; Mutable.Win64.Blau!4Z
; by ethical.blue Magazine

extrn VirtualProtect : proc
extrn GetCurrentProcess : proc
extrn FlushInstructionCache : proc
extrn MessageBoxA : proc
extrn ExitProcess : proc

.const
CODE_LENGTH equ 020h
PAGE_EXECUTE_READWRITE equ 040h
NULL equ 0

.data
oldProtect dd 0
e db "ethical.blue Magazine", 0

.code

Main proc

sub rsp, 28h

lea r9, oldProtect
mov r8, PAGE_EXECUTE_READWRITE
mov rdx, CODE_LENGTH
lea rcx, mutable
call VirtualProtect

lea rdx, mutable
mov byte ptr [rdx+00h], 04Dh
mov byte ptr [rdx+0Ah], 048h
mov byte ptr [rdx+11h], 048h
mov byte ptr [rdx+14h], 048h

call GetCurrentProcess

mov r8, CODE_LENGTH
lea rdx, mutable
mov rcx, rax
call FlushInstructionCache

mutable:
db 00Fh, 033h, 0C9h
lea r8, e
db 00Fh
lea edx, e
db 0E8h
xor ecx, ecx
db 00Fh
lea eax, MessageBoxA
call rax

xor rcx, rcx
call ExitProcess

Main endp

end