Xikug's protecterv0.3 unpacking tut-加壳脱壳-看雪-安全社区|安全招聘|kanxue.com

Xikug's protecterv0.3 unpacking tut

发表于: 2005-2-25 12:52 9079

Xikug's protecterv0.3 unpacking tut

loveboom

2005-2-25 12:52

9079

Xikug’s Protecter v0.3
【目    标】:XiKug’s Protecter v0.3主程序
【工    具】:Olydbg1.1(diy版)、LORDPE、ImportREC1.6F
【任    务】:分析外壳
【操作平台】:WinXP sp2
【作    者】: LOVEBOOM[DFCG][FCG][US]
【相关链接】: 自己去上网搜搜
【简要说明】：这个壳看是看过几次，只是以前没有时间去”细细的品味”，今天下定决心看个清楚。
【详细过程】:
设置：去掉忽略int3异常其它全部打勾。
载入前先写一点脚本方便后面分析代码.脚本如下：
repl eip,#E807000000????83C013EB0B58EB02????83C002EB01??50C3??#,#9090909090909090909090909090909090909090909090909090#,1000
repl eip,#E803000000??????58EB01??83C00750C3????#,#90909090909090909090909090909090909090#,1000
repl eip,#E808000000????83C00F50C3??5883C002FFE0??????#,#90909090909090909090909090909090909090909090#,1000
repl eip,#E8160000008B5C240C8BA3C4000000648F050000000083C404EB1464FF35000000006489250000000033C999F7F1??#,#9090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090#,1000
repl eip,#33F6E8100000008B642408648F050000000058EB13????64FF350000000064892500000000AD????#,#90909090909090909090909090909090909090909090909090909090909090909090909090909090#,1000
repl eip,#B904000000E81F000000????E816000000??EBF8????58EB09????E8F2FFFFFF????4975F1EB05EBF9EBF0??#,#9090909090909090909090909090909090909090909090909090909090909090909090909090909090909090#,1000
repl eip,#EB01??31F0EB0C33C8EB03EB09??59740575F851EBF1#,#90909090909090909090909090909090909090909090#,1000
ret

写完后用OD载入目标程序。
去掉垃圾代码然后在.Xikug那个段处下内存访问断点,F9运行之.到这里断下:
004A3121 E8 00000000    CALL 004A3126                         ; 这里壳代码开始处,上面的全部是垃圾代码来的
004A3126 5D             POP EBP
004A3127 81ED 26514000    SUB EBP,00405126                      ; 计算EBP的值
004A312D 89AD F6BD4000    MOV DWORD PTR SS:[EBP+40BDF6],EBP       ; 断下在这里
......
004A3149 8D85 60524000 LEA EAX,DWORD PTR SS:[EBP+405260]       ; 要解压的起始地址4a3260
004A314F 8D8D 04BA4000 LEA ECX,DWORD PTR SS:[EBP+40BA04]       ; INT3后面的JMP　OEP代码结束地址4a9a04
004A3155 8D95 81974000 LEA EDX,DWORD PTR SS:[EBP+409781]       ; INT3异常后的起始地址4a7781
004A315B EB 0B          JMP SHORT 004A3168
004A315D 8030 58       XOR BYTE PTR DS:[EAX],58                ; 很简单的解密方式 opcode xor 58("X")而已
004A3160 3BC2          CMP EAX,EDX                            ; 判断是否为IN3后面的代码，如果是则解密后再 opcode xor 52加密,
004A3162 72 03          JB SHORT 004A3167                      ; 壳后面把自己当成调试器后再xor 52还原代码,这里跳就不会再加密代码
004A3164 8030 52       XOR BYTE PTR DS:[EAX],52
004A3167 40             INC EAX
004A3168 3BC1          CMP EAX,ECX                            ; 判断有没有解密完，没有则跳
004A316A  ^ 72 F1          JB SHORT 004A315D

到这里就可以先把4A7781到4a9a04处的代码复制下来:

33 C9 8B 9D FE C1 40 00 EB 15 FF 34 8B FF B5 F6 BD 40 00 FF B5 DE BD 40 00 E8 DE 78 FF FF 41 3B
8D FA C1 40 00 72 E3 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C B9 04 00
00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49
75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9
50 C3 E8 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F
00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05
EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8
07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F
00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05
EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 EB 01 0F 31 F0 EB 0C 33
C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9
EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7
84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35
E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C E8 07 00 00 00 C7 83 83 C0 13
EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74
05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F
25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16
00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 08
00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C B9 04 00 00 00 E8 1F 00 00 00 EB FA
E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6
E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 03 00 00 00 C7
84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8
51 EB F1 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 03 00
00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00
00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9 04 00 00
00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75
F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04
00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9
49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00
00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00
00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9
EB F0 D6 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C
33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00
E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00
C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83
C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB
09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 08 00 00 00 0F 01 83 C0 0F 50 C3
FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1
B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF
0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8
07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F
00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05
EB F9 EB F0 D6 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0
EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00
00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9 04 00
00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49
75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9
50 C3 E8 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C
33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05
75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25
E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00
00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00
00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 08 00 00 00 0F 01 83 C0
0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8
51 EB F1 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C B9 04 00 00 00 E8 1F
00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05
EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83
C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F
59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB
09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB
09 0F 59 74 05 75 F8 51 EB F1 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 EB 01 0F
31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58
EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0
02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09
0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83
C0 07 50 C3 FF 35 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00
00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75
F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00
C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF
E0 0F 01 0C E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 EB 01
0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA
E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6
B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF
0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8
08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03
EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00
00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0
13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83
C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00
00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49
75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9
50 C3 E8 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00
00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49
75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 EB 01 0F 31
F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16
00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03
00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07
50 C3 FF 35 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C E8 07 00 00 00 C7
83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB
09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00
58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9 04 00 00 00 E8 1F 00 00 00
EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB
F0 D6 8B C5 8B 95 2A C2 40 00 33 95 02 C2 40 00 89 95 02 C2 40 00 5F 5A 59 5E 5B 5D 05 FA 11 40
00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 2D FA 11 40 00 FF B0 02 C2 40 00 EB 01 0F 31 F0
EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00
00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00
00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
C3 FF 35 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C E8 07 00 00 00 C7 83
83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09
0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58
EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9 04 00 00 00 E8 1F 00 00 00 EB
FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0
D6 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C B9 04 00 00 00 E8 1F 00 00
00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9
EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 03 00
00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74
05 75 F8 51 EB F1 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8
E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8
16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9
04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F
B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB
F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF
FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35
E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8
1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB
05 EB F9 EB F0 D6 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31
F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16
00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03
00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02
CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00
00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 08 00 00 00 0F 01 83 C0
0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8
51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2
FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3
FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00
00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75
F1 EB 05 EB F9 EB F0 D6 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01
0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA
E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6
B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF
0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02
EB 01 E9 50 C3 E8 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31
F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F
59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB
09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9 04 00 00 00 E8 1F 00 00 00 EB FA
E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6
E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 08 00 00 00 0F
01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74
05 75 F8 51 EB F1 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00
00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75
F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00
C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB
FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0
D6 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8
EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB
F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84
00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02
EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F
25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58
83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04
00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9
49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00
00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00
00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9
EB F0 D6 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C
33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00
E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9 04 00 00 00
E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1
EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3
E8 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8
EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8
51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2
FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00
E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00
C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 08 00 00 00 0F 01 83 C0 0F 50
C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB
F1 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 EB 01 0F 31 F0
EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00
00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00
00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 03 00 00 00 C7 84 00 58
EB 01 E9 83 C0 07 50 C3 FF 35 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C
33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89
25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4
04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64
24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8
16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00
00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00
58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B
A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33
C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00
00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00
00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10
00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00
00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64
FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F
05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00 00 00
8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25
00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7
83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00
00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1
E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64
89 25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83
C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B
64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20
E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00
00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00
00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C
8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00
33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35
00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05
00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8
10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00
00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14
64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64
8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00 00
00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89
25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13
C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00
00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7
F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00
64 89 25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00
83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00
8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD
20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00
00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00
00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24
0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00
00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF
35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F
05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6
E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00
00 00 00 AD CD 20 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB
14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08
64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 16 00
00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64
89 25 00 00 00 00 33 C9 99 F7 F1 E9 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB
13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 08 00 00 00 0F 01 83 C0 0F 50 C3
FF 58 83 C0 02 FF E0 0F 01 0C B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00
58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB
01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9
50 C3 E8 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F
00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05
EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 03 00 00 00
C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75
F8 51 EB F1 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C B9 04 00 00 00 E8
1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB
05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8
E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09
0F 59 74 05 75 F8 51 EB F1 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9
50 C3 E8 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 B9 04 00 00 00 E8 1F 00 00 00
EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB
F0 D6 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF
FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF
E0 0F 01 0C B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8
F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 EB 01 0F
31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8
16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB
01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 03 00 00 00 C7 84 00 58 EB 01
E9 83 C0 07 50 C3 FF 35 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 EB 01
0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 07 00 00 00 C7 83 83 C0 13 EB 0B
58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF
35 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF
FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB
F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 08 00 00 00 0F 01
83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00
E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 03 00 00 00
C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83
C0 02 EB 01 E9 50 C3 E8 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04
00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9
49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1
E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09
0F 59 74 05 75 F8 51 EB F1 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 08 00 00
00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F
59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB
09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B
58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF
E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8
1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB
05 EB F9 EB F0 D6 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 08 00 00 00 0F 01
83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01 0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05
75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25
E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02
CD 20 83 C0 02 EB 01 E9 50 C3 E8 E8 08 00 00 00 0F 01 83 C0 0F 50 C3 FF 58 83 C0 02 FF E0 0F 01
0C EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00
00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9
EB F0 D6 C3
......
004A3260 8B4424 18    MOV EAX,DWORD PTR SS:[ESP+18]          ; 准备取KERNEL32.dll的hModule
004A3264 25 0000FFFF    AND EAX,FFFF0000                      ; 去除底位
004A3269 33D2          XOR EDX,EDX
004A326B 48             DEC EAX
004A326C 66:8B50 3C    MOV DX,WORD PTR DS:[EAX+3C]
004A3270 66:F7C2 00F0 TEST DX,0F000
004A3275  ^ 75 F4          JNZ SHORT 004A326B
004A3277 3B4402 34    CMP EAX,DWORD PTR DS:[EDX+EAX+34]
004A327B  ^ 75 EE          JNZ SHORT 004A326B                      ; 循环取出Kernel32.dll的hModule
004A327D 8985 CFBD4000 MOV DWORD PTR SS:[EBP+40BDCF],EAX       ; 取出的hModule入[4A9DCF]处
……
004A3299 8D85 AFBA4000 LEA EAX,DWORD PTR SS:[EBP+40BAAF]       ; 准备获取GetModuleHandleA的地址
004A329F 50             PUSH EAX       ; /ProcNameOrOrdinal = "GetModuleHandleA"
004A32CC FFB5 CFBD4000 PUSH DWORD PTR SS:[EBP+40BDCF]          ; |hModule = 7C800000 (kernel32)
004A32EC E8 0FBDFFFF    CALL 0049F000       ; \GetProcAddress
……
CALL 0049F000实际上就相当于GetProcAddress函数
进去看看：

0049F000 55             PUSH EBP
0049F001 8BEC          MOV EBP,ESP
0049F003 83C4 E8       ADD ESP,-18
0049F006 53             PUSH EBX
0049F007 51             PUSH ECX
0049F008 56             PUSH ESI
0049F009 57             PUSH EDI
0049F00A 8B45 08       MOV EAX,DWORD PTR SS:[EBP+8]          ; hModule
0049F00D 8B40 3C       MOV EAX,DWORD PTR DS:[EAX+3C]
0049F010 0345 08       ADD EAX,DWORD PTR SS:[EBP+8]          ; 定位PE头
0049F013 8945 FC       MOV DWORD PTR SS:[EBP-4],EAX
0049F016 8B5D 08       MOV EBX,DWORD PTR SS:[EBP+8]
0049F019 0358 78       ADD EBX,DWORD PTR DS:[EAX+78]          ; 定位输出表
0049F01C 895D F8       MOV DWORD PTR SS:[EBP-8],EBX
0049F01F 8BC3          MOV EAX,EBX
0049F021 8B58 1C       MOV EBX,DWORD PTR DS:[EAX+1C]
0049F024 035D 08       ADD EBX,DWORD PTR SS:[EBP+8]          ; 定位AddressOfFunctions
0049F027 895D F4       MOV DWORD PTR SS:[EBP-C],EBX
0049F02A 8B58 18       MOV EBX,DWORD PTR DS:[EAX+18]          ; 定位NumberOfNames
0049F02D 895D F0       MOV DWORD PTR SS:[EBP-10],EBX
0049F030 8B58 20       MOV EBX,DWORD PTR DS:[EAX+20]
0049F033 035D 08       ADD EBX,DWORD PTR SS:[EBP+8]          ; 定位AddressOfNames
0049F036 895D E8       MOV DWORD PTR SS:[EBP-18],EBX
0049F039 8B58 24       MOV EBX,DWORD PTR DS:[EAX+24]
0049F03C 035D 08       ADD EBX,DWORD PTR SS:[EBP+8]          ; AddressofNameOrdinals
0049F03F 895D EC       MOV DWORD PTR SS:[EBP-14],EBX
0049F042 33C9          XOR ECX,ECX
0049F044 33DB          XOR EBX,EBX
0049F046 8B75 0C       MOV ESI,DWORD PTR SS:[EBP+C]          ; 要取的API名字
0049F049 8B7D E8       MOV EDI,DWORD PTR SS:[EBP-18]
0049F04C 8B3C8F       MOV EDI,DWORD PTR DS:[EDI+ECX*4]
0049F04F 037D 08       ADD EDI,DWORD PTR SS:[EBP+8]
0049F052 8A043B       MOV AL,BYTE PTR DS:[EBX+EDI]
0049F055 3A0433       CMP AL,BYTE PTR DS:[EBX+ESI]
0049F058 75 0A          JNZ SHORT 0049F064
0049F05A 43             INC EBX
0049F05B B0 00          MOV AL,0
0049F05D 3A0433       CMP AL,BYTE PTR DS:[EBX+ESI]
0049F060  ^ 75 F0          JNZ SHORT 0049F052
0049F062 74 08          JE SHORT 0049F06C
0049F064 33DB          XOR EBX,EBX
0049F066 41             INC ECX
0049F067 3B4D F0       CMP ECX,DWORD PTR SS:[EBP-10]
0049F06A  ^ 75 DD          JNZ SHORT 0049F049
0049F06C 8B7D F4       MOV EDI,DWORD PTR SS:[EBP-C]          ; 通过循环取出相关的API
0049F06F 8B048F       MOV EAX,DWORD PTR DS:[EDI+ECX*4]
0049F072 0345 08       ADD EAX,DWORD PTR SS:[EBP+8]          ; 取出的api转为VA
0049F075 5F             POP EDI
0049F076 5E             POP ESI
0049F077 59             POP ECX
0049F078 5B             POP EBX
0049F079 C9             LEAVE
0049F07A C2 0800       RETN 8
以下是Xikug的MyGetProcAddress源码:

‘----------------------------------Xikug的GetAPIAddress Proc--------------------------
GetApiAddress PROC k32Base: DWORD, ApiName: DWORD
LOCAL baseImageNtHeaders: DWORD ;ImageNtHeader基地址
LOCAL baseExportTable: DWORD ;Export表基地址

;;;;;;;;;;;;;IMAGE_EXPORT_DIRECTORY 的数据保存在下面的变量中;;;;;;;;;;;;;;;;
LOCAL AddressOfFunctions: DWORD
LOCAL NumberOfNames: DWORD
LOCAL AddressOfNameOrdinals: DWORD
LOCAL AddressOfNames: DWORD

push ebx
push ecx
push esi
push edi

mov eax, k32Base
mov eax, [eax + 3cH] ;Kernel32.dll 的 IMAGE_NT_HEADERS
add eax, k32Base
mov baseImageNtHeaders, eax

assume eax: ptr IMAGE_NT_HEADERS
mov ebx, k32Base
add ebx, [eax].OptionalHeader.DataDirectory.VirtualAddress
assume eax: nothing
mov baseExportTable, ebx

mov eax, ebx
assume eax: ptr IMAGE_EXPORT_DIRECTORY
mov ebx, [eax].AddressOfFunctions
add ebx, k32Base
mov AddressOfFunctions, ebx
mov ebx, [eax].NumberOfNames
mov NumberOfNames, ebx
mov ebx, [eax].AddressOfNames
add ebx, k32Base
mov AddressOfNames, ebx
mov ebx, [eax].AddressOfNameOrdinals
add ebx, k32Base
mov AddressOfNameOrdinals, ebx
assume eax: nothing

xor ecx, ecx
xor ebx, ebx

mov esi, ApiName

GetAPIName:
mov edi, AddressOfNames
mov edi, [edi + ecx * 4]
add edi, k32Base

CmpAPI:
mov al, [edi + ebx]
cmp al, [esi + ebx]
jne GetNext
inc ebx
mov al, 0
cmp al, [esi + ebx]
jne CmpAPI
je GetOK
GetNext:
xor ebx, ebx
inc ecx
cmp ecx, NumberOfNames
jne GetAPIName

GetOK:

;;;;;;;;;取得Api地址的Index;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; xor edx, edx
; mov ebx, AddressOfNameOrdinals
; mov dx, word ptr [ebx + ecx * 4]

;ecx为AddressOfFunctions中的索引
;在AddressOfFunctions中找到函数地址
mov edi, AddressOfFunctions
mov eax, [edi + ecx * 4]
add eax, k32Base

;平衡堆栈
pop edi
pop esi
pop ecx
pop ebx

ret

GetApiAddress endp
‘----------------------------------结束--------------------------
壳取以下些API的地址:
004A9AB4  64 75 6C 65 48 61 6E 64 6C 65 41 00 29 B5 80 7C  duleHandleA.)?|
004A9AC4  4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00  LoadLibraryA....
004A9AD4  00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00  .GetProcAddress.
004A9AE4  00 00 00 00 47 6C 6F 62 61 6C 41 6C 6C 6F 63 00  ....GlobalAlloc.
004A9AF4  00 00 00 00 47 6C 6F 62 61 6C 46 72 65 65 00 00  ....GlobalFree..
004A9B04  00 00 00 55 6E 68 61 6E 64 6C 65 64 45 78 63 65  ...UnhandledExce
004A9B14  70 74 69 6F 6E 46 69 6C 74 65 72 00 00 00 00 00  ptionFilter.....
004A9B24  47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D  GetModuleFileNam
004A9B34  65 41 00 00 00 00 00 45 78 69 74 50 72 6F 63 65  eA.....ExitProce
004A9B44  73 73 00 00 00 00 00 43 72 65 61 74 65 50 72 6F  ss.....CreatePro
004A9B54  63 65 73 73 00 00 00 00 00 57 61 69 74 46 6F 72  cess.....WaitFor
004A9B64  44 65 62 75 67 45 76 65 6E 74 00 00 00 00 00 43  DebugEvent.....C
004A9B74  6F 6E 74 69 6E 75 65 44 65 62 75 67 45 76 65 6E  ontinueDebugEven
004A9B84  74 00 00 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64  t.....GetCommand
004A9B94  4C 69 6E 65 00 00 00 00 00 6C 73 74 72 6C 65 6E  Line.....lstrlen
004A9BA4  00 00 00 00 00 6C 73 74 72 63 70 79 00 00 00 00  .....lstrcpy....
004A9BB4  00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00  .MessageBoxA....
004A9BC4  00 52 74 6C 5A 65 72 6F 4D 65 6D 6F 72 79 00 00  .RtlZeroMemory..
004A9BD4  00 00 00 43 72 65 61 74 65 54 6F 6F 6C 68 65 6C  ...CreateToolhel
004A9BE4  70 33 32 53 6E 61 70 73 68 6F 74 00 00 00 00 00  p32Snapshot.....
004A9BF4  50 72 6F 63 65 73 73 33 32 46 69 72 73 74 00 00  Process32First..
004A9C04  00 00 00 50 72 6F 63 65 73 73 33 32 4E 65 78 74  ...Process32Next
004A9C14  00 00 00 00 00 47 65 74 43 75 72 72 65 6E 74 50  .....GetCurrentP
004A9C24  72 6F 63 65 73 73 49 64 00 00 00 00 00 4F 70 65  rocessId.....Ope
004A9C34  6E 50 72 6F 63 65 73 73 00 00 00 00 00 43 6C 6F  nProcess.....Clo
004A9C44  73 65 48 61 6E 64 6C 65 00 00 00 00 00 52 65 61  seHandle.....Rea
004A9C54  64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00  dProcessMemory..
004A9C64  00 00 00 47 65 74 54 68 72 65 61 64 43 6F 6E 74  ...GetThreadCont
004A9C74  65 78 74 00 00 00 00 00 53 65 74 54 68 72 65 61  ext.....SetThrea
004A9C84  64 43 6F 6E 74 65 78 74 00 00 00 00 00 57 72 69  dContext.....Wri
004A9C94  74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00  teProcessMemory.
004A9CA4  00 00 00 00 46 6C 75 73 68 49 6E 73 74 72 75 63  ....FlushInstruc
004A9CB4  74 69 6F 6E 43 61 63 68 65 00 00                tionCache..
获取到GetProcAddress的地址后，直接用GetProcAddress函数获取相关API：
……
004A3B8F FF95 E4BA4000 CALL DWORD PTR SS:[EBP+40BAE4]          ; kernel32.GetProcAddress
004A3B95 8985 4DBC4000 MOV DWORD PTR SS:[EBP+40BC4D],EAX
……
004A3FED 6A 00          PUSH 0                                  ; /ProcessID = 0
004A3FEF 6A 02          PUSH 2                                  ; |Flags = TH32CS_SNAPPROCESS
004A3FF1 FF95 F0BB4000 CALL DWORD PTR SS:[EBP+40BBF0]          ; \CreateToolhelp32Snapshot
004A3FF7 8985 FBC24000 MOV DWORD PTR SS:[EBP+40C2FB],EAX       ; HANDLE(10)保存到[4aa2fb]
004A3FFD 50             PUSH EAX
……
004A4018 58             POP EAX
004A4019 83F8 FF       CMP EAX,-1                            ; 如果CreateToolhelp32Snapshot失败则退出程序
004A401C 75 01          JNZ SHORT 004A401F                      ; 成功则跳
……
004A408A 8DBD 03C34000 LEA EDI,DWORD PTR SS:[EBP+40C303]       ; 填充PROCESSENTRY32 结构
004A4090 C707 28010000 MOV DWORD PTR DS:[EDI],128             ; 结构大小
004A4096  PUSH EDI                            ; /pProcessentry =004AA303
004A40C3  PUSH DWORD PTR SS:[EBP+40C2FB]    ; |hSnapshot = 00000010
004A40C9  CALL DWORD PTR SS:[EBP+40BC03]    ; \Call Process32First
……
004A40EB 0BC0          OR EAX,EAX
004A40ED 75 0D          JNZ SHORT 004A40FC                      ; 如果函数成功则跳
004A40EF FFB5 FBC24000 PUSH DWORD PTR SS:[EBP+40C2FB]          ; 不成功就CloseHandle并结束程序
004A40F5 FF95 4DBC4000 CALL DWORD PTR SS:[EBP+40BC4D]
004A40FB C3             RETN
……
004A4167 FF95 2DBC4000 CALL DWORD PTR SS:[EBP+40BC2D]          ; GetCurrentProcessId获取当前进程ID
004A416D 3947 08       CMP DWORD PTR DS:[EDI+8],EAX
004A4170 0F85 111A0000 JNZ 004A5B87                            ; 如果不是没有找到当前进程则跳
004A4176 8B47 18       MOV EAX,DWORD PTR DS:[EDI+18]          ; 获取父进程的ID
004A4179 8985 3EC24000 MOV DWORD PTR SS:[EBP+40C23E],EAX       ; 父进程ID保存到[4AA23E处
004A417F FF77 18       PUSH DWORD PTR DS:[EDI+18]             ; /ProcessId = 3E0
004A4182 6A 00          PUSH 0                                  ; |Inheritable = FALSE
004A4184 68 FF0F1F00    PUSH 1F0FFF                            ; |Access = PROCESS_ALL_ACCESS
004A4189 FF95 3DBC4000 CALL DWORD PTR SS:[EBP+40BC3D]          ; \CALL OpenProcess
004A418F 8985 FFC24000 MOV DWORD PTR SS:[EBP+40C2FF],EAX       ; openProcHandle 保存到[4AA2FF]处
004A4195 0BC0          OR EAX,EAX
004A4197 0F84 E6190000 JE 004A5B83                            ; 如果打开进程失败则跳下去
004A419D 8D85 B4114000 LEA EAX,DWORD PTR SS:[EBP+4011B4]       ; 这里开始利用SEH处理读内存可能产生的异常
004A41A3 50             PUSH EAX                               ; 这里是一个Anti-Deubg
004A41A4 64:FF35 0000000>PUSH DWORD PTR FS:[0]
004A41AB 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
004A41B2 55             PUSH EBP
004A41B3 6A 00          PUSH 0                                  ; /pBytesRead = NULL
004A41B5 6A 40          PUSH 40                               ; |BytesToRead = 40 (64.)
004A41B7 8D85 2BC44000 LEA EAX,DWORD PTR SS:[EBP+40C42B]       ; |
004A41BD 50             PUSH EAX                               ; |Buffer = Explorer.004AA42B
004A41BE 68 00000010    PUSH 10000000                         ; |pBaseAddress = 10000000
004A41C3 FFB5 FFC24000 PUSH DWORD PTR SS:[EBP+40C2FF]          ; |hProcess = 0000001C
004A41C9 FF95 63BC4000 CALL DWORD PTR SS:[EBP+40BC63]          ; \ReadProcessMemory
004A41CF 5D             POP EBP                               ; UnSeh
004A41D0 33DB          XOR EBX,EBX
004A41D2 64:8F03       POP DWORD PTR FS:[EBX]
004A41D5 83C4 04       ADD ESP,4
004A41D8 50             PUSH EAX                               ; 如果读取成功则EAX为1
004A41D9 51             PUSH ECX
……
004A5B4E 8D47 24       LEA EAX,DWORD PTR DS:[EDI+24]          ; ;获取程序本身的进程名
004A5B51 8A0401       MOV AL,BYTE PTR DS:[ECX+EAX]          ; 依次取出每一位字符
004A5B54 0AC0          OR AL,AL
004A5B56 75 02          JNZ SHORT 004A5B5A                      ; 如果没有获取完则跳
004A5B58 EB 13          JMP SHORT 004A5B6D
004A5B5A 24 0F          AND AL,0F                               ; 取出的每一位and 0F后查表
004A5B5C 8D9D 2EC24000 LEA EBX,DWORD PTR SS:[EBP+40C22E]
004A5B62 D7             XLAT BYTE PTR DS:[EBX+AL]
004A5B63 888429 C2BC4000 MOV BYTE PTR DS:[ECX+EBP+40BCC2],AL    ; 查到后保存到[4a9cc2]处
004A5B6A 41             INC ECX
004A5B6B  ^ EB E1          JMP SHORT 004A5B4E                      ; 没有取完则继续上去计算加密值
004A5B6D 59             POP ECX
004A5B6E 58             POP EAX
004A5B6F 83F8 01       CMP EAX,1                               ; 这里判断读取内存是否成功，不成功则跳
004A5B72 75 0B          JNZ SHORT 004A5B7F
004A5B74 C685 3DC24000 0>MOV BYTE PTR SS:[EBP+40C23D],1          ; 成功则在[4AA23D]处做个标记
004A5B7B /EB 1F          JMP SHORT 004A5B9C                      ; 如果读取内存成功则利用CloseHandle(xx)使调试器异常
‘-----------------------------------------------------
004A5BB6 FFB5 FFC24000 PUSH DWORD PTR SS:[EBP+40C2FF]          ; /hObject = 0000001C ;这里改成0,否则异常
004A5BE5 FF95 4DBC4000 CALL DWORD PTR SS:[EBP+40BC4D]          ; \CloseHandle
‘--------------------------------------------------------
004A5B7D /EB 08          JMP SHORT 004A5B87
004A5B7F |EB 1B          JMP SHORT 004A5B9C
004A5B81 |EB 04          JMP SHORT 004A5B87
004A5B83 |EB 17          JMP SHORT 004A5B9C
004A5B85 |EB 00          JMP SHORT 004A5B87
004A5B87 \57             PUSH EDI                               ; /pProcessentry = Explorer.004AA303
004A5B88 FFB5 FBC24000 PUSH DWORD PTR SS:[EBP+40C2FB]          ; |hSnapshot = 00000010
004A5B8E FF95 15BC4000 CALL DWORD PTR SS:[EBP+40BC15]          ; \CALL Process32Next
004A5B94 0BC0          OR EAX,EAX
004A5B96  ^ 0F85 CBE5FFFF JNZ 004A4167                            ; 如果没有枚举完进程则跳回去继续
……
第一次计算加密的方法就是取出进程名的每一位，然后把取出的字符and 0F后的值就是在
&ad$.8=CCD[[VTQ中的第几位.
第一次计算后的值为：8C&V.d8dQ8C8
……
004A5BEB 57             PUSH EDI                               ; /pProcessentry = Explorer.004AA303
004A5C18 FFB5 FBC24000 PUSH DWORD PTR SS:[EBP+40C2FB]          ; |hSnapshot = 00000010
004A5C1E FF95 03BC4000 CALL DWORD PTR SS:[EBP+40BC03]          ; \Process32First
……
004A5C40 0BC0          OR EAX,EAX
004A5C42 75 0D          JNZ SHORT 004A5C51                      ; 如果函数成功则跳
004A5C44 FFB5 FBC24000 PUSH DWORD PTR SS:[EBP+40C2FB]          ; 否则关闭对象然后退出程序
004A5C4A FF95 4DBC4000 CALL DWORD PTR SS:[EBP+40BC4D]
004A5C50 C3             RETN
004A5C51 8B85 3EC24000 MOV EAX,DWORD PTR SS:[EBP+40C23E]       ; 父进程ID入EAX
004A5C57 3947 08       CMP DWORD PTR DS:[EDI+8],EAX
004A5C5A 0F85 A0000000 JNZ 004A5D00                            ; 如果不是父进程ID则跳下去继续
004A5C60 BA 00000000    MOV EDX,0
004A5C65 33C9          XOR ECX,ECX
004A5C67 8D47 24       LEA EAX,DWORD PTR DS:[EDI+24]          ; 获取父进程的进程名
004A5C6A 8A0401       MOV AL,BYTE PTR DS:[ECX+EAX]          ; 依次取出父进程的每一位
004A5C6D 0AC0          OR AL,AL
004A5C6F 75 02          JNZ SHORT 004A5C73                      ; 如果没有取完则跳
004A5C71 EB 1C          JMP SHORT 004A5C8F
004A5C73 24 0F          AND AL,0F
004A5C75 8D9D 2EC24000 LEA EBX,DWORD PTR SS:[EBP+40C22E]
004A5C7B D7             XLAT BYTE PTR DS:[EBX+AL]             ; 查表
004A5C7C 328429 C2BC4000 XOR AL,BYTE PTR DS:[ECX+EBP+40BCC2]    ; 查表后的值和上面计算自己进程名的值xor
004A5C83 0AC0          OR AL,AL                               ; 其中有一位不同
004A5C85 74 05          JE SHORT 004A5C8C                      ; 如果相等就跳
004A5C87 BA 01000000    MOV EDX,1                               ; 不同则edx设置为1
004A5C8C 41             INC ECX
004A5C8D  ^ EB D8          JMP SHORT 004A5C67
004A5C8F 83FA 01       CMP EDX,1                               ; 比较如果不相同的话就不跳
004A5C92 75 6C          JNZ SHORT 004A5D00                      ; 如果用OD来调试的子进程话这里就一定要跳,否则后面不会跳去正确的OEP处
……
004A5CAA BE 9A7C4000    MOV ESI,00407C9A
004A5CC9 81EE FF000000 SUB ESI,0FF
004A5CCF 03F5          ADD ESI,EBP
……
004A5CE7 C706 E77D4000 MOV DWORD PTR DS:[ESI],00407DE7       ; 这几句不知道是什么意思:-(
004A5CED 83C6 1F       ADD ESI,1F
004A5CF0 8906          MOV DWORD PTR DS:[ESI],EAX
004A5CF2 FFB5 FFC24000 PUSH DWORD PTR SS:[EBP+40C2FF]          ; /hObject = 0000001C
004A5CF8 FF95 4DBC4000 CALL DWORD PTR SS:[EBP+40BC4D]          ; \CloseHandle
004A5CFE EB 15          JMP SHORT 004A5D15
004A5D00 57             PUSH EDI                               ; /pProcessentry = Explorer.004AA303
004A5D01 FFB5 FBC24000 PUSH DWORD PTR SS:[EBP+40C2FB]          ; |hSnapshot = 00000010
004A5D07 FF95 15BC4000 CALL DWORD PTR SS:[EBP+40BC15]          ; \Process32Next
004A5D0D 0BC0          OR EAX,EAX
004A5D0F  ^ 0F85 3CFFFFFF JNZ 004A5C51                            ; 如果没有枚举完则继续
……
004A5D2F FFB5 FBC24000 PUSH DWORD PTR SS:[EBP+40C2FB]          ; /hObject = 00000010
004A5D5E FF95 4DBC4000 CALL DWORD PTR SS:[EBP+40BC4D]          ; \CloseHandle关闭对象

到这里为些壳的ANTI-Debug就结束了。

……
004A5D7A FF95 99BB4000 CALL DWORD PTR SS:[EBP+40BB99]          ; 获取命令行
004A5D80 50             PUSH EAX
004A5D81 90             NOP
004A5D82 90             NOP
……
004A5DAD 5A             POP EDX                               ; 00141EE0
004A5DAE 8BF2          MOV ESI,EDX
004A5DB0 90             NOP
……
004A5DC6 803E 58       CMP BYTE PTR DS:[ESI],58                ; 比较命令行第一个字符是否为"X",调试标志
004A5DC9 75 2E          JNZ SHORT 004A5DF9                      ; 不是则跳
……
004A5DF7 /EB 6B          JMP SHORT 004A5E64                      ; 如果是子进程则跳去解壳部分
……
004A5E0F 90             NOP
004A5E10 90             NOP                                     ; 准备获取程序的完整路径名
004A5E11 90             NOP
004A5E12 90             NOP
004A5E13 68 00010000    PUSH 100                               ; /BufSize = 100 (256.)
004A5E18 8D85 C2BC4000 LEA EAX,DWORD PTR SS:[EBP+40BCC2]       ; |
004A5E1E 50             PUSH EAX                               ; |PathBuffer = Explorer.004A9CC2
004A5E1F 6A 00          PUSH 0                                  ; |hModule = NULL
004A5E21 FF95 37BB4000 CALL DWORD PTR SS:[EBP+40BB37]          ; \GetModuleFileNameA
004A5E27 90             NOP
……
004A5E3A 8D85 C2BC4000 LEA EAX,DWORD PTR SS:[EBP+40BCC2]
004A5E40 50             PUSH EAX                               ; 获取到的程序完整路径名入栈
004A5E41 E8 1196FFFF    CALL 0049F457                         ; 这里跟进就是Shell Application(debug process)
跟进去看看：
0049F457 55             PUSH EBP                               ; 进来CreateProcess部分
0049F458 8BEC          MOV EBP,ESP
0049F45A 60             PUSHAD
0049F45B 8B7D 08       MOV EDI,DWORD PTR SS:[EBP+8]          ; 程序完整路径存放地址入edi
0049F45E E8 00000000    CALL 0049F463
0049F463 5B             POP EBX
0049F464 81EB 63144000 SUB EBX,00401463                      ; 获取重定位地址
0049F46A B8 44000000    MOV EAX,44                            ; 准备申请内存空间
0049F46F 50             PUSH EAX                               ; /Length = 44 (68.)
0049F470 8D83 42C24000 LEA EAX,DWORD PTR DS:[EBX+40C242]       ; |
0049F476 50             PUSH EAX                               ; |Destination = Explorer.004AA242
0049F477 FF93 D3BB4000 CALL DWORD PTR DS:[EBX+40BBD3]          ; \RtlZeroMemory
0049F47D B8 10000000    MOV EAX,10
0049F482 50             PUSH EAX                               ; /Length = 10 (16.)
0049F483 8D83 86C24000 LEA EAX,DWORD PTR DS:[EBX+40C286]       ; |
0049F489 50             PUSH EAX                               ; |Destination = Explorer.004AA286
0049F48A FF93 D3BB4000 CALL DWORD PTR DS:[EBX+40BBD3]          ; \RtlZeroMemory
0049F490 B8 44000000    MOV EAX,44                            ; 准备CreateProcessA调试子进程
0049F495 8983 42C24000 MOV DWORD PTR DS:[EBX+40C242],EAX
0049F49B 8D83 86C24000 LEA EAX,DWORD PTR DS:[EBX+40C286]
0049F4A1 50             PUSH EAX                               ; /pProcessInfo = Explorer.004AA286
0049F4A2 8D83 42C24000 LEA EAX,DWORD PTR DS:[EBX+40C242]       ; |
0049F4A8 50             PUSH EAX                               ; |pStartupInfo = Explorer.004AA242
0049F4A9 6A 00          PUSH 0                                  ; |CurrentDir = NULL
0049F4AB 6A 00          PUSH 0                                  ; |pEnvironment = NULL
0049F4AD B8 01000000    MOV EAX,1                               ; |
0049F4B2 83C8 02       OR EAX,2                               ; |
0049F4B5 50             PUSH EAX                               ; |CreationFlags = DEBUG_PROCESS|DEBUG_ONLY_THIS_PROCESS
0049F4B6 6A 00          PUSH 0                                  ; |InheritHandles = FALSE
0049F4B8 6A 00          PUSH 0                                  ; |pThreadSecurity = NULL
0049F4BA 6A 00          PUSH 0                                  ; |pProcessSecurity = NULL
0049F4BC 8D83 C2BD4000 LEA EAX,DWORD PTR DS:[EBX+40BDC2]       ; |
0049F4C2 50             PUSH EAX                               ; |CommandLine = "X"
0049F4C3 57             PUSH EDI                               ; |ModuleFileName = "D:\Explorer.exe"
0049F4C4 FF93 59BB4000 CALL DWORD PTR DS:[EBX+40BB59]          ; \CreateProcessA
0049F4CA 83F8 01       CMP EAX,1
0049F4CD 0F85 87010000 JNZ 0049F65A                            ; 如果创建进程失败则退出程序
0049F4D3 8DBB 64C54000 LEA EDI,DWORD PTR DS:[EBX+40C564]
0049F4D9 C707 07000100 MOV DWORD PTR DS:[EDI],10007
0049F4DF 810F 10000100 OR DWORD PTR DS:[EDI],10010
0049F4E5 8D83 96C24000 LEA EAX,DWORD PTR DS:[EBX+40C296]
0049F4EB 68 A00F0000    PUSH 0FA0                               ; /Timeout = 4000. ms
0049F4F0 50             PUSH EAX                               ; |pDebugEvent = Explorer.004AA296
0049F4F1 FF93 6FBB4000 CALL DWORD PTR DS:[EBX+40BB6F]          ; \WaitForDebugEvent
0049F4F7 83F8 01       CMP EAX,1
0049F4FA 0F85 55010000 JNZ 0049F655                            ; 如果 EAX ==FALSE则跳下一步
0049F500 8D93 96C24000 LEA EDX,DWORD PTR DS:[EBX+40C296]       ; DebugEvent
0049F506 8DB3 86C24000 LEA ESI,DWORD PTR DS:[EBX+40C286]       ; pi
0049F50C 833A 03       CMP DWORD PTR DS:[EDX],3                ; CREATE_PROCESS_DEBUG_EVENT
0049F50F 75 16          JNZ SHORT 0049F527                      ; 如果调试动作不为CREATE_PROCESS_DEBUG_EVENT则跳
0049F511 68 02000100    PUSH 10002                            ; /ContinueStatus = DBG_CONTINUE
0049F516 FF72 08       PUSH DWORD PTR DS:[EDX+8]             ; |ThreadId = 214
0049F519 FF72 04       PUSH DWORD PTR DS:[EDX+4]             ; |ProcessId = 57C
0049F51C FF93 86BB4000 CALL DWORD PTR DS:[EBX+40BB86]          ; \ContinueDebugEvent
0049F522 E9 2E010000    JMP 0049F655
0049F527 833A 01       CMP DWORD PTR DS:[EDX],1                ;  判断有没有发生异常EXCEPTION_DEBUG_EVENT
0049F52A 0F85 0B010000 JNZ 0049F63B                            ; 如果没有则跳
0049F530 817A 0C 0300008>CMP DWORD PTR DS:[EDX+C],80000003       ; 判断是否为int3断点异常，如果不是则跳去继续
0049F537 0F85 EB000000 JNZ 0049F628
0049F53D 83BB F7C24000 0>CMP DWORD PTR DS:[EBX+40C2F7],0       ; 判断是否为调试入口异常
0049F544 75 1C          JNZ SHORT 0049F562                      ; 也就是说壳的第一次断点异常为入口断点异常，忽略
0049F546 FF83 F7C24000 INC DWORD PTR DS:[EBX+40C2F7]          ; Debug Step+1
0049F54C 68 02000100    PUSH 10002                            ; /ContinueStatus = DBG_CONTINUE
0049F551 FF72 08       PUSH DWORD PTR DS:[EDX+8]             ; |ThreadId = 214
0049F554 FF72 04       PUSH DWORD PTR DS:[EDX+4]             ; |ProcessId = 57C
0049F557 FF93 86BB4000 CALL DWORD PTR DS:[EBX+40BB86]          ; \ContinueDebugEvent
0049F55D E9 F3000000    JMP 0049F655                            ; 跳去ContinueDebugEvent
0049F562 83BB F7C24000 0>CMP DWORD PTR DS:[EBX+40C2F7],1       ; 第二次int3异常
0049F569 0F85 A6000000 JNZ 0049F615
0049F56F 52             PUSH EDX
0049F570 FF83 F7C24000 INC DWORD PTR DS:[EBX+40C2F7]          ; debug step+1
0049F576 8DBB 64C54000 LEA EDI,DWORD PTR DS:[EBX+40C564]
0049F57C 57             PUSH EDI                               ; /pContext = Explorer.004AA564
0049F57D FF76 04       PUSH DWORD PTR DS:[ESI+4]             ; |hThread = 00000038 (window)
0049F580 FF93 78BC4000 CALL DWORD PTR DS:[EBX+40BC78]          ; \GetThreadContext
0049F586 8B8F B8000000 MOV ECX,DWORD PTR DS:[EDI+B8]          ; 获取异常地址(4A7781)
0049F58C 51             PUSH ECX
0049F58D 6A 00          PUSH 0                                  ; /pBytesRead = NULL
0049F58F 6A 01          PUSH 1                                  ; |BytesToRead = 1
0049F591 8D83 F6C24000 LEA EAX,DWORD PTR DS:[EBX+40C2F6]       ; |
0049F597 50             PUSH EAX                               ; |Buffer = Explorer.004AA2F6
0049F598 51             PUSH ECX                               ; |pBaseAddress = 4A7781
0049F599 FF36          PUSH DWORD PTR DS:[ESI]                ; |hProcess = 00000034
0049F59B FF93 63BC4000 CALL DWORD PTR DS:[EBX+40BC63]          ; \ReadProcessMemory
0049F5A1 59             POP ECX
0049F5A2 8D83 F6C24000 LEA EAX,DWORD PTR DS:[EBX+40C2F6]
0049F5A8 8A00          MOV AL,BYTE PTR DS:[EAX]
0049F5AA 34 52          XOR AL,52
0049F5AC 8883 F6C24000 MOV BYTE PTR DS:[EBX+40C2F6],AL
0049F5B2 51             PUSH ECX
0049F5B3 6A 00          PUSH 0                                  ; /pBytesWritten = NULL
0049F5B5 6A 01          PUSH 1                                  ; |BytesToWrite = 1
0049F5B7 8D83 F6C24000 LEA EAX,DWORD PTR DS:[EBX+40C2F6]       ; |
0049F5BD 50             PUSH EAX                               ; |Buffer = Explorer.004AA2F6
0049F5BE 51             PUSH ECX                               ; |Address = 4A7781
0049F5BF FF36          PUSH DWORD PTR DS:[ESI]                ; |hProcess = 00000034
0049F5C1 FF93 A4BC4000 CALL DWORD PTR DS:[EBX+40BCA4]          ; \WriteProcessMemory
0049F5C7 59             POP ECX
0049F5C8 8D83 04BA4000 LEA EAX,DWORD PTR DS:[EBX+40BA04]       ; 结束地址4A9A04
0049F5CE 41             INC ECX
0049F5CF 3BC8          CMP ECX,EAX
0049F5D1 75 02          JNZ SHORT 0049F5D5                      ; 判断有没有结束，没有结束则跳回去继续
0049F5D3 EB 02          JMP SHORT 0049F5D7
0049F5D5  ^ EB B5          JMP SHORT 0049F58C
0049F5D7 51             PUSH ECX
0049F5D8 8B87 B8000000 MOV EAX,DWORD PTR DS:[EDI+B8]
0049F5DE 8987 B8000000 MOV DWORD PTR DS:[EDI+B8],EAX
0049F5E4 57             PUSH EDI                               ; /pContext = Explorer.004AA564
0049F5E5 FF76 04       PUSH DWORD PTR DS:[ESI+4]             ; |hThread = 00000038 (window)
0049F5E8 FF93 8DBC4000 CALL DWORD PTR DS:[EBX+40BC8D]          ; \SetThreadContext
0049F5EE 8B87 B8000000 MOV EAX,DWORD PTR DS:[EDI+B8]
0049F5F4 59             POP ECX
0049F5F5 2BC8          SUB ECX,EAX
0049F5F7 51             PUSH ECX                               ; /RegionSize = 2283
0049F5F8 50             PUSH EAX                               ; |RegionBase = Explorer.004A7781
0049F5F9 FF36          PUSH DWORD PTR DS:[ESI]                ; |hProcess = 00000034
0049F5FB FF93 BEBC4000 CALL DWORD PTR DS:[EBX+40BCBE]          ; \FlushInstructionCache
0049F601 5A             POP EDX
0049F602 68 02000100    PUSH 10002                            ; /ContinueStatus = DBG_CONTINUE
0049F607 FF72 08       PUSH DWORD PTR DS:[EDX+8]             ; |ThreadId = 214
0049F60A FF72 04       PUSH DWORD PTR DS:[EDX+4]             ; |ProcessId = 57C
0049F60D FF93 86BB4000 CALL DWORD PTR DS:[EBX+40BB86]          ; \ContinueDebugEvent
0049F613 EB 40          JMP SHORT 0049F655
0049F615 68 01000180    PUSH 80010001                         ; /DBG_EXCEPTION_NOT_HANDLED
0049F61A FF72 08       PUSH DWORD PTR DS:[EDX+8]             ; |dwThreadId
0049F61D FF72 04       PUSH DWORD PTR DS:[EDX+4]             ; |dwProcessId
0049F620 FF93 86BB4000 CALL DWORD PTR DS:[EBX+40BB86]          ; \ContinueDebugEvent
0049F626 EB 2D          JMP SHORT 0049F655
0049F628 68 01000180    PUSH 80010001                         ; /DBG_EXCEPTION_NOT_HANDLED
0049F62D FF72 08       PUSH DWORD PTR DS:[EDX+8]             ; |dwThreadId
0049F630 FF72 04       PUSH DWORD PTR DS:[EDX+4]             ; |dwProcessId
0049F633 FF93 86BB4000 CALL DWORD PTR DS:[EBX+40BB86]          ; \ContinueDebugEvent
0049F639 EB 1A          JMP SHORT 0049F655
0049F63B 833A 05       CMP DWORD PTR DS:[EDX],5
0049F63E 75 04          JNZ SHORT 0049F644
0049F640 EB 18          JMP SHORT 0049F65A
0049F642 EB 11          JMP SHORT 0049F655
0049F644 68 02000100    PUSH 10002                            ; /ContinueStatus = DBG_CONTINUE
0049F649 FF72 08       PUSH DWORD PTR DS:[EDX+8]             ; |dwThreadId
0049F64C FF72 04       PUSH DWORD PTR DS:[EDX+4]             ; |dwProcessId
0049F64F FF93 86BB4000 CALL DWORD PTR DS:[EBX+40BB86]          ; \ContinueDebugEvent
0049F655  ^ E9 8BFEFFFF    JMP 0049F4E5
0049F65A 61             POPAD
0049F65B C9             LEAVE
0049F65C C2 0400       RETN 4
004A5E5B 90             NOP                                     ; 调试完程序结束
004A5E5C 6A 00          PUSH 0                                  ; /Exit Code = 0
004A5E5E FF95 47BB4000 CALL DWORD PTR SS:[EBP+40BB47]          ; \ExitProcess

到这里我们可以总结一下:壳只用了一个anti-debug,然后通过调试标志’X’判断是否为子进程。壳只处理INT3异常，异常时把从4A7781到4A9A04处的代码xor 52还原出正确代码。
现在再写一段脚本用于直接跳为单进程的方式：
var addr
start:
  gpa "GetProcAddress","kernel32.dll"
  bp $RESULT

lbl1:
  run

lbl2:
  mov addr,esp
  add addr,8
  mov addr,[addr]
  mov addr,[addr]
  cmp addr,73756c46
  jne lbl1
  bc $RESULT
  rtu

lbl3:
  mov addr,eip
  add addr,6
  asm addr,"jmp 004A5D7A"
  sto
  sto
  mov [addr],#E803000000#
  sto
  mov [eax],#58#
  run
  ret
重新来过，并运行上面的脚本，然后到这里：
004A5E7A E8 1E98FFFF    CALL 0049F69D                         ; ;初始化CRC32表
跟进看看：
0049F69D 60             PUSHAD
0049F69E E8 00000000    CALL 0049F6A3
0049F6A3 5B             POP EBX
0049F6A4 81EB A3164000 SUB EBX,004016A3                      ; 计算重定位值
0049F6AA B9 00010000    MOV ECX,100
0049F6AF BA 2083B8ED    MOV EDX,EDB88320
0049F6B4 8D41 FF       LEA EAX,DWORD PTR DS:[ECX-1]
0049F6B7 51             PUSH ECX
0049F6B8 B9 08000000    MOV ECX,8
0049F6BD D1E8          SHR EAX,1
0049F6BF 73 02          JNB SHORT 0049F6C3
0049F6C1 33C2          XOR EAX,EDX
0049F6C3 49             DEC ECX
0049F6C4  ^ 75 F7          JNZ SHORT 0049F6BD
0049F6C6 59             POP ECX
0049F6C7 8DBB FABD4000 LEA EDI,DWORD PTR DS:[EBX+40BDFA]
0049F6CD 89448F FC    MOV DWORD PTR DS:[EDI+ECX*4-4],EAX    0049F6D1 49             DEC ECX
0049F6D2  ^ 75 E0          JNZ SHORT 0049F6B4
0049F6D4 61             POPAD
0049F6D5 C3             RETN
……
004A5E99 E8 00000000    CALL 004A5E9E
004A5E9E 90             NOP
004A5E9F 90             NOP
004A5EA0 90             NOP
004A5EA1 90             NOP
004A5EA2 59             POP ECX
004A5EA3 81E9 9E7E4000 SUB ECX,00407E9E
004A5EA9 BB 0B174000    MOV EBX,0040170B
004A5EAE 03D9          ADD EBX,ECX                            ; 计算出壳的EP
004A5EB0 B9 93670000    MOV ECX,6793
004A5EB5 E8 1C98FFFF    CALL 0049F6D6                         ; 这里进去计算crc值
004A5EBA 8985 2AC24000 MOV DWORD PTR SS:[EBP+40C22A],EAX       ; CRC值保存到[4AA22A处
……
004A5F1C 6A 00             PUSH 0                                  ; /phModule = 0
004A5F1E FF95 C0BA4000    CALL DWORD PTR SS:[EBP+40BAC0]          ; \GetModuleHandleA
004A5F24 8985 DEBD4000    MOV DWORD PTR SS:[EBP+40BDDE],EAX       ; phModule保存到[004A9DDE]处
004A5F2A 8B58 3C          MOV EBX,DWORD PTR DS:[EAX+3C]          ; 定位pe头
004A5F2D 039D DEBD4000    ADD EBX,DWORD PTR SS:[EBP+40BDDE]
004A5F33 899D E2BD4000    MOV DWORD PTR SS:[EBP+40BDE2],EBX
004A5F39 8B85 E2BD4000    MOV EAX,DWORD PTR SS:[EBP+40BDE2]
004A5F3F 05 F8000000       ADD EAX,0F8
004A5F44 8985 E6BD4000    MOV DWORD PTR SS:[EBP+40BDE6],EAX       ; 定位Section name
004A5F4A 8B58 0C          MOV EBX,DWORD PTR DS:[EAX+C]          ; Section Voffset=1000
004A5F4D 039D DEBD4000    ADD EBX,DWORD PTR SS:[EBP+40BDDE]
004A5F53 899D EABD4000    MOV DWORD PTR SS:[EBP+40BDEA],EBX
004A5F59 8B58 08          MOV EBX,DWORD PTR DS:[EAX+8]          ; Vsize=73000
004A5F5C 899D EEBD4000    MOV DWORD PTR SS:[EBP+40BDEE],EBX
004A5F62 8B58 10          MOV EBX,DWORD PTR DS:[EAX+10]          ; Rsize=31c00
004A5F65 899D F2BD4000    MOV DWORD PTR SS:[EBP+40BDF2],EBX       ; 下面准备分配空间
004A5F6B FFB5 EEBD4000    PUSH DWORD PTR SS:[EBP+40BDEE]          ; /MemSize = 73000 (Push Visze)
004A5F71 6A 40             PUSH 40                               ; |Flags = GPTR
004A5F73 FF95 F4BA4000    CALL DWORD PTR SS:[EBP+40BAF4]          ; \GlobalAlloc
004A5F79 0BC0             OR EAX,EAX
004A5F7B 75 05             JNZ SHORT 004A5F82                      ; 如果分配成功则跳
004A5F7D E9 2C3B0000       JMP 004A9AAE
004A5F82 8BF8             MOV EDI,EAX                            ; mov edi,hmem
……
004A5FC3 8B85 EABD4000    MOV EAX,DWORD PTR SS:[EBP+40BDEA]
004A5FC9 57                PUSH EDI                               ; /hmem =00142AB8
004A5FCA 50                PUSH EAX                               ; |Uzip address = 401000
004A5FCB E8 353A0000       CALL 004A9A05                         ; \ApLib_Unpack
004A5FD0 58                POP EAX
004A5FD1 5F                POP EDI
……
004A6032 FC                CLD
004A6033 8B8D EEBD4000    MOV ECX,DWORD PTR SS:[EBP+40BDEE]
004A6039 8BF7             MOV ESI,EDI
004A603B 8BBD EABD4000    MOV EDI,DWORD PTR SS:[EBP+40BDEA]
004A6041 F3:A4             REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>; 还原代码
……
004A60F4 FFB5 F6BD4000    PUSH DWORD PTR SS:[EBP+40BDF6]          ; 重定位值9E000
004A60FA FFB5 DEBD4000    PUSH DWORD PTR SS:[EBP+40BDDE]          ; imagebase
004A6100 E8 EF92FFFF       CALL 0049F3F4                         ; 这里进去就是输入表还原
0049F3F4 55                PUSH EBP
0049F3F5 8BEC             MOV EBP,ESP
0049F3F7 83C4 F8          ADD ESP,-8
0049F3FA 60                PUSHAD
0049F3FB 8B45 08          MOV EAX,DWORD PTR SS:[EBP+8]
0049F3FE 8B50 3C          MOV EDX,DWORD PTR DS:[EAX+3C]          ; 定位pe头
0049F401 03C2             ADD EAX,EDX
0049F403 8B90 80000000    MOV EDX,DWORD PTR DS:[EAX+80]          ; 定位输入表
0049F409 0355 08          ADD EDX,DWORD PTR SS:[EBP+8]
0049F40C 8BFA             MOV EDI,EDX
0049F40E 8B5F 0C          MOV EBX,DWORD PTR DS:[EDI+C]
0049F411 83FB 00          CMP EBX,0
0049F414 74 3C             JE SHORT 0049F452                      ; 如果输入表处理完就跳去结束处
0049F416 035D 08          ADD EBX,DWORD PTR SS:[EBP+8]
0049F419 895D FC          MOV DWORD PTR SS:[EBP-4],EBX
0049F41C 8B1F             MOV EBX,DWORD PTR DS:[EDI]
0049F41E 035D 08          ADD EBX,DWORD PTR SS:[EBP+8]
0049F421 895D F8          MOV DWORD PTR SS:[EBP-8],EBX
0049F424 33C9             XOR ECX,ECX
0049F426 8B048B             MOV EAX,DWORD PTR DS:[EBX+ECX*4]
0049F429 8B5D F8          MOV EBX,DWORD PTR SS:[EBP-8]
0049F42C 3B5D 08          CMP EBX,DWORD PTR SS:[EBP+8]
0049F42F 74 03             JE SHORT 0049F434
0049F431 89048B             MOV DWORD PTR DS:[EBX+ECX*4],EAX
0049F434 8B5D FC          MOV EBX,DWORD PTR SS:[EBP-4]
0049F437 8B45 0C          MOV EAX,DWORD PTR SS:[EBP+C]
0049F43A 05 BA124000       ADD EAX,004012BA
0049F43F 89048B             MOV DWORD PTR DS:[EBX+ECX*4],EAX
0049F442 41                INC ECX
0049F443 8B048B             MOV EAX,DWORD PTR DS:[EBX+ECX*4]
0049F446 83F8 00          CMP EAX,0
0049F449 74 02             JE SHORT 0049F44D                      ; 如果当前DLL处理完则跳去处理下一个DLL的相关API
0049F44B  ^ EB D9             JMP SHORT 0049F426                      ; 循环回去还原输入表
0049F44D 83C7 14          ADD EDI,14
0049F450  ^ EB BC             JMP SHORT 0049F40E
0049F452 61                POPAD
0049F453 C9                LEAVE
0049F454 C2 0800          RETN 8
……
004A61B9 FFB5 F6BD4000    PUSH DWORD PTR SS:[EBP+40BDF6]          ; 重定位值
004A61BF FFB5 DEBD4000    PUSH DWORD PTR SS:[EBP+40BDDE]          ; hmodule
004A61C5 E8 9594FFFF       CALL 0049F65F                         ; 这里进去就是Load All Library
0049F65F 55                PUSH EBP
0049F660 8BEC             MOV EBP,ESP
0049F662 60                PUSHAD
0049F663 8B45 08          MOV EAX,DWORD PTR SS:[EBP+8]
0049F666 8B50 3C          MOV EDX,DWORD PTR DS:[EAX+3C]          ; 定位PE头
0049F669 03C2             ADD EAX,EDX
0049F66B 8B90 80000000    MOV EDX,DWORD PTR DS:[EAX+80]          ; 定位输入表
0049F671 0355 08          ADD EDX,DWORD PTR SS:[EBP+8]
0049F674 8BFA             MOV EDI,EDX
0049F676 8B5F 0C          MOV EBX,DWORD PTR DS:[EDI+C]
0049F679 83FB 00          CMP EBX,0
0049F67C 74 1A             JE SHORT 0049F698                      ; 如果全部DLL加载完则跳去结束处
0049F67E 035D 08          ADD EBX,DWORD PTR SS:[EBP+8]
0049F681 8B5F 10          MOV EBX,DWORD PTR DS:[EDI+10]
0049F684 035D 08          ADD EBX,DWORD PTR SS:[EBP+8]          ; 获取DLL的名称
0049F687 8BF3             MOV ESI,EBX
0049F689 56                PUSH ESI                               ; /push FileName
0049F68A 8B5D 0C          MOV EBX,DWORD PTR SS:[EBP+C]          ; |
0049F68D FF93 D1BA4000    CALL DWORD PTR DS:[EBX+40BAD1]          ; \LoadLibraryA
0049F693 83C7 14          ADD EDI,14
0049F696  ^ EB DE             JMP SHORT 0049F676                      ; 跳去取下一个dll名
0049F698 61                POPAD
0049F699 C9                LEAVE
0049F69A C2 0800          RETN 8
……
004A7780 CC                INT3                                  ; 再下来这里就异常了,记得上面我们保存下来的代码吗?
是了，把从4A7781处到4A9A04处的代码还原正确的回去。
004A7781 33C9             XOR ECX,ECX
004A7783 8B9D FEC14000    MOV EBX,DWORD PTR SS:[EBP+40C1FE]       ; 还原API的地址[4AA1FE]=004AAA00
004A7789 EB 15             JMP SHORT 004A77A0
004A778B FF348B             PUSH DWORD PTR DS:[EBX+ECX*4]          ; 471cec
004A778E FFB5 F6BD4000    PUSH DWORD PTR SS:[EBP+40BDF6]          ; relo =9e000
004A7794 FFB5 DEBD4000    PUSH DWORD PTR SS:[EBP+40BDDE]          ; pe header =400000
004A779A E8 DE78FFFF       CALL 0049F07D                         ; Fill Api Function
0049F07D 55                PUSH EBP
0049F07E 8BEC             MOV EBP,ESP
0049F080 83C4 EC          ADD ESP,-14
0049F083 60                PUSHAD
0049F084 8B45 08          MOV EAX,DWORD PTR SS:[EBP+8]
0049F087 8B50 3C          MOV EDX,DWORD PTR DS:[EAX+3C]
0049F08A 03C2             ADD EAX,EDX
0049F08C 8B90 80000000    MOV EDX,DWORD PTR DS:[EAX+80]
0049F092 0355 08          ADD EDX,DWORD PTR SS:[EBP+8]
0049F095 8955 FC          MOV DWORD PTR SS:[EBP-4],EDX
0049F098 8BFA             MOV EDI,EDX
0049F09A 8B5F 10          MOV EBX,DWORD PTR DS:[EDI+10]
0049F09D 83FB 00          CMP EBX,0
0049F0A0 0F84 09010000    JE 0049F1AF                            ; 如果输入表处理完则啵
0049F0A6 035D 08          ADD EBX,DWORD PTR SS:[EBP+8]
0049F0A9 895D F0          MOV DWORD PTR SS:[EBP-10],EBX
0049F0AC FF75 F0          PUSH DWORD PTR SS:[EBP-10]             ; push DLL name
0049F0AF 8B5D 0C          MOV EBX,DWORD PTR SS:[EBP+C]
0049F0B2 FF93 C0BA4000    CALL DWORD PTR DS:[EBX+40BAC0]          ; GetModuleHandleA获取dll的句柄
0049F0B8 8BD0             MOV EDX,EAX
0049F0BA 8B5F 0C          MOV EBX,DWORD PTR DS:[EDI+C]
0049F0BD 035D 08          ADD EBX,DWORD PTR SS:[EBP+8]
0049F0C0 895D F8          MOV DWORD PTR SS:[EBP-8],EBX
0049F0C3 8B1F             MOV EBX,DWORD PTR DS:[EDI]             ; OfirstThunk
0049F0C5 83FB 00          CMP EBX,0
0049F0C8 0F84 8B000000    JE 0049F159                            ; 如果OriginalFirstThunk为空则跳
0049F0CE 035D 08          ADD EBX,DWORD PTR SS:[EBP+8]
0049F0D1 895D F4          MOV DWORD PTR SS:[EBP-C],EBX
0049F0D4 33C9             XOR ECX,ECX
0049F0D6 8B75 F4          MOV ESI,DWORD PTR SS:[EBP-C]
0049F0D9 8B048E             MOV EAX,DWORD PTR DS:[ESI+ECX*4]
0049F0DC 83F8 00          CMP EAX,0
0049F0DF 0F84 C2000000    JE 0049F1A7                            ; 比较当前DLL的API函数是否已经处理完了
0049F0E5 25 00000080       AND EAX,80000000
0049F0EA 83F8 00          CMP EAX,0
0049F0ED 74 32             JE SHORT 0049F121                      ; 判断是否为序号方式获取，如果是认名字则啵
0049F0EF 8B048E             MOV EAX,DWORD PTR DS:[ESI+ECX*4]
0049F0F2 25 FFFFFF7F       AND EAX,7FFFFFFF
0049F0F7 8B5D F8          MOV EBX,DWORD PTR SS:[EBP-8]
0049F0FA 8D1C8B             LEA EBX,DWORD PTR DS:[EBX+ECX*4]
0049F0FD 3B5D 10          CMP EBX,DWORD PTR SS:[EBP+10]
0049F100 75 1C             JNZ SHORT 0049F11E
0049F102 51                PUSH ECX
0049F103 52                PUSH EDX
0049F104 50                PUSH EAX
0049F105 52                PUSH EDX
0049F106 8B5D 0C          MOV EBX,DWORD PTR SS:[EBP+C]
0049F109 FF93 E4BA4000    CALL DWORD PTR DS:[EBX+40BAE4]
0049F10F 5A                POP EDX
0049F110 59                POP ECX
0049F111 8B5D F8          MOV EBX,DWORD PTR SS:[EBP-8]
0049F114 8D1C8B             LEA EBX,DWORD PTR DS:[EBX+ECX*4]
0049F117 8903             MOV DWORD PTR DS:[EBX],EAX
0049F119 E9 91000000       JMP 0049F1AF
0049F11E 41                INC ECX
0049F11F  ^ EB B5             JMP SHORT 0049F0D6
0049F121 8B75 F4          MOV ESI,DWORD PTR SS:[EBP-C]          ; OriginalFirstThunk
0049F124 8B048E             MOV EAX,DWORD PTR DS:[ESI+ECX*4]
0049F127 83F8 00          CMP EAX,0
0049F12A 74 7B             JE SHORT 0049F1A7
0049F12C 0345 08          ADD EAX,DWORD PTR SS:[EBP+8]
0049F12F 83C0 02          ADD EAX,2
0049F132 8B5D F8          MOV EBX,DWORD PTR SS:[EBP-8]
0049F135 8D1C8B             LEA EBX,DWORD PTR DS:[EBX+ECX*4]
0049F138 3B5D 10          CMP EBX,DWORD PTR SS:[EBP+10]
0049F13B 75 19             JNZ SHORT 0049F156
0049F13D 51                PUSH ECX
0049F13E 52                PUSH EDX
0049F13F 50                PUSH EAX                               ; /ProcNameOrOrdinal
0049F140 52                PUSH EDX                               ; |hModule
0049F141 8B5D 0C          MOV EBX,DWORD PTR SS:[EBP+C]          ; |
0049F144 FF93 E4BA4000    CALL DWORD PTR DS:[EBX+40BAE4]          ; \GetProcAddress
0049F14A 5A                POP EDX
0049F14B 59                POP ECX
0049F14C 8B5D F8          MOV EBX,DWORD PTR SS:[EBP-8]
0049F14F 8D1C8B             LEA EBX,DWORD PTR DS:[EBX+ECX*4]
0049F152 8903             MOV DWORD PTR DS:[EBX],EAX
0049F154 EB 59             JMP SHORT 0049F1AF
0049F156 41                INC ECX
0049F157  ^ EB C8             JMP SHORT 0049F121
0049F159 33C9             XOR ECX,ECX
0049F15B 8B5F 24          MOV EBX,DWORD PTR DS:[EDI+24]
0049F15E 035D 08          ADD EBX,DWORD PTR SS:[EBP+8]
0049F161 895D EC          MOV DWORD PTR SS:[EBP-14],EBX
0049F164 8B75 F0          MOV ESI,DWORD PTR SS:[EBP-10]
0049F167 803E 00          CMP BYTE PTR DS:[ESI],0
0049F16A 74 03             JE SHORT 0049F16F
0049F16C 46                INC ESI
0049F16D  ^ EB F8             JMP SHORT 0049F167
0049F16F 46                INC ESI
0049F170 3B75 EC          CMP ESI,DWORD PTR SS:[EBP-14]
0049F173 74 32             JE SHORT 0049F1A7
0049F175 803E 00          CMP BYTE PTR DS:[ESI],0
0049F178  ^ 74 F5             JE SHORT 0049F16F
0049F17A 837E 01 00       CMP DWORD PTR DS:[ESI+1],0
0049F17E 74 2F             JE SHORT 0049F1AF
0049F180 8B5D F8          MOV EBX,DWORD PTR SS:[EBP-8]
0049F183 8D1C8B             LEA EBX,DWORD PTR DS:[EBX+ECX*4]
0049F186 3B5D 10          CMP EBX,DWORD PTR SS:[EBP+10]
0049F189 75 19             JNZ SHORT 0049F1A4
0049F18B 51                PUSH ECX
0049F18C 52                PUSH EDX
0049F18D 56                PUSH ESI
0049F18E 52                PUSH EDX
0049F18F 8B5D 0C          MOV EBX,DWORD PTR SS:[EBP+C]
0049F192 FF93 E4BA4000    CALL DWORD PTR DS:[EBX+40BAE4]
0049F198 5A                POP EDX
0049F199 59                POP ECX
0049F19A 8B5D F8          MOV EBX,DWORD PTR SS:[EBP-8]
0049F19D 8D1C8B             LEA EBX,DWORD PTR DS:[EBX+ECX*4]
0049F1A0 8903             MOV DWORD PTR DS:[EBX],EAX
0049F1A2 EB 0B             JMP SHORT 0049F1AF
0049F1A4 41                INC ECX
0049F1A5  ^ EB C0             JMP SHORT 0049F167
0049F1A7 83C7 14          ADD EDI,14
0049F1AA  ^ E9 EBFEFFFF       JMP 0049F09A
0049F1AF 61                POPAD
0049F1B0 C9                LEAVE
0049F1B1 C2 0C00          RETN 0C

004A779F 41                INC ECX
004A77A0 3B8D FAC14000    CMP ECX,DWORD PTR SS:[EBP+40C1FA]
004A77A6  ^ 72 E3             JB SHORT 004A778B                      ; 循环处理输入表
……
004A8303 8BC5          MOV EAX,EBP
004A8305 8B95 2AC24000 MOV EDX,DWORD PTR SS:[EBP+40C22A]       ; 校验值2cd76ec4
004A830B 3395 02C24000 XOR EDX,DWORD PTR SS:[EBP+40C202]       ; 如果前面改过,程序算出的oep地址就会出错
004A8311 8995 02C24000 MOV DWORD PTR SS:[EBP+40C202],EDX       ; OEP地址保存到4aa202处
004A8317 5F             POP EDI
004A8318 5A             POP EDX
004A8319 59             POP ECX
004A831A 5E             POP ESI
004A831B 5B             POP EBX
004A831C 5D             POP EBP
004A831D 05 FA114000    ADD EAX,004011FA
004A8322 50             PUSH EAX
004A8323 64:FF35 0000000>PUSH DWORD PTR FS:[0]
004A832A 64:8925 0000000>MOV DWORD PTR FS:[0],ESP                ; install hook安装she,( 0049F1FA)
004A8331 2D FA114000    SUB EAX,004011FA
004A8336 FFB0 02C24000 PUSH DWORD PTR DS:[EAX+40C202]          ; push oep
……
004A9A04 C3             RETN                                  ; 终于到光明顶了:-)
下面看看API的处理：
0049F2BA E8 00000000    CALL 0049F2BF
0049F2BF 58             POP EAX
0049F2C0 2D BF124000    SUB EAX,004012BF
0049F2C5 C780 22C24000 0>MOV DWORD PTR DS:[EAX+40C222],0
0049F2CF 8B80 02C24000 MOV EAX,DWORD PTR DS:[EAX+40C202]       ; 程序OEP地址入eax中
0049F2D5 8138 558BEC83 CMP DWORD PTR DS:[EAX],83EC8B55       ; 判断是否为push ebp mov ebp,esp add esp,xx方式的程序
0049F2DB 75 06          JNZ SHORT 0049F2E3                      ; 如果不是则跳
0049F2DD 58             POP EAX
0049F2DE 8B40 FC       MOV EAX,DWORD PTR DS:[EAX-4]
0049F2E1 EB 7D          JMP SHORT 0049F360
0049F2E3 8038 EB       CMP BYTE PTR DS:[EAX],0EB             ; 判断是否为BC的程序jmp xxxx
0049F2E6 75 06          JNZ SHORT 0049F2EE                      ; 如果不是则跳
0049F2E8 58             POP EAX
0049F2E9 8B40 FC       MOV EAX,DWORD PTR DS:[EAX-4]          ; 获取要保存输入表的地址iat
0049F2EC EB 72          JMP SHORT 0049F360                      ; 然后跳去获取api函数
0049F2EE 8B0424       MOV EAX,DWORD PTR SS:[ESP]
0049F2F1 817C24 04 00000>CMP DWORD PTR SS:[ESP+4],80000000
0049F2F9 73 06          JNB SHORT 0049F301
0049F2FB 334424 04    XOR EAX,DWORD PTR SS:[ESP+4]
0049F2FF EB 08          JMP SHORT 0049F309
0049F301 8B0424       MOV EAX,DWORD PTR SS:[ESP]
0049F304 8B40 FC       MOV EAX,DWORD PTR DS:[EAX-4]
0049F307 EB 57          JMP SHORT 0049F360
0049F309 3D 00001000    CMP EAX,100000
0049F30E 73 06          JNB SHORT 0049F316
0049F310 58             POP EAX
0049F311 8B40 FC       MOV EAX,DWORD PTR DS:[EAX-4]
0049F314 EB 4A          JMP SHORT 0049F360
0049F316 3D 00000070    CMP EAX,70000000
0049F31B 73 08          JNB SHORT 0049F325
0049F31D 8B0424       MOV EAX,DWORD PTR SS:[ESP]
0049F320 8B40 FC       MOV EAX,DWORD PTR DS:[EAX-4]
0049F323 EB 3B          JMP SHORT 0049F360
0049F325 813C24 00000070 CMP DWORD PTR SS:[ESP],70000000
0049F32C 73 01          JNB SHORT 0049F32F
0049F32E 58             POP EAX
0049F32F E8 00000000    CALL 0049F334
0049F334 58             POP EAX
0049F335 2D 34134000    SUB EAX,00401334
0049F33A C780 22C24000 0>MOV DWORD PTR DS:[EAX+40C222],1
0049F344 8B8424 E4000000 MOV EAX,DWORD PTR SS:[ESP+E4]
0049F34B 3D 03000080    CMP EAX,80000003
0049F350 0F85 98000000 JNZ 0049F3EE
0049F356 8B8424 F0000000 MOV EAX,DWORD PTR SS:[ESP+F0]
0049F35D 8B40 02       MOV EAX,DWORD PTR DS:[EAX+2]
0049F360 60             PUSHAD                                  ; 下面准备填充iat
0049F361 E8 00000000    CALL 0049F366
0049F366 5D             POP EBP
0049F367 81ED 66134000 SUB EBP,00401366                      ; 计算重定位值
0049F36D 50             PUSH EAX                               ; push iat address
0049F36E FFB5 F6BD4000 PUSH DWORD PTR SS:[EBP+40BDF6]          ; push relo(9E000)
0049F374 FFB5 DEBD4000 PUSH DWORD PTR SS:[EBP+40BDDE]          ; push hmodule
0049F37A E8 FEFCFFFF    CALL 0049F07D                         ; GetProcAddress获取填充api
0049F37F 61             POPAD
0049F380 52             PUSH EDX
0049F381 51             PUSH ECX
0049F382 E8 00000000    CALL 0049F387
0049F387 5A             POP EDX
0049F388 81EA 87134000 SUB EDX,00401387
0049F38E 81C2 BA124000 ADD EDX,004012BA                      ; 计算还原值
0049F394 8B08          MOV ECX,DWORD PTR DS:[EAX]             ; 把api函数地址放到ECX中
0049F396 8910          MOV DWORD PTR DS:[EAX],EDX             ;  取出API函数地址后还原"现场"
0049F398 8BC1          MOV EAX,ECX
0049F39A 59             POP ECX
0049F39B 5A             POP EDX
0049F39C 52             PUSH EDX
0049F39D E8 00000000    CALL 0049F3A2
0049F3A2 5A             POP EDX
0049F3A3 81EA A2134000 SUB EDX,004013A2                      ; 计算reloc
0049F3A9 83BA 22C24000 0>CMP DWORD PTR DS:[EDX+40C222],0
0049F3B0 75 05          JNZ SHORT 0049F3B7
0049F3B2 5A             POP EDX
0049F3B3 FFE0          JMP EAX                               ; 跳去执行api函数
0049F3B5 EB 37          JMP SHORT 0049F3EE
0049F3B7 5A             POP EDX
0049F3B8 8BBC24 F0000000 MOV EDI,DWORD PTR SS:[ESP+F0]
0049F3BF 83C7 01       ADD EDI,1
0049F3C2 803F 3D       CMP BYTE PTR DS:[EDI],3D
0049F3C5 74 0B          JE SHORT 0049F3D2
0049F3C7 8B7D 10       MOV EDI,DWORD PTR SS:[EBP+10]
0049F3CA 8987 A0000000 MOV DWORD PTR DS:[EDI+A0],EAX
0049F3D0 EB 09          JMP SHORT 0049F3DB
0049F3D2 8B7D 10       MOV EDI,DWORD PTR SS:[EBP+10]
0049F3D5 8987 9C000000 MOV DWORD PTR DS:[EDI+9C],EAX
0049F3DB 8B8424 F0000000 MOV EAX,DWORD PTR SS:[ESP+F0]
0049F3E2 83C0 06       ADD EAX,6
0049F3E5 8987 B8000000 MOV DWORD PTR DS:[EDI+B8],EAX
0049F3EB 33C0          XOR EAX,EAX
0049F3ED C3             RETN
分析完api的处理后，写上一段修复程序：

00473601 60             PUSHAD
00473602 B8 24EE4500    MOV EAX,0045EE24                      ; JMP to BORLNDMM.GetAllocMemCount
00473607 66:8138 FF15    CMP WORD PTR DS:[EAX],15FF
0047360C 75 33          JNZ SHORT 00473641
0047360E 8B50 02       MOV EDX,DWORD PTR DS:[EAX+2]
00473611 81FA 00000008 CMP EDX,8000000
00473617 73 28          JNB SHORT 00473641
00473619 81FA 00004000 CMP EDX,00400000                      ; ASCII "MZP"
0047361F 72 20          JB SHORT 00473641
00473621 813A BAF24900 CMP DWORD PTR DS:[EDX],0049F2BA
00473627 75 15          JNZ SHORT 0047363E
00473629 52             PUSH EDX       ;将要保存的地址
0047362A 68 00E00900    PUSH 9E000       ;重定位值
0047362F 68 00004000    PUSH 00400000                         ; ASCII "MZP"
00473634 E8 44BA0200    CALL 0049F07D       ;填充api
00473639 66:C700 FF25    MOV WORD PTR DS:[EAX],25FF
0047363E 83C0 05       ADD EAX,5
00473641 40             INC EAX
00473642 3D 58F74500    CMP EAX,0045F758
00473647  ^ 72 BE          JB SHORT 00473607
00473649 61             POPAD
0047364A  ^ E9 EDDBF8FF    JMP 0040123C
‘-----------------------------Binary code---------------------------
60 B8 24 EE 45 00 66 81 38 FF 15 75 33 8B 50 02 81 FA 00 00 00 08 73 28 81 FA 00 00 40 00 72 20
81 3A BA F2 49 00 75 15 52 68 00 E0 09 00 68 00 00 40 00 E8 44 BA 02 00 66 C7 00 FF 25 83 C0 05
40 3D 58 F7 45 00 72 BE 61 E9 ED DB F8 FF
‘------------------------------------END----------------------------------------
完成后，用IMPrec 写入OEP：123C  RVA：000710C8  SIZE：00000C74,用lordpe dump,最后修复。OK！
这个壳去年就想好好看一下了，因时间比较紧，所以一直拖到今年才有空看，壳完全搞明白加文章用了几天的时间。
Greetz:
Fly.Jingulong,yock,tDasm.David.hexer,hmimys,ahao.UFO(brother).alan(sister).all of my friends and you!

By loveboom[DFCG][FCG][US]
Email:loveboom#163.com
Date:2/25/2005 12:36:00 PM

附件:Tut.rar

登录后可查看完整内容

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)

收藏・0

免费・7

支持

最新回复 (13)
David 雪币： 411 活跃值： (1160) 能力值： ( LV9，RANK：810 ) 在线值：发帖 44 回帖 404 粉丝 4 关注私信	David 20 2 楼，又是一壳狂。 2005-2-25 13:01 0
lfsx 雪币： 218 活跃值： (40) 能力值： ( LV2，RANK：10 ) 在线值：发帖 9 回帖 169 粉丝 1 关注私信	lfsx 3 楼 2005-2-25 13:04 0
采臣·宁雪币： 161 活跃值： (231) 能力值： ( LV4，RANK：50 ) 在线值：发帖 33 回帖 1343 粉丝 6 关注私信	采臣·宁 1 4 楼好贴正如美女，我顶 2005-2-25 13:08 0
cyclotron 雪币： 392 活跃值： (909) 能力值： ( LV9，RANK：690 ) 在线值：发帖 43 回帖 800 粉丝 9 关注私信	cyclotron 17 5 楼最初由 loveboom 发布完成未了心愿! 附件:Tut.rar 此生无悔了 2005-2-25 13:19 0
clide2000 雪币： 301 活跃值： (300) 能力值： ( LV9，RANK：290 ) 在线值：发帖 56 回帖 1209 粉丝 2 关注私信	clide2000 7 6 楼辛苦了,收藏 2005-2-25 13:40 0
peaceclub 雪币： 255 活跃值： (207) 能力值： ( LV9，RANK：250 ) 在线值：发帖 59 回帖 967 粉丝 1 关注私信	peaceclub 6 7 楼最初由 loveboom 发布完成未了心愿! 附件:Tut.rar 心愿也完成了,你可以走了. 2005-2-25 14:38 0
qq7119 雪币： 207 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 30 回帖 477 粉丝 0 关注私信	qq7119 8 楼两家的人相互窜门 2005-2-25 18:17 0
linhanshi 雪币： 97697 活跃值： (200824) 能力值： (RANK：10 ) 在线值：发帖 9249 回帖 27947 粉丝 452 关注私信	linhanshi 9 楼支持... 2005-2-25 19:14 0
pendan2001 雪币： 61 活跃值： (160) 能力值： ( LV9，RANK：170 ) 在线值：发帖 25 回帖 1180 粉丝 0 关注私信	pendan2001 4 10 楼辛苦了,收藏 2005-2-25 19:28 0
xIkUg 雪币： 116 活跃值： (220) 能力值： ( LV12，RANK：370 ) 在线值：发帖 27 回帖 675 粉丝 4 关注私信	xIkUg 9 11 楼新版的快出来了...嘿嘿...这次用delphi重写了内核,加入了些新的东西... 2005-2-25 19:43 0
kingjia 雪币： 192 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 8 回帖 133 粉丝 0 关注私信	kingjia 12 楼心语心愿，愿你的心语，你的心愿都能成真。没有做不了的事，只有不想做的事 2005-2-25 22:15 0
qiweixue 雪币： 258 活跃值： (230) 能力值： ( LV12，RANK：770 ) 在线值：发帖 47 回帖 1136 粉丝 3 关注私信	qiweixue 19 13 楼 thanks 共享。。。 2005-2-26 15:14 0
采臣·宁雪币： 161 活跃值： (231) 能力值： ( LV4，RANK：50 ) 在线值：发帖 33 回帖 1343 粉丝 6 关注私信	采臣·宁 1 14 楼期待着新版的出现，不然这么多高手没有事做了。呵呵 2005-2-26 15:21 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

loveboom

100

发帖

690

回帖

2130

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (13)
David 雪币： 411 活跃值： (1160) 能力值： ( LV9，RANK：810 ) 在线值：发帖 44 回帖 404 粉丝 4 关注私信	David 20 2 楼，又是一壳狂。 2005-2-25 13:01 0
lfsx 雪币： 218 活跃值： (40) 能力值： ( LV2，RANK：10 ) 在线值：发帖 9 回帖 169 粉丝 1 关注私信	lfsx 3 楼 2005-2-25 13:04 0
采臣·宁雪币： 161 活跃值： (231) 能力值： ( LV4，RANK：50 ) 在线值：发帖 33 回帖 1343 粉丝 6 关注私信	采臣·宁 1 4 楼好贴正如美女，我顶 2005-2-25 13:08 0
cyclotron 雪币： 392 活跃值： (909) 能力值： ( LV9，RANK：690 ) 在线值：发帖 43 回帖 800 粉丝 9 关注私信	cyclotron 17 5 楼最初由 loveboom 发布完成未了心愿! 附件:Tut.rar 此生无悔了 2005-2-25 13:19 0
clide2000 雪币： 301 活跃值： (300) 能力值： ( LV9，RANK：290 ) 在线值：发帖 56 回帖 1209 粉丝 2 关注私信	clide2000 7 6 楼辛苦了,收藏 2005-2-25 13:40 0
peaceclub 雪币： 255 活跃值： (207) 能力值： ( LV9，RANK：250 ) 在线值：发帖 59 回帖 967 粉丝 1 关注私信	peaceclub 6 7 楼最初由 loveboom 发布完成未了心愿! 附件:Tut.rar 心愿也完成了,你可以走了. 2005-2-25 14:38 0
qq7119 雪币： 207 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 30 回帖 477 粉丝 0 关注私信	qq7119 8 楼两家的人相互窜门 2005-2-25 18:17 0
linhanshi 雪币： 97697 活跃值： (200824) 能力值： (RANK：10 ) 在线值：发帖 9249 回帖 27947 粉丝 452 关注私信	linhanshi 9 楼支持... 2005-2-25 19:14 0
pendan2001 雪币： 61 活跃值： (160) 能力值： ( LV9，RANK：170 ) 在线值：发帖 25 回帖 1180 粉丝 0 关注私信	pendan2001 4 10 楼辛苦了,收藏 2005-2-25 19:28 0
xIkUg 雪币： 116 活跃值： (220) 能力值： ( LV12，RANK：370 ) 在线值：发帖 27 回帖 675 粉丝 4 关注私信	xIkUg 9 11 楼新版的快出来了...嘿嘿...这次用delphi重写了内核,加入了些新的东西... 2005-2-25 19:43 0
kingjia 雪币： 192 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 8 回帖 133 粉丝 0 关注私信	kingjia 12 楼心语心愿，愿你的心语，你的心愿都能成真。没有做不了的事，只有不想做的事 2005-2-25 22:15 0
qiweixue 雪币： 258 活跃值： (230) 能力值： ( LV12，RANK：770 ) 在线值：发帖 47 回帖 1136 粉丝 3 关注私信	qiweixue 19 13 楼 thanks 共享。。。 2005-2-26 15:14 0
采臣·宁雪币： 161 活跃值： (231) 能力值： ( LV4，RANK：50 ) 在线值：发帖 33 回帖 1343 粉丝 6 关注私信	采臣·宁 1 14 楼期待着新版的出现，不然这么多高手没有事做了。呵呵 2005-2-26 15:21 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复