https://pastein.ru/t/IuT
Загрузка данных
1-
Mapper
Reading arguments, parsing monoFunctions: {mono_get_root_domain: O, mono_thread_attach: 0, mono_image_open_from_data: 0, mono_assembly_load_from_full: 0, mono_assembly_get_image: 0, mono_class_from_name: 0, mono_class_get_method_from_name: 0, mono_runtime_invoke: 0, mono_assembly_close: 0, mono_image_strerror: 0, mono_object_get_class: 0, mono_class_get_name: 0}
2-
Mapper
Reading arguments, parsing methods: {LoadLibraryW: 1987647840, FreeLibrary: 1987644800, GetLastError: 1987633840,
LdrControlFlowGuardEnforced: 2009465888, RtlAcquirePebLock: 2009575584, RtIReleasePebLock: 2009573296, NtAllocateVirtualMemory: 140725886441616, NtQueryObject: 140725886441360, NtFreeVirtualMemory: 140725886441808, NtWriteVirtualMemory: 140725886442704, NtReadVirtual Memory: 140725886442864, RtICreateUserThread: 140725886093184, NtProtectVirtualMemory: 140725886443408, NtQueryInformationThread: 140725886442032, NtQueryInformation Process: 140725886441648, NtQueryVirtualMemory: 140725886441968, NtDuplicateObject: 140725886442768,
NtOpenProcess: 140725886442064, NtOpenThread: 140725886450528, NtClose: 140725886441328, NtQuerySystemInformation: 140725886442576, NtSetInformationVirtualMemory: 140725886454144}
3-
Mapper
Reading arguments, parsing loadConfigsDirectoryData
4-
Mapper
initial library hash is: 574b5721bc8b7facbe32133316cebb68
5-
Mapper
Trying to allocate the image, libraryBaseSize is: 0xD15000
6-
Mapper
Calling Relocate method with: 0x40FF0000 address, library size: 13705728
7-
Mapper
Library hash after the relocation is: 04feb786a3de32e48a4ddb07446ddd52
8-
Mapper
Trying to allocate the loader entry
9-
Mapper
Trying to load dependencies, total amount of dependencies to be loaded: 2
10-
Mapper
Using default assembler option :c
11-
Mapper
Difference for this assembler, alive = true: (rv: 1347092480, ss: false, st: WaitForAssemblerAnswer.executed) execution is 8ms. Wait: 0 (0)
12-
Mapper
Caching dependency loading result: 1347092480, library: C:\Windows\SysWOW64\msvcp140.dll
13-
Mapper
Using default assembler option :c
14-
Mapper
Difference for this assembler, alive = true: (rv: 1346961408, ss: false, st: _WaitForAssemblerAnswer.executed) execution is 1ms. Wait: 0 (0)
15-
Mapper
Caching dependency loading result: 1346961408, library: C:\Windows\SysWOW64\vcruntime140.dll
16-
Mapper
Calling InsertimportFunctions method, default: (KERNEL32.dll: [{Name: Sleep, Offset: 1789972, Ordinal: 1464}, {Name: GetConsoleWindow, Offset: 1789976, Ordinal: 554}, {Name: FreeConsole, Offset: 1789980, Ordinal: 459}, {Name: AllocConsole, Offset: 1789984, Ordinal: 22}, {Name: SetConsoleTitleA, Offset: 1789988, Ordinal: 1337}, {Name: DisableThreadLibraryCalls, Offset: 1789992, Ordinal: 318), (Name: CloseHandle, Offset: 1789996, Ordinal: 157}, {Name: CreateThread, Offset: 1790000, Ordinal: 272}, {Name: GetProcAddress, Offset: 1790004, Ordinal: 726}, {Name: FindResourceW, Offset: 1790008, Ordinal: 440}, {Name: LoadResource, Offset: 1790012, Ordinal: 1015}, {Name: LockResource, Offset: 1790016, Ordinal: 1035}, {Name: SizeofResource, Offset: 1790020, Ordinal: 1463}, {Name: WriteProcessMemory, Offset: 1790024, Ordinal: 1624}, {Name: GetCurrentProcess, Offset: 1790028, Ordinal: 571}, {Name: LoadLibraryA, Offset: 1790032, Ordinal: 1009}, {Name: GetModuleHandleA, Offset: 1790036, Ordinal: 668}, {Name: SetThreadContext, Offset: 1790040, Ordinal: 1422}, {Name: ResumeThread, Offset: 1790044, Ordinal: 1283}, {Name: GetSystemTimeAsFileTime, Offset: 1790048, Ordinal: 787}, {Name: GetCurrentProcessld, Offset: 1790052, Ordinal: 572}, {Name: SetEnvironmentVariableW, Offset: 1790056, Ordinal: 1354}, {Name: AcquireSRWLockExclusive, Offset: 1790060, Ordinal: 0}, {Name: InitializeSListHead, Offset: 1790064, Ordinal: 913}, {Name: GetCurrentThreadid, Offset: 1790068, Ordinal: 576}, {Name: QueryPerformanceCounter, Offset: 1790072, Ordinal: 1150}, {Name: VirtualProtect, Offset: 1790076, Ordinal: 1545}, {Name: GetLastError, Offset: 1790080, Ordinal: 647}, {Name: VirtualAlloc, Offset: 1790084, Ordinal: 1539}, {Name: VirtualQuery, Offset: 1790088, Ordinal: 1547}, {Name: AddVectoredExceptionHandler, Offset: 1790092, Ordinal: 20}, {Name: WakeAllConditionVariable, Offset: 1790096, Ordinal: 1564}, {Name: SleepConditionVariableSRW, Offset: 1790100, Ordinal: 1466}, {Name: UnhandledExceptionFilter, Offset: 1790104, Ordinal: 1514}, {Name: SetUnhandledExceptionFilter, Offset: 1790108, Ordinal: 1448}, {Name: TerminateProcess, Offset: 1790112, Ordinal: 1480}, {Name: IsProcessorFeaturePresent, Offset: 1790116, Ordinal: 949}, {Name: IsDebuggerPresent, Offset: 1790120, Ordinal: 941}, {Name: ReleaseSRWLockExclusive, Offset: 1790124, Ordinal: 1254}], USER32.dll: [{Name: MessageBoxW, Offset: 1790244, Ordinal: 661}, {Name: FindWindowA, Offset: 1790248, Ordinal: 280}, {Name: MessageBoxA, Offset: 1790252, Ordinal: 654}, {Name: PostMessageA, Offset: 1790256, Ordinal: 695}], ADVAPI32.dll: [[Name: RegDeleteValueW, Offset: 1789952, Ordinal: 621}, {Name: RegQueryValueExW, Offset: 1789956, Ordinal: 659}, {Name: RegOpenKeyW, Offset: 1789960, Ordinal: 649}, {Name: RegCloseKey, Offset: 1789964, Ordinal: 597}], MSVCP140.dll: [{Name: ?tie@?$basic_ios@DU?Schar_traits @D@std@@@std@@QBEPAV?Sbasic_ostream@DU?$char_traits @D@std@@@2@XZ, Offset: 1790132, Ordinal: 1290}, {Name: ?_Osfx@?$basic_ostream@DU?$char_traits @D@std@@@std@@QAEXXZ, Offset: 1790136, Ordinal: 580}, {Name: ?flush@?$basic_ostream@DU?$char_traits @D@std@@@std@@QAEAAV12@XZ, Offset: 1790140, Ordinal: 872}, {Name: ?setstate@?Sbasic_ios@DU?Schar_traits @D@std@@@std@@QAEXH_N@Z, Offset: 1790144, Ordinal: 1221}, {Name: ?fill@?Sbasic_ios@DU?Schar_traits@D@std@@@std@@QBEDXZ, Offset: 1790148, Ordinal: 865}, {Name: ??6?$basic_ostream@DU?$char_traits @D@std@@@std@@QAEAAV01@K@Z, Offset: 1790152, Ordinal: 258}, {Name: ?_Xlength_error@std@@YAXPBD@Z, Offset: 1790156, Ordinal: 654}, {Name: ? Throw_Cpp_error@std@@YAXH@Z, Offset: 1790160, Ordinal: 629}, {Name: Thrd_detach, Offset: 1790164, Ordinal: 1456}, {Name: ?_Xout_of_range@std@@YAXPBD@Z, Offset: 1790168, Ordinal: 655}, {Name: ?sputn@?Sbasic_streambuf@DU?Schar_traits @D@std@@@std@@QAE_JPBD_J@Z, Offset: 1790172, Ordinal: 1249}, {Name: ?setf@ios_base@std@@QAEHHH@Z, Offset: 1790176, Ordinal: 1209}, {Name: ? Xbad_function_call@std@@YAXXZ, Offset: 1790180, Ordinal: 652), (Name: _Cnd_do_broadcast_at_thread_exit, Offset: 1790184, Ordinal: 1358}, {Name: ??6?$basic_ostream@DU?Schar_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z, Offset: 1790188, Ordinal: 264}, {Name: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@QAEAAV01@H@Z, Offset: 1790192, Ordinal: 255}, {Name: ??6?$basic_ostream@DU?$char_traits @D@std@@@std@@QAEAAV01@I@Z, Offset: 1790196, Ordinal: 256}, {Name: ??6?Sbasic_ostream@DU?Schar_traits @D@std@@@std@@QAEAAV01@_K@Z, Offset: 1790200, Ordinal: 268}, {Name: ?width@ios_base@std@@QAE_J_J@Z, Offset: 1790204, Ordinal: 1341}, {Name: ?sputc@?Sbasic_streambuf@DU?Schar_traits @D@std@@@std@@QAEHD@Z, Offset: 1790208, Ordinal: 1246}, {Name: ?flags@ios_base@std@@QBEHXZ, Offset: 1790212, Ordinal: 871}, {Name: ?good@ios_base@std@@QBE_NXZ, Offset: 1790216, Ordinal: 965}, {Name: ?uncaught exceptions@std@@YAHXZ, Offset: 1790220, Ordinal: 1311}, {Name: ?rdbuf@?Sbasic_ios@DU?Schar_traits @D@std@@@std@@QBEPAV?$basic_streambuf@DU?Schar_traits @D@std@@@2@XZ, Offset: 1790224, Ordinal: 1159}, {Name: ?cout@std@@3V?Sbasic_ostream@DU?$char_traits @D@std@@@1@A, Offset: 1790228, Ordinal: 692}, {Name: ?_Xinvalid_argument@std@@YAXPBD@Z, Offset: 1790232, Ordinal: 653}, {Name: ?width@ios_base@std@@QBE_JXZ, Offset: 1790236, Ordinal: 1342}], VCRUNTIME140.dll: [{Name: memcpy, Offset: 1790264, Ordinal: 70}, {Name: __current_exception, Offset: 1790268, Ordinal: 28}, {Name: __current_exception_context, Offset: 1790272, Ordinal: 29}, {Name: _CxxThrowException, Offset: 1790276, Ordinal: 1}, {Name: __std_exception_copy, Offset: 1790280, Ordinal: 33}, {Name: __std_exception_destroy, Offset: 1790284, Ordinal: 34}, {Name: _except_handler4_common, Offset: 1790288, Ordinal: 53}, {Name: __std_type_info_destroy_list, Offset: 1790292, Ordinal: 37}, {Name: __CxxFrameHandler3, Offset: 1790296, Ordinal: 16}, {Name: memmove, Offset: 1790300, Ordinal: 71}, {Name: memset, Offset: 1790304, Ordinal: 72}], api-ms-win-crt-runtime-11-1-0.dll: [[Name: _seh_filter_dll, Offset: 1790368, Ordinal: 65}, {Name: system, Offset: 1790372, Ordinal: 105}, {Name: _initterm_e, Offset: 1790376, Ordinal: 57}, {Name: _initterm, Offset: 1790380, Ordinal: 56}, {Name: cexit, Offset: 1790384, Ordinal: 23}, {Name: _execute_onexit_table, Offset: 1790388, Ordinal: 36}, {Name: _register_onexit_function, Offset: 1790392, Ordinal: 62}, {Name: _initialize_onexit_table, Offset: 1790396, Ordinal: 54}, {Name: _initialize_narrow_environment, Offset: 1790400, Ordinal: 53}, {Name: _configure_narrow_argv, Offset: 1790404, Ordinal: 25}, {Name: _crt_atexit, Offset: 1790408, Ordinal: 31}, {Name: _beginthreadex, Offset: 1790412, Ordinal: 21}, {Name: _invalid_parameter_noinfo_noreturn, Offset: 1790416, Ordinal: 59}, {Name: _errno, Offset: 1790420, Ordinal: 35}, {Name: terminate, Offset: 1790424, Ordinal: 106}], api-ms-win-crt-stdio-l1-1-0.dll: [Name: __acrt_iob_func, Offset: 1790432, Ordinal: 0}, {Name: fclose, Offset: 1790436, Ordinal: 116}, {Name: freopen, Offset: 1790440, Ordinal: 133}, {Name: __stdio_common_vsprintf, Offset: 1790444, Ordinal: 13}], api-ms-win-crt-heap-l1-1-0.dll: [[Name: malloc, Offset: 1790332, Ordinal: 25}, {Name: free, Offset: 1790336, Ordinal: 24}, {Name: realloc, Offset: 1790340, Ordinal: 26}, {Name: _callnewh, Offset: 1790344, Ordinal: 8}], api-ms-win-crt-convert-l1-1-0.dll: [{Name: strtoull, Offset: 1790312, Ordinal: 101}, {Name: strtoll, Offset: 1790316, Ordinal: 99}, {Name: strtod, Offset: 1790320, Ordinal: 94}, {Name: strtoul, Offset: 1790324, Ordinal: 100}], api-ms-win-crt-locale-l1-1-0.dll: [[Name: localeconv, Offset: 1790352, Ordinal: 18}], api-ms-win-crt-math-l1-1-0.dll: [[Name: _dclass, Offset: 1790360, Ordinal: 53}]}+ delayed: {}
17-
Mapper
Refreshing virtual modules list...
18-
Mapper
Library hash after the imports insertion is: e19df6cb8f607003f9a46feaafb36f07
19-
Mapper
Calling PassHeaders method.
20-
Mapper
Trying to map headers, size: [1024/1024]
21-
Calling PassSections method.
22-
Mapper
Trying to map image sections (4/4)
23-
Mapper
Proccesing debug directory...
24-
Mapper
Debug directory cleaning is skipped because CleanupDebugDir flag is missing
25-
Mapper
A ControlFlowGuard initialization is not enabled via flags, skipping this step...
26-
Mapper
Trying to initialize security cookie.
27-
Mapper
Library check for SEH requirement: Dir = 0x0, size (int) = 0 (verdict: false); SEHandler: 0x101B99EC, count (int) = 80 (verdict: true); Characteristics: Ox140 (verdict: true)
28-
Mapper
RegisterSehExceptions flag is not present, skipping this part...
29-
Mapper
Trying to initialize TLS data, LdrEntryAddress is: 0x2D10000
30-
Mapper
Found function LdrpHandleTIsData at 0x51183 (0x77C61183)
31-
Mapper
Using default assembler option :c
32-
Mapper
Difference for this assembler, alive = true: (rv: 0, ss: false, st: _WaitForAssemblerAnswer.executed) execution is 1ms. Wait: 0 (0)
33-
Mapper
CRT callbacks are skipped because callCRTCallbacks flag is not specified
34-
Mapper
Trying to execute library' EntryPoint at 0x41198502. EntryPointData: 0x1A8502 + 0x40FF0000. PreCalls: (0/0 + 9)
35-
Using default assembler option :c
36-
Mapper
Difference for this assembler, alive = true: (rv: 1, ss: false, st: _WaitForAssemblerAnswer.executed) execution is 87ms. Wait: 0 (0)
csgo.exe alt procces -
enigma (t.me/animstate)
--------
>> allocating memory ok [0x43310000]
>> mapping binary ok [0x43310000]
>> waiting for engine ok
>> fixing imports ok [1799 total]
>> exception handler ok
>> recompiling vm ok
ready. powered by enigma: t.me/animstate
