用PEID查下来是VC++扩展信息里面平均信息和EP检测都是压缩的！
OD加载后判断文件是加密的，而且带反跟踪，尝试爆破后，文件还带自校验
有高手能看看么
OD载入后看上去不像是vc++的文件头
00484000 > 60 PUSHAD
00484001 EB 01 JMP SHORT TOFlower.00484004
00484003 7E 0F JLE SHORT TOFlower.00484014
00484005 8502 TEST DWORD PTR DS:[EDX],EAX
00484007 0000 ADD BYTE PTR DS:[EAX],AL
00484009 0003 ADD BYTE PTR DS:[EBX],AL
0048400B D5 F8 AAD 0F8
0048400D 66:8BC7 MOV AX,DI
00484010 1BC6 SBB EAX,ESI
00484012 EB 01 JMP SHORT TOFlower.00484015
00484014 - 73 85 JNB SHORT TOFlower.00483F9B
00484016 C3 RETN
00484017 E8 01000000 CALL TOFlower.0048401D
0048401C E8 83C40487 CALL 874D04A4
00484021 D9E8 FLD1
00484023 0100 ADD DWORD PTR DS:[EAX],EAX
00484025 0000 ADD BYTE PTR DS:[EAX],AL
00484027 - 74 83 JE SHORT TOFlower.00483FAC
00484029 04 24 ADD AL,24
0048402B 06 PUSH ES
0048402C C3 RETN
0048402D FC CLD
0048402E 78 03 JS SHORT TOFlower.00484033
00484030 79 01 JNS SHORT TOFlower.00484033
00484032 75 0F JNZ SHORT TOFlower.00484043
00484034 870400 XCHG DWORD PTR DS:[EAX+EAX],EAX
00484037 0000 ADD BYTE PTR DS:[EAX],AL
00484039 66:B9 FC61 MOV CX,61FC
0048403D 74 03 JE SHORT TOFlower.00484042
0048403F 75 01 JNZ SHORT TOFlower.00484042
00484041 76 74 JBE SHORT TOFlower.004840B7
00484043 01F9 ADD ECX,EDI
00484045 EB 01 JMP SHORT TOFlower.00484048
00484047 ^ 75 F8 JNZ SHORT TOFlower.00484041
00484049 50 PUSH EAX
0048404A E8 01000000 CALL TOFlower.00484050
0048404F - 72 83 JB SHORT TOFlower.00483FD4
00484051 C40458 LES EAX,FWORD PTR DS:[EAX+EBX*2] ; 段寄存器更改
00484054 66:D3D1 RCL CX,CL
00484057 78 03 JS SHORT TOFlower.0048405C
00484059 79 01 JNS SHORT TOFlower.0048405C
0048405B 77 7C JA SHORT TOFlower.004840D9
0048405D 02D3 ADD DL,BL
0048405F C9 LEAVE
00484060 E8 01000000 CALL TOFlower.00484066
00484065 - 73 83 JNB SHORT TOFlower.00483FEA
00484067 04 24 ADD AL,24
00484069 06 PUSH ES
0048406A C3 RETN
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
