一个抓包软件Smart Sniffer 用Peid查出来是UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo的壳，根据ESP定律跳转后，跑到如下位置：
0042D15D . 58 pop eax
0042D15E . 61 popad
0042D15F . 8D4424 80 lea eax, dword ptr [esp-80] <---------这里
0042D163 > 6A 00 push 0
0042D165 . 39C4 cmp esp, eax
0042D167 .^ 75 FA jnz short 0042D163
0042D169 . 83EC 80 sub esp, -80
0042D16C .- E9 C13FFEFF jmp 00411132 <-----------跳转
0042D171 00 db 00
0042D172 00 db 00
0042D173 00 db 00
0042D174 00 db 00
跳到这里：
00411132 6A 70 push 70
00411134 68 70244100 push 00412470
00411139 E8 DE010000 call 0041131C
0041113E 33DB xor ebx, ebx
00411140 53 push ebx
00411141 8B3D 98204100 mov edi, dword ptr [412098] ; kernel32.GetModuleHandleA
00411147 FFD7 call edi
00411149 66:8138 4D5A cmp word ptr [eax], 5A4D
0041114E 75 1F jnz short 0041116F
00411150 8B48 3C mov ecx, dword ptr [eax+3C]
00411153 03C8 add ecx, eax
00411155 8139 50450000 cmp dword ptr [ecx], 4550
0041115B 75 12 jnz short 0041116F
0041115D 0FB741 18 movzx eax, word ptr [ecx+18]
00411161 3D 0B010000 cmp eax, 10B
00411166 74 1F je short 00411187
00411168 3D 0B020000 cmp eax, 20B
0041116D 74 05 je short 00411174
0041116F 895D E4 mov dword ptr [ebp-1C], ebx
00411172 EB 27 jmp short 0041119B
00411174 83B9 84000000 0>cmp dword ptr [ecx+84], 0E
0041117B ^ 76 F2 jbe short 0041116F
0041117D 33C0 xor eax, eax
0041117F 3999 F8000000 cmp dword ptr [ecx+F8], ebx
00411185 EB 0E jmp short 00411195
00411187 8379 74 0E cmp dword ptr [ecx+74], 0E
0041118B ^ 76 E2 jbe short 0041116F
0041118D 33C0 xor eax, eax
0041118F 3999 E8000000 cmp dword ptr [ecx+E8], ebx
00411195 0F95C0 setne al
00411198 8945 E4 mov dword ptr [ebp-1C], eax
0041119B 895D FC mov dword ptr [ebp-4], ebx
0041119E 6A 02 push 2
004111A0 FF15 9C234100 call dword ptr [41239C] ; msvcrt.__set_app_type
004111A6 59 pop ecx
004111A7 830D 2C404200 F>or dword ptr [42402C], FFFFFFFF
004111AE 830D 30404200 F>or dword ptr [424030], FFFFFFFF
004111B5 FF15 6C234100 call dword ptr [41236C] ; msvcrt.__p__fmode
004111BB 8B0D 9C534100 mov ecx, dword ptr [41539C]
004111C1 8908 mov dword ptr [eax], ecx
004111C3 FF15 40234100 call dword ptr [412340] ; msvcrt.__p__commode
感觉这部分是VC写的程序头，但却不知道怎么处理了，那位大侠帮忙看看
[注意]看雪招聘，专注安全领域的专业人才平台！
