00558CC0 >/$ 55 PUSH EBP ; (Initial CPU selection)
00558CC1 |. 8BEC MOV EBP,ESP
00558CC3 |. B9 08000000 MOV ECX,8
00558CC8 |> 6A 00 /PUSH 0
00558CCA |. 6A 00 |PUSH 0
00558CCC |. 49 |DEC ECX
00558CCD |.^ 75 F9 \JNZ SHORT AuditOff.00558CC8
00558CCF |. 53 PUSH EBX
00558CD0 |. 56 PUSH ESI
00558CD1 |. 57 PUSH EDI
00558CD2 |. B8 F8855500 MOV EAX,AuditOff.005585F8
00558CD7 |. E8 44E7EAFF CALL AuditOff.00407420
00558CDC |. 8B3D D4D65500 MOV EDI,DWORD PTR DS:[55D6D4] ; AuditOff.0055EBB8
00558CE2 |. 33C0 XOR EAX,EAX
00558CE4 |. 55 PUSH EBP
00558CE5 |. 68 568E5500 PUSH AuditOff.00558E56
00558CEA |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00558CED |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
00558CF0 |. E8 8F9EEAFF CALL AuditOff.00402B84
00558CF5 |. 8BF0 MOV ESI,EAX
00558CF7 |. 85F6 TEST ESI,ESI
00558CF9 |. 0F8E D4000000 JLE AuditOff.00558DD3
00558CFF |. BB 01000000 MOV EBX,1
00558D04 |> 8D55 E4 /LEA EDX,DWORD PTR SS:[EBP-1C]
00558D07 |. 8BC3 |MOV EAX,EBX
00558D09 |. E8 D69EEAFF |CALL AuditOff.00402BE4
00558D0E |. 8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C]
00558D11 |. 8D55 E8 |LEA EDX,DWORD PTR SS:[EBP-18]
00558D14 |. E8 C308EBFF |CALL AuditOff.004095DC
00558D19 |. 8B45 E8 |MOV EAX,DWORD PTR SS:[EBP-18]
00558D1C |. 8D55 EC |LEA EDX,DWORD PTR SS:[EBP-14]
00558D1F |. E8 EC0AEBFF |CALL AuditOff.00409810
00558D24 |. 8B45 EC |MOV EAX,DWORD PTR SS:[EBP-14]
00558D27 |. BA 708E5500 |MOV EDX,AuditOff.00558E70 ; /unregserver
00558D2C |. E8 FFC3EAFF |CALL AuditOff.00405130
00558D31 |. 0F84 8D000000 |JE AuditOff.00558DC4
00558D37 |. 8D55 D8 |LEA EDX,DWORD PTR SS:[EBP-28]
00558D3A |. 8BC3 |MOV EAX,EBX
00558D3C |. E8 A39EEAFF |CALL AuditOff.00402BE4
00558D41 |. 8B45 D8 |MOV EAX,DWORD PTR SS:[EBP-28]
00558D44 |. 8D55 DC |LEA EDX,DWORD PTR SS:[EBP-24]
00558D47 |. E8 9008EBFF |CALL AuditOff.004095DC
00558D4C |. 8B45 DC |MOV EAX,DWORD PTR SS:[EBP-24]
00558D4F |. 8D55 E0 |LEA EDX,DWORD PTR SS:[EBP-20]
00558D52 |. E8 B90AEBFF |CALL AuditOff.00409810
00558D57 |. 8B45 E0 |MOV EAX,DWORD PTR SS:[EBP-20]
00558D5A |. BA 888E5500 |MOV EDX,AuditOff.00558E88 ; /regserver
00558D5F |. E8 CCC3EAFF |CALL AuditOff.00405130
00558D64 |. 74 5E |JE SHORT AuditOff.00558DC4
00558D66 |. 8D55 CC |LEA EDX,DWORD PTR SS:[EBP-34]
00558D69 |. 8BC3 |MOV EAX,EBX
00558D6B |. E8 749EEAFF |CALL AuditOff.00402BE4
00558D70 |. 8B45 CC |MOV EAX,DWORD PTR SS:[EBP-34]
00558D73 |. 8D55 D0 |LEA EDX,DWORD PTR SS:[EBP-30]
00558D76 |. E8 6108EBFF |CALL AuditOff.004095DC
00558D7B |. 8B45 D0 |MOV EAX,DWORD PTR SS:[EBP-30]
00558D7E |. 8D55 D4 |LEA EDX,DWORD PTR SS:[EBP-2C]
00558D81 |. E8 8A0AEBFF |CALL AuditOff.00409810
00558D86 |. 8B45 D4 |MOV EAX,DWORD PTR SS:[EBP-2C]
00558D89 |. BA 9C8E5500 |MOV EDX,AuditOff.00558E9C ; -unregserver
00558D8E |. E8 9DC3EAFF |CALL AuditOff.00405130
00558D93 |. 74 2F |JE SHORT AuditOff.00558DC4
00558D95 |. 8D55 C0 |LEA EDX,DWORD PTR SS:[EBP-40]
00558D98 |. 8BC3 |MOV EAX,EBX
00558D9A |. E8 459EEAFF |CALL AuditOff.00402BE4
00558D9F |. 8B45 C0 |MOV EAX,DWORD PTR SS:[EBP-40]
00558DA2 |. 8D55 C4 |LEA EDX,DWORD PTR SS:[EBP-3C]
00558DA5 |. E8 3208EBFF |CALL AuditOff.004095DC
00558DAA |. 8B45 C4 |MOV EAX,DWORD PTR SS:[EBP-3C]
00558DAD |. 8D55 C8 |LEA EDX,DWORD PTR SS:[EBP-38]
00558DB0 |. E8 5B0AEBFF |CALL AuditOff.00409810
00558DB5 |. 8B45 C8 |MOV EAX,DWORD PTR SS:[EBP-38]
00558DB8 |. BA B48E5500 |MOV EDX,AuditOff.00558EB4 ; -regserver
00558DBD |. E8 6EC3EAFF |CALL AuditOff.00405130
00558DC2 |. 75 07 |JNZ SHORT AuditOff.00558DCB
00558DC4 |> 8B07 |MOV EAX,DWORD PTR DS:[EDI]
00558DC6 |. E8 3DC1F0FF |CALL AuditOff.00464F08
00558DCB |> 43 |INC EBX
00558DCC |. 4E |DEC ESI
00558DCD |.^ 0F85 31FFFFFF \JNZ AuditOff.00558D04
00558DD3 |> 68 C08E5500 PUSH AuditOff.00558EC0 ; {4BEB2B30-3327-4EDA-ADE9-DFF226AA34DE}
00558DD8 |. 6A 00 PUSH 0
00558DDA |. 6A 00 PUSH 0
00558DDC |. E8 97E8EAFF CALL AuditOff.00407678
00558DE1 |. 8BD8 MOV EBX,EAX
00558DE3 |. E8 E0E9EAFF CALL <JMP.&kernel32.GetLastError> ; [GetLastError
00558DE8 |. 3D B7000000 CMP EAX,0B7
00558DED |. 74 4C JE SHORT AuditOff.00558E3B
00558DEF |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00558DF1 |. C640 5B 00 MOV BYTE PTR DS:[EAX+5B],0
00558DF5 |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00558DF7 |. BA F08E5500 MOV EDX,AuditOff.00558EF0 ;
00558DFC |. E8 FFBCF0FF CALL AuditOff.00464B00
00558E01 |. 8B0D F8D85500 MOV ECX,DWORD PTR DS:[55D8F8] ; AuditOff.0055F0C0
00558E07 |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00558E09 |. 8B15 E4EA4F00 MOV EDX,DWORD PTR DS:[4FEAE4] ; AuditOff.004FEB30
00558E0F |. E8 0CC1F0FF CALL AuditOff.00464F20
00558E14 |. 8B0D 1CD15500 MOV ECX,DWORD PTR DS:[55D11C] ; AuditOff.0055F0CC
00558E1A |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00558E1C |. 8B15 20225000 MOV EDX,DWORD PTR DS:[502220] ; AuditOff.0050226C
00558E22 |. E8 F9C0F0FF CALL AuditOff.00464F20
00558E27 |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00558E29 |. E8 DAC0F0FF CALL AuditOff.00464F08
00558E2E |. 8B07 MOV EAX,DWORD PTR DS:[EDI]
00558E30 |. E8 6BC1F0FF CALL AuditOff.00464FA0
00558E35 |. 53 PUSH EBX ; /hObject
00558E36 |. E8 05E8EAFF CALL <JMP.&kernel32.CloseHandle> ; \CloseHandle
00558E3B |> 33C0 XOR EAX,EAX
00558E3D |. 5A POP EDX
00558E3E |. 59 POP ECX
00558E3F |. 59 POP ECX
00558E40 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
00558E43 |. 68 5D8E5500 PUSH AuditOff.00558E5D
00558E48 |> 8D45 C0 LEA EAX,DWORD PTR SS:[EBP-40]
00558E4B |. BA 0C000000 MOV EDX,0C
00558E50 |. E8 F3BEEAFF CALL AuditOff.00404D48
00558E55 \. C3 RETN
00558E56 .^ E9 69B7EAFF JMP AuditOff.004045C4
00558E5B .^ EB EB JMP SHORT AuditOff.00558E48
00558E5D 5F DB 5F ; CHAR '_'
00558E5E 5E DB 5E ; CHAR '^'
00558E5F 5B DB 5B ; CHAR '['
00558E60 E8 DB E8
00558E61 4B DB 4B ; CHAR 'K'
00558E62 BD DB BD
00558E63 EA DB EA
00558E64 FF DB FF
00558E65 00 DB 00
00558E66 00 DB 00
00558E67 00 DB 00
00558E68 . FFFFFFFF DD FFFFFFFF
00558E6C . 0C000000 DD 0000000C
00558E70 . 2F 75 6E 72 6>ASCII "/unregserver",0
00558E7D 00 DB 00
00558E7E 00 DB 00
00558E7F 00 DB 00
00558E80 . FFFFFFFF DD FFFFFFFF
00558E84 . 0A000000 DD 0000000A
00558E88 . 2F 72 65 67 7>ASCII "/regserver",0
00558E93 00 DB 00
00558E94 . FFFFFFFF DD FFFFFFFF
00558E98 . 0C000000 DD 0000000C
00558E9C . 2D 75 6E 72 6>ASCII "-unregserver",0
00558EA9 00 DB 00
00558EAA 00 DB 00
00558EAB 00 DB 00
00558EAC . FFFFFFFF DD FFFFFFFF
00558EB0 . 0A000000 DD 0000000A
00558EB4 . 2D 72 65 67 7>ASCII "-regserver",0
00558EBF 00 DB 00
00558EC0 . 7B 34 42 45 4>ASCII "{4BEB2B30-3327-4"
00558ED0 . 45 44 41 2D 4>ASCII "EDA-ADE9-DFF226A"
00558EE0 . 41 33 34 44 4>ASCII "A34DE}",0
00558EE7 00 DB 00
希望高手能翻译下。
另外我估计两个地方在检测注册与否,注册码是放在一个文件中的,程序那句是读文件呢?
我跟踪到
00558D93 |. /74 2F |JE SHORT AuditOff.00558DC4中有段CALL为下面的代码
00464F08 /$ 53 PUSH EBX
00464F09 |. A1 24D55500 MOV EAX,DWORD PTR DS:[55D524]
00464F0E |. 8338 00 CMP DWORD PTR DS:[EAX],0
00464F11 |. 74 0A JE SHORT AuditOff.00464F1D
00464F13 |. 8B1D 24D55500 MOV EBX,DWORD PTR DS:[55D524] ; AuditOff.0055E044
00464F19 |. 8B1B MOV EBX,DWORD PTR DS:[EBX]
00464F1B |. FFD3 CALL EBX
00464F1D |> 5B POP EBX
00464F1E \. C3 RETN
00464F1F 90 NOP
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课