00549248 /. 55 push ebp
00549249 |. 8BEC mov ebp,esp
0054924B |. B9 1A000000 mov ecx,1A
00549250 |> 6A 00 /push 0
00549252 |. 6A 00 |push 0
00549254 |. 49 |dec ecx
00549255 |.^ 75 F9 \jnz short TH_Serve.00549250
00549257 |. 53 push ebx
00549258 |. 56 push esi
00549259 |. 57 push edi
0054925A |. 8BF0 mov esi,eax
0054925C |. 33C0 xor eax,eax
0054925E |. 55 push ebp
0054925F |. 68 C3A15400 push TH_Serve.0054A1C3
00549264 |. 64:FF30 push dword ptr fs:[eax]
00549267 |. 64:8920 mov dword ptr fs:[eax],esp
0054926A |. B2 01 mov dl,1
0054926C |. 8B86 20030000 mov eax,dword ptr ds:[esi+320]
00549272 |. 8B08 mov ecx,dword ptr ds:[eax]
00549274 |. FF91 78010000 call dword ptr ds:[ecx+178]
0054927A |. 8B86 20030000 mov eax,dword ptr ds:[esi+320]
00549280 |. E8 2BB9F3FF call TH_Serve.00484BB0
00549285 |. E8 8222ECFF call TH_Serve.0040B50C
0054928A |. 83C4 F8 add esp,-8 ; /
0054928D |. DD1C24 fstp qword ptr ss:[esp] ; |Arg1 (8-byte)
00549290 |. 9B wait ; |
00549291 |. 8D45 C4 lea eax,dword ptr ss:[ebp-3C] ; |
00549294 |. E8 E72EECFF call TH_Serve.0040C180 ; \TH_Serve.0040C180
00549299 |. 8B45 C4 mov eax,dword ptr ss:[ebp-3C]
0054929C |. 8D55 C8 lea edx,dword ptr ss:[ebp-38]
0054929F |. E8 F89AFFFF call TH_Serve.00542D9C
005492A4 |. 8B45 C8 mov eax,dword ptr ss:[ebp-38] ; EDX=[现在日期]
005492A7 |. 50 push eax
005492A8 |. BA DCA15400 mov edx,TH_Serve.0054A1DC ; ASCII "xinx"
005492AD |. 8B86 20030000 mov eax,dword ptr ds:[esi+320]
005492B3 |. E8 78A2F3FF call TH_Serve.00483530
005492B8 |. 5A pop edx
005492B9 |. 8B08 mov ecx,dword ptr ds:[eax]
005492BB |. FF91 B0000000 call dword ptr ds:[ecx+B0]
005492C1 |. 8B86 20030000 mov eax,dword ptr ds:[esi+320]
005492C7 |. 8B10 mov edx,dword ptr ds:[eax]
005492C9 |. FF92 48020000 call dword ptr ds:[edx+248]
005492CF |. 33C0 xor eax,eax
005492D1 |. A3 90AA5600 mov dword ptr ds:[56AA90],eax
005492D6 |. E8 D8650000 call TH_Serve.0054F8B3
005492DB |. 85C0 test eax,eax
005492DD |. 0F84 BE010000 je TH_Serve.005494A1
005492E3 |. BA ECA15400 mov edx,TH_Serve.0054A1EC ; ASCII "xinxi"
005492E8 |. 8B86 20030000 mov eax,dword ptr ds:[esi+320]
005492EE |. E8 3DA2F3FF call TH_Serve.00483530
005492F3 |. 8D55 C0 lea edx,dword ptr ss:[ebp-40]
005492F6 |. 8B08 mov ecx,dword ptr ds:[eax]
005492F8 |. FF51 60 call dword ptr ds:[ecx+60]
005492FB |. 837D C0 00 cmp dword ptr ss:[ebp-40],0
005492FF |. 75 5E jnz short TH_Serve.0054935F
00549301 |. E8 0622ECFF call TH_Serve.0040B50C
00549306 |. D805 F4A15400 fadd dword ptr ds:[54A1F4]
0054930C |. DD5D D8 fstp qword ptr ss:[ebp-28]
0054930F |. 9B wait
00549310 |. 8B86 20030000 mov eax,dword ptr ds:[esi+320]
00549316 |. E8 95B8F3FF call TH_Serve.00484BB0
0054931B |. FF75 DC push dword ptr ss:[ebp-24] ; /Arg2
0054931E |. FF75 D8 push dword ptr ss:[ebp-28] ; |Arg1
00549321 |. 8D45 B8 lea eax,dword ptr ss:[ebp-48] ; |
00549324 |. E8 572EECFF call TH_Serve.0040C180 ; \TH_Serve.0040C180
00549329 |. 8B45 B8 mov eax,dword ptr ss:[ebp-48]
0054932C |. 8D55 BC lea edx,dword ptr ss:[ebp-44]
0054932F |. E8 689AFFFF call TH_Serve.00542D9C
00549334 |. 8B45 BC mov eax,dword ptr ss:[ebp-44]
00549337 |. 50 push eax
00549338 |. BA ECA15400 mov edx,TH_Serve.0054A1EC ; ASCII "xinxi"
0054933D |. 8B86 20030000 mov eax,dword ptr ds:[esi+320]
00549343 |. E8 E8A1F3FF call TH_Serve.00483530
00549348 |. 5A pop edx
00549349 |. 8B08 mov ecx,dword ptr ds:[eax]
0054934B |. FF91 B0000000 call dword ptr ds:[ecx+B0]
00549351 |. 8B86 20030000 mov eax,dword ptr ds:[esi+320]
00549357 |. 8B10 mov edx,dword ptr ds:[eax]
00549359 |. FF92 48020000 call dword ptr ds:[edx+248]
0054935F |> BA ECA15400 mov edx,TH_Serve.0054A1EC ; ASCII "xinxi"
00549364 |. 8B86 20030000 mov eax,dword ptr ds:[esi+320]
0054936A |. E8 C1A1F3FF call TH_Serve.00483530
0054936F |. 8D55 E4 lea edx,dword ptr ss:[ebp-1C]
00549372 |. 8B08 mov ecx,dword ptr ds:[eax]
00549374 |. FF51 60 call dword ptr ds:[ecx+60]
00549377 |. 8D55 B4 lea edx,dword ptr ss:[ebp-4C]
0054937A |. 8B45 E4 mov eax,dword ptr ss:[ebp-1C]
0054937D |. E8 AE96FFFF call TH_Serve.00542A30 ; 计算日期函数
00549382 |. 8B45 B4 mov eax,dword ptr ss:[ebp-4C] ; EAX=系统到期日期 如何在这边加入指定日期？？？
00549385 |. E8 2A36ECFF call TH_Serve.0040C9B4
0054938A |. DD5D D8 fstp qword ptr ss:[ebp-28]
0054938D |. 9B wait
0054938E |. E8 7921ECFF call TH_Serve.0040B50C
00549393 |. DC5D D8 fcomp qword ptr ss:[ebp-28]
00549396 |. DFE0 fstsw ax
00549398 |. 9E sahf
00549399 |. 0F83 B9000000 jnb TH_Serve.00549458
0054939F |. 68 00A25400 push TH_Serve.0054A200
005493A4 |. E8 6321ECFF call TH_Serve.0040B50C
005493A9 |. 83C4 F8 add esp,-8 ; /
005493AC |. DD1C24 fstp qword ptr ss:[esp] ; |Arg3 (8-byte)
005493AF |. 9B wait ; |
005493B0 |. FF75 DC push dword ptr ss:[ebp-24] ; |Arg2
005493B3 |. FF75 D8 push dword ptr ss:[ebp-28] ; |Arg1
005493B6 |. E8 ED12F2FF call TH_Serve.0046A6A8 ; \TH_Serve.0046A6A8
005493BB |. 8D55 B0 lea edx,dword ptr ss:[ebp-50]
005493BE |. E8 D504ECFF call TH_Serve.00409898 ; 计算还剩多少天
005493C3 |. FF75 B0 push dword ptr ss:[ebp-50] ; [ebp-50]=X天
005493C6 |. 68 18A25400 push TH_Serve.0054A218
005493CB |. 8D45 FC lea eax,dword ptr ss:[ebp-4]
005493CE |. BA 03000000 mov edx,3
005493D3 |. E8 04BAEBFF call TH_Serve.00404DDC
[课程]Linux pwn 探索篇！
