Details | Last modification | View Log | RSS feed
Rev | Author | Line No. | Line |
---|---|---|---|
2783 | clevermous | 1 | format PE GUI 4.0 |
2 | section '.text' code readable executable |
||
3 | entry start |
||
4 | start: |
||
5 | xor ebx, ebx |
||
6 | push ofn |
||
7 | call [GetOpenFileNameA] |
||
8 | test eax, eax |
||
9 | jnz @f |
||
10 | push ebx |
||
11 | call [ExitProcess] |
||
12 | @@: |
||
13 | call [GetVersion] |
||
14 | test eax, eax |
||
15 | sets [b9x] |
||
16 | js install_9x |
||
17 | mov [img_name+2], bl |
||
18 | push ebx |
||
19 | push ebx |
||
20 | push 3 |
||
21 | push ebx |
||
22 | push 3 |
||
23 | push 80000000h |
||
24 | push dn |
||
25 | call [CreateFileA] |
||
26 | inc eax |
||
27 | jnz @f |
||
28 | norights: |
||
29 | push 10h |
||
30 | push ebx |
||
31 | push norightsmsg |
||
32 | mbx: |
||
33 | push ebx |
||
34 | call [MessageBoxA] |
||
35 | push ebx |
||
36 | call [ExitProcess] |
||
37 | @@: |
||
38 | lea esi, [eax-1] |
||
39 | push ebx |
||
40 | push tmp |
||
41 | push 12 |
||
42 | push sdn |
||
43 | push ebx |
||
44 | push ebx |
||
45 | push 0x2D1080 |
||
46 | push esi |
||
47 | call [DeviceIoControl] |
||
48 | test eax, eax |
||
49 | jnz @f |
||
50 | cnr: |
||
51 | push esi |
||
52 | call [CloseHandle] |
||
53 | jmp norights |
||
54 | @@: |
||
55 | push ebx |
||
56 | push tmp |
||
57 | push 20h |
||
58 | push pi |
||
59 | push ebx |
||
60 | push ebx |
||
61 | push 0x74004 |
||
62 | push esi |
||
63 | call [DeviceIoControl] |
||
64 | test eax, eax |
||
65 | jz cnr |
||
66 | push esi |
||
67 | call [CloseHandle] |
||
68 | cmp [sdn], 7 |
||
69 | jz @f |
||
70 | push 10h |
||
71 | push 0 |
||
72 | push nohd |
||
73 | jmp mbx |
||
74 | @@: |
||
75 | mov al, byte [sdn+4] |
||
76 | or al, 80h |
||
77 | mov [mtldr_code+7], al |
||
78 | mov eax, [pi] |
||
79 | mov edx, [pi+4] |
||
80 | shrd eax, edx, 9 |
||
81 | shr edx, 9 |
||
82 | jz @f |
||
83 | m1e: push 10h |
||
84 | push ebx |
||
85 | push m1 |
||
86 | jmp mbx |
||
87 | @@: |
||
88 | install_cmn: |
||
89 | mov [mtldr_code+8], eax |
||
90 | mov esi, img_name |
||
91 | mov edi, img_real_name |
||
92 | mov byte [esi+2], '\' |
||
93 | push 256 |
||
94 | push edi |
||
95 | push esi |
||
96 | call [GetShortPathNameA] |
||
97 | cmp eax, 256 |
||
98 | jb @f |
||
99 | push 10h |
||
100 | push ebx |
||
101 | push ptl |
||
102 | jmp mbx |
||
103 | @@: |
||
104 | test eax, eax |
||
105 | jnz @f |
||
106 | push esi edi |
||
107 | mov ecx, 256/4 |
||
108 | rep movsd |
||
109 | pop edi esi |
||
110 | @@: |
||
111 | cmp byte [edi], 0 |
||
112 | jz lcd |
||
113 | cmp byte [edi], 'A' |
||
114 | jb lcc |
||
115 | cmp byte [edi], 'Z' |
||
116 | ja lcc |
||
117 | add byte [edi], 20h |
||
118 | lcc: |
||
119 | inc edi |
||
120 | jmp @b |
||
121 | lcd: |
||
122 | mov esi, img_real_name |
||
123 | cmp [b9x], 0 |
||
124 | jnz @f |
||
125 | cmp byte [esi], 'c' |
||
126 | jnz notc |
||
127 | @@: |
||
128 | push 256/4 |
||
129 | pop ecx |
||
130 | lea edi, [esi+ecx*4] |
||
131 | rep movsd |
||
132 | mov edi, esi |
||
133 | xor eax, eax |
||
134 | or ecx, -1 |
||
135 | repnz scasb |
||
136 | dec edi |
||
137 | std |
||
138 | mov al, '\' |
||
139 | repnz scasb |
||
140 | cld |
||
141 | inc edi |
||
142 | inc edi |
||
143 | mov eax, 'mtld' |
||
144 | stosd |
||
145 | mov al, 'r' |
||
146 | stosb |
||
147 | jmp cmn |
||
148 | notc: |
||
149 | mov dword [mtldr_name], 'C:\m' |
||
150 | mov dword [mtldr_name+4], 'tldr' |
||
151 | mov edi, mtldr_name+8 |
||
152 | cmn: |
||
153 | and word [edi], 0 |
||
154 | mf: |
||
155 | push mtldr_name |
||
156 | call [GetFileAttributesA] |
||
157 | inc eax |
||
158 | jnz @f |
||
159 | call [GetLastError] |
||
160 | cmp eax, 2 |
||
161 | jz fo |
||
162 | @@: |
||
163 | cmp byte [edi], 0 |
||
164 | jnz @f |
||
165 | mov byte [edi], '0' |
||
166 | jmp mf |
||
167 | @@: |
||
168 | cmp byte [edi], '9' |
||
169 | jae @f |
||
170 | mfi: |
||
171 | inc byte [edi] |
||
172 | jmp mf |
||
173 | @@: |
||
174 | ja @f |
||
175 | mov byte [edi], 'A' |
||
176 | jmp mf |
||
177 | @@: |
||
178 | cmp byte [edi], 'Z' |
||
179 | jb mfi |
||
180 | nomx: push 10h |
||
181 | push ebx |
||
182 | push nom |
||
183 | jmp mbx |
||
184 | fo: |
||
185 | cmp [b9x], 0 |
||
186 | jnz install_9x_2 |
||
187 | call write_mtldr1 |
||
188 | push ecx |
||
189 | call [GetVersion] |
||
190 | pop ecx |
||
191 | cmp al, 6 |
||
192 | jae install_vista |
||
193 | mov al, 2 |
||
194 | mov edi, tmp_data |
||
195 | neg ecx |
||
196 | add ecx, 2000h - mtldr_code_size |
||
197 | push ebx |
||
198 | push tmp |
||
199 | push ecx |
||
200 | push edi |
||
201 | push esi |
||
202 | rep stosb |
||
203 | call [WriteFile] |
||
204 | push esi |
||
205 | call [CloseHandle] |
||
206 | push bootini |
||
207 | mov edi, systitle+1 |
||
208 | mov esi, ostitle |
||
209 | mov byte [edi-1], '"' |
||
210 | @@: |
||
211 | lodsb |
||
212 | test al, al |
||
213 | jz @f |
||
214 | stosb |
||
215 | jmp @b |
||
216 | @@: |
||
217 | mov word [edi], '"' |
||
218 | push bootini |
||
219 | call [GetFileAttributesA] |
||
220 | push eax |
||
221 | and al, not 1 |
||
222 | push eax |
||
223 | push bootini |
||
224 | call [SetFileAttributesA] |
||
225 | push bootini |
||
226 | push systitle |
||
227 | push mtldr_name |
||
228 | push mtldr_name |
||
229 | push mtldr_name |
||
230 | call [CharToOemA] |
||
231 | push osstr |
||
232 | call [WritePrivateProfileStringA] |
||
233 | xchg eax, [esp] |
||
234 | push eax |
||
235 | push bootini |
||
236 | call [SetFileAttributesA] |
||
237 | pop eax |
||
238 | test eax, eax |
||
239 | jnz suci |
||
240 | ; failed, delete written mtldr |
||
241 | call delete_mtldr |
||
242 | push 10h |
||
243 | push ebx |
||
244 | push insterr |
||
245 | jmp mbx |
||
246 | suci: |
||
247 | push 40h |
||
248 | push suct |
||
249 | push succ |
||
250 | jmp mbx |
||
251 | |||
252 | install_9x: |
||
253 | mov al, [img_name] |
||
254 | or al, 20h |
||
255 | sub al, 'a'-1 |
||
256 | mov byte [regs], al |
||
257 | push ebx |
||
258 | push ebx |
||
259 | push 3 |
||
260 | push ebx |
||
261 | push 3 |
||
262 | push 80000000h |
||
263 | push vwin32 |
||
264 | call [CreateFileA] |
||
265 | inc eax |
||
266 | jz norights |
||
267 | dec eax |
||
268 | xchg eax, esi |
||
269 | push ebx |
||
270 | push tmp |
||
271 | push 28 |
||
272 | push regs |
||
273 | push 28 |
||
274 | push regs |
||
275 | push 1 |
||
276 | push esi |
||
277 | call [DeviceIoControl] |
||
278 | push eax |
||
279 | push esi |
||
280 | call [CloseHandle] |
||
281 | pop eax |
||
282 | test eax, eax |
||
283 | @@: jz norights |
||
284 | mov al, [diskinfobuf+3] |
||
285 | cmp al, 0xFF |
||
286 | jz @b |
||
287 | cmp al, 80h |
||
288 | jb norights |
||
289 | mov [mtldr_code+7], al |
||
290 | cmp dword [diskinfobuf+12], 0 |
||
291 | jnz m1e |
||
292 | mov eax, [diskinfobuf+8] |
||
293 | jmp install_cmn |
||
294 | |||
295 | install_9x_2: |
||
296 | push ebx |
||
297 | push ebx |
||
298 | push 3 |
||
299 | push ebx |
||
300 | push 1 |
||
301 | push 80000000h |
||
302 | push config |
||
303 | call [CreateFileA] |
||
304 | inc eax |
||
305 | jnz @f |
||
306 | ie2: |
||
307 | push 10h |
||
308 | push ebx |
||
309 | push insterr2 |
||
310 | jmp mbx |
||
311 | @@: |
||
312 | dec eax |
||
313 | xchg eax, esi |
||
314 | push ebx |
||
315 | push esi |
||
316 | call [GetFileSize] |
||
317 | inc eax |
||
318 | jz ie2 |
||
319 | dec eax |
||
320 | xchg eax, ebp |
||
321 | push 4 |
||
322 | push 1000h |
||
323 | push ebp |
||
324 | push ebx |
||
325 | call [VirtualAlloc] |
||
326 | xchg eax, edi |
||
327 | test edi, edi |
||
328 | jz ie2 |
||
329 | push ebx |
||
330 | push tmp |
||
331 | push ebp |
||
332 | push edi |
||
333 | push esi |
||
334 | call [ReadFile] |
||
335 | push esi |
||
336 | call [CloseHandle] |
||
337 | push ebx |
||
338 | push 80h |
||
339 | push 2 |
||
340 | push ebx |
||
341 | push ebx |
||
342 | push 40000000h |
||
343 | push config |
||
344 | call [CreateFileA] |
||
345 | inc eax |
||
346 | jz ie2 |
||
347 | dec eax |
||
348 | xchg eax, esi |
||
349 | mov eax, dword [edi] |
||
350 | or eax, 0x20202000 |
||
351 | cmp eax, '[men' |
||
352 | jz menu |
||
353 | push ostitle |
||
354 | call [lstrlenA] |
||
355 | cmp eax, 17 |
||
356 | ja bt1 |
||
357 | push esi edi |
||
358 | mov esi, ostitle |
||
359 | mov edi, mtldr_code+23Ah |
||
360 | mov ecx, eax |
||
361 | rep movsb |
||
362 | mov dword [edi], '? [y' |
||
363 | mov dword [edi+4], '/n]:' |
||
364 | mov word [edi+8], ' ' |
||
365 | pop edi esi |
||
366 | jmp ct1 |
||
367 | bt1: |
||
368 | push img_real_name+3 |
||
369 | call [lstrlenA] |
||
370 | add eax, mtldr_code_size+1+100h |
||
371 | mov word [mtldr_code+0x19], ax |
||
372 | ct1: |
||
373 | push ebx |
||
374 | push tmp |
||
375 | push 8 |
||
376 | push install |
||
377 | push esi |
||
378 | call [WriteFile] |
||
379 | cfgd: |
||
380 | mov eax, mtldr_name |
||
381 | push eax |
||
382 | push eax |
||
383 | push eax |
||
384 | call [CharToOemA] |
||
385 | call [lstrlenA] |
||
386 | push ebx |
||
387 | push tmp |
||
388 | push eax |
||
389 | push mtldr_name |
||
390 | push esi |
||
391 | call [WriteFile] |
||
392 | push ebx |
||
393 | push tmp |
||
394 | push 2 |
||
395 | push newline |
||
396 | push esi |
||
397 | call [WriteFile] |
||
398 | push ebx |
||
399 | push tmp |
||
400 | push ebp |
||
401 | push edi |
||
402 | push esi |
||
403 | call [WriteFile] |
||
404 | push esi |
||
405 | call [CloseHandle] |
||
406 | call write_mtldr1 |
||
407 | push ostitle |
||
408 | call [lstrlenA] |
||
409 | cmp eax, 11 |
||
410 | jbe @f |
||
411 | push ebx |
||
412 | push tmp |
||
413 | push ld2sz |
||
414 | push ld2 |
||
415 | push esi |
||
416 | push ebx |
||
417 | push tmp |
||
418 | push eax |
||
419 | push ostitle |
||
420 | push esi |
||
421 | push ebx |
||
422 | push tmp |
||
423 | push ld1sz |
||
424 | push ld1 |
||
425 | push esi |
||
426 | call [WriteFile] |
||
427 | call [WriteFile] |
||
428 | call [WriteFile] |
||
429 | @@: |
||
430 | push esi |
||
431 | call [CloseHandle] |
||
432 | jmp suci |
||
433 | menu: |
||
434 | push edi |
||
435 | or ecx, -1 |
||
436 | mes: |
||
437 | mov al, 0xA |
||
438 | repnz scasb |
||
439 | cmp byte [edi], '[' |
||
440 | jz med |
||
441 | cmp dword [edi], 'menu' |
||
442 | jnz mes |
||
443 | cmp dword [edi+4], 'item' |
||
444 | jnz mes |
||
445 | cmp byte [edi+8], '=' |
||
446 | jnz mes |
||
447 | mov eax, [edi+9] |
||
448 | or eax, ' ' |
||
449 | cmp eax, 'koli' |
||
450 | jnz mes |
||
451 | mov eax, [edi+13] |
||
452 | and eax, 0xFFFFFF |
||
453 | or eax, ' ' |
||
454 | cmp eax, 'bri' |
||
455 | jnz mes |
||
456 | movzx eax, byte [edi+16] |
||
457 | or al, 0x20 |
||
458 | mov [menuitems+eax], 1 |
||
459 | jmp mes |
||
460 | med: |
||
461 | cmp word [edi-4], 0x0A0D |
||
462 | jnz @f |
||
463 | dec edi |
||
464 | dec edi |
||
465 | jmp med |
||
466 | @@: |
||
467 | sub edi, [esp] |
||
468 | push ebx |
||
469 | push tmp |
||
470 | push edi |
||
471 | push dword [esp+12] |
||
472 | push esi |
||
473 | call [WriteFile] |
||
474 | add [esp], edi |
||
475 | sub ebp, edi |
||
476 | mov ecx, 7 |
||
477 | cmp [menuitems+0x20], 0 |
||
478 | jnz @f |
||
479 | cmp [menuitems+','], 0 |
||
480 | jz mef |
||
481 | @@: |
||
482 | mov eax, '0' |
||
483 | mel1: |
||
484 | cmp [menuitems+eax], 0 |
||
485 | jz med1 |
||
486 | inc eax |
||
487 | cmp al, '9'+1 |
||
488 | jb mel1 |
||
489 | jnz @f |
||
490 | mov al, 'a' |
||
491 | jmp mel1 |
||
492 | @@: |
||
493 | cmp al, 'z' |
||
494 | jbe mel1 |
||
495 | push ebx |
||
496 | push tmp |
||
497 | push ebp |
||
498 | push dword [esp+12] |
||
499 | push esi |
||
500 | call [WriteFile] |
||
501 | push esi |
||
502 | call [CloseHandle] |
||
503 | jmp nomx |
||
504 | med1: |
||
505 | mov [menuitem+7], al |
||
506 | mov ecx, 8 |
||
507 | mef: |
||
508 | push ebx |
||
509 | push tmp |
||
510 | push ecx |
||
511 | push menuitem |
||
512 | push esi |
||
513 | push ebx |
||
514 | push tmp |
||
515 | push ecx |
||
516 | push menuitem |
||
517 | push esi |
||
518 | push ebx |
||
519 | push tmp |
||
520 | push 9 |
||
521 | push mis |
||
522 | push esi |
||
523 | call [WriteFile] |
||
524 | call [WriteFile] |
||
525 | push ebx |
||
526 | push tmp |
||
527 | push title9xsz |
||
528 | push title9x |
||
529 | push esi |
||
530 | call [WriteFile] |
||
531 | push ebx |
||
532 | push tmp |
||
533 | push ostitle |
||
534 | call [lstrlenA] |
||
535 | push eax |
||
536 | push ostitle |
||
537 | push esi |
||
538 | call [WriteFile] |
||
539 | push ebx |
||
540 | push tmp |
||
541 | push title9x2sz |
||
542 | push title9x2 |
||
543 | push esi |
||
544 | call [WriteFile] |
||
545 | call [WriteFile] |
||
546 | push ebx |
||
547 | push tmp |
||
548 | push 11 |
||
549 | push sec9x2 |
||
550 | push esi |
||
551 | call [WriteFile] |
||
552 | mov byte [mtldr_code+1], 37h |
||
553 | pop edi |
||
554 | jmp cfgd |
||
555 | |||
556 | install_vista: |
||
557 | push esi |
||
558 | call [CloseHandle] |
||
559 | mov edi, sbn |
||
560 | call adjust_privilege |
||
561 | mov edi, srn |
||
562 | call adjust_privilege |
||
563 | push ebx |
||
564 | push ebx |
||
565 | call [CoInitializeEx] |
||
566 | test eax, eax |
||
567 | js we |
||
568 | push ebx |
||
569 | push ebx |
||
570 | push ebx |
||
571 | push 3 |
||
572 | push ebx |
||
573 | push ebx |
||
574 | push ebx |
||
575 | push -1 |
||
576 | push ebx |
||
577 | call [CoInitializeSecurity] |
||
578 | test eax, eax |
||
579 | jns @f |
||
580 | we2: |
||
581 | call [CoUninitialize] |
||
582 | we: |
||
583 | call delete_mtldr |
||
584 | push 10h |
||
585 | push ebx |
||
586 | push wmierr |
||
587 | jmp mbx |
||
588 | @@: |
||
589 | push ebx |
||
590 | push esp |
||
591 | push IID_IWbemLocator |
||
592 | push 1 |
||
593 | push ebx |
||
594 | push CLSID_WbemLocator |
||
595 | call [CoCreateInstance] |
||
596 | pop edi |
||
597 | test eax, eax |
||
598 | js we2 |
||
599 | push ebx |
||
600 | push esp |
||
601 | push ebx |
||
602 | push ebx |
||
603 | push ebx |
||
604 | push ebx |
||
605 | push ebx |
||
606 | push ebx |
||
607 | push ns |
||
608 | push edi |
||
609 | mov esi, [edi] |
||
610 | call dword [esi+12] |
||
611 | push eax |
||
612 | push edi |
||
613 | call dword [esi+8] |
||
614 | pop eax |
||
615 | pop edi |
||
616 | test eax, eax |
||
617 | js we2 |
||
618 | push ebx |
||
619 | push ebx |
||
620 | push 3 |
||
621 | push 3 |
||
622 | push ebx |
||
623 | push ebx |
||
624 | push 10 |
||
625 | push edi |
||
626 | call [CoSetProxyBlanket] |
||
627 | test eax, eax |
||
628 | jns @f |
||
629 | we3: |
||
630 | mov eax, [edi] |
||
631 | push edi |
||
632 | call dword [eax+8] |
||
633 | jmp we2 |
||
634 | @@: |
||
635 | xor esi, esi |
||
636 | push osp |
||
637 | push osn |
||
638 | push bs |
||
639 | call call_method |
||
640 | test eax, eax |
||
641 | js we3 |
||
642 | mov esi, guid |
||
643 | mov ebp, menuitems |
||
644 | push esi |
||
645 | call [CoCreateGuid] |
||
646 | push 2000h/2 |
||
647 | push ebp |
||
648 | push esi |
||
649 | call [StringFromGUID2] |
||
650 | mov esi, [varout+8] |
||
651 | push con |
||
652 | push bs |
||
653 | call call_method |
||
654 | jns @f |
||
655 | wecei: |
||
656 | mov ebp, coerr |
||
657 | wece: |
||
658 | mov eax, [esi] |
||
659 | push esi |
||
660 | call dword [eax+8] |
||
661 | mov eax, [edi] |
||
662 | push edi |
||
663 | call dword [eax+8] |
||
664 | call [CoUninitialize] |
||
665 | call delete_mtldr |
||
666 | push 10h |
||
667 | push ebx |
||
668 | push ebp |
||
669 | jmp mbx |
||
670 | @@: |
||
671 | pop eax |
||
672 | push esi |
||
673 | push eax |
||
674 | mov ebp, tmp_data |
||
675 | mov dword [vartmpstr+8], ebp |
||
676 | mov dword [vari32+8], 0x12000004 |
||
677 | push 2000h/2 |
||
678 | push ebp |
||
679 | push -1 |
||
680 | push ostitle |
||
681 | push ebx |
||
682 | push ebx |
||
683 | call [MultiByteToWideChar] |
||
684 | mov esi, [varout+8] |
||
685 | push ssen |
||
686 | push bo |
||
687 | call call_method |
||
688 | mov ebp, setproperr |
||
689 | js wece2 |
||
690 | sub dword [esp], 24 |
||
691 | mov byte [vari32+8], 2 |
||
692 | push 2000h/2 |
||
693 | push tmp_data |
||
694 | push -1 |
||
695 | push mtldr_name+2 |
||
696 | push ebx |
||
697 | push ebx |
||
698 | call [MultiByteToWideChar] |
||
699 | push ssen |
||
700 | push bo |
||
701 | call call_method |
||
702 | js wece2 |
||
703 | mov dword [vari32+8], 0x11000001 |
||
704 | mov ecx, tmp_data |
||
705 | mov dword [ecx], '\' + ('?' shl 16) |
||
706 | mov dword [ecx+4], '?' + ('\' shl 16) |
||
707 | xor eax, eax |
||
708 | mov dword [ecx+12], eax |
||
709 | mov al, [mtldr_name+1] |
||
710 | shl eax, 16 |
||
711 | mov al, [mtldr_name] |
||
712 | mov dword [ecx+8], eax |
||
713 | push spden |
||
714 | push bo |
||
715 | call call_method |
||
716 | js wece2 |
||
717 | mov eax, [esi] |
||
718 | push esi |
||
719 | call dword [eax+8] |
||
720 | pop eax |
||
721 | pop esi |
||
722 | push eax |
||
723 | push oon |
||
724 | push bs |
||
725 | call call_method |
||
726 | mov ebp, orerr |
||
727 | js wece3 |
||
728 | pop eax |
||
729 | push esi |
||
730 | push eax |
||
731 | mov esi, [varout+8] |
||
732 | mov dword [vari32+8], 0x24000001 |
||
733 | push gen |
||
734 | push bo |
||
735 | call call_method |
||
736 | js wece2 |
||
737 | push esi |
||
738 | mov esi, [varout+8] |
||
739 | push ebx |
||
740 | push ebx |
||
741 | push varout |
||
742 | push ebx |
||
743 | push idsn |
||
744 | mov eax, [esi] |
||
745 | push esi |
||
746 | call dword [eax+16] |
||
747 | push eax |
||
748 | mov eax, [esi] |
||
749 | push esi |
||
750 | call dword [eax+8] |
||
751 | pop eax |
||
752 | pop esi |
||
753 | test eax, eax |
||
754 | js wece2 |
||
755 | push esi |
||
756 | cmp word [varout], 2008h |
||
757 | jnz wece4 |
||
758 | mov esi, [varout+8] |
||
759 | cmp word [esi], 1 |
||
760 | jnz wece4 |
||
761 | push dword [esi+20] |
||
762 | mov eax, [esi+16] |
||
763 | inc eax |
||
764 | push eax |
||
765 | push esp |
||
766 | push esi |
||
767 | call [SafeArrayRedim] |
||
768 | pop ecx |
||
769 | pop ecx |
||
770 | test eax, eax |
||
771 | js wece4 |
||
772 | push menuitems |
||
773 | call [SysAllocString] |
||
774 | test eax, eax |
||
775 | jz wece4 |
||
776 | push eax |
||
777 | mov ecx, [esi+16] |
||
778 | add ecx, [esi+20] |
||
779 | dec ecx |
||
780 | push ecx |
||
781 | mov ecx, esp |
||
782 | push eax |
||
783 | push ecx |
||
784 | push esi |
||
785 | call [SafeArrayPutElement] |
||
786 | pop ecx |
||
787 | call [SysFreeString] |
||
788 | pop esi |
||
789 | push solen |
||
790 | push bo |
||
791 | call call_method |
||
792 | js wece2 |
||
793 | push varout |
||
794 | call [VariantClear] |
||
795 | mov eax, [esi] |
||
796 | push esi |
||
797 | call dword [eax+8] |
||
798 | pop eax |
||
799 | pop esi |
||
800 | mov eax, [esi] |
||
801 | push esi |
||
802 | call dword [eax+8] |
||
803 | mov eax, [edi] |
||
804 | push edi |
||
805 | call dword [eax+8] |
||
806 | call [CoUninitialize] |
||
807 | jmp suci |
||
808 | wece4: |
||
809 | pop esi |
||
810 | wece2: |
||
811 | mov eax, [esi] |
||
812 | push esi |
||
813 | call dword [eax+8] |
||
814 | pop eax |
||
815 | pop esi |
||
816 | push eax |
||
817 | wece3: |
||
818 | mov dword [vartmpstr+8], menuitems |
||
819 | pop eax |
||
820 | push dop |
||
821 | push don |
||
822 | push bs |
||
823 | call call_method |
||
824 | pop eax |
||
825 | jmp wece |
||
826 | |||
827 | write_mtldr1: |
||
828 | push ebx |
||
829 | push 80h |
||
830 | push 2 |
||
831 | push ebx |
||
832 | push ebx |
||
833 | push 40000000h |
||
834 | push mtldr_name |
||
835 | call [CreateFileA] |
||
836 | inc eax |
||
837 | jnz @f |
||
838 | push 10h |
||
839 | push ebx |
||
840 | push noc |
||
841 | jmp mbx |
||
842 | @@: |
||
843 | dec eax |
||
844 | xchg eax, esi |
||
845 | push ebx |
||
846 | push tmp |
||
847 | push mtldr_code_size |
||
848 | push mtldr_code |
||
849 | push esi |
||
850 | call [WriteFile] |
||
851 | push img_real_name |
||
852 | push img_real_name |
||
853 | call [CharToOemA] |
||
854 | mov edi, img_real_name+3 |
||
855 | push edi |
||
856 | call [lstrlenA] |
||
857 | inc eax |
||
858 | push eax |
||
859 | push ebx |
||
860 | push tmp |
||
861 | push eax |
||
862 | push edi |
||
863 | push esi |
||
864 | call [WriteFile] |
||
865 | pop ecx |
||
866 | ret |
||
867 | delete_mtldr: |
||
868 | push mtldr_name |
||
869 | push mtldr_name |
||
870 | push mtldr_name |
||
871 | call [OemToCharA] |
||
872 | call [DeleteFileA] |
||
873 | ret |
||
874 | |||
875 | adjust_privilege: |
||
876 | cmp [advapi32], 0 |
||
877 | jnz @f |
||
878 | push advapi32_name |
||
879 | call [LoadLibraryA] |
||
880 | mov [advapi32], eax |
||
881 | mov esi, eax |
||
882 | test esi, esi |
||
883 | jz ape |
||
884 | push opts |
||
885 | push esi |
||
886 | call [GetProcAddress] |
||
887 | mov [OpenProcessToken], eax |
||
888 | test eax, eax |
||
889 | jz ape |
||
890 | push lpvs |
||
891 | push esi |
||
892 | call [GetProcAddress] |
||
893 | mov [LookupPrivilegeValueA], eax |
||
894 | test eax, eax |
||
895 | jz ape |
||
896 | push atps |
||
897 | push esi |
||
898 | call [GetProcAddress] |
||
899 | mov [AdjustTokenPrivileges], eax |
||
900 | test eax, eax |
||
901 | jz ape |
||
902 | @@: |
||
903 | push ebx |
||
904 | push esp |
||
905 | push 28h |
||
906 | call [GetCurrentProcess] |
||
907 | push eax |
||
908 | call [OpenProcessToken] |
||
909 | test eax, eax |
||
910 | pop esi |
||
911 | jz ape |
||
912 | push 2 |
||
913 | push ebx |
||
914 | push ebx |
||
915 | mov eax, esp |
||
916 | push 1 |
||
917 | push eax |
||
918 | push edi |
||
919 | push ebx |
||
920 | call [LookupPrivilegeValueA] |
||
921 | test eax, eax |
||
922 | jz ape2 |
||
923 | mov eax, esp |
||
924 | push ebx |
||
925 | push ebx |
||
926 | push ebx |
||
927 | push eax |
||
928 | push ebx |
||
929 | push esi |
||
930 | call [AdjustTokenPrivileges] |
||
931 | test eax, eax |
||
932 | jz ape2 |
||
933 | add esp, 10h |
||
934 | push esi |
||
935 | call [CloseHandle] |
||
936 | ret |
||
937 | ape2: |
||
938 | add esp, 10h |
||
939 | push esi |
||
940 | call [CloseHandle] |
||
941 | ape: |
||
942 | push 10h |
||
943 | push ebx |
||
944 | push apf |
||
945 | jmp mbx |
||
946 | |||
947 | call_method: |
||
948 | push ebx |
||
949 | mov eax, esp |
||
950 | push ebx |
||
951 | push eax |
||
952 | push ebx |
||
953 | push ebx |
||
954 | push dword [eax+8] |
||
955 | mov eax, [edi] |
||
956 | push edi |
||
957 | call dword [eax+24] |
||
958 | xchg edi, [esp] |
||
959 | test eax, eax |
||
960 | js r |
||
961 | push ebx |
||
962 | mov eax, esp |
||
963 | push ebx |
||
964 | push eax |
||
965 | push ebx |
||
966 | push dword [eax+16] |
||
967 | mov eax, [edi] |
||
968 | push edi |
||
969 | call dword [eax+76] |
||
970 | push eax |
||
971 | mov eax, [edi] |
||
972 | push edi |
||
973 | call dword [eax+8] |
||
974 | pop eax |
||
975 | pop edi |
||
976 | test eax, eax |
||
977 | js r |
||
978 | push ebx |
||
979 | push esp |
||
980 | push ebx |
||
981 | mov eax, [edi] |
||
982 | push edi |
||
983 | call dword [eax+60] |
||
984 | push eax |
||
985 | mov eax, [edi] |
||
986 | push edi |
||
987 | call dword [eax+8] |
||
988 | pop eax |
||
989 | pop edi |
||
990 | test eax, eax |
||
991 | js r |
||
992 | cml1: |
||
993 | mov eax, [esp+16] |
||
994 | add dword [esp+16], 8 |
||
995 | cmp dword [eax], 0 |
||
996 | jz cme1 |
||
997 | push ebx |
||
998 | push dword [eax+4] |
||
999 | push ebx |
||
1000 | push dword [eax] |
||
1001 | mov eax, [edi] |
||
1002 | push edi |
||
1003 | call dword [eax+20] |
||
1004 | test eax, eax |
||
1005 | js r2 |
||
1006 | jmp cml1 |
||
1007 | cme1: |
||
1008 | and dword [varout], 0 |
||
1009 | mov ecx, [esp+8] |
||
1010 | test esi, esi |
||
1011 | jz cms |
||
1012 | push ebx |
||
1013 | push ebx |
||
1014 | push varout |
||
1015 | push ebx |
||
1016 | push rpn |
||
1017 | mov eax, [esi] |
||
1018 | push esi |
||
1019 | call dword [eax+16] |
||
1020 | test eax, eax |
||
1021 | js r2 |
||
1022 | cmp word [varout], 8 |
||
1023 | jnz r2 |
||
1024 | mov ecx, [varout+8] |
||
1025 | cms: |
||
1026 | pop edx |
||
1027 | push edx |
||
1028 | push ebx |
||
1029 | mov eax, esp |
||
1030 | push ebx |
||
1031 | push eax |
||
1032 | push edi |
||
1033 | push ebx |
||
1034 | push ebx |
||
1035 | push dword [eax+16] |
||
1036 | push ecx |
||
1037 | mov eax, [edx] |
||
1038 | push edx |
||
1039 | call dword [eax+96] |
||
1040 | push eax |
||
1041 | mov eax, [edi] |
||
1042 | push edi |
||
1043 | call dword [eax+8] |
||
1044 | push varout |
||
1045 | call [VariantClear] |
||
1046 | pop eax |
||
1047 | pop edi |
||
1048 | test eax, eax |
||
1049 | js r |
||
1050 | push ebx |
||
1051 | push ebx |
||
1052 | push varout |
||
1053 | push ebx |
||
1054 | push retvaln |
||
1055 | mov eax, [edi] |
||
1056 | push edi |
||
1057 | call dword [eax+16] |
||
1058 | test eax, eax |
||
1059 | js r2 |
||
1060 | mov eax, 80000000h |
||
1061 | cmp word [varout], 11 |
||
1062 | jnz r2 |
||
1063 | cmp word [varout+8], 0 |
||
1064 | jz r2 |
||
1065 | mov eax, [esp+16] |
||
1066 | mov eax, [eax-4] |
||
1067 | test eax, eax |
||
1068 | jz r2 |
||
1069 | push ebx |
||
1070 | push ebx |
||
1071 | push varout |
||
1072 | push ebx |
||
1073 | push eax |
||
1074 | mov eax, [edi] |
||
1075 | push edi |
||
1076 | call dword [eax+16] |
||
1077 | test eax, eax |
||
1078 | js r2 |
||
1079 | cmp word [varout], 13 |
||
1080 | setnz al |
||
1081 | shl eax, 31 |
||
1082 | r2: |
||
1083 | push eax |
||
1084 | mov eax, [edi] |
||
1085 | push edi |
||
1086 | call dword [eax+8] |
||
1087 | pop eax |
||
1088 | r: |
||
1089 | pop edi |
||
1090 | test eax, eax |
||
1091 | ret 8 |
||
1092 | |||
1093 | ofn_hook: |
||
1094 | cmp dword [esp+8], 2 |
||
1095 | jnz @f |
||
1096 | push 260 |
||
1097 | push ostitle |
||
1098 | push 23 |
||
1099 | push dword [esp+12+4] |
||
1100 | call [GetDlgItemTextA] |
||
1101 | @@: |
||
1102 | xor eax, eax |
||
1103 | ret 10h |
||
1104 | |||
1105 | section '.data' data readable writable |
||
1106 | data resource from 'rsrc.res' |
||
1107 | end data |
||
1108 | |||
1109 | align 4 |
||
1110 | ofn: |
||
1111 | dd 76 |
||
1112 | dd 0 |
||
1113 | dd ofn_title_template |
||
1114 | dd filter |
||
1115 | dd 0 |
||
1116 | dd 0 |
||
1117 | dd 0 |
||
1118 | dd img_name |
||
1119 | dd 100h |
||
1120 | dd 0 |
||
1121 | dd 0 |
||
1122 | dd 0 |
||
1123 | dd ofn_title |
||
1124 | dd 818A4h |
||
1125 | dd 0 |
||
1126 | dd aImg |
||
1127 | dd 0 |
||
1128 | dd ofn_hook |
||
1129 | dd 0 |
||
1130 | ofn_title_template: |
||
1131 | dw 1,-1 |
||
1132 | dd 0 |
||
1133 | dd 0 |
||
1134 | dd 56000444h |
||
1135 | dw 2 |
||
1136 | dw 0,0,275,28 |
||
1137 | dw 0,0,0 |
||
1138 | dw 8 |
||
1139 | dd 0 |
||
1140 | du 'MS Sans Serif',0 |
||
1141 | align 4 |
||
1142 | dd 0 |
||
1143 | dd 0 |
||
1144 | dd 50010000h |
||
1145 | dw 5,12,45,9 |
||
1146 | dw -1 |
||
1147 | dw 0 |
||
1148 | dw -1,82h |
||
1149 | du 'Title:',0 |
||
1150 | dw 0 |
||
1151 | align 4 |
||
1152 | dd 0 |
||
1153 | dd 204h |
||
1154 | dd 50010080h |
||
1155 | dw 54,10,218,12 |
||
1156 | dw 23 |
||
1157 | dw 0 |
||
1158 | dw -1,81h |
||
1159 | du 'KolibriOS',0 |
||
1160 | dw 0 |
||
1161 | |||
1162 | filter db 'Image files (*.img)',0,'*.img',0,'All files',0,'*.*',0,0 |
||
1163 | ofn_title db 'Select KolibriOS image file',0 |
||
1164 | aImg db 'img',0 |
||
1165 | norightsmsg db 'Cannot query drive info.',10 |
||
1166 | db 'Probably it is invalid drive or you are not administrator',0 |
||
1167 | nohd db 'Image must be on hard disk!',0 |
||
1168 | m1 db 'Please mail to diamondz@land.ru',0 |
||
1169 | nom db "Too many mtldr's found!",0 |
||
1170 | noc db 'Cannot create mtldr file!',0 |
||
1171 | osstr db 'operating systems',0 |
||
1172 | bootini db 'c:\boot.ini',0 |
||
1173 | insterr db 'Cannot write to boot.ini. Probably you are not administrator.',0 |
||
1174 | insterr2 db 'Cannot open config.sys',0 |
||
1175 | ptl db 'Path is too long',0 |
||
1176 | succ db 'Installation successful!',0 |
||
1177 | suct db 'Success',0 |
||
1178 | vwin32 db '\\.\vwin32',0 |
||
1179 | config db 'C:\config.sys',0 |
||
1180 | sec9x2 db ']',13,10 |
||
1181 | install db 'install=' |
||
1182 | newline db 13,10 |
||
1183 | menuitem db 'kolibri',0 |
||
1184 | mis db 'menuitem=' |
||
1185 | title9x db ',Load ' |
||
1186 | title9xsz = $ - title9x |
||
1187 | title9x2 db 13,10,13,10,'[' |
||
1188 | title9x2sz = $ - title9x2 |
||
1189 | ld1 db 'Load ' |
||
1190 | ld1sz = $ - ld1 |
||
1191 | ld2 db '? [y/n]: ',0 |
||
1192 | ld2sz = $ - ld2 |
||
1193 | apf db 'Cannot adjust backup and restore privileges',0 |
||
1194 | opts db 'OpenProcessToken',0 |
||
1195 | lpvs db 'LookupPrivilegeValueA',0 |
||
1196 | atps db 'AdjustTokenPrivileges',0 |
||
1197 | sbn db 'SeBackupPrivilege',0 |
||
1198 | srn db 'SeRestorePrivilege',0 |
||
1199 | wmierr db 'BCD WMI API: initialization error',0 |
||
1200 | coerr db 'Cannot create BCD object for KolibriOS loader',0 |
||
1201 | setproperr db 'Cannot create BCD element in object for KolibriOS loader',0 |
||
1202 | orerr db 'Cannot add KolibriOS loader in BCD display list',0 |
||
1203 | ns du 'root\wmi',0 |
||
1204 | retvaln du 'ReturnValue' |
||
1205 | emptystr du 0 |
||
1206 | rpn du '__Relpath',0 |
||
1207 | bs du 'BcdStore',0 |
||
1208 | bo du 'BcdObject',0 |
||
1209 | osn du 'OpenStore',0 |
||
1210 | con du 'CreateObject',0 |
||
1211 | don du 'DeleteObject',0 |
||
1212 | oon du 'OpenObject',0 |
||
1213 | ssen du 'SetStringElement',0 |
||
1214 | spden du 'SetPartitionDeviceElement',0 |
||
1215 | gen du 'GetElement',0 |
||
1216 | solen du 'SetObjectListElement',0 |
||
1217 | fn du 'File',0 |
||
1218 | storen du 'Store',0 |
||
1219 | idn du 'Id',0 |
||
1220 | idsn du 'Ids',0 |
||
1221 | tn du 'Type',0 |
||
1222 | obn du 'Object',0 |
||
1223 | sn du 'String',0 |
||
1224 | dtn du 'DeviceType',0 |
||
1225 | aon du 'AdditionalOptions',0 |
||
1226 | pn du 'Path',0 |
||
1227 | en du 'Element',0 |
||
1228 | bg du '{9dea862c-5cdd-4e70-acc1-f32b344d4795}',0 |
||
1229 | |||
1230 | align 4 |
||
1231 | advapi32 dd 0 |
||
1232 | |||
1233 | regs: |
||
1234 | dd 0 |
||
1235 | dd diskinfobuf |
||
1236 | dd 86Fh |
||
1237 | dd 440Dh |
||
1238 | dd 0 |
||
1239 | dd 0 |
||
1240 | dd 1 |
||
1241 | |||
1242 | diskinfobuf: |
||
1243 | db 10h,0,0,0FFh |
||
1244 | times 0Ch db 0 |
||
1245 | |||
1246 | IID_IWbemLocator: |
||
1247 | dd 0DC12A687h |
||
1248 | dw 737Fh |
||
1249 | dw 11CFh |
||
1250 | db 88h, 4Dh, 00h, 0AAh, 00h, 4Bh, 2Eh, 24h |
||
1251 | CLSID_WbemLocator: |
||
1252 | dd 4590F811h |
||
1253 | dw 1D3Ah |
||
1254 | dw 11D0h |
||
1255 | db 89h, 1Fh, 00h, 0AAh, 00h, 4Bh, 2Eh, 24h |
||
1256 | IID_IWbemClassObject: |
||
1257 | dd 0DC12A681h |
||
1258 | dw 737Fh |
||
1259 | dw 11CFh |
||
1260 | db 88h, 4Dh, 00h, 0AAh, 00h, 4Bh, 2Eh, 24h |
||
1261 | varemptystr: |
||
1262 | dd 8, 0, emptystr, 0 |
||
1263 | vartmpstr: |
||
1264 | dd 8, 0, menuitems, 0 |
||
1265 | varbootmgr: |
||
1266 | dd 8, 0, bg, 0 |
||
1267 | vari32: |
||
1268 | dd 3, 0, 10400008h, 0 |
||
1269 | vari32_pd: |
||
1270 | dd 3, 0, 2, 0 |
||
1271 | osp: |
||
1272 | dd fn, varemptystr |
||
1273 | dd 0, storen |
||
1274 | dd idn, vartmpstr |
||
1275 | dd tn, vari32 |
||
1276 | dd 0, obn |
||
1277 | dd tn, vari32 |
||
1278 | dd sn, vartmpstr |
||
1279 | dd 0, 0 |
||
1280 | dd tn, vari32 |
||
1281 | dd dtn, vari32_pd |
||
1282 | dd aon, varemptystr |
||
1283 | dd pn, vartmpstr |
||
1284 | dd 0, 0 |
||
1285 | dd idn, varbootmgr |
||
1286 | dd 0, obn |
||
1287 | dd tn, vari32 |
||
1288 | dd 0, en |
||
1289 | dd tn, vari32 |
||
1290 | dd idsn, varout |
||
1291 | dd 0, 0 |
||
1292 | |||
1293 | dop: |
||
1294 | dd idn, vartmpstr |
||
1295 | dd 0, 0 |
||
1296 | |||
1297 | data import |
||
1298 | macro thunk a |
||
1299 | {a#_thunk:dw 0 |
||
1300 | db `a,0} |
||
1301 | dd 0,0,0, rva kernel32_name, rva kernel32_thunks |
||
1302 | dd 0,0,0, rva user32_name, rva user32_thunks |
||
1303 | dd 0,0,0, rva comdlg32_name, rva comdlg32_thunks |
||
1304 | dd 0,0,0, rva ole32_name, rva ole32_thunks |
||
1305 | dd 0,0,0, rva oleaut32_name, rva oleaut32_thunks |
||
1306 | dd 0,0,0,0,0 |
||
1307 | kernel32_name db 'kernel32.dll',0 |
||
1308 | user32_name db 'user32.dll',0 |
||
1309 | advapi32_name db 'advapi32.dll',0 |
||
1310 | comdlg32_name db 'comdlg32.dll',0 |
||
1311 | ole32_name db 'ole32.dll',0 |
||
1312 | oleaut32_name db 'oleaut32.dll',0 |
||
1313 | |||
1314 | kernel32_thunks: |
||
1315 | GetVersion dd rva GetVersion_thunk |
||
1316 | CreateFileA dd rva CreateFileA_thunk |
||
1317 | DeviceIoControl dd rva DeviceIoControl_thunk |
||
1318 | CloseHandle dd rva CloseHandle_thunk |
||
1319 | GetFileAttributesA dd rva GetFileAttributesA_thunk |
||
1320 | SetFileAttributesA dd rva SetFileAttributesA_thunk |
||
1321 | GetLastError dd rva GetLastError_thunk |
||
1322 | ReadFile dd rva ReadFile_thunk |
||
1323 | WriteFile dd rva WriteFile_thunk |
||
1324 | ExitProcess dd rva ExitProcess_thunk |
||
1325 | WritePrivateProfileStringA dd rva WritePrivateProfileStringA_thunk |
||
1326 | GetShortPathNameA dd rva GetShortPathNameA_thunk |
||
1327 | lstrlenA dd rva lstrlenA_thunk |
||
1328 | VirtualAlloc dd rva VirtualAlloc_thunk |
||
1329 | GetFileSize dd rva GetFileSize_thunk |
||
1330 | DeleteFileA dd rva DeleteFileA_thunk |
||
1331 | MultiByteToWideChar dd rva MultiByteToWideChar_thunk |
||
1332 | GetCurrentProcess dd rva GetCurrentProcess_thunk |
||
1333 | LoadLibraryA dd rva LoadLibraryA_thunk |
||
1334 | GetProcAddress dd rva GetProcAddress_thunk |
||
1335 | dw 0 |
||
1336 | thunk GetVersion |
||
1337 | thunk CreateFileA |
||
1338 | thunk DeviceIoControl |
||
1339 | thunk CloseHandle |
||
1340 | thunk GetFileAttributesA |
||
1341 | thunk SetFileAttributesA |
||
1342 | thunk GetLastError |
||
1343 | thunk ReadFile |
||
1344 | thunk WriteFile |
||
1345 | thunk ExitProcess |
||
1346 | thunk WritePrivateProfileStringA |
||
1347 | thunk GetShortPathNameA |
||
1348 | thunk lstrlenA |
||
1349 | thunk VirtualAlloc |
||
1350 | thunk GetFileSize |
||
1351 | thunk DeleteFileA |
||
1352 | thunk MultiByteToWideChar |
||
1353 | thunk GetCurrentProcess |
||
1354 | thunk LoadLibraryA |
||
1355 | thunk GetProcAddress |
||
1356 | |||
1357 | user32_thunks: |
||
1358 | MessageBoxA dd rva MessageBoxA_thunk |
||
1359 | CharToOemA dd rva CharToOemA_thunk |
||
1360 | OemToCharA dd rva OemToCharA_thunk |
||
1361 | GetDlgItemTextA dd rva GetDlgItemTextA_thunk |
||
1362 | dw 0 |
||
1363 | thunk MessageBoxA |
||
1364 | thunk CharToOemA |
||
1365 | thunk OemToCharA |
||
1366 | thunk GetDlgItemTextA |
||
1367 | |||
1368 | comdlg32_thunks: |
||
1369 | GetOpenFileNameA dd rva GetOpenFileNameA_thunk |
||
1370 | dw 0 |
||
1371 | thunk GetOpenFileNameA |
||
1372 | |||
1373 | ole32_thunks: |
||
1374 | CoInitializeEx dd rva CoInitializeEx_thunk |
||
1375 | CoUninitialize dd rva CoUninitialize_thunk |
||
1376 | CoInitializeSecurity dd rva CoInitializeSecurity_thunk |
||
1377 | CoCreateInstance dd rva CoCreateInstance_thunk |
||
1378 | CoSetProxyBlanket dd rva CoSetProxyBlanket_thunk |
||
1379 | CoCreateGuid dd rva CoCreateGuid_thunk |
||
1380 | StringFromGUID2 dd rva StringFromGUID2_thunk |
||
1381 | dw 0 |
||
1382 | thunk CoInitializeEx |
||
1383 | thunk CoUninitialize |
||
1384 | thunk CoInitializeSecurity |
||
1385 | thunk CoCreateInstance |
||
1386 | thunk CoSetProxyBlanket |
||
1387 | thunk CoCreateGuid |
||
1388 | thunk StringFromGUID2 |
||
1389 | |||
1390 | oleaut32_thunks: |
||
1391 | VariantClear dd rva VariantClear_thunk |
||
1392 | SafeArrayRedim dd rva SafeArrayRedim_thunk |
||
1393 | SafeArrayPutElement dd rva SafeArrayPutElement_thunk |
||
1394 | SysAllocString dd rva SysAllocString_thunk |
||
1395 | SysFreeString dd rva SysFreeString_thunk |
||
1396 | dw 0 |
||
1397 | thunk VariantClear |
||
1398 | thunk SafeArrayRedim |
||
1399 | thunk SafeArrayPutElement |
||
1400 | thunk SysAllocString |
||
1401 | thunk SysFreeString |
||
1402 | end data |
||
1403 | |||
1404 | mtldr_code: |
||
1405 | file 'mtldr_for_installer' |
||
1406 | mtldr_code_size = $ - mtldr_code |
||
1407 | |||
1408 | dn db '\\.\' |
||
1409 | img_name rb 256 |
||
1410 | img_real_name rb 256 |
||
1411 | mtldr_name rb 256 |
||
1412 | tmp_data rb 2000h |
||
1413 | ostitle rb 260 |
||
1414 | systitle rb 262 |
||
1415 | |||
1416 | align 4 |
||
1417 | OpenProcessToken dd ? |
||
1418 | LookupPrivilegeValueA dd ? |
||
1419 | AdjustTokenPrivileges dd ? |
||
1420 | tmp dd ? |
||
1421 | sdn rd 3 |
||
1422 | pi rd 8 |
||
1423 | varout rd 4 |
||
1424 | guid rd 4 |
||
1425 | b9x db ? |
||
1426 | menuitems rb 100h |