00405880 /$ 6A FF push -1
00405882 |. 68 CEA04200 push SameBall.0042A0CE ; SE 句柄安装
00405887 |. 64:A1 00000000 mov eax,dword ptr fs:[0]
0040588D |. 50 push eax
0040588E |. 64:8925 000000>mov dword ptr fs:[0],esp
00405895 |. 81EC 30010000 sub esp,130
0040589B |. 56 push esi
0040589C |. 57 push edi
0040589D |. C74424 10 0000>mov dword ptr ss:[esp+10],0
004058A5 |. 8D8C24 A800000>lea ecx,dword ptr ss:[esp+A8]
004058AC |. C78424 4001000>mov dword ptr ss:[esp+140],1
004058B7 |. E8 A4B7FFFF call SameBall.00401060
004058BC |. 8D4C24 18 lea ecx,dword ptr ss:[esp+18]
004058C0 |. C68424 4001000>mov byte ptr ss:[esp+140],2
004058C8 |. E8 93B7FFFF call SameBall.00401060
004058CD |. A1 34774300 mov eax,dword ptr ds:[437734]
004058D2 |. 894424 0C mov dword ptr ss:[esp+C],eax
004058D6 |. 894424 08 mov dword ptr ss:[esp+8],eax
004058DA |. 68 C0744300 push SameBall.004374C0 ; ASCII "CFBCC6EC474AE5CD0F7BC8DBBA353A11"
004058DF |. 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
004058E3 |. C68424 4401000>mov byte ptr ss:[esp+144],5
004058EB |. E8 BE900100 call SameBall.0041E9AE
004058F0 |. 68 9C744300 push SameBall.0043749C ; ASCII "8231FC324594496514663D91E6C19989"
004058F5 |. 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
004058F9 |. E8 B0900100 call SameBall.0041E9AE
004058FE |. 8D4424 0C lea eax,dword ptr ss:[esp+C]
00405902 |. 6A 10 push 10 ; /Arg2 = 00000010
00405904 |. 50 push eax ; |Arg1
00405905 |. 8D8C24 B000000>lea ecx,dword ptr ss:[esp+B0] ; |
0040590C |. E8 BFBFFFFF call SameBall.004018D0 ; \SameBall.004018D0
00405911 |. 8D4C24 08 lea ecx,dword ptr ss:[esp+8]
00405915 |. 6A 10 push 10 ; /Arg2 = 00000010
00405917 |. 51 push ecx ; |Arg1
00405918 |. 8D4C24 20 lea ecx,dword ptr ss:[esp+20] ; |
0040591C |. E8 AFBFFFFF call SameBall.004018D0 ; \SameBall.004018D0
00405921 |. 81EC 90000000 sub esp,90
00405927 |. B9 24000000 mov ecx,24
0040592C |. 8DB424 3801000>lea esi,dword ptr ss:[esp+138]
00405933 |. 8BFC mov edi,esp
00405935 |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi]
00405937 |. 81EC 90000000 sub esp,90
0040593D |. B9 24000000 mov ecx,24
00405942 |. 8DB424 3801000>lea esi,dword ptr ss:[esp+138]
00405949 |. 8BFC mov edi,esp
0040594B |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi]
0040594D |. 51 push ecx
0040594E |. 8D9424 7002000>lea edx,dword ptr ss:[esp+270]
00405955 |. 8BCC mov ecx,esp
00405957 |. 89A424 3801000>mov dword ptr ss:[esp+138],esp
0040595E |. 52 push edx
0040595F |. E8 7A8C0100 call SameBall.0041E5DE
00405964 |. 8BB424 6C02000>mov esi,dword ptr ss:[esp+26C]
0040596B |. 56 push esi
0040596C |. E8 FFFCFFFF call SameBall.00405670
00405971 |. 81C4 28010000 add esp,128
00405977 |. C74424 10 0100>mov dword ptr ss:[esp+10],1
0040597F |. 8D4C24 08 lea ecx,dword ptr ss:[esp+8]
00405983 |. C68424 4001000>mov byte ptr ss:[esp+140],4
0040598B |. E8 D98E0100 call SameBall.0041E869
00405990 |. 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
00405994 |. C68424 4001000>mov byte ptr ss:[esp+140],3
0040599C |. E8 C88E0100 call SameBall.0041E869
004059A1 |. 8D4C24 18 lea ecx,dword ptr ss:[esp+18]
004059A5 |. C68424 4001000>mov byte ptr ss:[esp+140],2
004059AD |. E8 3EE7FFFF call SameBall.004040F0
004059B2 |. 8D8C24 A800000>lea ecx,dword ptr ss:[esp+A8]
004059B9 |. C68424 4001000>mov byte ptr ss:[esp+140],1
004059C1 |. E8 2AE7FFFF call SameBall.004040F0
004059C6 |. 8D8C24 4C01000>lea ecx,dword ptr ss:[esp+14C]
004059CD |. C68424 4001000>mov byte ptr ss:[esp+140],0
004059D5 |. E8 8F8E0100 call SameBall.0041E869
004059DA |. 8B8C24 3801000>mov ecx,dword ptr ss:[esp+138]
004059E1 |. 8BC6 mov eax,esi
004059E3 |. 5F pop edi
004059E4 |. 64:890D 000000>mov dword ptr fs:[0],ecx
004059EB |. 5E pop esi
004059EC |. 81C4 3C010000 add esp,13C
004059F2 \. C3 retn
[课程]FART 脱壳王！加量不加价！FART作者讲授！
