//themida & wl iat repair

var imgbase
var imgend
var codebase
var codesize
var codeend
var tmdbase
var tmp
var mjcount
var depth
var kernel32base
var advaip32base
var user32base

mov mjcount, 3
mov depth, 8


gmemi eip, MEMORYBASE
mov tmdbase, $RESULT
gmi eip, MODULEBASE
mov imgbase, $RESULT
mov imgend, imgbase
gmi eip, MODULESIZE
add imgend, $RESULT
mov codebase, imgbase
gmemi imgbase, MEMORYSIZE
add codebase, $RESULT
mov codeend, codebase
gmemi codebase, MEMORYSIZE
mov codesize, $RESULT
add codeend, codesize
gpa "MessageBoxA", "user32.dll"
gmi $RESULT, MODULEBASE
mov user32base, $RESULT
gpa "ExitProcess","kernel32.dll"
gmi $RESULT, MODULEBASE
mov kernel32base, $RESULT
gpa "RegQueryInfoKeyA","advapi32.dll"
gmi $RESULT, MODULEBASE
mov advaip32base, $RESULT

bphwcall
bpmc
bc
bprm codebase, codesize
jmp findbase

skip1:
bpmc
find eip, #648F0500000000#
bp $RESULT
esto
bc eip
bprm codebase, codesize
jmp findbase

skip2:
bpmc
find eip, #61C20800#
bp $RESULT
esto
bc eip
bprm codebase, codesize
jmp findbase

findbase:
esto
find eip, #6681384D5A#, 5
cmp $RESULT, 0
jne skip1
find eip, #8A16#, 2
cmp $RESULT, 0
jne skip2
find eip, #F3A4#, 2
cmp $RESULT, 0
je findbase
bpmc
mov tmp, tmdbase

findaddr:
find tmp,kernel32base
cmp $RESULT, 0
je findmagic
mov tmp, $RESULT
bphws tmp, "r"
inc tmp
jmp findaddr

findmagic:
esto
mov tmp, depth

findmagic1:
sub eip, 6
find eip, #3B8D????????0F84#, 8
cmp $RESULT, 0
jne prepatch
add eip, 6

findmagic2:
find eip, #2BD90F84#, 4
cmp $RESULT, 0
jne prepatch1
dec tmp
esti
cmp tmp, 0
jne findmagic2
jmp findmagic

prepatch:
bphwcall
bphws eip, "r"
jmp patch

prepatch1:
bphwcall
bphws eip, "r"
jmp patch1

nextmagic:
esti
find eip, #3B8D#, 2
cmp $RESULT, 0
jne patch
find eip, #2BD90F84#, 4
cmp $RESULT, 0
jne patch1
jmp nextmagic

patch:
fill eip, 4, 90
add eip, 4

patch1:
fill eip, 8, 90
add eip, 8
dec mjcount
cmp mjcount, 0
jne nextmagic
bprm codebase, codesize
mov tmp, tmdbase

hookvm:
find tmp, #3BC89CE9#
cmp $RESULT, 0
je nexthook
mov tmp, $RESULT
add tmp, 3
bp tmp
jmp hookvm

nexthook:
esto

process:
cmp [esi], 90909090
je patchcrc
cmp eax, kernel32base
je fix
cmp eax, advaip32base
je fix
cmp eax, user32base
je fix
cmp codeend, eip
ja done
jmp nexthook

fix:
mov [esp], 287
jmp nexthook

patchcrc:
esti
find eip, #75#, 1
cmp $RESULT, 0
jne skipcrc1
find eip, #4A0F85#, 3
cmp $RESULT, 0
jne skipcrc2
jmp patchcrc

skipcrc1:
mov tmp, $RESULT
add tmp, 2
bphwcall
bphws tmp, "x"
esto
bphwcall
jmp patchcrc2

skipcrc2:
mov tmp, $RESULT
add tmp, 7
bphwcall
bphws tmp, "x"
esto
bphwcall
jmp patchcrc2

patchcrc2:
esti
find eip, #3985#, 2 
cmp $RESULT, 0
je patchcrc2

patchcrc3:
esti
find eip, #0F84#, 2
cmp $RESULT, 0
je patchcrc3
fill eip, 1, 90
fill eip+1, 1, e9
jmp nexthook

done:
bpmc
bc
ret