; ml64 /c <file_name>.asm
; link <file_name>.obj /entry:main

; Listing generated by Microsoft (R) Optimizing Compiler Version 19.26.28806.0 

;include listing.inc

;INCLUDELIB LIBCMT
;INCLUDELIB OLDNAMES

CONST	SEGMENT
;$SG90382 DB	'k', 00H, 'e', 00H, 'r', 00H, 'n', 00H, 'e', 00H, 'l', 00H
;	DB	'3', 00H, '2', 00H, '.', 00H, 'd', 00H, 'l', 00H, 'l', 00H, 00H
;	DB	00H
;	ORG $+6
;$SG90384 DB	'LoadLibraryA', 00H
;	ORG $+3
;$SG90386 DB	'GetProcAddress', 00H
;	ORG $+1
;$SG90388 DB	'user32.dll', 00H
;	ORG $+5
;$SG90389 DB	'MessageBoxW', 00H
;$SG90391 DB	'O', 00H, 'K', 00H, 00H, 00H
;	ORG $+6
;$SG90392 DB	'L', 00H, 'o', 00H, 'a', 00H, 'd', 00H, 'e', 00H, 'd', 00H
;	DB	'!', 00H, 00H, 00H
CONST	ENDS
PUBLIC	?get_module_by_name@@YAPEAXPEA_W@Z		; get_module_by_name
PUBLIC	?get_func_by_name@@YAPEAXPEAXPEAD@Z		; get_func_by_name
PUBLIC	main
;	COMDAT pdata

; Function compile flags: /Odtp
_TEXT	SEGMENT
base$ = 32
load_lib$ = 40
get_proc$ = 48
_MessageBoxW$ = 56
_LoadLibraryA$ = 64
u32_dll$ = 72
_GetProcAddress$ = 80
main	PROC
; File C:\Users\IEUser\Desktop\shellcode_task_step1.cpp
; Line 153
$LN7:
	sub	rsp, 104				; 00000068H
; Line 154
	call after_kernel_str
 DB	'k', 00H, 'e', 00H, 'r', 00H, 'n', 00H, 'e', 00H, 'l', 00H
	DB	'3', 00H, '2', 00H, '.', 00H, 'd', 00H, 'l', 00H, 'l', 00H, 00H
	DB	00H
	ORG $+6
after_kernel_str:
	pop rcx
	;lea	rcx, OFFSET $SG90382
	call	?get_module_by_name@@YAPEAXPEA_W@Z	; get_module_by_name
	mov	QWORD PTR base$[rsp], rax
; Line 155
	cmp	QWORD PTR base$[rsp], 0
	jne	SHORT $LN2@main
; Line 156
	mov	eax, 1
	jmp	$LN1@main
$LN2@main:
; Line 159
call after_load_library_str
DB	'LoadLibraryA', 00H
	ORG $+3
after_load_library_str:
	pop rdx
	;lea	rdx, OFFSET $SG90384
	mov	rcx, QWORD PTR base$[rsp]
	call	?get_func_by_name@@YAPEAXPEAXPEAD@Z	; get_func_by_name
	mov	QWORD PTR load_lib$[rsp], rax
; Line 160
	cmp	QWORD PTR load_lib$[rsp], 0
	jne	SHORT $LN3@main
; Line 161
	mov	eax, 2
	jmp	$LN1@main
$LN3@main:
; Line 163
call after_get_proc_str
	DB	'GetProcAddress', 00H
	ORG $+1
after_get_proc_str:
	pop rdx
	;lea	rdx, OFFSET $SG90386
	mov	rcx, QWORD PTR base$[rsp]
	call	?get_func_by_name@@YAPEAXPEAXPEAD@Z	; get_func_by_name
	mov	QWORD PTR get_proc$[rsp], rax
; Line 164
	cmp	QWORD PTR get_proc$[rsp], 0
	jne	SHORT $LN4@main
; Line 165
	mov	eax, 3
	;jmp	SHORT $LN1@main
	; Line 187
	add	rsp, 104				; 00000068H
	ret	0
$LN4@main:
; Line 167
	mov	rax, QWORD PTR load_lib$[rsp]
	mov	QWORD PTR _LoadLibraryA$[rsp], rax
; Line 168
	mov	rax, QWORD PTR get_proc$[rsp]
	mov	QWORD PTR _GetProcAddress$[rsp], rax
; Line 170
call after_user32_str
DB	'user32.dll', 00H
	ORG $+5
after_user32_str:
	pop rcx
	;lea	rcx, OFFSET $SG90388
	call	QWORD PTR _LoadLibraryA$[rsp]
	mov	QWORD PTR u32_dll$[rsp], rax
; Line 176
call after_msgbox_str
	DB	'MessageBoxW', 00H
after_msgbox_str:
	pop rdx
	;lea	rdx, OFFSET $SG90389
	mov	rcx, QWORD PTR u32_dll$[rsp]
	call	QWORD PTR _GetProcAddress$[rsp]
	mov	QWORD PTR _MessageBoxW$[rsp], rax
; Line 182
	cmp	QWORD PTR _MessageBoxW$[rsp], 0
	jne	SHORT $LN5@main
	mov	eax, 4
	jmp	SHORT $LN1@main
$LN5@main:
; Line 184
call after_ok_str
	DB	'O', 00H, 'K', 00H, 00H, 00H
	ORG $+6
	after_ok_str:
	pop r8
	call after_msg_str
	DB	'L', 00H, 'o', 00H, 'a', 00H, 'd', 00H, 'e', 00H, 'd', 00H
	DB	'!', 00H, 00H, 00H
after_msg_str:
	pop rdx
	xor	r9d, r9d
	;lea	r8, OFFSET $SG90391
	;lea	rdx, OFFSET $SG90392
	xor	ecx, ecx
	call	QWORD PTR _MessageBoxW$[rsp]
; Line 186
	xor	eax, eax
$LN1@main:
; Line 187
	add	rsp, 104				; 00000068H
	ret	0
main	ENDP
_TEXT	ENDS
; Function compile flags: /Odtp
;	COMDAT ?get_func_by_name@@YAPEAXPEAXPEAD@Z
_TEXT	SEGMENT
k$1 = 0
i$2 = 8
exp$ = 16
expAddr$ = 24
funcNamesListRVA$ = 28
namesOrdsListRVA$ = 32
funcsListRVA$ = 36
curr_name$3 = 40
idh$ = 48
exportsDir$ = 56
nt_headers$ = 64
namesCount$ = 72
nameIndex$4 = 80
nameRVA$5 = 88
funcRVA$6 = 96
module$ = 128
func_name$ = 136
?get_func_by_name@@YAPEAXPEAXPEAD@Z PROC		; get_func_by_name, COMDAT
; File C:\Users\IEUser\Desktop\shellcode_task_step1.cpp
; Line 114
$LN13:
	mov	QWORD PTR [rsp+16], rdx
	mov	QWORD PTR [rsp+8], rcx
	sub	rsp, 120				; 00000078H
; Line 115
	mov	rax, QWORD PTR module$[rsp]
	mov	QWORD PTR idh$[rsp], rax
; Line 116
	mov	rax, QWORD PTR idh$[rsp]
	movzx	eax, WORD PTR [rax]
	cmp	eax, 23117				; 00005a4dH
	je	SHORT $LN8@get_func_b
; Line 117
	xor	eax, eax
	jmp	$LN1@get_func_b
$LN8@get_func_b:
; Line 119
	mov	rax, QWORD PTR idh$[rsp]
	movsxd	rax, DWORD PTR [rax+60]
	mov	rcx, QWORD PTR module$[rsp]
	add	rcx, rax
	mov	rax, rcx
	mov	QWORD PTR nt_headers$[rsp], rax
; Line 120
	mov	eax, 8
	imul	rax, rax, 0
	mov	rcx, QWORD PTR nt_headers$[rsp]
	lea	rax, QWORD PTR [rcx+rax+136]
	mov	QWORD PTR exportsDir$[rsp], rax
; Line 121
	mov	rax, QWORD PTR exportsDir$[rsp]
	cmp	DWORD PTR [rax], 0
	jne	SHORT $LN9@get_func_b
; Line 122
	xor	eax, eax
	jmp	$LN1@get_func_b
$LN9@get_func_b:
; Line 125
	mov	rax, QWORD PTR exportsDir$[rsp]
	mov	eax, DWORD PTR [rax]
	mov	DWORD PTR expAddr$[rsp], eax
; Line 126
	mov	eax, DWORD PTR expAddr$[rsp]
	add	rax, QWORD PTR module$[rsp]
	mov	QWORD PTR exp$[rsp], rax
; Line 127
	mov	rax, QWORD PTR exp$[rsp]
	mov	eax, DWORD PTR [rax+24]
	mov	QWORD PTR namesCount$[rsp], rax
; Line 129
	mov	rax, QWORD PTR exp$[rsp]
	mov	eax, DWORD PTR [rax+28]
	mov	DWORD PTR funcsListRVA$[rsp], eax
; Line 130
	mov	rax, QWORD PTR exp$[rsp]
	mov	eax, DWORD PTR [rax+32]
	mov	DWORD PTR funcNamesListRVA$[rsp], eax
; Line 131
	mov	rax, QWORD PTR exp$[rsp]
	mov	eax, DWORD PTR [rax+36]
	mov	DWORD PTR namesOrdsListRVA$[rsp], eax
; Line 134
	mov	QWORD PTR i$2[rsp], 0
	jmp	SHORT $LN4@get_func_b
$LN2@get_func_b:
	mov	rax, QWORD PTR i$2[rsp]
	inc	rax
	mov	QWORD PTR i$2[rsp], rax
$LN4@get_func_b:
	mov	rax, QWORD PTR namesCount$[rsp]
	cmp	QWORD PTR i$2[rsp], rax
	jae	$LN3@get_func_b
; Line 135
	mov	eax, DWORD PTR funcNamesListRVA$[rsp]
	mov	rcx, QWORD PTR module$[rsp]
	add	rcx, rax
	mov	rax, rcx
	mov	rcx, QWORD PTR i$2[rsp]
	lea	rax, QWORD PTR [rax+rcx*4]
	mov	QWORD PTR nameRVA$5[rsp], rax
; Line 136
	mov	eax, DWORD PTR namesOrdsListRVA$[rsp]
	mov	rcx, QWORD PTR module$[rsp]
	add	rcx, rax
	mov	rax, rcx
	mov	rcx, QWORD PTR i$2[rsp]
	lea	rax, QWORD PTR [rax+rcx*2]
	mov	QWORD PTR nameIndex$4[rsp], rax
; Line 137
	mov	eax, DWORD PTR funcsListRVA$[rsp]
	mov	rcx, QWORD PTR module$[rsp]
	add	rcx, rax
	mov	rax, rcx
	mov	rcx, QWORD PTR nameIndex$4[rsp]
	movzx	ecx, WORD PTR [rcx]
	lea	rax, QWORD PTR [rax+rcx*4]
	mov	QWORD PTR funcRVA$6[rsp], rax
; Line 139
	mov	rax, QWORD PTR nameRVA$5[rsp]
	mov	eax, DWORD PTR [rax]
	mov	rcx, QWORD PTR module$[rsp]
	add	rcx, rax
	mov	rax, rcx
	mov	QWORD PTR curr_name$3[rsp], rax
; Line 140
	mov	QWORD PTR k$1[rsp], 0
; Line 141
	mov	QWORD PTR k$1[rsp], 0
	jmp	SHORT $LN7@get_func_b
$LN5@get_func_b:
	mov	rax, QWORD PTR k$1[rsp]
	inc	rax
	mov	QWORD PTR k$1[rsp], rax
$LN7@get_func_b:
	mov	rax, QWORD PTR k$1[rsp]
	mov	rcx, QWORD PTR func_name$[rsp]
	add	rcx, rax
	mov	rax, rcx
	movsx	eax, BYTE PTR [rax]
	test	eax, eax
	je	SHORT $LN6@get_func_b
	mov	rax, QWORD PTR k$1[rsp]
	mov	rcx, QWORD PTR curr_name$3[rsp]
	add	rcx, rax
	mov	rax, rcx
	movsx	eax, BYTE PTR [rax]
	test	eax, eax
	je	SHORT $LN6@get_func_b
; Line 142
	mov	rax, QWORD PTR k$1[rsp]
	mov	rcx, QWORD PTR func_name$[rsp]
	add	rcx, rax
	mov	rax, rcx
	movsx	eax, BYTE PTR [rax]
	mov	rcx, QWORD PTR k$1[rsp]
	mov	rdx, QWORD PTR curr_name$3[rsp]
	add	rdx, rcx
	mov	rcx, rdx
	movsx	ecx, BYTE PTR [rcx]
	cmp	eax, ecx
	je	SHORT $LN10@get_func_b
	jmp	SHORT $LN6@get_func_b
$LN10@get_func_b:
; Line 143
	jmp	SHORT $LN5@get_func_b
$LN6@get_func_b:
; Line 144
	mov	rax, QWORD PTR k$1[rsp]
	mov	rcx, QWORD PTR func_name$[rsp]
	add	rcx, rax
	mov	rax, rcx
	movsx	eax, BYTE PTR [rax]
	test	eax, eax
	jne	SHORT $LN11@get_func_b
	mov	rax, QWORD PTR k$1[rsp]
	mov	rcx, QWORD PTR curr_name$3[rsp]
	add	rcx, rax
	mov	rax, rcx
	movsx	eax, BYTE PTR [rax]
	test	eax, eax
	jne	SHORT $LN11@get_func_b
; Line 146
	mov	rax, QWORD PTR funcRVA$6[rsp]
	mov	eax, DWORD PTR [rax]
	mov	rcx, QWORD PTR module$[rsp]
	add	rcx, rax
	mov	rax, rcx
	jmp	SHORT $LN1@get_func_b
$LN11@get_func_b:
; Line 148
	jmp	$LN2@get_func_b
$LN3@get_func_b:
; Line 149
	xor	eax, eax
$LN1@get_func_b:
; Line 150
	add	rsp, 120				; 00000078H
	ret	0
?get_func_by_name@@YAPEAXPEAXPEAD@Z ENDP		; get_func_by_name
_TEXT	ENDS
; Function compile flags: /Odtp
;	COMDAT ?get_module_by_name@@YAPEAXPEA_W@Z
_TEXT	SEGMENT
i$1 = 0
tv136 = 8
tv155 = 10
c1$2 = 12
c2$3 = 16
curr_name$4 = 24
curr_module$ = 32
tv132 = 40
tv151 = 44
peb$ = 48
ldr$ = 56
Flink$ = 64
list$ = 72
module_name$ = 128
?get_module_by_name@@YAPEAXPEA_W@Z PROC			; get_module_by_name, COMDAT
; File C:\Users\IEUser\Desktop\shellcode_task_step1.cpp
; Line 79
$LN16:
	mov	QWORD PTR [rsp+8], rcx
	push	rsi
	push	rdi
	sub	rsp, 104				; 00000068H
; Line 80
	mov	QWORD PTR peb$[rsp], 0
; Line 82
	mov	rax, QWORD PTR gs:[96]
	mov	QWORD PTR peb$[rsp], rax
; Line 86
	mov	rax, QWORD PTR peb$[rsp]
	mov	rax, QWORD PTR [rax+24]
	mov	QWORD PTR ldr$[rsp], rax
; Line 87
	lea	rax, QWORD PTR list$[rsp]
	mov	rcx, QWORD PTR ldr$[rsp]
	mov	rdi, rax
	lea	rsi, QWORD PTR [rcx+16]
	mov	ecx, 16
	rep movsb
; Line 89
	mov	rax, QWORD PTR list$[rsp]
	mov	QWORD PTR Flink$[rsp], rax
; Line 90
	mov	rax, QWORD PTR Flink$[rsp]
	mov	QWORD PTR curr_module$[rsp], rax
$LN15@get_module:
$LN2@get_module:
; Line 92
	cmp	QWORD PTR curr_module$[rsp], 0
	je	$LN3@get_module
	mov	rax, QWORD PTR curr_module$[rsp]
	cmp	QWORD PTR [rax+48], 0
	je	$LN3@get_module
; Line 93
	mov	rax, QWORD PTR curr_module$[rsp]
	cmp	QWORD PTR [rax+96], 0
	jne	SHORT $LN7@get_module
	jmp	SHORT $LN2@get_module
$LN7@get_module:
; Line 94
	mov	rax, QWORD PTR curr_module$[rsp]
	mov	rax, QWORD PTR [rax+96]
	mov	QWORD PTR curr_name$4[rsp], rax
; Line 96
	mov	QWORD PTR i$1[rsp], 0
; Line 97
	mov	QWORD PTR i$1[rsp], 0
	jmp	SHORT $LN6@get_module
$LN4@get_module:
	mov	rax, QWORD PTR i$1[rsp]
	inc	rax
	mov	QWORD PTR i$1[rsp], rax
$LN6@get_module:
	mov	rax, QWORD PTR module_name$[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	test	eax, eax
	je	$LN5@get_module
	mov	rax, QWORD PTR curr_name$4[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	test	eax, eax
	je	$LN5@get_module
; Line 99
	mov	rax, QWORD PTR module_name$[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	cmp	eax, 90					; 0000005aH
	jg	SHORT $LN11@get_module
	mov	rax, QWORD PTR module_name$[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	cmp	eax, 65					; 00000041H
	jl	SHORT $LN11@get_module
	mov	rax, QWORD PTR module_name$[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	sub	eax, 65					; 00000041H
	add	eax, 97					; 00000061H
	mov	DWORD PTR tv132[rsp], eax
	mov	rax, QWORD PTR module_name$[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	edx, WORD PTR tv132[rsp]
	mov	WORD PTR [rax+rcx*2], dx
	movzx	eax, WORD PTR tv132[rsp]
	mov	WORD PTR tv136[rsp], ax
	jmp	SHORT $LN12@get_module
$LN11@get_module:
	mov	rax, QWORD PTR module_name$[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	mov	WORD PTR tv136[rsp], ax
$LN12@get_module:
	movzx	eax, WORD PTR tv136[rsp]
	mov	WORD PTR c1$2[rsp], ax
; Line 100
	mov	rax, QWORD PTR curr_name$4[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	cmp	eax, 90					; 0000005aH
	jg	SHORT $LN13@get_module
	mov	rax, QWORD PTR curr_name$4[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	cmp	eax, 65					; 00000041H
	jl	SHORT $LN13@get_module
	mov	rax, QWORD PTR curr_name$4[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	sub	eax, 65					; 00000041H
	add	eax, 97					; 00000061H
	mov	DWORD PTR tv151[rsp], eax
	mov	rax, QWORD PTR curr_name$4[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	edx, WORD PTR tv151[rsp]
	mov	WORD PTR [rax+rcx*2], dx
	movzx	eax, WORD PTR tv151[rsp]
	mov	WORD PTR tv155[rsp], ax
	jmp	SHORT $LN14@get_module
$LN13@get_module:
	mov	rax, QWORD PTR curr_name$4[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	mov	WORD PTR tv155[rsp], ax
$LN14@get_module:
	movzx	eax, WORD PTR tv155[rsp]
	mov	WORD PTR c2$3[rsp], ax
; Line 101
	movzx	eax, WORD PTR c1$2[rsp]
	movzx	ecx, WORD PTR c2$3[rsp]
	cmp	eax, ecx
	je	SHORT $LN8@get_module
	jmp	SHORT $LN5@get_module
$LN8@get_module:
; Line 102
	jmp	$LN4@get_module
$LN5@get_module:
; Line 103
	mov	rax, QWORD PTR module_name$[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	test	eax, eax
	jne	SHORT $LN9@get_module
	mov	rax, QWORD PTR curr_name$4[rsp]
	mov	rcx, QWORD PTR i$1[rsp]
	movzx	eax, WORD PTR [rax+rcx*2]
	test	eax, eax
	jne	SHORT $LN9@get_module
; Line 105
	mov	rax, QWORD PTR curr_module$[rsp]
	mov	rax, QWORD PTR [rax+48]
	jmp	SHORT $LN1@get_module
$LN9@get_module:
; Line 108
	mov	rax, QWORD PTR curr_module$[rsp]
	mov	rax, QWORD PTR [rax]
	mov	QWORD PTR curr_module$[rsp], rax
; Line 109
	jmp	$LN15@get_module
$LN3@get_module:
; Line 110
	xor	eax, eax
$LN1@get_module:
; Line 111
	add	rsp, 104				; 00000068H
	pop	rdi
	pop	rsi
	ret	0
?get_module_by_name@@YAPEAXPEA_W@Z ENDP			; get_module_by_name
_TEXT	ENDS
END
