79627236

Date: 2025-05-18 07:40:48
Score: 1
Natty:
Report link

I haven't personally had this problem, but I know better solutions. The InMemoryOrderModuleList already contains user32.dll and ws2_32.dll, so there's no need to perform a LoadLibrary operation—doing so only draws unnecessary attention.

I used to use LoadLibrary, and here’s how I did it:

xor r12, r12
mov r12, 0x6C             ; Push 'l'
push r12
mov r12, 0x6C642E6970617370 ; Push 'psapi.dll' backwards
push r12
mov rcx, rsp              ; RCX points to the DLL string
sub rsp, 0x30             ; Shadow space for the call
call r14                  ; Call LoadLibrary (pointer in r14)
add rsp, 0x30             ; Clean up the stack

In other words, I first pushed the "dll" part, then pushed the rest of the string "psapi", then set rcx to point to the full DLL path on the stack. That way, I could call LoadLibrary easily.

Reasons:
  • Long answer (-0.5):
  • Has code block (-0.5):
  • User mentioned (1): user32
  • Low reputation (1):
Posted by: Kinezi