*/
KaOs PE-DLL eXecutable Undetecter Unpacker
Pavka
/*

var counter
var ImageBase
var OEP
var iat_start
mov counter,0
gmi eip,MODULEBASE
mov ImageBase,$RESULT
find eip,#61FF25#
cmp $RESULT,0
je quit
mov OEP,$RESULT+1
bp OEP
find eip,#89043BA1??????0083C704#
cmp $RESULT,0
je quit
fill $RESULT,3,90
mov iat_start,$RESULT
bp iat_start
erun
bc eip
mov iat_start,esi 
erun
bc eip
sti
mov OEP,eip
sub OEP,ImageBase
sub iat_start,ImageBase
mov counter,ImageBase
add counter,3C
mov counter,[counter]
add counter,ImageBase
add counter,28
mov [counter],OEP
add counter,58
mov [counter],iat_start
dpe "dump.exe", eip
MSG "File Unpacked"
ret
quit:
MSG "KaOs PE-DLL eXecutable Undetecte"
ret