0040E000 > BE DFCC4000 MOV ESI,sckTool.0040CCDF ;this is entire code added
0040E005 83C6 01 ADD ESI,1
0040E008 FFE6 JMP ESI ;esi = 40CCE0
0040CCE0 60 PUSHAD ;start of regular upx stub (not encrypted)
0040CCE1 BE 00A04000 MOV ESI,sckTool.0040A000
0040CCE6 8DBE 0070FFFF LEA EDI,DWORD PTR DS:[ESI+FFFF7000]
0040CCEC 57 PUSH EDI
0040CCED 83CD FF OR EBP,FFFFFFFF
0040CCF0 EB 10 JMP SHORT sckTool.0040CD02
0040CCF2 90 NOP
0040CCF3 90 NOP
0040CCF4 90 NOP
0040CCF5 90 NOP
0040CCF6 90 NOP
0040CCF7 90 NOP
|