[讨论]某外挂的部分分析-加壳脱壳-看雪-安全社区|安全招聘|kanxue.com

[讨论]某外挂的部分分析

发表于: 2005-11-5 00:58 7619

[讨论]某外挂的部分分析

完美

2005-11-5 00:58

7619

1003751C  |.  5B          POP EBX
1003751D  \.  C2 1000    RETN 10
10037520 .  55          PUSH EBP
10037521 .  8BEC       MOV EBP,ESP
10037523 .  68 82F50210 PUSH PYCQ.1002F582                      ;  SE handler installation
10037528 .  64:FF35 00000>PUSH DWORD PTR FS:[0]

1003765C FF15 B4F10310 CALL DWORD PTR DS:[1003F1B4]

iat
1003F000

20

007D25EC E8 4BFCFFFF    CALL 007D223C
007D25F1 E8 82FEFFFF    CALL 007D2478
007D25F6 8B17          MOV EDX,DWORD PTR DS:[EDI]
007D25F8 8902          MOV DWORD PTR DS:[EDX],EAX

CALL DWORD PTR DS:[1003F200]

0 0003F048 ? 0000 007D1358
0 0003F0D4 ? 0000 007D0EE8
0 0003F0D8 ? 0000 007D133C
0 0003F104 ? 0000 007D1390

ImportAddress RVA :0003b0c0 - kernel32.dll!LockResource
ImportAddress RVA :0003b104 - kernel32.dll!GetCurrentProcessId
ImportAddress RVA :0003b11c - kernel32.dll!GetVersion

CALL DWORD PTR DS:[1003F048] kernel32.dll 0193 GetVersion
CALL DWORD PTR DS:[1003F0D4] kernel32.dll 0158 GetProcAddress
CALL DWORD PTR DS:[1003F0D8] kernel32.dll 013F GetModuleHandleA
CALL DWORD PTR DS:[1003F104] kernel32.dll 010F GetCurrentProcessId

ImportAddressTable RVA :0003f114 - user32.dll
ImportAddressTable RVA :0003f044 - kernel32.dll
ImportAddressTable RVA :0003f000 - comctl32.dll
ImportAddressTable RVA :0003f008 - gdi32.dll
ImportAddressTable RVA :0003f1fc - wsock32.dll
19:08:16 - fixing import table..
ImportAddress RVA :0003f048 - kernel32.dll!GetVersion
ImportAddress RVA :0003f0d8 - kernel32.dll!FreeResource
ImportAddress RVA :0003f104 - kernel32.dll!GetCurrentProcessId
19:08:17 - no stolen bytes are found..
EntryPoint RVA :00037520
19:08:17 - saving unpacked file..
19:08:17 - file was unpacked successful..
19:08:17 - done..

//////////////////////////////////////////////////////////////////////
0040EDAE 59             POP ECX
0040EDAF C3             RETN
0040EDB0 50             PUSH EAX
0040EDB1 29143B       SUB DWORD PTR DS:[EBX+EDI],EDX
0040EDB4 BA 08167D40    MOV EDX,407D1608
0040EDB9 F3:          PREFIX REP:                            ; Superfluous prefix
0040EDBA 1903          SBB DWORD PTR DS:[EBX],EAX
0040EDBC 6E             OUTS DX,BYTE PTR ES:[EDI]             ; I/O command
0040EDBD CE             INTO
0040EDBE 07             POP ES                                  ; Modification of segment register
0040EDBF 64:A1 00000000  MOV EAX,DWORD PTR FS:[0]
0040EDC5 50             PUSH EAX
0040EDC6 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
0040EDCD 83EC 58       SUB ESP,58

0012FFB4 004124B4  PYCQ.004124B4
0012FFB8 0042F028  PYCQ.0042F028
0012FFBC FFFFFFFF
0012FFC0 0012FFF0
0012FFC4 77E687F5  RETURN to KERNEL32.77E687F5

0040EA30 >/$  55          PUSH EBP
0040EA31  |.  8BEC       MOV EBP,ESP
0040EA33  |.  6A FF       PUSH -1
0040EA35  |.  68 30E04200 PUSH PYCQ.0042E030
0040EA3A  |.  68 34214100 PUSH PYCQ.00412134                      ;  SE handler installation
0040EA3F  |.  64:A1 0000000>MOV EAX,DWORD PTR FS:[0]
0040EA45  |.  50          PUSH EAX
0040EA46  |.  64:8925 00000>MOV DWORD PTR FS:[0],ESP
0040EA4D  |.  83EC 58    SUB ESP,58

0040EDB0 55                PUSH EBP
0040EDB1 8BEC             MOV EBP,ESP
0040EDB3 6A FF             PUSH -1
0040EDB5 68 28F04200       PUSH PYCQ.0042F028
0040EDBA 68 B4244100       PUSH PYCQ.004124B4
0040EDBF 64:A1 00000000    MOV EAX,DWORD PTR FS:[0]
0040EDC5 50                PUSH EAX
0040EDC6 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
0040EDCD 83EC 58          SUB ESP,58

0040EDD6 FF15 88B24200    CALL DWORD PTR DS:[42B288]

IAT
42B000

0091479B 66:F706 2000 TEST WORD PTR DS:[ESI],20
009147A0 74 46          JE SHORT 009147E8
009147A2 66:F706 0200 TEST WORD PTR DS:[ESI],2
009147A7 75 1F          JNZ SHORT 009147C8

0 0002B11C ? 0000 0091545C
0 0002B268 ? 0000 00914BC0
0 0002B288 ? 0000 00915466
0 0002B2D4 ? 0000 00915490

CALL DWORD PTR DS:[42B11C] kernel32.dll 010E GetCurrentProcess
CALL DWORD PTR DS:[42B268] kernel32.dll 033A lstrlenA
CALL DWORD PTR DS:[42B288] kernel32.dll 0193 GetVersion
CALL DWORD PTR DS:[42B2D4] kernel32.dll 00DF GetCommandLineA

1 0002B218 kernel32.dll 0003 AddConsoleAliasA
1 0002B218 kernel32.dll 0091 ExitProcess

004023E7 .  3BD8       CMP EBX,EAX
004023E9    EB 67       JMP SHORT PYCQ.00402452
004023EB .  6A 30       PUSH 30

00437180  32 30 32 2E 31 30 33 2E 36 34 2E 32 30 35 00 00  202.103.64.205..

00402150  /$  83EC 10    SUB ESP,10
00402153  |.  8B4424 20    MOV EAX,DWORD PTR SS:[ESP+20]
00402157  |.  56          PUSH ESI
00402158  |.  50          PUSH EAX                               ; /HostSshort
00402159  |.  66:C74424 08 >MOV WORD PTR SS:[ESP+8],2             ; |
00402160  |.  E8 C3430000 CALL <JMP.&ws2_32.htons>                ; \htons
00402165  |.  8B4C24 20    MOV ECX,DWORD PTR SS:[ESP+20]
00402169  |.  66:894424 06  MOV WORD PTR SS:[ESP+6],AX
0040216E  |.  51          PUSH ECX                               ; /pAddr
0040216F  |.  E8 AE430000 CALL <JMP.&ws2_32.inet_addr>          ; \inet_addr

固定端口
00401FBB .  83FA 04    CMP EDX,4
00401FBE    EB 0A       JMP SHORT PYCQ.00401FCA
00401FC0 .  83FA 05    CMP EDX,5

文件检测
004023E7 .  3BD8       CMP EBX,EAX
004023E9    EB 67       JMP SHORT PYCQ.00402452
004023EB .  6A 30       PUSH 30

00402325 .  83C4 0C    ADD ESP,0C
00402328    EB 33       JMP SHORT PYCQ.0040235D
0040232A    90          NOP
0040232B    90          NOP
0040232C .  68 80000000 PUSH 80

00402875 .  83C4 0C       ADD ESP,0C
00402878    8B1D DCB14200 MOV EBX,DWORD PTR DS:[<&kernel32.GlobalA>;  KERNEL32.GlobalAlloc
0040287E    EB 4B          JMP SHORT PYCQ.004028CB
00402880    90             NOP
00402881 .  51             PUSH ECX

检查窗口
00403524 .  3BD3       CMP EDX,EBX
00403526    EB 10       JMP SHORT PYCQ.00403538
00403528 .  8B47 1C    MOV EAX,DWORD PTR DS:[EDI+1C]

检查dll
00403C04 .  3BC1       CMP EAX,ECX
00403C06    90          NOP
00403C07    90          NOP
00403C08 .  A1 F8BB4300 MOV EAX,DWORD PTR DS:[43BBF8]

检查exe for dll
1001DDEA  |> \803D D4010410>CMP BYTE PTR DS:[100401D4],0
1001DDF1    EB 24       JMP SHORT PYCQ.1001DE17
1001DDF3  |.  3D CF110000 CMP EAX,11CF

02697279 FF15 E4F16902 CALL DWORD PTR DS:[<&user32.CreateDialog>; user32.CreateDialogParamA
0269727F FF35 40E06902 PUSH DWORD PTR DS:[269E040]
02697285 FF15 38F16902 CALL DWORD PTR DS:[<&user32.SetActiveWin>; user32.SetActiveWindow
0269728B 64:8F05 0000000>POP DWORD PTR FS:[0]
02697292 83C4 04       ADD ESP,4
02697295 803D 23006A02 0>CMP BYTE PTR DS:[26A0023],3
0269729C 75 3C          JNZ SHORT PYCQ.026972DA
0269729E 833D 0A006A02 0>CMP DWORD PTR DS:[26A000A],0
026972A5 74 33          JE SHORT PYCQ.026972DA
026972A7 833D A8016A02 0>CMP DWORD PTR DS:[26A01A8],0
026972AE 74 2A          JE SHORT PYCQ.026972DA
026972B0 803D DA006A02 0>CMP BYTE PTR DS:[26A00DA],4
026972B7 74 0A          JE SHORT PYCQ.026972C3
026972B9 A1 DA006A02    MOV EAX,DWORD PTR DS:[26A00DA]
026972BE A3 A8016A02    MOV DWORD PTR DS:[26A01A8],EAX
026972C3 FF75 10       PUSH DWORD PTR SS:[EBP+10]
026972C6 FF75 0C       PUSH DWORD PTR SS:[EBP+C]
026972C9 FF75 08       PUSH DWORD PTR SS:[EBP+8]
026972CC FF35 0A006A02 PUSH DWORD PTR DS:[26A000A]
026972D2 FF15 A8016A02 CALL DWORD PTR DS:[26A01A8]

1000C0A0 .  FF15 ECF10310    CALL DWORD PTR DS:[<&user32.CallWindowPr>; \CallWindowProcA

00402C53  |.  8B15 A0BA4300 MOV EDX,DWORD PTR DS:[43BAA0]
00402C59  |.  8995 2C010000 MOV DWORD PTR SS:[EBP+12C],EDX

Names in PYCQ, item 9
Address=1003F1E4
Type=Import  (Known)
Name=user32.CreateDialogParamA

100372D2  |.  FF15 A8010410    CALL DWORD PTR DS:[100401A8]

100372B9  |.  A1 DA000410       MOV EAX,DWORD PTR DS:[100400DA]

检查节
100372B0  |.  803D DA000410 04    CMP BYTE PTR DS:[100400DA],4
100372B7    EB 0A             JMP SHORT PYCQ.100372C3
100372B9  |.  A1 DA000410       MOV EAX,DWORD PTR DS:[100400DA]

解压
10001122  |.  3D 80000000 CMP EAX,80
10001127    EB 44       JMP SHORT PYCQ.1000116D
10001129    90          NOP
1000112A    90          NOP
1000112B    90          NOP
1000112C    90          NOP
1000112D  |.  68 80000000 PUSH 80

/////////////////////////////////////////////////////////////////////

00000000h: BB B6 D3 AD CA B9 D3 C3 42 59 B8 A8 D6 FA B9 A4 ;
00000010h: BE DF 33 2E 39 34 B1 BE B5 D8 C6 C6 BD E2 B0 E6 ;
00000020h: B1 BE 2E 2E 2E 20 20 20 20 20 5B 43 72 61 63 6B ; [Crack
00000030h: 65 64 20 62 79 20 D0 A1 C8 AB 20 32 30 30 35 2D ; ed by 2005]
00000040h: 31 2D 31 33 5D                               ;

第二篇（第二版本）0040EA47 8925 00000000 MOV DWORD PTR DS:[0],ESP
0040EA4D 83EC 58       SUB ESP,58
0040EA50 53             PUSH EBX

0040EA5E 59                   POP ECX
0040EA5F C3                   RETN
0040EA60 55                   PUSH EBP
0040EA61 8BEC                MOV EBP,ESP
0040EA63 6A FF                PUSH -1
0040EA65 68 B0DF4200          PUSH PYCQ.0042DFB0
0040EA6A 68 64214100          PUSH PYCQ.00412164
0040EA6F 64:A1 00000000       MOV EAX,DWORD PTR FS:[0]
0040EA75 50                   PUSH EAX

0012FFB0 0012FFE0
0012FFB4 00412134  PYCQ.00412134
0012FFB8 0042E030  PYCQ.0042E030

0040EA2F C3                   RETN
0040EA30 55                   PUSH EBP
0040EA31 8BEC                MOV EBP,ESP
0040EA33 6A FF                PUSH -1
0040EA35 68 30E04200          PUSH PYCQ.0042E030
0040EA3A 68 34214100          PUSH PYCQ.00412134
0040EA3F 64:A1 00000000       MOV EAX,DWORD PTR FS:[0]
0040EA45 50                   PUSH EAX
0040EA46 64:8925 00000000    MOV DWORD PTR FS:[0],ESP
0040EA4D 83EC 58             SUB ESP,58

0040EA56 FF15 94A24200       CALL DWORD PTR DS:[42A294]

009147B3 66:F706 2000       TEST WORD PTR DS:[ESI],20
009147B8 74 46                JE SHORT 00914800
009147BA 66:F706 0200       TEST WORD PTR DS:[ESI],2
009147BF 75 1F                JNZ SHORT 009147E0

003A49BF 66:F706 2000       test word ptr ds:[esi],20
//改成test word ptr ds:[esi],8
003A49C4 74 46             je short 003A4A0C
//改成 jnz short 003A4A0C
003A49C6 66:F706 0200       test word ptr ds:[esi],2
003A49CB 75 1F             jnz short 003A49EC
003A49CD 66:C706 0400       mov word ptr ds:[esi],4
003A49D2 8B45 14          mov eax,dword ptr ss:[ebp+14]
003A49D5 6A 01             push 1
003A49D7 6A 00             push 0
003A49D9 FF76 04          push dword ptr ds:[esi+4]
003A49DC 6A 00             push 0
003A49DE FF75 18          push dword ptr ss:[ebp+18]
003A49E1 FF50 50          call dword ptr ds:[eax+50]
003A49E4 85C0             test eax,eax
003A49E6 74 39             je short 003A4A21
//改成  je short 003A4A0C
003A49E8 8907             mov dword ptr ds:[edi],eax
003A49EA EB 20             jmp short 003A4A0C
003A49EC 66:C706 0400       mov word ptr ds:[esi],4
003A49F1 8B45 14          mov eax,dword ptr ss:[ebp+14]
003A49F4 0FB756 02          movzx edx,word ptr ds:[esi+2]
003A49F8 6A 01             push 1
003A49FA 52                push edx
003A49FB 6A 00             push 0
003A49FD FF76 04          push dword ptr ds:[esi+4]
003A4A00 FF75 18          push dword ptr ss:[ebp+18]
003A4A03 FF50 50          call dword ptr ds:[eax+50]
003A4A06 85C0             test eax,eax
////改成  je short 003A4A0C
003A4A08 74 17             je short 003A4A21
003A4A0A 8907             mov dword ptr ds:[edi],eax

00912ACA F7F0                DIV EAX

42A000

CALL DWORD PTR DS:[42A21C]
0 0002A0D0 ? 0000 00915488 GetCurrentProcess
0 0002A10C ? 0000 009154B3 GetCommandLineA
0 0002A270 ? 0000 00914BD8 lstrlenA
0 0002A294 ? 0000 009154BD GetVersion
0 0002A5DC ? 0000 00914E10

1 0002A220 kernel32.dll 0003 AddConsoleAliasA
ExitProcess

CALL DWORD PTR DS:[42A0D0]

00436180  32 30 32 2E 31 30 33 2E 36 34 2E 32 30 35 00    202.103.64.205.

00401F3B .  83FA 04    CMP EDX,4
00401F3E .  74 0A       JE SHORT PYCQ.00401F4A
00401F40 .  83FA 05    CMP EDX,5

00401F3B .  83FA 04    CMP EDX,4
00401F3E    EB 0A       JMP SHORT PYCQ.00401F4A
00401F40 .  83FA 05    CMP EDX,5

00402274 .  6A 00       PUSH 0                                  ; /Flags = 0
00402276 .  8D4C24 2C    LEA ECX,DWORD PTR SS:[ESP+2C]          ; |
0040227A .  68 80000000 PUSH 80                               ; |BufSize = 80 (128.)
0040227F .  51          PUSH ECX                               ; |Buffer
00402280 .  57          PUSH EDI                               ; |Socket
00402281 .  E8 2E3F0000 CALL <JMP.&ws2_32.recv>                ; \recv

004022A8    /EB 33       JMP SHORT PYCQ.004022DD
004022AA    |90          NOP
004022AB    |90          NOP

004027B5 .  55          PUSH EBP                               ; /Flags => 0
004027B6 .  8D5424 20    LEA EDX,DWORD PTR SS:[ESP+20]          ; |
004027BA .  68 80000000 PUSH 80                               ; |BufSize = 80 (128.)
004027BF .  52          PUSH EDX                               ; |Buffer
004027C0 .  57          PUSH EDI                               ; |Socket
004027C1 .  E8 EE390000 CALL <JMP.&ws2_32.recv>                ; \recv

004027D8    /EB 51       JMP SHORT PYCQ.0040282B
004027DA    |90          NOP
004027DB    |90          NOP

004028CC > \C605 54AA4300 00    MOV BYTE PTR DS:[43AA54],0
004028D3 >  8B5424 30             MOV EDX,DWORD PTR SS:[ESP+30]
004028D7 .  66:8B4424 34          MOV AX,WORD PTR SS:[ESP+34]
004028DC .  8915 B8AB4300       MOV DWORD PTR DS:[43ABB8],EDX
004028E2 .  66:A3 BCAB4300       MOV WORD PTR DS:[43ABBC],AX
004028E8 .  8B56 1C             MOV EDX,DWORD PTR DS:[ESI+1C]
004028EB .  8D4C24 58             LEA ECX,DWORD PTR SS:[ESP+58]
004028EF .  51                   PUSH ECX
004028F0 .  52                   PUSH EDX
004028F1 .  E8 0A020000          CALL PYCQ.00402B00                               ;  mapview
004028F6 .  83C4 08             ADD ESP,8
004028F9 .  83F8 01             CMP EAX,1
004028FC .  0F85 28010000       JNZ PYCQ.00402A2A
00402902 .  8DAE 4C010000       LEA EBP,DWORD PTR DS:[ESI+14C]
00402908 .  6A 00                PUSH 0
0040290A .  8BCD                MOV ECX,EBP
0040290C .  E8 38DB0100          CALL PYCQ.00420449                               ;  enable but
00402911 .  6A 00                PUSH 0
00402913 .  8D8E 10010000       LEA ECX,DWORD PTR DS:[ESI+110]
00402919 .  E8 2BDB0100          CALL PYCQ.00420449                               ;  enable but
0040291E .  8BCD                MOV ECX,EBP
00402920 .  E8 F3D90100          CALL PYCQ.00420318                               ;  GetWindowTextLengthA
00402925 .  8BD0                MOV EDX,EAX
00402927 .  B9 20000000          MOV ECX,20
0040292C .  33C0                XOR EAX,EAX
0040292E .  8DBC24 9C000000       LEA EDI,DWORD PTR SS:[ESP+9C]
00402935 .  F3:AB                REP STOS DWORD PTR ES:[EDI]
00402937 .  8BCA                MOV ECX,EDX
00402939 .  B8 2A2A2A2A          MOV EAX,2A2A2A2A
0040293E .  8DBC24 9C000000       LEA EDI,DWORD PTR SS:[ESP+9C]
00402945 .  C1E9 02             SHR ECX,2
00402948 .  F3:AB                REP STOS DWORD PTR ES:[EDI]
0040294A .  8BCA                MOV ECX,EDX
0040294C .  83E1 03             AND ECX,3
0040294F .  F3:AA                REP STOS BYTE PTR ES:[EDI]
00402951 .  8D8424 9C000000       LEA EAX,DWORD PTR SS:[ESP+9C]
00402958 .  8BCD                MOV ECX,EBP
0040295A .  50                   PUSH EAX
0040295B .  E8 62D90100          CALL PYCQ.004202C2                               ;  set secrect
00402960 .  6A 01                PUSH 1
00402962 .  8D8E 98000000       LEA ECX,DWORD PTR DS:[ESI+98]
00402968 .  E8 DCDA0100          CALL PYCQ.00420449                               ;  enable but
0040296D .  6A 01                PUSH 1
0040296F .  8D4E 5C             LEA ECX,DWORD PTR DS:[ESI+5C]
00402972 .  E8 D2DA0100          CALL PYCQ.00420449                               ;  enable but
00402977 .  8B4E 1C             MOV ECX,DWORD PTR DS:[ESI+1C]
0040297A .  51                   PUSH ECX
0040297B .  E8 C0000000          CALL PYCQ.00402A40                               ;  wgshell.RegisterShell and mapview
00402980 .  83C4 04             ADD ESP,4
00402983 .  68 28050000          PUSH 528
00402988 .  6A 40                PUSH 40
0040298A .  FFD3                CALL EBX                                           ;  GlobalAlloc
0040298C .  50                   PUSH EAX                                           ; /hMem
0040298D .  A3 C4AB4300          MOV DWORD PTR DS:[43ABC4],EAX                      ; |
00402992 .  FF15 F0A14200       CALL DWORD PTR DS:[<&kernel32.GlobalLock>]       ; \GlobalLock
00402998 .  68 C8624300          PUSH PYCQ.004362C8                               ; /Title = "legend of mir2"
0040299D .  68 BC624300          PUSH PYCQ.004362BC                               ; |Class = "TFrmMain"
004029A2 .  A3 C8AB4300          MOV DWORD PTR DS:[43ABC8],EAX                      ; |
004029A7 .  FF15 38A54200       CALL DWORD PTR DS:[<&user32.FindWindowA>]          ; \FindWindowA
004029AD .  85C0                TEST EAX,EAX
004029AF .  74 79                JE SHORT PYCQ.00402A2A

00405A4D  |.  FF77 05    |PUSH DWORD PTR DS:[EDI+5]             ; /ProcessId
00405A50  |.  6A 00       |PUSH 0                               ; |Inheritable = FALSE
00405A52  |.  68 FF0F1F00 |PUSH 1F0FFF                            ; |Access = PROCESS_ALL_ACCESS
00405A57  |.  FF15 CCA14200 |CALL DWORD PTR DS:[<&kernel32.OpenProce>; \OpenProcess
00405A5D  |.  0BC0       |OR EAX,EAX
00405A5F  |.  74 1B       |JE SHORT PYCQ.00405A7C
00405A61  |.  8BD8       |MOV EBX,EAX
00405A63  |.  6A 00       |PUSH 0                               ; /pBytesWritten = NULL
00405A65  |.  68 81000000 |PUSH 81                               ; |BytesToWrite = 81 (129.)
00405A6A  |.  57          |PUSH EDI                               ; |Buffer
00405A6B  |.  FF76 08    |PUSH DWORD PTR DS:[ESI+8]             ; |Address
00405A6E  |.  53          |PUSH EBX                               ; |hProcess
00405A6F  |.  FF15 B4A24200 |CALL DWORD PTR DS:[<&kernel32.WriteProc>; \WriteProcessMemory
00405A75  |.  53          |PUSH EBX                               ; /hObject
00405A76  |.  FF15 D0A14200 |CALL DWORD PTR DS:[<&kernel32.CloseHand>; \CloseHandle

004033F8 .  8B96 04010000 MOV EDX,DWORD PTR DS:[ESI+104]
004033FE .  81F2 ED4C5B7A XOR EDX,7A5B4CED
00403404 .  3BD3       CMP EDX,EBX
00403406 .  74 10       JE SHORT PYCQ.00403418
00403408 .  8B47 1C    MOV EAX,DWORD PTR DS:[EDI+1C]

EDX=7AF95037

00403404 .  3BD3       CMP EDX,EBX
00403406    EB 10       JMP SHORT PYCQ.00403418
00403408 .  8B47 1C    MOV EAX,DWORD PTR DS:[EDI+1C]

004033B9 .  6A EB       PUSH -15                                        ; /Index = GWL_USERDATA
004033BB .  50          PUSH EAX                                        ; |hWnd
004033BC .  FF15 E8A44200 CALL DWORD PTR DS:[<&user32.GetWindowLongA>]    ; \GetWindowLongA

0335B4EF

405afa

/////////////////////////////////////////////////////////////////////
dll

0229D1B9  D1 ED 94 19 D4 46 00 00 01 00 33 53 E6 42 59 CD  秧?云...3S媛Y

022A6843  E4 56 46 00 B4 D8 44 00 4C 83 41 00 78 55 45 00  渲F.簇D.L?.xUE.
022A6853  A8 36 47 00 50 EA 46 00 4C 59 46 00 18 4B 46 00  ?G.P昶.LYF.KF.

10001123  |.  3D 80000000 CMP EAX,80
10001128    EB 45       JMP SHORT PYCQ.1000116F
1000112A    90          NOP
1000112B    90          NOP
1000112C    90          NOP
1000112D    90          NOP
1000112E  |.  68 80000000 PUSH 80

Names in PYCQ, item 78
Address=1003E0B0
Section=.edata
Type=Import  (Known)
Name=kernel32.MapViewOfFile

CALL DWORD PTR DS:[1003E0B0]

Breakpoints
Address Module    Active                   Disassembly                                              Comment
00410148 LOADDLL One-shot                NOP
10001128 PYCQ    Always                   JMP SHORT PYCQ.1000116F
10009848 PYCQ    Always                   CALL DWORD PTR DS:[<&kernel32.MapViewOfFile>]
1000B9F2 PYCQ    Always                   CALL DWORD PTR DS:[<&kernel32.MapViewOfFile>]
100133A2 PYCQ    Always                   CALL DWORD PTR DS:[<&kernel32.MapViewOfFile>] send
10014AA8 PYCQ    Always                   CALL DWORD PTR DS:[<&kernel32.MapViewOfFile>]

02871175 C605 CDF18A02 0>MOV BYTE PTR DS:[28AF1CD],1
0287117C 68 80000000    PUSH 80
02871181 68 B9D18A02    PUSH PYCQ.028AD1B9
02871186 8D45 80       LEA EAX,DWORD PTR SS:[EBP-80]
02871189 50             PUSH EAX
0287118A E8 21B70300    CALL PYCQ.028AC8B0

EAX=004656E4 (mir.004656E4)
DS:[028B6843]=FFFFFFFF

028B6843  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ????????
028B6853  FF FF FF FF FF FF FF FF FF FF FF FF 18 4B 46 00  ??????KF.

028B6843  E4 56 46 00 B4 D8 44 00 4C 83 41 00 78 55 45 00  渲F.簇D.L?.xUE.
028B6853  A8 36 47 00 50 EA 46 00 4C 59 46 00 18 4B 46 00  ?G.P昶.LYF.KF.

0289EFC7 803D C6D18A02 0>CMP BYTE PTR DS:[28AD1C6],0
0289EFCE 74 5C          JE SHORT PYCQ.0289F02C
0289EFD0 68 0000FF00    PUSH 0FF0000
0289EFD5 68 FFFFFF00    PUSH 0FFFFFF
0289EFDA 68 C6D18A02    PUSH PYCQ.028AD1C6
0289EFDF E8 6744FEFF    CALL PYCQ.0288344B
0289EFE4 C605 C6D18A02 0>MOV BYTE PTR DS:[28AD1C6],0
0289EFEB 803D 23F08A02 0>CMP BYTE PTR DS:[28AF023],3

00404D40 .  8B4424 08    MOV EAX,DWORD PTR SS:[ESP+8]

404d4000

0041EA88  |> \56          PUSH ESI    ;  Cases A,21 of switch 0041E7C3

CALL DWORD PTR DS:[42A53C]
CALL DWORD PTR DS:[42A518]
Names in PYCQ, item 301
Address=0042A53C
Type=Import  (Known)
Name=user32.SendMessageA
Names in PYCQ, item 260
Address=0042A518
Type=Import  (Known)
Name=user32.PostMessageA

SendMessage函数的功能是“发送消息”，即将一条消息发送到指定对象（操作系统、窗口或控件等）上，以产生特定的动作（如滚屏、修改对象外观等）。

02261175 .  C605 CDF12902 01    MOV BYTE PTR DS:[229F1CD],1
0226117C .  68 80000000          PUSH 80
02261181 .  68 B9D12902          PUSH PYCQ.0229D1B9
02261186 .  8D45 80             LEA EAX,DWORD PTR SS:[EBP-80]
02261189 .  50                   PUSH EAX
0226118A .  E8 21B70300          CALL PYCQ.0229C8B0

02871175 C605 CDF18A02 0>MOV BYTE PTR DS:[28AF1CD],1
0287117C 68 80000000    PUSH 80
02871181 68 B9D18A02    PUSH PYCQ.028AD1B9
02871186 8D45 80       LEA EAX,DWORD PTR SS:[EBP-80]
02871189 50             PUSH EAX
0287118A E8 21B70300    CALL PYCQ.028AC8B0

10001175 .  C605 CDF10310 01    MOV BYTE PTR DS:[1003F1CD],1
1000117C .  68 80000000       PUSH 80
10001181 .  68 B9D10310       PUSH PYCQ.1003D1B9
10001186 .  8D45 80             LEA EAX,DWORD PTR SS:[EBP-80]
10001189 .  50                PUSH EAX
1000118A .  E8 21B70300       CALL PYCQ.1003C8B0

1002EFC2  |.  E8 74000000 CALL PYCQ.1002F03B
1002EFC7  |.  803D C6D10310>CMP BYTE PTR DS:[1003D1C6],0
1002EFCE  |.  74 5C       JE SHORT PYCQ.1002F02C
1002EFD0  |.  68 0000FF00 PUSH 0FF0000                            ; /Arg3 = 00FF0000
1002EFD5  |.  68 FFFFFF00 PUSH 0FFFFFF                            ; |Arg2 = 00FFFFFF

0228EFC7  |.  803D C6D12902 00    CMP BYTE PTR DS:[229D1C6],0
0228EFCE  |.  74 5C                JE SHORT PYCQ.0228F02C
0228EFD0  |.  68 0000FF00          PUSH 0FF0000                            ; /Arg3 = 00FF0000
0228EFD5  |.  68 FFFFFF00          PUSH 0FFFFFF                            ; |Arg2 = 00FFFFFF
0228EFDA  |.  68 C6D12902          PUSH PYCQ.0229D1C6                      ; |Arg1 = 0229D1C6
0228EFDF  |.  E8 6744FEFF          CALL PYCQ.0227344B                      ; \PYCQ.1001344B

0040339F    90          NOP
004033A0    C2 0C00    RETN 0C
004033A3 .  8BF9       MOV EDI,ECX

0040339F    90          NOP
004033A0    53          PUSH EBX
004033A1    56          PUSH ESI
004033A2    57          PUSH EDI
004033A3 .  8BF9       MOV EDI,ECX
004033A5 .  E8 0BA40100 CALL PYCQ.0041D7B5

7A5B4CED
ed4c5b7a

00404D39    90             NOP
00404D3A    90             NOP
00404D3B    90             NOP
00404D3C    90             NOP
00404D3D    90             NOP
00404D3E    90             NOP
00404D3F    90             NOP
00404D40 .  8B4424 08       MOV EAX,DWORD PTR SS:[ESP+8]
00404D44 .  8B49 1C       MOV ECX,DWORD PTR DS:[ECX+1C]
00404D47 .  50             PUSH EAX                               ; /NewValue
00404D48 .  6A EB          PUSH -15                               ; |Index = GWL_USERDATA
00404D4A .  51             PUSH ECX                               ; |hWnd
00404D4B .  FF15 A4A44200 CALL DWORD PTR DS:[<&user32.SetWindowLon>; \SetWindowLongA
00404D51 .  B8 01000000    MOV EAX,1
00404D56 .  C2 0800       RETN 8
00404D59    90             NOP
00404D5A    90             NOP
00404D5B    90             NOP
00404D5C    90             NOP
00404D5D    90             NOP
00404D5E    90             NOP
00404D5F    90             NOP

MOV DWORD PTR DS:[00404D39],EAX

my code
00429F20    A3 394D4000    MOV DWORD PTR DS:[404D39],EAX
00429F25    8B49 1C       MOV ECX,DWORD PTR DS:[ECX+1C]
00429F28    50             PUSH EAX
00429F29    6A EB          PUSH -15
00429F2B ^ E9 1AAEFDFF    JMP PYCQ.00404D4A

00404D40    8B4424 08       MOV EAX,DWORD PTR SS:[ESP+8]
00404D44    E9 D7510200    JMP PYCQ.00429F20
00404D49    90             NOP
00404D4A    51             PUSH ECX
00404D4B    FF15 A4A44200 CALL DWORD PTR DS:[<&user32.SetWindowLon>;  USER32.SetWindowLongA
00404D51    B8 01000000    MOV EAX,1
00404D56    C2 0800       RETN 8

mycode
00429F30    A1 394D4000             MOV EAX,DWORD PTR DS:[404D39]
00429F35    35 ED4C5B7A             XOR EAX,7A5B4CED
00429F3A    894424 58                MOV DWORD PTR SS:[ESP+58],EAX
00429F3E ^ E9 E888FDFF             JMP PYCQ.0040282B

recv
004027D8

004027D8    /E9 53770200             JMP PYCQ.00429F30
004027DD    |90                      NOP
004027DE    |90                      NOP
004027DF    |90                      NOP
004027E0    |90                      NOP

key
8C1D3807

1000C086  |.  6A EB       PUSH -15                               ; |Index = GWL_USERDATA
1000C0FD .  6A EB       PUSH -15                               ; /Index = GWL_USERDATA
1000C150 > \6A EB       PUSH -15                               ; /Index = GWL_USERDATA
1000C335 > \6A EB       PUSH -15                               ; /Index = GWL_USERDATA
1001BD7E  |.  6A EB       PUSH -15                               ; |Index = GWL_USERDATA

Breakpoints
Address Module    Active                   Disassembly                         Comment
02661128 PYCQ    Disabled                JMP SHORT PYCQ.0266116F
02669848 PYCQ    Disabled                CALL DWORD PTR DS:[<&kernel32.MapVie
0266B9F2 PYCQ    Disabled                CALL DWORD PTR DS:[<&kernel32.MapVie
0266C086 PYCQ    Disabled                PUSH -15
0266C0FD PYCQ    Disabled                PUSH -15
0266C150 PYCQ    Disabled                PUSH -15
0266C335 PYCQ    Disabled                PUSH -15
0266C360 PYCQ    Disabled                PUSH EBP
026733A2 PYCQ    Disabled                CALL DWORD PTR DS:[<&kernel32.MapVie
02674AA8 PYCQ    Disabled                CALL DWORD PTR DS:[<&kernel32.MapVie
0267BD7E PYCQ    Disabled                PUSH -15
0268EFC7 PYCQ    Disabled                CMP BYTE PTR DS:[269D1C6],0

0012FC40 028D0104  |Arg1 = 028D0104
0012FC44 0012FC79  |Arg2 = 0012FC79
0012FC48 00000026  \Arg3 = 00000026

028D0104  A6 DD D1 74 EE B1 1B 33 88 D8 BC 79 6C D5 46 DD  ?阳畋3?践l掌
028D0114  7B 52 28 99 29 B1 39 85 58 CD 24 36 1C FA D9 42  {R(????6?B
028D0124  32 FD 1E 12 76 38 20 A0                         2?v8 ?.

10001040 >  A1 E89A0010    MOV EAX,DWORD PTR DS:[10009AE8]
10001045 56             PUSH ESI
10001046 8B7424 0C    MOV ESI,DWORD PTR SS:[ESP+C]
1000104A 57             PUSH EDI
1000104B 6A 00          PUSH 0
1000104D B9 0C000000    MOV ECX,0C
10001052 BF F49A0010    MOV EDI,wgshell.10009AF4
10001057 50             PUSH EAX
10001058 68 90100010    PUSH wgshell.10001090
1000105D 6A 0A          PUSH 0A
1000105F F3:A5          REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
10001061 FF15 E49A0010 CALL DWORD PTR DS:[10009AE4]          ; USER32.SetWindowsHookExA

004037F5  |.  52          PUSH EDX                               ; /FileName
004037F6  |.  FF15 C4A24200 CALL DWORD PTR DS:[<&kernel32.LoadLibrar>; \LoadLibraryA
004037FC  |.  85C0       TEST EAX,EAX                            ;  PYCQ_1ip.01320000

01334B65  |.  8B90 30010000 MOV EDX,DWORD PTR DS:[EAX+130]
01334B6B  |.  3390 04010000 XOR EDX,DWORD PTR DS:[EAX+104]
01334B71  |.  8915 636C3601 MOV DWORD PTR DS:[1366C63],EDX

\xFD\x52\x81\x79
\x1F\x66\xC7\x79
\x82\xF3\x81\x79
\x76\x5D\xC7\x79

DS:[01380104]=74893A13

$mess="
\xD7\x73\xD4\x19\xAF\x39\x00\x00\x01\x00\xC0\xA8\x12\xCE\x40\x9C\xE8\x03\x00\x00\x7F\x00\x00\x01\x20\xA0\x00\x39\x7D\x9D\x68\x6D\x1B\xF0\xAB\xC5\xD4\x9F\xC6\x8F\xF1\xA1\x2E\x3C\x2C\xB2\x43\xF5\x5B\x3B\x12\xB8\xE4\x0B\x0E\x02\x4C\xED\x77\x20\xBD\xC8\xC8\x79\xEE\xB1\x1B\x33\x88\xD8\xBC\x79\x6C\xD5\x46\xDD\x7B\x52\x28\x99\x29\xB1\x39\x85\x58\xCD\x24\x36\x1C\xFA\xD9\x42\x32\xFD\x1E\x12\x76\x38
\xFD\x52\x81\x79
\x1F\x66\xC7\x79
\x82\xF3\x81\x79
\x76\x5D\xC7\x79
\x9A\xA4\x55\x1B\x03\x3A\xC6\xF0\x93\x6F\xCA\xC8\xD6\x94";

01334B6B  |.  3390 04010000    XOR EDX,DWORD PTR DS:[EAX+104]

74B9D556

00401000 .  B8 40A64200 MOV EAX,PYCQ.0042A640

00471FFF    00          DB 00

00472000

00404A63 > \68 A0644300 PUSH PYCQ.004364A0                      ;  ASCII "GR"
00404A68 .  8D8E 9C000000 LEA ECX,DWORD PTR DS:[ESI+9C]
00404A6E .  E8 047E0100 CALL PYCQ.0041C877
00404A73 .  C786 98000000>MOV DWORD PTR DS:[ESI+98],1
00404A7D .  FF15 08A24200 CALL DWORD PTR DS:[<&kernel32.GetTickCou>; [GetTickCount
00404A83 .  50          PUSH EAX                               ; /lParam
00404A84 .  8B46 1C    MOV EAX,DWORD PTR DS:[ESI+1C]          ; |
00404A87 .  6A 00       PUSH 0                                  ; |wParam = 0
00404A89 .  68 00050000 PUSH 500                               ; |Message = MSG(500)
00404A8E .  50          PUSH EAX                               ; |hWnd
00404A8F .  FF15 18A54200 CALL DWORD PTR DS:[<&user32.PostMessageA>; \PostMessageA
00404A95 .  33C0       XOR EAX,EAX
00404A97 .  5E          POP ESI
00404A98 .  C2 0400    RETN 4

0012EEE0 0F1DA824  \lParam = F1DA824

004027D5 .  83C4 0C    ADD ESP,0C
004027D8    EB 51       JMP SHORT PYCQ.0040282B
004027DA    90          NOP
004027DB    90          NOP
004027DC    90          NOP

004027D5 .  83C4 0C    ADD ESP,0C
004027D8    E9 53770200 JMP PYCQ.00429F30
004027DD    90          NOP
004027DE    90          NOP

00404A63 > \68 A0644300 PUSH PYCQ.004364A0                      ;  ASCII "GR"
00404A68 .  8D8E 9C000000 LEA ECX,DWORD PTR DS:[ESI+9C]
00404A6E .  E8 047E0100 CALL PYCQ.0041C877
00404A73 .  C786 98000000>MOV DWORD PTR DS:[ESI+98],1
00404A7D .  FF15 08A24200 CALL DWORD PTR DS:[<&kernel32.GetTickCou>; [GetTickCount
00404A83 .  50          PUSH EAX                               ; /lParam
00404A84 .  8B46 1C    MOV EAX,DWORD PTR DS:[ESI+1C]          ; |
00404A87 .  6A 00       PUSH 0                                  ; |wParam = 0
00404A89 .  68 00050000 PUSH 500                               ; |Message = MSG(500)
00404A8E .  50          PUSH EAX                               ; |hWnd
00404A8F .  FF15 18A54200 CALL DWORD PTR DS:[<&user32.PostMessageA>; \PostMessageA
00404A95 .  33C0       XOR EAX,EAX
00404A97 .  5E          POP ESI
00404A98 .  C2 0400    RETN 4

00404D40 .  8B4424 08    MOV EAX,DWORD PTR SS:[ESP+8]
00404D44 .  E9 D7510200 JMP PYCQ.00429F20
00404D49    90          NOP
00404D4A >  51          PUSH ECX                               ; |hWnd
00404D4B .  FF15 A4A44200 CALL DWORD PTR DS:[<&user32.SetWindowLon>; \SetWindowLongA
00404D51 .  B8 01000000 MOV EAX,1

004022A8    /E9 25010000 JMP PYCQ.004023D2
004022AD    |90          NOP

00402983 .  68 28050000 PUSH 528
00402988 .  6A 40       PUSH 40
0040298A .  FFD3       CALL EBX                                     ;  GlobalAlloc
0040298C .  50          PUSH EAX                                     ; /hMem
0040298D .  A3 C4AB4300 MOV DWORD PTR DS:[43ABC4],EAX                ; |
00402992 .  FF15 F0A14200 CALL DWORD PTR DS:[<&kernel32.GlobalLock>]    ; \GlobalLock

004027F3 |FFD3                   CALL EBX

00913396 FFD1          CALL ECX                               ; KERNEL32.77E7B6C9

GMEM_ZEROINIT                      equ 40h
GMEM_ZEROINIT 新分配的内存块全部初始化成零

GMEM_FIXED                         equ 0h
GMEM_FIXED 分配一个固定内存块

004027D8 . /EB 51       JMP SHORT PYCQ.0040282B

004027D8    8B1D F4A14200       MOV EBX,DWORD PTR DS:[<&kernel32.GlobalAlloc>]          ;  KERNEL32.GlobalAlloc
004027DE    EB 4B             JMP SHORT PYCQ.0040282B

0228ED4E  |.  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hOwner
0228ED51  |.  FF75 10    PUSH DWORD PTR SS:[EBP+10]             ; |pTemplate
0228ED54  |.  FF35 24D02902 PUSH DWORD PTR DS:[229D024]             ; |hInst = 0225F000
0228ED5A  |.  FF15 D4E12902 CALL DWORD PTR DS:[<&user32.CreateDialog>; \CreateDialogParamA
0228ED60  |.  C9          LEAVE

0012FCD8 00B83AA2  |Arg1 = 00B83AA2
0012FCDC 00000005  |Arg2 = 00000005
0012FCE0 000003EE  |Arg3 = 000003EE
0012FCE4 0228EC0A  \Arg4 = 0228EC0A

0012FC7C 0225F000  |hModule = 0225F000
0012FC80 00000005  |ResourceType = RT_DIALOG
0012FC84 000003EE  |ResourceName = 3EE
0012FC88 00000000  \LanguageId = 0 (LANG_NEUTRAL)

DS:[0225F000]=???

0229857E .  FF35 24D02902       PUSH DWORD PTR DS:[229D024]                                     ; |hInst = 0225F000

CALL DWORD PTR DS:[229E0D4]

0227ABBE  |.  6D 73 76 66 77 33 32 2>ASCII "msvfw32.dll",0
0227ABCA  |>  68 BEAB2702          PUSH PYCQ.0227ABBE                                              ; /FileName = "msvfw32.dll"
0227ABCF  |.  FF15 B4E02902       CALL DWORD PTR DS:[<&kernel32.LoadLibraryA>]                      ; \LoadLibraryA

0227D614  /$  55                   PUSH EBP
0227D615  |.  8BEC                MOV EBP,ESP
0227D617  |.  81C4 58FEFFFF       ADD ESP,-1A8
0227D61D  |.  EB 0D                JMP SHORT PYCQ.0227D62C
0227D61F  |.  6B 65 72 6E 65 6C 33 3>ASCII "kernel32.dll",0
0227D62C  |>  68 1FD62702          PUSH PYCQ.0227D61F                                              ; /hResource = 0227D61F
0227D631  |.  FF15 D4E02902       CALL DWORD PTR DS:[<&kernel32.FreeResource>]                      ; \FreeResource
0227D637  |.  0BC0                OR EAX,EAX
0227D639  |.  0F84 16010000       JE PYCQ.0227D755
0227D63F  |.  8945 FC             MOV DWORD PTR SS:[EBP-4],EAX
0227D642  |.  EB 07                JMP SHORT PYCQ.0227D64B
0227D644  |.  5F 6C 6F 70 65 6E 00 ASCII "_lopen",0
0227D64B  |>  68 44D62702          PUSH PYCQ.0227D644                                              ; /ProcNameOrOrdinal = "_lopen"
0227D650  |.  FF75 FC             PUSH DWORD PTR SS:[EBP-4]                                        ; |hModule
0227D653  |.  FF15 D0E02902       CALL DWORD PTR DS:[<&kernel32.GetProcAddress>]                   ; \GetProcAddress
0227D659  |.  0BC0                OR EAX,EAX

Names in PYCQ, item 47
Address=1003E0D0
Section=.edata
Type=Import  (Known)
Name=kernel32.GetProcAddress

1001D61F  |.  6B 65 72 6E 6>ASCII "kernel32.dll",0
1001D62C  |>  68 1FD60110 PUSH PYCQ_org.1001D61F                ;  ASCII "kernel32.dll"
1001D631  |.  FF15 D4E00310 CALL DWORD PTR DS:[1003E0D4]
1001D637  |.  0BC0       OR EAX,EAX
1001D639  |.  0F84 16010000 JE PYCQ_org.1001D755
1001D63F  |.  8945 FC    MOV DWORD PTR SS:[EBP-4],EAX
1001D642  |.  EB 07       JMP SHORT PYCQ_org.1001D64B
1001D644  |.  5F 6C 6F 70 6>ASCII "_lopen",0
1001D64B  |>  68 44D60110 PUSH PYCQ_org.1001D644                ;  ASCII "_lopen"
1001D650  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]
1001D653  |.  FF15 D0E00310 CALL DWORD PTR DS:[1003E0D0]
1001D659  |.  0BC0       OR EAX,EAX
1001D65B  |.  74 03       JE SHORT PYCQ_org.1001D660
1001D65D  |.  8945 F8    MOV DWORD PTR SS:[EBP-8],EAX
1001D660  |>  EB 07       JMP SHORT PYCQ_org.1001D669
1001D662  |.  5F 6C 72 65 6>ASCII "_lread",0
1001D669  |>  68 62D60110 PUSH PYCQ_org.1001D662                ;  ASCII "_lread"
1001D66E  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]
1001D671  |.  FF15 D0E00310 CALL DWORD PTR DS:[1003E0D0]
1001D677  |.  0BC0       OR EAX,EAX
1001D679  |.  74 03       JE SHORT PYCQ_org.1001D67E
1001D67B  |.  8945 F4    MOV DWORD PTR SS:[EBP-C],EAX
1001D67E  |>  EB 08       JMP SHORT PYCQ_org.1001D688
1001D680  |.  5F 6C 63 6C 6>ASCII "_lclose",0
1001D688  |>  68 80D60110 PUSH PYCQ_org.1001D680                ;  ASCII "_lclose"
1001D68D  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]
1001D690  |.  FF15 D0E00310 CALL DWORD PTR DS:[1003E0D0]
1001D696  |.  0BC0       OR EAX,EAX
1001D698  |.  74 03       JE SHORT PYCQ_org.1001D69D
1001D69A  |.  8945 F0    MOV DWORD PTR SS:[EBP-10],EAX
1001D69D  |>  EB 08       JMP SHORT PYCQ_org.1001D6A7
1001D69F  |.  5F 6C 6C 73 6>ASCII "_llseek",0
1001D6A7  |>  68 9FD60110 PUSH PYCQ_org.1001D69F                ;  ASCII "_llseek"
1001D6AC  |.  FF75 FC    PUSH DWORD PTR SS:[EBP-4]

DS:[1003E0D0]=007D0EE8

1001D631             |.  FF15 D4E00310 CALL DWORD PTR DS:[<&kernel32.FreeResour>; \LoadLibraryA

1001D61F  |.  6B 65 72 6E 65 6C 3>ASCII "kernel32.dll",0
1001D62C  |>  68 1FD60110       PUSH PYCQ.1001D61F                      ; /hResource = 1001D61F
1001D631  |.  FF15 D4E00310    CALL DWORD PTR DS:[<&kernel32.FreeResour>; \FreeResource
1001D637  |.  0BC0             OR EAX,EAX
1001D639  |.  0F84 16010000    JE PYCQ.1001D755
1001D63F  |.  8945 FC          MOV DWORD PTR SS:[EBP-4],EAX
1001D642  |.  EB 07             JMP SHORT PYCQ.1001D64B
1001D644  |.  5F 6C 6F 70 65 6E 0>ASCII "_lopen",0
1001D64B  |>  68 44D60110       PUSH PYCQ.1001D644                      ; /ProcNameOrOrdinal = "_lopen"
1001D650  |.  FF75 FC          PUSH DWORD PTR SS:[EBP-4]             ; |hModule
1001D653  |.  FF15 D0E00310    CALL DWORD PTR DS:[<&kernel32.GetProcAdd>; \GetProcAddress

1000AC9B > \68 8FAC0010       PUSH PYCQ.1000AC8F                      ; /FileName = "version.dll"
1000ACA0 .  FF15 B4E00310    CALL DWORD PTR DS:[<&kernel32.LoadLibrar>; \LoadLibraryA
1000ACA6 .  0BC0             OR EAX,EAX
1000ACA8 .  0F84 98000000    JE PYCQ.1000AD46
1000ACAE .  8985 68FDFFFF    MOV DWORD PTR SS:[EBP-298],EAX
1000ACB4 .  EB 18             JMP SHORT PYCQ.1000ACCE
1000ACB6 .  47 65 74 46 69 6C 6>ASCII "GetFileVersionIn"
1000ACC6 .  66 6F 53 69 7A 65 4>ASCII "foSizeA",0
1000ACCE >  68 B6AC0010       PUSH PYCQ.1000ACB6                      ; /ProcNameOrOrdinal = "GetFileVersionInfoSizeA"
1000ACD3 .  FFB5 68FDFFFF    PUSH DWORD PTR SS:[EBP-298]             ; |hModule
1000ACD9 .  FF15 D0E00310    CALL DWORD PTR DS:[<&kernel32.GetProcAdd>; \GetProcAddress

1001D61F  |.  6B 65 72 6E 65 6C 3>ASCII "kernel32.dll",0
1001D62C  |>  68 1FD60110       PUSH 测试.1001D61F                      ; /hResource = 1001D61F
1001D631  |.  FF15 D4E00310    CALL DWORD PTR DS:[<&kernel32.FreeResour>; \FreeResource
1001D637  |.  0BC0             OR EAX,EAX
1001D639  |.  0F84 16010000    JE 测试.1001D755
1001D63F  |.  8945 FC          MOV DWORD PTR SS:[EBP-4],EAX
1001D642  |.  EB 07             JMP SHORT 测试.1001D64B
1001D644  |.  5F 6C 6F 70 65 6E 0>ASCII "_lopen",0
1001D64B  |>  68 44D60110       PUSH 测试.1001D644                      ; /ProcNameOrOrdinal = "_lopen"
1001D650  |.  FF75 FC          PUSH DWORD PTR SS:[EBP-4]             ; |hModule
1001D653  |.  FF15 D0E00310    CALL DWORD PTR DS:[<&kernel32.GetProcAdd>; \GetProcAddress

1000AC9B > \68 8FAC0010       PUSH 测试.1000AC8F                      ; /FileName = "version.dll"
1000ACA0 .  FF15 B4E00310    CALL DWORD PTR DS:[<&kernel32.LoadLibrar>; \LoadLibraryA
1000ACA6 .  0BC0             OR EAX,EAX
1000ACA8 .  0F84 98000000    JE 测试.1000AD46
1000ACAE .  8985 68FDFFFF    MOV DWORD PTR SS:[EBP-298],EAX
1000ACB4 .  EB 18             JMP SHORT 测试.1000ACCE
1000ACB6 .  47 65 74 46 69 6C 6>ASCII "GetFileVersionInfoSizeA",0
1000ACCE >  68 B6AC0010       PUSH 测试.1000ACB6                      ; /ProcNameOrOrdinal = "GetFileVersionInfoSizeA"
1000ACD3 .  FFB5 68FDFFFF    PUSH DWORD PTR SS:[EBP-298]             ; |hModule
1000ACD9 .  FF15 D0E00310    CALL DWORD PTR DS:[<&kernel32.GetProcAdd>; \GetProcAddress

10009816  |.  62 79 77 67 6>ASCII "bywgcq#1108",0
10009822  |>  68 16980010 PUSH PYCQ.10009816                      ; /MappingName = "bywgcq#1108"

bywgcq#1108

01334AC2  |.  FFB0 4C010000 PUSH DWORD PTR DS:[EAX+14C] ;0
01334AC8  |.  8F05 06F03501 POP DWORD PTR DS:[135F006]
01334ACE  |.  FFB0 50010000 PUSH DWORD PTR DS:[EAX+150] ;0
01334AD4  |.  8F05 0AF03501 POP DWORD PTR DS:[135F00A]
01334ADA  |.  FFB0 40010000 PUSH DWORD PTR DS:[EAX+140] ;exe句柄
01334AE0  |.  8F05 00D03501 POP DWORD PTR DS:[135D000]
01334AE6  |.  0FB790 2A0100>MOVZX EDX,WORD PTR DS:[EAX+12A] ;port
01334AED  |.  8915 ACF13501 MOV DWORD PTR DS:[135F1AC],EDX
01334AF3  |.  FFB0 88010000 PUSH DWORD PTR DS:[EAX+188]
01334AF9  |.  8F05 B0F13501 POP DWORD PTR DS:[135F1B0] ;ip
01334AFF  |.  8A90 57010000 MOV DL,BYTE PTR DS:[EAX+157] ;1
01334B05  |.  8815 6CD13501 MOV BYTE PTR DS:[135D16C],DL
01334B0B  |.  8A90 56010000 MOV DL,BYTE PTR DS:[EAX+156] ;0
01334B11  |.  8815 12F03501 MOV BYTE PTR DS:[135F012],DL
01334B17  |.  8A90 54010000 MOV DL,BYTE PTR DS:[EAX+154] ;0
01334B1D  |.  8815 CEF13501 MOV BYTE PTR DS:[135F1CE],DL
01334B23  |.  8A90 55010000 MOV DL,BYTE PTR DS:[EAX+155] ;0
01334B29  |.  8815 CFF13501 MOV BYTE PTR DS:[135F1CF],DL
01334B2F  |.  8B90 3C010000 MOV EDX,DWORD PTR DS:[EAX+13C]
01334B35  |.  3390 38010000 XOR EDX,DWORD PTR DS:[EAX+138]
01334B3B  |.  8915 836B3601 MOV DWORD PTR DS:[1366B83],EDX
01334B41  |.  8B90 38010000 MOV EDX,DWORD PTR DS:[EAX+138]
01334B47  |.  3390 34010000 XOR EDX,DWORD PTR DS:[EAX+134]
01334B4D  |.  8915 4F6B3601 MOV DWORD PTR DS:[1366B4F],EDX
01334B53  |.  8B90 34010000 MOV EDX,DWORD PTR DS:[EAX+134]
01334B59  |.  3390 30010000 XOR EDX,DWORD PTR DS:[EAX+130]
01334B5F  |.  8915 976A3601 MOV DWORD PTR DS:[1366A97],EDX
01334B65  |.  8B90 30010000 MOV EDX,DWORD PTR DS:[EAX+130]
01334B6B  |.  3390 04010000 XOR EDX,DWORD PTR DS:[EAX+104]
01334B71  |.  8915 636C3601 MOV DWORD PTR DS:[1366C63],EDX

014C4AC2 FFB0 4C010000 PUSH DWORD PTR DS:[EAX+14C]

014C4B3B 8915 836B4F01 MOV DWORD PTR DS:[14F6B83],EDX          ; PYCQ.0046AEF4
014C4B4D 8915 4F6B4F01 MOV DWORD PTR DS:[14F6B4F],EDX          ; PYCQ.0046959D
014C4B5F 8915 976A4F01 MOV DWORD PTR DS:[14F6A97],EDX          ; PYCQ.004634E2
014C4B71 8915 636C4F01 MOV DWORD PTR DS:[14F6C63],EDX          ; PYCQ.00499A40

10001181 .  68 B9D10310 PUSH PYCQ.1003D1B9

02281181 .  68 B9D12B02    PUSH PYCQ.022BD1B9

recv
026AE990 .  FF75 08    PUSH DWORD PTR SS:[EBP+8]
026AE993 .  E8 6E27FDFF CALL PYCQ.02681106
026AE998 .  FF75 10    PUSH DWORD PTR SS:[EBP+10]

处理501 mess
026AE3B7 .  55          PUSH EBP
026AE3B8 .  8BEC       MOV EBP,ESP
026AE3BA .  81C4 ECFEFFFF ADD ESP,-114
026AE3C0 .  68 2DF06A02 PUSH PYCQ.026AF02D                      ;  SE handler installation
026AE3C5 .  64:FF35 00000>PUSH DWORD PTR FS:[0]
026AE3CC .  64:8925 00000>MOV DWORD PTR FS:[0],ESP
026AE3D3 .  8B45 0C    MOV EAX,DWORD PTR SS:[EBP+C]
026AE3D6 .  3D 10010000 CMP EAX,110
026AE3DB .  0F85 A1010000 JNZ PYCQ.026AE582

026AED54  |.  FF35 24D06B02       PUSH DWORD PTR DS:[26BD024]             ; |hInst = 0267F000

026949B0  /$  55                PUSH EBP
026949B1  |.  8BEC                MOV EBP,ESP
026949B3  |.  83C4 F4             ADD ESP,-0C
026949B6  |.  FF75 08             PUSH DWORD PTR SS:[EBP+8]
026949B9  |.  8F05 24D06B02       POP DWORD PTR DS:[26BD024]
026949BF  |.  EB 0B             JMP SHORT PYCQ.026949CC
026949C1  |.  75 73 65 72 33 32 2E>ASCII "user32.dll",0
026949CC  |>  68 C1496902       PUSH PYCQ.026949C1                      ; /FileName = "user32.dll"
026949D1  |.  FF15 B4E06B02       CALL DWORD PTR DS:[<&kernel32.LoadLibrar>; \LoadLibraryA

0269D614  /$  55                PUSH EBP
0269D615  |.  8BEC                MOV EBP,ESP
0269D617  |.  81C4 58FEFFFF       ADD ESP,-1A8
0269D61D  |.  EB 0D             JMP SHORT PYCQ.0269D62C
0269D61F  |.  6B 65 72 6E 65 6C 33>ASCII "kernel32.dll",0
0269D62C  |>  68 1FD66902       PUSH PYCQ.0269D61F                      ; /pModule = "kernel32.dll"
0269D631  |.  FF15 D4E06B02       CALL DWORD PTR DS:[<&kernel32.GetModuleH>; \GetModuleHandleA

0012FC7C 0267F000  |hModule = 0267F000
0012FC80 00000005  |ResourceType = RT_DIALOG
0012FC84 000003EB  |ResourceName = 3EB
0012FC88 00000000  \LanguageId = 0 (LANG_NEUTRAL)

77DFC95D FF15 C091E477       CALL DWORD PTR DS:[77E491C0]          ; kernel32.FindResourceExA

Log data, item 0
Address=77F90235
Message=Access violation when reading [0267F000]

1001D631  |.  FF15 D4E00310 CALL DWORD PTR DS:[1003E0D4]

007D133C 55             PUSH EBP
007D133D 8BEC          MOV EBP,ESP
007D133F 8B45 08       MOV EAX,DWORD PTR SS:[EBP+8]
007D1342 85C0          TEST EAX,EAX
007D1344 75 07          JNZ SHORT 007D134D
007D1346 A1 78697D00    MOV EAX,DWORD PTR DS:[7D6978]
007D134B EB 06          JMP SHORT 007D1353
007D134D 50             PUSH EAX
007D134E E8 053EFFFF    CALL 007C5158                         ; JMP to KERNEL32.GetModuleHandleA
007D1353 5D             POP EBP
007D1354 C2 0400       RETN 4

GetModuleHandleA

1001D763  |. /74 1D          JE SHORT PYCQ.1001D782

1002ECE2 .  68 31130000          PUSH 1331                               ; |Message = MSG(1331)

1002ECFC .  FF35 7AF00310       PUSH DWORD PTR DS:[1003F07A]          ; |hWnd = NULL

0228EFCE  |. /74 5C       JE SHORT PYCQ.0228F02C
0228EFD0  |. |68 0000FF00 PUSH 0FF0000                            ; /Arg3 = 00FF0000
0228EFD5  |. |68 FFFFFF00 PUSH 0FFFFFF                            ; |Arg2 = 00FFFFFF
0228EFDA  |. |68 C6D12902 PUSH PYCQ.0229D1C6                      ; |Arg1 = 0229D1C6
0228EFDF  |. |E8 6744FEFF CALL PYCQ.0227344B                      ; \PYCQ.1001344B
0228EFE4  |. |C605 C6D12902>MOV BYTE PTR DS:[229D1C6],0
0228EFEB  |. |803D 23F02902>CMP BYTE PTR DS:[229F023],3
0228EFF2  |. |75 05       JNZ SHORT PYCQ.0228EFF9
0228EFF4  |. |E8 E8BBFDFF CALL PYCQ.0226ABE1
0228EFF9  |> |A1 8F6C2A02 MOV EAX,DWORD PTR DS:[22A6C8F]

Windows, item 49
Handle=NIK00212A48
Title=Tab1
Parent=00212A64
ID=000003E8 (1000.)
Style=54000200 WS_CHILD|WS_CLIPSIBLINGS|WS_VISIBLE|200
ExtStyle=00000004 WS_EX_NOPARENTNOTIFY
Thread=Main
ClsProc=FFFF130D
Class=SysTabControl32

0012FCD8 00212A48  |Arg1 = 00212A48 ASCII "4444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444"...
0012FCDC 00001331  |Arg2 = 00001331
0012FCE0 00000000  |Arg3 = 00000000
0012FCE4 0000001E  \Arg4 = 0000001E

///////////////////////////////////////////////////////////////////////////
1002ED64  /$  E8 F877FEFF CALL PYCQ.10016561
1002ED69  |.  6A 00       PUSH 0                                              ; /Arg2 = 00000000
1002ED6B  |.  6A 00       PUSH 0                                              ; |Arg1 = 00000000
1002ED6D  |.  E8 7ECEFDFF CALL PYCQ.1000BBF0                                  ; \PYCQ.1000BBF0

xor
10016561  /$  56          PUSH ESI
10016562  |.  57          PUSH EDI
10016563  |.  53          PUSH EBX
10016564  |.  8D35 17D20310 LEA ESI,DWORD PTR DS:[1003D217]
1001656A  |.  8D3D 43680410 LEA EDI,DWORD PTR DS:[10046843]
10016570  |.  B9 07000000 MOV ECX,7
10016575  |.  8B5E 1C    MOV EBX,DWORD PTR DS:[ESI+1C]
10016578  |>  8B06       /MOV EAX,DWORD PTR DS:[ESI]
1001657A  |.  33C3       |XOR EAX,EBX
1001657C  |.  8907       |MOV DWORD PTR DS:[EDI],EAX
1001657E  |.  49          |DEC ECX
1001657F  |.  83C6 04    |ADD ESI,4
10016582  |.  83C7 04    |ADD EDI,4
10016585  |.  0BC9       |OR ECX,ECX
10016587  |.^ 75 EF       \JNZ SHORT PYCQ.10016578
10016589  |.  5B          POP EBX
1001658A  |.  5F          POP EDI
1001658B  |.  5E          POP ESI
1001658C  \.  C3          RETN

1000C41A .  E8 26A30000 CALL PYCQ.10016745
1000C41F .  E8 40290200 CALL PYCQ.1002ED64

1003C7E6 > \3D 10010000 CMP EAX,110
1003C7EB .  75 0A       JNZ SHORT PYCQ.1003C7F7
1003C7ED .  FF75 08    PUSH DWORD PTR SS:[EBP+8]
1003C7F0 .  E8 6BFBFCFF CALL PYCQ.1000C360

1003B370 .  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; /lParam
1003B373 .  68 C7CC0110 PUSH PYCQ.1001CCC7                      ; |pDlgProc = PYCQ.1001CCC7
1003B378 .  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hOwner
1003B37B .  68 51040000 PUSH 451                               ; |pTemplate = 451
1003B380 .  FF35 24D00310 PUSH DWORD PTR DS:[1003D024]          ; |hInst = NULL
1003B386 .  FF15 D4E10310 CALL DWORD PTR DS:[<&user32.CreateDialog>; \CreateDialogParamA

1000118F .  6A 00       PUSH 0                                  ; /lParam = 0
10001191 .  6A 01       PUSH 1                                  ; |wParam = 1
10001193 .  68 01050000 PUSH 501                               ; |Message = MSG(501)
10001198 .  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
1000119B .  FF15 54E10310 CALL DWORD PTR DS:[<&user32.PostMessageA>; \PostMessageA

1002E582 > \3D 01050000 CMP EAX,501
1002E587 .  0F85 51010000 JNZ PYCQ.1002E6DE
1002E58D .  803D 23F00310>CMP BYTE PTR DS:[1003F023],0
1002E594 .  0F84 44010000 JE PYCQ.1002E6DE
1002E59A .  837D 10 00 CMP DWORD PTR SS:[EBP+10],0
1002E59E .  0F85 D5000000 JNZ PYCQ.1002E679
1002E5A4 .  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; /hWnd
1002E5A7 .  FF15 8CE10310 CALL DWORD PTR DS:[<&user32.GetWindowTex>; \GetWindowTextLengthA
1002E5AD .  0BC0       OR EAX,EAX
1002E5AF .  75 4C       JNZ SHORT PYCQ.1002E5FD
1002E5B1 .  803D CDF10310>CMP BYTE PTR DS:[1003F1CD],0
1002E5B8 .  75 43       JNZ SHORT PYCQ.1002E5FD
1002E5BA .  FF15 CCE00310 CALL DWORD PTR DS:[<&kernel32.GetTickCou>; [GetTickCount
1002E5C0 .  2B05 17F00310 SUB EAX,DWORD PTR DS:[1003F017]
1002E5C6 .  3D 88130000 CMP EAX,1388
1002E5CB .  77 0D       JA SHORT PYCQ.1002E5DA
1002E5CD .  833D 17F00310>CMP DWORD PTR DS:[1003F017],0
1002E5D4 .  0F85 55050000 JNZ PYCQ.1002EB2F
1002E5DA >  FF35 ACF10310 PUSH DWORD PTR DS:[1003F1AC]          ; /Arg3 = 00000000
1002E5E0 .  68 02050000 PUSH 502                               ; |Arg2 = 00000502
1002E5E5 .  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |Arg1
1002E5E8 .  E8 132AFDFF CALL PYCQ.10001000                      ; \PYCQ.10001000
1002E5ED .  FF15 CCE00310 CALL DWORD PTR DS:[<&kernel32.GetTickCou>; [GetTickCount
1002E5F3 .  A3 17F00310 MOV DWORD PTR DS:[1003F017],EAX
1002E5F8 .  E9 32050000 JMP PYCQ.1002EB2F
1002E5FD >  0BC0       OR EAX,EAX
1002E5FF .  0F84 2A050000 JE PYCQ.1002EB2F
1002E605 .  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; /hWnd
1002E608 .  FF15 74E10310 CALL DWORD PTR DS:[<&user32.IsWindowVisi>; \IsWindowVisible
1002E60E .  83F8 01    CMP EAX,1
1002E611 .  75 26       JNZ SHORT PYCQ.1002E639
1002E613 .  68 87000000 PUSH 87                               ; /Flags = SWP_NOSIZE|SWP_NOMOVE|SWP_NOZORDER|SWP_HIDEWINDOW
1002E618 .  6A 00       PUSH 0                                  ; |Height = 0
1002E61A .  6A 00       PUSH 0                                  ; |Width = 0
1002E61C .  6A 00       PUSH 0                                  ; |Y = 0
1002E61E .  6A 00       PUSH 0                                  ; |X = 0
1002E620 .  6A 00       PUSH 0                                  ; |InsertAfter = HWND_TOP
1002E622 .  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
1002E625 .  FF15 2CE10310 CALL DWORD PTR DS:[<&user32.SetWindowPos>; \SetWindowPos
1002E62B .  FF35 44D00310 PUSH DWORD PTR DS:[1003D044]          ; /hWnd = NULL
1002E631 .  FF15 40E10310 CALL DWORD PTR DS:[<&user32.SetActiveWin>; \SetActiveWindow
1002E637 .  EB 3B       JMP SHORT PYCQ.1002E674
1002E639 >  6A 00       PUSH 0
1002E63B .  6A 00       PUSH 0
1002E63D .  68 0B130000 PUSH 130B
1002E642 .  68 E8030000 PUSH 3E8
1002E647 .  FF75 08    PUSH DWORD PTR SS:[EBP+8]
1002E64A .  E8 BEAAFDFF CALL PYCQ.1000910D
1002E64F .  83F8 03    CMP EAX,3
1002E652 .  75 0B       JNZ SHORT PYCQ.1002E65F
1002E654 .  FF35 86F00310 PUSH DWORD PTR DS:[1003F086]
1002E65A .  E8 1BEBFDFF CALL PYCQ.1000D17A
1002E65F >  6A 47       PUSH 47                               ; /Flags = SWP_NOSIZE|SWP_NOMOVE|SWP_NOZORDER|SWP_SHOWWINDOW
1002E661 .  6A 00       PUSH 0                                  ; |Height = 0
1002E663 .  6A 00       PUSH 0                                  ; |Width = 0
1002E665 .  6A 00       PUSH 0                                  ; |Y = 0
1002E667 .  6A 00       PUSH 0                                  ; |X = 0
1002E669 .  6A 00       PUSH 0                                  ; |InsertAfter = HWND_TOP
1002E66B .  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
1002E66E .  FF15 2CE10310 CALL DWORD PTR DS:[<&user32.SetWindowPos>; \SetWindowPos
1002E674 >  E9 B6040000 JMP PYCQ.1002EB2F
1002E679 >  803D CDF10310>CMP BYTE PTR DS:[1003F1CD],0
1002E680 .  0F84 A9040000 JE PYCQ.1002EB2F
1002E686 .  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; /hWnd
1002E689 .  FF15 8CE10310 CALL DWORD PTR DS:[<&user32.GetWindowTex>; \GetWindowTextLengthA
1002E68F .  0BC0       OR EAX,EAX
1002E691 .  75 46       JNZ SHORT PYCQ.1002E6D9
1002E693 .  803D CFF10310>CMP BYTE PTR DS:[1003F1CF],0
1002E69A .  75 08       JNZ SHORT PYCQ.1002E6A4
1002E69C .  8D05 BD6B0310 LEA EAX,DWORD PTR DS:[10036BBD]
1002E6A2 .  EB 06       JMP SHORT PYCQ.1002E6AA
1002E6A4 >  8D05 DD6B0310 LEA EAX,DWORD PTR DS:[10036BDD]
1002E6AA >  50          PUSH EAX                               ; /Text
1002E6AB .  FF75 08    PUSH DWORD PTR SS:[EBP+8]             ; |hWnd
1002E6AE .  FF15 20E10310 CALL DWORD PTR DS:[<&user32.SetWindowTex>; \SetWindowTextA
1002E6B4 .  837D 14 00 CMP DWORD PTR SS:[EBP+14],0
1002E6B8 .  75 08       JNZ SHORT PYCQ.1002E6C2
1002E6BA .  FF75 08    PUSH DWORD PTR SS:[EBP+8]
1002E6BD .  E8 7B040000 CALL PYCQ.1002EB3D
1002E6C2 >  803D 01F00310>CMP BYTE PTR DS:[1003F001],0
1002E6C9 .  75 02       JNZ SHORT PYCQ.1002E6CD
1002E6CB .  EB 0C       JMP SHORT PYCQ.1002E6D9
1002E6CD >  FF35 44D00310 PUSH DWORD PTR DS:[1003D044]          ; /hWnd = NULL
1002E6D3 .  FF15 40E10310 CALL DWORD PTR DS:[<&user32.SetActiveWin>; \SetActiveWindow
1002E6D9 >  E9 51040000 JMP PYCQ.1002EB2F

Names in PYCQ, item 78
Address=1003E0B0
Section=.edata
Type=Import  (Known)
Name=kernel32.MapViewOfFile

CALL DWORD PTR DS:[1003D0B0]

1000D1BE  |.  B8 DC424A00    MOV EAX,4A42DC
1000D1C3  |.  8B00          MOV EAX,DWORD PTR DS:[EAX]
1000D1C5  |.  8B00          MOV EAX,DWORD PTR DS:[EAX]
1000D1C7  |.  8B80 90AE0200 MOV EAX,DWORD PTR DS:[EAX+2AE90]
1000D1CD  |.  8138 44343031 CMP DWORD PTR DS:[EAX],31303444
1000D1D3  |.  74 05          JE SHORT PYCQ.1000D1DA

10009021  /$  55          PUSH EBP
10009022  |.  8BEC       MOV EBP,ESP
10009024  |.  8B45 08    MOV EAX,DWORD PTR SS:[EBP+8]
10009027  |.  3B05 7AF00310 CMP EAX,DWORD PTR DS:[1003F07A]
1000902D  |.  75 0A       JNZ SHORT PYCQ.10009039

01334AE0  |.  8F05 00D03501    POP DWORD PTR DS:[135D000]

100143D7  |.  8F05 00C00310       POP DWORD PTR DS:[1003C000]

1000BC06 > /833D 76E00310 00    CMP DWORD PTR DS:[1003E076],0

1000BC6B .  50          PUSH EAX                               ; /lParam
1000BC6C .  FF35 48C00310 PUSH DWORD PTR DS:[1003C048]          ; |wParam = 0
1000BC72 .  6A 4A       PUSH 4A                               ; |Message = WM_COPYDATA
1000BC74 .  FF35 00C00310 PUSH DWORD PTR DS:[1003C000]          ; |hWnd = NULL
1000BC7A .  FF15 3CD10310 CALL DWORD PTR DS:[<&user32.SendMessageA>; \SendMessageA

1000BC6C .  FF35 48C00310    PUSH DWORD PTR DS:[1003C048]          ; |wParam = 0

0012F998 000D0156 |hWnd = D0156
0012F99C 0000004A |Message = WM_COPYDATA
0012F9A0 0006073A |hWnd = 0006073A ('BY辅助工具(www.bywg.com)v',class='#32770',parent=000606BE)
0012F9A4 0012F9A8 \pCopyData = 0012F9A8
0012F9A8 00000004
0012F9AC 00000008
0012F9B0 0012F9B4
0012F9B4 0006073A
0012F9B8 02280000 PYCQ.02280000
0012F9BC 0012FB2C
0012F9C0 00000000
0012F9C4 0000029E
0012F9C8 0006073A
0012F9CC 00000081

Names in PYCQ, item 260
Address=0042A518
Type=Import  (Known)
Name=user32.PostMessageA

CALL DWORD PTR DS:[42A518]

Names in PYCQ, item 301
Address=0042A53C
Type=Import  (Known)
Name=user32.SendMessageA

CALL DWORD PTR DS:[42A53C]

00403AD8 .  8B0D EC604300 MOV ECX,DWORD PTR DS:[4360EC]
00403ADE .  891D B0AB4300 MOV DWORD PTR DS:[43ABB0],EBX
00403AE4 .  3BC1       CMP EAX,ECX
00403AE6 .  75 4F       JNZ SHORT PYCQ.00403B37

ECX=66FD2D29
EAX=2E9FE203

以上便宜外挂

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

收藏・0

免费・0

支持

最新回复 (19)
pendan2001 雪币： 61 活跃值： (160) 能力值： ( LV9，RANK：170 ) 在线值：发帖 25 回帖 1180 粉丝 0 关注私信	pendan2001 4 2 楼？？？？？？？？？？？？？ 2005-11-5 01:07 0
采臣·宁雪币： 154 活跃值： (216) 能力值： ( LV4，RANK：50 ) 在线值：发帖 33 回帖 1343 粉丝 6 关注私信	采臣·宁 1 3 楼看不懂，没注释外挂应该是强贴，我顶 2005-11-5 11:12 0
shoooo 雪币： 398 活跃值： (343) 能力值： (RANK：650 ) 在线值：发帖 91 回帖 2169 粉丝 5 关注私信	shoooo 16 4 楼便宜 2005-11-5 11:16 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 5 楼对了是BY 2005-11-6 21:09 0
闪电狼雪币： 108 活跃值： (42) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 709 粉丝 0 关注私信	闪电狼 6 楼高人连注释都没 2005-11-6 22:22 0
萧洒雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 15 粉丝 0 关注私信	萧洒 7 楼高手，佩服佩服~~~~~ 2005-11-7 01:12 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 8 楼版主怎么不弄个精~~~~~ 算了~~~~~这些个虚拟的东西无所谓大家欣赏下 OK 2005-11-7 16:49 0
Phoenix 雪币： 153 活跃值： (17) 能力值： ( LV2，RANK：10 ) 在线值：发帖 14 回帖 413 粉丝 1 关注私信	Phoenix 9 楼最初由完美发布版主怎么不弄个精~~~~~ 算了~~~~~这些个虚拟的东西无所谓大家欣赏下 OK 2005-11-7 17:47 0
kanxue 雪币： 44229 活跃值： (19955) 能力值： (RANK：350 ) 在线值：发帖 2369 回帖 17027 粉丝 528 关注私信	kanxue 8 10 楼最初由完美发布版主怎么不弄个精~~~~~ 算了~~~~~这些个虚拟的东西无所谓大家欣赏下 OK 加点注释再说，目前这样的文章很难看懂。 2005-11-7 18:00 0
window 雪币： 111 活跃值： (55) 能力值： ( LV4，RANK：50 ) 在线值：发帖 1 回帖 168 粉丝 0 关注私信	window 1 11 楼这文章能说明什么问题? 2005-11-7 23:26 0
xuruifengc 雪币： 213 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 106 粉丝 0 关注私信	xuruifengc 12 楼最初由 window 发布这文章能说明什么问题? 似乎很眼熟的,在哪见过... 2005-11-8 12:28 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 13 楼下次再弄吧~~~ 弄传神的外带注释目前没时间弄要上班 2005-11-8 14:49 0
zhutiehan 雪币： 201 活跃值： (13) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 12 粉丝 0 关注私信	zhutiehan 14 楼不会是YOCK吧？他一直在搞BY外挂。。。 2005-11-10 10:51 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 15 楼过几天发布新便宜外挂官方服务端原代码程序希望新便宜外挂的工作人员不要太激动呵呵 2005-11-10 13:02 0
loveboom 雪币： 513 活跃值： (2258) 能力值： ( LV9，RANK：2130 ) 在线值：发帖 100 回帖 687 粉丝 10 关注私信	loveboom 53 16 楼别有心意吧，一没注释，二没说明，三没头没尾。四主题不正(好像没有讨论什么). 我看的总结就像是随手笔记，流水帐。 2005-11-10 13:32 0
gzgzlxg 雪币： 238 活跃值： (326) 能力值： ( LV12，RANK：450 ) 在线值：发帖 12 回帖 346 粉丝 7 关注私信	gzgzlxg 11 17 楼完美应该改名为不完美，这样的东西写给谁看，不明白楼主的用意。 2005-11-10 18:14 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 18 楼既然有这么多喜欢弄外挂的怎么就没见什么人去弄希望开个专门弄外挂的区好让我发泄下 2005-11-10 21:34 0
我爱我家雪币： 225 活跃值： (52) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 88 粉丝 1 关注私信	我爱我家 19 楼没头有尾，便宜外挂都可以自己做个SER端自己验证自己的。 2005-11-10 21:38 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 20 楼看样子你对BY 的理解还不够深 BY的对自己验证尤其是在游戏中暗槽比较多~~~~比如跨大地图小退等等你到解决暗槽了就会慢慢的理解一部分了 2005-11-10 21:40 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

完美

发帖

186

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (19)
pendan2001 雪币： 61 活跃值： (160) 能力值： ( LV9，RANK：170 ) 在线值：发帖 25 回帖 1180 粉丝 0 关注私信	pendan2001 4 2 楼？？？？？？？？？？？？？ 2005-11-5 01:07 0
采臣·宁雪币： 154 活跃值： (216) 能力值： ( LV4，RANK：50 ) 在线值：发帖 33 回帖 1343 粉丝 6 关注私信	采臣·宁 1 3 楼看不懂，没注释外挂应该是强贴，我顶 2005-11-5 11:12 0
shoooo 雪币： 398 活跃值： (343) 能力值： (RANK：650 ) 在线值：发帖 91 回帖 2169 粉丝 5 关注私信	shoooo 16 4 楼便宜 2005-11-5 11:16 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 5 楼对了是BY 2005-11-6 21:09 0
闪电狼雪币： 108 活跃值： (42) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 709 粉丝 0 关注私信	闪电狼 6 楼高人连注释都没 2005-11-6 22:22 0
萧洒雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 15 粉丝 0 关注私信	萧洒 7 楼高手，佩服佩服~~~~~ 2005-11-7 01:12 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 8 楼版主怎么不弄个精~~~~~ 算了~~~~~这些个虚拟的东西无所谓大家欣赏下 OK 2005-11-7 16:49 0
Phoenix 雪币： 153 活跃值： (17) 能力值： ( LV2，RANK：10 ) 在线值：发帖 14 回帖 413 粉丝 1 关注私信	Phoenix 9 楼最初由完美发布版主怎么不弄个精~~~~~ 算了~~~~~这些个虚拟的东西无所谓大家欣赏下 OK 2005-11-7 17:47 0
kanxue 雪币： 44229 活跃值： (19955) 能力值： (RANK：350 ) 在线值：发帖 2369 回帖 17027 粉丝 528 关注私信	kanxue 8 10 楼最初由完美发布版主怎么不弄个精~~~~~ 算了~~~~~这些个虚拟的东西无所谓大家欣赏下 OK 加点注释再说，目前这样的文章很难看懂。 2005-11-7 18:00 0
window 雪币： 111 活跃值： (55) 能力值： ( LV4，RANK：50 ) 在线值：发帖 1 回帖 168 粉丝 0 关注私信	window 1 11 楼这文章能说明什么问题? 2005-11-7 23:26 0
xuruifengc 雪币： 213 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 106 粉丝 0 关注私信	xuruifengc 12 楼最初由 window 发布这文章能说明什么问题? 似乎很眼熟的,在哪见过... 2005-11-8 12:28 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 13 楼下次再弄吧~~~ 弄传神的外带注释目前没时间弄要上班 2005-11-8 14:49 0
zhutiehan 雪币： 201 活跃值： (13) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 12 粉丝 0 关注私信	zhutiehan 14 楼不会是YOCK吧？他一直在搞BY外挂。。。 2005-11-10 10:51 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 15 楼过几天发布新便宜外挂官方服务端原代码程序希望新便宜外挂的工作人员不要太激动呵呵 2005-11-10 13:02 0
loveboom 雪币： 513 活跃值： (2258) 能力值： ( LV9，RANK：2130 ) 在线值：发帖 100 回帖 687 粉丝 10 关注私信	loveboom 53 16 楼别有心意吧，一没注释，二没说明，三没头没尾。四主题不正(好像没有讨论什么). 我看的总结就像是随手笔记，流水帐。 2005-11-10 13:32 0
gzgzlxg 雪币： 238 活跃值： (326) 能力值： ( LV12，RANK：450 ) 在线值：发帖 12 回帖 346 粉丝 7 关注私信	gzgzlxg 11 17 楼完美应该改名为不完美，这样的东西写给谁看，不明白楼主的用意。 2005-11-10 18:14 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 18 楼既然有这么多喜欢弄外挂的怎么就没见什么人去弄希望开个专门弄外挂的区好让我发泄下 2005-11-10 21:34 0
我爱我家雪币： 225 活跃值： (52) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 88 粉丝 1 关注私信	我爱我家 19 楼没头有尾，便宜外挂都可以自己做个SER端自己验证自己的。 2005-11-10 21:38 0
完美雪币： 208 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 18 回帖 186 粉丝 0 关注私信	完美 1 20 楼看样子你对BY 的理解还不够深 BY的对自己验证尤其是在游戏中暗槽比较多~~~~比如跨大地图小退等等你到解决暗槽了就会慢慢的理解一部分了 2005-11-10 21:40 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复