00AD11E0 > 81EC 30010000 SUB ESP,130
00AD11E6 53 PUSH EBX
00AD11E7 55 PUSH EBP
00AD11E8 56 PUSH ESI
00AD11E9 8B35 5020AD00 MOV ESI,DWORD PTR DS:[<&MSVCRT._ltoa>] ; msvcrt._ltoa
00AD11EF 57 PUSH EDI
00AD11F0 8BBC24 44010000 MOV EDI,DWORD PTR SS:[ESP+144]
00AD11F7 6A 10 PUSH 10
00AD11F9 68 2C30AD00 PUSH YTuDrive.00AD302C
00AD11FE 57 PUSH EDI
00AD11FF FFD6 CALL ESI
00AD1201 8B9C24 54010000 MOV EBX,DWORD PTR SS:[ESP+154]
00AD1208 6A 10 PUSH 10
00AD120A 68 4030AD00 PUSH YTuDrive.00AD3040
00AD120F 53 PUSH EBX
00AD1210 FFD6 CALL ESI
00AD1212 A1 2430AD00 MOV EAX,DWORD PTR DS:[AD3024]
00AD1217 83C4 18 ADD ESP,18
00AD121A 6A 00 PUSH 0
00AD121C 50 PUSH EAX
00AD121D FF15 0420AD00 CALL DWORD PTR DS:[<&KERNEL32.TerminateT>; kernel32.TerminateThread
00AD1223 68 2030AD00 PUSH YTuDrive.00AD3020
00AD1228 6A 00 PUSH 0
00AD122A 6A 00 PUSH 0
00AD122C 68 2011AD00 PUSH YTuDrive.00AD1120
00AD1231 6A 00 PUSH 0
00AD1233 6A 00 PUSH 0
00AD1235 FF15 0020AD00 CALL DWORD PTR DS:[<&KERNEL32.CreateThre>; kernel32.CreateThread
00AD123B 33C9 XOR ECX,ECX
00AD123D 33D2 XOR EDX,EDX
00AD123F 894C24 29 MOV DWORD PTR SS:[ESP+29],ECX
00AD1243 895424 15 MOV DWORD PTR SS:[ESP+15],EDX
00AD1247 A3 2430AD00 MOV DWORD PTR DS:[AD3024],EAX
00AD124C A0 6C30AD00 MOV AL,BYTE PTR DS:[AD306C]
00AD1251 894C24 2D MOV DWORD PTR SS:[ESP+2D],ECX
00AD1255 895424 19 MOV DWORD PTR SS:[ESP+19],EDX
00AD1259 894C24 31 MOV DWORD PTR SS:[ESP+31],ECX
00AD125D 895424 1D MOV DWORD PTR SS:[ESP+1D],EDX
00AD1261 884424 28 MOV BYTE PTR SS:[ESP+28],AL
00AD1265 884424 14 MOV BYTE PTR SS:[ESP+14],AL
00AD1269 894C24 35 MOV DWORD PTR SS:[ESP+35],ECX
00AD126D 895424 21 MOV DWORD PTR SS:[ESP+21],EDX
00AD1271 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28]
00AD1275 6A 10 PUSH 10
00AD1277 66:894C24 3D MOV WORD PTR SS:[ESP+3D],CX
00AD127C 66:895424 29 MOV WORD PTR SS:[ESP+29],DX
00AD1281 50 PUSH EAX
00AD1282 57 PUSH EDI
00AD1283 884C24 47 MOV BYTE PTR SS:[ESP+47],CL
00AD1287 885424 33 MOV BYTE PTR SS:[ESP+33],DL
00AD128B FFD6 CALL ESI
00AD128D 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20]
00AD1291 6A 10 PUSH 10
00AD1293 51 PUSH ECX
00AD1294 53 PUSH EBX
00AD1295 FFD6 CALL ESI
00AD1297 8B1D 6020AD00 MOV EBX,DWORD PTR DS:[<&Syunew3D.#7>] ; SYUNEW3D.FindPort
00AD129D 8B2D 5C20AD00 MOV EBP,DWORD PTR DS:[<&Syunew3D.#5>] ; SYUNEW3D.YRead
00AD12A3 83C4 18 ADD ESP,18
00AD12A6 33FF XOR EDI,EDI
00AD12A8 8D5424 3C LEA EDX,DWORD PTR SS:[ESP+3C]
00AD12AC 52 PUSH EDX
00AD12AD 57 PUSH EDI
00AD12AE FFD3 CALL EBX
00AD12B0 8BF0 MOV ESI,EAX
00AD12B2 85F6 TEST ESI,ESI
00AD12B4 75 24 JNZ SHORT YTuDrive.00AD12DA
00AD12B6 8D4424 3C LEA EAX,DWORD PTR SS:[ESP+3C]
00AD12BA 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14]
00AD12BE 50 PUSH EAX
00AD12BF 8D5424 2C LEA EDX,DWORD PTR SS:[ESP+2C]
00AD12C3 51 PUSH ECX
00AD12C4 52 PUSH EDX
00AD12C5 8D4424 1F LEA EAX,DWORD PTR SS:[ESP+1F]
00AD12C9 6A 01 PUSH 1
00AD12CB 50 PUSH EAX
00AD12CC FFD5 CALL EBP
00AD12CE 8BF0 MOV ESI,EAX
00AD12D0 85F6 TEST ESI,ESI
00AD12D2 74 3A JE SHORT YTuDrive.00AD130E
00AD12D4 47 INC EDI
00AD12D5 83FF 7F CMP EDI,7F
00AD12D8 ^ 7C CE JL SHORT YTuDrive.00AD12A8
00AD12DA FF15 1420AD00 CALL DWORD PTR DS:[<&KERNEL32.GetCurrent>; kernel32.GetCurrentProcessId
00AD12E0 50 PUSH EAX
00AD12E1 6A 00 PUSH 0
00AD12E3 6A 01 PUSH 1
00AD12E5 FF15 1020AD00 CALL DWORD PTR DS:[<&KERNEL32.OpenProces>; kernel32.OpenProcess
00AD12EB 8BF8 MOV EDI,EAX
00AD12ED 85FF TEST EDI,EDI
00AD12EF 74 10 JE SHORT YTuDrive.00AD1301
00AD12F1 6A 00 PUSH 0
00AD12F3 57 PUSH EDI
00AD12F4 FF15 0820AD00 CALL DWORD PTR DS:[<&KERNEL32.TerminateP>; kernel32.TerminateProcess
00AD12FA 57 PUSH EDI
00AD12FB FF15 1820AD00 CALL DWORD PTR DS:[<&KERNEL32.CloseHandl>; kernel32.CloseHandle
00AD1301 8BC6 MOV EAX,ESI
00AD1303 5F POP EDI
00AD1304 5E POP ESI
00AD1305 5D POP EBP
00AD1306 5B POP EBX
00AD1307 81C4 30010000 ADD ESP,130
00AD130D C3 RETN
00AD130E 5F POP EDI
00AD130F 5E POP ESI
00AD1310 5D POP EBP
00AD1311 33C0 XOR EAX,EAX
00AD1313 5B POP EBX
00AD1314 81C4 30010000 ADD ESP,130
00AD131A C3 RETN
[培训]内核驱动高级班，冲击BAT一流互联网大厂工
作，每周日13:00-18:00直播授课
