format PE GUI 4.0 DLL
entry DllEntryPoint

include 'win32a.inc'

section '.code' code readable executable

proc DllEntryPoint uses edi, hinstDLL,fdwReason,lpvReserved
        mov     edi, buffer

        stdcall BackUpProc, WinExec
        stdcall BackUpProc, ZwProtectVirtualMemory
        stdcall BackUpProc, ZwWriteVirtualMemory

        mov     eax, TRUE
        ret
endp

proc BackUpProc uses esi ecx ebx, Original
        mov     ebx, [Original]
        push    edi
        mov     edi, [ebx]

        mov     al, 0x90                ; Getting proc size by first nop
        xor     ecx, ecx
        mov     cl, -1
        repne   scasb
        jne     .Error
        not     cl

        add     ecx, 3
        shr     ecx, 2

        pop     edi

        mov     esi, [ebx]
        mov     [ebx], edi

        mov     eax, ecx
        stosd
        mov     eax, esi
        stosd

        lea     ebx, [ecx*4]
        rep     movsd

        invoke  VirtualProtect, eax, ebx, PAGE_EXECUTE_READWRITE, tmp
  .Error:
        ret
endp

proc RestoreAll
        stdcall RestoreProc, ZwProtectVirtualMemory
        stdcall RestoreProc, ZwWriteVirtualMemory
        stdcall RestoreProc, WinExec
        ret
endp

proc RestoreProc uses esi, Backup
        mov     esi, [Backup]
        mov     esi, [esi]
        mov     ecx, [esi]
        mov     edi, [esi+4]
        add     esi, 8
        rep     movsd
        ret
endp

section '.idata' import data readable writeable

  library ntdll,'NTDLL.DLL',\
          kernel,'KERNEL32.DLL',\
          user,'USER32.DLL'

  import ntdll,\
         ZwProtectVirtualMemory,'ZwProtectVirtualMemory',\
         ZwWriteVirtualMemory,'ZwWriteVirtualMemory'

  import kernel,\
         WinExec,'WinExec',\
         VirtualProtect,'VirtualProtect'

section '.edata' export data readable

  export 'UNHOOK.DLL',\
         RestoreAll,'RestoreAll'

section '.resto' data readable writable

  buffer        rd 1024 ; 1 page
  tmp           dd ?

section '.reloc' fixups data discardable

format PE GUI 4.0
entry start

include 'win32a.inc'

section '.code' code readable executable

  start:
        invoke  MessageBoxA, 0, msg, tit, MB_YESNO

        cmp     eax, IDYES
        jne     .dont_restore
        call    [RestoreAll]
  .dont_restore:

        invoke  WinExec, cmd, SW_SHOW
        invoke  ExitProcess, 0

  cmd           db 'C:\Program Files\Internet Explorer\IEXPLORE.EXE http://antichat.ru', 0
  msg           db 'Do you realy wonna take all the hooks off?', 0
  tit           db 'Do take it off?', 0

section '.idata' import data readable writeable

  library kernel,'KERNEL32.DLL',\
          user,'USER32.DLL',\
          unhook,'UNHOOK.DLL'

  import kernel,\
         ExitProcess,'ExitProcess',\
         WinExec,'WinExec'

  import user,\
         MessageBoxA,'MessageBoxA'

  import unhook,\
         RestoreAll,'RestoreAll'

  xxx   dd ?
  yyy   dd ?