; MessageBoxA Shellcode
;
; By Peter Winter-Smith [peter4020@hotmail.com]
;
; For reliability, just use the 'vampiric' method of finding
; LoadLibraryA and GetProcAddress offsets, instead of my
; hardcoded WinXP Home SP1 addresses!


bits 32

jmp short data

continue:

pop edi

push ebp
mov ebp, esp
add esp, -16

push edi

xor edx, edx
mov ecx, 0ffffffffh

mov dl, 5

cld
mov al, 0ffh

nullify:

repne scasb
inc byte [edi-1]
push edi

dec dl
cmp dl, 1
jne nullify

sub esp, -4
mov ebx, esp

push dword [ebx+12]

mov esi, 77e7d961h
call esi ;LOADLIBRARYA

push dword [ebx+8]
push eax

mov esi, 77e7b332h
call esi ;GETPROCADDRESS

xor ecx, ecx

push ecx
push dword [ebx+4]
push dword [ebx]
push ecx

call eax

int3


data:

call continue

db "user32.dll",0ffh
db "MessageBoxA",0ffh
db "Title",0ffh
db "Caption",0ffh