0040DE8A 6A 02 PUSH 2
0040DE8C E8 EB747F77 CALL msvcrt.__set_app_type
0040DE91 90 NOP
0040DE92 59 POP ECX
...
0040DF80 6A 0A PUSH 0A
0040DF82 58 POP EAX
0040DF83 50 PUSH EAX
0040DF84 56 PUSH ESI
0040DF85 53 PUSH EBX
0040DF86 53 PUSH EBX
0040DF87 E8 33650900 CALL 004A44BF
0040DF8C 90 NOP
0040DF8D 50 PUSH EAX
0040DF8E E8 91000000 CALL 0040E024 ; <-***
0040DF93 8945 98 MOV [EBP-68], EAX
0040DF96 50 PUSH EAX
0040DF97 90 NOP
0040DF98 E8 E1BE7F77 CALL msvcrt.
exit
...
0040E024 FF7424 10 PUSH DWORD PTR [ESP+10] ; 0000000A
0040E028 FF7424 10 PUSH DWORD PTR [ESP+10] ; 00152371
0040E02C FF7424 10 PUSH DWORD PTR [ESP+10] ; 00000000
0040E030 FF7424 10 PUSH DWORD PTR [ESP+10] ; 00400000
0040E034 E8 43000000 CALL 0040E07C
0040E039 C2 1000 RETN 10
...
0040E07C E9 AAEE9273 JMP mfc42.
...
73D3CF2B > 8BFF MOV EDI, EDI ;
in
mfc42.dll
...
73D3CF71 FF50 58 CALL NEAR [EAX+58] ; back to 004013D0
...
004013D0 55 PUSH EBP
004013D1 8BEC MOV EBP, ESP
004013D3 6A FF PUSH -1
004013D5 68 F3E04000 PUSH 0040E0F3
004013DA 64:A1 00000000 MOV EAX, FS:[0]
004013E0 50 PUSH EAX
004013E1 64:8925 00000000 MOV FS:[0], ESP
004013E8 81EC C4010000 SUB ESP, 1C4
004013EE 53 PUSH EBX
004013EF 56 PUSH ESI
004013F0 57 PUSH EDI
004013F1 8BF1 MOV ESI, ECX
004013F3 E8 D2C70000 CALL 0040DBCA
004013F8 E9 57081E00 JMP 005E1C54
...
005E1C54 68 2D5B7D13 PUSH 137D5B2D ; VM1_137D5B2D
005E1C59 E9 9EDBE3FF JMP 0041F7FC ; VM1_EXIT back to 004044E0
...
004044E0 6A FF PUSH -1
004044E2 68 20E94000 PUSH 0040E920
004044E7 64:A1 00000000 MOV EAX, FS:[0]
...
004045A2 64:890D 00000000 MOV FS:[0], ECX
004045A9 81C4 1C010000 ADD ESP, 11C
004045AF C3 RETN ;
return
to 005DCA83
...
005DCA83 68 5B957D13 PUSH 137D955B ; 以下
"VM CALL"
依次执行
005DCA88 E9 6F2DE4FF JMP 0041F7FC
005DCA8D 68 36977D13 PUSH 137D9736
005DCA92 E9 652DE4FF JMP 0041F7FC
005DCA97 68 F1987D13 PUSH 137D98F1
005DCA9C E9 5B2DE4FF JMP 0041F7FC
005DCAA1 68 A69A7D13 PUSH 137D9AA6
005DCAA6 E9 512DE4FF JMP 0041F7FC
005DCAAB 68 E79B7D13 PUSH 137D9BE7
005DCAB0 E9 472DE4FF JMP 0041F7FC
005DCAB5 68 2B9D7D13 PUSH 137D9D2B
005DCABA E9 3D2DE4FF JMP 0041F7FC
005DCABF 68 C99D7D13 PUSH 137D9DC9
005DCAC4 E9 332DE4FF JMP 0041F7FC
005DCAC9 68 F19E7D13 PUSH 137D9EF1
005DCACE E9 292DE4FF JMP 0041F7FC
005DCAD3 68 80A07D13 PUSH 137DA080
005DCAD8 E9 1F2DE4FF JMP 0041F7FC
005DCADD 68 98A17D13 PUSH 137DA198
005DCAE2 E9 152DE4FF JMP 0041F7FC
005DCAE7 68 95A27D13 PUSH 137DA295
005DCAEC E9 0B2DE4FF JMP 0041F7FC
005DCAF1 68 50A37D13 PUSH 137DA350
005DCAF6 E9 012DE4FF JMP 0041F7FC
005DCAFB 68 A2A47D13 PUSH 137DA4A2
005DCB00 E9 F72CE4FF JMP 0041F7FC
005DCB05 68 6DA67D13 PUSH 137DA66D
005DCB0A E9 ED2CE4FF JMP 0041F7FC
005DCB0F 68 05A77D13 PUSH 137DA705
005DCB14 E9 E32CE4FF JMP 0041F7FC
005DCB19 68 42A87D13 PUSH 137DA842
005DCB1E E9 D92CE4FF JMP 0041F7FC
005DCB23 68 63A97D13 PUSH 137DA963
005DCB28 E9 CF2CE4FF JMP 0041F7FC
005DCB2D 68 FFA97D13 PUSH 137DA9FF
005DCB32 E9 C52CE4FF JMP 0041F7FC
005DCB37 68 28AB7D13 PUSH 137DAB28
005DCB3C E9 BB2CE4FF JMP 0041F7FC ; VM1_EXIT to 00401541
...
00401541 E9 C93A1E00 JMP 005E500F
...
005E500F 68 6FAC7D13 PUSH 137DAC6F
005E5014 E9 E3A7E3FF JMP 0041F7FC ; VM1_EXIT to 00404C10
...
00404C10 55 PUSH EBP
00404C11 8BEC MOV EBP, ESP
00404C13 6A FF PUSH -1
00404C15 68 90EA4000 PUSH 0040EA90
00404C1A 64:A1 00000000 MOV EAX, FS:[0]
00404C20 50 PUSH EAX
00404C21 64:8925 00000000 MOV FS:[0], ESP
00404C28 81EC 28070000 SUB ESP, 728
00404C2E 53 PUSH EBX
00404C2F 56 PUSH ESI
00404C30 57 PUSH EDI
00404C31 E9 78E22000 JMP 00612EAE ; <-***
...
00612EAE 68 D22D8013 PUSH 13802DD2 ; <-***
00612EB3 E9 44C9E0FF JMP 0041F7FC