大家好！
如题呀，查不出来的壳怎么下手？如附件。
老鸟们指导下，可以吗？谢谢。
什么壳 可能？
0061D290 > 833D 4CDE6100 0>CMP DWORD PTR DS:[61DE4C],0
0061D297 75 05 JNZ SHORT StsServe.0061D29E
0061D299 E9 01000000 JMP StsServe.0061D29F
0061D29E C3 RETN
0061D29F E8 46000000 CALL StsServe.0061D2EA
0061D2A4 E8 73000000 CALL StsServe.0061D31C
0061D2A9 B8 90D26100 MOV EAX,OFFSET StsServe.<模块入口点>
0061D2AE 2B05 08DE6100 SUB EAX,DWORD PTR DS:[61DE08]
0061D2B4 A3 40DE6100 MOV DWORD PTR DS:[61DE40],EAX
0061D2B9 E8 9C000000 CALL StsServe.0061D35A
0061D2BE E8 48020000 CALL StsServe.0061D50B
0061D2C3 E8 F8060000 CALL StsServe.0061D9C0
0061D2C8 E8 47060000 CALL StsServe.0061D914
0061D2CD A1 40DE6100 MOV EAX,DWORD PTR DS:[61DE40]
0061D2D2 C705 4CDE6100 0>MOV DWORD PTR DS:[61DE4C],1
0061D2DC 0105 00DE6100 ADD DWORD PTR DS:[61DE00],EAX
0061D2E2 FF35 00DE6100 PUSH DWORD PTR DS:[61DE00]
0061D2E8 C3 RETN
0061D2E9 C3 RETN
0061D2EA 56 PUSH ESI
0061D2EB 57 PUSH EDI
0061D2EC 68 80D16100 PUSH StsServe.0061D180 ; KERNEL32.DLL
0061D2F1 FF15 00DC6100 CALL DWORD PTR DS:[<&KERNEL32.LoadLibrar>; kernel32.LoadLibraryA
0061D2F7 8B35 08DC6100 MOV ESI,DWORD PTR DS:[<&KERNEL32.GetProc>; kernel32.GetProcAddress
0061D2FD 8BF8 MOV EDI,EAX
0061D2FF 68 90D16100 PUSH StsServe.0061D190 ; VirtualAlloc
0061D304 57 PUSH EDI
0061D305 FFD6 CALL ESI
0061D307 68 A0D16100 PUSH StsServe.0061D1A0 ; VirtualFreenPack v1.1.500.2008: Loader Error
0061D30C 57 PUSH EDI
0061D30D A3 48DE6100 MOV DWORD PTR DS:[61DE48],EAX
0061D312 FFD6 CALL ESI
0061D314 5F POP EDI
0061D315 A3 44DE6100 MOV DWORD PTR DS:[61DE44],EAX
0061D31A 5E POP ESI
0061D31B C3 RETN
0061D31C 56 PUSH ESI
0061D31D 57 PUSH EDI
0061D31E 6A 04 PUSH 4
0061D320 68 00300000 PUSH 3000
0061D325 6A 24 PUSH 24
0061D327 6A 00 PUSH 0
0061D329 FF15 48DE6100 CALL DWORD PTR DS:[61DE48]
0061D32F 8BF0 MOV ESI,EAX
0061D331 BF 00DE6100 MOV EDI,StsServe.0061DE00
0061D336 56 PUSH ESI
0061D337 57 PUSH EDI
0061D338 E8 23FEFFFF CALL StsServe.0061D160
0061D33D 6A 24 PUSH 24
0061D33F 56 PUSH ESI
0061D340 57 PUSH EDI
0061D341 E8 F4FCFFFF CALL StsServe.0061D03A
0061D346 83C4 14 ADD ESP,14
0061D349 68 00400000 PUSH 4000
0061D34E 6A 00 PUSH 0
0061D350 56 PUSH ESI
0061D351 FF15 44DE6100 CALL DWORD PTR DS:[61DE44]
0061D357 5F POP EDI
0061D358 5E POP ESI
0061D359 C3 RETN
0061D35A 83EC 10 SUB ESP,10
0061D35D 55 PUSH EBP
0061D35E 56 PUSH ESI
0061D35F 57 PUSH EDI
0061D360 33ED XOR EBP,EBP
0061D362 FF35 40DE6100 PUSH DWORD PTR DS:[61DE40]
0061D368 896C24 18 MOV DWORD PTR SS:[ESP+18],EBP
0061D36C E8 BFFCFFFF CALL StsServe.0061D030
0061D371 8BF8 MOV EDI,EAX
0061D373 59 POP ECX
0061D374 897C24 18 MOV DWORD PTR SS:[ESP+18],EDI
0061D378 896C24 10 MOV DWORD PTR SS:[ESP+10],EBP
0061D37C 0FB747 14 MOVZX EAX,WORD PTR DS:[EDI+14]
0061D380 8D7438 18 LEA ESI,DWORD PTR DS:[EAX+EDI+18]
0061D384 0FB747 06 MOVZX EAX,WORD PTR DS:[EDI+6]
0061D388 48 DEC EAX
0061D389 85C0 TEST EAX,EAX
0061D38B 0F8E 73010000 JLE StsServe.0061D504
0061D391 53 PUSH EBX
0061D392 396E 10 CMP DWORD PTR DS:[ESI+10],EBP
0061D395 896C24 10 MOV DWORD PTR SS:[ESP+10],EBP
0061D399 0F84 4E010000 JE StsServe.0061D4ED
0061D39F 396E 14 CMP DWORD PTR DS:[ESI+14],EBP
0061D3A2 0F84 45010000 JE StsServe.0061D4ED
0061D3A8 F646 27 10 TEST BYTE PTR DS:[ESI+27],10
0061D3AC 74 0D JE SHORT StsServe.0061D3BB
0061D3AE F605 1CDE6100 0>TEST BYTE PTR DS:[61DE1C],1
0061D3B5 0F85 32010000 JNZ StsServe.0061D4ED
0061D3BB 57 PUSH EDI
0061D3BC 56 PUSH ESI
0061D3BD 6A 02 PUSH 2
0061D3BF E8 3CFCFFFF CALL StsServe.0061D000
0061D3C4 83C4 0C ADD ESP,0C
0061D3C7 85C0 TEST EAX,EAX
0061D3C9 74 14 JE SHORT StsServe.0061D3DF
0061D3CB 392D 0CDE6100 CMP DWORD PTR DS:[61DE0C],EBP
0061D3D1 0F84 16010000 JE StsServe.0061D4ED
0061D3D7 C74424 10 01000>MOV DWORD PTR SS:[ESP+10],1
0061D3DF 57 PUSH EDI
0061D3E0 56 PUSH ESI
0061D3E1 55 PUSH EBP
0061D3E2 E8 19FCFFFF CALL StsServe.0061D000
0061D3E7 83C4 0C ADD ESP,0C
0061D3EA 85C0 TEST EAX,EAX
0061D3EC 0F85 FB000000 JNZ StsServe.0061D4ED
0061D3F2 8B46 10 MOV EAX,DWORD PTR DS:[ESI+10]
0061D3F5 BF 00300000 MOV EDI,3000
0061D3FA 6A 04 PUSH 4
0061D3FC 57 PUSH EDI
0061D3FD 50 PUSH EAX
0061D3FE 55 PUSH EBP
0061D3FF FF15 48DE6100 CALL DWORD PTR DS:[61DE48]
0061D405 396C24 10 CMP DWORD PTR SS:[ESP+10],EBP
0061D409 8BD8 MOV EBX,EAX
0061D40B 74 4B JE SHORT StsServe.0061D458
0061D40D 8B4E 10 MOV ECX,DWORD PTR DS:[ESI+10]
0061D410 A1 0CDE6100 MOV EAX,DWORD PTR DS:[61DE0C]
0061D415 2BC8 SUB ECX,EAX
0061D417 51 PUSH ECX
0061D418 8B4E 0C MOV ECX,DWORD PTR DS:[ESI+C]
0061D41B 03C8 ADD ECX,EAX
0061D41D 030D 40DE6100 ADD ECX,DWORD PTR DS:[61DE40]
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
