
</td>
</tr>
<tr>
number="1698"></td>
</td>
</tr>
<tr>
number="1699"></td>
[P2+15B], P1</td>
</tr>
<tr>
number="1700"></td>
</td>
</tr>
<tr>
number="1701"></td>
</td>
</tr>
<tr>
number="1702"></td>
[P2+19F], P1</td>
</tr>
<tr>
number="1703"></td>
</td>
</tr>
<tr>
number="1704"></td>
</td>
</tr>
<tr>
number="1705"></td>
[P2+1A7], P1</td>
</tr>
<tr>
number="1706"></td>
</td>
</tr>
<tr>
number="1707"></td>
</td>
</tr>
<tr>
number="1708"></td>
[P2+1B2], P1</td>
</tr>
<tr>
number="1709"></td>
</td>
</tr>
<tr>
number="1710"></td>
</td>
</tr>
<tr>
number="1711"></td>
[P2+1BE], P1</td>
</tr>
<tr>
number="1712"></td>
</td>
</tr>
<tr>
number="1713"></td>
</td>
</tr>
<tr>
number="1714"></td>
[P2+1D6], P1</td>
</tr>
<tr>
number="1715"></td>
<td id="LC1715" class="blob-code blob-code-inner js-file-line">// mov
[P2+215], P1</td>
</tr>
<tr>
number="1716"></td>
</td>
</tr>
<tr>
number="1717"></td>
[P1+0E34], eip</td>
</tr>
<tr>
number="1718"></td>
[P1+0E34], P1</td>
</tr>
<tr>
number="1719"></td>
[P1+0E48], P2+17B</td>
</tr>
<tr>
number="1720"></td>
[P1+0E60], P2+224</td>
</tr>
<tr>
number="1721"></td>
[P1+0E80], P2+287</td>
</tr>
<tr>
number="1722"></td>
[P1+01F0], P2+0E80</td>
</tr>
<tr>
number="1723"></td>
<td id="LC1723" class="blob-code blob-code-inner js-file-line">fill
PATCH_ADDR+206, 01E, 90</td>
</tr>
<tr>
number="1724"></td>
IMPORT_TABLE_ADDRESS, IMAGEBASE</td>
</tr>
<tr>
number="1725"></td>
[IMPORT_TABLE_ADDRESS+10], 00</td>
</tr>
<tr>
number="1726"></td>
NOT_FOUND_IN</td>
</tr>
<tr>
number="1727"></td>
line">////////////////////</td>
</tr>
<tr>
number="1728"></td>
<td id="LC1728" class="blob-code blob-code-inner js-file-line">API_INFOS:
</td>
</tr>
<tr>
number="1729"></td>
<td id="LC1729" class="blob-code blob-code-inner js-file-line">mov API,
[IMPORT_TABLE_ADDRESS+10]</td>
</tr>
<tr>
number="1730"></td>
<td id="LC1730" class="blob-code blob-code-inner js-file-line">add API,
IMAGEBASE</td>
</tr>
<tr>
number="1731"></td>
<td id="LC1731" class="blob-code blob-code-inner js-file-line">// log API,
""</td>
</tr>
<tr>
number="1732"></td>
line">////////////////////</td>
</tr>
<tr>
number="1733"></td>
line">API_CHECK_OFF:</td>
</tr>
<tr>
number="1734"></td>
<td id="LC1734" class="blob-code blob-code-inner js-file-line">cmp [API],
VirtualAlloc</td>
</tr>
<tr>
number="1735"></td>
VirtualAlloc</td>
</tr>
<tr>
number="1736"></td>
VirtualProtect</td>
</tr>
<tr>
number="1737"></td>
VirtualProtect</td>
</tr>
<tr>
number="1738"></td>
</tr>
<tr>
number="1739"></td>
</tr>
<tr>
number="1740"></td>
line">////////////////////</td>
</tr>
<tr>
number="1741"></td>
<td id="LC1741" class="blob-code blob-code-inner js-file-line">ADD_API:
</td>
</tr>
<tr>
number="1742"></td>
<td id="LC1742" class="blob-code blob-code-inner js-file-line">add API, 04
</td>
</tr>
<tr>
number="1743"></td>
00</td>
</tr>
<tr>
number="1744"></td>
API_CHECK_OFF</td>
</tr>
<tr>
number="1745"></td>
IMPORT_TABLE_ADDRESS, 14</td>
</tr>
<tr>
number="1746"></td>
[IMPORT_TABLE_ADDRESS+10], 00</td>
</tr>
<tr>
number="1747"></td>
<td id="LC1747" class="blob-code blob-code-inner js-file-line">je API_ENDE
</td>
</tr>
<tr>
number="1748"></td>
API_INFOS</td>
</tr>
<tr>
number="1749"></td>
line">////////////////////</td>
</tr>
<tr>
number="1750"></td>
line">VirtualAlloc:</td>
</tr>
<tr>
number="1751"></td>
<td id="LC1751" class="blob-code blob-code-inner js-file-line">mov VA, API
</td>
</tr>
<tr>
number="1752"></td>
<td id="LC1752" class="blob-code blob-code-inner js-file-line">jmp ADD_API
</td>
</tr>
<tr>
number="1753"></td>
line">////////////////////</td>
</tr>
<tr>
number="1754"></td>
line">VirtualProtect:</td>
</tr>
<tr>
number="1755"></td>
<td id="LC1755" class="blob-code blob-code-inner js-file-line">mov VP, API
</td>
</tr>
<tr>
number="1756"></td>
</td>
</tr>
<tr>
number="1757"></td>
line">////////////////////</td>
</tr>
<tr>
number="1758"></td>
line">DialogBoxIndirectParamA:</td>
</tr>
<tr>
number="1759"></td>
<td id="LC1759" class="blob-code blob-code-inner js-file-line">mov DC, API
</td>
</tr>
<tr>
number="1760"></td>
</td>
</tr>
<tr>
number="1761"></td>
line">////////////////////</td>
</tr>
<tr>
number="1762"></td>
line">NOT_FOUND_IN:</td>
</tr>
<tr>
number="1763"></td>
</td>
</tr>
<tr>
number="1764"></td>
{scriptname} \r\n\r\n{points} \r\n\r\nNot all 3 APIs was found in your Imports!Add
them with LordPE! \r\n\r\nkernel32.dll / User32.dll \r\n--------------------
\r\nVirtualAlloc \r\nVirtualProtect \r\nDialogBoxIndirectParamA \r\n\r\n{points}
\r\n{ME}"</td>
</tr>
<tr>
number="1765"></td>
</td>
</tr>
<tr>
number="1766"></td>
"Not all 3 APIs was found in your Imports!"</td>
</tr>
<tr>
number="1767"></td>
"Not all 3 APIs was found in your Imports!"</td>
</tr>
<tr>
number="1768"></td>
" "</td>
</tr>
<tr>
number="1769"></td>
"Add them with LordPE!"</td>
</tr>
<tr>
number="1770"></td>
"Add them with LordPE!"</td>
</tr>
<tr>
number="1771"></td>
" "</td>
</tr>
<tr>
number="1772"></td>
"kernel32.dll / User32.dll"</td>
</tr>
<tr>
number="1773"></td>
"kernel32.dll / User32.dll"</td>
</tr>
<tr>
number="1774"></td>
" "</td>
</tr>
<tr>
number="1775"></td>
"--------------------"</td>
</tr>
<tr>
number="1776"></td>
"--------------------"</td>
</tr>
<tr>
number="1777"></td>
" "</td>
</tr>
<tr>
number="1778"></td>
"VirtualAlloc" </td>
</tr>
<tr>
number="1779"></td>
"VirtualAlloc"</td>
</tr>
<tr>
number="1780"></td>
" "</td>
</tr>
<tr>
number="1781"></td>
"VirtualProtect" </td>
</tr>
<tr>
number="1782"></td>
"VirtualProtect"</td>
</tr>
<tr>
number="1783"></td>
" "</td>
</tr>
<tr>
number="1784"></td>
"DialogBoxIndirectParamA"</td>
</tr>
<tr>
number="1785"></td>
"DialogBoxIndirectParamA"</td>
</tr>
<tr>
number="1786"></td>
" "</td>
</tr>
<tr>
number="1787"></td>
" "</td>
</tr>
<tr>
number="1788"></td>
""</td>
</tr>
<tr>
number="1789"></td>
</td>
</tr>
<tr>
number="1790"></td>
line">////////////////////</td>
</tr>
<tr>
number="1791"></td>
<td id="LC1791" class="blob-code blob-code-inner js-file-line">API_ENDE:
</td>
</tr>
<tr>
number="1792"></td>
<td id="LC1792" class="blob-code blob-code-inner js-file-line">cmp [VA],
VirtualAlloc</td>
</tr>
<tr>
number="1793"></td>
NOT_ALL_API</td>
</tr>
<tr>
number="1794"></td>
<td id="LC1794" class="blob-code blob-code-inner js-file-line">cmp [VP],
VirtualProtect</td>
</tr>
<tr>
number="1795"></td>
NOT_ALL_API</td>
</tr>
<tr>
number="1796"></td>
<td id="LC1796" class="blob-code blob-code-inner js-file-line">cmp [DC],
</tr>
<tr>
number="1797"></td>
NOT_ALL_API</td>
</tr>
<tr>
number="1798"></td>
""</td>
</tr>
<tr>
number="1799"></td>
"ALL API ARE THERE!"</td>
</tr>
<tr>
number="1800"></td>
""</td>
</tr>
<tr>
number="1801"></td>
"API-LIST-FOUND"</td>
</tr>
<tr>
number="1802"></td>
"API-LIST-FOUND"</td>
</tr>
<tr>
number="1803"></td>
"--------------------"</td>
</tr>
<tr>
number="1804"></td>
" "</td>
</tr>
<tr>
number="1805"></td>
"--------------------"</td>
</tr>
<tr>
number="1806"></td>
" "</td>
</tr>
<tr>
number="1807"></td>
{VA} | {VirtualAlloc} | VirtualAlloc"</td>
</tr>
<tr>
number="1808"></td>
$RESULT</td>
</tr>
<tr>
number="1809"></td>
" "</td>
</tr>
<tr>
number="1810"></td>
""</td>
</tr>
<tr>
number="1811"></td>
{VP} | {VirtualProtect} | VirtualProtect"</td>
</tr>
<tr>
number="1812"></td>
$RESULT</td>
</tr>
<tr>
number="1813"></td>
" "</td>
</tr>
<tr>
number="1814"></td>
""</td>
</tr>
<tr>
number="1815"></td>
{DC} | {DialogBoxIndirectParamA} | DialogBoxIndirectParamA"</td>
</tr>
<tr>
number="1816"></td>
$RESULT</td>
</tr>
<tr>
number="1817"></td>
" "</td>
</tr>
<tr>
number="1818"></td>
""</td>
</tr>
<tr>
number="1819"></td>
"--------------------"</td>
</tr>
<tr>
number="1820"></td>
"--------------------"</td>
</tr>
<tr>
number="1821"></td>
""</td>
</tr>
<tr>
number="1822"></td>
FIX_API_ADDRESSES</td>
</tr>
<tr>
number="1823"></td>
line">////////////////////</td>
</tr>
<tr>
number="1824"></td>
<td id="LC1824" class="blob-code blob-code-inner js-file-line">NOT_ALL_API:
</td>
</tr>
<tr>
number="1825"></td>
NOT_FOUND_IN</td>
</tr>
<tr>
number="1826"></td>
line">////////////////////</td>
</tr>
<tr>
number="1827"></td>
line">FIX_API_ADDRESSES:</td>
</tr>
<tr>
number="1828"></td>
<td id="LC1828" class="blob-code blob-code-inner js-file-line">mov [P1+02],
VA</td>
</tr>
<tr>
number="1829"></td>
VP</td>
</tr>
<tr>
number="1830"></td>
<td id="LC1830" class="blob-code blob-code-inner js-file-line">mov [P1+1A],
VA</td>
</tr>
<tr>
number="1831"></td>
VA</td>
</tr>
<tr>
number="1832"></td>
VA</td>
</tr>
<tr>
number="1833"></td>
[P1+0CD], VA</td>
</tr>
<tr>
number="1834"></td>
[P1+107], VA</td>
</tr>
<tr>
number="1835"></td>
[P1+11F], DC</td>
</tr>
<tr>
number="1836"></td>
[P1+132], VP</td>
</tr>
<tr>
number="1837"></td>
[P1+137], DC</td>
</tr>
<tr>
number="1838"></td>
[P1+14F], DC</td>
</tr>
<tr>
number="1839"></td>
[P1+17D], DC</td>
</tr>
<tr>
number="1840"></td>
[P1+1DE], P1+0E68</td>
</tr>
<tr>
number="1841"></td>
[P1+1DE], P1+287</td>
</tr>
<tr>
number="1842"></td>
[P1+1E9], P1+E6C</td>
</tr>
<tr>
number="1843"></td>
[P1+226], P1+E70</td>
</tr>
<tr>
number="1844"></td>
[P1+22C], P1+E50</td>
</tr>
<tr>
number="1845"></td>
[P1+234], P1+E54</td>
</tr>
<tr>
number="1846"></td>
[P1+23A], P1+E58</td>
</tr>
<tr>
number="1847"></td>
[P1+246], P1+E70</td>
</tr>
<tr>
number="1848"></td>
[P1+258], P1+E50</td>
</tr>
<tr>
number="1849"></td>
[P1+27D], P1+E70</td>
</tr>
<tr>
number="1850"></td>
[P1+289], P1+E64</td>
</tr>
<tr>
number="1851"></td>
[P1+28F], P1+E68</td>
</tr>
<tr>
number="1852"></td>
[P1+295], P1+E6C</td>
</tr>
<tr>
number="1853"></td>
[P1+29F], P1+E50</td>
</tr>
<tr>
number="1854"></td>
[P1+2A5], P1+E60</td>
</tr>
<tr>
number="1855"></td>
[P1+2B9], P1+E64</td>
</tr>
<tr>
number="1856"></td>
[P1+2BF], P1+E80</td>
</tr>
<tr>
number="1857"></td>
<td id="LC1857" class="blob-code blob-code-inner js-file-line">var SELL
</td>
</tr>
<tr>
number="1858"></td>
</td>
</tr>
<tr>
number="1859"></td>
<td id="LC1859" class="blob-code blob-code-inner js-file-line">mov SELL,
$RESULT</td>
</tr>
<tr>
number="1860"></td>
</tr>
<tr>
number="1861"></td>
<td id="LC1861" class="blob-code blob-code-inner js-file-line">lm SELL,
1000, $RESULT</td>
</tr>
<tr>
number="1862"></td>
<td id="LC1862" class="blob-code blob-code-inner js-file-line">find SELL,
#23#</td>
</tr>
<tr>
number="1863"></td>
<td id="LC1863" class="blob-code blob-code-inner js-file-line">mov U1,
$RESULT</td>
</tr>
<tr>
number="1864"></td>
<td id="LC1864" class="blob-code blob-code-inner js-file-line">inc U1</td>
</tr>
<tr>
number="1865"></td>
<td id="LC1865" class="blob-code blob-code-inner js-file-line">find U1,
#23#</td>
</tr>
<tr>
number="1866"></td>
$RESULT</td>
</tr>
<tr>
number="1867"></td>
<td id="LC1867" class="blob-code blob-code-inner js-file-line">// dec U2
</td>
</tr>
<tr>
number="1868"></td>
<td id="LC1868" class="blob-code blob-code-inner js-file-line">sub U2, U1
</td>
</tr>
<tr>
number="1869"></td>
[U1], U2</td>
</tr>
<tr>
number="1870"></td>
$RESULT</td>
</tr>
<tr>
number="1871"></td>
<td id="LC1871" class="blob-code blob-code-inner js-file-line">str U3</td>
</tr>
<tr>
number="1872"></td>
"#{U3}#"</td>
</tr>
<tr>
number="1873"></td>
$RESULT</td>
</tr>
<tr>
number="1874"></td>
<td id="LC1874" class="blob-code blob-code-inner js-file-line">str U4</td>
</tr>
<tr>
number="1875"></td>
<td id="LC1875" class="blob-code blob-code-inner js-file-line">fill SELL,
50, 00</td>
</tr>
<tr>
number="1876"></td>
<td id="LC1876" class="blob-code blob-code-inner js-file-line">mov [SELL],
U4</td>
</tr>
<tr>
number="1877"></td>
[P1+25F], [SELL]</td>
</tr>
<tr>
number="1878"></td>
[P1+267], [SELL+04]</td>
</tr>
<tr>
number="1879"></td>
[P1+26F], [SELL+08]</td>
</tr>
<tr>
number="1880"></td>
[P1+277], [SELL+0C]</td>
</tr>
<tr>
number="1881"></td>
<td id="LC1881" class="blob-code blob-code-inner js-file-line">free SELL
</td>
</tr>
<tr>
number="1882"></td>
</td>
</tr>
<tr>
number="1883"></td>
<td id="LC1883" class="blob-code blob-code-inner js-file-line">mov READ,
$RESULT</td>
</tr>
<tr>
number="1884"></td>
{PROCESSNAME_2}_Session_Infos.txt"</td>
</tr>
<tr>
number="1885"></td>
<td id="LC1885" class="blob-code blob-code-inner js-file-line">lm READ,
1000, $RESULT</td>
</tr>
<tr>
number="1886"></td>
line">////////////////////</td>
</tr>
<tr>
number="1887"></td>
<td id="LC1887" class="blob-code blob-code-inner js-file-line">PLUS_VALUES:
</td>
</tr>
<tr>
number="1888"></td>
<td id="LC1888" class="blob-code blob-code-inner js-file-line">find READ,
#3A#</td>
</tr>
<tr>
number="1889"></td>
00</td>
</tr>
<tr>
number="1890"></td>
PLUS_VALUES_1</td>
</tr>
<tr>
number="1891"></td>
</tr>
<tr>
number="1892"></td>
</tr>
<tr>
number="1893"></td>
line">////////////////////</td>
</tr>
<tr>
number="1894"></td>
line">PLUS_VALUES_1:</td>
</tr>
<tr>
number="1895"></td>
<td id="LC1895" class="blob-code blob-code-inner js-file-line">mov PL1,
$RESULT</td>
</tr>
<tr>
number="1896"></td>
<td id="LC1896" class="blob-code blob-code-inner js-file-line">add PL1, 01
</td>
</tr>
<tr>
number="1897"></td>
<td id="LC1897" class="blob-code blob-code-inner js-file-line">find PL1,
#0D#</td>
</tr>
<tr>
number="1898"></td>
00</td>
</tr>
<tr>
number="1899"></td>
PLUS_VALUES_2</td>
</tr>
<tr>
number="1900"></td>
</tr>
<tr>
number="1901"></td>
</tr>
<tr>
number="1902"></td>
line">////////////////////</td>
</tr>
<tr>
number="1903"></td>
</tr>
<tr>
number="1904"></td>
<td id="LC1904" class="blob-code blob-code-inner js-file-line">mov PL1_B,
$RESULT</td>
</tr>
<tr>
number="1905"></td>
<td id="LC1905" class="blob-code blob-code-inner js-file-line">sub PL1_B,
PL1</td>
</tr>
<tr>
number="1906"></td>
[PL1], PL1_B</td>
</tr>
<tr>
number="1907"></td>
<td id="LC1907" class="blob-code blob-code-inner js-file-line">mov END_PL1,
$RESULT</td>
</tr>
<tr>
number="1908"></td>
<td id="LC1908" class="blob-code blob-code-inner js-file-line">atoi
END_PL1, 16.</td>
</tr>
<tr>
number="1909"></td>
$RESULT</td>
</tr>
<tr>
number="1910"></td>
[P1+19A], END_PL1</td>
</tr>
<tr>
number="1911"></td>
#3A#</td>
</tr>
<tr>
number="1912"></td>
00</td>
</tr>
<tr>
number="1913"></td>
PLUS_VALUES_3</td>
</tr>
<tr>
number="1914"></td>
</tr>
<tr>
number="1915"></td>
</tr>
<tr>
number="1916"></td>
line">////////////////////</td>
</tr>
<tr>
number="1917"></td>
</tr>
<tr>
number="1918"></td>
$RESULT</td>
</tr>
<tr>
number="1919"></td>
</td>
</tr>
<tr>
number="1920"></td>
#0D#</td>
</tr>
<tr>
number="1921"></td>
00</td>
</tr>
<tr>
number="1922"></td>
PLUS_VALUES_4</td>
</tr>
<tr>
number="1923"></td>
</tr>
<tr>
number="1924"></td>
</tr>
<tr>
number="1925"></td>
line">////////////////////</td>
</tr>
<tr>
number="1926"></td>
</tr>
<tr>
number="1927"></td>
$RESULT</td>
</tr>
<tr>
number="1928"></td>
PL1</td>
</tr>
<tr>
number="1929"></td>
[PL2], PL2_B</td>
</tr>
<tr>
number="1930"></td>
$RESULT</td>
</tr>
<tr>
number="1931"></td>
END_PL2, 16.</td>
</tr>
<tr>
number="1932"></td>
$RESULT</td>
</tr>
<tr>
number="1933"></td>
[P1+1D1], END_PL2</td>
</tr>
<tr>
number="1934"></td>
#3A#</td>
</tr>
<tr>
number="1935"></td>
00</td>
</tr>
<tr>
number="1936"></td>
PLUS_VALUES_5</td>
</tr>
<tr>
number="1937"></td>
</tr>
<tr>
number="1938"></td>
</tr>
<tr>
number="1939"></td>
line">////////////////////</td>
</tr>
<tr>
number="1940"></td>
</tr>
<tr>
number="1941"></td>
$RESULT</td>
</tr>
<tr>
number="1942"></td>
</td>
</tr>
<tr>
number="1943"></td>
#00#</td>
</tr>
<tr>
number="1944"></td>
PLUS_VALUES_6</td>
</tr>
<tr>
number="1945"></td>
</tr>
<tr>
number="1946"></td>
</tr>
<tr>
number="1947"></td>
line">////////////////////</td>
</tr>
<tr>
number="1948"></td>
</tr>
<tr>
number="1949"></td>
$RESULT</td>
</tr>
<tr>
number="1950"></td>
PL2</td>
</tr>
<tr>
number="1951"></td>
[PL2], PL2_B</td>
</tr>
<tr>
number="1952"></td>
$RESULT</td>
</tr>
<tr>
number="1953"></td>
END_PL2, 16.</td>
</tr>
<tr>
number="1954"></td>
$RESULT</td>
</tr>
<tr>
number="1955"></td>
[P1+062], END_PL2</td>
</tr>
<tr>
number="1956"></td>
<td id="LC1956" class="blob-code blob-code-inner js-file-line">mov eip, P1
</td>
</tr>
<tr>
number="1957"></td>
ENTRYPOINT, MEMORYBASE</td>
</tr>
<tr>
number="1958"></td>
<td id="LC1958" class="blob-code blob-code-inner js-file-line">mov EPBASE,
$RESULT</td>
</tr>
<tr>
number="1959"></td>
PE_INFO_START, 0F8</td>
</tr>
<tr>
number="1960"></td>
line">////////////////////</td>
</tr>
<tr>
number="1961"></td>
<td id="LC1961" class="blob-code blob-code-inner js-file-line">READ_IT:
</td>
</tr>
<tr>
number="1962"></td>
PE_INFO_START, 0C</td>
</tr>
<tr>
number="1963"></td>
<td id="LC1963" class="blob-code blob-code-inner js-file-line">mov ADDR,
[PE_INFO_START]</td>
</tr>
<tr>
number="1964"></td>
<td id="LC1964" class="blob-code blob-code-inner js-file-line">add ADDR,
IMAGEBASE</td>
</tr>
<tr>
number="1965"></td>
<td id="LC1965" class="blob-code blob-code-inner js-file-line">cmp ADDR,
EPBASE</td>
</tr>
<tr>
number="1966"></td>
<td id="LC1966" class="blob-code blob-code-inner js-file-line">je EP2</td>
</tr>
<tr>
number="1967"></td>
PE_INFO_START, 01C</td>
</tr>
<tr>
number="1968"></td>
<td id="LC1968" class="blob-code blob-code-inner js-file-line">jmp READ_IT
</td>
</tr>
<tr>
number="1969"></td>
line">////////////////////</td>
</tr>
<tr>
number="1970"></td>
<td id="LC1970" class="blob-code blob-code-inner js-file-line">EP2:</td>
</tr>
<tr>
number="1971"></td>
<td id="LC1971" class="blob-code blob-code-inner js-file-line">mov RW,
[PE_INFO_START+018]</td>
</tr>
<tr>
number="1972"></td>
<td id="LC1972" class="blob-code blob-code-inner js-file-line">mov eax, RW
</td>
</tr>
<tr>
number="1973"></td>
<td id="LC1973" class="blob-code blob-code-inner js-file-line">shr eax, 18
</td>
</tr>
<tr>
number="1974"></td>
<td id="LC1974" class="blob-code blob-code-inner js-file-line">shr eax, 04
</td>
</tr>
<tr>
number="1975"></td>
<td id="LC1975" class="blob-code blob-code-inner js-file-line">cmp al, 8
</td>
</tr>
<tr>
number="1976"></td>
IS_WRITEABLE</td>
</tr>
<tr>
number="1977"></td>
<td id="LC1977" class="blob-code blob-code-inner js-file-line">ja
IS_WRITEABLE</td>
</tr>
<tr>
number="1978"></td>
<td id="LC1978" class="blob-code blob-code-inner js-file-line">cmp IBS, 00
</td>
</tr>
<tr>
number="1979"></td>
<td id="LC1979" class="blob-code blob-code-inner js-file-line">je EP3A</td>
</tr>
<tr>
number="1980"></td>
IMAGEBASE</td>
</tr>
<tr>
number="1981"></td>
<td id="LC1981" class="blob-code blob-code-inner js-file-line">add U1,
PE_HEADER_SIZE</td>
</tr>
<tr>
number="1982"></td>
<td id="LC1982" class="blob-code blob-code-inner js-file-line">mov EP_2,
EPBASE</td>
</tr>
<tr>
number="1983"></td>
<td id="LC1983" class="blob-code blob-code-inner js-file-line">sub EP_2,
MODULEBASE</td>
</tr>
<tr>
number="1984"></td>
<td id="LC1984" class="blob-code blob-code-inner js-file-line">add EP_2,
IBS</td>
</tr>
<tr>
number="1985"></td>
IBS</td>
</tr>
<tr>
number="1986"></td>
<td id="LC1986" class="blob-code blob-code-inner js-file-line">mov EPBASE,
EP_2</td>
</tr>
<tr>
number="1987"></td>
<td id="LC1987" class="blob-code blob-code-inner js-file-line">add EP_2,
IBS</td>
</tr>
<tr>
number="1988"></td>
<td id="LC1988" class="blob-code blob-code-inner js-file-line">jmp EP3B
</td>
</tr>
<tr>
number="1989"></td>
line">////////////////////</td>
</tr>
<tr>
number="1990"></td>
<td id="LC1990" class="blob-code blob-code-inner js-file-line">EP3A:</td>
</tr>
<tr>
number="1991"></td>
<td id="LC1991" class="blob-code blob-code-inner js-file-line">mov EP_2,
EPBASE</td>
</tr>
<tr>
number="1992"></td>
IMAGEBASE</td>
</tr>
<tr>
number="1993"></td>
line">////////////////////</td>
</tr>
<tr>
number="1994"></td>
<td id="LC1994" class="blob-code blob-code-inner js-file-line">EP3B:</td>
</tr>
<tr>
number="1995"></td>
</td>
</tr>
<tr>
number="1996"></td>
</tr>
<tr>
number="1997"></td>
$RESULT</td>
</tr>
<tr>
number="1998"></td>
$RESULT</td>
</tr>
<tr>
number="1999"></td>
" "</td>
</tr>
<tr>
number="2000"></td>
{scriptname} \r\n\r\n{points} \r\n\r\nYou must set the section \r\n\r\nVA: {EPBASE}
\r\n\r\nRVA: {EP_2} \r\n\r\nto writeable with LordPE!Dont forget this!
</tr>
<tr>
number="2001"></td>
$RESULT</td>
</tr>
<tr>
number="2002"></td>
" "</td>
</tr>
<tr>
number="2003"></td>
</td>
</tr>
<tr>
number="2004"></td>
""</td>
</tr>
<tr>
number="2005"></td>
"You must set the section VA: {EPBASE} | RVA: {EP_2} to writeable with LordPE!
Dont forget this!"</td>
</tr>
<tr>
number="2006"></td>
""</td>
</tr>
<tr>
number="2007"></td>
WRITE_OVER</td>
</tr>
<tr>
number="2008"></td>
line">////////////////////</td>
</tr>
<tr>
number="2009"></td>
line">IS_WRITEABLE:</td>
</tr>
<tr>
number="2010"></td>
line">////////////////////</td>
</tr>
<tr>
number="2011"></td>
<td id="LC2011" class="blob-code blob-code-inner js-file-line">WRITE_OVER:
</td>
</tr>
<tr>
number="2012"></td>
"exe"</td>
</tr>
<tr>
number="2013"></td>
WRITE_OVER_2</td>
</tr>
<tr>
number="2014"></td>
"EXE"</td>
</tr>
<tr>
number="2015"></td>
WRITE_OVER_2</td>
</tr>
<tr>
number="2016"></td>
line">////////////////////</td>
</tr>
<tr>
number="2017"></td>
<td id="LC2017" class="blob-code blob-code-inner js-file-line">DLL_FIX:
</td>
</tr>
<tr>
number="2018"></td>
<td id="LC2018" class="blob-code blob-code-inner js-file-line">mov P1_BAK,
P1</td>
</tr>
<tr>
number="2019"></td>
[P1+02DF],
#90608BD381E20000FFFF66813A4D5A740881EA00000100EBF18BC283C03C030083E83C83C0288B0003
C28BC82DE0020000#</td>
</tr>
<tr>
number="2020"></td>
[P1+0310],
#890424816802AAAAAAAA816807AAAAAAAA816815AAAAAAAA81681AAAAAAAAA816822AAAAAAAA81682B
AAAAAAAA816832AAAAAAAA81683EAAAAAAAA81684CAAAAAAAA81686EAAAAAAAA816875AAAAAAAA81687
BAAAAAAAA#</td>
</tr>
<tr>
number="2021"></td>
[P1+0367],
#81A884000000AAAAAAAA81A892000000AAAAAAAA81A8A0000000AAAAAAAA81A8AC000000AAAAAAAA81
A8BB000000AAAAAAAA81A8C7000000AAAAAAAA81A8CD000000AAAAAAAA81A8D4000000AAAAAAAA81A8D
A000000AAAAAAAA81A8E5000000AAAAAAAA81A8EF000000AAAAAAAA81A8FC000000AAAAAAAA#</td>
</tr>
<tr>
number="2022"></td>
[P1+03DF],
#81A801010000AAAAAAAA81A807010000AAAAAAAA81A80D010000AAAAAAAA81A816010000AAAAAAAA81
A81F010000AAAAAAAA81A824010000AAAAAAAA81A832010000AAAAAAAA81A837010000AAAAAAAA81A83
F010000AAAAAAAA81A848010000AAAAAAAA81A84F010000AAAAAAAA81A85B010000AAAAAAAA81A86901
0000AAAAAAAA81A87D010000AAAAAAAA#</td>
</tr>
<tr>
number="2023"></td>
[P1+046B],
#81A883010000AAAAAAAA81A88C010000AAAAAAAA81A895010000AAAAAAAA81A89F010000AAAAAAAA81
A8A7010000AAAAAAAA81A8B2010000AAAAAAAA81A8BE010000AAAAAAAA81A8CC010000AAAAAAAA81A8D
6010000AAAAAAAA81A8DE010000AAAAAAAA81A8E9010000AAAAAAAA81A8F0010000AAAAAAAA#</td>
</tr>
<tr>
number="2024"></td>
[P1+04E3],
#81A826020000AAAAAAAA81A82C020000AAAAAAAA81A834020000AAAAAAAA81A83A020000AAAAAAAA81
A846020000AAAAAAAA81A858020000AAAAAAAA81A87D020000AAAAAAAA81A889020000AAAAAAAA81A88
F020000AAAAAAAA81A895020000AAAAAAAA81A89F020000AAAAAAAA81A8A5020000AAAAAAAA81A8B902
0000AAAAAAAA81A8BF020000AAAAAAAA81A8D3020000AAAAAAAA81A8DB020000AAAAAAAA#</td>
</tr>
<tr>
number="2025"></td>
[P1+0583],
#01500201500701501501501A01502201502B01503201503E01504C01506E01507501507B0190840000
000190920000000190A00000000190AC0000000190BB0000000190C70000000190CD0000000190D4000
0000190DA0000000190E50000000190EF0000000190FC000000#</td>
</tr>
<tr>
number="2026"></td>
[P1+05EF],
#01900101000001900701000001900D01000001901601000001901F0100000190240100000190320100
0001903701000001903F01000001904801000001904F01000001905B01000001906901000001907D010
00001908301000001908C01000001909501000001909F0100000190A70100000190B20100000190BE01
00000190CC0100000190D60100000190DE0100000190E90100000190F001000001902602000001902C0
20000#</td>
</tr>
<tr>
number="2027"></td>
[P1+0697],
#01903402000001903A02000001904602000001905802000001907D02000001908902000001908F0200
0001909502000001909F0200000190A50200000190B90200000190BF0200000190D30200000190DB020
000#</td>
</tr>
<tr>
number="2028"></td>
[P1+06EB],
#81A81C0E0000AAAAAAAA81A8340E0000AAAAAAAA81A8480E0000AAAAAAAA81A8600E0000AAAAAAAA81
A8800E0000AAAAAAAA01901C0E00000190340E00000190480E00000190600E00000190800E0000C601E
983C0572BC183E80589410161FF6424E090#</td>
</tr>
<tr>
number="2029"></td>
[P1+0316], IMAGEBASE</td>
</tr>
<tr>
number="2030"></td>
[P1+031D], IMAGEBASE</td>
</tr>
<tr>
number="2031"></td>
</tr>
<tr>
number="2032"></td>
[P1+032B], IMAGEBASE</td>
</tr>
<tr>
number="2033"></td>
</tr>
<tr>
number="2034"></td>
</tr>
<tr>
number="2035"></td>
</tr>
<tr>
number="2036"></td>
</tr>
<tr>
number="2037"></td>
[P1+034E], IMAGEBASE</td>
</tr>
<tr>
number="2038"></td>
</tr>
<tr>
number="2039"></td>
[P1+035C], IMAGEBASE</td>
</tr>
<tr>
number="2040"></td>
</tr>
<tr>
number="2041"></td>
[P1+036D], IMAGEBASE</td>
</tr>
<tr>
number="2042"></td>
</tr>
<tr>
number="2043"></td>
</tr>
<tr>
number="2044"></td>
[P1+038B], IMAGEBASE</td>
</tr>
<tr>
number="2045"></td>
</tr>
<tr>
number="2046"></td>
[P1+039F], IMAGEBASE</td>
</tr>
<tr>
number="2047"></td>
[P1+03A9], IMAGEBASE</td>
</tr>
<tr>
number="2048"></td>
[P1+03B3], IMAGEBASE</td>
</tr>
<tr>
number="2049"></td>
[P1+03BD], IMAGEBASE</td>
</tr>
<tr>
number="2050"></td>
[P1+03C7], IMAGEBASE</td>
</tr>
<tr>
number="2051"></td>
[P1+03D1], IMAGEBASE</td>
</tr>
<tr>
number="2052"></td>
[P1+03DB], IMAGEBASE</td>
</tr>
<tr>
number="2053"></td>
<td id="LC2053" class="blob-code blob-code-inner js-file-line">mov TAMPA,
P1</td>
</tr>
<tr>
number="2054"></td>
<td id="LC2054" class="blob-code blob-code-inner js-file-line">add TAMPA,
3D5</td>
</tr>
<tr>
number="2055"></td>
06</td>
</tr>
<tr>
number="2056"></td>
<td id="LC2056" class="blob-code blob-code-inner js-file-line">mov [TAMPA],
IMAGEBASE</td>
</tr>
<tr>
number="2057"></td>
0A</td>
</tr>
<tr>
number="2058"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2059"></td>
0A</td>
</tr>
<tr>
number="2060"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2061"></td>
0A</td>
</tr>
<tr>
number="2062"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2063"></td>
0A</td>
</tr>
<tr>
number="2064"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2065"></td>
0A</td>
</tr>
<tr>
number="2066"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2067"></td>
0A</td>
</tr>
<tr>
number="2068"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2069"></td>
0A</td>
</tr>
<tr>
number="2070"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2071"></td>
0A</td>
</tr>
<tr>
number="2072"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2073"></td>
0A</td>
</tr>
<tr>
number="2074"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2075"></td>
0A</td>
</tr>
<tr>
number="2076"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2077"></td>
0A</td>
</tr>
<tr>
number="2078"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2079"></td>
0A</td>
</tr>
<tr>
number="2080"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2081"></td>
0A</td>
</tr>
<tr>
number="2082"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2083"></td>
0A</td>
</tr>
<tr>
number="2084"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2085"></td>
0A</td>
</tr>
<tr>
number="2086"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2087"></td>
0A</td>
</tr>
<tr>
number="2088"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2089"></td>
0A</td>
</tr>
<tr>
number="2090"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2091"></td>
0A</td>
</tr>
<tr>
number="2092"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2093"></td>
0A</td>
</tr>
<tr>
number="2094"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2095"></td>
0A</td>
</tr>
<tr>
number="2096"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2097"></td>
0A</td>
</tr>
<tr>
number="2098"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2099"></td>
0A</td>
</tr>
<tr>
number="2100"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2101"></td>
0A</td>
</tr>
<tr>
number="2102"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2103"></td>
0A</td>
</tr>
<tr>
number="2104"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2105"></td>
0A</td>
</tr>
<tr>
number="2106"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2107"></td>
0A</td>
</tr>
<tr>
number="2108"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2109"></td>
0A</td>
</tr>
<tr>
number="2110"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2111"></td>
0A</td>
</tr>
<tr>
number="2112"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2113"></td>
0A</td>
</tr>
<tr>
number="2114"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2115"></td>
0A</td>
</tr>
<tr>
number="2116"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2117"></td>
0A</td>
</tr>
<tr>
number="2118"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2119"></td>
0A</td>
</tr>
<tr>
number="2120"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2121"></td>
0A</td>
</tr>
<tr>
number="2122"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2123"></td>
0A</td>
</tr>
<tr>
number="2124"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2125"></td>
0A</td>
</tr>
<tr>
number="2126"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2127"></td>
0A</td>
</tr>
<tr>
number="2128"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2129"></td>
0A</td>
</tr>
<tr>
number="2130"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2131"></td>
0A</td>
</tr>
<tr>
number="2132"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2133"></td>
0A</td>
</tr>
<tr>
number="2134"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2135"></td>
0A</td>
</tr>
<tr>
number="2136"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2137"></td>
0A</td>
</tr>
<tr>
number="2138"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2139"></td>
0A</td>
</tr>
<tr>
number="2140"></td>
IMAGEBASE</td>
</tr>
<tr>
number="2141"></td>
[P1+06F1], IMAGEBASE</td>
</tr>
<tr>
number="2142"></td>
[P1+06FB], IMAGEBASE</td>
</tr>
<tr>
number="2143"></td>
</tr>
<tr>
number="2144"></td>
[P1+070F], IMAGEBASE</td>
</tr>
<tr>
number="2145"></td>
</tr>
<tr>
number="2146"></td>
line">////////////////////</td>
</tr>
<tr>
number="2147"></td>
<td id="LC2147" class="blob-code blob-code-inner js-file-line">HANTA:</td>
</tr>
<tr>
number="2148"></td>
<td id="LC2148" class="blob-code blob-code-inner js-file-line">jmp HANTA2
</td>
</tr>
<tr>
number="2149"></td>
</tr>
<tr>
number="2150"></td>
</tr>
<tr>
number="2151"></td>
[P1+036A], IMAGEBASE</td>
</tr>
<tr>
number="2152"></td>
</tr>
<tr>
number="2153"></td>
</tr>
<tr>
number="2154"></td>
</tr>
<tr>
number="2155"></td>
</tr>
<tr>
number="2156"></td>
</tr>
<tr>
number="2157"></td>
[P1+03A6], IMAGEBASE</td>
</tr>
<tr>
number="2158"></td>
[P1+03B0], IMAGEBASE</td>
</tr>
<tr>
number="2159"></td>
[P1+03BA], IMAGEBASE</td>
</tr>
<tr>
number="2160"></td>
[P1+03C4], IMAGEBASE</td>
</tr>
<tr>
number="2161"></td>
[P1+03CE], IMAGEBASE</td>
</tr>
<tr>
number="2162"></td>
[P1+03D8], IMAGEBASE</td>
</tr>
<tr>
number="2163"></td>
[P1+03E2], IMAGEBASE</td>
</tr>
<tr>
number="2164"></td>
[P1+03EC], IMAGEBASE</td>
</tr>
<tr>
number="2165"></td>
[P1+03F6], IMAGEBASE</td>
</tr>
<tr>
number="2166"></td>
</tr>
<tr>
number="2167"></td>
</tr>
<tr>
number="2168"></td>
</tr>
<tr>
number="2169"></td>
</tr>
<tr>
number="2170"></td>
</tr>
<tr>
number="2171"></td>
</tr>
<tr>
number="2172"></td>
</tr>
<tr>
number="2173"></td>
</tr>
<tr>
number="2174"></td>
</tr>
<tr>
number="2175"></td>
</tr>
<tr>
number="2176"></td>
</tr>
<tr>
number="2177"></td>
</tr>
<tr>
number="2178"></td>
</tr>
<tr>
number="2179"></td>
</tr>
<tr>
number="2180"></td>
line">////////////////////</td>
</tr>
<tr>
number="2181"></td>
<td id="LC2181" class="blob-code blob-code-inner js-file-line">HANTA2:</td>
</tr>
<tr>
number="2182"></td>
<td id="LC2182" class="blob-code blob-code-inner js-file-line">add P1_BAK,
2D0</td>
</tr>
<tr>
number="2183"></td>
"MOV WORD PTR DS:[{P1}],55EB"</td>
</tr>
<tr>
number="2184"></td>
<td id="LC2184" class="blob-code blob-code-inner js-file-line">asm P1_BAK,
$RESULT</td>
</tr>
<tr>
number="2185"></td>
<td id="LC2185" class="blob-code blob-code-inner js-file-line">sub P1_BAK,
2D0</td>
</tr>
<tr>
number="2186"></td>
<td id="LC2186" class="blob-code blob-code-inner js-file-line">add P1_BAK,
2D9</td>
</tr>
<tr>
number="2187"></td>
<td id="LC2187" class="blob-code blob-code-inner js-file-line">mov P_TEMP,
P1</td>
</tr>
<tr>
number="2188"></td>
<td id="LC2188" class="blob-code blob-code-inner js-file-line">add P_TEMP,
0E50</td>
</tr>
<tr>
number="2189"></td>
"jmp dword ptr ds:[{P_TEMP}]"</td>
</tr>
<tr>
number="2190"></td>
<td id="LC2190" class="blob-code blob-code-inner js-file-line">asm P1_BAK,
$RESULT</td>
</tr>
<tr>
number="2191"></td>
<td id="LC2191" class="blob-code blob-code-inner js-file-line">sub P1_BAK,
2D9</td>
</tr>
<tr>
number="2192"></td>
<td id="LC2192" class="blob-code blob-code-inner js-file-line">mov FACE, P1
</td>
</tr>
<tr>
number="2193"></td>
<td id="LC2193" class="blob-code blob-code-inner js-file-line">add FACE,
2E0</td>
</tr>
<tr>
number="2194"></td>
<td id="LC2194" class="blob-code blob-code-inner js-file-line">mov FACE_2,
TEMP_EXTRA</td>
</tr>
<tr>
number="2195"></td>
<td id="LC2195" class="blob-code blob-code-inner js-file-line">add FACE_2,
2E0</td>
</tr>
<tr>
number="2196"></td>
""</td>
</tr>
<tr>
number="2197"></td>
"Dynamic DLL Patch was written and starts at address: {FACE}"</td>
</tr>
<tr>
number="2198"></td>
""</td>
</tr>
<tr>
number="2199"></td>
""</td>
</tr>
<tr>
number="2200"></td>
"Enter in LORD PE the new EP RVA address of: {FACE_2}"</td>
</tr>
<tr>
number="2201"></td>
""</td>
</tr>
<tr>
number="2202"></td>
""</td>
</tr>
<tr>
number="2203"></td>
{scriptname} \r\n\r\n{points} \r\n\r\nDynamic DLL Patch was written and starts at
address: {FACE} \r\n\r\nThis is also your >>> NEW DLL ENTRY POINT!
<<< \r\n\r\nNew EP RVA is: {FACE_2} \r\n\r\n{points} \r\n{ME}"</td>
</tr>
<tr>
number="2204"></td>
</td>
</tr>
<tr>
number="2205"></td>
$RESULT</td>
</tr>
<tr>
number="2206"></td>
" "</td>
</tr>
<tr>
number="2207"></td>
WRITE_OVER_2</td>
</tr>
<tr>
number="2208"></td>
</tr>
<tr>
number="2209"></td>
</tr>
<tr>
number="2210"></td>
line">////////////////////</td>
</tr>
<tr>
number="2211"></td>
line">WRITE_OVER_2:</td>
</tr>
<tr>
number="2212"></td>
line">////////////////////</td>
</tr>
<tr>
number="2213"></td>
line">WRITE_OVER_2_A:</td>
</tr>
<tr>
number="2214"></td>
{PROCESSNAME_2}_InLine.exe was successfully created!"</td>
</tr>
<tr>
number="2215"></td>
"</td>
</tr>
<tr>
number="2216"></td>
line">////////////////////</td>
</tr>
<tr>
number="2217"></td>
<td id="LC2217" class="blob-code blob-code-inner js-file-line">NO_DUMP:
</td>
</tr>
<tr>
number="2218"></td>
""</td>
</tr>
<tr>
number="2219"></td>
"Don´t forget to change the new EntryPoint!"</td>
</tr>
<tr>
number="2220"></td>
line">////////////////////</td>
</tr>
<tr>
number="2221"></td>
<td id="LC2221" class="blob-code blob-code-inner js-file-line">DUMP_OVER:
</td>
</tr>
<tr>
number="2222"></td>
{scriptname} \r\n\r\n{points} \r\n\r\nNow in your last step you need to run this
script again to find the new CRC DWORD! \r\n\r\nAfter this your are finished!
</tr>
<tr>
number="2223"></td>
</td>
</tr>
<tr>
number="2224"></td>
""</td>
</tr>
<tr>
number="2225"></td>
"Now in your last step you need to run this script again to find the new CRC
DWORD!After this your are finished!"</td>
</tr>
<tr>
number="2226"></td>
""</td>
</tr>
<tr>
number="2227"></td>
<td id="LC2227" class="blob-code blob-code-inner js-file-line">free READ
</td>
</tr>
<tr>
number="2228"></td>
</td>
</tr>
<tr>
number="2229"></td>
line">////////////////////</td>
</tr>
<tr>
number="2230"></td>
line">START_OF_CRCCHECK:</td>
</tr>
<tr>
number="2231"></td>
</td>
</tr>
<tr>
number="2232"></td>
line">////////////////////</td>
</tr>
<tr>
number="2233"></td>
<td id="LC2233" class="blob-code blob-code-inner js-file-line">START_2:
</td>
</tr>
<tr>
number="2234"></td>
<td id="LC2234" class="blob-code blob-code-inner js-file-line">cmp Temp_1,
00</td>
</tr>
<tr>
number="2235"></td>
<td id="LC2235" class="blob-code blob-code-inner js-file-line">je START_2_B
</td>
</tr>
<tr>
number="2236"></td>
<td id="LC2236" class="blob-code blob-code-inner js-file-line">find Temp_1,
#5F5EF7D0C3#</td>
</tr>
<tr>
number="2237"></td>
00</td>
</tr>
<tr>
number="2238"></td>
FOUNDSOME</td>
</tr>
<tr>
number="2239"></td>
#??F7D0??C20?#</td>
</tr>
<tr>
number="2240"></td>
00</td>
</tr>
<tr>
number="2241"></td>
FOUNDSOME</td>
</tr>
<tr>
number="2242"></td>
<td id="LC2242" class="blob-code blob-code-inner js-file-line">cmp Temp_2,
00</td>
</tr>
<tr>
number="2243"></td>
</td>
</tr>
<tr>
number="2244"></td>
#5F5EF7D0C3#</td>
</tr>
<tr>
number="2245"></td>
00</td>
</tr>
<tr>
number="2246"></td>
<td id="LC2246" class="blob-code blob-code-inner js-file-line">jne SAFFA
</td>
</tr>
<tr>
number="2247"></td>
FOUNDSOME</td>
</tr>
<tr>
number="2248"></td>
line">////////////////////</td>
</tr>
<tr>
number="2249"></td>
<td id="LC2249" class="blob-code blob-code-inner js-file-line">SAFFA:</td>
</tr>
<tr>
number="2250"></td>
#??F7D0??C20?#</td>
</tr>
<tr>
number="2251"></td>
00</td>
</tr>
<tr>
number="2252"></td>
</td>
</tr>
<tr>
number="2253"></td>
line">////////////////////</td>
</tr>
<tr>
number="2254"></td>
<td id="LC2254" class="blob-code blob-code-inner js-file-line">FOUNDSOME:
</td>
</tr>
<tr>
number="2255"></td>
<td id="LC2255" class="blob-code blob-code-inner js-file-line">mov CRC,
$RESULT</td>
</tr>
<tr>
number="2256"></td>
<td id="LC2256" class="blob-code blob-code-inner js-file-line">add CRC, 04
</td>
</tr>
<tr>
number="2257"></td>
<td id="LC2257" class="blob-code blob-code-inner js-file-line">gmemi CRC,
MEMORYBASE</td>
</tr>
<tr>
number="2258"></td>
<td id="LC2258" class="blob-code blob-code-inner js-file-line">mov CRCBASE,
$RESULT</td>
</tr>
<tr>
number="2259"></td>
</tr>
<tr>
number="2260"></td>
</tr>
<tr>
number="2261"></td>
FOUNDCRC_2</td>
</tr>
<tr>
number="2262"></td>
line">////////////////////</td>
</tr>
<tr>
number="2263"></td>
<td id="LC2263" class="blob-code blob-code-inner js-file-line">START_2_B:
</td>
</tr>
<tr>
number="2264"></td>
VirtualAlloc, "x"</td>
</tr>
<tr>
number="2265"></td>
VirtualAlloc</td>
</tr>
<tr>
number="2266"></td>
MapViewOfFile, "x"</td>
</tr>
<tr>
number="2267"></td>
MapViewOfFile</td>
</tr>
<tr>
number="2268"></td>
</tr>
<tr>
number="2269"></td>
VirtualAlloc</td>
</tr>
<tr>
number="2270"></td>
<td id="LC2270" class="blob-code blob-code-inner js-file-line">je ALLOC
</td>
</tr>
<tr>
number="2271"></td>
</tr>
<tr>
number="2272"></td>
</tr>
<tr>
number="2273"></td>
<td id="LC2273" class="blob-code blob-code-inner js-file-line">rtu</td>
</tr>
<tr>
number="2274"></td>
MAPPEDFILE, eax</td>
</tr>
<tr>
number="2275"></td>
<td id="LC2275" class="blob-code blob-code-inner js-file-line">rtu</td>
</tr>
<tr>
number="2276"></td>
MEMORYBASE</td>
</tr>
<tr>
number="2277"></td>
<td id="LC2277" class="blob-code blob-code-inner js-file-line">mov CRCBASE,
$RESULT</td>
</tr>
<tr>
number="2278"></td>
CRCBASE, #5F5EF7D0C3#</td>
</tr>
<tr>
number="2279"></td>
00</td>
</tr>
<tr>
number="2280"></td>
<td id="LC2280" class="blob-code blob-code-inner js-file-line">jne FOUNDCRC
</td>
</tr>
<tr>
number="2281"></td>
</tr>
<tr>
number="2282"></td>
</tr>
<tr>
number="2283"></td>
line">////////////////////</td>
</tr>
<tr>
number="2284"></td>
<td id="LC2284" class="blob-code blob-code-inner js-file-line">FOUNDCRC:
</td>
</tr>
<tr>
number="2285"></td>
<td id="LC2285" class="blob-code blob-code-inner js-file-line">mov CRC,
$RESULT</td>
</tr>
<tr>
number="2286"></td>
<td id="LC2286" class="blob-code blob-code-inner js-file-line">add CRC, 04
</td>
</tr>
<tr>
number="2287"></td>
line">////////////////////</td>
</tr>
<tr>
number="2288"></td>
<td id="LC2288" class="blob-code blob-code-inner js-file-line">FOUNDCRC_2:
</td>
</tr>
<tr>
number="2289"></td>
<td id="LC2289" class="blob-code blob-code-inner js-file-line">bphws CRC,
"x"</td>
</tr>
<tr>
number="2290"></td>
<td id="LC2290" class="blob-code blob-code-inner js-file-line">bp CRC</td>
</tr>
<tr>
number="2291"></td>
</tr>
<tr>
number="2292"></td>
<td id="LC2292" class="blob-code blob-code-inner js-file-line">inc run</td>
</tr>
<tr>
number="2293"></td>
<td id="LC2293" class="blob-code blob-code-inner js-file-line">cmp run, 02
</td>
</tr>
<tr>
number="2294"></td>
<td id="LC2294" class="blob-code blob-code-inner js-file-line">je RUNTEST
</td>
</tr>
<tr>
number="2295"></td>
<td id="LC2295" class="blob-code blob-code-inner js-file-line">jb RUNTEST
</td>
</tr>
<tr>
number="2296"></td>
</tr>
<tr>
number="2297"></td>
</tr>
<tr>
number="2298"></td>
line">////////////////////</td>
</tr>
<tr>
number="2299"></td>
<td id="LC2299" class="blob-code blob-code-inner js-file-line">RUNTEST:
</td>
</tr>
<tr>
number="2300"></td>
<td id="LC2300" class="blob-code blob-code-inner js-file-line">cmp DWORD_1,
00</td>
</tr>
<tr>
number="2301"></td>
FOUNDCRC_2_A</td>
</tr>
<tr>
number="2302"></td>
<td id="LC2302" class="blob-code blob-code-inner js-file-line">mov DWORD_1,
eax</td>
</tr>
<tr>
number="2303"></td>
DWORD_1_TEMP, eax</td>
</tr>
<tr>
number="2304"></td>
line">////////////////////</td>
</tr>
<tr>
number="2305"></td>
line">FOUNDCRC_2_A:</td>
</tr>
<tr>
number="2306"></td>
</td>
</tr>
<tr>
number="2307"></td>
FOUNDCRC_2_B</td>
</tr>
<tr>
number="2308"></td>
<td id="LC2308" class="blob-code blob-code-inner js-file-line">cmp DWORD_2,
00</td>
</tr>
<tr>
number="2309"></td>
FOUNDCRC_2_B</td>
</tr>
<tr>
number="2310"></td>
<td id="LC2310" class="blob-code blob-code-inner js-file-line">mov DWORD_2,
eax</td>
</tr>
<tr>
number="2311"></td>
line">////////////////////</td>
</tr>
<tr>
number="2312"></td>
line">FOUNDCRC_2_B:</td>
</tr>
<tr>
number="2313"></td>
OTHERCRC, 01</td>
</tr>
<tr>
number="2314"></td>
FOUNDCRC_2_B_1_2</td>
</tr>
<tr>
number="2315"></td>
ecx</td>
</tr>
<tr>
number="2316"></td>
<td id="LC2316" class="blob-code blob-code-inner js-file-line">gmemi TEMP,
MEMORYBASE</td>
</tr>
<tr>
number="2317"></td>
00</td>
</tr>
<tr>
number="2318"></td>
FOUNDCRC_2_C</td>
</tr>
<tr>
number="2319"></td>
<td id="LC2319" class="blob-code blob-code-inner js-file-line">mov AA,
$RESULT</td>
</tr>
<tr>
number="2320"></td>
<td id="LC2320" class="blob-code blob-code-inner js-file-line">mov NO_CODE,
01</td>
</tr>
<tr>
number="2321"></td>
<td id="LC2321" class="blob-code blob-code-inner js-file-line">cmp AA,
PE_HEADER</td>
</tr>
<tr>
number="2322"></td>
FOUNDCRC_2_D</td>
</tr>
<tr>
number="2323"></td>
<td id="LC2323" class="blob-code blob-code-inner js-file-line">cmp AA,
</tr>
<tr>
number="2324"></td>
<td id="LC2324" class="blob-code blob-code-inner js-file-line">ja
FOUNDCRC_2_D</td>
</tr>
<tr>
number="2325"></td>
<td id="LC2325" class="blob-code blob-code-inner js-file-line">mov NO_CODE,
00</td>
</tr>
<tr>
number="2326"></td>
line">////////////////////</td>
</tr>
<tr>
number="2327"></td>
line">FOUNDCRC_2_C:</td>
</tr>
<tr>
number="2328"></td>
<td id="LC2328" class="blob-code blob-code-inner js-file-line">cmp TEMP, 00
</td>
</tr>
<tr>
number="2329"></td>
FOUNDCRC_2_B_1</td>
</tr>
<tr>
number="2330"></td>
line">////////////////////</td>
</tr>
<tr>
number="2331"></td>
line">FOUNDCRC_2_D:</td>
</tr>
<tr>
number="2332"></td>
OTHERCRC, 01</td>
</tr>
<tr>
number="2333"></td>
line">////////////////////</td>
</tr>
<tr>
number="2334"></td>
line">FOUNDCRC_2_B_1:</td>
</tr>
<tr>
number="2335"></td>
MAPPEDFILE, 00</td>
</tr>
<tr>
number="2336"></td>
</tr>
<tr>
number="2337"></td>
<td id="LC2337" class="blob-code blob-code-inner js-file-line">gmemi TEMP,
MEMORYBASE</td>
</tr>
<tr>
number="2338"></td>
MAPPEDFILE</td>
</tr>
<tr>
number="2339"></td>
FOUNDCRC_2</td>
</tr>
<tr>
number="2340"></td>
line">////////////////////</td>
</tr>
<tr>
number="2341"></td>
line">FOUNDCRC_2_B_1_2:</td>
</tr>
<tr>
number="2342"></td>
</td>
</tr>
<tr>
number="2343"></td>
FOUNDCRC_2</td>
</tr>
<tr>
number="2344"></td>
<td id="LC2344" class="blob-code blob-code-inner js-file-line">xor DWORD_1,
DWORD_2</td>
</tr>
<tr>
number="2345"></td>
<td id="LC2345" class="blob-code blob-code-inner js-file-line">mov DWORD,
DWORD_1</td>
</tr>
<tr>
number="2346"></td>
OTHERCRC, 01</td>
</tr>
<tr>
number="2347"></td>
</tr>
<tr>
number="2348"></td>
line">////////////////////</td>
</tr>
<tr>
number="2349"></td>
<td id="LC2349" class="blob-code blob-code-inner js-file-line">ROUNDER:
</td>
</tr>
<tr>
number="2350"></td>
</tr>
<tr>
number="2351"></td>
C833, 02</td>
</tr>
<tr>
number="2352"></td>
<td id="LC2352" class="blob-code blob-code-inner js-file-line">jne ROUNDER
</td>
</tr>
<tr>
number="2353"></td>
line">////////////////////</td>
</tr>
<tr>
number="2354"></td>
<td id="LC2354" class="blob-code blob-code-inner js-file-line">ROUNDER_2:
</td>
</tr>
<tr>
number="2355"></td>
</tr>
<tr>
number="2356"></td>
3B, 01</td>
</tr>
<tr>
number="2357"></td>
ROUNDER_2</td>
</tr>
<tr>
number="2358"></td>
<td id="LC2358" class="blob-code blob-code-inner js-file-line">GOPI eip, 2,
ADDR</td>
</tr>
<tr>
number="2359"></td>
CRC_ADDRESS, $RESULT</td>
</tr>
<tr>
number="2360"></td>
line">////////////////////</td>
</tr>
<tr>
number="2361"></td>
</td>
</tr>
<tr>
number="2362"></td>
</tr>
<tr>
number="2363"></td>
840F, 02</td>
</tr>
<tr>
number="2364"></td>
ROUNDER_4</td>
</tr>
<tr>
number="2365"></td>
<td id="LC2365" class="blob-code blob-code-inner js-file-line">cmp !ZF, 00
</td>
</tr>
<tr>
number="2366"></td>
<td id="LC2366" class="blob-code blob-code-inner js-file-line">je SET_CRC
</td>
</tr>
<tr>
number="2367"></td>
</tr>
<tr>
number="2368"></td>
line">////////////////////</td>
</tr>
<tr>
number="2369"></td>
</td>
</tr>
<tr>
number="2370"></td>
850F, 02</td>
</tr>
<tr>
number="2371"></td>
ROUNDER_3</td>
</tr>
<tr>
number="2372"></td>
<td id="LC2372" class="blob-code blob-code-inner js-file-line">cmp !ZF, 01
</td>
</tr>
<tr>
number="2373"></td>
<td id="LC2373" class="blob-code blob-code-inner js-file-line">je SET_CRC
</td>
</tr>
<tr>
number="2374"></td>
</tr>
<tr>
number="2375"></td>
line">////////////////////</td>
</tr>
<tr>
number="2376"></td>
<td id="LC2376" class="blob-code blob-code-inner js-file-line">SET_CRC:
</td>
</tr>
<tr>
number="2377"></td>
<td id="LC2377" class="blob-code blob-code-inner js-file-line">mov CRCSET,
01</td>
</tr>
<tr>
number="2378"></td>
"NEW CRC NEEDED!"</td>
</tr>
<tr>
number="2379"></td>
</tr>
<tr>
number="2380"></td>
line">////////////////////</td>
</tr>
<tr>
number="2381"></td>
</tr>
<tr>
number="2382"></td>
CRC_ADDRESS, ecx</td>
</tr>
<tr>
number="2383"></td>
line">////////////////////</td>
</tr>
<tr>
number="2384"></td>
</tr>
<tr>
number="2385"></td>
<td id="LC2385" class="blob-code blob-code-inner js-file-line">mov OLD_CRC,
[CRC_ADDRESS]</td>
</tr>
<tr>
number="2386"></td>
<td id="LC2386" class="blob-code blob-code-inner js-file-line">mov NEW_CRC,
DWORD</td>
</tr>
<tr>
number="2387"></td>
<td id="LC2387" class="blob-code blob-code-inner js-file-line">findmem
OLD_CRC, CODESECTION</td>
</tr>
<tr>
number="2388"></td>
00</td>
</tr>
<tr>
number="2389"></td>
<td id="LC2389" class="blob-code blob-code-inner js-file-line">jne CRC_CODE
</td>
</tr>
<tr>
number="2390"></td>
</tr>
<tr>
number="2391"></td>
</tr>
<tr>
number="2392"></td>
line">////////////////////</td>
</tr>
<tr>
number="2393"></td>
<td id="LC2393" class="blob-code blob-code-inner js-file-line">CRC_CODE:
</td>
</tr>
<tr>
number="2394"></td>
<td id="LC2394" class="blob-code blob-code-inner js-file-line">mov END_CRC,
$RESULT</td>
</tr>
<tr>
number="2395"></td>
</tr>
<tr>
number="2396"></td>
</tr>
<tr>
number="2397"></td>
<td id="LC2397" class="blob-code blob-code-inner js-file-line">xor
DWORD_1_TEMP, OLD_CRC</td>
</tr>
<tr>
number="2398"></td>
<td id="LC2398" class="blob-code blob-code-inner js-file-line">// mov eax,
DWORD_1_TEMP</td>
</tr>
<tr>
number="2399"></td>
<td id="LC2399" class="blob-code blob-code-inner js-file-line">cmp KULI, 01
</td>
</tr>
<tr>
number="2400"></td>
<td id="LC2400" class="blob-code blob-code-inner js-file-line">je CRC_INFOS
</td>
</tr>
<tr>
number="2401"></td>
</tr>
<tr>
number="2402"></td>
$RESULT</td>
</tr>
<tr>
number="2403"></td>
$RESULT</td>
</tr>
<tr>
number="2404"></td>
" "</td>
</tr>
<tr>
number="2405"></td>
line">////////////////////</td>
</tr>
<tr>
number="2406"></td>
<td id="LC2406" class="blob-code blob-code-inner js-file-line">CRC_INFOS:
</td>
</tr>
<tr>
number="2407"></td>
"The CRC DWORD was located at {END_CRC} | {OLD_CRC}"</td>
</tr>
<tr>
number="2408"></td>
$RESULT</td>
</tr>
<tr>
number="2409"></td>
""</td>
</tr>
<tr>
number="2410"></td>
" "</td>
</tr>
<tr>
number="2411"></td>
""</td>
</tr>
<tr>
number="2412"></td>
"The new CRC DWORD is {NEW_CRC}"</td>
</tr>
<tr>
number="2413"></td>
$RESULT</td>
</tr>
<tr>
number="2414"></td>
""</td>
</tr>
<tr>
number="2415"></td>
""</td>
</tr>
<tr>
number="2416"></td>
" "</td>
</tr>
<tr>
number="2417"></td>
points</td>
</tr>
<tr>
number="2418"></td>
<td id="LC2418" class="blob-code blob-code-inner js-file-line">log points,
""</td>
</tr>
<tr>
number="2419"></td>
"The new CRC result is: {END_CRC} | {NEW_CRC}"</td>
</tr>
<tr>
number="2420"></td>
$RESULT</td>
</tr>
<tr>
number="2421"></td>
""</td>
</tr>
<tr>
number="2422"></td>
" "</td>
</tr>
<tr>
number="2423"></td>
""</td>
</tr>
<tr>
number="2424"></td>
{scriptname} \r\n\r\n{points} \r\n\r\nThe CRC DWORD was located at {END_CRC} |
{OLD_CRC} \r\n\r\nThe new CRC DWORD is {NEW_CRC} \r\n\r\nThe new CRC result is:
{END_CRC} | {NEW_CRC} \r\n\r\n{points} \r\n{ME}"</td>
</tr>
<tr>
number="2425"></td>
</td>
</tr>
<tr>
number="2426"></td>
{scriptname} \r\n\r\n{points} \r\n\r\nDo you want let patch NOW the new CRC
DWORD? \r\n\r\n{points} \r\n{ME}"</td>
</tr>
<tr>
number="2427"></td>
<td id="LC2427" class="blob-code blob-code-inner js-file-line">msgyn
$RESULT</td>
</tr>
<tr>
number="2428"></td>
01</td>
</tr>
<tr>
number="2429"></td>
<td id="LC2429" class="blob-code blob-code-inner js-file-line">jne CRC_ENDE
</td>
</tr>
<tr>
number="2430"></td>
END_CRC</td>
</tr>
<tr>
number="2431"></td>
[END_CRC], NEW_CRC</td>
</tr>
<tr>
number="2432"></td>
<td id="LC2432" class="blob-code blob-code-inner js-file-line">mov patched,
01</td>
</tr>
<tr>
number="2433"></td>
line">////////////////////</td>
</tr>
<tr>
number="2434"></td>
<td id="LC2434" class="blob-code blob-code-inner js-file-line">CRC_ENDE:
</td>
</tr>
<tr>
number="2435"></td>
"Save the new CRC DWORD on the LAST step after all your patches!"</td>
</tr>
<tr>
number="2436"></td>
" "</td>
</tr>
<tr>
number="2437"></td>
"Save the new CRC DWORD on the LAST step after all your patches!"</td>
</tr>
<tr>
number="2438"></td>
"</td>
</tr>
<tr>
number="2439"></td>
<td id="LC2439" class="blob-code blob-code-inner js-file-line">cmp patched,
01</td>
</tr>
<tr>
number="2440"></td>
CRC_ENDE_2</td>
</tr>
<tr>
number="2441"></td>
{scriptname} \r\n\r\n{points} \r\n\r\nThe NEW CRC DWORD WAS WRITTEN,NOW SELECT this
DWORD AND SAVE! \r\n\r\n{points} \r\n{ME}"</td>
</tr>
<tr>
number="2442"></td>
" "</td>
</tr>
<tr>
number="2443"></td>
</td>
</tr>
<tr>
number="2444"></td>
"The NEW CRC DWORD WAS WRITTEN,NOW SELECT this DWORD AND SAVE!"</td>
</tr>
<tr>
number="2445"></td>
"The NEW CRC DWORD WAS WRITTEN,NOW SELECT this DWORD AND SAVE!"</td>
</tr>
<tr>
number="2446"></td>
""</td>
</tr>
<tr>
number="2447"></td>
<td id="LC2447" class="blob-code blob-code-inner js-file-line">OPENDUMP
END_CRC</td>
</tr>
<tr>
number="2448"></td>
<td id="LC2448" class="blob-code blob-code-inner js-file-line">cmt END_CRC,
"CRC DWORD!"</td>
</tr>
<tr>
number="2449"></td>
line">////////////////////</td>
</tr>
<tr>
number="2450"></td>
<td id="LC2450" class="blob-code blob-code-inner js-file-line">CRC_ENDE_2:
</td>
</tr>
<tr>
number="2451"></td>
</td>
</tr>
<tr>
number="2452"></td>
line">////////////////////</td>
</tr>
<tr>
number="2453"></td>
<td id="LC2453" class="blob-code blob-code-inner js-file-line">ALLOC:</td>
</tr>
<tr>
number="2454"></td>
VirtualAlloc</td>
</tr>
<tr>
number="2455"></td>
<td id="LC2455" class="blob-code blob-code-inner js-file-line">bc
VirtualAlloc</td>
</tr>
<tr>
number="2456"></td>
<td id="LC2456" class="blob-code blob-code-inner js-file-line">inc ALOC
</td>
</tr>
<tr>
number="2457"></td>
<td id="LC2457" class="blob-code blob-code-inner js-file-line">cmp A_SIZE,
00</td>
</tr>
<tr>
number="2458"></td>
<td id="LC2458" class="blob-code blob-code-inner js-file-line">jne ALLOC_2
</td>
</tr>
<tr>
number="2459"></td>
<td id="LC2459" class="blob-code blob-code-inner js-file-line">mov A_SIZE,
[esp+08]</td>
</tr>
<tr>
number="2460"></td>
</tr>
<tr>
number="2461"></td>
A_ADDRESS, eax</td>
</tr>
<tr>
number="2462"></td>
<td id="LC2462" class="blob-code blob-code-inner js-file-line">mov Temp_1,
eax</td>
</tr>
<tr>
number="2463"></td>
<td id="LC2463" class="blob-code blob-code-inner js-file-line">jmp START_2
</td>
</tr>
<tr>
number="2464"></td>
line">////////////////////</td>
</tr>
<tr>
number="2465"></td>
<td id="LC2465" class="blob-code blob-code-inner js-file-line">ALLOC_2:
</td>
</tr>
<tr>
number="2466"></td>
<td id="LC2466" class="blob-code blob-code-inner js-file-line">cmp B_SIZE,
00</td>
</tr>
<tr>
number="2467"></td>
</td>
</tr>
<tr>
number="2468"></td>
<td id="LC2468" class="blob-code blob-code-inner js-file-line">mov B_SIZE,
[esp+08]</td>
</tr>
<tr>
number="2469"></td>
</tr>
<tr>
number="2470"></td>
B_ADDRESS, eax</td>
</tr>
<tr>
number="2471"></td>
eax</td>
</tr>
<tr>
number="2472"></td>
</td>
</tr>
<tr>
number="2473"></td>
line">////////////////////</td>
</tr>
<tr>
number="2474"></td>
</td>
</tr>
<tr>
number="2475"></td>
<td id="LC2475" class="blob-code blob-code-inner js-file-line">cmp C_SIZE,
00</td>
</tr>
<tr>
number="2476"></td>
</td>
</tr>
<tr>
number="2477"></td>
<td id="LC2477" class="blob-code blob-code-inner js-file-line">mov C_SIZE,
[esp+08]</td>
</tr>
<tr>
number="2478"></td>
</tr>
<tr>
number="2479"></td>
C_ADDRESS, eax</td>
</tr>
<tr>
number="2480"></td>
eax</td>
</tr>
<tr>
number="2481"></td>
</td>
</tr>
<tr>
number="2482"></td>
line">////////////////////</td>
</tr>
<tr>
number="2483"></td>
</td>
</tr>
<tr>
number="2484"></td>
<td id="LC2484" class="blob-code blob-code-inner js-file-line">cmp D_SIZE,
00</td>
</tr>
<tr>
number="2485"></td>
</td>
</tr>
<tr>
number="2486"></td>
<td id="LC2486" class="blob-code blob-code-inner js-file-line">mov D_SIZE,
[esp+08]</td>
</tr>
<tr>
number="2487"></td>
</tr>
<tr>
number="2488"></td>
D_ADDRESS, eax</td>
</tr>
<tr>
number="2489"></td>
eax</td>
</tr>
<tr>
number="2490"></td>
</td>
</tr>
<tr>
number="2491"></td>
line">////////////////////</td>
</tr>
<tr>
number="2492"></td>
</td>
</tr>
<tr>
number="2493"></td>
<td id="LC2493" class="blob-code blob-code-inner js-file-line">mov E_SIZE,
[esp+08]</td>
</tr>
<tr>
number="2494"></td>
</tr>
<tr>
number="2495"></td>
E_ADDRESS, eax</td>
</tr>
<tr>
number="2496"></td>
eax</td>
</tr>
<tr>
number="2497"></td>
</td>
</tr>
<tr>
number="2498"></td>
line">////////////////////</td>
</tr>
<tr>
number="2499"></td>
<td id="LC2499" class="blob-code blob-code-inner js-file-line">FULL_END:
</td>
</tr>
<tr>
number="2500"></td>
<td id="LC2500" class="blob-code blob-code-inner js-file-line">cmp STUCK,
01</td>
</tr>
<tr>
number="2501"></td>
FULL_END_2</td>
</tr>
<tr>
number="2502"></td>
{PROCESSNAME_2}_Version.txt"</td>
</tr>
<tr>
number="2503"></td>
<td id="LC2503" class="blob-code blob-code-inner js-file-line">mov sFileB,
$RESULT</td>
</tr>
<tr>
number="2504"></td>
<td id="LC2504" class="blob-code blob-code-inner js-file-line">wrt sFileB,
TAFF</td>
</tr>
<tr>
number="2505"></td>
line">////////////////////</td>
</tr>
<tr>
number="2506"></td>
<td id="LC2506" class="blob-code blob-code-inner js-file-line">FULL_END_2:
</td>
</tr>
<tr>
number="2507"></td>
scriptname, ""</td>
</tr>
<tr>
number="2508"></td>
<td id="LC2508" class="blob-code blob-code-inner js-file-line">log points,
""</td>
</tr>
<tr>
number="2509"></td>
"script was written by"</td>
</tr>
<tr>
number="2510"></td>
""</td>
</tr>
<tr>
number="2511"></td>
<td id="LC2511" class="blob-code blob-code-inner js-file-line">log ME,
""</td>
</tr>
<tr>
number="2512"></td>
{scriptname} \r\n\r\n{points} \r\nscript was written by \r\n\r\n{ME}"</td>
</tr>
<tr>
number="2513"></td>
</td>
</tr>
<tr>
number="2514"></td>
<td id="LC2514" class="blob-code blob-code-inner js-file-line">cmp KULI, 01
</td>
</tr>
<tr>
number="2515"></td>
FULL_END_3</td>
</tr>
<tr>
number="2516"></td>
<td id="LC2516" class="blob-code blob-code-inner js-file-line">jmp AUSS
</td>
</tr>
<tr>
number="2517"></td>
line">////////////////////</td>
</tr>
<tr>
number="2518"></td>
<td id="LC2518" class="blob-code blob-code-inner js-file-line">FULL_END_3:
</td>
</tr>
<tr>
number="2519"></td>
"\r\n"</td>
</tr>
<tr>
number="2520"></td>
"\r\n"</td>
</tr>
<tr>
number="2521"></td>
points</td>
</tr>
<tr>
number="2522"></td>
"script was written by"</td>
</tr>
<tr>
number="2523"></td>
" "</td>
</tr>
<tr>
number="2524"></td>
ME</td>
</tr>
<tr>
number="2525"></td>
line">////////////////////</td>
</tr>
<tr>
number="2526"></td>
<td id="LC2526" class="blob-code blob-code-inner js-file-line">AUSS:</td>
</tr>
<tr>
number="2527"></td>
</tr>
<tr>
number="2528"></td>
</tr>
<tr>
number="2529"></td>
</tr>
<tr>
number="2530"></td>
</tr>
</table>
<details class="details-reset details-overlay BlobToolbar position-absolute js-

file-line-actions dropdown d-none" aria-hidden="true">
<summary class="btn-octicon ml-0 px-2 p-0 bg-white border border-gray-dark
rounded-1" aria-label="Inline file action toolbar">
<svg class="octicon octicon-kebab-horizontal" viewBox="0 0 13 16"
d="M1.5 9a1.5 1.5 0 1 0 0-3 1.5 1.5 0 0 0 0 3zm5 0a1.5 1.5 0 1 0 0-3 1.5 1.5 0 0 0
0 3zM13 7.5a1.5 1.5 0 1 1-3 0 1.5 1.5 0 0 1 3 0z"/></svg>
</summary>
<details-menu>
<ul class="BlobToolbar-dropdown dropdown-menu dropdown-menu-se mt-2">
<li><clipboard-copy role="menuitem" class="dropdown-item" id="js-copy-
lines" style="cursor:pointer;" data-original-text="Copy lines">Copy
lines</clipboard-copy></li>
<li><clipboard-copy role="menuitem" class="dropdown-item" id="js-copy-
permalink" style="cursor:pointer;" data-original-text="Copy permalink">Copy
permalink</clipboard-copy></li>
<li><a class="dropdown-item js-update-url-with-hash" id="js-view-git-blame"
role="menuitem" href="/ThomasThelen/OllyDbg-
Scripts/blame/a1956715a19f49edc910a633f3d4d9fb323b76d7/ZProtect/ZProtect%201.3%20-
%201.6%20Full%20Decryption%20%2B%20Inline%20Patcher%20v1.0.txt">View git
blame</a></li>
<li><a class="dropdown-item" id="js-new-issue" role="menuitem"
href="/ThomasThelen/OllyDbg-Scripts/issues/new">Open new issue</a></li>
</ul>
</details-menu>
</details>
</div>
</div>
<details class="details-reset details-overlay details-overlay-dark">

<summary data-hotkey="l" aria-label="Jump to line"></summary>
<details-dialog class="Box Box--overlay d-flex flex-column anim-fade-in fast
linejump" aria-label="Jump to line">
</option></form><form class="js-jump-
to-line-form Box-body d-flex" action="" accept-charset="UTF-8" method="get"><input
name="utf8" type="hidden" value="✓" />
<input class="form-control flex-auto mr-3 linejump-input js-jump-to-line-
field" type="text" placeholder="Jump to line…" aria-label="Jump to line"
autofocus>
<button type="submit" class="btn" data-close-dialog>Go</button>
</form> </details-dialog>
</details>
</div>
<div class="modal-backdrop js-touch-events"></div>
</div>
</div>
</div>
</div>
<div class="footer container-lg px-3" role="contentinfo">

<div class="position-relative d-flex flex-justify-between pt-6 pb-2 mt-6 f6 text-
gray border-top border-gray-light ">
<ul class="list-style-none d-flex flex-wrap ">
<li class="mr-3">© 2018 <span title="0.19900s from unicorn-2371016375-
vpt5h">GitHub</span>, Inc.</li>
<li class="mr-3"><a data-ga-click="Footer, go to terms, text:terms"
href="https://github.com/site/terms">Terms</a></li>
<li class="mr-3"><a data-ga-click="Footer, go to privacy, text:privacy"
href="https://github.com/site/privacy">Privacy</a></li>
<li class="mr-3"><a href="https://help.github.com/articles/github-
security/" data-ga-click="Footer, go to security, text:security">Security</a></li>
<li class="mr-3"><a href="https://status.github.com/" data-ga-
click="Footer, go to status, text:status">Status</a></li>
<li><a data-ga-click="Footer, go to help, text:help"
href="https://help.github.com">Help</a></li>
</ul>
<a aria-label="Homepage" title="GitHub" class="footer-octicon"

href="https://github.com">
<svg height="24" class="octicon octicon-mark-github" viewBox="0 0 16 16"
version="1.1" width="24" aria-hidden="true"><path fill-rule="evenodd" d="M8 0C3.58
0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-
2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01
1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-
3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18
1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08
2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0
1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0 0 16 8c0-4.42-3.58-8-8-
8z"/></svg>
</a>
<ul class="list-style-none d-flex flex-wrap ">
<li class="mr-3"><a data-ga-click="Footer, go to contact, text:contact"
href="https://github.com/contact">Contact GitHub</a></li>
<li class="mr-3"><a href="/pricing" data-ga-click="Footer, go to Pricing,
text:Pricing">Pricing</a></li>
<li class="mr-3"><a href="https://developer.github.com" data-ga-
click="Footer, go to api, text:api">API</a></li>
<li class="mr-3"><a href="https://training.github.com" data-ga-click="Footer,
go to training, text:training">Training</a></li>
<li class="mr-3"><a href="https://blog.github.com" data-ga-click="Footer,
go to blog, text:blog">Blog</a></li>
<li><a data-ga-click="Footer, go to about, text:about"
href="https://github.com/about">About</a></li>
</ul>
</div>
<div class="d-flex flex-justify-center pb-6">
<span class="f6 text-gray-light"></span>
</div>
</div>
<div id="ajax-error-message" class="ajax-error-message flash flash-error">

<svg class="octicon octicon-alert" viewBox="0 0 16 16" version="1.1" width="16"
height="16" aria-hidden="true"><path fill-rule="evenodd" d="M8.893
1.5c-.183-.31-.52-.5-.887-.5s-.703.19-.886.5L.138 13.499a.98.98 0 0 0 0
1.001c.193.31.53.501.886.501h13.964c.367 0 .704-.19.877-.5a1.03 1.03 0 0 0 .01-
1.002L8.893 1.5zm.133 11.497H6.987v-2.003h2.039v2.003zm0-
3.004H6.987V5.987h2.039v4.006z"/></svg>
<button type="button" class="flash-close js-ajax-error-dismiss" aria-
label="Dismiss error">
<svg class="octicon octicon-x" viewBox="0 0 12 16" version="1.1" width="12"
height="16" aria-hidden="true"><path fill-rule="evenodd" d="M7.48 8l3.75 3.75-1.48
1.48L6 9.48l-3.75 3.75-1.48-1.48L4.52 8 .77 4.25l1.48-1.48L6 6.52l3.75-3.75 1.48
1.48L7.48 8z"/></svg>
</button>
You can’t perform that action at this time.
</div>
<script crossorigin="anonymous" integrity="sha512-

Swe7kfA0LYlT3FJ/ke9bPeUkLzJicE/ZxqOlslN1BTzsmekU9LCRmkEhprM8P9jyIT1PPZnHu/8tNM5k6Js
tFg==" type="application/javascript" src="https://assets-
cdn.github.com/assets/frameworks-000e724656d8b68c57faba0b6d80278a.js"></script>
<script crossorigin="anonymous" async="async" integrity="sha512-

iK04uvFyMwXxWLbY/eleTk1H7shOe5W3V3LhirjsdmqMRoFuwWN1MHovDavK+Gm5INFyv+LiG32Aeui7DZk
+/g==" type="application/javascript" src="https://assets-
cdn.github.com/assets/github-ca5c0c6b6a11f4b7ad8aa92f3a2a45d4.js"></script>
<div class="js-stale-session-flash stale-session-flash flash flash-warn flash-

banner d-none">
<svg class="octicon octicon-alert" viewBox="0 0 16 16" version="1.1" width="16"
height="16" aria-hidden="true"><path fill-rule="evenodd" d="M8.893
1.5c-.183-.31-.52-.5-.887-.5s-.703.19-.886.5L.138 13.499a.98.98 0 0 0 0
1.001c.193.31.53.501.886.501h13.964c.367 0 .704-.19.877-.5a1.03 1.03 0 0 0 .01-
1.002L8.893 1.5zm.133 11.497H6.987v-2.003h2.039v2.003zm0-
3.004H6.987V5.987h2.039v4.006z"/></svg>
<span class="signed-in-tab-flash">You signed in with another tab or window. <a
href="">Reload</a> to refresh your session.</span>
<span class="signed-out-tab-flash">You signed out in another tab or window. <a
href="">Reload</a> to refresh your session.</span>
</div>
<div class="facebox" id="facebox" style="display:none;">
<div class="facebox-popup">
<div class="facebox-content" role="dialog" aria-labelledby="facebox-header"
aria-describedby="facebox-description">
</div>
<button type="button" class="facebox-close js-facebox-close" aria-label="Close
modal">
1.48L6 9.48l-3.75 3.75-1.48-1.48L4.52 8 .77 4.25l1.48-1.48L6 6.52l3.75-3.75 1.48
1.48L7.48 8z"/></svg>
</button>
</div>
</div>
<template id="site-details-dialog">
<details class="details-reset details-overlay details-overlay-dark lh-default
text-gray-dark" open>
<summary aria-haspopup="dialog" aria-label="Close dialog"></summary>
<details-dialog class="Box Box--overlay d-flex flex-column anim-fade-in fast">
<button class="m-3 btn-octicon position-absolute right-0 top-0" type="button"
aria-label="Close dialog" data-close-dialog>
1.48L6 9.48l-3.75 3.75-1.48-1.48L4.52 8 .77 4.25l1.48-1.48L6 6.52l3.75-3.75 1.48
1.48L7.48 8z"/></svg>
</button>
<div class="octocat-spinner my-6 js-details-dialog-spinner"></div>
</details-dialog>
</details>
</template>
<div class="Popover js-hovercard-content position-absolute" style="display: none;

outline: none;" tabindex="0">
<div class="Popover-message Popover-message--bottom-left Popover-message--large
Box box-shadow-large" style="width:360px;">
</div>
</div>
<div id="hovercard-aria-description" class="sr-only">

Press h to open a hovercard with more details.
</div>
</body>
</html>

ZProtect 1.3 - 1.6 Full Decryption + Inline Patcher v1.0

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

ZProtect 1.3 - 1.6 Full Decryption + Inline Patcher v1.0

Caricato da

Copyright:

Formati disponibili

<!

<link crossorigin="anonymous" media="all" integrity="sha512-

<link crossorigin="anonymous" media="all"

<meta name="viewport" content="width=device-width">

<title>OllyDbg-Scripts/ZProtect 1.3 - 1.6 Full Decryption + Inline Patcher

<link rel="assets" href="https://assets-cdn.github.com/">

<meta name="pjax-timeout" content="1000">

<meta name="selected-link" value="repo_source" data-pjax-transient>

<meta name="octolytics-host" content="collector.githubapp.com" /><meta

<meta class="js-ga-set" name="dimension1" content="Logged Out">

<meta name="hostname" content="github.com">

<meta name="expected-hostname" content="github.com">

<meta name="html-safe-nonce" content="06d4fc8ab06c4988e10983bb9f387b4edf708a6b">

<meta http-equiv="x-pjax-version" content="60e4fa41ffbcbd51f51925bcc7ea1d9f">

<meta name="go-import" content="github.com/ThomasThelen/OllyDbg-Scripts git

<link rel="canonical" href="https://github.com/ThomasThelen/OllyDbg-

<link rel="mask-icon" href="https://assets-cdn.github.com/pinned-octocat.svg"

<meta name="theme-color" content="#1e2327">

<meta name="u2f-support" content="true">

<link rel="manifest" href="/manifest.json" crossOrigin="use-credentials">

<body class="logged-out env-production page-blob">

<div class="position-relative js-header-wrapper ">

<header class="Header header-logged-out position-relative f4 py-3" role="banner"

<div class="HeaderMenu d-flex flex-justify-between flex-auto">

<div class="Box position-absolute overflow-hidden d-none jump-to-

<div class="jump-to-suggestion-name js-jump-to-suggestion-name

<div class="border rounded-1 flex-shrink-0 bg-gray px-1 text-

<div aria-hidden="true" class="border rounded-1 flex-shrink-0

<ul id="jump-to-results" class="js-navigation-container jump-to-

<div id="start-of-content" class="show-on-focus"></div>

<div role="main" class="application-main ">

<div class="pagehead repohead instapaper_ignore readability-menu experiment-repo-

<a class="social-count js-social-count" href="/ThomasThelen/OllyDbg-

<a href="/ThomasThelen/OllyDbg-Scripts/network/members" class="social-count"

<h1 class="public ">

<nav class="reponav js-repo-nav js-sidenav-container-pjax container"

<span itemscope itemtype="http://schema.org/ListItem" itemprop="itemListElement">

<span itemscope itemtype="http://schema.org/ListItem"

<span itemscope itemtype="http://schema.org/ListItem" itemprop="itemListElement">

<a data-hotkey="g b" class="js-selected-navigation-item reponav-item" data-

<a class="js-selected-navigation-item reponav-item" data-selected-

<div class="container new-discussion-timeline experiment-repo-nav ">

<a class="d-none js-permalink-shortcut" data-hotkey="y"

<div class="signup-prompt-bg rounded-1">

<div class="select-menu branch-select-menu js-menu-container js-select-menu float-

type="button" aria-label="Switch branches or tags" aria-expanded="false" aria-

<div class="select-menu-modal-holder js-menu-content js-navigation-container"

<div class="select-menu-list select-menu-tab-bucket js-select-menu-tab-

<div data-filterable-for="context-commitish-filter-field" data-filterable-

<div class="select-menu-no-results">Nothing to show</div>

<div class="select-menu-list select-menu-tab-bucket js-select-menu-tab-

<div class="select-menu-no-results">Nothing to show</div>

<div class="BtnGroup float-right">

<a class="btn-octicon tooltipped tooltipped-nw"

<button type="button" class="btn-octicon disabled tooltipped tooltipped-nw"

<div itemprop="text" class="blob-wrapper data type-text">

<details class="details-reset details-overlay BlobToolbar position-absolute js-

<details class="details-reset details-overlay details-overlay-dark">

<div class="footer container-lg px-3" role="contentinfo">

<a aria-label="Homepage" title="GitHub" class="footer-octicon"

<div id="ajax-error-message" class="ajax-error-message flash flash-error">

<script crossorigin="anonymous" integrity="sha512-

<script crossorigin="anonymous" async="async" integrity="sha512-