008788F8 |. /74 17 |je short lol!.00878911 ; If the previous comparison was equal, go to 00878911 008788FA |. |6A 00 |push 0 ; /pThreadId = NULL ; pThreadId is declared as NULL as a parameter for CreateThread 008788FC |. |6A 00 |push 0 ; |CreationFlags = 0 ; CreationFlags is declared as 0 as a parameter for CreateThread 008788FE |. |6A 00 |push 0 ; |pThreadParm = NULL ; pThreadParam declared as NULL as a parameter for CreateThread 00878900 |. |B8 7D588700 |mov eax, lol!.0087587D ; | ; Move the data stored at 0087587D to the EAX register 00878905 |. |50 |push eax ; |ThreadFunction => lol!.0087587D ; Push the EAX register as a parameter for CreateThread 00878906 |. |6A 00 |push 0 ; |StackSize = 0 ; Declare the stack size as 0 as a parameter for CreateThread 00878908 |. |6A 00 |push 0 ; |pSecurity = NULL ; pSecurity is declared as NULL as a parameter for CreateThread 0087890A |. |2E:FF15 BC518>|call near dword ptr cs:[<&KERNEL32.CreateThread>] ; \CreateThread ; Call to CreateThread 00878911 |> \E8 2CAAFFFF |call lol!.00873342 ; Call to function at address 00873342 00878916 |. 6A 32 |push 32 ; /Timeout = 50. ms ; Push decimal value 50 as a parameter for SLEEP 00878918 |. 2E:FF15 64528>|call near dword ptr cs:[<&KERNEL32.Sleep>] ; \Sleep ; Call SLEEP function 0087891F |> BA 11748900 |mov edx, lol!.00897411 ; ASCII "@charge" ; Load the ASCII text "@charge" into the EDX register 00878924 |. E8 569FFFFF |call lol!.0087287F ; Call to function at address 0087287F 00878929 |. E8 92070100 |call lol!.008890C0 ; Call to function at address 008890C0 0087892E |. 85C0 |test eax, eax ; AND operation - modifies flags as needed 00878930 |. 75 49 |jnz short lol!.0087897B ; Jump if return value is not zero to address 0087897B 00878932 |. 803D 61C48900>|cmp byte ptr ds:[89C461], 0 ; Compare byte value 89C461 to zero 00878939 |. 75 06 |jnz short lol!.00878941 ; Jump if return value is not zero to address 00878941 0087893B |. C645 80 01 |mov byte ptr ss:[ebp-80], 1 ; Move the number 1 to 80 bytes below the stack base pointer 0087893F |. EB 04 |jmp short lol!.00878945 ; Jump to address 00878945 00878941 |> C645 80 00 |mov byte ptr ss:[ebp-80], 0 ; Move the number 0 to 80 bytes below the stack base pointer 00878945 |> 8A45 80 |mov al, byte ptr ss:[ebp-80] ; Move the byte value of EBP-80 to the register AL 00878948 |. A2 61C48900 |mov byte ptr ds:[89C461], al ; 0087894D |. 803D 61C48900>|cmp byte ptr ds:[89C461], 0 ; Compare the byte value 89C461 to 0 00878954 |. 74 17 |je short lol!.0087896D ; If the values are equal jump to address 0087896D 00878956 |. 6A 00 |push 0 ; /pThreadId = NULL ; pThreadId is declared as NULL as a parameter for CreateThread 00878958 |. 6A 00 |push 0 ; |CreationFlags = 0 ; CreationFlags is declared as 0 as a parameter for CreateThread 0087895A |. 6A 00 |push 0 ; |pThreadParm = NULL ; pThreadParam declared as NULL as a parameter for CreateThread 0087895C |. B8 FE578700 |mov eax, lol!.008757FE ; | ; Move the data stored at 008757FE to the EAX register 00878961 |. 50 |push eax ; |ThreadFunction => lol!.008757FE ; Push the EAX register as a parameter for CreateThread 00878962 |. 6A 00 |push 0 ; |StackSize = 0 ; Declare the stack size as 0 as a parameter for CreateThread 00878964 |. 6A 00 |push 0 ; |pSecurity = NULL ; pSecurity is declared as NULL as a parameter for CreateThread 00878966 |. 2E:FF15 BC518>|call near dword ptr cs:[<&KERNEL32.CreateThread>] ; \CreateThread ; Call to CreateThread 0087896D |> E8 D0A9FFFF |call lol!.00873342 ; Call to function at address 00873342 00878972 |. 6A 32 |push 32 ; /Timeout = 50. ms ; Push decimal value 50 as a parameter for SLEEP 00878974 |. 2E:FF15 64528>|call near dword ptr cs:[<&KERNEL32.Sleep>] ; \Sleep ; Call to SLEEP 0087897B |> BA 19748900 |mov edx, lol!.00897419 ; ASCII "@godmode" ; Move ASCII text "@godmode" into EDX register
'Hacking' 카테고리의 다른 글
| Hacking with Javascript 2005.FEB. (0) | 2009.06.09 |
|---|---|
| How to find Addresses in Gunz (0) | 2009.06.09 |
| How to Hack a Yahoo Mail Password (0) | 2009.05.26 |
| Debugging (0) | 2009.05.23 |
| Basic 80x86 Architecture (0) | 2009.05.23 |
