3838
3939 pushx rsi , rdi , rbx , rbp
4040 sub rsp , 28h
41- jmp load_cmd
42- init_cmd:
43- pop r10
4441 push TEB.ProcessEnvironmentBlock
4542 pop r11
4643 mov rax , [ gs : r11 ]
@@ -65,31 +62,32 @@ scan_dll:
6562 lea rsi , [ rbx + rcx + IMAGE_EXPORT_DIRECTORY.NumberOfNames ]
6663 lodsd
6764 xchg eax , ecx
68- jecxz next_dll ; skip if no names
65+ jecxz next_dll ; skip if no names
6966 ; rdx = IMAGE_EXPORT_DIRECTORY.AddressOfFunctions
7067 lodsd
7168 xchg eax , edx
72- add rdx , rbx ; rax = RVA2VA(rdx, rbx)
69+ add rdx , rbx ; rax = RVA2VA(rdx, rbx)
7370 ; rbp = IMAGE_EXPORT_DIRECTORY.AddressOfNames
7471 lodsd
7572 xchg eax , ebp
76- add rbp , rbx ; rbp = RVA2VA(rbp, rbx)
73+ add rbp , rbx ; rbp = RVA2VA(rbp, rbx)
7774 ; rax = IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals
7875 lodsd
7976 xchg eax , esi
80- add rsi , rbx ; rsi = RVA(rax, rbx)
77+ add rsi , rbx ; rsi = RVA(rax, rbx)
8178find_api:
82- mov eax , [ rbp + rcx * 4 - 4 ] ; eax = RVA of API string
79+ mov eax , [ rbp + rcx * 4 - 4 ] ; eax = RVA of API string
8380 cmp dword [ rax + rbx ], 'WinE'
84- loopne find_api ; --ecx && Load not found
81+ loopne find_api ; --ecx && Load not found
8582 jnz next_dll
86- movzx eax , word [ rsi + rcx * 2 ] ; eax = AddressOfNameOrdinals[eax]
87- mov ecx , [ rdx + rax * 4 ] ; ecx = base + AddressOfFunctions[eax]
83+ movzx eax , word [ rsi + rcx * 2 ] ; eax = AddressOfNameOrdinals[eax]
84+ mov ecx , [ rdx + rax * 4 ] ; ecx = base + AddressOfFunctions[eax]
8885 add rbx , rcx
89- push r10
90- pop rcx
9186 push SW_SHOWNORMAL
9287 pop rdx
88+ jmp load_cmd
89+ init_cmd:
90+ pop rcx
9391 call rbx
9492exit_load:
9593 add rsp , 28h
0 commit comments