HD Ban bypass
Does anyone have any ideas?
Code:
10841849 |. 68 E424AC10 PUSH cshell_d.10AC24E4 ; ASCII "\\.\PhysicalDrive%u" 1084184E |. 52 PUSH EDX 1084184F |. E8 0CEFFFFF CALL cshell_d.10840760 10841854 |. 83C4 0C ADD ESP,0C 10841857 |. 53 PUSH EBX ; /hTemplateFile 10841858 |. 68 80000000 PUSH 80 ; |Attributes = NORMAL 1084185D |. 6A 03 PUSH 3 ; |Mode = OPEN_EXISTING 1084185F |. 53 PUSH EBX ; |pSecurity 10841860 |. 6A 03 PUSH 3 ; |ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE 10841862 |. 68 89001200 PUSH 120089 ; |Access = 120089 10841867 |. 8D4424 40 LEA EAX,DWORD PTR SS:[ESP+40] ; | 1084186B |. 50 PUSH EAX ; |FileName 1084186C |. FF15 10329010 CALL DWORD PTR DS:[10903210] ; \CreateFileA 10841872 |. 8BE8 MOV EBP,EAX 10841874 |. 83FD FF CMP EBP,-1 10841877 |. 0F84 B9000000 JE cshell_d.10841936 1084187D |. 53 PUSH EBX ; /pOverlapped 1084187E |. 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] ; | 10841882 |. 51 PUSH ECX ; |pBytesReturned 10841883 |. 6A 08 PUSH 8 ; |OutBufferSize = 8 10841885 |. 33C0 XOR EAX,EAX ; | 10841887 |. 8D5424 1C LEA EDX,DWORD PTR SS:[ESP+1C] ; | 1084188B |. 52 PUSH EDX ; |OutBuffer 1084188C |. 894424 2C MOV DWORD PTR SS:[ESP+2C],EAX ; | 10841890 |. 894424 30 MOV DWORD PTR SS:[ESP+30],EAX ; | 10841894 |. 6A 0C PUSH 0C ; |InBufferSize = C (12.) 10841896 |. 894424 38 MOV DWORD PTR SS:[ESP+38],EAX ; | 1084189A |. 8D4424 30 LEA EAX,DWORD PTR SS:[ESP+30] ; | 1084189E |. 50 PUSH EAX ; |InBuffer 1084189F |. 68 00142D00 PUSH 2D1400 ; |IoControlCode = 2D1400 108418A4 |. 55 PUSH EBP ; |hDevice 108418A5 |. 895C24 30 MOV DWORD PTR SS:[ESP+30],EBX ; | 108418A9 |. 895C24 34 MOV DWORD PTR SS:[ESP+34],EBX ; | 108418AD |. 895C24 3C MOV DWORD PTR SS:[ESP+3C],EBX ; | 108418B1 |. 895C24 40 MOV DWORD PTR SS:[ESP+40],EBX ; | 108418B5 |. FF15 98309010 CALL DWORD PTR DS:[10903098] ; \DeviceIoControl 108418BB |. 85C0 TEST EAX,EAX 108418BD |. 74 70 JE SHORT cshell_d.1084192F 108418BF |. 57 PUSH EDI 108418C0 |. 8B7C24 18 MOV EDI,DWORD PTR SS:[ESP+18] 108418C4 |. 57 PUSH EDI 108418C5 |. E8 C0EDFFFF CALL cshell_d.1084068A 108418CA |. 57 PUSH EDI 108418CB |. 8BF0 MOV ESI,EAX 108418CD |. 53 PUSH EBX 108418CE |. 56 PUSH ESI 108418CF |. E8 92EEFFFF CALL cshell_d.10840766 108418D4 |. 83C4 10 ADD ESP,10 108418D7 |. 53 PUSH EBX ; /pOverlapped 108418D8 |. 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] ; | 108418DC |. 51 PUSH ECX ; |pBytesReturned 108418DD |. 57 PUSH EDI ; |OutBufferSize 108418DE |. 56 PUSH ESI ; |OutBuffer 108418DF |. 6A 0C PUSH 0C ; |InBufferSize = C (12.) 108418E1 |. 8D5424 34 LEA EDX,DWORD PTR SS:[ESP+34] ; | 108418E5 |. 52 PUSH EDX ; |InBuffer 108418E6 |. 68 00142D00 PUSH 2D1400 ; |IoControlCode = 2D1400 108418EB |. 55 PUSH EBP ; |hDevice 108418EC |. FF15 98309010 CALL DWORD PTR DS:[10903098] ; \DeviceIoControl 108418F2 |. 85C0 TEST EAX,EAX 108418F4 |. 5F POP EDI 108418F5 |. 74 2F JE SHORT cshell_d.10841926 108418F7 |. 8B46 18 MOV EAX,DWORD PTR DS:[ESI+18] 108418FA |. 3BC3 CMP EAX,EBX 108418FC |. 74 28 JE SHORT cshell_d.10841926 108418FE |. 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18] 10841902 |. 03C6 ADD EAX,ESI 10841904 |. 2BD0 SUB EDX,EAX 10841906 |> 8A08 /MOV CL,BYTE PTR DS:[EAX] 10841908 |. 880C02 |MOV BYTE PTR DS:[EDX+EAX],CL 1084190B |. 83C0 01 |ADD EAX,1 1084190E |. 3ACB |CMP CL,BL 10841910 |.^75 F4 \JNZ SHORT cshell_d.10841906 10841912 |. 56 PUSH ESI 10841913 |. E8 06EDFFFF CALL cshell_d.1084061E 10841918 |. 83C4 04 ADD ESP,4 1084191B |. 55 PUSH EBP ; /hObject 1084191C |. FF15 18319010 CALL DWORD PTR DS:[10903118] ; \CloseHandle 10841922 |. B0 01 MOV AL,1 10841924 |. EB 12 JMP SHORT cshell_d.10841938 10841926 |> 56 PUSH ESI 10841927 |. E8 F2ECFFFF CALL cshell_d.1084061E 1084192C |. 83C4 04 ADD ESP,4 1084192F |> 55 PUSH EBP ; /hObject 10841930 |. FF15 18319010 CALL DWORD PTR DS:[10903118] ; \CloseHandle 10841936 |> 32C0 XOR AL,AL 10841938 |> 5D POP EBP 10841939 |> 8B8C24 2801000>MOV ECX,DWORD PTR SS:[ESP+128] 10841940 |. 5E POP ESI 10841941 |. 5B POP EBX 10841942 |. 33CC XOR ECX,ESP 10841944 |. E8 31EDFFFF CALL cshell_d.1084067A 10841949 |. 81C4 24010000 ADD ESP,124 1084194F \. C2 0400 RETN 4 10841952 CC INT3 10841953 CC INT3 10841954 CC INT3 10841955 CC INT3 10841956 CC INT3 10841957 CC INT3 10841958 CC INT3 10841959 CC INT3 1084195A CC INT3 1084195B CC INT3 1084195C CC INT3 1084195D CC INT3 1084195E CC INT3 1084195F CC INT3 10841960 /$ 81EC 20010000 SUB ESP,120 10841966 |. A1 54E2B810 MOV EAX,DWORD PTR DS:[10B8E254] 1084196B |. 33C4 XOR EAX,ESP 1084196D |. 898424 1C01000>MOV DWORD PTR SS:[ESP+11C],EAX 10841974 |. 53 PUSH EBX 10841975 |. 56 PUSH ESI 10841976 |. 57 PUSH EDI 10841977 |. 83CF FF OR EDI,FFFFFFFF 1084197A |. E8 51FDFFFF CALL cshell_d.108416D0 1084197F |. 8BF0 MOV ESI,EAX 10841981 |. 33DB XOR EBX,EBX 10841983 |. 83FE FF CMP ESI,-1 10841986 |. 895C24 14 MOV DWORD PTR SS:[ESP+14],EBX 1084198A |. 75 1B JNZ SHORT cshell_d.108419A7 1084198C |> 5F POP EDI 1084198D |. 5E POP ESI 1084198E |. 83C8 FF OR EAX,FFFFFFFF 10841991 |. 5B POP EBX 10841992 |. 8B8C24 1C01000>MOV ECX,DWORD PTR SS:[ESP+11C] 10841999 |. 33CC XOR ECX,ESP 1084199B |. E8 DAECFFFF CALL cshell_d.1084067A 108419A0 |. 81C4 20010000 ADD ESP,120 108419A6 |. C3 RETN 108419A7 |> 68 03010000 PUSH 103 108419AC |. 8D4424 29 LEA EAX,DWORD PTR SS:[ESP+29] 108419B0 |. 53 PUSH EBX 108419B1 |. 50 PUSH EAX 108419B2 |. 885C24 30 MOV BYTE PTR SS:[ESP+30],BL 108419B6 |. E8 ABEDFFFF CALL cshell_d.10840766 108419BB |. 56 PUSH ESI 108419BC |. 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 108419C0 |. 68 E424AC10 PUSH cshell_d.10AC24E4 ; ASCII "\\.\PhysicalDrive%u" 108419C5 |. 51 PUSH ECX 108419C6 |. E8 95EDFFFF CALL cshell_d.10840760 108419CB |. 83C4 18 ADD ESP,18 108419CE |. 53 PUSH EBX ; /hTemplateFile 108419CF |. 68 80000000 PUSH 80 ; |Attributes = NORMAL 108419D4 |. 6A 03 PUSH 3 ; |Mode = OPEN_EXISTING 108419D6 |. 53 PUSH EBX ; |pSecurity 108419D7 |. 6A 03 PUSH 3 ; |ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE 108419D9 |. 68 89001200 PUSH 120089 ; |Access = 120089 108419DE |. 8D5424 3C LEA EDX,DWORD PTR SS:[ESP+3C] ; | 108419E2 |. 52 PUSH EDX ; |FileName 108419E3 |. FF15 10329010 CALL DWORD PTR DS:[10903210] ; \CreateFileA 108419E9 |. 8BF0 MOV ESI,EAX 108419EB |. 83FE FF CMP ESI,-1 108419EE |.^74 9C JE SHORT cshell_d.1084198C 108419F0 |. 33C0 XOR EAX,EAX 108419F2 |. 53 PUSH EBX ; /pOverlapped 108419F3 |. 894424 1C MOV DWORD PTR SS:[ESP+1C],EAX ; | 108419F7 |. 894424 20 MOV DWORD PTR SS:[ESP+20],EAX ; | 108419FB |. 894424 24 MOV DWORD PTR SS:[ESP+24],EAX ; | 108419FF |. 8D4424 18 LEA EAX,DWORD PTR SS:[ESP+18] ; | 10841A03 |. 50 PUSH EAX ; |pBytesReturned 10841A04 |. 6A 08 PUSH 8 ; |OutBufferSize = 8 10841A06 |. 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18] ; | 10841A0A |. 51 PUSH ECX ; |OutBuffer 10841A0B |. 6A 0C PUSH 0C ; |InBufferSize = C (12.) 10841A0D |. 8D5424 2C LEA EDX,DWORD PTR SS:[ESP+2C] ; | 10841A11 |. 52 PUSH EDX ; |InBuffer 10841A12 |. 68 00142D00 PUSH 2D1400 ; |IoControlCode = 2D1400 10841A17 |. 56 PUSH ESI ; |hDevice 10841A18 |. 895C24 2C MOV DWORD PTR SS:[ESP+2C],EBX ; | 10841A1C |. 895C24 30 MOV DWORD PTR SS:[ESP+30],EBX ; | 10841A20 |. 895C24 38 MOV DWORD PTR SS:[ESP+38],EBX ; | 10841A24 |. 895C24 3C MOV DWORD PTR SS:[ESP+3C],EBX ; | 10841A28 |. FF15 98309010 CALL DWORD PTR DS:[10903098] ; \DeviceIoControl 10841A2E |. 85C0 TEST EAX,EAX 10841A30 |. 74 04 JE SHORT cshell_d.10841A36 10841A32 |. 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10] 10841A36 |> 56 PUSH ESI ; /hObject 10841A37 |. FF15 18319010 CALL DWORD PTR DS:[10903118] ; \CloseHandle 10841A3D |. 8B8C24 2801000>MOV ECX,DWORD PTR SS:[ESP+128] 10841A44 |. 8BC7 MOV EAX,EDI 10841A46 |. 5F POP EDI 10841A47 |. 5E POP ESI 10841A48 |. 5B POP EBX 10841A49 |. 33CC XOR ECX,ESP 10841A4B |. E8 2AECFFFF CALL cshell_d.1084067A 10841A50 |. 81C4 20010000 ADD ESP,120 10841A56 \. C3 RETN 10841A57 CC INT3 10841A58 CC INT3 10841A59 CC INT3 10841A5A CC INT3 10841A5B CC INT3 10841A5C CC INT3 10841A5D CC INT3 10841A5E CC INT3 10841A5F CC INT3 10841A60 /$ 6A FF PUSH -1 10841A62 |. 68 3B088F10 PUSH cshell_d.108F083B 10841A67 |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 10841A6D |. 50 PUSH EAX 10841A6E |. 51 PUSH ECX 10841A6F |. A1 54E2B810 MOV EAX,DWORD PTR DS:[10B8E254] 10841A74 |. 33C4 XOR EAX,ESP 10841A76 |. 50 PUSH EAX 10841A77 |. 8D4424 08 LEA EAX,DWORD PTR SS:[ESP+8] 10841A7B |. 64:A3 00000000 MOV DWORD PTR FS:[0],EAX 10841A81 |. 8B0D 08309711 MOV ECX,DWORD PTR DS:[11973008] 10841A87 |. 85C9 TEST ECX,ECX 10841A89 |. 74 26 JE SHORT cshell_d.10841AB1 10841A8B |. 8379 FC 00 CMP DWORD PTR DS:[ECX-4],0 10841A8F |. 8D41 FC LEA EAX,DWORD PTR DS:[ECX-4] 10841A92 |. 74 0A JE SHORT cshell_d.10841A9E 10841A94 |. 8B01 MOV EAX,DWORD PTR DS:[ECX] 10841A96 |. 8B10 MOV EDX,DWORD PTR DS:[EAX] 10841A98 |. 6A 03 PUSH 3 10841A9A |. FFD2 CALL EDX 10841A9C |. EB 09 JMP SHORT cshell_d.10841AA7 10841A9E |> 50 PUSH EAX 10841A9F |. E8 7AEBFFFF CALL cshell_d.1084061E 10841AA4 |. 83C4 04 ADD ESP,4 10841AA7 |> C705 08309711 >MOV DWORD PTR DS:[11973008],0 10841AB1 |> 6A 58 PUSH 58 10841AB3 |. E8 D2EBFFFF CALL cshell_d.1084068A 10841AB8 |. 83C4 04 ADD ESP,4 10841ABB |. 894424 04 MOV DWORD PTR SS:[ESP+4],EAX 10841ABF |. 85C0 TEST EAX,EAX 10841AC1 |. C74424 10 0000>MOV DWORD PTR SS:[ESP+10],0 10841AC9 |. 74 09 JE SHORT cshell_d.10841AD4 10841ACB |. 8BC8 MOV ECX,EAX 10841ACD |. E8 7A020000 CALL cshell_d.10841D4C 10841AD2 |. EB 02 JMP SHORT cshell_d.10841AD6 10841AD4 |> 33C0 XOR EAX,EAX 10841AD6 |> 85C0 TEST EAX,EAX 10841AD8 |. C74424 10 FFFF>MOV DWORD PTR SS:[ESP+10],-1 10841AE0 |. A3 08309711 MOV DWORD PTR DS:[11973008],EAX 10841AE5 |. 75 12 JNZ SHORT cshell_d.10841AF9 10841AE7 |. 32C0 XOR AL,AL 10841AE9 |. 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 10841AED |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX 10841AF4 |. 59 POP ECX 10841AF5 |. 83C4 10 ADD ESP,10 10841AF8 |. C3 RETN 10841AF9 |> 8BC8 MOV ECX,EAX 10841AFB |. E8 1A020000 CALL cshell_d.10841D1A 10841B00 |. B0 01 MOV AL,1 10841B02 |. 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 10841B06 |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX 10841B0D |. 59 POP ECX 10841B0E |. 83C4 10 ADD ESP,10 10841B11 \. C3 RETN 10841B12 CC INT3 10841B13 CC INT3 10841B14 CC INT3 10841B15 CC INT3 10841B16 CC INT3 10841B17 CC INT3 10841B18 CC INT3 10841B19 CC INT3 10841B1A CC INT3 10841B1B CC INT3 10841B1C CC INT3 10841B1D CC INT3 10841B1E CC INT3 10841B1F CC INT3 10841B20 /$ 53 PUSH EBX 10841B21 |. 55 PUSH EBP 10841B22 |. 56 PUSH ESI 10841B23 |. 8B7424 10 MOV ESI,DWORD PTR SS:[ESP+10] 10841B27 |. 56 PUSH ESI 10841B28 |. 8BE9 MOV EBP,ECX 10841B2A |. E8 01FBFFFF CALL cshell_d.10841630 10841B2F |. 3C 01 CMP AL,1 10841B31 |. 75 16 JNZ SHORT cshell_d.10841B49 10841B33 |. 8BC6 MOV EAX,ESI 10841B35 |. 8D50 01 LEA EDX,DWORD PTR DS:[EAX+1] 10841B38 |> 8A08 /MOV CL,BYTE PTR DS:[EAX] 10841B3A |. 83C0 01 |ADD EAX,1 10841B3D |. 84C9 |TEST CL,CL 10841B3F |.^75 F7 \JNZ SHORT cshell_d.10841B38 10841B41 |. 2BC2 SUB EAX,EDX 10841B43 |. 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 10841B47 |. EB 1B JMP SHORT cshell_d.10841B64
