Ldex86 used to find len of instructions in VirtaulAllocEx from kernel32.dll


LdeX86 - Length Disassembler engin X86

             deroko <deroko<at>gmail<dot>com>
             http://deroko.headcoders.net

press enter to start 

6A 10
68 18 3B E8 77
E8 A8 F6 FF FF
8B 45 0C
85 C0
0F 85 12 B5 FF FF
83 65 FC 00
FF 75 18
FF 75 14
8D 45 10
50
6A 00
8D 45 0C
50
FF 75 08
FF 15 88 11 E6 77
89 45 E4
83 4D FC FF
85 C0
0F 8C 99 90 FE FF
8B 45 0C
E8 30 F7 FF FF
C2 14 00
55
8B EC
FF 75 14
FF 75 10
FF 75 0C
FF 75 08
6A FF
E8 9C FF FF FF
5D
C2 10 00
8B 44 24 04
85 C0
0F 84 B7 01 00 00
A8 01
0F 85 CA F7 FE FF
C2 08 00
FF 25 64 13 E6 77
6A 28
68 28 3B E8 77
E8 23 F6 FF FF
33 FF
57
FF 75 08
E8 CC FF FF FF
89 45 E4
89 7D E0
89 7D DC
press enter to exit


C:\Borland\progz\decoder>

77E7AC24 > 6A 10                PUSH 10
77E7AC26   68 183BE877          PUSH kernel32.77E83B18
77E7AC2B   E8 A8F6FFFF          CALL kernel32.77E7A2D8
77E7AC30   8B45 0C              MOV EAX,DWORD PTR SS:[EBP+C]
77E7AC33   85C0                 TEST EAX,EAX
77E7AC35  ^0F85 12B5FFFF        JNZ kernel32.77E7614D
77E7AC3B   8365 FC 00           AND DWORD PTR SS:[EBP-4],0
77E7AC3F   FF75 18              PUSH DWORD PTR SS:[EBP+18]
77E7AC42   FF75 14              PUSH DWORD PTR SS:[EBP+14]
77E7AC45   8D45 10              LEA EAX,DWORD PTR SS:[EBP+10]
77E7AC48   50                   PUSH EAX
77E7AC49   6A 00                PUSH 0
77E7AC4B   8D45 0C              LEA EAX,DWORD PTR SS:[EBP+C]
77E7AC4E   50                   PUSH EAX
77E7AC4F   FF75 08              PUSH DWORD PTR SS:[EBP+8]
77E7AC52   FF15 8811E677        CALL DWORD PTR DS:[<&ntdll.NtAllocateVir>; ntdll.ZwAllocateVirtualMemory
77E7AC58   8945 E4              MOV DWORD PTR SS:[EBP-1C],EAX
77E7AC5B   834D FC FF           OR DWORD PTR SS:[EBP-4],FFFFFFFF
77E7AC5F   85C0                 TEST EAX,EAX
77E7AC61  ^0F8C 9990FEFF        JL kernel32.77E63D00
77E7AC67   8B45 0C              MOV EAX,DWORD PTR SS:[EBP+C]
77E7AC6A   E8 30F7FFFF          CALL kernel32.77E7A39F
77E7AC6F   C2 1400              RETN 14
77E7AC72 > 55                   PUSH EBP
77E7AC73   8BEC                 MOV EBP,ESP
77E7AC75   FF75 14              PUSH DWORD PTR SS:[EBP+14]
77E7AC78   FF75 10              PUSH DWORD PTR SS:[EBP+10]
77E7AC7B   FF75 0C              PUSH DWORD PTR SS:[EBP+C]
77E7AC7E   FF75 08              PUSH DWORD PTR SS:[EBP+8]
77E7AC81   6A FF                PUSH -1
77E7AC83   E8 9CFFFFFF          CALL kernel32.VirtualAllocEx
77E7AC88   5D                   POP EBP
77E7AC89   C2 1000              RETN 10
77E7AC8C   8B4424 04            MOV EAX,DWORD PTR SS:[ESP+4]
77E7AC90   85C0                 TEST EAX,EAX
77E7AC92   0F84 B7010000        JE kernel32.77E7AE4F
77E7AC98   A8 01                TEST AL,1
77E7AC9A  ^0F85 CAF7FEFF        JNZ kernel32.77E6A46A
77E7ACA0   C2 0800              RETN 8
77E7ACA3  -FF25 6413E677        JMP DWORD PTR DS:[<&ntdll.LdrLockLoaderL>; ntdll.LdrLockLoaderLock
77E7ACA9 > 6A 28                PUSH 28
77E7ACAB   68 283BE877          PUSH kernel32.77E83B28
77E7ACB0   E8 23F6FFFF          CALL kernel32.77E7A2D8
77E7ACB5   33FF                 XOR EDI,EDI
77E7ACB7   57                   PUSH EDI
77E7ACB8   FF75 08              PUSH DWORD PTR SS:[EBP+8]
77E7ACBB   E8 CCFFFFFF          CALL kernel32.77E7AC8C
77E7ACC0   8945 E4              MOV DWORD PTR SS:[EBP-1C],EAX
77E7ACC3   897D E0              MOV DWORD PTR SS:[EBP-20],EDI
77E7ACC6   897D DC              MOV DWORD PTR SS:[EBP-24],EDI

