0042DF90 >/$ 55 push ebp
0042DF91 |. 8BEC mov ebp,esp
0042DF93 |. 6A FF push -0x1
0042DF95 |. 68 80CE4400 push ArchiveM.0044CE80
0042DF9A |. 68 FAE04200 push <jmp.&MSVCRT._except_handler3> ; SE 处理程序安装
0042DF9F |. 64:A1 0000000>mov eax,dword ptr fs:[0]
0042DFA5 |. 50 push eax ; msvcrt.77C31743
0042DFA6 |. 64:8925 00000>mov dword ptr fs:[0],esp
0042DFAD |. 83EC 68 sub esp,0x68
0042DFB0 |. 53 push ebx
0042DFB1 |. 56 push esi
0042DFB2 |. 57 push edi
0042DFB3 |. 8965 E8 mov [local.6],esp
0042DFB6 |. 33DB xor ebx,ebx
0042DFB8 |. 895D FC mov [local.1],ebx
0042DFBB |. 6A 02 push 0x2
0042DFBD |. FF15 447B4400 call dword ptr ds:[<&MSVCRT.__set_app_ty>; msvcrt.__set_app_type
0042DFC3 |. 59 pop ecx ; 0012CF9C
0042DFC4 |. 830D 4C264600>or dword ptr ds:[0x46264C],-0x1
0042DFCB |. 830D 50264600>or dword ptr ds:[0x462650],-0x1
0042DFD2 |. FF15 487B4400 call dword ptr ds:[<&MSVCRT.__p__fmode>] ; msvcrt.__p__fmode
0042DFD8 |. 8B0D 301A4600 mov ecx,dword ptr ds:[0x461A30]
0042DFDE |. 8908 mov dword ptr ds:[eax],ecx ; ArchiveM.00439670
0042DFE0 |. FF15 4C7B4400 call dword ptr ds:[<&MSVCRT.__p__commode>; msvcrt.__p__commode
0042DFE6 |. 8B0D 2C1A4600 mov ecx,dword ptr ds:[0x461A2C]
0042DFEC |. 8908 mov dword ptr ds:[eax],ecx ; ArchiveM.00439670
0042DFEE |. A1 507B4400 mov eax,dword ptr ds:[<&MSVCRT._adjust_f>
0042DFF3 |. 8B00 mov eax,dword ptr ds:[eax]
0042DFF5 |. A3 48264600 mov dword ptr ds:[0x462648],eax ; msvcrt.77C31743
0042DFFA |. E8 22010000 call ArchiveM.0042E121
0042DFFF |. 391D A0024600 cmp dword ptr ds:[0x4602A0],ebx
0042E005 |. 75 0C jnz short ArchiveM.0042E013
0042E007 |. 68 1EE14200 push ArchiveM.0042E11E
0042E00C |. FF15 547B4400 call dword ptr ds:[<&MSVCRT.__setusermat>; msvcrt.__setusermatherr
0042E012 |. 59 pop ecx ; 0012CF9C
0042E013 |> E8 F4000000 call ArchiveM.0042E10C
0042E018 |. 68 64E04500 push ArchiveM.0045E064
0042E01D |. 68 60E04500 push ArchiveM.0045E060
0042E022 |. E8 DF000000 call <jmp.&MSVCRT._initterm>
0042E027 |. A1 281A4600 mov eax,dword ptr ds:[0x461A28]
0042E02C |. 8945 94 mov [local.27],eax ; msvcrt.77C31743
0042E02F |. 8D45 94 lea eax,[local.27]
0042E032 |. 50 push eax ; msvcrt.77C31743
0042E033 |. FF35 241A4600 push dword ptr ds:[0x461A24]
0042E039 |. 8D45 9C lea eax,[local.25]
0042E03C |. 50 push eax ; msvcrt.77C31743
0042E03D |. 8D45 90 lea eax,[local.28]
0042E040 |. 50 push eax ; msvcrt.77C31743
0042E041 |. 8D45 A0 lea eax,[local.24]
0042E044 |. 50 push eax ; msvcrt.77C31743
0042E045 |. FF15 5C7B4400 call dword ptr ds:[<&MSVCRT.__getmainarg>; msvcrt.__getmainargs
0042E04B |. 68 5CE04500 push ArchiveM.0045E05C
0042E050 |. 68 00E04500 push ArchiveM.0045E000
0042E055 |. E8 AC000000 call <jmp.&MSVCRT._initterm>
0042E05A |. 83C4 24 add esp,0x24
0042E05D |. A1 607B4400 mov eax,dword ptr ds:[<&MSVCRT._acmdln>]
0042E062 |. 8B30 mov esi,dword ptr ds:[eax]
0042E064 |. 8975 8C mov [local.29],esi
0042E067 |. 803E 22 cmp byte ptr ds:[esi],0x22
0042E06A |. 75 3A jnz short ArchiveM.0042E0A6
0042E06C |> 46 /inc esi
0042E06D |. 8975 8C |mov [local.29],esi
0042E070 |. 8A06 |mov al,byte ptr ds:[esi]
0042E072 |. 3AC3 |cmp al,bl
0042E074 |. 74 04 |je short ArchiveM.0042E07A
0042E076 |. 3C 22 |cmp al,0x22
0042E078 |.^ 75 F2 \jnz short ArchiveM.0042E06C
0042E07A |> 803E 22 cmp byte ptr ds:[esi],0x22
0042E07D |. 75 04 jnz short ArchiveM.0042E083
0042E07F |> 46 inc esi
0042E080 |. 8975 8C mov [local.29],esi
0042E083 |> 8A06 mov al,byte ptr ds:[esi]
0042E085 |. 3AC3 cmp al,bl
0042E087 |. 74 04 je short ArchiveM.0042E08D
0042E089 |. 3C 20 cmp al,0x20
0042E08B |.^ 76 F2 jbe short ArchiveM.0042E07F
0042E08D |> 895D D0 mov [local.12],ebx
0042E090 |. 8D45 A4 lea eax,[local.23]
0042E093 |. 50 push eax ; /pStartupinfo = msvcrt.77C31743
0042E094 |. FF15 AC724400 call dword ptr ds:[<&KERNEL32.GetStartup>; \GetStartupInfoA
0042E09A |. F645 D0 01 test byte ptr ss:[ebp-0x30],0x1
0042E09E |. 74 11 je short ArchiveM.0042E0B1
0042E0A0 |. 0FB745 D4 movzx eax,word ptr ss:[ebp-0x2C]
0042E0A4 |. EB 0E jmp short ArchiveM.0042E0B4
0042E0A6 |> 803E 20 /cmp byte ptr ds:[esi],0x20
0042E0A9 |.^ 76 D8 |jbe short ArchiveM.0042E083
0042E0AB |. 46 |inc esi
0042E0AC |. 8975 8C |mov [local.29],esi
0042E0AF |.^ EB F5 \jmp short ArchiveM.0042E0A6
0042E0B1 |> 6A 0A push 0xA
0042E0B3 |. 58 pop eax ; 0012CF9C
0042E0B4 |> 50 push eax ; msvcrt.77C31743
0042E0B5 |. 56 push esi
0042E0B6 |. 53 push ebx
0042E0B7 |. 53 push ebx ; /pModule = NULL
0042E0B8 |. FF15 78724400 call dword ptr ds:[<&KERNEL32.GetModuleH>; \GetModuleHandleA
0042E0BE |. 50 push eax ; msvcrt.77C31743
0042E0BF |. E8 5A160100 call ArchiveM.0043F71E
0042E0C4 |. 8945 98 mov [local.26],eax ; msvcrt.77C31743
0042E0C7 |. 50 push eax ; /status = 77C31743 (2009274179.)
0042E0C8 |. FF15 747B4400 call dword ptr ds:[<&MSVCRT.exit>] ; \exit 如何跳过退出
0042E0CE |. 8B45 EC mov eax,[local.5]
0042E0D1 |. 8B08 mov ecx,dword ptr ds:[eax]
0042E0D3 |. 8B09 mov ecx,dword ptr ds:[ecx]
0042E0D5 |. 894D 88 mov [local.30],ecx ; ArchiveM.00439670
0042E0D8 |. 50 push eax ; msvcrt.77C31743
0042E0D9 |. 51 push ecx ; ArchiveM.00439670
0042E0DA |. E8 21000000 call <jmp.&MSVCRT._XcptFilter>
0042E0DF |. 59 pop ecx ; 0012CF9C
0042E0E0 |. 59 pop ecx ; 0012CF9C
0042E0E1 \. C3 retn
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
