Loot Code

02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 25 26 25 75 ?? ?? ?? ?? 2D ?? D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 25 26 74 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02

02 ldarg.0
7B ?? ?? ?? ?? ldfld <field>
72 ?? ?? ?? ?? ldstr <string>
28 ?? ?? ?? ?? call <method>
25 dup
26 pop
25 dup
75 ?? ?? ?? ?? isinst <class>
2D ?? brtrue.s
D0 ?? ?? ?? ?? ldtoken <token>
28 ?? ?? ?? ?? call <method>
28 ?? ?? ?? ?? call <method>
25 dup
26 pop
74 ?? ?? ?? ?? castclass <class>
28 ?? ?? ?? ?? call <method>
02 ldarg.0

#include <iostream>
#include <fstream>
#include <windows.h>
#include <conio.h>
#include <vector>

using namespace std;

vector<string> get_all_files_names_within_folder(string folder){
    vector<string> names;
    char search_path[200];
    sprintf(search_path, "%s*.*", folder.c_str());
    WIN32_FIND_DATA fd;
    HANDLE hFind = ::FindFirstFile(search_path, &fd);
    if(hFind != INVALID_HANDLE_VALUE) {
        do{
            if(! (fd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) ){
                names.push_back(fd.cFileName);

            }
        }while(::FindNextFile(hFind, &fd));
        ::FindClose(hFind);
    }
    return names;
}

bool isstart(string tmp){
    if(tmp[0]=='L' and tmp[1]=='_' and tmp[6]==':')
        return true;
    return false;
}

bool checkword(string tmp,int &state){
    switch(state){
    case 0: if(tmp=="ldfld")state++;else state=0;break;
    case 1: if(tmp=="ldstr")state++;else {state=0;checkword(tmp,state);}break;
    case 2: if(tmp=="call")state++;else {state=0;checkword(tmp,state);}break;
    case 3: if(tmp=="dup")state++;else {state=0;checkword(tmp,state);}break;
    case 4: if(tmp=="pop")state++;else {state=0;checkword(tmp,state);}break;
    case 5: if(tmp=="dup")state++;else {state=0;checkword(tmp,state);}break;
    case 6: if(tmp=="isinst")state++;else {state=0;checkword(tmp,state);}break;
    case 7: if(tmp=="brtrue.s")state++;else {state=0;checkword(tmp,state);}break;
    case 8: if(tmp=="ldtoken")state++;else {state=0;checkword(tmp,state);}break;
    case 9: if(tmp=="call")state++;else {state=0;checkword(tmp,state);}break;
    case 10: if(tmp=="call")state++;else {state=0;checkword(tmp,state);}break;
    case 11: if(tmp=="dup")state++;else {state=0;checkword(tmp,state);}break;
    case 12: if(tmp=="pop")state++;else {state=0;checkword(tmp,state);}break;
    case 13: if(tmp=="castclass")state++;else {state=0;checkword(tmp,state);}break;
    case 14: if(tmp=="call")state++;else {state=0;checkword(tmp,state);}break;
    default:break;
    }
    if(state==15){
        state=0;
        cout<<" - Here\n";
        getch();
        return true;
    }
    return false;
}

int main()
{
    string patch="C:\\Users\\User\\Desktop\\deadff\\";
    string cfile;
    vector<string> files=get_all_files_names_within_folder(patch);
    for(int i=0;i<files.size();i++){
        bool fnd=false;
        cout<<files[i];
        cfile=patch+files[i];
        fstream f(cfile.c_str(),ios::in);
        string tmp;
        int state=0;
        while(!f.eof()){
            f>>tmp;
            if(isstart(tmp)){
                f>>tmp;
                if(checkword(tmp,state)){
                    fnd=true;
                    break;
                }
            }
        }
        if(!fnd)
            cout<<" - no\n";
        f.close();
    }
    return 0;
}