I dont tested if this script work but i think it works
dbh
var a
var b
var c
var d
var e
var test
var rva
run
eoe checkme
eob checkme
checkme:
mov b,eip
add b,2
mov b,[b]
cmp b,00058F64
je checklast
esto
checklast:
mov a,ebp
sub a,10
mov a,[a]
cmp a,400000
je found
esto
found:
eob end
eoe end
mov c,[40003C]
add c,100
add c,400000
mov c,[c]
bprm 401000,c
esto
end:
mov a,[eip]
and a,0000FF
cmp a,C3
jne exit
mov test,[esp]
and test,F00000
shr test,14
cmp test,9
jae loop
jmp exit
loop:
eob exit
eoe exit
esto
exit:
sti
mov d,eip
sub d,9
mov eip,d
mov e,[ebp-8]
mov [eip],e
mov d,eip
sub d,1
mov eip,d
mov [eip],#68#
mov d,eip
sub d,2
mov eip,d
mov [eip],#6A60#
dpe "dump.exe",eip
cmt eip,"OEP! Stolen bytes fixed & dumped. Fix IAT with ImpREC!"
mov rva,eip
sub rva,400000
log rva,"RVA of OEP: "
ret
retry:
ret
its a olly script ...