|
|
|---|---|
|
|
00404C19 55 PUSH EBP
00404C1A 8BEC MOV EBP,ESP 00404C1C 6A FF PUSH -1 00404C1E 68 30D84100 PUSH eXPresso.0041D830 00404C23 68 547D4000 PUSH eXPresso.00407D54 00404C28 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 00404C2E 50 PUSH EAX 00404C2F 64:8925 00000000 MOV DWORD PTR FS:[0],ESP 00404C36 83EC 58 SUB ESP,58 00404C39 53 PUSH EBX 00404C3A 56 PUSH ESI 00404C3B 57 PUSH EDI 00404C3C 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP 00404C3F FF15 CCC14100 CALL DWORD PTR DS:[41C1CC] ; KERNEL32.GetVersion 00404C45 33D2 XOR EDX,EDX 00404C47 8AD4 MOV DL,AH 00404C49 8915 348D4200 MOV DWORD PTR DS:[428D34],EDX 00404C4F 8BC8 MOV ECX,EAX 00404C51 81E1 FF000000 AND ECX,0FF 00404C57 890D 308D4200 MOV DWORD PTR DS:[428D30],ECX 00404C5D C1E1 08 SHL ECX,8 00404C60 03CA ADD ECX,EDX 00404C62 890D 2C8D4200 MOV DWORD PTR DS:[428D2C],ECX 00404C68 C1E8 10 SHR EAX,10 00404C6B A3 288D4200 MOV DWORD PTR DS:[428D28],EAX 00404C70 6A 01 PUSH 1 00404C72 E8 C51D0000 CALL eXPresso.00406A3C 00404C77 59 POP ECX 00404C78 85C0 TEST EAX,EAX 00404C7A 75 08 JNZ SHORT eXPresso.00404C84 00404C7C 6A 1C PUSH 1C 00404C7E E8 C3000000 CALL eXPresso.00404D46 00404C83 59 POP ECX 00404C84 E8 133A0000 CALL eXPresso.0040869C 00404C89 85C0 TEST EAX,EAX 00404C8B 75 08 JNZ SHORT eXPresso.00404C95 00404C8D 6A 10 PUSH 10 00404C8F E8 B2000000 CALL eXPresso.00404D46 00404C94 59 POP ECX 00404C95 33F6 XOR ESI,ESI 00404C97 8975 FC MOV DWORD PTR SS:[EBP-4],ESI 00404C9A E8 B9440000 CALL eXPresso.00409158 00404C9F FF15 CCC04100 CALL DWORD PTR DS:[41C0CC] ; KERNEL32.GetCommandLineA 00404CA5 A3 58A44200 MOV DWORD PTR DS:[42A458],EAX 00404CAA E8 77430000 CALL eXPresso.00409026 00404CAF A3 108D4200 MOV DWORD PTR DS:[428D10],EAX 00404CB4 E8 20410000 CALL eXPresso.00408DD9 00404CB9 E8 62400000 CALL eXPresso.00408D20 00404CBE E8 0C0E0000 CALL eXPresso.00405ACF 00404CC3 8975 D0 MOV DWORD PTR SS:[EBP-30],ESI 00404CC6 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C] 00404CC9 50 PUSH EAX 00404CCA FF15 C8C04100 CALL DWORD PTR DS:[41C0C8] ; KERNEL32.GetStartupInfoA 00404CD0 E8 F33F0000 CALL eXPresso.00408CC8 00404CD5 8945 9C MOV DWORD PTR SS:[EBP-64],EAX 00404CD8 F645 D0 01 TEST BYTE PTR SS:[EBP-30],1 00404CDC 74 06 JE SHORT eXPresso.00404CE4 00404CDE 0FB745 D4 MOVZX EAX,WORD PTR SS:[EBP-2C] 00404CE2 EB 03 JMP SHORT eXPresso.00404CE7 00404CE4 6A 0A PUSH 0A 00404CE6 58 POP EAX 00404CE7 50 PUSH EAX 00404CE8 FF75 9C PUSH DWORD PTR SS:[EBP-64] 00404CEB 56 PUSH ESI 00404CEC 56 PUSH ESI 00404CED FF15 E4C14100 CALL DWORD PTR DS:[41C1E4] ; KERNEL32.GetModuleHandleA 00404CF3 50 PUSH EAX ..... 00404D0E E8 3D3E0000 CALL eXPresso.00408B50 00404D13 59 POP ECX 00404D14 59 POP ECX 00404D15 C3 RETN 00404D16 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18] 00404D19 FF75 98 PUSH DWORD PTR SS:[EBP-68] 00404D1C E8 EC0D0000 CALL eXPresso.00405B0D 00404D21 833D 188D4200 01 CMP DWORD PTR DS:[428D18],1 00404D28 75 05 JNZ SHORT eXPresso.00404D2F 00404D2A E8 E5450000 CALL eXPresso.00409314 00404D2F FF7424 04 PUSH DWORD PTR SS:[ESP+4] 00404D33 E8 15460000 CALL eXPresso.0040934D 00404D38 68 FF000000 PUSH 0FF 00404D3D FF15 F8174200 CALL DWORD PTR DS:[4217F8] ; eXPresso.00405B0D 00404D43 59 POP ECX 00404D44 59 POP ECX 00404D45 C3 RETN 00404D46 833D 188D4200 01 CMP DWORD PTR DS:[428D18],1 00404D4D 75 05 JNZ SHORT eXPresso.00404D54 00404D4F E8 C0450000 CALL eXPresso.00409314 00404D54 FF7424 04 PUSH DWORD PTR SS:[ESP+4] 00404D58 E8 F0450000 CALL eXPresso.0040934D 00404D5D 59 POP ECX 00404D5E 68 FF000000 PUSH 0FF 00404D63 FF15 D0C04100 CALL DWORD PTR DS:[41C0D0] ; KERNEL32.ExitProcess 小脱了一下，，， 入口到是不难找 
|
|
|
|
