大家好我是菜??求各位的?助
呃是一款彩票?篦我用W32dsm反酵诅找相晷字串
找到授?瘁邋锗的字串，不知哪?是重要的call
想要知道??篦的暂?演算法咄而??
?大家交我一下暂?瘁演算的咿程
附上?篦蒌?http://down.clubbox.co.kr/squeare/69jg7
此为繁体中文版请下载apploc可以让繁体版顺利安装
* Possible StringData Ref from Code Obj ->"\Software\TaiwanLotto"
|
:00553D1F BA643E5500 mov edx, 00553E64
:00553D24 E86FCDF0FF call 00460A98
:00553D29 8B45FC mov eax, dword ptr [ebp-04]
:00553D2C 8B8010080000 mov eax, dword ptr [eax+00000810]
:00553D32 8BCB mov ecx, ebx
* Possible StringData Ref from Code Obj ->"ProductID"
|
:00553D34 BA843E5500 mov edx, 00553E84
:00553D39 E86ECFF0FF call 00460CAC
:00553D3E 8B45FC mov eax, dword ptr [ebp-04]
:00553D41 8B8010080000 mov eax, dword ptr [eax+00000810]
:00553D47 8BCE mov ecx, esi
* Possible StringData Ref from Code Obj ->"PassID"
|
:00553D49 BA983E5500 mov edx, 00553E98
:00553D4E E859CFF0FF call 00460CAC
:00553D53 8B45FC mov eax, dword ptr [ebp-04]
:00553D56 8B8010080000 mov eax, dword ptr [eax+00000810]
:00553D5C E8A3CCF0FF call 00460A04
:00553D61 8B45FC mov eax, dword ptr [ebp-04]
:00553D64 8B8010080000 mov eax, dword ptr [eax+00000810]
:00553D6A E849F3EAFF call 004030B8
:00553D6F 8B45FC mov eax, dword ptr [ebp-04]
:00553D72 33D2 xor edx, edx
:00553D74 899010080000 mov dword ptr [eax+00000810], edx
:00553D7A 33C0 xor eax, eax
:00553D7C 5A pop edx
:00553D7D 59 pop ecx
:00553D7E 59 pop ecx
:00553D7F 648910 mov dword ptr fs:[eax], edx
:00553D82 EB20 jmp 00553DA4
:00553D84 E9DBF7EAFF jmp 00403564
* Possible StringData Ref from Code Obj ->"?法找到系靳韵定?"
|
:00553D89 B8A83E5500 mov eax, 00553EA8
:00553D8E E8DD99F0FF call 0045D770
:00553D93 A16CE45500 mov eax, dword ptr [0055E46C]
:00553D98 8B00 mov eax, dword ptr [eax]
:00553D9A E8CD0AF0FF call 0045486C
:00553D9F E81CFBEAFF call 004038C0
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00553D82(U)
|
:00553DA4 8B45FC mov eax, dword ptr [ebp-04]
:00553DA7 8B80E8020000 mov eax, dword ptr [eax+000002E8]
:00553DAD B201 mov dl, 01
:00553DAF 8B08 mov ecx, dword ptr [eax]
:00553DB1 FF515C call [ecx+5C]
:00553DB4 8B45FC mov eax, dword ptr [ebp-04]
:00553DB7 8B80E0020000 mov eax, dword ptr [eax+000002E0]
:00553DBD BA01000000 mov edx, 00000001
:00553DC2 E8D95EF0FF call 00459CA0
:00553DC7 8B45FC mov eax, dword ptr [ebp-04]
:00553DCA 8B8034050000 mov eax, dword ptr [eax+00000534]
:00553DD0 B201 mov dl, 01
:00553DD2 E82952F0FF call 00459000
:00553DD7 8B45FC mov eax, dword ptr [ebp-04]
:00553DDA 8B8040050000 mov eax, dword ptr [eax+00000540]
:00553DE0 B201 mov dl, 01
:00553DE2 E81952F0FF call 00459000
:00553DE7 8B55F8 mov edx, dword ptr [ebp-08]
:00553DEA 8B45FC mov eax, dword ptr [ebp-04]
:00553DED E8A2E5FFFF call 00552394
:00553DF2 EB3D jmp 00553E31
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00553CDD(C)
|
* Possible StringData Ref from Code Obj ->"授?瘁邋锗?重新?入"
|
:00553DF4 B8C43E5500 mov eax, 00553EC4
:00553DF9 E87299F0FF call 0045D770
:00553DFE 8B45FC mov eax, dword ptr [ebp-04]
:00553E01 8B80F8050000 mov eax, dword ptr [eax+000005F8]
:00553E07 8B10 mov edx, dword ptr [eax]
:00553E09 FF92CC000000 call dword ptr [edx+000000CC]
:00553E0F 8B45FC mov eax, dword ptr [ebp-04]
:00553E12 8B80FC050000 mov eax, dword ptr [eax+000005FC]
:00553E18 8B10 mov edx, dword ptr [eax]
:00553E1A FF92CC000000 call dword ptr [edx+000000CC]
:00553E20 8B45FC mov eax, dword ptr [ebp-04]
:00553E23 8B80F8050000 mov eax, dword ptr [eax+000005F8]
:00553E29 8B10 mov edx, dword ptr [eax]
:00553E2B FF92B0000000 call dword ptr [edx+000000B0]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00553DF2(U)
|
:00553E31 33C0 xor eax, eax
:00553E33 5A pop edx
:00553E34 59 pop ecx
:00553E35 59 pop ecx
:00553E36 648910 mov dword ptr fs:[eax], edx
:00553E39 68533E5500 push 00553E53
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00553E51(U)
|
:00553E3E 8D45F0 lea eax, dword ptr [ebp-10]
:00553E41 BA02000000 mov edx, 00000002
:00553E46 E859FFEAFF call 00403DA4
:00553E4B C3 ret
:00553E4C E9C7F9EAFF jmp 00403818
:00553E51 EBEB jmp 00553E3E
:00553E53 5F pop edi
:00553E54 5E pop esi
:00553E55 5B pop ebx
:00553E56 8BE5 mov esp, ebp
:00553E58 5D pop ebp
:00553E59 C3 ret
:00553E5A 0000 BYTE 2 DUP(0)
:00553E5C FFFFFFFF BYTE 4 DUP(0ffh)
:00553E60 150000005C adc eax, 5C000000
:00553E65 53 push ebx
:00553E66 6F outsd
:00553E67 667477 je 00553EE1
:00553E6A 61 popad
:00553E6B 7265 jb 00553ED2
:00553E6D 5C pop esp
:00553E6E 54 push esp
:00553E6F 61 popad
:00553E70 6977616E4C6F74 imul esi, dword ptr [edi+61], 746F4C6E
:00553E77 746F je 00553EE8
:00553E79 000000 BYTE 3 DUP(0)
:00553E7C FFFFFFFF BYTE 4 DUP(0ffh)
:00553E80 0900 or dword ptr [eax], eax
:00553E82 0000 add byte ptr [eax], al
:00553E84 50 push eax
:00553E85 726F jb 00553EF6
:00553E87 64 BYTE 064h
:00553E88 7563 jne 00553EED
:00553E8A 7449 je 00553ED5
:00553E8C 44 inc esp
:00553E8D 000000 BYTE 3 DUP(0)
:00553E90 FFFFFFFF BYTE 4 DUP(0ffh)
:00553E94 06 push es
:00553E95 000000 BYTE 3 DUP(0)
:00553E98 50 push eax
:00553E99 61 popad
:00553E9A 7373 jnb 00553F0F
:00553E9C 49 dec ecx
:00553E9D 44 inc esp
:00553E9E 0000 add byte ptr [eax], al
:00553EA0 FFFFFFFF BYTE 4 DUP(0ffh)
:00553EA4 1200 adc al, byte ptr [eax]
:00553EA6 0000 add byte ptr [eax], al
:00553EA8 B54C mov ch, 4C
:00553EAA AA stosb
:00553EAB 6BA7E4A8ECA874 imul esp, dword ptr [edi+A8ECA8E4], 00000074
:00553EB2 B2CE mov dl, CE
:00553EB4 B35D mov bl, 5D
:00553EB6 A977C0C900 test eax, 00C9C077
:00553EBB 00FF add bh, bh
:00553EBD FFFFFF BYTE 3 DUP(0ffh)
:00553EC0 1400 adc al, 00
:00553EC2 0000 add byte ptr [eax], al
:00553EC4 B1C2 mov cl, C2
:00553EC6 C576BD lds esi, dword ptr [esi-43]
:00553EC9 58 pop eax
:00553ECA BFF9BB7EBD mov edi, BD7EBBF9
:00553ECF D0ADABB773BF shr byte ptr [ebp+BF73B7AB], 1
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00553E8A(C)
|
:00553ED5 E9A44A0000 jmp 0055897E
:00553EDA 0000 add byte ptr [eax], al
:00553EDC 53 push ebx
:00553EDD 56 push esi
:00553EDE 57 push edi
:00553EDF 55 push ebp
:00553EE0 83C4E8 add esp, FFFFFFE8
:00553EE3 8BFA mov edi, edx
:00553EE5 8BD8 mov ebx, eax
:00553EE7 33F6 xor esi, esi
:00553EE9 E8566BEBFF call 0040AA44
:00553EEE E8F1EBEAFF call 00402AE4
:00553EF3 89442410 mov dword ptr [esp+10], eax
:00553EF7 89542414 mov dword ptr [esp+14], edx
:00553EFB DF6C2410 fild qword ptr [esp+10]
:00553EFF DD5C2408 fstp qword ptr [esp+08]
:00553F03 9B wait
:00553F04 E83B6BEBFF call 0040AA44
:00553F09 E8D6EBEAFF call 00402AE4
:00553F0E 89442410 mov dword ptr [esp+10], eax
:00553F12 89542414 mov dword ptr [esp+14], edx
:00553F16 DF6C2410 fild qword ptr [esp+10]
:00553F1A DD1C24 fstp qword ptr [esp]
:00553F1D 9B wait
:00553F1E B201 mov dl, 01
:00553F20 A194084600 mov eax, dword ptr [00460894]
:00553F25 E86ACAF0FF call 00460994
:00553F2A 8BE8 mov ebp, eax
:00553F2C 89AB10080000 mov dword ptr [ebx+00000810], ebp
:00553F32 BA01000080 mov edx, 80000001
:00553F37 8BC5 mov eax, ebp
:00553F39 E8F6CAF0FF call 00460A34
:00553F3E B101 mov cl, 01
* Possible StringData Ref from Code Obj ->"\Software\Microsoft\Alex"
|
:00553F40 BA44415500 mov edx, 00554144
:00553F45 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00553F4B E848CBF0FF call 00460A98
* Possible StringData Ref from Code Obj ->"UseCount"
|
:00553F50 BA68415500 mov edx, 00554168
:00553F55 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00553F5B E8DCCEF0FF call 00460E3C
:00553F60 84C0 test al, al
:00553F62 7414 je 00553F78
* Possible StringData Ref from Code Obj ->"UseCount"
|
:00553F64 BA68415500 mov edx, 00554168
:00553F69 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00553F6F E84CCDF0FF call 00460CC0
:00553F74 8BF0 mov esi, eax
:00553F76 EB15 jmp 00553F8D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00553F62(C)
|
:00553F78 B901000000 mov ecx, 00000001
* Possible StringData Ref from Code Obj ->"UseCount"
|
:00553F7D BA68415500 mov edx, 00554168
:00553F82 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00553F88 E81FCDF0FF call 00460CAC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00553F76(U)
|
* Possible StringData Ref from Code Obj ->"GoId"
|
:00553F8D BA7C415500 mov edx, 0055417C
:00553F92 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00553F98 E89FCEF0FF call 00460E3C
:00553F9D 84C0 test al, al
:00553F9F 7417 je 00553FB8
* Possible StringData Ref from Code Obj ->"GoId"
|
:00553FA1 BA7C415500 mov edx, 0055417C
:00553FA6 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00553FAC E89BCDF0FF call 00460D4C
:00553FB1 DD5C2408 fstp qword ptr [esp+08]
:00553FB5 9B wait
:00553FB6 EB2D jmp 00553FE5
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00553F9F(C)
|
:00553FB8 E8876AEBFF call 0040AA44
:00553FBD E822EBEAFF call 00402AE4
:00553FC2 89442410 mov dword ptr [esp+10], eax
:00553FC6 89542414 mov dword ptr [esp+14], edx
:00553FCA DF6C2410 fild qword ptr [esp+10]
:00553FCE 83C4F8 add esp, FFFFFFF8
:00553FD1 DD1C24 fstp qword ptr [esp]
:00553FD4 9B wait
* Possible StringData Ref from Code Obj ->"GoId"
|
:00553FD5 BA7C415500 mov edx, 0055417C
:00553FDA 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00553FE0 E853CDF0FF call 00460D38
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00553FB6(U)
|
* Possible StringData Ref from Code Obj ->"CurrentId"
|
:00553FE5 BA8C415500 mov edx, 0055418C
:00553FEA 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00553FF0 E847CEF0FF call 00460E3C
:00553FF5 84C0 test al, al
:00553FF7 7416 je 0055400F
* Possible StringData Ref from Code Obj ->"CurrentId"
|
:00553FF9 BA8C415500 mov edx, 0055418C
:00553FFE 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00554004 E843CDF0FF call 00460D4C
:00554009 DD1C24 fstp qword ptr [esp]
:0055400C 9B wait
:0055400D EB2D jmp 0055403C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00553FF7(C)
|
:0055400F E8306AEBFF call 0040AA44
:00554014 E8CBEAEAFF call 00402AE4
:00554019 89442410 mov dword ptr [esp+10], eax
:0055401D 89542414 mov dword ptr [esp+14], edx
:00554021 DF6C2410 fild qword ptr [esp+10]
:00554025 83C4F8 add esp, FFFFFFF8
:00554028 DD1C24 fstp qword ptr [esp]
:0055402B 9B wait
* Possible StringData Ref from Code Obj ->"CurrentId"
|
:0055402C BA8C415500 mov edx, 0055418C
:00554031 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00554037 E8FCCCF0FF call 00460D38
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0055400D(U)
|
:0055403C DD0424 fld qword ptr [esp]
:0055403F DC642408 fsub qword ptr [esp+08]
:00554043 D81D98415500 fcomp dword ptr [00554198]
:00554049 DFE0 fstsw ax
:0055404B 9E sahf
:0055404C 7305 jnb 00554053
:0055404E 83FE78 cmp esi, 00000078
:00554051 7C43 jl 00554096
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0055404C(C)
|
* Possible StringData Ref from Code Obj ->"感著您的?用陪支持！
您已超咿?用30天之期限
"
->"因而?法擂理使用本?篦"
|
:00554053 B8A4415500 mov eax, 005541A4
:00554058 E81397F0FF call 0045D770
* Possible StringData Ref from Code Obj ->"如您需擂理使用本系靳，?至全省各地?湮商?偕
"
->"
或上咀查? 法老王彩券咣?咀站 "
->"www.CSNet.com.tw"
|
:0055405D B8F4415500 mov eax, 005541F4
:00554062 E80997F0FF call 0045D770
:00554067 8B8310080000 mov eax, dword ptr [ebx+00000810]
:0055406D E892C9F0FF call 00460A04
:00554072 8B8310080000 mov eax, dword ptr [ebx+00000810]
:00554078 E83BF0EAFF call 004030B8
:0055407D 33C0 xor eax, eax
:0055407F 898310080000 mov dword ptr [ebx+00000810], eax
:00554085 A16CE45500 mov eax, dword ptr [0055E46C]
:0055408A 8B00 mov eax, dword ptr [eax]
:0055408C E8DB07F0FF call 0045486C
:00554091 E99E000000 jmp 00554134
[课程]FART 脱壳王！加量不加价！FART作者讲授！
