;Beginning Address was : 640F27 PUSHFD //save regs PUSHAD //save flags, since I'm using a CMP below, which alters ZF CMP DWORD PTR SS:[ESP+18],218 //do we write the whole key? NO, do normal WF; YES, do my code JNZ SHORT Test.00640F88 //NO, do normal WF ^ MOV ECX,97 //making ECX 0x97 (the length of "C:\Application Data\..." in UNICODE) MOV EAX,DWORD PTR SS:[ESP+24] //putting flashfxp.key's handle in EAX MOV DWORD PTR DS:[640F93],EAX //saving it in temp location MOV EDI,Test.00641000 //setting destination for copied unicode string MOV ESI,DWORD PTR SS:[ESP-3CC] //setting source where unicode string is in stack REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI] //copying it POPAD //restoring regs POPFD //restoring flags CALL //execute normal code located original at 40B0C0; .key gets written so it should be 560 bytes now.. PUSHAD //saving regs again PUSH Test.00640F99 //location of "kernel32.dll" string; pushing it CALL //and loading kernel32.dll ^; result is in EAX PUSH Test.00640FA6 //location of "SetFileAttributesW" API string; pushing it PUSH EAX //pushing address of loaded library from earlier (kernel32.dll) CALL //getting address of SetFileAttributesW API; result is in EAX PUSH 1 //1 = set file to READ_ONLY PUSH EAX //pushing address of SFAW API for later use PUSH DWORD PTR DS:[640F93] //pushing file handle CALL //and closing the handle, so then I could.. POP EAX //return SFAW API in EAX PUSH Test.00641000 //push unicode string buffer for file location (flashfxp.key) CALL EAX //and calling SFAW to set file to READ_ONLY =] POPAD //restoring regs JMP Test.0040B0C5 //returning to original code POPAD //this is where I land in case CMP at beginning fails (NO case) POPFD //restoring flags and registers CALL //calling original instruction at 40B0C0 JMP Test.0040B0C5 //and returning to normal code ;End Address was : 640F8F ;Beginning Address was : 40B0C0 JMP Test.00640F27 //jumping to cave where "hook" is.. ;End Address was : 40B0C0