下面tmp.exe的一部分代码,Microsoft Visual C++ 5.0 [Debug]
00404C8A . E8 A3C3FFFF CALL tmp.00401032
...
00401032 $ /E9 193F0000 JMP tmp.00404F50
...
00404F50 > \55 PUSH EBP
00404F51 . 8BEC MOV EBP,ESP
00404F53 . 6A FF PUSH -1
00404F55 . 68 1C7A4100 PUSH tmp.00417A1C ; SE 处理程序安装(程序入口)
00404F5A . 64:A1 0000000>MOV EAX,DWORD PTR FS:[0]
00404F60 . 50 PUSH EAX
00404F61 . 64:8925 00000>MOV DWORD PTR FS:[0],ESP
00404F68 . 81EC 6C010000 SUB ESP,16C
00404F6E . 53 PUSH EBX
00404F6F . 56 PUSH ESI
00404F70 . 57 PUSH EDI
00404F71 . 8DBD 88FEFFFF LEA EDI,DWORD PTR SS:[EBP-178]
00404F77 . B9 5B000000 MOV ECX,5B
00404F7C . B8 CCCCCCCC MOV EAX,CCCCCCCC
00404F81 . F3:AB REP STOS DWORD PTR ES:[EDI]
00404F83 . 8D8D 04FFFFFF LEA ECX,DWORD PTR SS:[EBP-FC]
00404F89 . E8 8BC0FFFF CALL tmp.00401019
...
00401019 $ /E9 52010000 JMP tmp.00401170
...
00401170 /> \55 PUSH EBP
00401171 |. 8BEC MOV EBP,ESP
00401173 |. 83EC 44 SUB ESP,44
00401176 |. 53 PUSH EBX
00401177 |. 56 PUSH ESI
00401178 |. 57 PUSH EDI
00401179 |. 51 PUSH ECX
0040117A |. 8D7D BC LEA EDI,DWORD PTR SS:[EBP-44]
0040117D |. B9 11000000 MOV ECX,11
00401182 |. B8 CCCCCCCC MOV EAX,CCCCCCCC
00401187 |. F3:AB REP STOS DWORD PTR ES:[EDI]
00401189 |. 59 POP ECX
0040118A |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
0040118D |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00401190 |. C700 1C904200 MOV DWORD PTR DS:[EAX],tmp.0042901C
00401196 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00401199 |. 5F POP EDI
0040119A |. 5E POP ESI
0040119B |. 5B POP EBX
0040119C |. 8BE5 MOV ESP,EBP
0040119E |. 5D POP EBP
0040119F \. C3 RETN
这应该是很常见的一段代码,有点像出错处理什么的,可是我是菜鸟还没见到过
请高手帮我看一下这段代码是干什么的,对应的VC代码是什么?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课