peunlck.asm

一个汇编程序 不过什么忘了

comment %
哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪
                                   PEUNLOCK-NT
            decrypter for PELOCK-NT (all version known) by mARQUIS [uCF]
                         coded by xOANINO [UCF] (c) 1999
 
               (version supported are : v2.01, v2.02b, v2.03, v2.04)
 
 if someone have other versions or if this decrypter should not work for any
 reason (ie: decrypt wrong) please mail me at [e-mail] and i'll try
 to fix it.

          Cmon Marq, kick our ass again with another kewl pecrypter now !
      (and come on IRC to say hello to your UCF buddies sometimes... ehehe!)
哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪
%

.386P
Locals
Jumps

.model Flat, StdCall

Extrn           ExitProcess	: PROC
Extrn           CreateFileA	: PROC                
Extrn           GetFileSize     : PROC                
Extrn		SetFilePointer	: PROC
Extrn           SetEndOfFile    : PROC
Extrn		CloseHandle	: PROC
Extrn		ReadFile	: PROC
Extrn		WriteFile	: PROC
Extrn		GetCommandLineA : PROC
Extrn           MessageBeep     : PROC
Extrn           VirtualAlloc    : PROC
Extrn           VirtualFree     : PROC

.data

;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪
        filenamesize    dd 0
        filesize        dd 0
        filehandle      dd 0
        toread          dd 0
        headeroffset    dd 0
        lastobjoffset   dd 0
        lastobjsize     dd 0
        lastobjvirtsize dd 0
        PELOCKdirectoryoffset dd 0
        version         db 0
;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪
        decrsections    db 0
        decrlayer       db 0
        layers          db 0
        magicbyte       db 0
        magickey        dd 0
        EIP             dd 0
        objsize         dd 0
        objrva          dd 0
        objoffset       dd 0
        imgbase         dd 0
        importsize      dd 0
        importRVA       dd 0
        baserelocsize   dd 0
        baserelocRVA    dd 0
        objdisplacement dd 0
        objnum          dd 0

; the below values contains RVAs and sizes of IT, IAT, RSRC and TLS .
; these parts must be handled different during decryption (must be skipped)

        value1a         dd 0
        value1b         dd 0
        value2a         dd 0
        value2b         dd 0
        value3a         dd 0
        value3b         dd 0
        value4a         dd 0
        value4b         dd 0
;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪

;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪
        filename        db 128 dup (0)
        buffer          dd 0
        PELOCKbuf       db 4000h dup (0)
;哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪

        logo            db 0dh,0ah
                        db "PEUNLOCK-NT 鷄LL VERSIONS!