::0041DFF1:: FF15 18104000 CALL NEAR DWORD PTR [401018] >>>: MSVBVM60.DLL:__vbaFreeVarList::0041DFF7:: 8B16 MOV EDX, DWORD PTR [ESI] ::0041DFF9:: 83C4 2C ADD ESP, 2C ::0041DFFC:: 56 PUSH ESI ::0041DFFD:: FF92 1C030000 CALL NEAR DWORD PTR [EDX+31C] ::0041E003:: 8B1D 48104000 MOV EBX, DWORD PTR [401048] ::0041E009:: 50 PUSH EAX ::0041E00A:: 8D45 E4 LEA EAX, DWORD PTR [EBP-1C] ::0041E00D:: 50 PUSH EAX ::0041E00E:: FFD3 CALL NEAR EBX ::0041E010:: 8BF8 MOV EDI, EAX ::0041E012:: 68 EC0F4100 PUSH 410FEC \->: 不注册免费试用,有遮挡。收费注册消除遮挡 46827027::0041E017:: 57 PUSH EDI ::0041E018:: 8B0F MOV ECX, DWORD PTR [EDI] ::0041E01A:: FF51 54 CALL NEAR DWORD PTR [ECX+54] ::0041E01D:: 85C0 TEST EAX, EAX ::0041E01F:: DBE2 FCLEX ::0041E021:: 7D 0F JGE SHORT 0041E032 \:JMPDOWN
::0041DE8E:: E8 5930FFFF CALL 00410EEC \:JMPUP::0041DE93:: FF15 38104000 CALL NEAR DWORD PTR [401038] >>>: MSVBVM60.DLL:__vbaSetSystemError::0041DE99:: 8B16 MOV EDX, DWORD PTR [ESI] ::0041DE9B:: 56 PUSH ESI ::0041DE9C:: FF92 00030000 CALL NEAR DWORD PTR [EDX+300] ::0041DEA2:: 50 PUSH EAX ::0041DEA3:: 8D45 E4 LEA EAX, DWORD PTR [EBP-1C] ::0041DEA6:: 50 PUSH EAX ::0041DEA7:: FFD3 CALL NEAR EBX ::0041DEA9:: 8B3D AC104000 MOV EDI, DWORD PTR [4010AC] ::0041DEAF:: 8D4D D4 LEA ECX, DWORD PTR [EBP-2C] ::0041DEB2:: 8BD8 MOV EBX, EAX ::0041DEB4:: 6A 0D PUSH D ::0041DEB6:: 51 PUSH ECX ::0041DEB7:: 899D 08FFFFFF MOV DWORD PTR [EBP-F8], EBX ::0041DEBD:: C785 3CFFFFFF 900F4100 MOV DWORD PTR [EBP-C4], 410F90 \->: 点击这里::0041DEC7:: C785 34FFFFFF 08000000 MOV DWORD PTR [EBP-CC], 8 ::0041DED1:: FFD7 CALL NEAR EDI ::0041DED3:: 8D55 B4 LEA EDX, DWORD PTR [EBP-4C] ::0041DED6:: 6A 0A PUSH A ::0041DED8:: 52 PUSH EDX ::0041DED9:: FFD7 CALL NEAR EDI ::0041DEDB:: 8D45 84 LEA EAX, DWORD PTR [EBP-7C] ::0041DEDE:: 6A 0D PUSH D ::0041DEE0:: 50 PUSH EAX ::0041DEE1:: C785 2CFFFFFF A00F4100 MOV DWORD PTR [EBP-D4], 410FA0 \->: 收费注册::0041DEEB:: C785 24FFFFFF 08000000 MOV DWORD PTR [EBP-DC], 8 ::0041DEF5:: FFD7 CALL NEAR EDI ::0041DEF7:: 8D8D 64FFFFFF LEA ECX, DWORD PTR [EBP-9C] ::0041DEFD:: 6A 0A PUSH A ::0041DEFF:: 51 PUSH ECX ::0041DF00:: FFD7 CALL NEAR EDI ::0041DF02:: 8B3D B8104000 MOV EDI, DWORD PTR [4010B8] ::0041DF08:: 8D95 34FFFFFF LEA EDX, DWORD PTR [EBP-CC] ::0041DF0E:: 8D45 D4 LEA EAX, DWORD PTR [EBP-2C] ::0041DF11:: 52 PUSH EDX ::0041DF12:: 8D4D C4 LEA ECX, DWORD PTR [EBP-3C] ::0041DF15:: 50 PUSH EAX ::0041DF16:: C785 1CFFFFFF B00F4100 MOV DWORD PTR [EBP-E4], 410FB0 \->: 消除遮挡::0041DF20:: C785 14FFFFFF 08000000 MOV DWORD PTR [EBP-EC], 8 ::0041DF2A:: 8B1B MOV EBX, DWORD PTR [EBX] ::0041DF2C:: 51 PUSH ECX ::0041DF2D:: FFD7 CALL NEAR EDI ::0041DF2F:: 50 PUSH EAX ::0041DF30:: 8D55 B4 LEA EDX, DWORD PTR [EBP-4C] ::0041DF33:: 8D45 A4 LEA EAX, DWORD PTR [EBP-5C] ::0041DF36:: 52 PUSH EDX ::0041DF37:: 50 PUSH EAX ::0041DF38:: FFD7 CALL NEAR EDI ::0041DF3A:: 8D8D 24FFFFFF LEA ECX, DWORD PTR [EBP-DC] ::0041DF40:: 50 PUSH EAX ::0041DF41:: 8D55 94 LEA EDX, DWORD PTR [EBP-6C] ::0041DF44:: 51 PUSH ECX ::0041DF45:: 52 PUSH EDX ::0041DF46:: FFD7 CALL NEAR EDI ::0041DF48:: 50 PUSH EAX ::0041DF49:: 8D45 84 LEA EAX, DWORD PTR [EBP-7C] ::0041DF4C:: 8D8D 74FFFFFF LEA ECX, DWORD PTR [EBP-8C] ::0041DF52:: 50 PUSH EAX ::0041DF53:: 51 PUSH ECX ::0041DF54:: FFD7 CALL NEAR EDI ::0041DF56:: 50 PUSH EAX ::0041DF57:: 8D95 64FFFFFF LEA EDX, DWORD PTR [EBP-9C] ::0041DF5D:: 8D85 54FFFFFF LEA EAX, DWORD PTR [EBP-AC] ::0041DF63:: 52 PUSH EDX ::0041DF64:: 50 PUSH EAX ::0041DF65:: FFD7 CALL NEAR EDI ::0041DF67:: 50 PUSH EAX ::0041DF68:: 8D8D 14FFFFFF LEA ECX, DWORD PTR [EBP-EC] ::0041DF6E:: 8D95 44FFFFFF LEA EDX, DWORD PTR [EBP-BC] ::0041DF74:: 51 PUSH ECX ::0041DF75:: 52 PUSH EDX ::0041DF76:: FFD7 CALL NEAR EDI ::0041DF78:: 50 PUSH EAX ::0041DF79:: 8D45 E8 LEA EAX, DWORD PTR [EBP-18] ::0041DF7C:: 50 PUSH EAX ::0041DF7D:: FF15 B4104000 CALL NEAR DWORD PTR [4010B4] >>>: MSVBVM60.DLL:__vbaStrVarVal
[课程]Linux pwn 探索篇!