能力值:
( LV2,RANK:10 )
|
-
-
3 楼
;Microsoft Windows kernel32.dll - ExitProcess
;调用微软Windows函数的程序
.386
.model flat,stdcall
option casemap:none
include kernel32.inc
;ExitProcess
includelib kernel32.lib
;ExitProcess
.data
driver db "C:\\"
.code
start:
;Xor Edx, Edx
;Mov Eax, 6527363
;6527363是十进制数,转换为十六进制数就是
;639983
;Mov Ecx, 28732
;28732是十进制数,转换为十六进制数就是
;703C
;Div Ecx
;寄存器EAX中的数除以寄存器ECX中的数
;商值保存在寄存器EAX中,E3h,227d
;余数保存在寄存器EDX中,144Fh,5199d
invoke GetVolumeInformation,addr driver,0,0,ebx,0,0,0,0
;驱动器C中卷的序列号是58FD-9112,则driver地址处是58FD9112h
invoke ExitProcess,00h
;如果参数有多个则从最后一个参数开始压入堆栈
;其中 ExitProcess 是 Kernel32.Dll 输出函数的符号名
;其中 Invoke 是“MicroSoft Macro Assembler”的指令
;Push 0h
;Call ExitProcess
end start
|
能力值:
( LV2,RANK:10 )
|
-
-
6 楼
00578FF1 55 PUSH EBP
00578FF2 68 7E925700 PUSH zcsh_exe.0057927E
00578FF7 64:FF30 PUSH DWORD PTR FS:[EAX]
00578FFA 64:8920 MOV DWORD PTR FS:[EAX],ESP
00578FFD 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00579000 E8 ABFDFFFF CALL zcsh_exe.00578DB0
00579005 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00579008 50 PUSH EAX
00579009 B9 0A000000 MOV ECX,0A
0057900E BA 02000000 MOV EDX,2
00579013 A1 DC875800 MOV EAX,DWORD PTR DS:[5887DC]
00579018 E8 93C1E8FF CALL zcsh_exe.004051B0
0057901D 8D85 D8FEFFFF LEA EAX,DWORD PTR SS:[EBP-128]
00579023 50 PUSH EAX
00579024 B9 02000000 MOV ECX,2
00579029 BA 09000000 MOV EDX,9
0057902E 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00579031 E8 7AC1E8FF CALL zcsh_exe.004051B0
00579036 FFB5 D8FEFFFF PUSH DWORD PTR SS:[EBP-128]
0057903C 8D85 D4FEFFFF LEA EAX,DWORD PTR SS:[EBP-12C]
00579042 50 PUSH EAX
00579043 B9 02000000 MOV ECX,2
00579048 BA 01000000 MOV EDX,1
0057904D 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00579050 E8 5BC1E8FF CALL zcsh_exe.004051B0
00579055 FFB5 D4FEFFFF PUSH DWORD PTR SS:[EBP-12C]
0057905B 68 94925700 PUSH zcsh_exe.00579294 ; -
00579060 8D85 D0FEFFFF LEA EAX,DWORD PTR SS:[EBP-130]
00579066 50 PUSH EAX
00579067 B9 06000000 MOV ECX,6
0057906C BA 03000000 MOV EDX,3
00579071 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00579074 E8 37C1E8FF CALL zcsh_exe.004051B0
00579079 FFB5 D0FEFFFF PUSH DWORD PTR SS:[EBP-130]
0057907F 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00579082 BA 04000000 MOV EDX,4
00579087 E8 8CBFE8FF CALL zcsh_exe.00405018
0057908C A1 5C4C5800 MOV EAX,DWORD PTR DS:[584C5C]
00579091 8B00 MOV EAX,DWORD PTR DS:[EAX]
00579093 8B80 18030000 MOV EAX,DWORD PTR DS:[EAX+318]
00579099 33D2 XOR EDX,EDX
0057909B E8 88E4ECFF CALL zcsh_exe.00447528
005790A0 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
005790A6 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
005790A9 E8 CE79F2FF CALL zcsh_exe.004A0A7C
005790AE 8D95 C4FEFFFF LEA EDX,DWORD PTR SS:[EBP-13C]
005790B4 A1 5C4C5800 MOV EAX,DWORD PTR DS:[584C5C]
005790B9 8B00 MOV EAX,DWORD PTR DS:[EAX]
005790BB 8B80 04030000 MOV EAX,DWORD PTR DS:[EAX+304]
005790C1 E8 0E9AEDFF CALL zcsh_exe.00452AD4
005790C6 8B85 C4FEFFFF MOV EAX,DWORD PTR SS:[EBP-13C]
005790CC 8D95 C8FEFFFF LEA EDX,DWORD PTR SS:[EBP-138]
005790D2 E8 7505E9FF CALL zcsh_exe.0040964C
005790D7 8B85 C8FEFFFF MOV EAX,DWORD PTR SS:[EBP-138]
005790DD 8D95 CCFEFFFF LEA EDX,DWORD PTR SS:[EBP-134]
005790E3 E8 1403E9FF CALL zcsh_exe.004093FC
005790E8 8B85 CCFEFFFF MOV EAX,DWORD PTR SS:[EBP-134]
005790EE E8 997FF2FF CALL zcsh_exe.004A108C
005790F3 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
005790F6 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
005790F9 A3 C0775800 MOV DWORD PTR DS:[5877C0],EAX
005790FE 8D4D F0 LEA ECX,DWORD PTR SS:[EBP-10]
00579101 8D95 64FFFFFF LEA EDX,DWORD PTR SS:[EBP-9C]
00579107 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
0057910D E8 E679F2FF CALL zcsh_exe.004A0AF8
00579112 6A 04 PUSH 4
00579114 8D4D EC LEA ECX,DWORD PTR SS:[EBP-14]
00579117 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
0057911A 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
0057911D E8 A673F2FF CALL zcsh_exe.004A04C8
00579122 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
00579125 B9 FF000000 MOV ECX,0FF
0057912A BA 08000000 MOV EDX,8
0057912F E8 68A1E8FF CALL zcsh_exe.0040329C
00579134 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
0057913A E8 C97DF2FF CALL zcsh_exe.004A0F08
0057913F 6A 00 PUSH 0
00579141 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
00579144 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
0057914A B9 20000000 MOV ECX,20
0057914F E8 4C7CF2FF CALL zcsh_exe.004A0DA0
00579154 33C0 XOR EAX,EAX
00579156 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
00579159 33C0 XOR EAX,EAX
0057915B 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
0057915E 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
00579164 E8 9F7DF2FF CALL zcsh_exe.004A0F08
00579169 6A 0C PUSH 0C
0057916B 8D8D 50FFFFFF LEA ECX,DWORD PTR SS:[EBP-B0]
00579171 BA 58465800 MOV EDX,zcsh_exe.00584658
00579176 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
0057917C E8 977DF2FF CALL zcsh_exe.004A0F18
00579181 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
00579187 E8 7C7DF2FF CALL zcsh_exe.004A0F08
0057918C 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
00579192 E8 357DF2FF CALL zcsh_exe.004A0ECC
00579197 8D85 F0FEFFFF LEA EAX,DWORD PTR SS:[EBP-110]
0057919D E8 7276F2FF CALL zcsh_exe.004A0814
005791A2 8D95 50FFFFFF LEA EDX,DWORD PTR SS:[EBP-B0]
005791A8 8D85 F0FEFFFF LEA EAX,DWORD PTR SS:[EBP-110]
005791AE B9 0C000000 MOV ECX,0C
005791B3 E8 C076F2FF CALL zcsh_exe.004A0878
005791B8 8D95 DCFEFFFF LEA EDX,DWORD PTR SS:[EBP-124]
005791BE 8D85 F0FEFFFF LEA EAX,DWORD PTR SS:[EBP-110]
005791C4 E8 1777F2FF CALL zcsh_exe.004A08E0
005791C9 8D85 F0FEFFFF LEA EAX,DWORD PTR SS:[EBP-110]
005791CF E8 7076F2FF CALL zcsh_exe.004A0844
005791D4 33C9 XOR ECX,ECX
005791D6 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124]
005791DC BA 64465800 MOV EDX,zcsh_exe.00584664
005791E1 8A18 MOV BL,BYTE PTR DS:[EAX]
005791E3 3A1A CMP BL,BYTE PTR DS:[EDX]
005791E5 75 08 JNZ SHORT zcsh_exe.005791EF
005791E7 41 INC ECX
005791E8 42 INC EDX
005791E9 40 INC EAX
005791EA 83F9 14 CMP ECX,14
005791ED ^ 75 F2 JNZ SHORT zcsh_exe.005791E1
005791EF 83F9 14 CMP ECX,14
005791F2 75 52 JNZ SHORT zcsh_exe.00579246
005791F4 BA F0865800 MOV EDX,zcsh_exe.005886F0
005791F9 8D85 50FFFFFF LEA EAX,DWORD PTR SS:[EBP-B0]
005791FF B9 0C000000 MOV ECX,0C
00579204 E8 E397E8FF CALL zcsh_exe.004029EC
00579209 E8 BEC8FFFF CALL zcsh_exe.00575ACC
0057920E E8 A5F8FFFF CALL zcsh_exe.00578AB8
00579213 E8 4CC6FFFF CALL zcsh_exe.00575864
00579218 A2 E5875800 MOV BYTE PTR DS:[5887E5],AL
0057921D E8 96D0FFFF CALL zcsh_exe.005762B8
00579222 A1 384B5800 MOV EAX,DWORD PTR DS:[584B38]
00579227 8B00 MOV EAX,DWORD PTR DS:[EAX]
00579229 33D2 XOR EDX,EDX
0057922B E8 846BFFFF CALL zcsh_exe.0056FDB4
00579230 A1 384B5800 MOV EAX,DWORD PTR DS:[584B38]
00579235 8B00 MOV EAX,DWORD PTR DS:[EAX]
00579237 8B80 50040000 MOV EAX,DWORD PTR DS:[EAX+450]
0057923D 33D2 XOR EDX,EDX
0057923F E8 28B7EEFF CALL zcsh_exe.0046496C
00579244 EB 07 JMP SHORT zcsh_exe.0057924D
00579246 33C0 XOR EAX,EAX
00579248 A3 C0775800 MOV DWORD PTR DS:[5877C0],EAX
0057924D 33C0 XOR EAX,EAX
0057924F 5A POP EDX
00579250 59 POP ECX
00579251 59 POP ECX
00579252 64:8910 MOV DWORD PTR FS:[EAX],EDX
00579255 68 85925700 PUSH zcsh_exe.00579285
0057925A 8D85 C4FEFFFF LEA EAX,DWORD PTR SS:[EBP-13C]
00579260 E8 3BBAE8FF CALL zcsh_exe.00404CA0
00579265 8D85 C8FEFFFF LEA EAX,DWORD PTR SS:[EBP-138]
0057926B BA 05000000 MOV EDX,5
00579270 E8 4FBAE8FF CALL zcsh_exe.00404CC4
00579275 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00579278 E8 23BAE8FF CALL zcsh_exe.00404CA0
0057927D C3 RETN
0057927E ^ E9 A5B3E8FF JMP zcsh_exe.00404628
00579283 ^ EB D5 JMP SHORT zcsh_exe.0057925A
00579285 5B POP EBX
00579286 8BE5 MOV ESP,EBP
00579288 5D POP EBP
00579289 C3 RETN
不是明码比较,不适合我这个菜鸟了,兄弟有兴趣不妨看看这段代码,(005790EE处建议进去看看,005791F2处的跳转也比较好玩):)
|
能力值:
( LV12,RANK:730 )
|
-
-
8 楼
根据霹雳大侠提示,总算跟到下面一段
004027F8 53 PUSH EBX
004027F9 85C0 TEST EAX,EAX
004027FB 74 15 JE SHORT zcsh.00402812
004027FD FF15 34105800 CALL [DWORD DS:581034] ; zcsh.004023A0
00402803 8BD8 MOV EBX,EAX
00402805 85DB TEST EBX,EBX
00402807 74 0B JE SHORT zcsh.00402814
00402809 B0 02 MOV AL,2
0040280B E8 30010000 CALL zcsh.00402940
00402810 EB 02 JMP SHORT zcsh.00402814
00402812 33DB XOR EBX,EBX
00402814 8BC3 MOV EAX,EBX
00402816 5B POP EBX
00402817 C3 RETN
进入00402940以后看不明白,只好乱了结一下,注册码大概是10个字符,两个英文A到H,八个数字2到9。上面这段应该是对前面的计算结果进一步验证,如果不对还是不成。
|
能力值:
( LV8,RANK:130 )
|
-
-
22 楼
算法应是SHA-1
注册码10位。第1,2位是字母在(ABCDEFPWXYZQSTKH)之中,后面八位是数字在23456789之中。
00578FF1 55 PUSH EBP
00578FF2 68 7E925700 PUSH zcsh_exe.0057927E
00578FF7 64:FF30 PUSH DWORD PTR FS:[EAX]
00578FFA 64:8920 MOV DWORD PTR FS:[EAX],ESP
00578FFD 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00579000 E8 ABFDFFFF CALL zcsh_exe.00578DB0
00579005 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00579008 50 PUSH EAX
00579009 B9 0A000000 MOV ECX,0A
0057900E BA 02000000 MOV EDX,2
00579013 A1 DC875800 MOV EAX,DWORD PTR DS:[5887DC]
00579018 E8 93C1E8FF CALL zcsh_exe.004051B0
0057901D 8D85 D8FEFFFF LEA EAX,DWORD PTR SS:[EBP-128]
00579023 50 PUSH EAX
00579024 B9 02000000 MOV ECX,2
00579029 BA 09000000 MOV EDX,9
0057902E 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00579031 E8 7AC1E8FF CALL zcsh_exe.004051B0
00579036 FFB5 D8FEFFFF PUSH DWORD PTR SS:[EBP-128]
0057903C 8D85 D4FEFFFF LEA EAX,DWORD PTR SS:[EBP-12C]
00579042 50 PUSH EAX
00579043 B9 02000000 MOV ECX,2
00579048 BA 01000000 MOV EDX,1
0057904D 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00579050 E8 5BC1E8FF CALL zcsh_exe.004051B0
00579055 FFB5 D4FEFFFF PUSH DWORD PTR SS:[EBP-12C]
0057905B 68 94925700 PUSH zcsh_exe.00579294 ; -
00579060 8D85 D0FEFFFF LEA EAX,DWORD PTR SS:[EBP-130]
00579066 50 PUSH EAX
00579067 B9 06000000 MOV ECX,6
0057906C BA 03000000 MOV EDX,3
00579071 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00579074 E8 37C1E8FF CALL zcsh_exe.004051B0
00579079 FFB5 D0FEFFFF PUSH DWORD PTR SS:[EBP-130]
0057907F 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00579082 BA 04000000 MOV EDX,4
00579087 E8 8CBFE8FF CALL zcsh_exe.00405018
0057908C A1 5C4C5800 MOV EAX,DWORD PTR DS:[584C5C]
00579091 8B00 MOV EAX,DWORD PTR DS:[EAX]
00579093 8B80 18030000 MOV EAX,DWORD PTR DS:[EAX+318]
00579099 33D2 XOR EDX,EDX
0057909B E8 88E4ECFF CALL zcsh_exe.00447528
005790A0 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
005790A6 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
005790A9 E8 CE79F2FF CALL zcsh_exe.004A0A7C
005790AE 8D95 C4FEFFFF LEA EDX,DWORD PTR SS:[EBP-13C]
005790B4 A1 5C4C5800 MOV EAX,DWORD PTR DS:[584C5C]
005790B9 8B00 MOV EAX,DWORD PTR DS:[EAX]
005790BB 8B80 04030000 MOV EAX,DWORD PTR DS:[EAX+304]
005790C1 E8 0E9AEDFF CALL zcsh_exe.00452AD4
005790C6 8B85 C4FEFFFF MOV EAX,DWORD PTR SS:[EBP-13C]
005790CC 8D95 C8FEFFFF LEA EDX,DWORD PTR SS:[EBP-138]
005790D2 E8 7505E9FF CALL zcsh_exe.0040964C
005790D7 8B85 C8FEFFFF MOV EAX,DWORD PTR SS:[EBP-138]
005790DD 8D95 CCFEFFFF LEA EDX,DWORD PTR SS:[EBP-134]
005790E3 E8 1403E9FF CALL zcsh_exe.004093FC
005790E8 8B85 CCFEFFFF MOV EAX,DWORD PTR SS:[EBP-134]
005790EE E8 997FF2FF CALL zcsh_exe.004A108C
005790F3 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
005790F6 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
005790F9 A3 C0775800 MOV DWORD PTR DS:[5877C0],EAX
005790FE 8D4D F0 LEA ECX,DWORD PTR SS:[EBP-10]
00579101 8D95 64FFFFFF LEA EDX,DWORD PTR SS:[EBP-9C]
00579107 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
0057910D E8 E679F2FF CALL zcsh_exe.004A0AF8
00579112 6A 04 PUSH 4
00579114 8D4D EC LEA ECX,DWORD PTR SS:[EBP-14]
00579117 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
0057911A 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
0057911D E8 A673F2FF CALL zcsh_exe.004A04C8
00579122 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
00579125 B9 FF000000 MOV ECX,0FF
0057912A BA 08000000 MOV EDX,8
0057912F E8 68A1E8FF CALL zcsh_exe.0040329C
00579134 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
0057913A E8 C97DF2FF CALL zcsh_exe.004A0F08
0057913F 6A 00 PUSH 0
00579141 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
00579144 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
0057914A B9 20000000 MOV ECX,20
0057914F E8 4C7CF2FF CALL zcsh_exe.004A0DA0
00579154 33C0 XOR EAX,EAX
00579156 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
00579159 33C0 XOR EAX,EAX
0057915B 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
0057915E 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
00579164 E8 9F7DF2FF CALL zcsh_exe.004A0F08
00579169 6A 0C PUSH 0C
0057916B 8D8D 50FFFFFF LEA ECX,DWORD PTR SS:[EBP-B0]
00579171 BA 58465800 MOV EDX,zcsh_exe.00584658
00579176 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
0057917C E8 977DF2FF CALL zcsh_exe.004A0F18
00579181 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
00579187 E8 7C7DF2FF CALL zcsh_exe.004A0F08
0057918C 8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
00579192 E8 357DF2FF CALL zcsh_exe.004A0ECC
00579197 8D85 F0FEFFFF LEA EAX,DWORD PTR SS:[EBP-110]
0057919D E8 7276F2FF CALL zcsh_exe.004A0814
005791A2 8D95 50FFFFFF LEA EDX,DWORD PTR SS:[EBP-B0]
005791A8 8D85 F0FEFFFF LEA EAX,DWORD PTR SS:[EBP-110]
005791AE B9 0C000000 MOV ECX,0C
005791B3 E8 C076F2FF CALL zcsh_exe.004A0878
005791B8 8D95 DCFEFFFF LEA EDX,DWORD PTR SS:[EBP-124]
005791BE 8D85 F0FEFFFF LEA EAX,DWORD PTR SS:[EBP-110]
005791C4 E8 1777F2FF CALL zcsh_exe.004A08E0 //SHA-1
005791C9 8D85 F0FEFFFF LEA EAX,DWORD PTR SS:[EBP-110]
005791CF E8 7076F2FF CALL zcsh_exe.004A0844
005791D4 33C9 XOR ECX,ECX
005791D6 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124] //160位算列值
005791DC BA 64465800 MOV EDX,zcsh_exe.00584664 //160位算列值
005791E1 8A18 MOV BL,BYTE PTR DS:[EAX]
005791E3 3A1A CMP BL,BYTE PTR DS:[EDX] //比较两个算列值
005791E5 75 08 JNZ SHORT zcsh_exe.005791EF
005791E7 41 INC ECX
005791E8 42 INC EDX
005791E9 40 INC EAX
005791EA 83F9 14 CMP ECX,14
005791ED ^ 75 F2 JNZ SHORT zcsh_exe.005791E1
005791EF 83F9 14 CMP ECX,14
005791F2 75 52 JNZ SHORT zcsh_exe.00579246
005791F4 BA F0865800 MOV EDX,zcsh_exe.005886F0
005791F9 8D85 50FFFFFF LEA EAX,DWORD PTR SS:[EBP-B0]
005791FF B9 0C000000 MOV ECX,0C
00579204 E8 E397E8FF CALL zcsh_exe.004029EC
00579209 E8 BEC8FFFF CALL zcsh_exe.00575ACC
0057920E E8 A5F8FFFF CALL zcsh_exe.00578AB8
00579213 E8 4CC6FFFF CALL zcsh_exe.00575864
00579218 A2 E5875800 MOV BYTE PTR DS:[5887E5],AL
0057921D E8 96D0FFFF CALL zcsh_exe.005762B8
00579222 A1 384B5800 MOV EAX,DWORD PTR DS:[584B38]
00579227 8B00 MOV EAX,DWORD PTR DS:[EAX]
00579229 33D2 XOR EDX,EDX
0057922B E8 846BFFFF CALL zcsh_exe.0056FDB4
00579230 A1 384B5800 MOV EAX,DWORD PTR DS:[584B38]
00579235 8B00 MOV EAX,DWORD PTR DS:[EAX]
00579237 8B80 50040000 MOV EAX,DWORD PTR DS:[EAX+450]
0057923D 33D2 XOR EDX,EDX
0057923F E8 28B7EEFF CALL zcsh_exe.0046496C
00579244 EB 07 JMP SHORT zcsh_exe.0057924D
00579246 33C0 XOR EAX,EAX
00579248 A3 C0775800 MOV DWORD PTR DS:[5877C0],EAX
0057924D 33C0 XOR EAX,EAX
0057924F 5A POP EDX
00579250 59 POP ECX
00579251 59 POP ECX
00579252 64:8910 MOV DWORD PTR FS:[EAX],EDX
00579255 68 85925700 PUSH zcsh_exe.00579285
0057925A 8D85 C4FEFFFF LEA EAX,DWORD PTR SS:[EBP-13C]
00579260 E8 3BBAE8FF CALL zcsh_exe.00404CA0
00579265 8D85 C8FEFFFF LEA EAX,DWORD PTR SS:[EBP-138]
0057926B BA 05000000 MOV EDX,5
00579270 E8 4FBAE8FF CALL zcsh_exe.00404CC4
00579275 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00579278 E8 23BAE8FF CALL zcsh_exe.00404CA0
0057927D C3 RETN
0057927E ^ E9 A5B3E8FF JMP zcsh_exe.00404628
00579283 ^ EB D5 JMP SHORT zcsh_exe.0057925A
00579285 5B POP EBX
00579286 8BE5 MOV ESP,EBP
00579288 5D POP EBP
00579289 C3 RETN
|