0042E5E1 . 8B40 1C MOV EAX, DWORD PTR DS:[EAX+0x1C]
0042E5E4 . 8B35 74C54A00 MOV ESI, DWORD PTR DS:[<&USER32.SendMess>; user32.SendMessageA
0042E5EA . 6A 00 PUSH 0x0 ; /lParam = 0x0
0042E5EC . 6A 00 PUSH 0x0 ; |wParam = 0x0
0042E5EE . 68 F0000000 PUSH 0xF0 ; |Message = BM_GETCHECK
0042E5F3 . 50 PUSH EAX ; |hWnd = NULL
0042E5F4 . FFD6 CALL ESI ; \SendMessageA
0042E5F6 . 85C0 TEST EAX, EAX
0042E5F8 . 74 33 JE SHORT 0042E62D ;
0042E5FA . C74424 10 000>MOV DWORD PTR SS:[ESP+0x10], 0x0
0042E602 > 8BCD MOV ECX, EBP
0042E604 . E8 87F8FFFF CALL 0042DE90
0042E609 . 85C0 TEST EAX, EAX
0042E60B . 75 6A JNZ SHORT 0042E677 ;
0042E60D . 50 PUSH EAX
0042E60E . 6A 30 PUSH 0x30
0042E610 . 68 741C4B00 PUSH 004B1C74 ; ASCII "注册信息不正确！"
0042E615 . E8 1A690600 CALL 00494F34
0042E61A . 8B4C24 5C MOV ECX, DWORD PTR SS:[ESP+0x5C]
0042E61E . 64:890D 00000>MOV DWORD PTR FS:[0], ECX
0042E625 . 5F POP EDI ; kernel32.7C816037
0042E626 . 5E POP ESI ; kernel32.7C816037
0042E627 . 5D POP EBP ; kernel32.7C816037
0042E628 . 5B POP EBX ; kernel32.7C816037
0042E629 . 83C4 58 ADD ESP, 0x58
0042E62C . C3 RETN
0042E62D > 68 4F040000 PUSH 0x44F
0042E632 . 8BCD MOV ECX, EBP
0042E634 . E8 31090600 CALL 0048EF6A
0042E639 . 8B48 1C MOV ECX, DWORD PTR DS:[EAX+0x1C]
0042E63C . 6A 00 PUSH 0x0
0042E63E . 6A 00 PUSH 0x0
0042E640 . 68 F0000000 PUSH 0xF0
0042E645 . 51 PUSH ECX
0042E646 . FFD6 CALL ESI
0042E648 . 85C0 TEST EAX, EAX
0042E64A . 74 0A JE SHORT 0042E656
0042E64C . C74424 10 010>MOV DWORD PTR SS:[ESP+0x10], 0x1
0042E654 .^ EB AC JMP SHORT 0042E602
0042E656 > 6A 00 PUSH 0x0
0042E658 . 6A 30 PUSH 0x30
0042E65A . 68 601C4B00 PUSH 004B1C60 ; ASCII "注册类型不正确！"
0042E65F . E8 D0680600 CALL 00494F34
0042E664 . 8B4C24 5C MOV ECX, DWORD PTR SS:[ESP+0x5C]
0042E668 . 64:890D 00000>MOV DWORD PTR FS:[0], ECX
0042E66F . 5F POP EDI ; kernel32.7C816037
0042E670 . 5E POP ESI ; kernel32.7C816037
0042E671 . 5D POP EBP ; kernel32.7C816037
0042E672 . 5B POP EBX ; kernel32.7C816037
0042E673 . 83C4 58 ADD ESP, 0x58
0042E676 . C3 RETN
0042E677 > 8D8D CC000000 LEA ECX, DWORD PTR SS:[EBP+0xCC]
0042E67D . E8 4E2EFDFF CALL 004014D0
0042E682 . 51 PUSH ECX
0042E683 . 8BF0 MOV ESI, EAX
0042E685 . 8BCC MOV ECX, ESP
0042E687 . 896424 24 MOV DWORD PTR SS:[ESP+0x24], ESP
0042E68B . 56 PUSH ESI
0042E68C . E8 9F2CFDFF CALL 00401330
0042E691 . 8B0D 386E4D00 MOV ECX, DWORD PTR DS:[0x4D6E38]
0042E697 . E8 943BFDFF CALL 00402230
0042E69C . 51 PUSH ECX
0042E69D . 8BCC MOV ECX, ESP
0042E69F . 896424 24 MOV DWORD PTR SS:[ESP+0x24], ESP
0042E6A3 . 56 PUSH ESI
0042E6A4 . 8BF8 MOV EDI, EAX
0042E6A6 . E8 852CFDFF CALL 00401330
0042E6AB . 8B0D 386E4D00 MOV ECX, DWORD PTR DS:[0x4D6E38]
0042E6B1 . E8 FA3BFDFF CALL 004022B0
0042E6B6 . 8B95 C8000000 MOV EDX, DWORD PTR SS:[EBP+0xC8]
0042E6BC . 8B8D C0000000 MOV ECX, DWORD PTR SS:[EBP+0xC0]
0042E6C2 . 895424 18 MOV DWORD PTR SS:[ESP+0x18], EDX ; ntdll.KiFastSystemCallRet
0042E6C6 . 8B15 58124D00 MOV EDX, DWORD PTR DS:[0x4D1258] ; 复件_Eas.004ACA7C
0042E6CC . 52 PUSH EDX ; ntdll.KiFastSystemCallRet
0042E6CD . 50 PUSH EAX
0042E6CE . 8B4424 20 MOV EAX, DWORD PTR SS:[ESP+0x20] ; kernel32.7C839B48
0042E6D2 . 57 PUSH EDI ; ntdll.7C930208
0042E6D3 . 51 PUSH ECX
0042E6D4 . 8B4C24 20 MOV ECX, DWORD PTR SS:[ESP+0x20] ; kernel32.7C839B48
0042E6D8 . 50 PUSH EAX
0042E6D9 . 8B85 C4000000 MOV EAX, DWORD PTR SS:[EBP+0xC4]
0042E6DF . 8D9D C4000000 LEA EBX, DWORD PTR SS:[EBP+0xC4]
0042E6E5 . 51 PUSH ECX
0042E6E6 . 50 PUSH EAX
0042E6E7 . E8 E4750100 CALL 00445CD0
0042E6EC . 83C4 1C ADD ESP, 0x1C
0042E6EF . 85C0 TEST EAX, EAX
0042E6F1 . 0F84 D5010000 JE 0042E8CC
0042E6F7 . 8B15 58124D00 MOV EDX, DWORD PTR DS:[0x4D1258] ; 复件_Eas.004ACA7C
0042E6FD . 52 PUSH EDX ; ntdll.KiFastSystemCallRet
0042E6FE . 8D4C24 1C LEA ECX, DWORD PTR SS:[ESP+0x1C]
0042E702 . E8 4935FDFF CALL 00401C50
0042E707 . 8BC8 MOV ECX, EAX
0042E709 . C74424 64 000>MOV DWORD PTR SS:[ESP+0x64], 0x0
0042E711 . E8 BA2DFDFF CALL 004014D0
0042E716 . 8BF8 MOV EDI, EAX
0042E718 . 8B4424 18 MOV EAX, DWORD PTR SS:[ESP+0x18]
0042E71C . 83C0 F0 ADD EAX, -0x10
0042E71F . C74424 64 FFF>MOV DWORD PTR SS:[ESP+0x64], -0x1
0042E727 . 8D48 0C LEA ECX, DWORD PTR DS:[EAX+0xC]
0042E72A . 83CA FF OR EDX, 0xFFFFFFFF
0042E72D . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX], EDX ; ntdll.KiFastSystemCallRet
0042E731 . 4A DEC EDX ; ntdll.KiFastSystemCallRet
0042E732 . 85D2 TEST EDX, EDX ; ntdll.KiFastSystemCallRet
0042E734 . 7F 08 JG SHORT 0042E73E
0042E736 . 8B08 MOV ECX, DWORD PTR DS:[EAX]
0042E738 . 8B11 MOV EDX, DWORD PTR DS:[ECX] ; ntdll.7C92DC9C
0042E73A . 50 PUSH EAX
0042E73B . FF52 04 CALL DWORD PTR DS:[EDX+0x4]
0042E73E > 8BCB MOV ECX, EBX
0042E740 . E8 8B2DFDFF CALL 004014D0
0042E745 . 8D8D C8000000 LEA ECX, DWORD PTR SS:[EBP+0xC8]
0042E74B . 8BD8 MOV EBX, EAX
0042E74D . E8 7E2DFDFF CALL 004014D0
0042E752 . 53 PUSH EBX
0042E753 . 57 PUSH EDI ; ntdll.7C930208
0042E754 . 894424 20 MOV DWORD PTR SS:[ESP+0x20], EAX
0042E758 . A1 386E4D00 MOV EAX, DWORD PTR DS:[0x4D6E38]
0042E75D . 8B08 MOV ECX, DWORD PTR DS:[EAX]
0042E75F . 56 PUSH ESI
0042E760 . 50 PUSH EAX
0042E761 . FF51 48 CALL DWORD PTR DS:[ECX+0x48] ; 复件_Eas.<ModuleEntryPoint>
0042E764 . 8B4C24 10 MOV ECX, DWORD PTR SS:[ESP+0x10]
0042E768 . A1 386E4D00 MOV EAX, DWORD PTR DS:[0x4D6E38]
0042E76D . 8B10 MOV EDX, DWORD PTR DS:[EAX]
0042E76F . 51 PUSH ECX
0042E770 . 57 PUSH EDI ; ntdll.7C930208
0042E771 . 56 PUSH ESI
0042E772 . 50 PUSH EAX
0042E773 . FF52 50 CALL DWORD PTR DS:[EDX+0x50]
0042E776 . 8B85 C0000000 MOV EAX, DWORD PTR SS:[EBP+0xC0]
0042E77C . 83E8 10 SUB EAX, 0x10
0042E77F . 50 PUSH EAX
0042E780 . E8 EB2CFDFF CALL 00401470
0042E785 . 83C0 10 ADD EAX, 0x10
0042E788 . 83C4 04 ADD ESP, 0x4
0042E78B . 894424 14 MOV DWORD PTR SS:[ESP+0x14], EAX
0042E78F . 8D4C24 24 LEA ECX, DWORD PTR SS:[ESP+0x24]
0042E793 . C74424 64 010>MOV DWORD PTR SS:[ESP+0x64], 0x1
0042E79B . E8 20C60100 CALL 0044ADC0
0042E7A0 . 8B15 A4124D00 MOV EDX, DWORD PTR DS:[0x4D12A4] ; 复件_Eas.004AC91C
0042E7A6 . 52 PUSH EDX ; ntdll.KiFastSystemCallRet
0042E7A7 . 8D85 CC000000 LEA EAX, DWORD PTR SS:[EBP+0xCC]
0042E7AD . 50 PUSH EAX
0042E7AE . 8D4424 18 LEA EAX, DWORD PTR SS:[ESP+0x18]
0042E7B2 . 50 PUSH EAX
0042E7B3 . C64424 70 02 MOV BYTE PTR SS:[ESP+0x70], 0x2
0042E7B8 . E8 E33BFDFF CALL 004023A0
0042E7BD . 83C4 0C ADD ESP, 0xC
0042E7C0 . 8B00 MOV EAX, DWORD PTR DS:[EAX]
0042E7C2 . 8D4C24 14 LEA ECX, DWORD PTR SS:[ESP+0x14]
0042E7C6 . 51 PUSH ECX
0042E7C7 . 50 PUSH EAX
0042E7C8 . 8D4C24 2C LEA ECX, DWORD PTR SS:[ESP+0x2C]
0042E7CC . C64424 6C 03 MOV BYTE PTR SS:[ESP+0x6C], 0x3
0042E7D1 . E8 3AC50100 CALL 0044AD10
0042E7D6 . 8B4424 10 MOV EAX, DWORD PTR SS:[ESP+0x10]
0042E7DA . 83C0 F0 ADD EAX, -0x10
0042E7DD . C64424 64 02 MOV BYTE PTR SS:[ESP+0x64], 0x2
0042E7E2 . 8D50 0C LEA EDX, DWORD PTR DS:[EAX+0xC]
0042E7E5 . 83C9 FF OR ECX, 0xFFFFFFFF
0042E7E8 . F0:0FC10A LOCK XADD DWORD PTR DS:[EDX], ECX
0042E7EC . 49 DEC ECX
0042E7ED . 85C9 TEST ECX, ECX
0042E7EF . 7F 08 JG SHORT 0042E7F9
0042E7F1 . 8B08 MOV ECX, DWORD PTR DS:[EAX]
0042E7F3 . 8B11 MOV EDX, DWORD PTR DS:[ECX] ; ntdll.7C92DC9C
0042E7F5 . 50 PUSH EAX
0042E7F6 . FF52 04 CALL DWORD PTR DS:[EDX+0x4]
0042E7F9 > 8B4424 14 MOV EAX, DWORD PTR SS:[ESP+0x14]
0042E7FD . 50 PUSH EAX
0042E7FE . 8D4C24 20 LEA ECX, DWORD PTR SS:[ESP+0x20]
0042E802 . 51 PUSH ECX
0042E803 . E8 C8CB0100 CALL 0044B3D0
0042E808 . 83C4 08 ADD ESP, 0x8
0042E80B . 8D4C24 1C LEA ECX, DWORD PTR SS:[ESP+0x1C]
0042E80F . C64424 64 04 MOV BYTE PTR SS:[ESP+0x64], 0x4
0042E814 . E8 B72CFDFF CALL 004014D0
0042E819 . 8B0D 386E4D00 MOV ECX, DWORD PTR DS:[0x4D6E38]
0042E81F . 8B11 MOV EDX, DWORD PTR DS:[ECX] ; ntdll.7C92DC9C
0042E821 . 50 PUSH EAX
0042E822 . 57 PUSH EDI ; ntdll.7C930208
0042E823 . 56 PUSH ESI
0042E824 . 51 PUSH ECX
0042E825 . 894424 30 MOV DWORD PTR SS:[ESP+0x30], EAX
0042E829 . FF52 58 CALL DWORD PTR DS:[EDX+0x58]
0042E82C . 8B5424 18 MOV EDX, DWORD PTR SS:[ESP+0x18]
0042E830 . A1 386E4D00 MOV EAX, DWORD PTR DS:[0x4D6E38]
0042E835 . 8B08 MOV ECX, DWORD PTR DS:[EAX]
0042E837 . 52 PUSH EDX ; ntdll.KiFastSystemCallRet
0042E838 . 57 PUSH EDI ; ntdll.7C930208
0042E839 . 56 PUSH ESI
0042E83A . 50 PUSH EAX
0042E83B . FF51 60 CALL DWORD PTR DS:[ECX+0x60]
0042E83E . 57 PUSH EDI ; ntdll.7C930208
0042E83F . 8B3D 00C44A00 MOV EDI, DWORD PTR DS:[<&OLEAUT32.#SysFr>; oleaut32.SysFreeString
0042E845 . FFD7 CALL EDI ; ntdll.7C930208; <&OLEAUT32.#SysFreeString_6>
0042E847 . 53 PUSH EBX
0042E848 . FFD7 CALL EDI ; ntdll.7C930208
0042E84A . 8B4424 20 MOV EAX, DWORD PTR SS:[ESP+0x20] ; kernel32.7C839B48
0042E84E . 50 PUSH EAX
0042E84F . FFD7 CALL EDI ; ntdll.7C930208
0042E851 . 8B4C24 18 MOV ECX, DWORD PTR SS:[ESP+0x18]
0042E855 . 51 PUSH ECX
0042E856 . FFD7 CALL EDI ; ntdll.7C930208
0042E858 . 8B4424 1C MOV EAX, DWORD PTR SS:[ESP+0x1C]
0042E85C . 83C0 F0 ADD EAX, -0x10
0042E85F . C64424 64 02 MOV BYTE PTR SS:[ESP+0x64], 0x2
0042E864 . 8D50 0C LEA EDX, DWORD PTR DS:[EAX+0xC]
0042E867 . 83C9 FF OR ECX, 0xFFFFFFFF
0042E86A . F0:0FC10A LOCK XADD DWORD PTR DS:[EDX], ECX
0042E86E . 49 DEC ECX
0042E86F . 85C9 TEST ECX, ECX
0042E871 . 7F 08 JG SHORT 0042E87B
0042E873 . 8B08 MOV ECX, DWORD PTR DS:[EAX]
0042E875 . 8B11 MOV EDX, DWORD PTR DS:[ECX] ; ntdll.7C92DC9C
0042E877 . 50 PUSH EAX
0042E878 . FF52 04 CALL DWORD PTR DS:[EDX+0x4]
0042E87B > 8D4C24 24 LEA ECX, DWORD PTR SS:[ESP+0x24]
0042E87F . C64424 64 01 MOV BYTE PTR SS:[ESP+0x64], 0x1
0042E884 . E8 57C40100 CALL 0044ACE0
0042E889 . 8B4424 14 MOV EAX, DWORD PTR SS:[ESP+0x14]
0042E88D . 83C0 F0 ADD EAX, -0x10
0042E890 . C74424 64 FFF>MOV DWORD PTR SS:[ESP+0x64], -0x1
0042E898 . 8D48 0C LEA ECX, DWORD PTR DS:[EAX+0xC]
0042E89B . 83CA FF OR EDX, 0xFFFFFFFF
0042E89E . F0:0FC111 LOCK XADD DWORD PTR DS:[ECX], EDX ; ntdll.KiFastSystemCallRet
0042E8A2 . 4A DEC EDX ; ntdll.KiFastSystemCallRet
0042E8A3 . 85D2 TEST EDX, EDX ; ntdll.KiFastSystemCallRet
0042E8A5 . 7F 08 JG SHORT 0042E8AF
0042E8A7 . 8B08 MOV ECX, DWORD PTR DS:[EAX]
0042E8A9 . 8B11 MOV EDX, DWORD PTR DS:[ECX] ; ntdll.7C92DC9C
0042E8AB . 50 PUSH EAX
0042E8AC . FF52 04 CALL DWORD PTR DS:[EDX+0x4]
0042E8AF > 56 PUSH ESI
0042E8B0 . FFD7 CALL EDI ; ntdll.7C930208
0042E8B2 . 8BCD MOV ECX, EBP
0042E8B4 . E8 78BE0500 CALL 0048A731
0042E8B9 . 8B4C24 5C MOV ECX, DWORD PTR SS:[ESP+0x5C]
0042E8BD . 64:890D 00000>MOV DWORD PTR FS:[0], ECX
0042E8C4 . 5F POP EDI ; kernel32.7C816037
0042E8C5 . 5E POP ESI ; kernel32.7C816037
0042E8C6 . 5D POP EBP ; kernel32.7C816037
0042E8C7 . 5B POP EBX ; kernel32.7C816037
0042E8C8 . 83C4 58 ADD ESP, 0x58
0042E8CB . C3 RETN
0042E8CC > 6A 00 PUSH 0x0
0042E8CE . 6A 30 PUSH 0x30
0042E8D0 . 68 741C4B00 PUSH 004B1C74 ; ASCII "注册信息不正确！"

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法