mirror of
https://github.com/klezVirus/ThreadPoolExecChain
synced 2026-06-08 15:20:22 +00:00
klez.virus
53 lines
968 B
Plaintext
53 lines
968 B
Plaintext
.code
|
|
ThreadPoolCallback PROC
|
|
pop rbp
|
|
add rsp, 30h
|
|
|
|
; Load context
|
|
mov rax, [rdx]; func ptr
|
|
mov r10, rdx
|
|
push r10; We save the address of the CTX structure
|
|
mov r11, [rdx + 010h]; argc(int)
|
|
|
|
cmp r11, 4
|
|
jg skip_call; current implementation only supports up to 4 args
|
|
|
|
; Set RCX, RDX, R8, R9
|
|
cmp r11, 0
|
|
jle do_call; no args, just call
|
|
|
|
mov rcx, [r10 + 018h]
|
|
cmp r11, 1
|
|
jle do_call
|
|
|
|
mov rdx, [r10 + 020h]
|
|
cmp r11, 2
|
|
jle do_call
|
|
|
|
mov r8, [r12 + 028h]
|
|
cmp r11, 3
|
|
jle do_call
|
|
|
|
mov r9, [r12 + 030h]
|
|
cmp r11, 4
|
|
jle do_call
|
|
|
|
do_call :
|
|
pop r11; We fetch the address of the CTX structure
|
|
sub rsp, 30h; We release the stack space
|
|
push rbp
|
|
mov r10, [r10 + 08h]; addressToPush
|
|
|
|
sub rsp, 28h; this is for the spoofed / swapped frame
|
|
push r10
|
|
mov rbx, r11; we need this structure in RBX
|
|
|
|
jmp rax
|
|
|
|
skip_call :
|
|
pop r11; We fetch the address of the CTX structure
|
|
sub rsp, 30h; We release the stack space
|
|
ret
|
|
ThreadPoolCallback ENDP
|
|
|
|
END |