[求助]帮忙分析一下我的CRECKME 谢谢-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[求助]帮忙分析一下我的CRECKME 谢谢

2006-11-10 17:01 8549

[求助]帮忙分析一下我的CRECKME 谢谢

lieben

2006-11-10 17:01

8549

00401000 > .  B8 0C234000 mov    eax, offset CtestApp::messageMap
00401005 .  C3          retn
00401006    CC          int3
00401007    CC          int3
00401008    CC          int3
00401009    CC          int3
0040100A    CC          int3
0040100B    CC          int3
0040100C    CC          int3
0040100D    CC          int3
0040100E    CC          int3
0040100F    CC          int3
00401010 >/$  56          push esi
00401011  |.  6A 00       push 0
00401013  |.  8BF1       mov    esi, ecx
00401015  |.  E8 5E060000 call CWinApp::CWinApp
0040101A  |.  C706 48234000 mov    dword ptr [esi], offset CtestApp>
00401020  |.  8BC6       mov    eax, esi
00401022  |.  5E          pop    esi
00401023  \.  C3          retn
00401024    CC          int3
00401025    CC          int3
00401026    CC          int3
00401027    CC          int3
00401028    CC          int3
00401029    CC          int3
0040102A    CC          int3
0040102B    CC          int3
0040102C    CC          int3
0040102D    CC          int3
0040102E    CC          int3
0040102F    CC          int3
00401030 > $  E9 49060000 jmp    CWinApp::~CWinApp
00401035    CC          int3
00401036    CC          int3
00401037    CC          int3
00401038    CC          int3
00401039    CC          int3
0040103A    CC          int3
0040103B    CC          int3
0040103C    CC          int3
0040103D    CC          int3
0040103E    CC          int3
0040103F    CC          int3
00401040 > $  56          push esi
00401041 .  8BF1       mov    esi, ecx
00401043 .  8D4E 7C    lea    ecx, dword ptr [esi+7C]
00401046 .  FF15 68204000 call dword ptr [<&MFC71.#578_ATL::CSt>;  MFC71.ATL::CSimpleStringT<char,1>::~CSimpleStringT<char,1>
0040104C .  8D4E 78    lea    ecx, dword ptr [esi+78]
0040104F .  FF15 68204000 call dword ptr [<&MFC71.#578_ATL::CSt>;  MFC71.ATL::CSimpleStringT<char,1>::~CSimpleStringT<char,1>
00401055 .  8BCE       mov    ecx, esi
00401057 .  5E          pop    esi
00401058 .  E9 27060000 jmp    CDialog::~CDialog
0040105D    CC          int3
0040105E    CC          int3
0040105F    CC          int3
00401060 > .  C2 0400    retn 4
00401063    CC          int3
00401064    CC          int3
00401065    CC          int3
00401066    CC          int3
00401067    CC          int3
00401068    CC          int3
00401069    CC          int3
0040106A    CC          int3
0040106B    CC          int3
0040106C    CC          int3
0040106D    CC          int3
0040106E    CC          int3
0040106F    CC          int3
00401070 > .  C3          retn
00401071    CC          int3
00401072    CC          int3
00401073    CC          int3
00401074    CC          int3
00401075    CC          int3
00401076    CC          int3
00401077    CC          int3
00401078    CC          int3
00401079    CC          int3
0040107A    CC          int3
0040107B    CC          int3
0040107C    CC          int3
0040107D    CC          int3
0040107E    CC          int3
0040107F    CC          int3
00401080 > .  56          push esi
00401081 .  8BF1       mov    esi, ecx
00401083 .  E8 A8FFFFFF call CtestApp::~CtestApp
00401088 .  F64424 08 01  test byte ptr [esp+8], 1
0040108D .  74 09       je    short 00401098
0040108F .  56          push esi                            ; /block
00401090 .  E8 F5050000 call operator delete                ; \free
00401095 .  83C4 04    add    esp, 4
00401098 >  8BC6       mov    eax, esi
0040109A .  5E          pop    esi
0040109B .  C2 0400    retn 4
0040109E    CC          int3
0040109F    CC          int3
004010A0 > .  6A FF       push -1
004010A2 .  68 8B1E4000 push 00401E8B                      ;  SE 处理程序安装
004010A7 .  64:A1 0000000>mov    eax, dword ptr fs:[0]
004010AD .  50          push eax
004010AE .  64:8925 00000>mov    dword ptr fs:[0], esp
004010B5 .  81EC 80000000 sub    esp, 80
004010BB .  56          push esi
004010BC .  8BF1       mov    esi, ecx
004010BE .  FF15 00204000 call dword ptr [<&COMCTL32.#17>]    ; [InitCommonControls
004010C4 .  8BCE       mov    ecx, esi
004010C6 .  E8 D7050000 call CWinApp::InitInstance          ;  jmp 到 MFC71.CWinApp::InitInstance
004010CB .  6A 00       push 0
004010CD .  E8 CA050000 call AfxEnableControlContainer
004010D2 .  83C4 04    add    esp, 4
004010D5 .  68 08244000 push 00402408
004010DA .  8BCE       mov    ecx, esi
004010DC .  E8 B5050000 call CWinApp::SetRegistryKey
004010E1 .  6A 00       push 0
004010E3 .  8D4C24 08    lea    ecx, dword ptr [esp+8]
004010E7 .  E8 04010000 call CtestDlg::CtestDlg
004010EC .  8D4424 04    lea    eax, dword ptr [esp+4]
004010F0 .  8D4C24 04    lea    ecx, dword ptr [esp+4]
004010F4 .  C78424 8C0000>mov    dword ptr [esp+8C], 0
004010FF .  8946 20    mov    dword ptr [esi+20], eax
00401102 .  E8 89050000 call CDialog::DoModal
00401107 .  8D8C24 800000>lea    ecx, dword ptr [esp+80]
0040110E .  C78424 8C0000>mov    dword ptr [esp+8C], -1
00401119 .  FF15 68204000 call dword ptr [<&MFC71.#578_ATL::CSt>;  MFC71.ATL::CSimpleStringT<char,1>::~CSimpleStringT<char,1>
0040111F .  8D4C24 7C    lea    ecx, dword ptr [esp+7C]
00401123 .  FF15 68204000 call dword ptr [<&MFC71.#578_ATL::CSt>;  MFC71.ATL::CSimpleStringT<char,1>::~CSimpleStringT<char,1>
00401129 .  8D4C24 04    lea    ecx, dword ptr [esp+4]
0040112D .  E8 52050000 call CDialog::~CDialog
00401132 .  8B8C24 840000>mov    ecx, dword ptr [esp+84]
00401139 .  33C0       xor    eax, eax
0040113B .  5E          pop    esi
0040113C .  64:890D 00000>mov    dword ptr fs:[0], ecx
00401143 .  81C4 8C000000 add    esp, 8C
00401149 .  C3          retn
0040114A    CC          int3
0040114B    CC          int3
0040114C    CC          int3
0040114D    CC          int3
0040114E    CC          int3
0040114F    CC          int3
00401150 > $  E9 2F050000 jmp    CDialog::~CDialog
00401155    CC          int3
00401156    CC          int3
00401157    CC          int3
00401158    CC          int3
00401159    CC          int3
0040115A    CC          int3
0040115B    CC          int3
0040115C    CC          int3
0040115D    CC          int3
0040115E    CC          int3
0040115F    CC          int3
00401160 > .  B8 A8244000 mov    eax, offset CAboutDlg::messageMa>
00401165 .  C3          retn
00401166    CC          int3
00401167    CC          int3
00401168    CC          int3
00401169    CC          int3
0040116A    CC          int3
0040116B    CC          int3
0040116C    CC          int3
0040116D    CC          int3
0040116E    CC          int3
0040116F    CC          int3
00401170 > .  B8 28244000 mov    eax, offset CtestDlg::messageMap
00401175 .  C3          retn
00401176    CC          int3
00401177    CC          int3
00401178    CC          int3
00401179    CC          int3
0040117A    CC          int3
0040117B    CC          int3
0040117C    CC          int3
0040117D    CC          int3
0040117E    CC          int3
0040117F    CC          int3
00401180 > .  8B41 74    mov    eax, dword ptr [ecx+74]
00401183 .  C3          retn
00401184    CC          int3
00401185    CC          int3
00401186    CC          int3
00401187    CC          int3
00401188    CC          int3
00401189    CC          int3
0040118A    CC          int3
0040118B    CC          int3
0040118C    CC          int3
0040118D    CC          int3
0040118E    CC          int3
0040118F    CC          int3
00401190 > .  8B41 20    mov    eax, dword ptr [ecx+20]
00401193 .  6A 00       push 0                               ; /Enable = FALSE
00401195 .  50          push eax                            ; |hWnd
00401196 .  FF15 C8224000 call dword ptr [<&USER32.EnableWindow>; \EnableWindow
0040119C .  C3          retn
0040119D    CC          int3
0040119E    CC          int3
0040119F    CC          int3
004011A0 > .  8B41 20    mov    eax, dword ptr [ecx+20]
004011A3 .  6A 01       push 1                               ; /Enable = TRUE
004011A5 .  50          push eax                            ; |hWnd
004011A6 .  FF15 C8224000 call dword ptr [<&USER32.EnableWindow>; \EnableWindow
004011AC .  C3          retn
004011AD    CC          int3
004011AE    CC          int3
004011AF    CC          int3
004011B0 > .  8B01       mov    eax, dword ptr [ecx]
004011B2 .  0FB75424 04 movzx edx, word ptr [esp+4]
004011B7 .  895424 04    mov    dword ptr [esp+4], edx
004011BB .  FFA0 3C010000 jmp    dword ptr [eax+13C]
004011C1    CC          int3
004011C2    CC          int3
004011C3    CC          int3
004011C4    CC          int3
004011C5    CC          int3
004011C6    CC          int3
004011C7    CC          int3
004011C8    CC          int3
004011C9    CC          int3
004011CA    CC          int3
004011CB    CC          int3
004011CC    CC          int3
004011CD    CC          int3
004011CE    CC          int3
004011CF    CC          int3
004011D0 > .  56          push esi
004011D1 .  8BF1       mov    esi, ecx
004011D3 .  E8 78FFFFFF call CAboutDlg::~CAboutDlg
004011D8 .  F64424 08 01  test byte ptr [esp+8], 1
004011DD .  74 09       je    short 004011E8
004011DF .  56          push esi                            ; /block
004011E0 .  E8 A5040000 call operator delete                ; \free
004011E5 .  83C4 04    add    esp, 4
004011E8 >  8BC6       mov    eax, esi
004011EA .  5E          pop    esi
004011EB .  C2 0400    retn 4
004011EE    CC          int3
004011EF    CC          int3
004011F0 >/$  6A FF       push -1
004011F2  |.  68 C01E4000 push 00401EC0                      ;  SE 处理程序安装
004011F7  |.  64:A1 0000000>mov    eax, dword ptr fs:[0]
004011FD  |.  50          push eax
004011FE  |.  64:8925 00000>mov    dword ptr fs:[0], esp
00401205  |.  51          push ecx
00401206  |.  8B4424 14    mov    eax, dword ptr [esp+14]
0040120A  |.  56          push esi
0040120B  |.  50          push eax
0040120C  |.  8BF1       mov    esi, ecx
0040120E  |.  6A 66       push 66
00401210  |.  897424 0C    mov    dword ptr [esp+C], esi
00401214  |.  E8 1B060000 call CDialog::CDialog                ;  jmp 到 MFC71.CDialog::CDialog
00401219  |.  68 88274000 push 00402788
0040121E  |.  8D4E 78    lea    ecx, dword ptr [esi+78]
00401221  |.  C74424 14 000>mov    dword ptr [esp+14], 0
00401229  |.  C706 28264000 mov    dword ptr [esi], offset CtestDlg>
0040122F  |.  FF15 A4214000 call dword ptr [<&MFC71.#304_ATL::CSt>;  MFC71.ATL::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > >::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > >
00401235  |.  68 88274000 push 00402788
0040123A  |.  8D4E 7C    lea    ecx, dword ptr [esi+7C]
0040123D  |.  C64424 14 01  mov    byte ptr [esp+14], 1
00401242  |.  FF15 A4214000 call dword ptr [<&MFC71.#304_ATL::CSt>;  MFC71.ATL::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > >::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > >
00401248  |.  C64424 10 02  mov    byte ptr [esp+10], 2
0040124D  |.  E8 E8050000 call AfxGetModuleState             ;  jmp 到 MFC71.AfxGetModuleState
00401252  |.  68 80000000 push 80
00401257  |.  6A 0E       push 0E
00401259  |.  68 80000000 push 80
0040125E  |.  E8 E9050000 call AfxFindResourceHandle
00401263  |.  50          push eax                            ; |hInst
00401264  |.  FF15 C4224000 call dword ptr [<&USER32.LoadIconA>]  ; \LoadIconA
0040126A  |.  8B4C24 08    mov    ecx, dword ptr [esp+8]
0040126E  |.  8946 74    mov    dword ptr [esi+74], eax
00401271  |.  8BC6       mov    eax, esi
00401273  |.  5E          pop    esi
00401274  |.  64:890D 00000>mov    dword ptr fs:[0], ecx
0040127B  |.  83C4 10    add    esp, 10
0040127E  \.  C2 0400    retn 4
00401281    CC          int3
00401282    CC          int3
00401283    CC          int3
00401284    CC          int3
00401285    CC          int3
00401286    CC          int3
00401287    CC          int3
00401288    CC          int3
00401289    CC          int3
0040128A    CC          int3
0040128B    CC          int3
0040128C    CC          int3
0040128D    CC          int3
0040128E    CC          int3
0040128F    CC          int3
00401290 > .  56          push esi
00401291 .  8BF1       mov    esi, ecx
00401293 .  E8 A8FDFFFF call CtestDlg::~CtestDlg
00401298 .  F64424 08 01  test byte ptr [esp+8], 1
0040129D .  74 09       je    short 004012A8
0040129F .  56          push esi                            ; /block
004012A0 .  E8 E5030000 call operator delete                ; \free
004012A5 .  83C4 04    add    esp, 4
004012A8 >  8BC6       mov    eax, esi
004012AA .  5E          pop    esi
004012AB .  C2 0400    retn 4
004012AE    CC          int3
004012AF    CC          int3
004012B0 > .  56          push esi
004012B1 .  57          push edi
004012B2 .  8B7C24 0C    mov    edi, dword ptr [esp+C]
004012B6 .  8BF1       mov    esi, ecx
004012B8 .  8D46 78    lea    eax, dword ptr [esi+78]
004012BB .  50          push eax
004012BC .  68 E8030000 push 3E8
004012C1 .  57          push edi
004012C2 .  E8 8B050000 call DDX_Text                      ;  jmp 到 MFC71.DDX_Text
004012C7 .  83C6 7C    add    esi, 7C
004012CA .  56          push esi
004012CB .  68 E9030000 push 3E9
004012D0 .  57          push edi
004012D1 .  E8 7C050000 call DDX_Text                      ;  jmp 到 MFC71.DDX_Text
004012D6 .  5F          pop    edi
004012D7 .  5E          pop    esi
004012D8 .  C2 0400    retn 4
004012DB    CC          int3
004012DC    CC          int3
004012DD    CC          int3
004012DE    CC          int3
004012DF    CC          int3
004012E0 > .  6A FF       push -1
004012E2 .  68 D91E4000 push 00401ED9                      ;  SE 处理程序安装
004012E7 .  64:A1 0000000>mov    eax, dword ptr fs:[0]
004012ED .  50          push eax
004012EE .  64:8925 00000>mov    dword ptr fs:[0], esp
004012F5 .  51          push ecx
004012F6 .  56          push esi
004012F7 .  57          push edi
004012F8 .  8BF1       mov    esi, ecx
004012FA .  E8 C7030000 call CDialog::OnInitDialog          ;  jmp 到 MFC71.CDialog::OnInitDialog
004012FF .  8B46 20    mov    eax, dword ptr [esi+20]
00401302 .  6A 00       push 0                               ; /Revert = FALSE
00401304 .  50          push eax                            ; |hWnd
00401305 .  FF15 D8224000 call dword ptr [<&USER32.GetSystemMen>; \GetSystemMenu
0040130B .  50          push eax
0040130C .  E8 2F050000 call CMenu::FromHandle             ;  jmp 到 MFC71.CMenu::FromHandle
00401311 .  8BF8       mov    edi, eax
00401313 .  85FF       test edi, edi
00401315 .  74 62       je    short 00401379
00401317 .  8D4C24 08    lea    ecx, dword ptr [esp+8]
0040131B .  FF15 B4214000 call dword ptr [<&MFC71.#310_ATL::CSt>;  MFC71.ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >
00401321 .  6A 65       push 65
00401323 .  8D4C24 0C    lea    ecx, dword ptr [esp+C]
00401327 .  C74424 18 000>mov    dword ptr [esp+18], 0
0040132F .  FF15 B0214000 call dword ptr [<&MFC71.#4035_ATL::CS>;  MFC71.ATL::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > >::LoadStringA
00401335 .  8D4C24 08    lea    ecx, dword ptr [esp+8]
00401339 .  FF15 AC214000 call dword ptr [<&MFC71.#3934_ATL::CS>;  MFC71.ATL::CSimpleStringT<wchar_t,1>::IsEmpty
0040133F .  84C0       test al, al
00401341 .  75 2C       jnz    short 0040136F
00401343 .  8B4F 04    mov    ecx, dword ptr [edi+4]
00401346 .  53          push ebx
00401347 .  8B1D E0224000 mov    ebx, dword ptr [<&USER32.AppendM>;  USER32.AppendMenuA
0040134D .  6A 00       push 0                               ; /pItem = NULL
0040134F .  6A 00       push 0                               ; |ItemID = 0
00401351 .  68 00080000 push 800                            ; |Flags = MF_BYCOMMAND|MF_SEPARATOR|MF_ENABLED|MF_STRING
00401356 .  51          push ecx                            ; |hMenu
00401357 .  FFD3       call ebx                            ; \AppendMenuA
00401359 .  8D4C24 0C    lea    ecx, dword ptr [esp+C]
0040135D .  FF15 90214000 call dword ptr [<&MFC71.#876_ATL::CSi>;  MFC71._CIP<IMoniker,&IID_IMoniker>::operator IMoniker *
00401363 .  8B57 04    mov    edx, dword ptr [edi+4]
00401366 .  50          push eax
00401367 .  6A 10       push 10
00401369 .  6A 00       push 0
0040136B .  52          push edx
0040136C .  FFD3       call ebx
0040136E .  5B          pop    ebx
0040136F >  8D4C24 08    lea    ecx, dword ptr [esp+8]
00401373 .  FF15 68204000 call dword ptr [<&MFC71.#578_ATL::CSt>;  MFC71.ATL::CSimpleStringT<char,1>::~CSimpleStringT<char,1>
00401379 >  8B46 74    mov    eax, dword ptr [esi+74]
0040137C .  8B4E 20    mov    ecx, dword ptr [esi+20]
0040137F .  8B3D DC224000 mov    edi, dword ptr [<&USER32.SendMes>;  USER32.SendMessageA
00401385 .  50          push eax                            ; /lParam
00401386 .  6A 01       push 1                               ; |wParam = 1
00401388 .  68 80000000 push 80                            ; |Message = WM_SETICON
0040138D .  51          push ecx                            ; |hWnd
0040138E .  FFD7       call edi                            ; \SendMessageA
00401390 .  8B56 74    mov    edx, dword ptr [esi+74]
00401393 .  8B46 20    mov    eax, dword ptr [esi+20]
00401396 .  52          push edx                            ; /lParam
00401397 .  6A 00       push 0                               ; |wParam = 0
00401399 .  68 80000000 push 80                            ; |Message = WM_SETICON
0040139E .  50          push eax                            ; |hWnd
0040139F .  FFD7       call edi                            ; \SendMessageA
004013A1 .  8B4C24 0C    mov    ecx, dword ptr [esp+C]
004013A5 .  5F          pop    edi
004013A6 .  B8 01000000 mov    eax, 1
004013AB .  5E          pop    esi
004013AC .  64:890D 00000>mov    dword ptr fs:[0], ecx
004013B3 .  83C4 10    add    esp, 10
004013B6 .  C3          retn
004013B7    CC          int3
004013B8    CC          int3
004013B9    CC          int3
004013BA    CC          int3
004013BB    CC          int3
004013BC    CC          int3
004013BD    CC          int3
004013BE    CC          int3
004013BF    CC          int3
004013C0 > .  64:A1 0000000>mov    eax, dword ptr fs:[0]
004013C6 .  6A FF       push -1
004013C8 .  68 F81E4000 push 00401EF8
004013CD .  50          push eax
004013CE .  8B4424 10    mov    eax, dword ptr [esp+10]
004013D2 .  64:8925 00000>mov    dword ptr fs:[0], esp
004013D9 .  25 F0FF0000 and    eax, 0FFF0
004013DE .  83EC 74    sub    esp, 74
004013E1 .  83F8 10    cmp    eax, 10
004013E4 .  75 48       jnz    short 0040142E
004013E6 .  6A 00       push 0
004013E8 .  6A 64       push 64
004013EA .  8D4C24 08    lea    ecx, dword ptr [esp+8]
004013EE .  E8 41040000 call CDialog::CDialog                ;  jmp 到 MFC71.CDialog::CDialog
004013F3 .  C70424 C82440>mov    dword ptr [esp], offset CAboutDl>
004013FA .  8D0C24       lea    ecx, dword ptr [esp]
004013FD .  C74424 7C 000>mov    dword ptr [esp+7C], 0
00401405 .  E8 86020000 call CDialog::DoModal
0040140A .  8D0C24       lea    ecx, dword ptr [esp]
0040140D .  C74424 7C FFF>mov    dword ptr [esp+7C], -1
00401415 .  E8 6A020000 call CDialog::~CDialog
0040141A .  8B4C24 74    mov    ecx, dword ptr [esp+74]
0040141E .  64:890D 00000>mov    dword ptr fs:[0], ecx
00401425 .  81C4 80000000 add    esp, 80
0040142B .  C2 0800    retn 8
0040142E >  E8 13040000 call CWnd::Default                   ;  jmp 到 MFC71.CWnd::Default
00401433 .  8B4C24 74    mov    ecx, dword ptr [esp+74]
00401437 .  64:890D 00000>mov    dword ptr fs:[0], ecx
0040143E .  81C4 80000000 add    esp, 80
00401444 .  C2 0800    retn 8
00401447    CC          int3
00401448    CC          int3
00401449    CC          int3
0040144A    CC          int3
0040144B    CC          int3
0040144C    CC          int3
0040144D    CC          int3
0040144E    CC          int3
0040144F    CC          int3
00401450 > .  83EC 68    sub    esp, 68
00401453 .  A1 20404000 mov    eax, dword ptr [__security_cooki>
00401458 .  56          push esi
00401459 .  8BF1       mov    esi, ecx
0040145B .  894424 68    mov    dword ptr [esp+68], eax
0040145F .  8B46 20    mov    eax, dword ptr [esi+20]
00401462 .  50          push eax                            ; /hWnd
00401463 .  FF15 D4224000 call dword ptr [<&USER32.IsIconic>] ; \IsIconic
00401469 .  85C0       test eax, eax
0040146B .  0F84 8E000000 je    004014FF
00401471 .  53          push ebx
00401472 .  57          push edi
00401473 .  56          push esi
00401474 .  8D4C24 20    lea    ecx, dword ptr [esp+20]
00401478 .  E8 E7030000 call CPaintDC::CPaintDC
0040147D .  8B4C24 20    mov    ecx, dword ptr [esp+20]
00401481 .  8B56 20    mov    edx, dword ptr [esi+20]
00401484 .  6A 00       push 0                               ; /lParam = 0
00401486 .  51          push ecx                            ; |wParam
00401487 .  6A 27       push 27                            ; |Message = WM_ICONERASEBKGND
00401489 .  52          push edx                            ; |hWnd
0040148A .  FF15 DC224000 call dword ptr [<&USER32.SendMessageA>; \SendMessageA
00401490 .  8B3D CC224000 mov    edi, dword ptr [<&USER32.GetSyst>;  USER32.GetSystemMetrics
00401496 .  6A 0B       push 0B                            ; /Index = SM_CXICON
00401498 .  FFD7       call edi                            ; \GetSystemMetrics
0040149A .  6A 0C       push 0C                            ; /Index = SM_CYICON
0040149C .  8BD8       mov    ebx, eax                      ; |
0040149E .  FFD7       call edi                            ; \GetSystemMetrics
004014A0 .  8B4E 20    mov    ecx, dword ptr [esi+20]
004014A3 .  8BF8       mov    edi, eax
004014A5 .  8D4424 0C    lea    eax, dword ptr [esp+C]
004014A9 .  50          push eax                            ; /pRect
004014AA .  51          push ecx                            ; |hWnd
004014AB .  FF15 D0224000 call dword ptr [<&USER32.GetClientRec>; \GetClientRect
004014B1 .  8B4424 18    mov    eax, dword ptr [esp+18]
004014B5 .  8B4C24 10    mov    ecx, dword ptr [esp+10]
004014B9 .  8B56 74    mov    edx, dword ptr [esi+74]
004014BC .  2BC1       sub    eax, ecx
004014BE .  2BC7       sub    eax, edi
004014C0 .  40          inc    eax
004014C1 .  52          push edx                            ; /hIcon
004014C2 .  99          cdq                                     ; |
004014C3 .  2BC2       sub    eax, edx                      ; |
004014C5 .  8B5424 10    mov    edx, dword ptr [esp+10]       ; |
004014C9 .  D1F8       sar    eax, 1                         ; |
004014CB .  50          push eax                            ; |Y
004014CC .  8B4424 1C    mov    eax, dword ptr [esp+1C]       ; |
004014D0 .  2BC2       sub    eax, edx                      ; |
004014D2 .  2BC3       sub    eax, ebx                      ; |
004014D4 .  40          inc    eax                            ; |
004014D5 .  99          cdq                                     ; |
004014D6 .  2BC2       sub    eax, edx                      ; |
004014D8 .  D1F8       sar    eax, 1                         ; |
004014DA .  50          push eax                            ; |X
004014DB .  8B4424 2C    mov    eax, dword ptr [esp+2C]       ; |
004014DF .  50          push eax                            ; |hDC
004014E0 .  FF15 E4224000 call dword ptr [<&USER32.DrawIcon>] ; \DrawIcon
004014E6 .  8D4C24 1C    lea    ecx, dword ptr [esp+1C]
004014EA .  E8 6F030000 call CPaintDC::~CPaintDC             ;  jmp 到 MFC71.CPaintDC::~CPaintDC
004014EF .  5F          pop    edi
004014F0 .  5B          pop    ebx
004014F1 .  5E          pop    esi
004014F2 .  8B4C24 64    mov    ecx, dword ptr [esp+64]
004014F6 .  E8 4E040000 call __security_check_cookie
004014FB .  83C4 68    add    esp, 68
004014FE .  C3          retn
004014FF >  8BCE       mov    ecx, esi
00401501 .  E8 52030000 call CDialog::OnPaint
00401506 .  8B4C24 68    mov    ecx, dword ptr [esp+68]
0040150A .  5E          pop    esi
0040150B .  E8 39040000 call __security_check_cookie
00401510 .  83C4 68    add    esp, 68
00401513 .  C3          retn
00401514    CC          int3
00401515    CC          int3
00401516    CC          int3
00401517    CC          int3
00401518    CC          int3
00401519    CC          int3
0040151A    CC          int3
0040151B    CC          int3
0040151C    CC          int3
0040151D    CC          int3
0040151E    CC          int3
0040151F    CC          int3
00401520 > .  53          push ebx
00401521 .  56          push esi
00401522 .  57          push edi
00401523 .  8BF1       mov    esi, ecx
00401525 .  8D7E 7C    lea    edi, dword ptr [esi+7C]
00401528 .  57          push edi
00401529 .  E8 42030000 call CWnd::GetWindowTextA
0040152E .  8D5E 78    lea    ebx, dword ptr [esi+78]
00401531 .  53          push ebx
00401532 .  8BCE       mov    ecx, esi
00401534 .  E8 37030000 call CWnd::GetWindowTextA
00401539 .  8BCF       mov    ecx, edi
0040153B .  FF15 90214000 call dword ptr [<&MFC71.#876_ATL::CSi>;  MFC71._CIP<IMoniker,&IID_IMoniker>::operator IMoniker *
00401541 .  50          push eax
00401542 .  8BCB       mov    ecx, ebx
00401544 .  FF15 8C214000 call dword ptr [<&MFC71.#1482_ATL::CS>;  MFC71.ATL::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char> > >::Compare
0040154A .  85C0       test eax, eax
0040154C .  6A 00       push 0
0040154E .  8BCE       mov    ecx, esi
00401550 .  6A 00       push 0
00401552 .  75 0E       jnz    short 00401562
00401554 .  68 94274000 push 00402794
00401559 .  E8 0C030000 call CWnd::MessageBoxA             ;  jmp 到 MFC71.CWnd::MessageBoxA
0040155E .  5F          pop    edi
0040155F .  5E          pop    esi
00401560 .  5B          pop    ebx
00401561 .  C3          retn
00401562 >  68 8C274000 push 0040278C
00401567 .  E8 FE020000 call CWnd::MessageBoxA             ;  jmp 到 MFC71.CWnd::MessageBoxA
0040156C .  5F          pop    edi
0040156D .  5E          pop    esi
0040156E .  5B          pop    ebx
0040156F .  C3          retn
00401570 > .- FF25 54224000 jmp    dword ptr [<&MFC71.#4541_CWinApp>;  MFC71.CWinApp::OnHelp
00401576 > .- FF25 4C224000 jmp    dword ptr [<&MFC71.#3683_CWinApp>;  MFC71.CWinApp::GetThisMessageMap
0040157C > .- FF25 48224000 jmp    dword ptr [<&MFC71.#4038_CWinApp>;  MFC71.CWinApp::LoadSysPolicies
00401582 > .- FF25 44224000 jmp    dword ptr [<&MFC71.#4014_CWinApp>;  MFC71.CWinApp::LoadAppLangResourceDLL
00401588 > .- FF25 40224000 jmp    dword ptr [<&MFC71.#6278_CWinApp>;  MFC71.CWinApp::WinHelpInternal
0040158E > .- FF25 3C224000 jmp    dword ptr [<&MFC71.#3801_CWinApp>;  MFC71.CWinApp::HtmlHelpA
00401594 > .- FF25 38224000 jmp    dword ptr [<&MFC71.#6276_CWinApp>;  MFC71.CWinApp::WinHelpA
0040159A > .- FF25 34224000 jmp    dword ptr [<&MFC71.#4326_CWinApp>;  MFC71.CWinApp::OnDDECommand
004015A0 > .- FF25 30224000 jmp    dword ptr [<&MFC71.#2063_CWinApp>;  MFC71.CWinApp::DoWaitCursor
004015A6 > .- FF25 2C224000 jmp    dword ptr [<&MFC71.#2018_CWinApp>;  MFC71.CWinApp::DoMessageBox
004015AC > .- FF25 28224000 jmp    dword ptr [<&MFC71.#5583_CWinApp>;  MFC71.CWinApp::SaveAllModified
004015B2 > .- FF25 24224000 jmp    dword ptr [<&MFC71.#3806_CWinApp>;  MFC71.CWinApp::InitApplication
004015B8 > .- FF25 20224000 jmp    dword ptr [<&MFC71.#1010_CWinApp>;  MFC71.7C151AC8
004015BE > .- FF25 1C224000 jmp    dword ptr [<&MFC71.#5102_CWinApp>;  MFC71.CWinApp::OpenDocumentFile
004015C4 > .- FF25 18224000 jmp    dword ptr [<&MFC71.#6219_CWinApp>;  MFC71.CWinApp::Unregister
004015CA > .- FF25 14224000 jmp    dword ptr [<&MFC71.#5382_CWinApp>;  MFC71.COleObjectFactory::Unregister
004015D0 > .- FF25 10224000 jmp    dword ptr [<&MFC71.#3832_CWinApp>;  MFC71.CWinApp::InitLibId
004015D6 > .- FF25 0C224000 jmp    dword ptr [<&MFC71.#1920_CWinThr>;  MFC71.CWinThread::Delete
004015DC > .- FF25 08224000 jmp    dword ptr [<&MFC71.#2931_CWinThr>;  MFC71.CWinThread::GetMainWnd
004015E2 > .- FF25 04224000 jmp    dword ptr [<&MFC71.#5224_CWinThr>;  MFC71.7C1723C3
004015E8 > .- FF25 00224000 jmp    dword ptr [<&MFC71.#5226_CWinApp>;  MFC71.CWinApp::ProcessWndProcException
004015EE > .- FF25 FC214000 jmp    dword ptr [<&MFC71.#2248_CWinApp>;  MFC71.CWinApp::ExitInstance
004015F4 > .- FF25 F8214000 jmp    dword ptr [<&MFC71.#3948_CWinThr>;  MFC71.CWinThread::IsIdleMessage
004015FA > .- FF25 F4214000 jmp    dword ptr [<&MFC71.#4568_CWinApp>;  MFC71.7C15741E
00401600 > .- FF25 F0214000 jmp    dword ptr [<&MFC71.#5230_CWinThr>;  MFC71.AfxInternalPumpMessage
00401606 > .- FF25 EC214000 jmp    dword ptr [<&MFC71.#5213_CWinThr>;  MFC71.CWinThread::PreTranslateMessage
0040160C > .- FF25 E8214000 jmp    dword ptr [<&MFC71.#5566_CWinApp>;  MFC71.CWinApp::Run
00401612 > .- FF25 E4214000 jmp    dword ptr [<&MFC71.#2537_CCmdTar>;  MFC71.CCmdTarget::GetDispatchIID
00401618 > .- FF25 E0214000 jmp    dword ptr [<&MFC71.#2731_CCmdTar>;  MFC71.CCmdTarget::GetDispatchIID
0040161E > .- FF25 DC214000 jmp    dword ptr [<&MFC71.#2835_CCmdTar>;  MFC71.CCmdTarget::GetDispatchIID
00401624 > .- FF25 D8214000 jmp    dword ptr [<&MFC71.#4307_CCmdTar>;  MFC71.CCmdTarget::OnCreateAggregates
0040162A > .- FF25 D4214000 jmp    dword ptr [<&MFC71.#2714_CCmdTar>;  MFC71.CCmdTarget::GetThisEventSinkMap
00401630 > .- FF25 D0214000 jmp    dword ptr [<&MFC71.#2838_CCmdTar>;  MFC71.CCmdTarget::GetInterfaceMap
00401636 > .- FF25 CC214000 jmp    dword ptr [<&MFC71.#2540_CCmdTar>;  MFC71.CCmdTarget::GetThisConnectionMap
0040163C > .- FF25 04214000 jmp    dword ptr [<&MFC71.#2646_CCmdTar>;  MFC71.CCmdTarget::GetDispatchMap
00401642 > .- FF25 38204000 jmp    dword ptr [<&MFC71.#2533_CCmdTar>;  MFC71.CCmdTarget::GetCommandMap
00401648 > .- FF25 3C204000 jmp    dword ptr [<&MFC71.#3718_CCmdTar>;  MFC71.CCmdTarget::GetTypeLib
0040164E > .- FF25 40204000 jmp    dword ptr [<&MFC71.#3719_CCmdTar>;  MFC71.CWinThread::InitInstance
00401654 > .- FF25 44204000 jmp    dword ptr [<&MFC71.#3709_CCmdTar>;  MFC71.CWinThread::InitInstance
0040165A > .- FF25 48204000 jmp    dword ptr [<&MFC71.#2644_CCmdTar>;  MFC71.CCmdTarget::GetDispatchIID
00401660 > .- FF25 4C204000 jmp    dword ptr [<&MFC71.#3949_CCmdTar>;  MFC71.CCmdTarget::IsInvokeAllowed
00401666 > .- FF25 50204000 jmp    dword ptr [<&MFC71.#4481_CCmdTar>;  MFC71.CCmdTarget::OnFinalRelease
0040166C > .- FF25 54204000 jmp    dword ptr [<&MFC71.#4261_CCmdTar>;  MFC71.CCmdTarget::OnCmdMsg
00401672 > .- FF25 58204000 jmp    dword ptr [<&MFC71.#3333_CWinApp>;  MFC71.CWinApp::GetThisClass
00401678 > $- FF25 5C204000 jmp    dword ptr [<&MFC71.#566_CWinApp:>;  MFC71.7C14A3BF
0040167E > >- FF25 60204000 jmp    dword ptr [<&MFC71.#757_CWinApp:>;  MFC71.7C17685F
00401684 > $- FF25 64204000 jmp    dword ptr [<&MFC71.#605_CDialog:>;  MFC71.7C158B47
0040168A > $- FF25 6C204000 jmp    dword ptr [<&MFC71.#764_operator>;  MFC71.operator delete[]
00401690 > $- FF25 70204000 jmp    dword ptr [<&MFC71.#2020_CDialog>;  MFC71.7C146E7C
00401696 > $- FF25 74204000 jmp    dword ptr [<&MFC71.#5975_CWinApp>;  MFC71.7C14DCB3
0040169C > $- FF25 78204000 jmp    dword ptr [<&MFC71.#1054_AfxEnab>;  MFC71.7C19EBA2
004016A2 > $- FF25 7C204000 jmp    dword ptr [<&MFC71.#3830_CWinApp>;  MFC71.CWinApp::InitInstance
004016A8 > .- FF25 80204000 jmp    dword ptr [<&MFC71.#3641_CDialog>;  MFC71.CDialog::GetThisMessageMap
004016AE > .- FF25 84204000 jmp    dword ptr [<&MFC71.#5182_CDialog>;  MFC71.CWnd::PreSubclassWindow
004016B4 > .- FF25 88204000 jmp    dword ptr [<&MFC71.#4212_CDialog>;  MFC71.CDialog::OnCancel
004016BA > .- FF25 8C204000 jmp    dword ptr [<&MFC71.#4735_CDialog>;  MFC71.CDialog::OnOK
004016C0 > .- FF25 90204000 jmp    dword ptr [<&MFC71.#4890_CDialog>;  MFC71.CTestCmdUI::SetCheck
004016C6 > $- FF25 94204000 jmp    dword ptr [<&MFC71.#4580_CDialog>;  MFC71.CDialog::OnInitDialog
004016CC > .- FF25 98204000 jmp    dword ptr [<&MFC71.#1671_CDialog>;  MFC71.CDialog::CreateIndirect
004016D2 > .- FF25 9C204000 jmp    dword ptr [<&MFC71.#1670_CDialog>;  MFC71.CDialog::CreateIndirect
004016D8 > .- FF25 A0204000 jmp    dword ptr [<&MFC71.#1551_CDialog>;  MFC71.CDialog::Create
004016DE > .- FF25 A4204000 jmp    dword ptr [<&MFC71.#5912_CDialog>;  MFC71.CDialog::SetOccDialogInfo
004016E4 > .- FF25 A8204000 jmp    dword ptr [<&MFC71.#1620_CWnd::C>;  MFC71.CWnd::CreateControlSite
004016EA > .- FF25 AC204000 jmp    dword ptr [<&MFC71.#1617_CWnd::C>;  MFC71.CWnd::CreateControlContainer
004016F0 > .- FF25 B0204000 jmp    dword ptr [<&MFC71.#3946_CWnd::I>;  MFC71.CWinThread::InitInstance
004016F6 > .- FF25 B4204000 jmp    dword ptr [<&MFC71.#1401_CDialog>;  MFC71.CDialog::CheckAutoCenter
004016FC > .- FF25 B8204000 jmp    dword ptr [<&MFC71.#4244_CWnd::O>;  MFC71.CWnd::OnChildNotify
00401702 > .- FF25 BC204000 jmp    dword ptr [<&MFC71.#5152_CWnd::P>;  MFC71.CWnd::PreSubclassWindow
00401708 > .- FF25 C0204000 jmp    dword ptr [<&MFC71.#1908_CWnd::D>;  MFC71.CWnd::DefWindowProcA
0040170E > .- FF25 C4204000 jmp    dword ptr [<&MFC71.#5073_CWnd::O>;  MFC71.7C16DFDB
00401714 > .- FF25 C8204000 jmp    dword ptr [<&MFC71.#6275_CWnd::W>;  MFC71.CWnd::WindowProc
0040171A > .- FF25 CC204000 jmp    dword ptr [<&MFC71.#4185_CWnd::O>;  MFC71.CWnd::OnAmbientProperty
00401720 > .- FF25 D0204000 jmp    dword ptr [<&MFC71.#5203_CDialog>;  MFC71.7C146D7C
00401726 > .- FF25 D4204000 jmp    dword ptr [<&MFC71.#3403_CWnd::G>;  MFC71.CWnd::GetSuperWndProcAddr
0040172C > .- FF25 D8204000 jmp    dword ptr [<&MFC71.#4722_CWnd::O>;  MFC71.CWnd::OnNotify
00401732 > .- FF25 DC204000 jmp    dword ptr [<&MFC71.#4282_CWnd::O>;  MFC71.CWnd::OnCommand
00401738 > .- FF25 E0204000 jmp    dword ptr [<&MFC71.#1600_CWnd::C>;  MFC71.CWnd::CreateAccessibleProxy
0040173E > .- FF25 E4204000 jmp    dword ptr [<&MFC71.#5960_CWnd::S>;  MFC71.CWnd::SetProxy
00401744 > .- FF25 E8204000 jmp    dword ptr [<&MFC71.#5235_CWnd::p>;  MFC71.CWnd::put_accValue
0040174A > .- FF25 EC204000 jmp    dword ptr [<&MFC71.#5233_CWnd::p>;  MFC71.CWnd::put_accValue
00401750 > .- FF25 F0204000 jmp    dword ptr [<&MFC71.#923_CWnd::ac>;  MFC71.CWnd::accDoDefaultAction
00401756 > .- FF25 F4204000 jmp    dword ptr [<&MFC71.#928_CWnd::ac>;  MFC71.CWnd::accHitTest
0040175C > .- FF25 F8204000 jmp    dword ptr [<&MFC71.#932_CWnd::ac>;  MFC71.CWnd::accNavigate
00401762 > .- FF25 FC204000 jmp    dword ptr [<&MFC71.#930_CWnd::ac>;  MFC71.CWnd::accLocation
00401768 > .- FF25 00214000 jmp    dword ptr [<&MFC71.#934_CWnd::ac>;  MFC71.CWnd::accSelect
0040176E > .- FF25 50224000 jmp    dword ptr [<&MFC71.#2390_CWnd::g>;  MFC71.CWnd::get_accDefaultAction
00401774 > .- FF25 08214000 jmp    dword ptr [<&MFC71.#2410_CWnd::g>;  MFC71.CWnd::get_accSelection
0040177A > .- FF25 0C214000 jmp    dword ptr [<&MFC71.#2394_CWnd::g>;  MFC71.CWnd::get_accFocus
00401780 > .- FF25 10214000 jmp    dword ptr [<&MFC71.#2400_CWnd::g>;  MFC71.CWnd::get_accKeyboardShortcut
00401786 > .- FF25 14214000 jmp    dword ptr [<&MFC71.#2398_CWnd::g>;  MFC71.CWnd::get_accHelpTopic
0040178C > .- FF25 18214000 jmp    dword ptr [<&MFC71.#2396_CWnd::g>;  MFC71.CWnd::get_accHelp
00401792 > .- FF25 1C214000 jmp    dword ptr [<&MFC71.#2413_CWnd::g>;  MFC71.CWnd::get_accState
00401798 > .- FF25 20214000 jmp    dword ptr [<&MFC71.#2408_CWnd::g>;  MFC71.CWnd::get_accRole
0040179E > .- FF25 24214000 jmp    dword ptr [<&MFC71.#2392_CWnd::g>;  MFC71.CWnd::get_accDescription
004017A4 > .- FF25 28214000 jmp    dword ptr [<&MFC71.#2415_CWnd::g>;  MFC71.CWnd::get_accValue
004017AA > .- FF25 2C214000 jmp    dword ptr [<&MFC71.#2403_CWnd::g>;  MFC71.CWnd::get_accName
004017B0 > .- FF25 30214000 jmp    dword ptr [<&MFC71.#2385_CWnd::g>;  MFC71.CWnd::get_accChild
004017B6 > .- FF25 34214000 jmp    dword ptr [<&MFC71.#2387_CWnd::g>;  MFC71.CWnd::get_accChildCount
004017BC > .- FF25 38214000 jmp    dword ptr [<&MFC71.#2405_CWnd::g>;  MFC71.CWnd::get_accParent
004017C2 > .- FF25 3C214000 jmp    dword ptr [<&MFC71.#2178_CWnd::E>;  MFC71.CWnd::EnsureStdObj
004017C8 > .- FF25 40214000 jmp    dword ptr [<&MFC71.#2172_CWnd::E>;  MFC71.CWnd::EndModalLoop
004017CE > .- FF25 44214000 jmp    dword ptr [<&MFC71.#1522_CWnd::C>;  MFC71.7C14778E
004017D4 > .- FF25 48214000 jmp    dword ptr [<&MFC71.#6279_CWnd::W>;  MFC71.CWnd::WinHelpInternal
004017DA > .- FF25 4C214000 jmp    dword ptr [<&MFC71.#3802_CWnd::H>;  MFC71.CWnd::HtmlHelpA
004017E0 > .- FF25 50214000 jmp    dword ptr [<&MFC71.#6277_CWnd::W>;  MFC71.CWnd::WinHelpA
004017E6 > .- FF25 54214000 jmp    dword ptr [<&MFC71.#3345_CWnd::G>;  MFC71.CCmdTarget::GetDispatchIID
004017EC > .- FF25 58214000 jmp    dword ptr [<&MFC71.#4967_CWnd::O>;  MFC71.CWnd::OnToolHitTest
004017F2 > .- FF25 5C214000 jmp    dword ptr [<&MFC71.#1362_CWnd::C>;  MFC71.CWnd::CalcWindowRect
004017F8 > .- FF25 60214000 jmp    dword ptr [<&MFC71.#5175_CWnd::P>;  MFC71.CWnd::PreCreateWindow
004017FE > .- FF25 64214000 jmp    dword ptr [<&MFC71.#1964_CWnd::D>;  MFC71.7C175CFF
00401804 > .- FF25 68214000 jmp    dword ptr [<&MFC71.#1656_CWnd::C>;  MFC71.7C15216C
0040180A > .- FF25 6C214000 jmp    dword ptr [<&MFC71.#1655_CWnd::C>;  MFC71.CWnd::CreateEx
00401810 > .- FF25 70214000 jmp    dword ptr [<&MFC71.#1599_CWnd::C>;  MFC71.CWnd::Create
00401816 > .- FF25 74214000 jmp    dword ptr [<&MFC71.#5200_CWnd::P>;  MFC71.CWnd::PreSubclassWindow
0040181C > .- FF25 78214000 jmp    dword ptr [<&MFC71.#2862_CWnd::G>;  MFC71.CWnd::GetThisInterfaceMap
00401822 > .- FF25 7C214000 jmp    dword ptr [<&MFC71.#4486_CWnd::O>;  MFC71.CWnd::OnFinalRelease
00401828 > .- FF25 80214000 jmp    dword ptr [<&MFC71.#4262_CDialog>;  MFC71.7C14DB1B
0040182E > .- FF25 84214000 jmp    dword ptr [<&MFC71.#3182_CDialog>;  MFC71.CDialog::GetThisClass
00401834 > $- FF25 88214000 jmp    dword ptr [<&MFC71.#354_CDialog:>;  MFC71.CDialog::CDialog
0040183A > $- FF25 94214000 jmp    dword ptr [<&MFC71.#1084_AfxGetM>;  MFC71.AfxGetModuleState
00401840 > $- FF25 98214000 jmp    dword ptr [<&MFC71.#2371_CMenu::>;  MFC71.CMenu::FromHandle
00401846 > $- FF25 9C214000 jmp    dword ptr [<&MFC71.#1903_CWnd::D>;  MFC71.CWnd::Default
0040184C > $- FF25 A0214000 jmp    dword ptr [<&MFC71.#1063_AfxFind>;  MFC71.7C1530C1
00401852 > $- FF25 A8214000 jmp    dword ptr [<&MFC71.#1892_DDX_Tex>;  MFC71.DDX_Text
00401858 > $- FF25 B8214000 jmp    dword ptr [<&MFC71.#4749_CDialog>;  MFC71.7C14D9D0
0040185E > $- FF25 BC214000 jmp    dword ptr [<&MFC71.#709_CPaintDC>;  MFC71.CPaintDC::~CPaintDC
00401864 > $- FF25 C0214000 jmp    dword ptr [<&MFC71.#501_CPaintDC>;  MFC71.7C1576C8
0040186A > $- FF25 C4214000 jmp    dword ptr [<&MFC71.#4104_CWnd::M>;  MFC71.CWnd::MessageBoxA
00401870 > $- FF25 C8214000 jmp    dword ptr [<&MFC71.#3761_CWnd::G>;  MFC71.7C158F43
00401876 >/$  56          push esi
00401877  |.  6A 18       push 18                            ; /n = 18 (24.)
00401879  |.  8BF1       mov    esi, ecx                      ; |
0040187B  |.  6A 00       push 0                               ; |c = 00
0040187D  |.  56          push esi                            ; |s
0040187E  |.  E8 75030000 call memset                         ; \memset
00401883  |.  83C4 0C    add    esp, 0C
00401886  |.  8BC6       mov    eax, esi
00401888  |.  5E          pop    esi
00401889  \.  C3          retn
0040188A > $  6A 0C       push 0C
0040188C .  68 F0274000 push 004027F0
00401891 .  E8 16030000 call __SEH_prolog
00401896 .  33F6       xor    esi, esi
00401898 .  8975 FC    mov    dword ptr [ebp-4], esi
0040189B .  51          push ecx                            ; /pCriticalSection
0040189C .  FF15 0C204000 call dword ptr [<&KERNEL32.Initialize>; \InitializeCriticalSection
004018A2 .  EB 2A       jmp    short 004018CE
004018A4 .  8B45 EC    mov    eax, dword ptr [ebp-14]
004018A7 .  8B00       mov    eax, dword ptr [eax]
004018A9 .  8B00       mov    eax, dword ptr [eax]
004018AB .  8945 E4    mov    dword ptr [ebp-1C], eax
004018AE .  33C0       xor    eax, eax
004018B0 .  40          inc    eax
004018B1 .  C3          retn
004018B2 .  8B65 E8    mov    esp, dword ptr [ebp-18]
004018B5 .  33C0       xor    eax, eax
004018B7 .  817D E4 17000>cmp    dword ptr [ebp-1C], C0000017
004018BE .  0F95C0       setne al
004018C1 .  48          dec    eax
004018C2 .  25 09C00600 and    eax, 6C009
004018C7 .  05 05400080 add    eax, 80004005
004018CC .  8BF0       mov    esi, eax
004018CE >  834D FC FF or    dword ptr [ebp-4], FFFFFFFF
004018D2 .  8BC6       mov    eax, esi
004018D4 .  E8 0E030000 call __SEH_epilog
004018D9 .  C3          retn
004018DA > >- FF25 B4224000 jmp    dword ptr [<&MSVCR71.__CxxFrameH>;  MSVCR71.__CxxFrameHandler
004018E0 >/$  833D 40414000>cmp    dword ptr [__onexitbegin], -1
004018E7  |.  75 06       jnz    short 004018EF
004018E9  |.- FF25 A0224000 jmp    dword ptr [<&MSVCR71._onexit>] ;  MSVCR71._onexit
004018EF  |>  68 3C414000 push offset __onexitend
004018F4  |.  68 40414000 push offset __onexitbegin
004018F9  |.  FF7424 0C    push dword ptr [esp+C]
004018FD  |.  E8 1E030000 call __dllonexit                   ;  jmp 到 MSVCR71.__dllonexit
00401902  |.  83C4 0C    add    esp, 0C
00401905  \.  C3          retn
00401906 >/$  FF7424 04    push dword ptr [esp+4]             ; /func
0040190A  |.  E8 D1FFFFFF call _onexit                         ; \_onexit
0040190F  |.  F7D8       neg    eax
00401911  |.  1BC0       sbb    eax, eax
00401913  |.  F7D8       neg    eax
00401915  |.  59          pop    ecx
00401916  |.  48          dec    eax
00401917  \.  C3          retn
00401918 > >  6A 08       push 8
0040191A .  68 00284000 push 00402800
0040191F .  E8 88020000 call __SEH_prolog
00401924 .  8365 FC 00 and    dword ptr [ebp-4], 0
00401928 .  6A 00       push 0
0040192A .  6A 01       push 1
0040192C .  E8 5B030000 call __security_error_handler       ;  jmp 到 MSVCR71.__security_error_handler
00401931 .  59          pop    ecx
00401932 .  59          pop    ecx
00401933 .  EB 07       jmp    short 0040193C
00401935 .  33C0       xor    eax, eax
00401937 .  40          inc    eax
00401938 .  C3          retn
00401939 .  8B65 E8    mov    esp, dword ptr [ebp-18]
0040193C >  834D FC FF or    dword ptr [ebp-4], FFFFFFFF
00401940 .  6A 03       push 3                               ; /ExitCode = 3
00401942 .  FF15 14204000 call dword ptr [<&KERNEL32.ExitProces>; \ExitProcess
00401948    CC          int3
00401949 > $  3B0D 20404000 cmp    ecx, dword ptr [__security_cooki>
0040194F .  75 01       jnz    short 00401952
00401951 .  C3          retn
00401952 >^ E9 C1FFFFFF jmp    report_failure
00401957    CC          int3
00401958 > $- FF25 BC224000 jmp    dword ptr [<&MSVCR71.free>]    ;  MSVCR71.free
0040195E > .- FF25 AC224000 jmp    dword ptr [<&MSVCR71._except_han>;  MSVCR71._except_handler3
00401964    CC          int3
00401965    CC          int3
00401966    CC          int3
00401967    CC          int3
00401968    CC          int3
00401969    CC          int3
0040196A    CC          int3
0040196B    CC          int3
0040196C    CC          int3
0040196D    CC          int3
0040196E    CC          int3
0040196F    CC          int3
00401970 > 3D          db    3D                            ;  CHAR '='
00401971    00          db    00
00401972    10          db    10
00401973    00          db    00
00401974    00          db    00
00401975    73          db    73                            ;  CHAR 's'
00401976    0E          db    0E
00401977    F7          db    F7
00401978    D8          db    D8
00401979    03          db    03
0040197A    C4          db    C4
0040197B    83          db    83
0040197C    C0          db    C0
0040197D    04          db    04
0040197E    85          db    85
0040197F    00          db    00
00401980 .  94          xchg eax, esp
00401981 .  8B00       mov    eax, dword ptr [eax]
00401983 .  50          push eax
00401984 .  C3          retn
00401985 .  51          push ecx
00401986 .  8D4C24 08    lea    ecx, dword ptr [esp+8]
0040198A >  81E9 00100000 sub    ecx, 1000
00401990 .  2D 00100000 sub    eax, 1000
00401995 .  8501       test dword ptr [ecx], eax
00401997 .  3D 00100000 cmp    eax, 1000
0040199C .^ 73 EC       jnb    short 0040198A
0040199E .  2BC8       sub    ecx, eax
004019A0 .  8BC4       mov    eax, esp
004019A2 .  8501       test dword ptr [ecx], eax
004019A4 .  8BE1       mov    esp, ecx
004019A6 .  8B08       mov    ecx, dword ptr [eax]
004019A8 .  8B40 04    mov    eax, dword ptr [eax+4]
004019AB .  50          push eax
004019AC .  C3          retn
004019AD > $  6A 74       push 74
004019AF .  68 10284000 push 00402810
004019B4 .  E8 F3010000 call __SEH_prolog
004019B9 .  33DB       xor    ebx, ebx
004019BB .  895D E0    mov    dword ptr [ebp-20], ebx
004019BE .  53          push ebx                            ; /pModule => NULL
004019BF .  8B3D 18204000 mov    edi, dword ptr [<&KERNEL32.GetMo>; |kernel32.GetModuleHandleA
004019C5 .  FFD7       call edi                            ; \GetModuleHandleA
004019C7 .  66:8138 4D5A  cmp    word ptr [eax], 5A4D
004019CC .  75 1F       jnz    short 004019ED
004019CE .  8B48 3C    mov    ecx, dword ptr [eax+3C]
004019D1 .  03C8       add    ecx, eax
004019D3 .  8139 50450000 cmp    dword ptr [ecx], 4550
004019D9 .  75 12       jnz    short 004019ED
004019DB .  0FB741 18    movzx eax, word ptr [ecx+18]
004019DF .  3D 0B010000 cmp    eax, 10B
004019E4 .  74 1F       je    short 00401A05
004019E6 .  3D 0B020000 cmp    eax, 20B
004019EB .  74 05       je    short 004019F2
004019ED >  895D E4    mov    dword ptr [ebp-1C], ebx
004019F0 .  EB 27       jmp    short 00401A19
004019F2 >  83B9 84000000>cmp    dword ptr [ecx+84], 0E
004019F9 .^ 76 F2       jbe    short 004019ED
004019FB .  33C0       xor    eax, eax
004019FD .  3999 F8000000 cmp    dword ptr [ecx+F8], ebx
00401A03 .  EB 0E       jmp    short 00401A13
00401A05 >  8379 74 0E cmp    dword ptr [ecx+74], 0E
00401A09 .^ 76 E2       jbe    short 004019ED
00401A0B .  33C0       xor    eax, eax
00401A0D .  3999 E8000000 cmp    dword ptr [ecx+E8], ebx
00401A13 >  0F95C0       setne al
00401A16 .  8945 E4    mov    dword ptr [ebp-1C], eax
00401A19 >  895D FC    mov    dword ptr [ebp-4], ebx
00401A1C .  6A 02       push 2
00401A1E .  FF15 60224000 call dword ptr [<&MSVCR71.__set_app_t>;  MSVCR71.__set_app_type
00401A24 .  59          pop    ecx
00401A25 .  830D 3C414000>or    dword ptr [__onexitend], FFFFFFF>
00401A2C .  830D 40414000>or    dword ptr [__onexitbegin], FFFFF>
00401A33 .  FF15 64224000 call dword ptr [<&MSVCR71.__p__fmode>>;  MSVCR71.__p__fmode
00401A39 .  8B0D F4404000 mov    ecx, dword ptr [_fmode]
00401A3F .  8908       mov    dword ptr [eax], ecx
00401A41 .  FF15 68224000 call dword ptr [<&MSVCR71.__p__commod>;  MSVCR71.__p__commode
00401A47 .  8B0D F0404000 mov    ecx, dword ptr [_commode]
00401A4D .  8908       mov    dword ptr [eax], ecx
00401A4F .  A1 6C224000 mov    eax, dword ptr [<&MSVCR71._adjus>
00401A54 .  8B00       mov    eax, dword ptr [eax]
00401A56 .  A3 38414000 mov    dword ptr [_adjust_fdiv], eax
00401A5B .  E8 3E020000 call _RTC_Initialize
00401A60 .  E8 D9020000 call _matherr
00401A65 .  391D 30404000 cmp    dword ptr [__defaultmatherr], eb>
00401A6B .  75 0C       jnz    short 00401A79
00401A6D .  68 3E1D4000 push _matherr
00401A72 .  FF15 70224000 call dword ptr [<&MSVCR71.__setuserma>;  MSVCR71.__setusermatherr
00401A78 .  59          pop    ecx
00401A79 >  E8 AE020000 call _setdefaultprecision
00401A7E .  68 1C404000 push offset __xi_z
00401A83 .  68 18404000 push offset __xi_a
00401A88 .  E8 99020000 call _initterm                      ;  jmp 到 MSVCR71._initterm
00401A8D .  68 E21C4000 push _RTC_Terminate                ; /func = test._RTC_Terminate
00401A92 .  E8 6FFEFFFF call atexit                         ; \atexit
00401A97 .  A1 EC404000 mov    eax, dword ptr [_newmode]
00401A9C .  8945 D8    mov    dword ptr [ebp-28], eax
00401A9F .  8D45 D8    lea    eax, dword ptr [ebp-28]
00401AA2 .  50          push eax
00401AA3 .  FF35 E8404000 push dword ptr [_dowildcard]
00401AA9 .  8D45 D0    lea    eax, dword ptr [ebp-30]
00401AAC .  50          push eax
00401AAD .  8D45 CC    lea    eax, dword ptr [ebp-34]
00401AB0 .  50          push eax
00401AB1 .  8D45 C8    lea    eax, dword ptr [ebp-38]
00401AB4 .  50          push eax
00401AB5 .  FF15 78224000 call dword ptr [<&MSVCR71.__getmainar>;  MSVCR71.__getmainargs
00401ABB .  83C4 20    add    esp, 20
00401ABE .  8945 C4    mov    dword ptr [ebp-3C], eax
00401AC1 .  3BC3       cmp    eax, ebx
00401AC3 .  7D 08       jge    short 00401ACD
00401AC5 .  6A 08       push 8
00401AC7 .  E8 CC010000 call _amsg_exit                      ;  jmp 到 MSVCR71._amsg_exit
00401ACC .  59          pop    ecx
00401ACD >  68 14404000 push offset __xc_z
00401AD2 .  68 00404000 push offset __xc_a
00401AD7 .  E8 4A020000 call _initterm                      ;  jmp 到 MSVCR71._initterm
00401ADC .  59          pop    ecx
00401ADD .  59          pop    ecx
00401ADE .  A1 80224000 mov    eax, dword ptr [<&MSVCR71._acmdl>
00401AE3 .  8B30       mov    esi, dword ptr [eax]
00401AE5 >  8975 DC    mov    dword ptr [ebp-24], esi
00401AE8 .  8A06       mov    al, byte ptr [esi]
00401AEA .  3C 20       cmp    al, 20
00401AEC .  77 5D       ja    short 00401B4B
00401AEE .  3AC3       cmp    al, bl
00401AF0 .  74 05       je    short 00401AF7
00401AF2 .  395D E0    cmp    dword ptr [ebp-20], ebx
00401AF5 .  75 54       jnz    short 00401B4B
00401AF7 >  8A06       mov    al, byte ptr [esi]
00401AF9 .  3AC3       cmp    al, bl
00401AFB .  74 0A       je    short 00401B07
00401AFD .  3C 20       cmp    al, 20
00401AFF .  77 06       ja    short 00401B07
00401B01 .  46          inc    esi
00401B02 .  8975 DC    mov    dword ptr [ebp-24], esi
00401B05 .^ EB F0       jmp    short 00401AF7
00401B07 >  895D A8    mov    dword ptr [ebp-58], ebx
00401B0A .  8D85 7CFFFFFF lea    eax, dword ptr [ebp-84]
00401B10 .  50          push eax                            ; /pStartupinfo
00401B11 .  FF15 1C204000 call dword ptr [<&KERNEL32.GetStartup>; \GetStartupInfoA
00401B17 .  F645 A8 01 test byte ptr [ebp-58], 1
00401B1B .  74 06       je    short 00401B23
00401B1D .  0FB745 AC    movzx eax, word ptr [ebp-54]
00401B21 .  EB 03       jmp    short 00401B26
00401B23 >  6A 0A       push 0A
00401B25 .  58          pop    eax
00401B26 >  50          push eax
00401B27 .  56          push esi
00401B28 .  53          push ebx
00401B29 .  53          push ebx
00401B2A .  FFD7       call edi
00401B2C .  50          push eax                            ; |hCurrInstance
00401B2D .  E8 0E030000 call WinMain                         ; \WinMain
00401B32 .  8BF0       mov    esi, eax
00401B34 .  8975 C0    mov    dword ptr [ebp-40], esi
00401B37 .  395D E4    cmp    dword ptr [ebp-1C], ebx
00401B3A .  75 07       jnz    short 00401B43
00401B3C .  56          push esi                            ; /status
00401B3D .  FF15 84224000 call dword ptr [<&MSVCR71.exit>]    ; \exit
00401B43 >  FF15 88224000 call dword ptr [<&MSVCR71._cexit>] ;  MSVCR71._cexit
00401B49 .  EB 55       jmp    short 00401BA0
00401B4B >  3C 22       cmp    al, 22
00401B4D .  75 0B       jnz    short 00401B5A
00401B4F .  33C9       xor    ecx, ecx
00401B51 .  395D E0    cmp    dword ptr [ebp-20], ebx
00401B54 .  0F94C1       sete cl
00401B57 .  894D E0    mov    dword ptr [ebp-20], ecx
00401B5A >  0FB6C0       movzx eax, al
00401B5D .  50          push eax                            ; /c
00401B5E .  FF15 8C224000 call dword ptr [<&MSVCR71._ismbblead>>; \_ismbblead
00401B64 .  59          pop    ecx
00401B65 .  85C0       test eax, eax
00401B67 .  74 04       je    short 00401B6D
00401B69 .  46          inc    esi
00401B6A .  8975 DC    mov    dword ptr [ebp-24], esi
00401B6D >  46          inc    esi
00401B6E .^ E9 72FFFFFF jmp    00401AE5
00401B73 .  8B45 EC    mov    eax, dword ptr [ebp-14]
00401B76 .  8B08       mov    ecx, dword ptr [eax]
00401B78 .  8B09       mov    ecx, dword ptr [ecx]
00401B7A .  894D D4    mov    dword ptr [ebp-2C], ecx
00401B7D .  50          push eax
00401B7E .  51          push ecx
00401B7F .  E8 0E010000 call _XcptFilter                   ;  jmp 到 MSVCR71._XcptFilter
00401B84 .  59          pop    ecx
00401B85 .  59          pop    ecx
00401B86 .  C3          retn
00401B87 .  8B65 E8    mov    esp, dword ptr [ebp-18]
00401B8A .  8B75 D4    mov    esi, dword ptr [ebp-2C]
00401B8D .  837D E4 00 cmp    dword ptr [ebp-1C], 0
00401B91 .  75 07       jnz    short 00401B9A
00401B93 .  56          push esi                            ; /status
00401B94 .  FF15 94224000 call dword ptr [<&MSVCR71._exit>]    ; \_exit
00401B9A >  FF15 98224000 call dword ptr [<&MSVCR71._c_exit>] ;  MSVCR71._c_exit
00401BA0 >  834D FC FF or    dword ptr [ebp-4], FFFFFFFF
00401BA4 .  8BC6       mov    eax, esi
00401BA6 .  E8 3C000000 call __SEH_epilog
00401BAB .  C3          retn
00401BAC >/$  68 5E194000 push _except_handler3                ;  jmp 到 MSVCR71._except_handler3
00401BB1  |.  64:A1 0000000>mov    eax, dword ptr fs:[0]
00401BB7  |.  50          push eax
00401BB8  |.  8B4424 10    mov    eax, dword ptr [esp+10]
00401BBC  |.  896C24 10    mov    dword ptr [esp+10], ebp
00401BC0  |.  8D6C24 10    lea    ebp, dword ptr [esp+10]
00401BC4  |.  2BE0       sub    esp, eax
00401BC6  |.  53          push ebx
00401BC7  |.  56          push esi
00401BC8  |.  57          push edi
00401BC9  |.  8B45 F8    mov    eax, dword ptr [ebp-8]
00401BCC  |.  8965 E8    mov    dword ptr [ebp-18], esp
00401BCF  |.  50          push eax
00401BD0  |.  8B45 FC    mov    eax, dword ptr [ebp-4]
00401BD3  |.  C745 FC FFFFF>mov    dword ptr [ebp-4], -1
00401BDA  |.  8945 F8    mov    dword ptr [ebp-8], eax
00401BDD  |.  8D45 F0    lea    eax, dword ptr [ebp-10]
00401BE0  |.  64:A3 0000000>mov    dword ptr fs:[0], eax
00401BE6  \.  C3          retn
00401BE7 >/$  8B4D F0    mov    ecx, dword ptr [ebp-10]
00401BEA  |.  64:890D 00000>mov    dword ptr fs:[0], ecx
00401BF1  |.  59          pop    ecx
00401BF2  |.  5F          pop    edi
00401BF3  |.  5E          pop    esi
00401BF4  |.  5B          pop    ebx
00401BF5  |.  C9          leave
00401BF6  |.  51          push ecx
00401BF7  \.  C3          retn
00401BF8 > $- FF25 A8224000 jmp    dword ptr [<&MSVCR71.memset>] ;  MSVCR71.memset
00401BFE    CC          int3
00401BFF    CC          int3
00401C00 > .  6A FF       push -1
00401C02 .  50          push eax
00401C03 .  64:A1 0000000>mov    eax, dword ptr fs:[0]
00401C09 .  50          push eax
00401C0A .  8B4424 0C    mov    eax, dword ptr [esp+C]
00401C0E .  64:8925 00000>mov    dword ptr fs:[0], esp
00401C15 .  896C24 0C    mov    dword ptr [esp+C], ebp
00401C19 .  8D6C24 0C    lea    ebp, dword ptr [esp+C]
00401C1D .  50          push eax
00401C1E .  C3          retn
00401C1F    CC          int3
00401C20 > $- FF25 A4224000 jmp    dword ptr [<&MSVCR71.__dllonexit>;  MSVCR71.__dllonexit
00401C26 >/.  55          push ebp
00401C27  |.  8BEC       mov    ebp, esp
00401C29  |.  83EC 10    sub    esp, 10
00401C2C  |.  A1 20404000 mov    eax, dword ptr [__security_cooki>
00401C31  |.  85C0       test eax, eax
00401C33  |.  74 07       je    short 00401C3C
00401C35  |.  3D 4EE640BB cmp    eax, BB40E64E
00401C3A  |.  75 4E       jnz    short 00401C8A
00401C3C  |>  56          push esi
00401C3D  |.  8D45 F8    lea    eax, dword ptr [ebp-8]
00401C40  |.  50          push eax                            ; /pFileTime
00401C41  |.  FF15 30204000 call dword ptr [<&KERNEL32.GetSystemT>; \GetSystemTimeAsFileTime
00401C47  |.  8B75 FC    mov    esi, dword ptr [ebp-4]
00401C4A  |.  3375 F8    xor    esi, dword ptr [ebp-8]
00401C4D  |.  FF15 2C204000 call dword ptr [<&KERNEL32.GetCurrent>; [GetCurrentProcessId
00401C53  |.  33F0       xor    esi, eax
00401C55  |.  FF15 28204000 call dword ptr [<&KERNEL32.GetCurrent>; [GetCurrentThreadId
00401C5B  |.  33F0       xor    esi, eax
00401C5D  |.  FF15 24204000 call dword ptr [<&KERNEL32.GetTickCou>; [GetTickCount
00401C63  |.  33F0       xor    esi, eax
00401C65  |.  8D45 F0    lea    eax, dword ptr [ebp-10]
00401C68  |.  50          push eax                            ; /pPerformanceCount
00401C69  |.  FF15 20204000 call dword ptr [<&KERNEL32.QueryPerfo>; \QueryPerformanceCounter
00401C6F  |.  8B45 F4    mov    eax, dword ptr [ebp-C]
00401C72  |.  3345 F0    xor    eax, dword ptr [ebp-10]
00401C75  |.  33F0       xor    esi, eax
00401C77  |.  8935 20404000 mov    dword ptr [__security_cookie], e>
00401C7D  |.  75 0A       jnz    short 00401C89
00401C7F  |.  C705 20404000>mov    dword ptr [__security_cookie], B>
00401C89  |>  5E          pop    esi
00401C8A  |>  C9          leave
00401C8B  \.  C3          retn
00401C8C > $- FF25 9C224000 jmp    dword ptr [<&MSVCR71.__security_>;  MSVCR71.__security_error_handler
00401C92 > $- FF25 90224000 jmp    dword ptr [<&MSVCR71._XcptFilter>;  MSVCR71._XcptFilter
00401C98 > $- FF25 7C224000 jmp    dword ptr [<&MSVCR71._amsg_exit>>;  MSVCR71._amsg_exit
00401C9E > $  6A 0C       push 0C
00401CA0 .  68 20284000 push 00402820
00401CA5 .  E8 02FFFFFF call __SEH_prolog
00401CAA .  C745 E4 28294>mov    dword ptr [ebp-1C], offset __rtc>
00401CB1 >  817D E4 28294>cmp    dword ptr [ebp-1C], offset __rtc>
00401CB8 .  73 22       jnb    short 00401CDC
00401CBA .  8365 FC 00 and    dword ptr [ebp-4], 0
00401CBE .  8B45 E4    mov    eax, dword ptr [ebp-1C]
00401CC1 .  8B00       mov    eax, dword ptr [eax]
00401CC3 .  85C0       test eax, eax
00401CC5 .  74 0B       je    short 00401CD2
00401CC7 .  FFD0       call eax
00401CC9 .  EB 07       jmp    short 00401CD2
00401CCB .  33C0       xor    eax, eax
00401CCD .  40          inc    eax
00401CCE .  C3          retn
00401CCF .  8B65 E8    mov    esp, dword ptr [ebp-18]
00401CD2 >  834D FC FF or    dword ptr [ebp-4], FFFFFFFF
00401CD6 .  8345 E4 04 add    dword ptr [ebp-1C], 4
00401CDA .^ EB D5       jmp    short 00401CB1
00401CDC >  E8 06FFFFFF call __SEH_epilog
00401CE1 .  C3          retn
00401CE2 > .  6A 0C       push 0C
00401CE4 .  68 30284000 push 00402830
00401CE9 .  E8 BEFEFFFF call __SEH_prolog
00401CEE .  C745 E4 30294>mov    dword ptr [ebp-1C], offset __rtc>
00401CF5 >  817D E4 30294>cmp    dword ptr [ebp-1C], offset __rtc>
00401CFC .  73 22       jnb    short 00401D20
00401CFE .  8365 FC 00 and    dword ptr [ebp-4], 0
00401D02 .  8B45 E4    mov    eax, dword ptr [ebp-1C]
00401D05 .  8B00       mov    eax, dword ptr [eax]
00401D07 .  85C0       test eax, eax
00401D09 .  74 0B       je    short 00401D16
00401D0B .  FFD0       call eax
00401D0D .  EB 07       jmp    short 00401D16
00401D0F .  33C0       xor    eax, eax
00401D11 .  40          inc    eax
00401D12 .  C3          retn
00401D13 .  8B65 E8    mov    esp, dword ptr [ebp-18]
00401D16 >  834D FC FF or    dword ptr [ebp-4], FFFFFFFF
00401D1A .  8345 E4 04 add    dword ptr [ebp-1C], 4
00401D1E .^ EB D5       jmp    short 00401CF5
00401D20 >  E8 C2FEFFFF call __SEH_epilog
00401D25 .  C3          retn
00401D26 > $- FF25 74224000 jmp    dword ptr [<&MSVCR71._initterm>] ;  MSVCR71._initterm
00401D2C >/$  68 00000300 push 30000                         ; /CWmask = 30000
00401D31  |.  68 00000100 push 10000                         ; |CWnew = 10000
00401D36  |.  E8 07000000 call _controlfp                      ; \_controlfp
00401D3B  |.  59          pop    ecx
00401D3C  |.  59          pop    ecx
00401D3D  \.  C3          retn
00401D3E >/$  33C0       xor    eax, eax
00401D40  \.  C3          retn
00401D41    CC          int3
00401D42 > $- FF25 B0224000 jmp    dword ptr [<&MSVCR71._controlfp>>;  MSVCR71._controlfp
00401D48 > >  56          push esi
00401D49 .  8BF1       mov    esi, ecx
00401D4B .  8B06       mov    eax, dword ptr [esi]
00401D4D .  85C0       test eax, eax
00401D4F .  74 0A       je    short 00401D5B
00401D51 .  50          push eax                            ; /block
00401D52 .  E8 01FCFFFF call free                            ; \free
00401D57 .  8326 00    and    dword ptr [esi], 0
00401D5A .  59          pop    ecx
00401D5B >  8366 04 00 and    dword ptr [esi+4], 0
00401D5F .  8366 08 00 and    dword ptr [esi+8], 0
00401D63 .  5E          pop    esi
00401D64 .  C3          retn
00401D65 >/$  56          push esi
00401D66  |.  8BF1       mov    esi, ecx
00401D68  |.  8D4E 18    lea    ecx, dword ptr [esi+18]
00401D6B  |.  E8 06FBFFFF call ATL::CComCriticalSection::CComCr>
00401D70  |.  33C0       xor    eax, eax
00401D72  |.  8946 30    mov    dword ptr [esi+30], eax
00401D75  |.  8946 34    mov    dword ptr [esi+34], eax
00401D78  |.  8946 38    mov    dword ptr [esi+38], eax
00401D7B  |.  8BC6       mov    eax, esi
00401D7D  |.  5E          pop    esi
00401D7E  \.  C3          retn
00401D7F > >  56          push esi
00401D80 .  8BF1       mov    esi, ecx
00401D82 .  8D46 18    lea    eax, dword ptr [esi+18]
00401D85 .  50          push eax                            ; /pCriticalSection
00401D86 .  FF15 10204000 call dword ptr [<&KERNEL32.DeleteCrit>; \DeleteCriticalSection
00401D8C .  8D4E 30    lea    ecx, dword ptr [esi+30]
00401D8F .  5E          pop    esi
00401D90 .^ E9 B3FFFFFF jmp    ATL::CSimpleArray<HINSTANCE__ *,>
00401D95 >/$  55          push ebp
00401D96  |.  8D6C24 88    lea    ebp, dword ptr [esp-78]
00401D9A  |.  81EC 98000000 sub    esp, 98
00401DA0  |.  A1 20404000 mov    eax, dword ptr [__security_cooki>
00401DA5  |.  56          push esi
00401DA6  |.  8945 74    mov    dword ptr [ebp+74], eax
00401DA9  |.  8BF1       mov    esi, ecx
00401DAB  |.  E8 B5FFFFFF call ATL::_ATL_BASE_MODULE70::_ATL_BA>
00401DB0  |.  B8 00004000 mov    eax, 00400000
00401DB5  |.  68 94000000 push 94                            ; /n = 94 (148.)
00401DBA  |.  8946 08    mov    dword ptr [esi+8], eax          ; |
00401DBD  |.  8946 04    mov    dword ptr [esi+4], eax          ; |
00401DC0  |.  8D45 E0    lea    eax, dword ptr [ebp-20]       ; |
00401DC3  |.  6A 00       push 0                               ; |c = 00
00401DC5  |.  50          push eax                            ; |s
00401DC6  |.  C706 3C000000 mov    dword ptr [esi], 3C             ; |
00401DCC  |.  C646 0C 00 mov    byte ptr [esi+C], 0             ; |
00401DD0  |.  E8 23FEFFFF call memset                         ; \memset
00401DD5  |.  83C4 0C    add    esp, 0C
00401DD8  |.  8D45 E0    lea    eax, dword ptr [ebp-20]
00401DDB  |.  50          push eax                            ; /pVersionInformation
00401DDC  |.  C745 E0 94000>mov    dword ptr [ebp-20], 94          ; |
00401DE3  |.  FF15 08204000 call dword ptr [<&KERNEL32.GetVersion>; \GetVersionExA
00401DE9  |.  837D F0 02 cmp    dword ptr [ebp-10], 2
00401DED  |.  75 08       jnz    short 00401DF7
00401DEF  |.  837D E4 05 cmp    dword ptr [ebp-1C], 5
00401DF3  |.  72 1A       jb    short 00401E0F
00401DF5  |.  EB 14       jmp    short 00401E0B
00401DF7  |>  837D F0 01 cmp    dword ptr [ebp-10], 1
00401DFB  |.  75 12       jnz    short 00401E0F
00401DFD  |.  837D E4 04 cmp    dword ptr [ebp-1C], 4
00401E01  |.  77 08       ja    short 00401E0B
00401E03  |.  75 0A       jnz    short 00401E0F
00401E05  |.  837D E8 00 cmp    dword ptr [ebp-18], 0
00401E09  |.  76 04       jbe    short 00401E0F
00401E0B  |>  C646 0C 01 mov    byte ptr [esi+C], 1
00401E0F  |>  8D4E 18    lea    ecx, dword ptr [esi+18]
00401E12  |.  C746 10 10070>mov    dword ptr [esi+10], 710
00401E19  |.  C746 14 4C284>mov    dword ptr [esi+14], offset GUID_>
00401E20  |.  E8 65FAFFFF call ATL::CComCriticalSection::Init
00401E25  |.  85C0       test eax, eax
00401E27  |.  7D 07       jge    short 00401E30
00401E29  |.  C605 DC404000>mov    byte ptr [ATL::CAtlBaseModule::m>
00401E30  |>  8B4D 74    mov    ecx, dword ptr [ebp+74]
00401E33  |.  8BC6       mov    eax, esi
00401E35  |.  5E          pop    esi
00401E36  |.  E8 0EFBFFFF call __security_check_cookie
00401E3B  |.  83C5 78    add    ebp, 78
00401E3E  |.  C9          leave
00401E3F  \.  C3          retn
00401E40 > $  E9 29000000 jmp    AfxWinMain
00401E45 >/$  E8 F0F9FFFF call AfxGetModuleState             ;  jmp 到 MFC71.AfxGetModuleState
00401E4A  |.  8B4C24 04    mov    ecx, dword ptr [esp+4]
00401E4E  |.  85C9       test ecx, ecx
00401E50  |.  8B5424 08    mov    edx, dword ptr [esp+8]
00401E54  |.  8848 14    mov    byte ptr [eax+14], cl
00401E57  |.  8990 40100000 mov    dword ptr [eax+1040], edx
00401E5D  |.  75 09       jnz    short 00401E68
00401E5F  |.  6A FD       push -3                            ; /codepage = FFFFFFFD (-3.)
00401E61  |.  FF15 B8224000 call dword ptr [<&MSVCR71._setmbcp>]  ; \_setmbcp
00401E67  |.  59          pop    ecx
00401E68  |>  33C0       xor    eax, eax
00401E6A  |.  40          inc    eax
00401E6B  \.  C2 0800    retn 8
00401E6E > >- FF25 58224000 jmp    dword ptr [<&MFC71.#1207_AfxWinM>;  MFC71.7C172F6F
00401E74    CC          int3
00401E75    CC          int3
00401E76    CC          int3
00401E77    CC          int3
00401E78    CC          int3
00401E79    CC          int3
00401E7A    CC          int3
00401E7B    CC          int3
00401E7C    CC          int3
00401E7D    CC          int3
00401E7E    CC          int3
00401E7F    CC          int3
00401E80 .  8D8D 74FFFFFF lea    ecx, dword ptr [ebp-8C]
00401E86 .^ E9 B5F1FFFF jmp    CtestDlg::~CtestDlg
00401E8B $  B8 3C294000 mov    eax, 0040293C                   ;  结构异常处理程序
00401E90 .^ E9 45FAFFFF jmp    __CxxFrameHandler             ;  jmp 到 MSVCR71.__CxxFrameHandler
00401E95    CC          int3
00401E96    CC          int3
00401E97    CC          int3
00401E98    CC          int3
00401E99    CC          int3
00401E9A    CC          int3
00401E9B    CC          int3
00401E9C    CC          int3
00401E9D    CC          int3
00401E9E    CC          int3
00401E9F    CC          int3
00401EA0 .  8B4D F0    mov    ecx, dword ptr [ebp-10]
00401EA3 .^ E9 DCF7FFFF jmp    CDialog::~CDialog
00401EA8 .  8B4D F0    mov    ecx, dword ptr [ebp-10]
00401EAB .  83C1 78    add    ecx, 78
00401EAE .- FF25 68204000 jmp    dword ptr [<&MFC71.#578_ATL::CSt>;  MFC71.ATL::CSimpleStringT<char,1>::~CSimpleStringT<char,1>
00401EB4 .  8B4D F0    mov    ecx, dword ptr [ebp-10]
00401EB7 .  83C1 7C    add    ecx, 7C
00401EBA .- FF25 68204000 jmp    dword ptr [<&MFC71.#578_ATL::CSt>;  MFC71.ATL::CSimpleStringT<char,1>::~CSimpleStringT<char,1>
00401EC0 $  B8 70294000 mov    eax, 00402970                   ;  结构异常处理程序
00401EC5 .^ E9 10FAFFFF jmp    __CxxFrameHandler             ;  jmp 到 MSVCR71.__CxxFrameHandler
00401ECA    CC          int3
00401ECB    CC          int3
00401ECC    CC          int3
00401ECD    CC          int3
00401ECE    CC          int3
00401ECF    CC          int3
00401ED0 .  8D4D F0    lea    ecx, dword ptr [ebp-10]
00401ED3 .- FF25 68204000 jmp    dword ptr [<&MFC71.#578_ATL::CSt>;  MFC71.ATL::CSimpleStringT<char,1>::~CSimpleStringT<char,1>
00401ED9 $  B8 94294000 mov    eax, 00402994                   ;  结构异常处理程序
00401EDE .^ E9 F7F9FFFF jmp    __CxxFrameHandler             ;  jmp 到 MSVCR71.__CxxFrameHandler
00401EE3    CC          int3
00401EE4    CC          int3
00401EE5    CC          int3
00401EE6    CC          int3
00401EE7    CC          int3
00401EE8    CC          int3
00401EE9    CC          int3
00401EEA    CC          int3
00401EEB    CC          int3
00401EEC    CC          int3
00401EED    CC          int3
00401EEE    CC          int3
00401EEF    CC          int3
00401EF0 .  8D4D 80    lea    ecx, dword ptr [ebp-80]
00401EF3 .^ E9 58F2FFFF jmp    CAboutDlg::~CAboutDlg
00401EF8 .  B8 B8294000 mov    eax, 004029B8
00401EFD .^ E9 D8F9FFFF jmp    __CxxFrameHandler             ;  jmp 到 MSVCR71.__CxxFrameHandler
00401F02    CC          int3
00401F03    CC          int3
00401F04    CC          int3
00401F05    CC          int3
00401F06    CC          int3
00401F07    CC          int3
00401F08    CC          int3
00401F09    CC          int3
00401F0A    CC          int3
00401F0B    CC          int3
00401F0C    CC          int3
00401F0D    CC          int3
00401F0E    CC          int3
00401F0F    CC          int3
00401F10 > .  B9 38404000 mov    ecx, offset theApp
00401F15 .  E8 F6F0FFFF call CtestApp::CtestApp
00401F1A .  68 501F4000 push $E2                            ; /func = test.$E2
00401F1F .  E8 E2F9FFFF call atexit                         ; \atexit
00401F24 .  59          pop    ecx
00401F25 .  C3          retn
00401F26 > .  B9 F8404000 mov    ecx, offset ATL::_AtlBaseModule
00401F2B .  E8 65FEFFFF call ATL::CAtlBaseModule::CAtlBaseMod>
00401F30 .  68 5A1F4000 push $E6                            ; /func = test.$E6
00401F35 .  E8 CCF9FFFF call atexit                         ; \atexit
00401F3A .  59          pop    ecx
00401F3B .  C3          retn
00401F3C > .  68 10070000 push 710
00401F41 .  6A 00       push 0
00401F43 .  E8 FDFEFFFF call AfxInitialize
00401F48 .  A2 34414000 mov    byte ptr [_afxInitAppState], al
00401F4D .  C3          retn
00401F4E    CC          int3
00401F4F    CC          int3
00401F50 > .  B9 38404000 mov    ecx, offset theApp
00401F55 .^ E9 D6F0FFFF jmp    CtestApp::~CtestApp
00401F5A > .  B9 F8404000 mov    ecx, offset ATL::_AtlBaseModule
00401F5F .^ E9 1BFEFFFF jmp    ATL::CAtlBaseModule::~CAtlBaseMo>
00401F64    00          db    00
00401F65    00          db    00
00401F66    00          db    00
00401F67    00          db    00
00401F68    00          db    00
00401F69    00          db    00
00401F6A    00          db    00
00401F6B    00          db    00
00401F6C    00          db    00
00401F6D    00          db    00
00401F6E    00          db    00
00401F6F    00          db    00
00401F70    00          db    00
00401F71    00          db    00
00401F72    00          db    00
00401F73    00          db    00
00401F74    00          db    00
00401F75    00          db    00
00401F76    00          db    00
00401F77    00          db    00
00401F78    00          db    00
00401F79    00          db    00
00401F7A    00          db    00
00401F7B    00          db    00
00401F7C    00          db    00
00401F7D    00          db    00
00401F7E    00          db    00
00401F7F    00          db    00
00401F80    00          db    00
00401F81    00          db    00
00401F82    00          db    00
00401F83    00          db    00
00401F84    00          db    00
00401F85    00          db    00
00401F86    00          db    00
00401F87    00          db    00
00401F88    00          db    00
00401F89    00          db    00
00401F8A    00          db    00
00401F8B    00          db    00
00401F8C    00          db    00
00401F8D    00          db    00
00401F8E    00          db    00
00401F8F    00          db    00
00401F90    00          db    00
00401F91    00          db    00
00401F92    00          db    00
00401F93    00          db    00
00401F94    00          db    00
00401F95    00          db    00
00401F96    00          db    00
00401F97    00          db    00
00401F98    00          db    00
00401F99    00          db    00
00401F9A    00          db    00
00401F9B    00          db    00
00401F9C    00          db    00
00401F9D    00          db    00
00401F9E    00          db    00
00401F9F    00          db    00
00401FA0    00          db    00
00401FA1    00          db    00
00401FA2    00          db    00
00401FA3    00          db    00
00401FA4    00          db    00
00401FA5    00          db    00
00401FA6    00          db    00
00401FA7    00          db    00
00401FA8    00          db    00
00401FA9    00          db    00
00401FAA    00          db    00
00401FAB    00          db    00
00401FAC    00          db    00
00401FAD    00          db    00
00401FAE    00          db    00
00401FAF    00          db    00
00401FB0    00          db    00
00401FB1    00          db    00
00401FB2    00          db    00
00401FB3    00          db    00
00401FB4    00          db    00
00401FB5    00          db    00
00401FB6    00          db    00
00401FB7    00          db    00
00401FB8    00          db    00
00401FB9    00          db    00
00401FBA    00          db    00
00401FBB    00          db    00
00401FBC    00          db    00
00401FBD    00          db    00
00401FBE    00          db    00
00401FBF    00          db    00
00401FC0    00          db    00
00401FC1    00          db    00
00401FC2    00          db    00
00401FC3    00          db    00
00401FC4    00          db    00
00401FC5    00          db    00
00401FC6    00          db    00
00401FC7    00          db    00
00401FC8    00          db    00
00401FC9    00          db    00
00401FCA    00          db    00
00401FCB    00          db    00
00401FCC    00          db    00
00401FCD    00          db    00
00401FCE    00          db    00
00401FCF    00          db    00
00401FD0    00          db    00
00401FD1    00          db    00
00401FD2    00          db    00
00401FD3    00          db    00
00401FD4    00          db    00
00401FD5    00          db    00
00401FD6    00          db    00
00401FD7    00          db    00
00401FD8    00          db    00
00401FD9    00          db    00
00401FDA    00          db    00
00401FDB    00          db    00
00401FDC    00          db    00
00401FDD    00          db    00
00401FDE    00          db    00
00401FDF    00          db    00
00401FE0    00          db    00
00401FE1    00          db    00
00401FE2    00          db    00
00401FE3    00          db    00
00401FE4    00          db    00
00401FE5    00          db    00
00401FE6    00          db    00
00401FE7    00          db    00
00401FE8    00          db    00
00401FE9    00          db    00
00401FEA    00          db    00
00401FEB    00          db    00
00401FEC    00          db    00
00401FED    00          db    00
00401FEE    00          db    00
00401FEF    00          db    00
00401FF0    00          db    00
00401FF1    00          db    00
00401FF2    00          db    00
00401FF3    00          db    00
00401FF4    00          db    00
00401FF5    00          db    00
00401FF6    00          db    00
00401FF7    00          db    00
00401FF8    00          db    00
00401FF9    00          db    00
00401FFA    00          db    00
00401FFB    00          db    00
00401FFC    00          db    00
00401FFD    00          db    00
00401FFE    00          db    00
00401FFF    00          db    00

[培训]科锐软件逆向50期预科班报名即将截止，速来！！！ 50期正式班报名火爆招生中！！！

收藏・1

免费・0

打赏

最新回复 (22)
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-10 17:02 2 楼 0 由于我的权限不够，不能上传，所以只好贴代码了
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-10 17:03 3 楼 0 这个程序是一个输入一个序列号和一个验证码，如果成功就显示成功，失败就显示失败。请大家帮忙分析一下，谢谢！！
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-10 17:05 4 楼 0 有兴趣的朋友可以告诉我邮件，我可以把程序发邮件给你们，谢谢！！！
warshon 雪币： 191 活跃值： (205) 能力值： ( LV9，RANK：250 ) 在线值：发帖 23 回帖 112 粉丝 0 关注私信	warshon 6 2006-11-10 23:15 5 楼 0 完全可以申请块网络硬盘
fonge 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：210 ) 在线值：发帖 38 回帖 1071 粉丝 0 关注私信	fonge 5 2006-11-11 10:47 6 楼 0 到http://www.ys168.com去申请一个吧
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-13 09:24 7 楼 0 已经放到我的空间里了lieben3000.ys168.com里的test.exe
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-13 11:13 8 楼 0 本人是菜鸟，请帮忙分析一下我的CRECKME 谢谢！！！该文件在lieben3000.ys168.com里的test.exe文件。 CRECKME hansen test.exe 33.5KB crackme
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 2006-11-13 16:34 9 楼 0 测试什么，输入任何东西都弹出成功？
fonge 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：210 ) 在线值：发帖 38 回帖 1071 粉丝 0 关注私信	fonge 5 2006-11-13 16:36 10 楼 0 最初由 lieben* 发布* 这个程序是一个输入一个序列号和一个验证码，如果成功就显示成功，失败就显示失败。请大家帮忙分析一下，谢谢！！直接点按钮也是成功啊没有失败吧 00401520 . 53 push ebx 00401521 . 56 push esi 00401522 . 57 push edi 00401523 . 8BF1 mov esi, ecx 00401525 . 8D7E 7C lea edi, [esi+7C] 00401528 . 57 push edi 00401529 . E8 42030000 call <jmp.&MFC71.#3761> 0040152E . 8D5E 78 lea ebx, [esi+78] 00401531 . 53 push ebx 00401532 . 8BCE mov ecx, esi 00401534 . E8 37030000 call <jmp.&MFC71.#3761> 00401539 . 8BCF mov ecx, edi 0040153B . FF15 90214000 call [<&MFC71.#876>] ; MFC71.7C158BCD 00401541 . 50 push eax 00401542 . 8BCB mov ecx, ebx 00401544 . FF15 8C214000 call [<&MFC71.#1482>] ; MFC71.7C144DAE 0040154A . 85C0 test eax, eax 0040154C . 6A 00 push 0 0040154E . 8BCE mov ecx, esi 00401550 . 6A 00 push 0 00401552 . 75 0E jnz short 00401562 00401554 . 68 94274000 push 00402794 ; 成功 00401559 . E8 0C030000 call <jmp.&MFC71.#4104> 0040155E . 5F pop edi 0040155F . 5E pop esi 00401560 . 5B pop ebx 00401561 . C3 retn 00401562 > 68 8C274000 push 0040278C ; 失败 00401567 . E8 FE020000 call <jmp.&MFC71.#4104> 我看不出来怎么才跳得过去！
fonge 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：210 ) 在线值：发帖 38 回帖 1071 粉丝 0 关注私信	fonge 5 2006-11-13 16:39 11 楼 0 就是哈哈
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-13 16:57 12 楼 0 CRECKME hansen crack.exe 33.5KB 正确的CRACK 那个TEST是错的 test.exe 33.5KB crackme 记录数:2(含分类记录) [刷新数据]
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-13 17:07 13 楼 0 CRECKME hansen crack.exe 33.5KB 正确的CRACK 那个TEST是错的 test.exe 33.5KB crackme 记录数:2(含分类记录) [刷新数据]
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-13 17:10 14 楼 0 lieben3000.ys168.com CRECKME hansen crack.exe 33.5KB 正确的CRACK 那个TEST是错的 test.exe 33.5KB crackme 记录数:2(含分类记录) [刷新数据]
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 2006-11-13 17:55 15 楼 0 没难道可言，秒破，注明：此非爆破 IF B == NAME :OK 上传的附件： 1.jpg （9.02kb，42次下载）
ainafeng 雪币： 214 活跃值： (10) 能力值： ( LV6，RANK：90 ) 在线值：发帖 7 回帖 37 粉丝 0 关注私信	ainafeng 2 2006-11-13 22:28 16 楼 0 有点意思！！
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-14 09:55 17 楼 0 本人是菜鸟，KAN大哥，能不能给出详细的分析？谢谢
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 2006-11-14 19:41 18 楼 0 00401537 . FF15 94214000 CALL DWORD PTR DS:[<&MFC71.#1482>] ; 关键 CALL F7 进 0040153D . 85C0 TEST EAX,EAX 0040153F . 6A 00 PUSH 0 00401541 . 8BCE MOV ECX,ESI 00401543 . 6A 00 PUSH 0 00401545 . 75 0C JNZ SHORT crack.00401553 //关键跳转 00401547 . 68 94274000 PUSH crack.00402794 0040154C . E8 09030000 CALL <JMP.&MFC71.#4104> 00401551 . 5E POP ESI 00401552 . C3 RETN 00401553 > 68 8C274000 PUSH crack.0040278C 00401558 . E8 FD020000 CALL <JMP.&MFC71.#4104> 0040155D . 5E POP ESI ―――――――――――――――――――――――――――――――――――――――――――――――― F7 进入后到这里 7C144DAE 8B09 MOV ECX,DWORD PTR DS:[ECX] 7C144DB0 FF7424 04 PUSH DWORD PTR SS:[ESP+4] 7C144DB4 51 PUSH ECX 7C144DB5 FF15 2811147C CALL DWORD PTR DS:[<&MSVCR71._mbscmp>] ; 又是一个关键 CALL F7 进 7C144DBC 59 POP ECX 7C144DBD C2 0400 RETN 4 ―――――――――――――――――――――――――――――――――――――――――――――――― 因为不是写破文，就去掉好多关键的代码到下面这一句 7C34BBAD 8ADA MOV BL,DL 7C34BBAF 8BCB MOV ECX,EBX 7C34BBB1 66:3BC8 CMP CX,AX // 所有的算法就在这一句，“漏洞啊” 7C34BBB4 75 0C JNZ SHORT MSVCR71.7C34BBC2 7C34BBB6 66:85C0 TEST AX,AX 7C34BBB9 ^ 75 A8 JNZ SHORT MSVCR71.7C34BB63 上面这个比较，不是比一个数值的相等，而是比较输入的用户名和注册码框的值是否相等，一见这句就知道了答案了
warshing 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 8 粉丝 0 关注私信	warshing 2006-11-14 21:19 19 楼 0 怎么下的断点？用W32ASM找不到相关的字符串。
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 2006-11-14 23:06 20 楼 0 可以用万能断点试试嘛，好用的很呢
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-15 08:43 21 楼 0 谢谢 KAN 大哥！！！
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-15 09:08 22 楼 0 最初由 KAN* 发布* 可以用万能断点试试嘛，好用的很呢万能断点是指自己设的断点吗？现在还不知道该在什么地方设置断点。请问如何设置断点？有什么技巧和原则吗？？？
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-15 09:15 23 楼 0 CALL <JMP.&MFC71.#4104> CALL DWORD PTR DS:[<&MFC71.#1482>] CALL <JMP.&MFC71.#4104> CALL DWORD PTR DS:[<&MSVCR71._mbscmp>] JNZ SHORT MSVCR71.7C34BBC2 上面的看不懂，不知道JMP.&MFC71.#4104，[<&MFC71.#1482>]，[<&MSVCR71._mbscmp>] ，MSVCR71.7C34BBC2 是什么意思？？？ KAN 大哥，能不能解释一下看？
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复

lieben

发帖

回帖

RANK

关注

私信

他的文章

[求助]写了个非常简单的CRACKME，请大家来分析一下，谢谢

[求助]帮忙分析一下我的CRECKME 谢谢

关于我们

联系我们

企业服务

看雪公众号

最新回复 (22)
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-10 17:02 2 楼 0 由于我的权限不够，不能上传，所以只好贴代码了
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-10 17:03 3 楼 0 这个程序是一个输入一个序列号和一个验证码，如果成功就显示成功，失败就显示失败。请大家帮忙分析一下，谢谢！！
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-10 17:05 4 楼 0 有兴趣的朋友可以告诉我邮件，我可以把程序发邮件给你们，谢谢！！！
warshon 雪币： 191 活跃值： (205) 能力值： ( LV9，RANK：250 ) 在线值：发帖 23 回帖 112 粉丝 0 关注私信	warshon 6 2006-11-10 23:15 5 楼 0 完全可以申请块网络硬盘
fonge 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：210 ) 在线值：发帖 38 回帖 1071 粉丝 0 关注私信	fonge 5 2006-11-11 10:47 6 楼 0 到http://www.ys168.com去申请一个吧
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-13 09:24 7 楼 0 已经放到我的空间里了lieben3000.ys168.com里的test.exe
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-13 11:13 8 楼 0 本人是菜鸟，请帮忙分析一下我的CRECKME 谢谢！！！该文件在lieben3000.ys168.com里的test.exe文件。 CRECKME hansen test.exe 33.5KB crackme
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 2006-11-13 16:34 9 楼 0 测试什么，输入任何东西都弹出成功？
fonge 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：210 ) 在线值：发帖 38 回帖 1071 粉丝 0 关注私信	fonge 5 2006-11-13 16:36 10 楼 0 最初由 lieben* 发布* 这个程序是一个输入一个序列号和一个验证码，如果成功就显示成功，失败就显示失败。请大家帮忙分析一下，谢谢！！直接点按钮也是成功啊没有失败吧 00401520 . 53 push ebx 00401521 . 56 push esi 00401522 . 57 push edi 00401523 . 8BF1 mov esi, ecx 00401525 . 8D7E 7C lea edi, [esi+7C] 00401528 . 57 push edi 00401529 . E8 42030000 call <jmp.&MFC71.#3761> 0040152E . 8D5E 78 lea ebx, [esi+78] 00401531 . 53 push ebx 00401532 . 8BCE mov ecx, esi 00401534 . E8 37030000 call <jmp.&MFC71.#3761> 00401539 . 8BCF mov ecx, edi 0040153B . FF15 90214000 call [<&MFC71.#876>] ; MFC71.7C158BCD 00401541 . 50 push eax 00401542 . 8BCB mov ecx, ebx 00401544 . FF15 8C214000 call [<&MFC71.#1482>] ; MFC71.7C144DAE 0040154A . 85C0 test eax, eax 0040154C . 6A 00 push 0 0040154E . 8BCE mov ecx, esi 00401550 . 6A 00 push 0 00401552 . 75 0E jnz short 00401562 00401554 . 68 94274000 push 00402794 ; 成功 00401559 . E8 0C030000 call <jmp.&MFC71.#4104> 0040155E . 5F pop edi 0040155F . 5E pop esi 00401560 . 5B pop ebx 00401561 . C3 retn 00401562 > 68 8C274000 push 0040278C ; 失败 00401567 . E8 FE020000 call <jmp.&MFC71.#4104> 我看不出来怎么才跳得过去！
fonge 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：210 ) 在线值：发帖 38 回帖 1071 粉丝 0 关注私信	fonge 5 2006-11-13 16:39 11 楼 0 就是哈哈
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-13 16:57 12 楼 0 CRECKME hansen crack.exe 33.5KB 正确的CRACK 那个TEST是错的 test.exe 33.5KB crackme 记录数:2(含分类记录) [刷新数据]
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-13 17:07 13 楼 0 CRECKME hansen crack.exe 33.5KB 正确的CRACK 那个TEST是错的 test.exe 33.5KB crackme 记录数:2(含分类记录) [刷新数据]
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-13 17:10 14 楼 0 lieben3000.ys168.com CRECKME hansen crack.exe 33.5KB 正确的CRACK 那个TEST是错的 test.exe 33.5KB crackme 记录数:2(含分类记录) [刷新数据]
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 2006-11-13 17:55 15 楼 0 没难道可言，秒破，注明：此非爆破 IF B == NAME :OK 上传的附件： 1.jpg （9.02kb，42次下载）
ainafeng 雪币： 214 活跃值： (10) 能力值： ( LV6，RANK：90 ) 在线值：发帖 7 回帖 37 粉丝 0 关注私信	ainafeng 2 2006-11-13 22:28 16 楼 0 有点意思！！
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-14 09:55 17 楼 0 本人是菜鸟，KAN大哥，能不能给出详细的分析？谢谢
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 2006-11-14 19:41 18 楼 0 00401537 . FF15 94214000 CALL DWORD PTR DS:[<&MFC71.#1482>] ; 关键 CALL F7 进 0040153D . 85C0 TEST EAX,EAX 0040153F . 6A 00 PUSH 0 00401541 . 8BCE MOV ECX,ESI 00401543 . 6A 00 PUSH 0 00401545 . 75 0C JNZ SHORT crack.00401553 //关键跳转 00401547 . 68 94274000 PUSH crack.00402794 0040154C . E8 09030000 CALL <JMP.&MFC71.#4104> 00401551 . 5E POP ESI 00401552 . C3 RETN 00401553 > 68 8C274000 PUSH crack.0040278C 00401558 . E8 FD020000 CALL <JMP.&MFC71.#4104> 0040155D . 5E POP ESI ―――――――――――――――――――――――――――――――――――――――――――――――― F7 进入后到这里 7C144DAE 8B09 MOV ECX,DWORD PTR DS:[ECX] 7C144DB0 FF7424 04 PUSH DWORD PTR SS:[ESP+4] 7C144DB4 51 PUSH ECX 7C144DB5 FF15 2811147C CALL DWORD PTR DS:[<&MSVCR71._mbscmp>] ; 又是一个关键 CALL F7 进 7C144DBC 59 POP ECX 7C144DBD C2 0400 RETN 4 ―――――――――――――――――――――――――――――――――――――――――――――――― 因为不是写破文，就去掉好多关键的代码到下面这一句 7C34BBAD 8ADA MOV BL,DL 7C34BBAF 8BCB MOV ECX,EBX 7C34BBB1 66:3BC8 CMP CX,AX // 所有的算法就在这一句，“漏洞啊” 7C34BBB4 75 0C JNZ SHORT MSVCR71.7C34BBC2 7C34BBB6 66:85C0 TEST AX,AX 7C34BBB9 ^ 75 A8 JNZ SHORT MSVCR71.7C34BB63 上面这个比较，不是比一个数值的相等，而是比较输入的用户名和注册码框的值是否相等，一见这句就知道了答案了
warshing 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 8 粉丝 0 关注私信	warshing 2006-11-14 21:19 19 楼 0 怎么下的断点？用W32ASM找不到相关的字符串。
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 2006-11-14 23:06 20 楼 0 可以用万能断点试试嘛，好用的很呢
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-15 08:43 21 楼 0 谢谢 KAN 大哥！！！
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-15 09:08 22 楼 0 最初由 KAN* 发布* 可以用万能断点试试嘛，好用的很呢万能断点是指自己设的断点吗？现在还不知道该在什么地方设置断点。请问如何设置断点？有什么技巧和原则吗？？？
lieben 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 14 粉丝 0 关注私信	lieben 2006-11-15 09:15 23 楼 0 CALL <JMP.&MFC71.#4104> CALL DWORD PTR DS:[<&MFC71.#1482>] CALL <JMP.&MFC71.#4104> CALL DWORD PTR DS:[<&MSVCR71._mbscmp>] JNZ SHORT MSVCR71.7C34BBC2 上面的看不懂，不知道JMP.&MFC71.#4104，[<&MFC71.#1482>]，[<&MSVCR71._mbscmp>] ，MSVCR71.7C34BBC2 是什么意思？？？ KAN 大哥，能不能解释一下看？
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复