-
-
快速脱EXEStealth + ACProtect篇[原创]
-
发表于: 2005-11-6 05:01 5766
-
软件名称: 应急日语 1.0
软件语言: 简体中文
界面预览:
软件类型: 国产软件 / 外语学习
运行环境: Win9x/NT/2000/XP
授权方式: 共享版
软件大小: 15.23 MB
http://www.pc286.com/SoftView/SoftView_15715.html
应急日语 是一款集日语口语、日语背单词综合日语学习软件。精选了交际用语、日常用语、心情表达、
日语语法句式等四大类共900多句常用日语对话内容以及600多个常用单词的全部内容并以全部真人发音,
运用先进的语音朗读技术,富于娱乐性;使您在使用电脑进行工作、学习或娱乐的同时,就能不知不觉、
轻轻松松地掌握各类日常日语会话及常用日语单词。该方式既摆脱了枯燥的传统学习方法,又充分利用了
在电脑前的各种冗余和等待时间,有效地提高了学习效率,在不知不觉中轻轻松松、迅速提高日语的听力、
口语水平。
加壳方式:EXEStealth 2.72 - 2.73 + ACProtect
忽略所有异常,OD载入
00A29060 > /EB 00 jmp short CJapanes.00A29062//进入OD后停在这!
00A29062 \EB 2F jmp short CJapanes.00A29093
bp Process32First
009A384C 52 push edx
009A384D 50 push eax
009A384E FF95 C3664000 call dword ptr ss:[ebp+4066C3>
009A3854 0BC0 or eax,eax
009A3856 /0F84 FE000000 je CJapanes.009A395A //改为JMP 009A395A
009A385C |8DB5 23644000 lea esi,dword ptr ss:[ebp+406>
009A3862 |8BFE mov edi,esi
009A3864 |8A07 mov al,byte ptr ds:[edi]
009A3866 |0AC0 or al,al
009A3868 |74 12 je short CJapanes.009A387C
009A386A |90 nop
009A386B |90 nop
009A386C |90 nop
009A386D |90 nop
009A386E |3C 5C cmp al,5C
009A3870 |75 07 jnz short CJapanes.009A3879
009A3872 |90 nop
009A3873 |90 nop
009A3874 |90 nop
009A3875 |90 nop
009A3876 |8BF7 mov esi,edi
009A3878 |46 inc esi
009A3879 |47 inc edi
009A387A ^|EB E8 jmp short CJapanes.009A3864
009A387C |8BC6 mov eax,esi
009A387E |BF 167A4000 mov edi,CJapanes.00407A16
009A3883 |03FD add edi,ebp
009A3885 |8B17 mov edx,dword ptr ds:[edi]
009A3887 |66:0BD2 or dx,dx
009A388A |74 22 je short CJapanes.009A38AE
009A388C |90 nop
009A388D |90 nop
009A388E |90 nop
009A388F |90 nop
009A3890 |0AD2 or dl,dl
009A3892 |74 07 je short CJapanes.009A389B
009A3894 |90 nop
009A3895 |90 nop
009A3896 |90 nop
009A3897 |90 nop
009A3898 |47 inc edi
009A3899 ^|EB EA jmp short CJapanes.009A3885
009A389B |47 inc edi
009A389C |8BF0 mov esi,eax
009A389E |E8 29F1FFFF call CJapanes.009A29CC
009A38A3 |80FE 01 cmp dh,1
009A38A6 |74 1C je short CJapanes.009A38C4
009A38A8 |90 nop
009A38A9 |90 nop
009A38AA |90 nop
009A38AB |90 nop
009A38AC ^|EB D7 jmp short CJapanes.009A3885
009A38AE |B8 FF634000 mov eax,CJapanes.004063FF
009A38B3 |03C5 add eax,ebp
009A38B5 |50 push eax
009A38B6 |FFB5 FB634000 push dword ptr ss:[ebp+4063FB>
009A38BC |FF95 C7664000 call dword ptr ss:[ebp+4066C7>
009A38C2 ^|EB 90 jmp short CJapanes.009A3854
009A38C4 |60 pushad
009A38C5 |E8 D6EAFFFF call CJapanes.009A23A0
009A38CA |8DBD 58CD4000 lea edi,dword ptr ss:[ebp+40C>
009A38D0 |B8 05000000 mov eax,5
009A38D5 |E8 50E8FFFF call CJapanes.009A212A
009A38DA |0BC0 or eax,eax
009A38DC |74 28 je short CJapanes.009A3906
009A38DE |90 nop
009A38DF |90 nop
009A38E0 |90 nop
009A38E1 |90 nop
009A38E2 |48 dec eax
009A38E3 |0BC0 or eax,eax
009A38E5 |74 2A je short CJapanes.009A3911
009A38E7 |90 nop
009A38E8 |90 nop
009A38E9 |90 nop
009A38EA |90 nop
009A38EB |48 dec eax
009A38EC |0BC0 or eax,eax
009A38EE |74 2C je short CJapanes.009A391C
009A38F0 |90 nop
009A38F1 |90 nop
009A38F2 |90 nop
009A38F3 |90 nop
009A38F4 |48 dec eax
009A38F5 |0BC0 or eax,eax
009A38F7 |74 2E je short CJapanes.009A3927
009A38F9 |90 nop
009A38FA |90 nop
009A38FB |90 nop
009A38FC |90 nop
009A38FD |48 dec eax
009A38FE |0BC0 or eax,eax
009A3900 |74 30 je short CJapanes.009A3932
009A3902 |90 nop
009A3903 |90 nop
009A3904 |90 nop
009A3905 |90 nop
009A3906 |8DBD 0C914100 lea edi,dword ptr ss:[ebp+419>
009A390C |EB 2A jmp short CJapanes.009A3938
009A390E |90 nop
009A390F |90 nop
009A3910 |90 nop
009A3911 |8DBD A2A94000 lea edi,dword ptr ss:[ebp+40A>
009A3917 |EB 1F jmp short CJapanes.009A3938
009A3919 |90 nop
009A391A |90 nop
009A391B |90 nop
009A391C |8DBD 8D674000 lea edi,dword ptr ss:[ebp+406>
009A3922 |EB 14 jmp short CJapanes.009A3938
009A3924 |90 nop
009A3925 |90 nop
009A3926 |90 nop
009A3927 |8DBD 63A24000 lea edi,dword ptr ss:[ebp+40A>
009A392D |EB 09 jmp short CJapanes.009A3938
009A392F |90 nop
009A3930 |90 nop
009A3931 |90 nop
009A3932 |8DBD 3AC84000 lea edi,dword ptr ss:[ebp+40C>
009A3938 |B8 00010000 mov eax,100
009A393D |E8 E8E7FFFF call CJapanes.009A212A
009A3942 |8BC8 mov ecx,eax
009A3944 |41 inc ecx
009A3945 |B8 00010000 mov eax,100
009A394A |E8 DBE7FFFF call CJapanes.009A212A
009A394F |03F8 add edi,eax
009A3951 |E8 E8E7FFFF call CJapanes.009A213E
009A3956 |AB stos dword ptr es:[edi] //这里让你死翘翘!
009A3957 ^|E2 F8 loopd short CJapanes.009A3951
009A3959 |61 popad
009A395A \FFB5 FB634000 push dword ptr ss:[ebp+4063FB>
009A3960 FF95 CB664000 call dword ptr ss:[ebp+4066CB>
009A3966 60 pushad
009A3967 E8 00000000 call CJapanes.009A396C
009A396C 5E pop esi
009A396D 83EE 06 sub esi,6
009A3970 B9 40010000 mov ecx,140
009A3975 29CE sub esi,ecx
009A3977 BA 45C57664 mov edx,6476C545
009A397C C1E9 02 shr ecx,2
009A397F 83E9 02 sub ecx,2
009A3982 83F9 00 cmp ecx,0
009A3985 7C 1A jl short CJapanes.009A39A1
bp GetProcAddress
0083F055 8985 4D050000 mov dword ptr ss:[ebp+54D],ea>; kernel32.VirtualAlloc
0083F05B 8D5D 6B lea ebx,dword ptr ss:[ebp+6B]
0083F05E 53 push ebx
0083F05F 57 push edi
0083F060 FF95 490F0000 call dword ptr ss:[ebp+F49]
0083F066 8985 51050000 mov dword ptr ss:[ebp+551],ea>
0083F06C 8D45 77 lea eax,dword ptr ss:[ebp+77]
0083F06F /FFE0 jmp eax ; CJapanes.0083F08A
0083F08A 8B9D 31050000 mov ebx,dword ptr ss:[ebp+531>
0083F090 0BDB or ebx,ebx
0083F092 74 0A je short CJapanes.0083F09E
0083F09E 8DB5 69050000 lea esi,dword ptr ss:[ebp+569>
0083F0A4 833E 00 cmp dword ptr ds:[esi],0
0083F0A7 0F84 21010000 je CJapanes.0083F1CE
0083F0AD 6A 04 push 4
0083F0AF 68 00100000 push 1000
0083F0B4 68 00180000 push 1800
0083F0B9 6A 00 push 0
0083F0BB FF95 4D050000 call dword ptr ss:[ebp+54D]
0083F0C1 8985 56010000 mov dword ptr ss:[ebp+156],ea>
0083F0C7 8B46 04 mov eax,dword ptr ds:[esi+4]
0083F0CA 05 0E010000 add eax,10E
0083F0CF 6A 04 push 4
0083F0D1 68 00100000 push 1000
0083F0D6 50 push eax
0083F0D7 6A 00 push 0
0083F0D9 FF95 4D050000 call dword ptr ss:[ebp+54D]
0083F0DF 8985 52010000 mov dword ptr ss:[ebp+152],ea>
0083F0E5 56 push esi
0083F0E6 8B1E mov ebx,dword ptr ds:[esi]
0083F0E8 039D 22040000 add ebx,dword ptr ss:[ebp+422>
0083F0EE FFB5 56010000 push dword ptr ss:[ebp+156]
0083F0F4 FF76 04 push dword ptr ds:[esi+4]
0083F0F7 50 push eax
0083F0F8 53 push ebx
0083F0F9 E8 6E050000 call CJapanes.0083F66C
0083F0FE B3 01 mov bl,1
0083F100 80FB 00 cmp bl,0
0083F103 75 5E jnz short CJapanes.0083F163
0083F105 FE85 EC000000 inc byte ptr ss:[ebp+EC]
0083F10B 8B3E mov edi,dword ptr ds:[esi]
0083F10D 03BD 22040000 add edi,dword ptr ss:[ebp+422>
0083F113 FF37 push dword ptr ds:[edi]
0083F115 C607 C3 mov byte ptr ds:[edi],0C3
0083F118 FFD7 call edi
0083F11A 8F07 pop dword ptr ds:[edi]
0083F11C 50 push eax
0083F11D 51 push ecx
0083F11E 56 push esi
0083F11F 53 push ebx
0083F120 8BC8 mov ecx,eax
0083F122 83E9 06 sub ecx,6
0083F125 8BB5 52010000 mov esi,dword ptr ss:[ebp+152>
0083F12B 33DB xor ebx,ebx
0083F12D 0BC9 or ecx,ecx
0083F12F 74 2E je short CJapanes.0083F15F
0083F131 78 2C js short CJapanes.0083F15F
0083F133 AC lods byte ptr ds:[esi]
0083F134 3C E8 cmp al,0E8
0083F136 74 0A je short CJapanes.0083F142
0083F138 EB 00 jmp short CJapanes.0083F13A
0083F13A 3C E9 cmp al,0E9
0083F13C 74 04 je short CJapanes.0083F142
0083F13E 43 inc ebx
0083F13F 49 dec ecx
0083F140 ^ EB EB jmp short CJapanes.0083F12D
0083F142 8B06 mov eax,dword ptr ds:[esi]
0083F144 EB 0A jmp short CJapanes.0083F150
0083F146 803E 00 cmp byte ptr ds:[esi],0
0083F149 ^ 75 F3 jnz short CJapanes.0083F13E
0083F14B 24 00 and al,0
0083F14D C1C0 18 rol eax,18
0083F150 2BC3 sub eax,ebx
0083F152 8906 mov dword ptr ds:[esi],eax
0083F154 83C3 05 add ebx,5
0083F157 83C6 04 add esi,4
0083F15A 83E9 05 sub ecx,5
0083F15D ^ EB CE jmp short CJapanes.0083F12D
0083F15F 5B pop ebx
0083F160 5E pop esi
0083F161 59 pop ecx
0083F162 58 pop eax
0083F163 EB 08 jmp short CJapanes.0083F16D
0083F165 0000 add byte ptr ds:[eax],al
0083F167 8201 00 add byte ptr ds:[ecx],0
0083F16A 0081 018BC88B add byte ptr ds:[ecx+8BC88B01>
0083F170 3E:03BD 2204000>add edi,dword ptr ds:[ebp+422>
0083F177 8BB5 52010000 mov esi,dword ptr ss:[ebp+152>
0083F17D C1F9 02 sar ecx,2
0083F180 F3:A5 rep movs dword ptr es:[edi],d>
0083F182 8BC8 mov ecx,eax
0083F184 83E1 03 and ecx,3
0083F187 F3:A4 rep movs byte ptr es:[edi],by>
0083F189 5E pop esi
0083F18A 68 00800000 push 8000
0083F18F 6A 00 push 0
0083F191 FFB5 52010000 push dword ptr ss:[ebp+152]
0083F197 FF95 51050000 call dword ptr ss:[ebp+551]
0083F19D 83C6 08 add esi,8
0083F1A0 833E 00 cmp dword ptr ds:[esi],0
0083F1A3 ^ 0F85 1EFFFFFF jnz CJapanes.0083F0C7
0083F1A9 68 00800000 push 8000
0083F1AE 6A 00 push 0
0083F1B0 FFB5 56010000 push dword ptr ss:[ebp+156]
0083F1B6 FF95 51050000 call dword ptr ss:[ebp+551]
0083F1BC 8B9D 31050000 mov ebx,dword ptr ss:[ebp+531>
0083F1C2 0BDB or ebx,ebx
0083F1C4 74 08 je short CJapanes.0083F1CE
0083F1C6 8B03 mov eax,dword ptr ds:[ebx]
0083F1C8 8785 35050000 xchg dword ptr ss:[ebp+535],e>
0083F1CE 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
0083F1D4 8B85 2D050000 mov eax,dword ptr ss:[ebp+52D>
0083F1DA 2BD0 sub edx,eax
0083F1DC 74 79 je short CJapanes.0083F257
0083F1DE 8BC2 mov eax,edx
0083F1E0 C1E8 10 shr eax,10
0083F1E3 33DB xor ebx,ebx
0083F1E5 8BB5 39050000 mov esi,dword ptr ss:[ebp+539>
0083F1EB 03B5 22040000 add esi,dword ptr ss:[ebp+422>
0083F1F1 833E 00 cmp dword ptr ds:[esi],0
0083F1F4 74 61 je short CJapanes.0083F257
0083F1F6 8B4E 04 mov ecx,dword ptr ds:[esi+4]
0083F1F9 83E9 08 sub ecx,8
0083F1FC D1E9 shr ecx,1
0083F1FE 8B3E mov edi,dword ptr ds:[esi]
0083F200 03BD 22040000 add edi,dword ptr ss:[ebp+422>
0083F206 83C6 08 add esi,8
0083F209 66:8B1E mov bx,word ptr ds:[esi]
0083F20C C1EB 0C shr ebx,0C
0083F20F 83FB 01 cmp ebx,1
0083F212 74 0C je short CJapanes.0083F220
0083F214 83FB 02 cmp ebx,2
0083F217 74 16 je short CJapanes.0083F22F
0083F219 83FB 03 cmp ebx,3
0083F21C 74 20 je short CJapanes.0083F23E
0083F21E EB 2C jmp short CJapanes.0083F24C
0083F220 66:8B1E mov bx,word ptr ds:[esi]
0083F223 81E3 FF0F0000 and ebx,0FFF
0083F229 66:01041F add word ptr ds:[edi+ebx],ax
0083F22D EB 1D jmp short CJapanes.0083F24C
0083F22F 66:8B1E mov bx,word ptr ds:[esi]
0083F232 81E3 FF0F0000 and ebx,0FFF
0083F238 66:01141F add word ptr ds:[edi+ebx],dx
0083F23C EB 0E jmp short CJapanes.0083F24C
0083F23E 66:8B1E mov bx,word ptr ds:[esi]
0083F241 81E3 FF0F0000 and ebx,0FFF
0083F247 01141F add dword ptr ds:[edi+ebx],ed>
0083F24A EB 00 jmp short CJapanes.0083F24C
0083F24C 66:830E FF or word ptr ds:[esi],0FFFF
0083F250 83C6 02 add esi,2
0083F253 ^ E2 B4 loopd short CJapanes.0083F209
0083F255 ^ EB 9A jmp short CJapanes.0083F1F1
0083F257 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
0083F25D 8BB5 41050000 mov esi,dword ptr ss:[ebp+541>
0083F263 0BF6 or esi,esi
0083F265 74 11 je short CJapanes.0083F278
0083F267 03F2 add esi,edx
0083F269 AD lods dword ptr ds:[esi]
0083F26A 0BC0 or eax,eax
0083F26C 74 0A je short CJapanes.0083F278
0083F26E 03C2 add eax,edx
0083F270 8BF8 mov edi,eax
0083F272 66:AD lods word ptr ds:[esi]
0083F274 66:AB stos word ptr es:[edi]
0083F276 ^ EB F1 jmp short CJapanes.0083F269
0083F278 BE 60AD3C00 mov esi,3CAD60
0083F27D 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
0083F283 03F2 add esi,edx
0083F285 8B46 0C mov eax,dword ptr ds:[esi+C]
0083F288 85C0 test eax,eax
0083F28A 0F84 0A010000 je CJapanes.0083F39A
0083F290 03C2 add eax,edx
0083F292 8BD8 mov ebx,eax
0083F294 50 push eax
0083F295 FF95 4D0F0000 call dword ptr ss:[ebp+F4D]
0083F29B 85C0 test eax,eax
0083F29D 75 07 jnz short CJapanes.0083F2A6
0083F29F 53 push ebx
0083F2A0 FF95 510F0000 call dword ptr ss:[ebp+F51]
0083F2A6 8985 45050000 mov dword ptr ss:[ebp+545],ea>
0083F2AC C785 49050000 0>mov dword ptr ss:[ebp+549],0
0083F2B6 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
0083F2BC 8B06 mov eax,dword ptr ds:[esi]
0083F2BE 85C0 test eax,eax
0083F2C0 75 03 jnz short CJapanes.0083F2C5
0083F2C2 8B46 10 mov eax,dword ptr ds:[esi+10]
0083F2C5 03C2 add eax,edx
0083F2C7 0385 49050000 add eax,dword ptr ss:[ebp+549>
0083F2CD 8B18 mov ebx,dword ptr ds:[eax]
0083F2CF 8B7E 10 mov edi,dword ptr ds:[esi+10]
0083F2D2 03FA add edi,edx
0083F2D4 03BD 49050000 add edi,dword ptr ss:[ebp+549>
0083F2DA 85DB test ebx,ebx
0083F2DC 0F84 A2000000 je CJapanes.0083F384
0083F2E2 F7C3 00000080 test ebx,80000000
0083F2E8 75 04 jnz short CJapanes.0083F2EE
0083F2EA 03DA add ebx,edx
0083F2EC 43 inc ebx
0083F2ED 43 inc ebx
0083F2EE 53 push ebx
0083F2EF 81E3 FFFFFF7F and ebx,7FFFFFFF
0083F2F5 53 push ebx
0083F2F6 FFB5 45050000 push dword ptr ss:[ebp+545]
0083F2FC FF95 490F0000 call dword ptr ss:[ebp+F49]
0083F302 85C0 test eax,eax
0083F304 5B pop ebx
0083F305 75 6F jnz short CJapanes.0083F376
0083F307 F7C3 00000080 test ebx,80000000
0083F30D 75 19 jnz short CJapanes.0083F328
0083F30F 57 push edi
0083F310 8B46 0C mov eax,dword ptr ds:[esi+C]
0083F313 0385 22040000 add eax,dword ptr ss:[ebp+422>
0083F319 50 push eax
0083F31A 53 push ebx
0083F31B 8D85 75040000 lea eax,dword ptr ss:[ebp+475>
0083F321 50 push eax
0083F322 57 push edi
0083F323 E9 98000000 jmp CJapanes.0083F3C0
0083F328 81E3 FFFFFF7F and ebx,7FFFFFFF
0083F32E 8B85 26040000 mov eax,dword ptr ss:[ebp+426>
0083F334 3985 45050000 cmp dword ptr ss:[ebp+545],ea>
0083F33A 75 24 jnz short CJapanes.0083F360
0083F33C 57 push edi
0083F33D 8BD3 mov edx,ebx
0083F33F 4A dec edx
0083F340 C1E2 02 shl edx,2
0083F343 8B9D 45050000 mov ebx,dword ptr ss:[ebp+545>
0083F349 8B7B 3C mov edi,dword ptr ds:[ebx+3C]
0083F34C 8B7C3B 78 mov edi,dword ptr ds:[ebx+edi>
0083F350 035C3B 1C add ebx,dword ptr ds:[ebx+edi>
0083F354 8B0413 mov eax,dword ptr ds:[ebx+edx>
0083F357 0385 45050000 add eax,dword ptr ss:[ebp+545>
0083F35D 5F pop edi
0083F35E EB 16 jmp short CJapanes.0083F376
0083F360 57 push edi
0083F361 8B46 0C mov eax,dword ptr ds:[esi+C]
0083F364 0385 22040000 add eax,dword ptr ss:[ebp+422>
0083F36A 50 push eax
0083F36B 53 push ebx
0083F36C 8D85 C6040000 lea eax,dword ptr ss:[ebp+4C6>
0083F372 50 push eax
0083F373 57 push edi
0083F374 EB 4A jmp short CJapanes.0083F3C0
0083F376 8907 mov dword ptr ds:[edi],eax
0083F378 8385 49050000 0>add dword ptr ss:[ebp+549],4
0083F37F ^ E9 32FFFFFF jmp CJapanes.0083F2B6
0083F384 8906 mov dword ptr ds:[esi],eax
0083F386 8946 0C mov dword ptr ds:[esi+C],eax
0083F389 8946 10 mov dword ptr ds:[esi+10],eax
0083F38C 83C6 14 add esi,14
0083F38F 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
0083F395 ^ E9 EBFEFFFF jmp CJapanes.0083F285
0083F39A B8 F07D3C00 mov eax,3C7DF0
0083F39F 50 push eax
0083F3A0 0385 22040000 add eax,dword ptr ss:[ebp+422>
0083F3A6 59 pop ecx
0083F3A7 0BC9 or ecx,ecx
0083F3A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],ea>
0083F3AF 61 popad
0083F3B0 75 08 jnz short CJapanes.0083F3BA
0083F3B2 B8 01000000 mov eax,1
0083F3B7 C2 0C00 retn 0C
0083F3BA 68 F07D7C00 push CJapanes.007C7DF0 //F4直接来这里
0083F3BF C3 retn
返回到 007C7DF0 (CJapanes.007C7DF0)
进入第2层壳 UPX
007C7DF0 60 pushad
007C7DF1 BE 00206000 mov esi,CJapanes.00602000
007C7DF6 8DBE 00F0DFFF lea edi,dword ptr ds:[esi+FFD>
007C7DFC 57 push edi
007C7DFD 83CD FF or ebp,FFFFFFFF
007C7E00 EB 10 jmp short CJapanes.007C7E12
007C7E02 90 nop
007C7E03 90 nop
007C7E04 90 nop
007C7E05 90 nop
007C7E06 90 nop
007C7E07 90 nop
007C7E08 8A06 mov al,byte ptr ds:[esi]
007C7E0A 46 inc esi
007C7E0B 8807 mov byte ptr ds:[edi],al
007C7E0D 47 inc edi
007C7E0E 01DB add ebx,ebx
007C7E10 75 07 jnz short CJapanes.007C7E19
007C7E12 8B1E mov ebx,dword ptr ds:[esi]
007C7E14 83EE FC sub esi,-4
007C7E17 11DB adc ebx,ebx
007C7E19 ^ 72 ED jb short CJapanes.007C7E08
007C7E1B B8 01000000 mov eax,1
007C7E20 01DB add ebx,ebx
007C7E22 75 07 jnz short CJapanes.007C7E2B
007C7E24 8B1E mov ebx,dword ptr ds:[esi]
007C7E26 83EE FC sub esi,-4
007C7E29 11DB adc ebx,ebx
007C7E2B 11C0 adc eax,eax
007C7E2D 01DB add ebx,ebx
007C7E2F 73 0B jnb short CJapanes.007C7E3C
007C7E31 75 19 jnz short CJapanes.007C7E4C
007C7E33 8B1E mov ebx,dword ptr ds:[esi]
007C7E35 83EE FC sub esi,-4
007C7E38 11DB adc ebx,ebx
007C7E3A 72 10 jb short CJapanes.007C7E4C
007C7E3C 48 dec eax
007C7E3D 01DB add ebx,ebx
007C7E3F 75 07 jnz short CJapanes.007C7E48
007C7E41 8B1E mov ebx,dword ptr ds:[esi]
007C7E43 83EE FC sub esi,-4
007C7E46 11DB adc ebx,ebx
007C7E48 11C0 adc eax,eax
007C7E4A ^ EB D4 jmp short CJapanes.007C7E20
007C7E4C 31C9 xor ecx,ecx
007C7E4E 83E8 03 sub eax,3
007C7E51 72 11 jb short CJapanes.007C7E64
007C7E53 C1E0 08 shl eax,8
007C7E56 8A06 mov al,byte ptr ds:[esi]
007C7E58 46 inc esi
007C7E59 83F0 FF xor eax,FFFFFFFF
007C7E5C 74 78 je short CJapanes.007C7ED6
007C7E5E D1F8 sar eax,1
007C7E60 89C5 mov ebp,eax
007C7E62 EB 0B jmp short CJapanes.007C7E6F
007C7E64 01DB add ebx,ebx
007C7E66 75 07 jnz short CJapanes.007C7E6F
007C7E68 8B1E mov ebx,dword ptr ds:[esi]
007C7E6A 83EE FC sub esi,-4
007C7E6D 11DB adc ebx,ebx
007C7E6F 11C9 adc ecx,ecx
007C7E71 01DB add ebx,ebx
007C7E73 75 07 jnz short CJapanes.007C7E7C
007C7E75 8B1E mov ebx,dword ptr ds:[esi]
007C7E77 83EE FC sub esi,-4
007C7E7A 11DB adc ebx,ebx
007C7E7C 11C9 adc ecx,ecx
007C7E7E 75 20 jnz short CJapanes.007C7EA0
007C7E80 41 inc ecx
007C7E81 01DB add ebx,ebx
007C7E83 75 07 jnz short CJapanes.007C7E8C
007C7E85 8B1E mov ebx,dword ptr ds:[esi]
007C7E87 83EE FC sub esi,-4
007C7E8A 11DB adc ebx,ebx
007C7E8C 11C9 adc ecx,ecx
007C7E8E 01DB add ebx,ebx
007C7E90 ^ 73 EF jnb short CJapanes.007C7E81
007C7E92 75 09 jnz short CJapanes.007C7E9D
007C7E94 8B1E mov ebx,dword ptr ds:[esi]
007C7E96 83EE FC sub esi,-4
007C7E99 11DB adc ebx,ebx
007C7E9B ^ 73 E4 jnb short CJapanes.007C7E81
007C7E9D 83C1 02 add ecx,2
007C7EA0 81FD 00FBFFFF cmp ebp,-500
007C7EA6 83D1 01 adc ecx,1
007C7EA9 8D142F lea edx,dword ptr ds:[edi+ebp>
007C7EAC 83FD FC cmp ebp,-4
007C7EAF 76 0F jbe short CJapanes.007C7EC0
007C7EB1 8A02 mov al,byte ptr ds:[edx]
007C7EB3 42 inc edx
007C7EB4 8807 mov byte ptr ds:[edi],al
007C7EB6 47 inc edi
007C7EB7 49 dec ecx
007C7EB8 ^ 75 F7 jnz short CJapanes.007C7EB1
007C7EBA ^ E9 4FFFFFFF jmp CJapanes.007C7E0E
007C7EBF 90 nop
007C7EC0 8B02 mov eax,dword ptr ds:[edx]
007C7EC2 83C2 04 add edx,4
007C7EC5 8907 mov dword ptr ds:[edi],eax
007C7EC7 83C7 04 add edi,4
007C7ECA 83E9 04 sub ecx,4
007C7ECD ^ 77 F1 ja short CJapanes.007C7EC0
007C7ECF 01CF add edi,ecx
007C7ED1 ^ E9 38FFFFFF jmp CJapanes.007C7E0E
007C7ED6 5E pop esi
007C7ED7 8DBE 00503C00 lea edi,dword ptr ds:[esi+3C5>
007C7EDD 8B07 mov eax,dword ptr ds:[edi]
007C7EDF 09C0 or eax,eax
007C7EE1 74 3C je short CJapanes.007C7F1F
007C7EE3 8B5F 04 mov ebx,dword ptr ds:[edi+4]
007C7EE6 8D8430 609D3C00 lea eax,dword ptr ds:[eax+esi>
007C7EED 01F3 add ebx,esi
007C7EEF 50 push eax
007C7EF0 83C7 08 add edi,8
007C7EF3 FF96 649E3C00 call dword ptr ds:[esi+3C9E64>
007C7EF9 95 xchg eax,ebp
007C7EFA 8A07 mov al,byte ptr ds:[edi]
007C7EFC 47 inc edi
007C7EFD 08C0 or al,al
007C7EFF ^ 74 DC je short CJapanes.007C7EDD
007C7F01 89F9 mov ecx,edi
007C7F03 57 push edi
007C7F04 48 dec eax
007C7F05 F2:AE repne scas byte ptr es:[edi]
007C7F07 55 push ebp
007C7F08 FF96 689E3C00 call dword ptr ds:[esi+3C9E68>
007C7F0E 09C0 or eax,eax
007C7F10 74 07 je short CJapanes.007C7F19
007C7F12 8903 mov dword ptr ds:[ebx],eax
007C7F14 83C3 04 add ebx,4
007C7F17 ^ EB E1 jmp short CJapanes.007C7EFA
007C7F19 FF96 6C9E3C00 call dword ptr ds:[esi+3C9E6C>
007C7F1F 61 popad
007C7F20 ^ E9 DC40F1FF jmp CJapanes.006DC001 // //F4直接来这里
006DC001 60 pushad
006DC002 E8 03000000 call CJapanes.006DC00A
006DC007 - E9 EB045D45 jmp 45CAC4F7
006DC00C 55 push ebp
006DC00D C3 retn
006DC00A 5D pop ebp ; CJapanes.006DC007
006DC00B 45 inc ebp
006DC00C 55 push ebp
006DC00D C3 retn
006DC008 /EB 04 jmp short CJapanes.006DC00E
006DC00E E8 01000000 call CJapanes.006DC014
进入第3层壳
006DC014 5D pop ebp ; CJapanes.006DC013
006DC015 BB EDFFFFFF mov ebx,-13
006DC01A 03DD add ebx,ebp
006DC01C 81EB 00C02D00 sub ebx,2DC000
006DC022 83BD 22040000 0>cmp dword ptr ss:[ebp+422],0
006DC029 899D 22040000 mov dword ptr ss:[ebp+422],eb>
006DC02F 0F85 65030000 jnz CJapanes.006DC39A
006DC035 8D85 2E040000 lea eax,dword ptr ss:[ebp+42E>
006DC03B 50 push eax
006DC03C FF95 4D0F0000 call dword ptr ss:[ebp+F4D]
006DC042 8985 26040000 mov dword ptr ss:[ebp+426],ea>
006DC048 8BF8 mov edi,eax
006DC04A 8D5D 5E lea ebx,dword ptr ss:[ebp+5E]
006DC04D 53 push ebx
006DC04E 50 push eax
006DC04F FF95 490F0000 call dword ptr ss:[ebp+F49]
006DC055 8985 4D050000 mov dword ptr ss:[ebp+54D],ea>
006DC05B 8D5D 6B lea ebx,dword ptr ss:[ebp+6B]
006DC05E 53 push ebx
006DC05F 57 push edi
006DC060 FF95 490F0000 call dword ptr ss:[ebp+F49]
006DC066 8985 51050000 mov dword ptr ss:[ebp+551],ea>
006DC06C 8D45 77 lea eax,dword ptr ss:[ebp+77]
006DC06F FFE0 jmp eax
006DC071 56 push esi
006DC072 6972 74 75616C4>imul esi,dword ptr ds:[edx+74>
006DC079 6C ins byte ptr es:[edi],dx
006DC07A 6C ins byte ptr es:[edi],dx
006DC07B 6F outs dx,dword ptr es:[edi]
006DC07C 6300 arpl word ptr ds:[eax],ax
006DC07E 56 push esi
006DC07F 6972 74 75616C4>imul esi,dword ptr ds:[edx+74>
006DC086 72 65 jb short CJapanes.006DC0ED
006DC088 65:008B 9D31050>add byte ptr gs:[ebx+5319D],c>
006DC08F 000B add byte ptr ds:[ebx],cl
006DC091 DB ??? ; 未知命令
006DC092 74 0A je short CJapanes.006DC09E
006DC094 8B03 mov eax,dword ptr ds:[ebx]
006DC096 8785 35050000 xchg dword ptr ss:[ebp+535],e>
006DC09C 8903 mov dword ptr ds:[ebx],eax
006DC09E 8DB5 69050000 lea esi,dword ptr ss:[ebp+569>
006DC0A4 833E 00 cmp dword ptr ds:[esi],0
006DC0A7 0F84 21010000 je CJapanes.006DC1CE
006DC0AD 6A 04 push 4
006DC0AF 68 00100000 push 1000
006DC0B4 68 00180000 push 1800
006DC0B9 6A 00 push 0
006DC0BB FF95 4D050000 call dword ptr ss:[ebp+54D]
006DC0C1 8985 56010000 mov dword ptr ss:[ebp+156],ea>
006DC0C7 8B46 04 mov eax,dword ptr ds:[esi+4]
006DC0CA 05 0E010000 add eax,10E
006DC0CF 6A 04 push 4
006DC0D1 68 00100000 push 1000
006DC0D6 50 push eax
006DC0D7 6A 00 push 0
006DC0D9 FF95 4D050000 call dword ptr ss:[ebp+54D]
006DC0DF 8985 52010000 mov dword ptr ss:[ebp+152],ea>
006DC0E5 56 push esi
006DC0E6 8B1E mov ebx,dword ptr ds:[esi]
006DC0E8 039D 22040000 add ebx,dword ptr ss:[ebp+422>
006DC0EE FFB5 56010000 push dword ptr ss:[ebp+156]
006DC0F4 FF76 04 push dword ptr ds:[esi+4]
006DC0F7 50 push eax
006DC0F8 53 push ebx
006DC0F9 E8 6E050000 call CJapanes.006DC66C
006DC0FE B3 00 mov bl,0
006DC100 80FB 00 cmp bl,0
006DC103 75 5E jnz short CJapanes.006DC163
006DC105 FE85 EC000000 inc byte ptr ss:[ebp+EC]
006DC10B 8B3E mov edi,dword ptr ds:[esi]
006DC10D 03BD 22040000 add edi,dword ptr ss:[ebp+422>
006DC113 FF37 push dword ptr ds:[edi]
006DC115 C607 C3 mov byte ptr ds:[edi],0C3
006DC118 FFD7 call edi
006DC11A 8F07 pop dword ptr ds:[edi]
006DC11C 50 push eax
006DC11D 51 push ecx
006DC11E 56 push esi
006DC11F 53 push ebx
006DC120 8BC8 mov ecx,eax
006DC122 83E9 06 sub ecx,6
006DC125 8BB5 52010000 mov esi,dword ptr ss:[ebp+152>
006DC12B 33DB xor ebx,ebx
006DC12D 0BC9 or ecx,ecx
006DC12F 74 2E je short CJapanes.006DC15F
006DC131 78 2C js short CJapanes.006DC15F
006DC133 AC lods byte ptr ds:[esi]
006DC134 3C E8 cmp al,0E8
006DC136 74 0A je short CJapanes.006DC142
006DC138 EB 00 jmp short CJapanes.006DC13A
006DC13A 3C E9 cmp al,0E9
006DC13C 74 04 je short CJapanes.006DC142
006DC13E 43 inc ebx
006DC13F 49 dec ecx
006DC140 ^ EB EB jmp short CJapanes.006DC12D
006DC142 8B06 mov eax,dword ptr ds:[esi]
006DC144 EB 0A jmp short CJapanes.006DC150
006DC146 803E 00 cmp byte ptr ds:[esi],0
006DC149 ^ 75 F3 jnz short CJapanes.006DC13E
006DC14B 24 00 and al,0
006DC14D C1C0 18 rol eax,18
006DC150 2BC3 sub eax,ebx
006DC152 8906 mov dword ptr ds:[esi],eax
006DC154 83C3 05 add ebx,5
006DC157 83C6 04 add esi,4
006DC15A 83E9 05 sub ecx,5
006DC15D ^ EB CE jmp short CJapanes.006DC12D
006DC15F 5B pop ebx
006DC160 5E pop esi
006DC161 59 pop ecx
006DC162 58 pop eax
006DC163 EB 08 jmp short CJapanes.006DC16D
006DC165 0000 add byte ptr ds:[eax],al
006DC167 0000 add byte ptr ds:[eax],al
006DC169 0000 add byte ptr ds:[eax],al
006DC16B 0000 add byte ptr ds:[eax],al
006DC16D 8BC8 mov ecx,eax
006DC16F 8B3E mov edi,dword ptr ds:[esi]
006DC171 03BD 22040000 add edi,dword ptr ss:[ebp+422>
006DC177 8BB5 52010000 mov esi,dword ptr ss:[ebp+152>
006DC17D C1F9 02 sar ecx,2
006DC180 F3:A5 rep movs dword ptr es:[edi],d>
006DC182 8BC8 mov ecx,eax
006DC184 83E1 03 and ecx,3
006DC187 F3:A4 rep movs byte ptr es:[edi],by>
006DC189 5E pop esi
006DC18A 68 00800000 push 8000
006DC18F 6A 00 push 0
006DC191 FFB5 52010000 push dword ptr ss:[ebp+152]
006DC197 FF95 51050000 call dword ptr ss:[ebp+551]
006DC19D 83C6 08 add esi,8
006DC1A0 833E 00 cmp dword ptr ds:[esi],0
006DC1A3 ^ 0F85 1EFFFFFF jnz CJapanes.006DC0C7
006DC1A9 68 00800000 push 8000
006DC1AE 6A 00 push 0
006DC1B0 FFB5 56010000 push dword ptr ss:[ebp+156]
006DC1B6 FF95 51050000 call dword ptr ss:[ebp+551]
006DC1BC 8B9D 31050000 mov ebx,dword ptr ss:[ebp+531>
006DC1C2 0BDB or ebx,ebx
006DC1C4 74 08 je short CJapanes.006DC1CE
006DC1C6 8B03 mov eax,dword ptr ds:[ebx]
006DC1C8 8785 35050000 xchg dword ptr ss:[ebp+535],e>
006DC1CE 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
006DC1D4 8B85 2D050000 mov eax,dword ptr ss:[ebp+52D>
006DC1DA 2BD0 sub edx,eax
006DC1DC 74 79 je short CJapanes.006DC257
006DC1DE 8BC2 mov eax,edx
006DC1E0 C1E8 10 shr eax,10
006DC1E3 33DB xor ebx,ebx
006DC1E5 8BB5 39050000 mov esi,dword ptr ss:[ebp+539>
006DC1EB 03B5 22040000 add esi,dword ptr ss:[ebp+422>
006DC1F1 833E 00 cmp dword ptr ds:[esi],0
006DC1F4 74 61 je short CJapanes.006DC257
006DC1F6 8B4E 04 mov ecx,dword ptr ds:[esi+4]
006DC1F9 83E9 08 sub ecx,8
006DC1FC D1E9 shr ecx,1
006DC1FE 8B3E mov edi,dword ptr ds:[esi]
006DC200 03BD 22040000 add edi,dword ptr ss:[ebp+422>
006DC206 83C6 08 add esi,8
006DC209 66:8B1E mov bx,word ptr ds:[esi]
006DC20C C1EB 0C shr ebx,0C
006DC20F 83FB 01 cmp ebx,1
006DC212 74 0C je short CJapanes.006DC220
006DC214 83FB 02 cmp ebx,2
006DC217 74 16 je short CJapanes.006DC22F
006DC219 83FB 03 cmp ebx,3
006DC21C 74 20 je short CJapanes.006DC23E
006DC21E EB 2C jmp short CJapanes.006DC24C
006DC220 66:8B1E mov bx,word ptr ds:[esi]
006DC223 81E3 FF0F0000 and ebx,0FFF
006DC229 66:01041F add word ptr ds:[edi+ebx],ax
006DC22D EB 1D jmp short CJapanes.006DC24C
006DC22F 66:8B1E mov bx,word ptr ds:[esi]
006DC232 81E3 FF0F0000 and ebx,0FFF
006DC238 66:01141F add word ptr ds:[edi+ebx],dx
006DC23C EB 0E jmp short CJapanes.006DC24C
006DC23E 66:8B1E mov bx,word ptr ds:[esi]
006DC241 81E3 FF0F0000 and ebx,0FFF
006DC247 01141F add dword ptr ds:[edi+ebx],ed>
006DC24A EB 00 jmp short CJapanes.006DC24C
006DC24C 66:830E FF or word ptr ds:[esi],0FFFF
006DC250 83C6 02 add esi,2
006DC253 ^ E2 B4 loopd short CJapanes.006DC209
006DC255 ^ EB 9A jmp short CJapanes.006DC1F1
006DC257 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
006DC25D 8BB5 41050000 mov esi,dword ptr ss:[ebp+541>
006DC263 0BF6 or esi,esi
006DC265 74 11 je short CJapanes.006DC278
006DC267 03F2 add esi,edx
006DC269 AD lods dword ptr ds:[esi]
006DC26A 0BC0 or eax,eax
006DC26C 74 0A je short CJapanes.006DC278
006DC26E 03C2 add eax,edx
006DC270 8BF8 mov edi,eax
006DC272 66:AD lods word ptr ds:[esi]
006DC274 66:AB stos word ptr es:[edi]
006DC276 ^ EB F1 jmp short CJapanes.006DC269
006DC278 BE 607D2600 mov esi,267D60
006DC27D 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
006DC283 03F2 add esi,edx
006DC285 8B46 0C mov eax,dword ptr ds:[esi+C]
006DC288 85C0 test eax,eax
006DC28A 0F84 0A010000 je CJapanes.006DC39A
006DC290 03C2 add eax,edx
006DC292 8BD8 mov ebx,eax
006DC294 50 push eax
006DC295 FF95 4D0F0000 call dword ptr ss:[ebp+F4D]
006DC29B 85C0 test eax,eax
006DC29D 75 07 jnz short CJapanes.006DC2A6
006DC29F 53 push ebx
006DC2A0 FF95 510F0000 call dword ptr ss:[ebp+F51]
006DC2A6 8985 45050000 mov dword ptr ss:[ebp+545],ea>
006DC2AC C785 49050000 0>mov dword ptr ss:[ebp+549],0
006DC2B6 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
006DC2BC 8B06 mov eax,dword ptr ds:[esi]
006DC2BE 85C0 test eax,eax
006DC2C0 75 03 jnz short CJapanes.006DC2C5
006DC2C2 8B46 10 mov eax,dword ptr ds:[esi+10]
006DC2C5 03C2 add eax,edx
006DC2C7 0385 49050000 add eax,dword ptr ss:[ebp+549>
006DC2CD 8B18 mov ebx,dword ptr ds:[eax]
006DC2CF 8B7E 10 mov edi,dword ptr ds:[esi+10]
006DC2D2 03FA add edi,edx
006DC2D4 03BD 49050000 add edi,dword ptr ss:[ebp+549>
006DC2DA 85DB test ebx,ebx
006DC2DC 0F84 A2000000 je CJapanes.006DC384
006DC2E2 F7C3 00000080 test ebx,80000000
006DC2E8 75 04 jnz short CJapanes.006DC2EE
006DC2EA 03DA add ebx,edx
006DC2EC 43 inc ebx
006DC2ED 43 inc ebx
006DC2EE 53 push ebx
006DC2EF 81E3 FFFFFF7F and ebx,7FFFFFFF
006DC2F5 53 push ebx
006DC2F6 FFB5 45050000 push dword ptr ss:[ebp+545]
006DC2FC FF95 490F0000 call dword ptr ss:[ebp+F49]
006DC302 85C0 test eax,eax
006DC304 5B pop ebx
006DC305 75 6F jnz short CJapanes.006DC376
006DC307 F7C3 00000080 test ebx,80000000
006DC30D 75 19 jnz short CJapanes.006DC328
006DC30F 57 push edi
006DC310 8B46 0C mov eax,dword ptr ds:[esi+C]
006DC313 0385 22040000 add eax,dword ptr ss:[ebp+422>
006DC319 50 push eax
006DC31A 53 push ebx
006DC31B 8D85 75040000 lea eax,dword ptr ss:[ebp+475>
006DC321 50 push eax
006DC322 57 push edi
006DC323 E9 98000000 jmp CJapanes.006DC3C0
006DC328 81E3 FFFFFF7F and ebx,7FFFFFFF
006DC32E 8B85 26040000 mov eax,dword ptr ss:[ebp+426>
006DC334 3985 45050000 cmp dword ptr ss:[ebp+545],ea>
006DC33A 75 24 jnz short CJapanes.006DC360
006DC33C 57 push edi
006DC33D 8BD3 mov edx,ebx
006DC33F 4A dec edx
006DC340 C1E2 02 shl edx,2
006DC343 8B9D 45050000 mov ebx,dword ptr ss:[ebp+545>
006DC349 8B7B 3C mov edi,dword ptr ds:[ebx+3C]
006DC34C 8B7C3B 78 mov edi,dword ptr ds:[ebx+edi>
006DC350 035C3B 1C add ebx,dword ptr ds:[ebx+edi>
006DC354 8B0413 mov eax,dword ptr ds:[ebx+edx>
006DC357 0385 45050000 add eax,dword ptr ss:[ebp+545>
006DC35D 5F pop edi
006DC35E EB 16 jmp short CJapanes.006DC376
006DC360 57 push edi
006DC361 8B46 0C mov eax,dword ptr ds:[esi+C]
006DC364 0385 22040000 add eax,dword ptr ss:[ebp+422>
006DC36A 50 push eax
006DC36B 53 push ebx
006DC36C 8D85 C6040000 lea eax,dword ptr ss:[ebp+4C6>
006DC372 50 push eax
006DC373 57 push edi
006DC374 EB 4A jmp short CJapanes.006DC3C0
006DC376 8907 mov dword ptr ds:[edi],eax
006DC378 8385 49050000 0>add dword ptr ss:[ebp+549],4
006DC37F ^ E9 32FFFFFF jmp CJapanes.006DC2B6
006DC384 8906 mov dword ptr ds:[esi],eax
006DC386 8946 0C mov dword ptr ds:[esi+C],eax
006DC389 8946 10 mov dword ptr ds:[esi+10],eax
006DC38C 83C6 14 add esi,14
006DC38F 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
006DC395 ^ E9 EBFEFFFF jmp CJapanes.006DC285
006DC39A B8 604A2600 mov eax,264A60
006DC39F 50 push eax
006DC3A0 0385 22040000 add eax,dword ptr ss:[ebp+422>
006DC3A6 59 pop ecx
006DC3A7 0BC9 or ecx,ecx
006DC3A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],ea>
006DC3AF 61 popad
006DC3B0 75 08 jnz short CJapanes.006DC3BA
006DC3B2 B8 01000000 mov eax,1
006DC3B7 C2 0C00 retn 0C
006DC3BA 68 604A6600 push CJapanes.00664A60 // //F4直接来这里
006DC3BF C3 retn
返回到 00664A60 (CJapanes.00664A60)
进入第4层壳 还是UPX
00664A60 60 pushad
00664A61 BE 00205700 mov esi,CJapanes.00572000
00664A66 8DBE 00F0E8FF lea edi,dword ptr ds:[esi+FFE>
00664A6C C787 CC601B00 1>mov dword ptr ds:[edi+1B60CC]>
00664A76 57 push edi
00664A77 83CD FF or ebp,FFFFFFFF
00664A7A EB 0E jmp short CJapanes.00664A8A
00664A7C 90 nop
00664A7D 90 nop
00664A7E 90 nop
00664A7F 90 nop
00664A80 8A06 mov al,byte ptr ds:[esi]
00664A82 46 inc esi
00664A83 8807 mov byte ptr ds:[edi],al
00664A85 47 inc edi
00664A86 01DB add ebx,ebx
00664A88 75 07 jnz short CJapanes.00664A91
00664A8A 8B1E mov ebx,dword ptr ds:[esi]
00664A8C 83EE FC sub esi,-4
00664A8F 11DB adc ebx,ebx
00664A91 ^ 72 ED jb short CJapanes.00664A80
00664A93 B8 01000000 mov eax,1
00664A98 01DB add ebx,ebx
00664A9A 75 07 jnz short CJapanes.00664AA3
00664A9C 8B1E mov ebx,dword ptr ds:[esi]
00664A9E 83EE FC sub esi,-4
00664AA1 11DB adc ebx,ebx
00664AA3 11C0 adc eax,eax
00664AA5 01DB add ebx,ebx
00664AA7 73 0B jnb short CJapanes.00664AB4
00664AA9 75 19 jnz short CJapanes.00664AC4
00664AAB 8B1E mov ebx,dword ptr ds:[esi]
00664AAD 83EE FC sub esi,-4
00664AB0 11DB adc ebx,ebx
00664AB2 72 10 jb short CJapanes.00664AC4
00664AB4 48 dec eax
00664AB5 01DB add ebx,ebx
00664AB7 75 07 jnz short CJapanes.00664AC0
00664AB9 8B1E mov ebx,dword ptr ds:[esi]
00664ABB 83EE FC sub esi,-4
00664ABE 11DB adc ebx,ebx
00664AC0 11C0 adc eax,eax
00664AC2 ^ EB D4 jmp short CJapanes.00664A98
00664AC4 31C9 xor ecx,ecx
00664AC6 83E8 03 sub eax,3
00664AC9 72 11 jb short CJapanes.00664ADC
00664ACB C1E0 08 shl eax,8
00664ACE 8A06 mov al,byte ptr ds:[esi]
00664AD0 46 inc esi
00664AD1 83F0 FF xor eax,FFFFFFFF
00664AD4 74 78 je short CJapanes.00664B4E
00664AD6 D1F8 sar eax,1
00664AD8 89C5 mov ebp,eax
00664ADA EB 0B jmp short CJapanes.00664AE7
00664ADC 01DB add ebx,ebx
00664ADE 75 07 jnz short CJapanes.00664AE7
00664AE0 8B1E mov ebx,dword ptr ds:[esi]
00664AE2 83EE FC sub esi,-4
00664AE5 11DB adc ebx,ebx
00664AE7 11C9 adc ecx,ecx
00664AE9 01DB add ebx,ebx
00664AEB 75 07 jnz short CJapanes.00664AF4
00664AED 8B1E mov ebx,dword ptr ds:[esi]
00664AEF 83EE FC sub esi,-4
00664AF2 11DB adc ebx,ebx
00664AF4 11C9 adc ecx,ecx
00664AF6 75 20 jnz short CJapanes.00664B18
00664AF8 41 inc ecx
00664AF9 01DB add ebx,ebx
00664AFB 75 07 jnz short CJapanes.00664B04
00664AFD 8B1E mov ebx,dword ptr ds:[esi]
00664AFF 83EE FC sub esi,-4
00664B02 11DB adc ebx,ebx
00664B04 11C9 adc ecx,ecx
00664B06 01DB add ebx,ebx
00664B08 ^ 73 EF jnb short CJapanes.00664AF9
00664B0A 75 09 jnz short CJapanes.00664B15
00664B0C 8B1E mov ebx,dword ptr ds:[esi]
00664B0E 83EE FC sub esi,-4
00664B11 11DB adc ebx,ebx
00664B13 ^ 73 E4 jnb short CJapanes.00664AF9
00664B15 83C1 02 add ecx,2
00664B18 81FD 00FBFFFF cmp ebp,-500
00664B1E 83D1 01 adc ecx,1
00664B21 8D142F lea edx,dword ptr ds:[edi+ebp>
00664B24 83FD FC cmp ebp,-4
00664B27 76 0F jbe short CJapanes.00664B38
00664B29 8A02 mov al,byte ptr ds:[edx]
00664B2B 42 inc edx
00664B2C 8807 mov byte ptr ds:[edi],al
00664B2E 47 inc edi
00664B2F 49 dec ecx
00664B30 ^ 75 F7 jnz short CJapanes.00664B29
00664B32 ^ E9 4FFFFFFF jmp CJapanes.00664A86
00664B37 90 nop
00664B38 8B02 mov eax,dword ptr ds:[edx]
00664B3A 83C2 04 add edx,4
00664B3D 8907 mov dword ptr ds:[edi],eax
00664B3F 83C7 04 add edi,4
00664B42 83E9 04 sub ecx,4
00664B45 ^ 77 F1 ja short CJapanes.00664B38
00664B47 01CF add edi,ecx
00664B49 ^ E9 38FFFFFF jmp CJapanes.00664A86
00664B4E 5E pop esi
00664B4F 89F7 mov edi,esi
00664B51 B9 25E00000 mov ecx,0E025
00664B56 8A07 mov al,byte ptr ds:[edi]
00664B58 47 inc edi
00664B59 2C E8 sub al,0E8
00664B5B 3C 01 cmp al,1
00664B5D ^ 77 F7 ja short CJapanes.00664B56
00664B5F 803F 25 cmp byte ptr ds:[edi],25
00664B62 ^ 75 F2 jnz short CJapanes.00664B56
00664B64 8B07 mov eax,dword ptr ds:[edi]
00664B66 8A5F 04 mov bl,byte ptr ds:[edi+4]
00664B69 66:C1E8 08 shr ax,8
00664B6D C1C0 10 rol eax,10
00664B70 86C4 xchg ah,al
00664B72 29F8 sub eax,edi
00664B74 80EB E8 sub bl,0E8
00664B77 01F0 add eax,esi
00664B79 8907 mov dword ptr ds:[edi],eax
00664B7B 83C7 05 add edi,5
00664B7E 89D8 mov eax,ebx
00664B80 ^ E2 D9 loopd short CJapanes.00664B5B
00664B82 8DBE 00302500 lea edi,dword ptr ds:[esi+253>
00664B88 8B07 mov eax,dword ptr ds:[edi]
00664B8A 09C0 or eax,eax
00664B8C 74 3C je short CJapanes.00664BCA
00664B8E 8B5F 04 mov ebx,dword ptr ds:[edi+4]
00664B91 8D8430 606D2600 lea eax,dword ptr ds:[eax+esi>
00664B98 01F3 add ebx,esi
00664B9A 50 push eax
00664B9B 83C7 08 add edi,8
00664B9E FF96 646E2600 call dword ptr ds:[esi+266E64>
00664BA4 95 xchg eax,ebp
00664BA5 8A07 mov al,byte ptr ds:[edi]
00664BA7 47 inc edi
00664BA8 08C0 or al,al
00664BAA ^ 74 DC je short CJapanes.00664B88
00664BAC 89F9 mov ecx,edi
00664BAE 57 push edi
00664BAF 48 dec eax
00664BB0 F2:AE repne scas byte ptr es:[edi]
00664BB2 55 push ebp
00664BB3 FF96 686E2600 call dword ptr ds:[esi+266E68>
00664BB9 09C0 or eax,eax
00664BBB 74 07 je short CJapanes.00664BC4
00664BBD 8903 mov dword ptr ds:[ebx],eax
00664BBF 83C3 04 add ebx,4
00664BC2 ^ EB E1 jmp short CJapanes.00664BA5
00664BC4 FF96 6C6E2600 call dword ptr ds:[esi+266E6C>
00664BCA 83C7 04 add edi,4
00664BCD 8D5E FC lea ebx,dword ptr ds:[esi-4]
00664BD0 31C0 xor eax,eax
00664BD2 8A07 mov al,byte ptr ds:[edi]
00664BD4 47 inc edi
00664BD5 09C0 or eax,eax
00664BD7 74 22 je short CJapanes.00664BFB
00664BD9 3C EF cmp al,0EF
00664BDB 77 11 ja short CJapanes.00664BEE
00664BDD 01C3 add ebx,eax
00664BDF 8B03 mov eax,dword ptr ds:[ebx]
00664BE1 86C4 xchg ah,al
00664BE3 C1C0 10 rol eax,10
00664BE6 86C4 xchg ah,al
00664BE8 01F0 add eax,esi
00664BEA 8903 mov dword ptr ds:[ebx],eax
00664BEC ^ EB E2 jmp short CJapanes.00664BD0
00664BEE 24 0F and al,0F
00664BF0 C1E0 10 shl eax,10
00664BF3 66:8B07 mov ax,word ptr ds:[edi]
00664BF6 83C7 02 add edi,2
00664BF9 ^ EB E2 jmp short CJapanes.00664BDD
00664BFB 61 popad
00664BFC - E9 6F17F5FF jmp CJapanes.005B6370 // //F4直接来这里
OEP
005B6370 55 push ebp //DUMP
005B6371 8BEC mov ebp,esp
005B6373 83C4 F0 add esp,-10
005B6376 B8 A05F5B00 mov eax,CJapanes.005B5FA0
005B637B E8 000AE5FF call CJapanes.00406D80
005B6380 8B0D 3CE75B00 mov ecx,dword ptr ds:[5BE73C] ; CJapanes.005BFBEC
005B6386 8B09 mov ecx,dword ptr ds:[ecx]
005B6388 B2 01 mov dl,1
005B638A A1 504F5900 mov eax,dword ptr ds:[594F50]
005B638F E8 A457EBFF call CJapanes.0046BB38
005B6394 8B15 ECE45B00 mov edx,dword ptr ds:[5BE4EC] ; CJapanes.005C0034
ImportREC修复一下就可以运行了。
用PEID检测为Borland Delphi 6.0 - 7.0
软件语言: 简体中文
界面预览:
软件类型: 国产软件 / 外语学习
运行环境: Win9x/NT/2000/XP
授权方式: 共享版
软件大小: 15.23 MB
http://www.pc286.com/SoftView/SoftView_15715.html
应急日语 是一款集日语口语、日语背单词综合日语学习软件。精选了交际用语、日常用语、心情表达、
日语语法句式等四大类共900多句常用日语对话内容以及600多个常用单词的全部内容并以全部真人发音,
运用先进的语音朗读技术,富于娱乐性;使您在使用电脑进行工作、学习或娱乐的同时,就能不知不觉、
轻轻松松地掌握各类日常日语会话及常用日语单词。该方式既摆脱了枯燥的传统学习方法,又充分利用了
在电脑前的各种冗余和等待时间,有效地提高了学习效率,在不知不觉中轻轻松松、迅速提高日语的听力、
口语水平。
加壳方式:EXEStealth 2.72 - 2.73 + ACProtect
忽略所有异常,OD载入
00A29060 > /EB 00 jmp short CJapanes.00A29062//进入OD后停在这!
00A29062 \EB 2F jmp short CJapanes.00A29093
bp Process32First
009A384C 52 push edx
009A384D 50 push eax
009A384E FF95 C3664000 call dword ptr ss:[ebp+4066C3>
009A3854 0BC0 or eax,eax
009A3856 /0F84 FE000000 je CJapanes.009A395A //改为JMP 009A395A
009A385C |8DB5 23644000 lea esi,dword ptr ss:[ebp+406>
009A3862 |8BFE mov edi,esi
009A3864 |8A07 mov al,byte ptr ds:[edi]
009A3866 |0AC0 or al,al
009A3868 |74 12 je short CJapanes.009A387C
009A386A |90 nop
009A386B |90 nop
009A386C |90 nop
009A386D |90 nop
009A386E |3C 5C cmp al,5C
009A3870 |75 07 jnz short CJapanes.009A3879
009A3872 |90 nop
009A3873 |90 nop
009A3874 |90 nop
009A3875 |90 nop
009A3876 |8BF7 mov esi,edi
009A3878 |46 inc esi
009A3879 |47 inc edi
009A387A ^|EB E8 jmp short CJapanes.009A3864
009A387C |8BC6 mov eax,esi
009A387E |BF 167A4000 mov edi,CJapanes.00407A16
009A3883 |03FD add edi,ebp
009A3885 |8B17 mov edx,dword ptr ds:[edi]
009A3887 |66:0BD2 or dx,dx
009A388A |74 22 je short CJapanes.009A38AE
009A388C |90 nop
009A388D |90 nop
009A388E |90 nop
009A388F |90 nop
009A3890 |0AD2 or dl,dl
009A3892 |74 07 je short CJapanes.009A389B
009A3894 |90 nop
009A3895 |90 nop
009A3896 |90 nop
009A3897 |90 nop
009A3898 |47 inc edi
009A3899 ^|EB EA jmp short CJapanes.009A3885
009A389B |47 inc edi
009A389C |8BF0 mov esi,eax
009A389E |E8 29F1FFFF call CJapanes.009A29CC
009A38A3 |80FE 01 cmp dh,1
009A38A6 |74 1C je short CJapanes.009A38C4
009A38A8 |90 nop
009A38A9 |90 nop
009A38AA |90 nop
009A38AB |90 nop
009A38AC ^|EB D7 jmp short CJapanes.009A3885
009A38AE |B8 FF634000 mov eax,CJapanes.004063FF
009A38B3 |03C5 add eax,ebp
009A38B5 |50 push eax
009A38B6 |FFB5 FB634000 push dword ptr ss:[ebp+4063FB>
009A38BC |FF95 C7664000 call dword ptr ss:[ebp+4066C7>
009A38C2 ^|EB 90 jmp short CJapanes.009A3854
009A38C4 |60 pushad
009A38C5 |E8 D6EAFFFF call CJapanes.009A23A0
009A38CA |8DBD 58CD4000 lea edi,dword ptr ss:[ebp+40C>
009A38D0 |B8 05000000 mov eax,5
009A38D5 |E8 50E8FFFF call CJapanes.009A212A
009A38DA |0BC0 or eax,eax
009A38DC |74 28 je short CJapanes.009A3906
009A38DE |90 nop
009A38DF |90 nop
009A38E0 |90 nop
009A38E1 |90 nop
009A38E2 |48 dec eax
009A38E3 |0BC0 or eax,eax
009A38E5 |74 2A je short CJapanes.009A3911
009A38E7 |90 nop
009A38E8 |90 nop
009A38E9 |90 nop
009A38EA |90 nop
009A38EB |48 dec eax
009A38EC |0BC0 or eax,eax
009A38EE |74 2C je short CJapanes.009A391C
009A38F0 |90 nop
009A38F1 |90 nop
009A38F2 |90 nop
009A38F3 |90 nop
009A38F4 |48 dec eax
009A38F5 |0BC0 or eax,eax
009A38F7 |74 2E je short CJapanes.009A3927
009A38F9 |90 nop
009A38FA |90 nop
009A38FB |90 nop
009A38FC |90 nop
009A38FD |48 dec eax
009A38FE |0BC0 or eax,eax
009A3900 |74 30 je short CJapanes.009A3932
009A3902 |90 nop
009A3903 |90 nop
009A3904 |90 nop
009A3905 |90 nop
009A3906 |8DBD 0C914100 lea edi,dword ptr ss:[ebp+419>
009A390C |EB 2A jmp short CJapanes.009A3938
009A390E |90 nop
009A390F |90 nop
009A3910 |90 nop
009A3911 |8DBD A2A94000 lea edi,dword ptr ss:[ebp+40A>
009A3917 |EB 1F jmp short CJapanes.009A3938
009A3919 |90 nop
009A391A |90 nop
009A391B |90 nop
009A391C |8DBD 8D674000 lea edi,dword ptr ss:[ebp+406>
009A3922 |EB 14 jmp short CJapanes.009A3938
009A3924 |90 nop
009A3925 |90 nop
009A3926 |90 nop
009A3927 |8DBD 63A24000 lea edi,dword ptr ss:[ebp+40A>
009A392D |EB 09 jmp short CJapanes.009A3938
009A392F |90 nop
009A3930 |90 nop
009A3931 |90 nop
009A3932 |8DBD 3AC84000 lea edi,dword ptr ss:[ebp+40C>
009A3938 |B8 00010000 mov eax,100
009A393D |E8 E8E7FFFF call CJapanes.009A212A
009A3942 |8BC8 mov ecx,eax
009A3944 |41 inc ecx
009A3945 |B8 00010000 mov eax,100
009A394A |E8 DBE7FFFF call CJapanes.009A212A
009A394F |03F8 add edi,eax
009A3951 |E8 E8E7FFFF call CJapanes.009A213E
009A3956 |AB stos dword ptr es:[edi] //这里让你死翘翘!
009A3957 ^|E2 F8 loopd short CJapanes.009A3951
009A3959 |61 popad
009A395A \FFB5 FB634000 push dword ptr ss:[ebp+4063FB>
009A3960 FF95 CB664000 call dword ptr ss:[ebp+4066CB>
009A3966 60 pushad
009A3967 E8 00000000 call CJapanes.009A396C
009A396C 5E pop esi
009A396D 83EE 06 sub esi,6
009A3970 B9 40010000 mov ecx,140
009A3975 29CE sub esi,ecx
009A3977 BA 45C57664 mov edx,6476C545
009A397C C1E9 02 shr ecx,2
009A397F 83E9 02 sub ecx,2
009A3982 83F9 00 cmp ecx,0
009A3985 7C 1A jl short CJapanes.009A39A1
bp GetProcAddress
0083F055 8985 4D050000 mov dword ptr ss:[ebp+54D],ea>; kernel32.VirtualAlloc
0083F05B 8D5D 6B lea ebx,dword ptr ss:[ebp+6B]
0083F05E 53 push ebx
0083F05F 57 push edi
0083F060 FF95 490F0000 call dword ptr ss:[ebp+F49]
0083F066 8985 51050000 mov dword ptr ss:[ebp+551],ea>
0083F06C 8D45 77 lea eax,dword ptr ss:[ebp+77]
0083F06F /FFE0 jmp eax ; CJapanes.0083F08A
0083F08A 8B9D 31050000 mov ebx,dword ptr ss:[ebp+531>
0083F090 0BDB or ebx,ebx
0083F092 74 0A je short CJapanes.0083F09E
0083F09E 8DB5 69050000 lea esi,dword ptr ss:[ebp+569>
0083F0A4 833E 00 cmp dword ptr ds:[esi],0
0083F0A7 0F84 21010000 je CJapanes.0083F1CE
0083F0AD 6A 04 push 4
0083F0AF 68 00100000 push 1000
0083F0B4 68 00180000 push 1800
0083F0B9 6A 00 push 0
0083F0BB FF95 4D050000 call dword ptr ss:[ebp+54D]
0083F0C1 8985 56010000 mov dword ptr ss:[ebp+156],ea>
0083F0C7 8B46 04 mov eax,dword ptr ds:[esi+4]
0083F0CA 05 0E010000 add eax,10E
0083F0CF 6A 04 push 4
0083F0D1 68 00100000 push 1000
0083F0D6 50 push eax
0083F0D7 6A 00 push 0
0083F0D9 FF95 4D050000 call dword ptr ss:[ebp+54D]
0083F0DF 8985 52010000 mov dword ptr ss:[ebp+152],ea>
0083F0E5 56 push esi
0083F0E6 8B1E mov ebx,dword ptr ds:[esi]
0083F0E8 039D 22040000 add ebx,dword ptr ss:[ebp+422>
0083F0EE FFB5 56010000 push dword ptr ss:[ebp+156]
0083F0F4 FF76 04 push dword ptr ds:[esi+4]
0083F0F7 50 push eax
0083F0F8 53 push ebx
0083F0F9 E8 6E050000 call CJapanes.0083F66C
0083F0FE B3 01 mov bl,1
0083F100 80FB 00 cmp bl,0
0083F103 75 5E jnz short CJapanes.0083F163
0083F105 FE85 EC000000 inc byte ptr ss:[ebp+EC]
0083F10B 8B3E mov edi,dword ptr ds:[esi]
0083F10D 03BD 22040000 add edi,dword ptr ss:[ebp+422>
0083F113 FF37 push dword ptr ds:[edi]
0083F115 C607 C3 mov byte ptr ds:[edi],0C3
0083F118 FFD7 call edi
0083F11A 8F07 pop dword ptr ds:[edi]
0083F11C 50 push eax
0083F11D 51 push ecx
0083F11E 56 push esi
0083F11F 53 push ebx
0083F120 8BC8 mov ecx,eax
0083F122 83E9 06 sub ecx,6
0083F125 8BB5 52010000 mov esi,dword ptr ss:[ebp+152>
0083F12B 33DB xor ebx,ebx
0083F12D 0BC9 or ecx,ecx
0083F12F 74 2E je short CJapanes.0083F15F
0083F131 78 2C js short CJapanes.0083F15F
0083F133 AC lods byte ptr ds:[esi]
0083F134 3C E8 cmp al,0E8
0083F136 74 0A je short CJapanes.0083F142
0083F138 EB 00 jmp short CJapanes.0083F13A
0083F13A 3C E9 cmp al,0E9
0083F13C 74 04 je short CJapanes.0083F142
0083F13E 43 inc ebx
0083F13F 49 dec ecx
0083F140 ^ EB EB jmp short CJapanes.0083F12D
0083F142 8B06 mov eax,dword ptr ds:[esi]
0083F144 EB 0A jmp short CJapanes.0083F150
0083F146 803E 00 cmp byte ptr ds:[esi],0
0083F149 ^ 75 F3 jnz short CJapanes.0083F13E
0083F14B 24 00 and al,0
0083F14D C1C0 18 rol eax,18
0083F150 2BC3 sub eax,ebx
0083F152 8906 mov dword ptr ds:[esi],eax
0083F154 83C3 05 add ebx,5
0083F157 83C6 04 add esi,4
0083F15A 83E9 05 sub ecx,5
0083F15D ^ EB CE jmp short CJapanes.0083F12D
0083F15F 5B pop ebx
0083F160 5E pop esi
0083F161 59 pop ecx
0083F162 58 pop eax
0083F163 EB 08 jmp short CJapanes.0083F16D
0083F165 0000 add byte ptr ds:[eax],al
0083F167 8201 00 add byte ptr ds:[ecx],0
0083F16A 0081 018BC88B add byte ptr ds:[ecx+8BC88B01>
0083F170 3E:03BD 2204000>add edi,dword ptr ds:[ebp+422>
0083F177 8BB5 52010000 mov esi,dword ptr ss:[ebp+152>
0083F17D C1F9 02 sar ecx,2
0083F180 F3:A5 rep movs dword ptr es:[edi],d>
0083F182 8BC8 mov ecx,eax
0083F184 83E1 03 and ecx,3
0083F187 F3:A4 rep movs byte ptr es:[edi],by>
0083F189 5E pop esi
0083F18A 68 00800000 push 8000
0083F18F 6A 00 push 0
0083F191 FFB5 52010000 push dword ptr ss:[ebp+152]
0083F197 FF95 51050000 call dword ptr ss:[ebp+551]
0083F19D 83C6 08 add esi,8
0083F1A0 833E 00 cmp dword ptr ds:[esi],0
0083F1A3 ^ 0F85 1EFFFFFF jnz CJapanes.0083F0C7
0083F1A9 68 00800000 push 8000
0083F1AE 6A 00 push 0
0083F1B0 FFB5 56010000 push dword ptr ss:[ebp+156]
0083F1B6 FF95 51050000 call dword ptr ss:[ebp+551]
0083F1BC 8B9D 31050000 mov ebx,dword ptr ss:[ebp+531>
0083F1C2 0BDB or ebx,ebx
0083F1C4 74 08 je short CJapanes.0083F1CE
0083F1C6 8B03 mov eax,dword ptr ds:[ebx]
0083F1C8 8785 35050000 xchg dword ptr ss:[ebp+535],e>
0083F1CE 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
0083F1D4 8B85 2D050000 mov eax,dword ptr ss:[ebp+52D>
0083F1DA 2BD0 sub edx,eax
0083F1DC 74 79 je short CJapanes.0083F257
0083F1DE 8BC2 mov eax,edx
0083F1E0 C1E8 10 shr eax,10
0083F1E3 33DB xor ebx,ebx
0083F1E5 8BB5 39050000 mov esi,dword ptr ss:[ebp+539>
0083F1EB 03B5 22040000 add esi,dword ptr ss:[ebp+422>
0083F1F1 833E 00 cmp dword ptr ds:[esi],0
0083F1F4 74 61 je short CJapanes.0083F257
0083F1F6 8B4E 04 mov ecx,dword ptr ds:[esi+4]
0083F1F9 83E9 08 sub ecx,8
0083F1FC D1E9 shr ecx,1
0083F1FE 8B3E mov edi,dword ptr ds:[esi]
0083F200 03BD 22040000 add edi,dword ptr ss:[ebp+422>
0083F206 83C6 08 add esi,8
0083F209 66:8B1E mov bx,word ptr ds:[esi]
0083F20C C1EB 0C shr ebx,0C
0083F20F 83FB 01 cmp ebx,1
0083F212 74 0C je short CJapanes.0083F220
0083F214 83FB 02 cmp ebx,2
0083F217 74 16 je short CJapanes.0083F22F
0083F219 83FB 03 cmp ebx,3
0083F21C 74 20 je short CJapanes.0083F23E
0083F21E EB 2C jmp short CJapanes.0083F24C
0083F220 66:8B1E mov bx,word ptr ds:[esi]
0083F223 81E3 FF0F0000 and ebx,0FFF
0083F229 66:01041F add word ptr ds:[edi+ebx],ax
0083F22D EB 1D jmp short CJapanes.0083F24C
0083F22F 66:8B1E mov bx,word ptr ds:[esi]
0083F232 81E3 FF0F0000 and ebx,0FFF
0083F238 66:01141F add word ptr ds:[edi+ebx],dx
0083F23C EB 0E jmp short CJapanes.0083F24C
0083F23E 66:8B1E mov bx,word ptr ds:[esi]
0083F241 81E3 FF0F0000 and ebx,0FFF
0083F247 01141F add dword ptr ds:[edi+ebx],ed>
0083F24A EB 00 jmp short CJapanes.0083F24C
0083F24C 66:830E FF or word ptr ds:[esi],0FFFF
0083F250 83C6 02 add esi,2
0083F253 ^ E2 B4 loopd short CJapanes.0083F209
0083F255 ^ EB 9A jmp short CJapanes.0083F1F1
0083F257 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
0083F25D 8BB5 41050000 mov esi,dword ptr ss:[ebp+541>
0083F263 0BF6 or esi,esi
0083F265 74 11 je short CJapanes.0083F278
0083F267 03F2 add esi,edx
0083F269 AD lods dword ptr ds:[esi]
0083F26A 0BC0 or eax,eax
0083F26C 74 0A je short CJapanes.0083F278
0083F26E 03C2 add eax,edx
0083F270 8BF8 mov edi,eax
0083F272 66:AD lods word ptr ds:[esi]
0083F274 66:AB stos word ptr es:[edi]
0083F276 ^ EB F1 jmp short CJapanes.0083F269
0083F278 BE 60AD3C00 mov esi,3CAD60
0083F27D 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
0083F283 03F2 add esi,edx
0083F285 8B46 0C mov eax,dword ptr ds:[esi+C]
0083F288 85C0 test eax,eax
0083F28A 0F84 0A010000 je CJapanes.0083F39A
0083F290 03C2 add eax,edx
0083F292 8BD8 mov ebx,eax
0083F294 50 push eax
0083F295 FF95 4D0F0000 call dword ptr ss:[ebp+F4D]
0083F29B 85C0 test eax,eax
0083F29D 75 07 jnz short CJapanes.0083F2A6
0083F29F 53 push ebx
0083F2A0 FF95 510F0000 call dword ptr ss:[ebp+F51]
0083F2A6 8985 45050000 mov dword ptr ss:[ebp+545],ea>
0083F2AC C785 49050000 0>mov dword ptr ss:[ebp+549],0
0083F2B6 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
0083F2BC 8B06 mov eax,dword ptr ds:[esi]
0083F2BE 85C0 test eax,eax
0083F2C0 75 03 jnz short CJapanes.0083F2C5
0083F2C2 8B46 10 mov eax,dword ptr ds:[esi+10]
0083F2C5 03C2 add eax,edx
0083F2C7 0385 49050000 add eax,dword ptr ss:[ebp+549>
0083F2CD 8B18 mov ebx,dword ptr ds:[eax]
0083F2CF 8B7E 10 mov edi,dword ptr ds:[esi+10]
0083F2D2 03FA add edi,edx
0083F2D4 03BD 49050000 add edi,dword ptr ss:[ebp+549>
0083F2DA 85DB test ebx,ebx
0083F2DC 0F84 A2000000 je CJapanes.0083F384
0083F2E2 F7C3 00000080 test ebx,80000000
0083F2E8 75 04 jnz short CJapanes.0083F2EE
0083F2EA 03DA add ebx,edx
0083F2EC 43 inc ebx
0083F2ED 43 inc ebx
0083F2EE 53 push ebx
0083F2EF 81E3 FFFFFF7F and ebx,7FFFFFFF
0083F2F5 53 push ebx
0083F2F6 FFB5 45050000 push dword ptr ss:[ebp+545]
0083F2FC FF95 490F0000 call dword ptr ss:[ebp+F49]
0083F302 85C0 test eax,eax
0083F304 5B pop ebx
0083F305 75 6F jnz short CJapanes.0083F376
0083F307 F7C3 00000080 test ebx,80000000
0083F30D 75 19 jnz short CJapanes.0083F328
0083F30F 57 push edi
0083F310 8B46 0C mov eax,dword ptr ds:[esi+C]
0083F313 0385 22040000 add eax,dword ptr ss:[ebp+422>
0083F319 50 push eax
0083F31A 53 push ebx
0083F31B 8D85 75040000 lea eax,dword ptr ss:[ebp+475>
0083F321 50 push eax
0083F322 57 push edi
0083F323 E9 98000000 jmp CJapanes.0083F3C0
0083F328 81E3 FFFFFF7F and ebx,7FFFFFFF
0083F32E 8B85 26040000 mov eax,dword ptr ss:[ebp+426>
0083F334 3985 45050000 cmp dword ptr ss:[ebp+545],ea>
0083F33A 75 24 jnz short CJapanes.0083F360
0083F33C 57 push edi
0083F33D 8BD3 mov edx,ebx
0083F33F 4A dec edx
0083F340 C1E2 02 shl edx,2
0083F343 8B9D 45050000 mov ebx,dword ptr ss:[ebp+545>
0083F349 8B7B 3C mov edi,dword ptr ds:[ebx+3C]
0083F34C 8B7C3B 78 mov edi,dword ptr ds:[ebx+edi>
0083F350 035C3B 1C add ebx,dword ptr ds:[ebx+edi>
0083F354 8B0413 mov eax,dword ptr ds:[ebx+edx>
0083F357 0385 45050000 add eax,dword ptr ss:[ebp+545>
0083F35D 5F pop edi
0083F35E EB 16 jmp short CJapanes.0083F376
0083F360 57 push edi
0083F361 8B46 0C mov eax,dword ptr ds:[esi+C]
0083F364 0385 22040000 add eax,dword ptr ss:[ebp+422>
0083F36A 50 push eax
0083F36B 53 push ebx
0083F36C 8D85 C6040000 lea eax,dword ptr ss:[ebp+4C6>
0083F372 50 push eax
0083F373 57 push edi
0083F374 EB 4A jmp short CJapanes.0083F3C0
0083F376 8907 mov dword ptr ds:[edi],eax
0083F378 8385 49050000 0>add dword ptr ss:[ebp+549],4
0083F37F ^ E9 32FFFFFF jmp CJapanes.0083F2B6
0083F384 8906 mov dword ptr ds:[esi],eax
0083F386 8946 0C mov dword ptr ds:[esi+C],eax
0083F389 8946 10 mov dword ptr ds:[esi+10],eax
0083F38C 83C6 14 add esi,14
0083F38F 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
0083F395 ^ E9 EBFEFFFF jmp CJapanes.0083F285
0083F39A B8 F07D3C00 mov eax,3C7DF0
0083F39F 50 push eax
0083F3A0 0385 22040000 add eax,dword ptr ss:[ebp+422>
0083F3A6 59 pop ecx
0083F3A7 0BC9 or ecx,ecx
0083F3A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],ea>
0083F3AF 61 popad
0083F3B0 75 08 jnz short CJapanes.0083F3BA
0083F3B2 B8 01000000 mov eax,1
0083F3B7 C2 0C00 retn 0C
0083F3BA 68 F07D7C00 push CJapanes.007C7DF0 //F4直接来这里
0083F3BF C3 retn
返回到 007C7DF0 (CJapanes.007C7DF0)
进入第2层壳 UPX
007C7DF0 60 pushad
007C7DF1 BE 00206000 mov esi,CJapanes.00602000
007C7DF6 8DBE 00F0DFFF lea edi,dword ptr ds:[esi+FFD>
007C7DFC 57 push edi
007C7DFD 83CD FF or ebp,FFFFFFFF
007C7E00 EB 10 jmp short CJapanes.007C7E12
007C7E02 90 nop
007C7E03 90 nop
007C7E04 90 nop
007C7E05 90 nop
007C7E06 90 nop
007C7E07 90 nop
007C7E08 8A06 mov al,byte ptr ds:[esi]
007C7E0A 46 inc esi
007C7E0B 8807 mov byte ptr ds:[edi],al
007C7E0D 47 inc edi
007C7E0E 01DB add ebx,ebx
007C7E10 75 07 jnz short CJapanes.007C7E19
007C7E12 8B1E mov ebx,dword ptr ds:[esi]
007C7E14 83EE FC sub esi,-4
007C7E17 11DB adc ebx,ebx
007C7E19 ^ 72 ED jb short CJapanes.007C7E08
007C7E1B B8 01000000 mov eax,1
007C7E20 01DB add ebx,ebx
007C7E22 75 07 jnz short CJapanes.007C7E2B
007C7E24 8B1E mov ebx,dword ptr ds:[esi]
007C7E26 83EE FC sub esi,-4
007C7E29 11DB adc ebx,ebx
007C7E2B 11C0 adc eax,eax
007C7E2D 01DB add ebx,ebx
007C7E2F 73 0B jnb short CJapanes.007C7E3C
007C7E31 75 19 jnz short CJapanes.007C7E4C
007C7E33 8B1E mov ebx,dword ptr ds:[esi]
007C7E35 83EE FC sub esi,-4
007C7E38 11DB adc ebx,ebx
007C7E3A 72 10 jb short CJapanes.007C7E4C
007C7E3C 48 dec eax
007C7E3D 01DB add ebx,ebx
007C7E3F 75 07 jnz short CJapanes.007C7E48
007C7E41 8B1E mov ebx,dword ptr ds:[esi]
007C7E43 83EE FC sub esi,-4
007C7E46 11DB adc ebx,ebx
007C7E48 11C0 adc eax,eax
007C7E4A ^ EB D4 jmp short CJapanes.007C7E20
007C7E4C 31C9 xor ecx,ecx
007C7E4E 83E8 03 sub eax,3
007C7E51 72 11 jb short CJapanes.007C7E64
007C7E53 C1E0 08 shl eax,8
007C7E56 8A06 mov al,byte ptr ds:[esi]
007C7E58 46 inc esi
007C7E59 83F0 FF xor eax,FFFFFFFF
007C7E5C 74 78 je short CJapanes.007C7ED6
007C7E5E D1F8 sar eax,1
007C7E60 89C5 mov ebp,eax
007C7E62 EB 0B jmp short CJapanes.007C7E6F
007C7E64 01DB add ebx,ebx
007C7E66 75 07 jnz short CJapanes.007C7E6F
007C7E68 8B1E mov ebx,dword ptr ds:[esi]
007C7E6A 83EE FC sub esi,-4
007C7E6D 11DB adc ebx,ebx
007C7E6F 11C9 adc ecx,ecx
007C7E71 01DB add ebx,ebx
007C7E73 75 07 jnz short CJapanes.007C7E7C
007C7E75 8B1E mov ebx,dword ptr ds:[esi]
007C7E77 83EE FC sub esi,-4
007C7E7A 11DB adc ebx,ebx
007C7E7C 11C9 adc ecx,ecx
007C7E7E 75 20 jnz short CJapanes.007C7EA0
007C7E80 41 inc ecx
007C7E81 01DB add ebx,ebx
007C7E83 75 07 jnz short CJapanes.007C7E8C
007C7E85 8B1E mov ebx,dword ptr ds:[esi]
007C7E87 83EE FC sub esi,-4
007C7E8A 11DB adc ebx,ebx
007C7E8C 11C9 adc ecx,ecx
007C7E8E 01DB add ebx,ebx
007C7E90 ^ 73 EF jnb short CJapanes.007C7E81
007C7E92 75 09 jnz short CJapanes.007C7E9D
007C7E94 8B1E mov ebx,dword ptr ds:[esi]
007C7E96 83EE FC sub esi,-4
007C7E99 11DB adc ebx,ebx
007C7E9B ^ 73 E4 jnb short CJapanes.007C7E81
007C7E9D 83C1 02 add ecx,2
007C7EA0 81FD 00FBFFFF cmp ebp,-500
007C7EA6 83D1 01 adc ecx,1
007C7EA9 8D142F lea edx,dword ptr ds:[edi+ebp>
007C7EAC 83FD FC cmp ebp,-4
007C7EAF 76 0F jbe short CJapanes.007C7EC0
007C7EB1 8A02 mov al,byte ptr ds:[edx]
007C7EB3 42 inc edx
007C7EB4 8807 mov byte ptr ds:[edi],al
007C7EB6 47 inc edi
007C7EB7 49 dec ecx
007C7EB8 ^ 75 F7 jnz short CJapanes.007C7EB1
007C7EBA ^ E9 4FFFFFFF jmp CJapanes.007C7E0E
007C7EBF 90 nop
007C7EC0 8B02 mov eax,dword ptr ds:[edx]
007C7EC2 83C2 04 add edx,4
007C7EC5 8907 mov dword ptr ds:[edi],eax
007C7EC7 83C7 04 add edi,4
007C7ECA 83E9 04 sub ecx,4
007C7ECD ^ 77 F1 ja short CJapanes.007C7EC0
007C7ECF 01CF add edi,ecx
007C7ED1 ^ E9 38FFFFFF jmp CJapanes.007C7E0E
007C7ED6 5E pop esi
007C7ED7 8DBE 00503C00 lea edi,dword ptr ds:[esi+3C5>
007C7EDD 8B07 mov eax,dword ptr ds:[edi]
007C7EDF 09C0 or eax,eax
007C7EE1 74 3C je short CJapanes.007C7F1F
007C7EE3 8B5F 04 mov ebx,dword ptr ds:[edi+4]
007C7EE6 8D8430 609D3C00 lea eax,dword ptr ds:[eax+esi>
007C7EED 01F3 add ebx,esi
007C7EEF 50 push eax
007C7EF0 83C7 08 add edi,8
007C7EF3 FF96 649E3C00 call dword ptr ds:[esi+3C9E64>
007C7EF9 95 xchg eax,ebp
007C7EFA 8A07 mov al,byte ptr ds:[edi]
007C7EFC 47 inc edi
007C7EFD 08C0 or al,al
007C7EFF ^ 74 DC je short CJapanes.007C7EDD
007C7F01 89F9 mov ecx,edi
007C7F03 57 push edi
007C7F04 48 dec eax
007C7F05 F2:AE repne scas byte ptr es:[edi]
007C7F07 55 push ebp
007C7F08 FF96 689E3C00 call dword ptr ds:[esi+3C9E68>
007C7F0E 09C0 or eax,eax
007C7F10 74 07 je short CJapanes.007C7F19
007C7F12 8903 mov dword ptr ds:[ebx],eax
007C7F14 83C3 04 add ebx,4
007C7F17 ^ EB E1 jmp short CJapanes.007C7EFA
007C7F19 FF96 6C9E3C00 call dword ptr ds:[esi+3C9E6C>
007C7F1F 61 popad
007C7F20 ^ E9 DC40F1FF jmp CJapanes.006DC001 // //F4直接来这里
006DC001 60 pushad
006DC002 E8 03000000 call CJapanes.006DC00A
006DC007 - E9 EB045D45 jmp 45CAC4F7
006DC00C 55 push ebp
006DC00D C3 retn
006DC00A 5D pop ebp ; CJapanes.006DC007
006DC00B 45 inc ebp
006DC00C 55 push ebp
006DC00D C3 retn
006DC008 /EB 04 jmp short CJapanes.006DC00E
006DC00E E8 01000000 call CJapanes.006DC014
进入第3层壳
006DC014 5D pop ebp ; CJapanes.006DC013
006DC015 BB EDFFFFFF mov ebx,-13
006DC01A 03DD add ebx,ebp
006DC01C 81EB 00C02D00 sub ebx,2DC000
006DC022 83BD 22040000 0>cmp dword ptr ss:[ebp+422],0
006DC029 899D 22040000 mov dword ptr ss:[ebp+422],eb>
006DC02F 0F85 65030000 jnz CJapanes.006DC39A
006DC035 8D85 2E040000 lea eax,dword ptr ss:[ebp+42E>
006DC03B 50 push eax
006DC03C FF95 4D0F0000 call dword ptr ss:[ebp+F4D]
006DC042 8985 26040000 mov dword ptr ss:[ebp+426],ea>
006DC048 8BF8 mov edi,eax
006DC04A 8D5D 5E lea ebx,dword ptr ss:[ebp+5E]
006DC04D 53 push ebx
006DC04E 50 push eax
006DC04F FF95 490F0000 call dword ptr ss:[ebp+F49]
006DC055 8985 4D050000 mov dword ptr ss:[ebp+54D],ea>
006DC05B 8D5D 6B lea ebx,dword ptr ss:[ebp+6B]
006DC05E 53 push ebx
006DC05F 57 push edi
006DC060 FF95 490F0000 call dword ptr ss:[ebp+F49]
006DC066 8985 51050000 mov dword ptr ss:[ebp+551],ea>
006DC06C 8D45 77 lea eax,dword ptr ss:[ebp+77]
006DC06F FFE0 jmp eax
006DC071 56 push esi
006DC072 6972 74 75616C4>imul esi,dword ptr ds:[edx+74>
006DC079 6C ins byte ptr es:[edi],dx
006DC07A 6C ins byte ptr es:[edi],dx
006DC07B 6F outs dx,dword ptr es:[edi]
006DC07C 6300 arpl word ptr ds:[eax],ax
006DC07E 56 push esi
006DC07F 6972 74 75616C4>imul esi,dword ptr ds:[edx+74>
006DC086 72 65 jb short CJapanes.006DC0ED
006DC088 65:008B 9D31050>add byte ptr gs:[ebx+5319D],c>
006DC08F 000B add byte ptr ds:[ebx],cl
006DC091 DB ??? ; 未知命令
006DC092 74 0A je short CJapanes.006DC09E
006DC094 8B03 mov eax,dword ptr ds:[ebx]
006DC096 8785 35050000 xchg dword ptr ss:[ebp+535],e>
006DC09C 8903 mov dword ptr ds:[ebx],eax
006DC09E 8DB5 69050000 lea esi,dword ptr ss:[ebp+569>
006DC0A4 833E 00 cmp dword ptr ds:[esi],0
006DC0A7 0F84 21010000 je CJapanes.006DC1CE
006DC0AD 6A 04 push 4
006DC0AF 68 00100000 push 1000
006DC0B4 68 00180000 push 1800
006DC0B9 6A 00 push 0
006DC0BB FF95 4D050000 call dword ptr ss:[ebp+54D]
006DC0C1 8985 56010000 mov dword ptr ss:[ebp+156],ea>
006DC0C7 8B46 04 mov eax,dword ptr ds:[esi+4]
006DC0CA 05 0E010000 add eax,10E
006DC0CF 6A 04 push 4
006DC0D1 68 00100000 push 1000
006DC0D6 50 push eax
006DC0D7 6A 00 push 0
006DC0D9 FF95 4D050000 call dword ptr ss:[ebp+54D]
006DC0DF 8985 52010000 mov dword ptr ss:[ebp+152],ea>
006DC0E5 56 push esi
006DC0E6 8B1E mov ebx,dword ptr ds:[esi]
006DC0E8 039D 22040000 add ebx,dword ptr ss:[ebp+422>
006DC0EE FFB5 56010000 push dword ptr ss:[ebp+156]
006DC0F4 FF76 04 push dword ptr ds:[esi+4]
006DC0F7 50 push eax
006DC0F8 53 push ebx
006DC0F9 E8 6E050000 call CJapanes.006DC66C
006DC0FE B3 00 mov bl,0
006DC100 80FB 00 cmp bl,0
006DC103 75 5E jnz short CJapanes.006DC163
006DC105 FE85 EC000000 inc byte ptr ss:[ebp+EC]
006DC10B 8B3E mov edi,dword ptr ds:[esi]
006DC10D 03BD 22040000 add edi,dword ptr ss:[ebp+422>
006DC113 FF37 push dword ptr ds:[edi]
006DC115 C607 C3 mov byte ptr ds:[edi],0C3
006DC118 FFD7 call edi
006DC11A 8F07 pop dword ptr ds:[edi]
006DC11C 50 push eax
006DC11D 51 push ecx
006DC11E 56 push esi
006DC11F 53 push ebx
006DC120 8BC8 mov ecx,eax
006DC122 83E9 06 sub ecx,6
006DC125 8BB5 52010000 mov esi,dword ptr ss:[ebp+152>
006DC12B 33DB xor ebx,ebx
006DC12D 0BC9 or ecx,ecx
006DC12F 74 2E je short CJapanes.006DC15F
006DC131 78 2C js short CJapanes.006DC15F
006DC133 AC lods byte ptr ds:[esi]
006DC134 3C E8 cmp al,0E8
006DC136 74 0A je short CJapanes.006DC142
006DC138 EB 00 jmp short CJapanes.006DC13A
006DC13A 3C E9 cmp al,0E9
006DC13C 74 04 je short CJapanes.006DC142
006DC13E 43 inc ebx
006DC13F 49 dec ecx
006DC140 ^ EB EB jmp short CJapanes.006DC12D
006DC142 8B06 mov eax,dword ptr ds:[esi]
006DC144 EB 0A jmp short CJapanes.006DC150
006DC146 803E 00 cmp byte ptr ds:[esi],0
006DC149 ^ 75 F3 jnz short CJapanes.006DC13E
006DC14B 24 00 and al,0
006DC14D C1C0 18 rol eax,18
006DC150 2BC3 sub eax,ebx
006DC152 8906 mov dword ptr ds:[esi],eax
006DC154 83C3 05 add ebx,5
006DC157 83C6 04 add esi,4
006DC15A 83E9 05 sub ecx,5
006DC15D ^ EB CE jmp short CJapanes.006DC12D
006DC15F 5B pop ebx
006DC160 5E pop esi
006DC161 59 pop ecx
006DC162 58 pop eax
006DC163 EB 08 jmp short CJapanes.006DC16D
006DC165 0000 add byte ptr ds:[eax],al
006DC167 0000 add byte ptr ds:[eax],al
006DC169 0000 add byte ptr ds:[eax],al
006DC16B 0000 add byte ptr ds:[eax],al
006DC16D 8BC8 mov ecx,eax
006DC16F 8B3E mov edi,dword ptr ds:[esi]
006DC171 03BD 22040000 add edi,dword ptr ss:[ebp+422>
006DC177 8BB5 52010000 mov esi,dword ptr ss:[ebp+152>
006DC17D C1F9 02 sar ecx,2
006DC180 F3:A5 rep movs dword ptr es:[edi],d>
006DC182 8BC8 mov ecx,eax
006DC184 83E1 03 and ecx,3
006DC187 F3:A4 rep movs byte ptr es:[edi],by>
006DC189 5E pop esi
006DC18A 68 00800000 push 8000
006DC18F 6A 00 push 0
006DC191 FFB5 52010000 push dword ptr ss:[ebp+152]
006DC197 FF95 51050000 call dword ptr ss:[ebp+551]
006DC19D 83C6 08 add esi,8
006DC1A0 833E 00 cmp dword ptr ds:[esi],0
006DC1A3 ^ 0F85 1EFFFFFF jnz CJapanes.006DC0C7
006DC1A9 68 00800000 push 8000
006DC1AE 6A 00 push 0
006DC1B0 FFB5 56010000 push dword ptr ss:[ebp+156]
006DC1B6 FF95 51050000 call dword ptr ss:[ebp+551]
006DC1BC 8B9D 31050000 mov ebx,dword ptr ss:[ebp+531>
006DC1C2 0BDB or ebx,ebx
006DC1C4 74 08 je short CJapanes.006DC1CE
006DC1C6 8B03 mov eax,dword ptr ds:[ebx]
006DC1C8 8785 35050000 xchg dword ptr ss:[ebp+535],e>
006DC1CE 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
006DC1D4 8B85 2D050000 mov eax,dword ptr ss:[ebp+52D>
006DC1DA 2BD0 sub edx,eax
006DC1DC 74 79 je short CJapanes.006DC257
006DC1DE 8BC2 mov eax,edx
006DC1E0 C1E8 10 shr eax,10
006DC1E3 33DB xor ebx,ebx
006DC1E5 8BB5 39050000 mov esi,dword ptr ss:[ebp+539>
006DC1EB 03B5 22040000 add esi,dword ptr ss:[ebp+422>
006DC1F1 833E 00 cmp dword ptr ds:[esi],0
006DC1F4 74 61 je short CJapanes.006DC257
006DC1F6 8B4E 04 mov ecx,dword ptr ds:[esi+4]
006DC1F9 83E9 08 sub ecx,8
006DC1FC D1E9 shr ecx,1
006DC1FE 8B3E mov edi,dword ptr ds:[esi]
006DC200 03BD 22040000 add edi,dword ptr ss:[ebp+422>
006DC206 83C6 08 add esi,8
006DC209 66:8B1E mov bx,word ptr ds:[esi]
006DC20C C1EB 0C shr ebx,0C
006DC20F 83FB 01 cmp ebx,1
006DC212 74 0C je short CJapanes.006DC220
006DC214 83FB 02 cmp ebx,2
006DC217 74 16 je short CJapanes.006DC22F
006DC219 83FB 03 cmp ebx,3
006DC21C 74 20 je short CJapanes.006DC23E
006DC21E EB 2C jmp short CJapanes.006DC24C
006DC220 66:8B1E mov bx,word ptr ds:[esi]
006DC223 81E3 FF0F0000 and ebx,0FFF
006DC229 66:01041F add word ptr ds:[edi+ebx],ax
006DC22D EB 1D jmp short CJapanes.006DC24C
006DC22F 66:8B1E mov bx,word ptr ds:[esi]
006DC232 81E3 FF0F0000 and ebx,0FFF
006DC238 66:01141F add word ptr ds:[edi+ebx],dx
006DC23C EB 0E jmp short CJapanes.006DC24C
006DC23E 66:8B1E mov bx,word ptr ds:[esi]
006DC241 81E3 FF0F0000 and ebx,0FFF
006DC247 01141F add dword ptr ds:[edi+ebx],ed>
006DC24A EB 00 jmp short CJapanes.006DC24C
006DC24C 66:830E FF or word ptr ds:[esi],0FFFF
006DC250 83C6 02 add esi,2
006DC253 ^ E2 B4 loopd short CJapanes.006DC209
006DC255 ^ EB 9A jmp short CJapanes.006DC1F1
006DC257 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
006DC25D 8BB5 41050000 mov esi,dword ptr ss:[ebp+541>
006DC263 0BF6 or esi,esi
006DC265 74 11 je short CJapanes.006DC278
006DC267 03F2 add esi,edx
006DC269 AD lods dword ptr ds:[esi]
006DC26A 0BC0 or eax,eax
006DC26C 74 0A je short CJapanes.006DC278
006DC26E 03C2 add eax,edx
006DC270 8BF8 mov edi,eax
006DC272 66:AD lods word ptr ds:[esi]
006DC274 66:AB stos word ptr es:[edi]
006DC276 ^ EB F1 jmp short CJapanes.006DC269
006DC278 BE 607D2600 mov esi,267D60
006DC27D 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
006DC283 03F2 add esi,edx
006DC285 8B46 0C mov eax,dword ptr ds:[esi+C]
006DC288 85C0 test eax,eax
006DC28A 0F84 0A010000 je CJapanes.006DC39A
006DC290 03C2 add eax,edx
006DC292 8BD8 mov ebx,eax
006DC294 50 push eax
006DC295 FF95 4D0F0000 call dword ptr ss:[ebp+F4D]
006DC29B 85C0 test eax,eax
006DC29D 75 07 jnz short CJapanes.006DC2A6
006DC29F 53 push ebx
006DC2A0 FF95 510F0000 call dword ptr ss:[ebp+F51]
006DC2A6 8985 45050000 mov dword ptr ss:[ebp+545],ea>
006DC2AC C785 49050000 0>mov dword ptr ss:[ebp+549],0
006DC2B6 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
006DC2BC 8B06 mov eax,dword ptr ds:[esi]
006DC2BE 85C0 test eax,eax
006DC2C0 75 03 jnz short CJapanes.006DC2C5
006DC2C2 8B46 10 mov eax,dword ptr ds:[esi+10]
006DC2C5 03C2 add eax,edx
006DC2C7 0385 49050000 add eax,dword ptr ss:[ebp+549>
006DC2CD 8B18 mov ebx,dword ptr ds:[eax]
006DC2CF 8B7E 10 mov edi,dword ptr ds:[esi+10]
006DC2D2 03FA add edi,edx
006DC2D4 03BD 49050000 add edi,dword ptr ss:[ebp+549>
006DC2DA 85DB test ebx,ebx
006DC2DC 0F84 A2000000 je CJapanes.006DC384
006DC2E2 F7C3 00000080 test ebx,80000000
006DC2E8 75 04 jnz short CJapanes.006DC2EE
006DC2EA 03DA add ebx,edx
006DC2EC 43 inc ebx
006DC2ED 43 inc ebx
006DC2EE 53 push ebx
006DC2EF 81E3 FFFFFF7F and ebx,7FFFFFFF
006DC2F5 53 push ebx
006DC2F6 FFB5 45050000 push dword ptr ss:[ebp+545]
006DC2FC FF95 490F0000 call dword ptr ss:[ebp+F49]
006DC302 85C0 test eax,eax
006DC304 5B pop ebx
006DC305 75 6F jnz short CJapanes.006DC376
006DC307 F7C3 00000080 test ebx,80000000
006DC30D 75 19 jnz short CJapanes.006DC328
006DC30F 57 push edi
006DC310 8B46 0C mov eax,dword ptr ds:[esi+C]
006DC313 0385 22040000 add eax,dword ptr ss:[ebp+422>
006DC319 50 push eax
006DC31A 53 push ebx
006DC31B 8D85 75040000 lea eax,dword ptr ss:[ebp+475>
006DC321 50 push eax
006DC322 57 push edi
006DC323 E9 98000000 jmp CJapanes.006DC3C0
006DC328 81E3 FFFFFF7F and ebx,7FFFFFFF
006DC32E 8B85 26040000 mov eax,dword ptr ss:[ebp+426>
006DC334 3985 45050000 cmp dword ptr ss:[ebp+545],ea>
006DC33A 75 24 jnz short CJapanes.006DC360
006DC33C 57 push edi
006DC33D 8BD3 mov edx,ebx
006DC33F 4A dec edx
006DC340 C1E2 02 shl edx,2
006DC343 8B9D 45050000 mov ebx,dword ptr ss:[ebp+545>
006DC349 8B7B 3C mov edi,dword ptr ds:[ebx+3C]
006DC34C 8B7C3B 78 mov edi,dword ptr ds:[ebx+edi>
006DC350 035C3B 1C add ebx,dword ptr ds:[ebx+edi>
006DC354 8B0413 mov eax,dword ptr ds:[ebx+edx>
006DC357 0385 45050000 add eax,dword ptr ss:[ebp+545>
006DC35D 5F pop edi
006DC35E EB 16 jmp short CJapanes.006DC376
006DC360 57 push edi
006DC361 8B46 0C mov eax,dword ptr ds:[esi+C]
006DC364 0385 22040000 add eax,dword ptr ss:[ebp+422>
006DC36A 50 push eax
006DC36B 53 push ebx
006DC36C 8D85 C6040000 lea eax,dword ptr ss:[ebp+4C6>
006DC372 50 push eax
006DC373 57 push edi
006DC374 EB 4A jmp short CJapanes.006DC3C0
006DC376 8907 mov dword ptr ds:[edi],eax
006DC378 8385 49050000 0>add dword ptr ss:[ebp+549],4
006DC37F ^ E9 32FFFFFF jmp CJapanes.006DC2B6
006DC384 8906 mov dword ptr ds:[esi],eax
006DC386 8946 0C mov dword ptr ds:[esi+C],eax
006DC389 8946 10 mov dword ptr ds:[esi+10],eax
006DC38C 83C6 14 add esi,14
006DC38F 8B95 22040000 mov edx,dword ptr ss:[ebp+422>
006DC395 ^ E9 EBFEFFFF jmp CJapanes.006DC285
006DC39A B8 604A2600 mov eax,264A60
006DC39F 50 push eax
006DC3A0 0385 22040000 add eax,dword ptr ss:[ebp+422>
006DC3A6 59 pop ecx
006DC3A7 0BC9 or ecx,ecx
006DC3A9 8985 A8030000 mov dword ptr ss:[ebp+3A8],ea>
006DC3AF 61 popad
006DC3B0 75 08 jnz short CJapanes.006DC3BA
006DC3B2 B8 01000000 mov eax,1
006DC3B7 C2 0C00 retn 0C
006DC3BA 68 604A6600 push CJapanes.00664A60 // //F4直接来这里
006DC3BF C3 retn
返回到 00664A60 (CJapanes.00664A60)
进入第4层壳 还是UPX
00664A60 60 pushad
00664A61 BE 00205700 mov esi,CJapanes.00572000
00664A66 8DBE 00F0E8FF lea edi,dword ptr ds:[esi+FFE>
00664A6C C787 CC601B00 1>mov dword ptr ds:[edi+1B60CC]>
00664A76 57 push edi
00664A77 83CD FF or ebp,FFFFFFFF
00664A7A EB 0E jmp short CJapanes.00664A8A
00664A7C 90 nop
00664A7D 90 nop
00664A7E 90 nop
00664A7F 90 nop
00664A80 8A06 mov al,byte ptr ds:[esi]
00664A82 46 inc esi
00664A83 8807 mov byte ptr ds:[edi],al
00664A85 47 inc edi
00664A86 01DB add ebx,ebx
00664A88 75 07 jnz short CJapanes.00664A91
00664A8A 8B1E mov ebx,dword ptr ds:[esi]
00664A8C 83EE FC sub esi,-4
00664A8F 11DB adc ebx,ebx
00664A91 ^ 72 ED jb short CJapanes.00664A80
00664A93 B8 01000000 mov eax,1
00664A98 01DB add ebx,ebx
00664A9A 75 07 jnz short CJapanes.00664AA3
00664A9C 8B1E mov ebx,dword ptr ds:[esi]
00664A9E 83EE FC sub esi,-4
00664AA1 11DB adc ebx,ebx
00664AA3 11C0 adc eax,eax
00664AA5 01DB add ebx,ebx
00664AA7 73 0B jnb short CJapanes.00664AB4
00664AA9 75 19 jnz short CJapanes.00664AC4
00664AAB 8B1E mov ebx,dword ptr ds:[esi]
00664AAD 83EE FC sub esi,-4
00664AB0 11DB adc ebx,ebx
00664AB2 72 10 jb short CJapanes.00664AC4
00664AB4 48 dec eax
00664AB5 01DB add ebx,ebx
00664AB7 75 07 jnz short CJapanes.00664AC0
00664AB9 8B1E mov ebx,dword ptr ds:[esi]
00664ABB 83EE FC sub esi,-4
00664ABE 11DB adc ebx,ebx
00664AC0 11C0 adc eax,eax
00664AC2 ^ EB D4 jmp short CJapanes.00664A98
00664AC4 31C9 xor ecx,ecx
00664AC6 83E8 03 sub eax,3
00664AC9 72 11 jb short CJapanes.00664ADC
00664ACB C1E0 08 shl eax,8
00664ACE 8A06 mov al,byte ptr ds:[esi]
00664AD0 46 inc esi
00664AD1 83F0 FF xor eax,FFFFFFFF
00664AD4 74 78 je short CJapanes.00664B4E
00664AD6 D1F8 sar eax,1
00664AD8 89C5 mov ebp,eax
00664ADA EB 0B jmp short CJapanes.00664AE7
00664ADC 01DB add ebx,ebx
00664ADE 75 07 jnz short CJapanes.00664AE7
00664AE0 8B1E mov ebx,dword ptr ds:[esi]
00664AE2 83EE FC sub esi,-4
00664AE5 11DB adc ebx,ebx
00664AE7 11C9 adc ecx,ecx
00664AE9 01DB add ebx,ebx
00664AEB 75 07 jnz short CJapanes.00664AF4
00664AED 8B1E mov ebx,dword ptr ds:[esi]
00664AEF 83EE FC sub esi,-4
00664AF2 11DB adc ebx,ebx
00664AF4 11C9 adc ecx,ecx
00664AF6 75 20 jnz short CJapanes.00664B18
00664AF8 41 inc ecx
00664AF9 01DB add ebx,ebx
00664AFB 75 07 jnz short CJapanes.00664B04
00664AFD 8B1E mov ebx,dword ptr ds:[esi]
00664AFF 83EE FC sub esi,-4
00664B02 11DB adc ebx,ebx
00664B04 11C9 adc ecx,ecx
00664B06 01DB add ebx,ebx
00664B08 ^ 73 EF jnb short CJapanes.00664AF9
00664B0A 75 09 jnz short CJapanes.00664B15
00664B0C 8B1E mov ebx,dword ptr ds:[esi]
00664B0E 83EE FC sub esi,-4
00664B11 11DB adc ebx,ebx
00664B13 ^ 73 E4 jnb short CJapanes.00664AF9
00664B15 83C1 02 add ecx,2
00664B18 81FD 00FBFFFF cmp ebp,-500
00664B1E 83D1 01 adc ecx,1
00664B21 8D142F lea edx,dword ptr ds:[edi+ebp>
00664B24 83FD FC cmp ebp,-4
00664B27 76 0F jbe short CJapanes.00664B38
00664B29 8A02 mov al,byte ptr ds:[edx]
00664B2B 42 inc edx
00664B2C 8807 mov byte ptr ds:[edi],al
00664B2E 47 inc edi
00664B2F 49 dec ecx
00664B30 ^ 75 F7 jnz short CJapanes.00664B29
00664B32 ^ E9 4FFFFFFF jmp CJapanes.00664A86
00664B37 90 nop
00664B38 8B02 mov eax,dword ptr ds:[edx]
00664B3A 83C2 04 add edx,4
00664B3D 8907 mov dword ptr ds:[edi],eax
00664B3F 83C7 04 add edi,4
00664B42 83E9 04 sub ecx,4
00664B45 ^ 77 F1 ja short CJapanes.00664B38
00664B47 01CF add edi,ecx
00664B49 ^ E9 38FFFFFF jmp CJapanes.00664A86
00664B4E 5E pop esi
00664B4F 89F7 mov edi,esi
00664B51 B9 25E00000 mov ecx,0E025
00664B56 8A07 mov al,byte ptr ds:[edi]
00664B58 47 inc edi
00664B59 2C E8 sub al,0E8
00664B5B 3C 01 cmp al,1
00664B5D ^ 77 F7 ja short CJapanes.00664B56
00664B5F 803F 25 cmp byte ptr ds:[edi],25
00664B62 ^ 75 F2 jnz short CJapanes.00664B56
00664B64 8B07 mov eax,dword ptr ds:[edi]
00664B66 8A5F 04 mov bl,byte ptr ds:[edi+4]
00664B69 66:C1E8 08 shr ax,8
00664B6D C1C0 10 rol eax,10
00664B70 86C4 xchg ah,al
00664B72 29F8 sub eax,edi
00664B74 80EB E8 sub bl,0E8
00664B77 01F0 add eax,esi
00664B79 8907 mov dword ptr ds:[edi],eax
00664B7B 83C7 05 add edi,5
00664B7E 89D8 mov eax,ebx
00664B80 ^ E2 D9 loopd short CJapanes.00664B5B
00664B82 8DBE 00302500 lea edi,dword ptr ds:[esi+253>
00664B88 8B07 mov eax,dword ptr ds:[edi]
00664B8A 09C0 or eax,eax
00664B8C 74 3C je short CJapanes.00664BCA
00664B8E 8B5F 04 mov ebx,dword ptr ds:[edi+4]
00664B91 8D8430 606D2600 lea eax,dword ptr ds:[eax+esi>
00664B98 01F3 add ebx,esi
00664B9A 50 push eax
00664B9B 83C7 08 add edi,8
00664B9E FF96 646E2600 call dword ptr ds:[esi+266E64>
00664BA4 95 xchg eax,ebp
00664BA5 8A07 mov al,byte ptr ds:[edi]
00664BA7 47 inc edi
00664BA8 08C0 or al,al
00664BAA ^ 74 DC je short CJapanes.00664B88
00664BAC 89F9 mov ecx,edi
00664BAE 57 push edi
00664BAF 48 dec eax
00664BB0 F2:AE repne scas byte ptr es:[edi]
00664BB2 55 push ebp
00664BB3 FF96 686E2600 call dword ptr ds:[esi+266E68>
00664BB9 09C0 or eax,eax
00664BBB 74 07 je short CJapanes.00664BC4
00664BBD 8903 mov dword ptr ds:[ebx],eax
00664BBF 83C3 04 add ebx,4
00664BC2 ^ EB E1 jmp short CJapanes.00664BA5
00664BC4 FF96 6C6E2600 call dword ptr ds:[esi+266E6C>
00664BCA 83C7 04 add edi,4
00664BCD 8D5E FC lea ebx,dword ptr ds:[esi-4]
00664BD0 31C0 xor eax,eax
00664BD2 8A07 mov al,byte ptr ds:[edi]
00664BD4 47 inc edi
00664BD5 09C0 or eax,eax
00664BD7 74 22 je short CJapanes.00664BFB
00664BD9 3C EF cmp al,0EF
00664BDB 77 11 ja short CJapanes.00664BEE
00664BDD 01C3 add ebx,eax
00664BDF 8B03 mov eax,dword ptr ds:[ebx]
00664BE1 86C4 xchg ah,al
00664BE3 C1C0 10 rol eax,10
00664BE6 86C4 xchg ah,al
00664BE8 01F0 add eax,esi
00664BEA 8903 mov dword ptr ds:[ebx],eax
00664BEC ^ EB E2 jmp short CJapanes.00664BD0
00664BEE 24 0F and al,0F
00664BF0 C1E0 10 shl eax,10
00664BF3 66:8B07 mov ax,word ptr ds:[edi]
00664BF6 83C7 02 add edi,2
00664BF9 ^ EB E2 jmp short CJapanes.00664BDD
00664BFB 61 popad
00664BFC - E9 6F17F5FF jmp CJapanes.005B6370 // //F4直接来这里
OEP
005B6370 55 push ebp //DUMP
005B6371 8BEC mov ebp,esp
005B6373 83C4 F0 add esp,-10
005B6376 B8 A05F5B00 mov eax,CJapanes.005B5FA0
005B637B E8 000AE5FF call CJapanes.00406D80
005B6380 8B0D 3CE75B00 mov ecx,dword ptr ds:[5BE73C] ; CJapanes.005BFBEC
005B6386 8B09 mov ecx,dword ptr ds:[ecx]
005B6388 B2 01 mov dl,1
005B638A A1 504F5900 mov eax,dword ptr ds:[594F50]
005B638F E8 A457EBFF call CJapanes.0046BB38
005B6394 8B15 ECE45B00 mov edx,dword ptr ds:[5BE4EC] ; CJapanes.005C0034
ImportREC修复一下就可以运行了。
用PEID检测为Borland Delphi 6.0 - 7.0
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!
赞赏
他的文章
- [推荐]发个记事本大家玩玩 4280
- [原创]桌面天气秀3.7 分析篇 14444
- [下载]unpacked aUS v0.5 3297
- 快速脱EXEStealth + ACProtect篇[原创] 5767
- SoftSentry 2.11脱壳 6959
看原图
赞赏
雪币:
留言: