闲得无聊搜集的一些OEP和Section，希望能对研究脱壳的朋友们帮上一点小忙。
末尾有打包下载。
**********************************************************************
Borland C++ 1999
.text
.data
.tls
.rdata
.idata
.edata
.rsrc
.reloc
00401000 Find> $ /EB 10 jmp short Finder33.00401012
00401002 |66 db 66 ; CHAR 'f'
00401003 |62 db 62 ; CHAR 'b'
00401004 |3A db 3A ; CHAR ':'
00401005 |43 db 43 ; CHAR 'C'
00401006 |2B db 2B ; CHAR '+'
00401007 |2B db 2B ; CHAR '+'
00401008 |48 db 48 ; CHAR 'H'
00401009 |4F db 4F ; CHAR 'O'
0040100A |4F db 4F ; CHAR 'O'
0040100B |4B db 4B ; CHAR 'K'
0040100C |90 nop
0040100D |E9 db E9
0040100E . |AC lods byte ptr ds:[esi]
0040100F . |2348 00 and ecx,dword ptr ds:[eax]
00401012 > \A1 9F234800 mov eax,dword ptr ds:[48239F]
00401017 . C1E0 02 shl eax,2
0040101A . A3 A3234800 mov dword ptr ds:[4823A3],eax
0040101F . 52 push edx ; ntdll.KiFastSystemCallRet
00401020 . 6A 00 push 0 ; /pModule = NULL
00401022 . E8 79010800 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401027 . 8BD0 mov edx,eax
00401029 . E8 F64F0700 call Finder33.00476024
0040102E . 5A pop edx ; kernel32.7C816FD7
0040102F . E8 544F0700 call Finder33.00475F88
00401034 . E8 2B500700 call Finder33.00476064
00401039 . 6A 00 push 0 ; /Arg1 = 00000000
0040103B . E8 48620700 call Finder33.00477288 ; \Finder33.00477288
00401040 . 59 pop ecx ; kernel32.7C816FD7
00401041 . 68 48234800 push Finder33.00482348
00401046 . 6A 00 push 0 ; /pModule = NULL
00401048 . E8 53010800 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
0040104D . A3 A7234800 mov dword ptr ds:[4823A7],eax
00401052 . 6A 00 push 0
00401054 . E9 0BB40700 jmp Finder33.0047C464
00401059 Find> $ E9 76620700 jmp Finder33.004772D4
0040105E . 33C0 xor eax,eax
00401060 . A0 91234800 mov al,byte ptr ds:[482391]
00401065 . C3 retn
EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 AC 23 48 00 A1 9F 23 48 00 C1 E0 02 A3 A3 23 48 00 52
6A 00 E8 79 01 08 00 8B D0 E8 F6 4F 07 00 5A E8 54 4F 07 00 E8 2B 50 07 00 6A 00 E8 48 62 07 00
59 68 48 23 48 00 6A 00 E8 53 01 08 00 A3 A7 23 48 00 6A 00 E9 0B B4 07 00 E9 76 62 07 00 33 C0
A0 91 23 48 00 C3
**********************************************************************
Borland C++
CODE
DATA
.INIT
.idata
.edata
.reloc
.rsrc
00401000 BCW.> $ A1 59B05000 mov eax,dword ptr ds:[50B059]
00401005 . C1E0 02 shl eax,2
00401008 . A3 5DB05000 mov dword ptr ds:[50B05D],eax
0040100D . 57 push edi ; ntdll.7C930738
0040100E . 51 push ecx
0040100F . 33C0 xor eax,eax
00401011 . BF 84665400 mov edi,BCW.00546684
00401016 . B9 8C345500 mov ecx,BCW.0055348C
0040101B . 3BCF cmp ecx,edi ; ntdll.7C930738
0040101D . 76 05 jbe short BCW.00401024
0040101F . 2BCF sub ecx,edi ; ntdll.7C930738
00401021 . FC cld
00401022 . F3:AA rep stos byte ptr es:[edi]
00401024 > 59 pop ecx ; kernel32.7C816FD7
00401025 . 5F pop edi ; kernel32.7C816FD7
00401026 . 64:67:8B16 0400 mov edx,dword ptr fs:[4]
0040102C . 8B42 F8 mov eax,dword ptr ds:[edx-8]
0040102F . A3 61B05000 mov dword ptr ds:[50B061],eax
00401034 . 8B42 FC mov eax,dword ptr ds:[edx-4]
00401037 . A3 65B05000 mov dword ptr ds:[50B065],eax
0040103C . 83EA 04 sub edx,4
0040103F . 8915 80345500 mov dword ptr ds:[553480],edx ; ntdll.KiFastSystemCallRet
00401045 . 83EA 04 sub edx,4
00401048 . 3BD4 cmp edx,esp
0040104A . 73 02 jnb short BCW.0040104E
0040104C . 8BE2 mov esp,edx ; ntdll.KiFastSystemCallRet
0040104E > 6A 00 push 0 ; /Arg1 = 00000000
00401050 . E8 45100000 call BCW.0040209A ; \BCW.0040209A
00401055 . 59 pop ecx ; kernel32.7C816FD7
00401056 . 68 2CB05000 push BCW.0050B02C
0040105B . 6A 00 push 0 ; /pModule = NULL
0040105D . E8 73821000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401062 . A3 6AB05000 mov dword ptr ds:[50B06A],eax
00401067 . 6A 00 push 0
00401069 . E9 93801000 jmp <jmp.&cw3220mt.__startup>
0040106E BCW.> $ E9 09110000 jmp BCW.0040217C
00401073 00 db 00
00401074 00 db 00
00401075 00 db 00
00401076 00 db 00
00401077 00 db 00
00401078 /$ 55 push ebp
00401079 |. 8BEC mov ebp,esp
0040107B |. 53 push ebx
0040107C |. 56 push esi
0040107D |. 57 push edi ; ntdll.7C930738
0040107E |. 8B75 0C mov esi,dword ptr ss:[ebp+C]
00401081 |. 6A 00 push 0 ; /pDefaultCharUsed = NULL
00401083 |. 6A 00 push 0 ; |pDefaultChar = NULL
00401085 |. 6A 00 push 0 ; |MultiByteCount = 0
00401087 |. 6A 00 push 0 ; |MultiByteStr = NULL
00401089 |. 56 push esi ; |WideCharCount = FFFFFFFF (-1.)
0040108A |. FF75 08 push dword ptr ss:[ebp+8] ; |WideCharStr = "?",82,"???",82,"?,87,"??暄T偎",86,"",85,"?盏????,A1,"",96,"v?",04,"???P???P?漾",B8,"?,86,"",85,"?,85,"????j?",10,"",89,"?",82,"?,98,"旦Ｑ?,10,"",99,"{",82,"?,98,"?肓",10,"?",11,""
0040108D |. 6A 00 push 0 ; |Options = 0
0040108F |. 6A 00 push 0 ; |CodePage = CP_ACP
00401091 |. E8 99821000 call <jmp.&KERNEL32.WideCharToMultiByte> ; \WideCharToMultiByte
00401096 |. 8BD8 mov ebx,eax
00401098 |. 83FE FF cmp esi,-1
0040109B |. 0F95C0 setne al
0040109E |. 83E0 01 and eax,1
004010A1 |. 03C3 add eax,ebx
004010A3 |. 50 push eax
004010A4 |. E8 A47F1000 call <jmp.&cw3220mt.@$bnwa$qui>
004010A9 |. 59 pop ecx ; kernel32.7C816FD7
004010AA |. 8BF8 mov edi,eax
004010AC |. 6A 00 push 0 ; /pDefaultCharUsed = NULL
004010AE |. 6A 00 push 0 ; |pDefaultChar = NULL
004010B0 |. 53 push ebx ; |MultiByteCount = 7FFDF000 (2147348480.)
004010B1 |. 57 push edi ; |MultiByteStr = ntdll.7C930738
004010B2 |. 56 push esi ; |WideCharCount = FFFFFFFF (-1.)
004010B3 |. FF75 08 push dword ptr ss:[ebp+8] ; |WideCharStr = "?",82,"???",82,"?,87,"??暄T偎",86,"",85,"?盏????,A1,"",96,"v?",04,"???P???P?漾",B8,"?,86,"",85,"?,85,"????j?",10,"",89,"?",82,"?,98,"旦Ｑ?,10,"",99,"{",82,"?,98,"?肓",10,"?",11,""
004010B6 |. 6A 00 push 0 ; |Options = 0
004010B8 |. 6A 00 push 0 ; |CodePage = CP_ACP
004010BA |. E8 70821000 call <jmp.&KERNEL32.WideCharToMultiByte> ; \WideCharToMultiByte
004010BF |. 8BD8 mov ebx,eax
004010C1 |. 83FE FF cmp esi,-1
004010C4 |. 74 04 je short BCW.004010CA
004010C6 |. C6041F 00 mov byte ptr ds:[edi+ebx],0
004010CA |> 8BC7 mov eax,edi ; ntdll.7C930738
004010CC |. 5F pop edi ; kernel32.7C816FD7
004010CD |. 5E pop esi ; kernel32.7C816FD7
004010CE |. 5B pop ebx ; kernel32.7C816FD7
004010CF |. 5D pop ebp ; kernel32.7C816FD7
004010D0 \. C3 retn
A1 59 B0 50 00 C1 E0 02 A3 5D B0 50 00 57 51 33 C0 BF 84 66 54 00 B9 8C 34 55 00 3B CF 76 05 2B
CF FC F3 AA 59 5F 64 67 8B 16 04 00 8B 42 F8 A3 61 B0 50 00 8B 42 FC A3 65 B0 50 00 83 EA 04 89
15 80 34 55 00 83 EA 04 3B D4 73 02 8B E2 6A 00 E8 45 10 00 00 59 68 2C B0 50 00 6A 00 E8 73 82
10 00 A3 6A B0 50 00 6A 00 E9 93 80 10 00 E9 09 11 00 00 00 00 00 00 00 55 8B EC 53 56 57 8B 75
0C 6A 00 6A 00 6A 00 6A 00 56 FF 75 08 6A 00 6A 00 E8 99 82 10 00 8B D8 83 FE FF 0F 95 C0 83 E0
01 03 C3 50 E8 A4 7F 10 00 59 8B F8 6A 00 6A 00 53 57 56 FF 75 08 6A 00 6A 00 E8 70 82 10 00 8B
D8 83 FE FF 74 04 C6 04 1F 00 8B C7 5F 5E 5B 5D C3
**********************************************************************
Borland Delphi 2.0
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
00433D9C htes> 55 push ebp
00433D9D 8BEC mov ebp,esp
00433D9F 83C4 F4 add esp,-0C
00433DA2 E8 F1F4FCFF call htest.00403298
00433DA7 E8 940AFDFF call htest.00404840
00433DAC E8 CF3AFDFF call htest.00407880
00433DB1 E8 92A4FDFF call htest.0040E248
00433DB6 E8 D1A5FDFF call htest.0040E38C
00433DBB E8 28C5FDFF call htest.004102E8
00433DC0 E8 633CFEFF call htest.00417A28
00433DC5 E8 CE0BFFFF call htest.00424998
00433DCA E8 2956FFFF call htest.004293F8
00433DCF E8 1474FFFF call htest.0042B1E8
00433DD4 E8 C3A2FFFF call htest.0042E09C
00433DD9 E8 4ED3FFFF call htest.0043112C
00433DDE E8 A5E2FFFF call htest.00432088
00433DE3 A1 28664300 mov eax,dword ptr ds:[436628]
00433DE8 E8 1302FFFF call htest.00424000
00433DED BA 2C3E4300 mov edx,htest.00433E2C ; ASCII "MP3-2-EXE Player"
00433DF2 A1 28664300 mov eax,dword ptr ds:[436628]
00433DF7 E8 20FFFEFF call htest.00423D1C
00433DFC B9 A4664300 mov ecx,htest.004366A4
00433E01 BA 04254300 mov edx,htest.00432504
00433E06 A1 28664300 mov eax,dword ptr ds:[436628]
00433E0B E8 0002FFFF call htest.00424010
00433E10 A1 28664300 mov eax,dword ptr ds:[436628]
00433E15 E8 8602FFFF call htest.004240A0
00433E1A E8 2904FDFF call htest.00404248
00433E1F 8BE5 mov esp,ebp
00433E21 5D pop ebp ; kernel32.7C816FD7
00433E22 C3 retn
55 8B EC 83 C4 F4 E8 F1 F4 FC FF E8 94 0A FD FF E8 CF 3A FD FF E8 92 A4 FD FF E8 D1 A5 FD FF E8
28 C5 FD FF E8 63 3C FE FF E8 CE 0B FF FF E8 29 56 FF FF E8 14 74 FF FF E8 C3 A2 FF FF E8 4E D3
FF FF E8 A5 E2 FF FF A1 28 66 43 00 E8 13 02 FF FF BA 2C 3E 43 00 A1 28 66 43 00 E8 20 FF FE FF
B9 A4 66 43 00 BA 04 25 43 00 A1 28 66 43 00 E8 00 02 FF FF A1 28 66 43 00 E8 86 02 FF FF E8 29
04 FD FF 8B E5 5D C3
**********************************************************************
Borland Delphi 3.0
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
004ABA30 ResH> 55 push ebp
004ABA31 8BEC mov ebp,esp
004ABA33 83C4 F0 add esp,-10
004ABA36 33C0 xor eax,eax
004ABA38 8945 F0 mov dword ptr ss:[ebp-10],eax
004ABA3B B8 60B84A00 mov eax,ResHacke.004AB860
004ABA40 E8 B79CF5FF call ResHacke.004056FC
004ABA45 33C0 xor eax,eax
004ABA47 55 push ebp
004ABA48 68 40BB4A00 push ResHacke.004ABB40
004ABA4D 64:FF30 push dword ptr fs:[eax]
004ABA50 64:8920 mov dword ptr fs:[eax],esp
004ABA53 A1 60DC4A00 mov eax,dword ptr ds:[4ADC60]
004ABA58 8B00 mov eax,dword ptr ds:[eax]
004ABA5A E8 856EF8FF call ResHacke.004328E4
004ABA5F A1 60DC4A00 mov eax,dword ptr ds:[4ADC60]
004ABA64 8B00 mov eax,dword ptr ds:[eax]
004ABA66 BA 54BB4A00 mov edx,ResHacke.004ABB54 ; ASCII "Resource Hacker"
004ABA6B E8 8C6BF8FF call ResHacke.004325FC
004ABA70 A1 60DC4A00 mov eax,dword ptr ds:[4ADC60]
004ABA75 8B00 mov eax,dword ptr ds:[eax]
004ABA77 C640 3F 00 mov byte ptr ds:[eax+3F],0
004ABA7B 8B0D D8DA4A00 mov ecx,dword ptr ds:[4ADAD8] ; ResHacke.004AE81C
004ABA81 A1 60DC4A00 mov eax,dword ptr ds:[4ADC60]
004ABA86 8B00 mov eax,dword ptr ds:[eax]
004ABA88 8B15 DCE44900 mov edx,dword ptr ds:[49E4DC] ; ResHacke.0049E51C
004ABA8E E8 696EF8FF call ResHacke.004328FC
004ABA93 E8 786DF5FF call ResHacke.00402810
004ABA98 48 dec eax
004ABA99 7E 78 jle short ResHacke.004ABB13
004ABA9B 8D55 F0 lea edx,dword ptr ss:[ebp-10]
004ABA9E B8 01000000 mov eax,1
004ABAA3 E8 C86DF5FF call ResHacke.00402870
004ABAA8 8B45 F0 mov eax,dword ptr ss:[ebp-10]
004ABAAB 8038 2D cmp byte ptr ds:[eax],2D
004ABAAE 75 63 jnz short ResHacke.004ABB13
004ABAB0 B2 01 mov dl,1
004ABAB2 A1 88AE4800 mov eax,dword ptr ds:[48AE88]
004ABAB7 E8 B872F5FF call ResHacke.00402D74
004ABABC A3 84E84A00 mov dword ptr ds:[4AE884],eax
004ABAC1 33C0 xor eax,eax
004ABAC3 55 push ebp
004ABAC4 68 F9BA4A00 push ResHacke.004ABAF9
004ABAC9 64:FF30 push dword ptr fs:[eax]
004ABACC 64:8920 mov dword ptr fs:[eax],esp
004ABACF 8B15 D8DA4A00 mov edx,dword ptr ds:[4ADAD8] ; ResHacke.004AE81C
004ABAD5 8B12 mov edx,dword ptr ds:[edx]
004ABAD7 A1 84E84A00 mov eax,dword ptr ds:[4AE884]
004ABADC E8 8BF5FDFF call ResHacke.0048B06C
004ABAE1 33C0 xor eax,eax
004ABAE3 5A pop edx ; kernel32.7C816FD7
004ABAE4 59 pop ecx ; kernel32.7C816FD7
004ABAE5 59 pop ecx ; kernel32.7C816FD7
004ABAE6 64:8910 mov dword ptr fs:[eax],edx ; ntdll.KiFastSystemCallRet
004ABAE9 68 00BB4A00 push ResHacke.004ABB00
004ABAEE A1 84E84A00 mov eax,dword ptr ds:[4AE884]
004ABAF3 E8 A472F5FF call ResHacke.00402D9C
004ABAF8 C3 retn
004ABAF9 ^ E9 6A78F5FF jmp ResHacke.00403368
004ABAFE ^ EB EE jmp short ResHacke.004ABAEE
004ABB00 A1 D8DA4A00 mov eax,dword ptr ds:[4ADAD8]
004ABB05 8B00 mov eax,dword ptr ds:[eax]
004ABB07 E8 304DF8FF call ResHacke.0043083C
004ABB0C E8 837CF5FF call ResHacke.00403794
004ABB11 EB 0B jmp short ResHacke.004ABB1E
004ABB13 A1 60DC4A00 mov eax,dword ptr ds:[4ADC60]
004ABB18 8B00 mov eax,dword ptr ds:[eax]
004ABB1A C640 3F 01 mov byte ptr ds:[eax+3F],1
004ABB1E A1 60DC4A00 mov eax,dword ptr ds:[4ADC60]
004ABB23 8B00 mov eax,dword ptr ds:[eax]
004ABB25 E8 5E6EF8FF call ResHacke.00432988
004ABB2A 33C0 xor eax,eax
004ABB2C 5A pop edx ; kernel32.7C816FD7
004ABB2D 59 pop ecx ; kernel32.7C816FD7
004ABB2E 59 pop ecx ; kernel32.7C816FD7
004ABB2F 64:8910 mov dword ptr fs:[eax],edx ; ntdll.KiFastSystemCallRet
004ABB32 68 47BB4A00 push ResHacke.004ABB47
004ABB37 8D45 F0 lea eax,dword ptr ss:[ebp-10]
004ABB3A E8 097EF5FF call ResHacke.00403948
004ABB3F C3 retn
55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 60 B8 4A 00 E8 B7 9C F5 FF 33 C0 55 68 40 BB 4A 00 64 FF 30
64 89 20 A1 60 DC 4A 00 8B 00 E8 85 6E F8 FF A1 60 DC 4A 00 8B 00 BA 54 BB 4A 00 E8 8C 6B F8 FF
A1 60 DC 4A 00 8B 00 C6 40 3F 00 8B 0D D8 DA 4A 00 A1 60 DC 4A 00 8B 00 8B 15 DC E4 49 00 E8 69
6E F8 FF E8 78 6D F5 FF 48 7E 78 8D 55 F0 B8 01 00 00 00 E8 C8 6D F5 FF 8B 45 F0 80 38 2D 75 63
B2 01 A1 88 AE 48 00 E8 B8 72 F5 FF A3 84 E8 4A 00 33 C0 55 68 F9 BA 4A 00 64 FF 30 64 89 20 8B
15 D8 DA 4A 00 8B 12 A1 84 E8 4A 00 E8 8B F5 FD FF 33 C0 5A 59 59 64 89 10 68 00 BB 4A 00 A1 84
E8 4A 00 E8 A4 72 F5 FF C3 E9 6A 78 F5 FF EB EE A1 D8 DA 4A 00 8B 00 E8 30 4D F8 FF E8 83 7C F5
FF EB 0B A1 60 DC 4A 00 8B 00 C6 40 3F 01 A1 60 DC 4A 00 8B 00 E8 5E 6E F8 FF 33 C0 5A 59 59 64
89 10 68 47 BB 4A 00 8D 45 F0 E8 09 7E F5 FF C3
**********************************************************************
Borland Delphi 4.0 - 5.0
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
00457E00 YUCE> 55 push ebp
00457E01 8BEC mov ebp,esp
00457E03 83C4 F4 add esp,-0C
00457E06 B8 C87C4500 mov eax,YUCE.00457CC8
00457E0B E8 44E4FAFF call YUCE.00406254
00457E10 A1 048F4500 mov eax,dword ptr ds:[458F04]
00457E15 8B00 mov eax,dword ptr ds:[eax]
00457E17 BA 547E4500 mov edx,YUCE.00457E54
00457E1C E8 83DEFEFF call YUCE.00445CA4
00457E21 8B0D 688D4500 mov ecx,dword ptr ds:[458D68] ; YUCE.0045A878
00457E27 A1 048F4500 mov eax,dword ptr ds:[458F04]
00457E2C 8B00 mov eax,dword ptr ds:[eax]
00457E2E 8B15 C85B4500 mov edx,dword ptr ds:[455BC8] ; YUCE.00455C14
00457E34 E8 2FE2FEFF call YUCE.00446068
00457E39 A1 048F4500 mov eax,dword ptr ds:[458F04]
00457E3E 8B00 mov eax,dword ptr ds:[eax]
00457E40 E8 A3E2FEFF call YUCE.004460E8
00457E45 E8 F6B8FAFF call YUCE.00403740
00457E4A 0000 add byte ptr ds:[eax],al
00457E4C FFFF ??? ; Unknown command
00457E4E FFFF ??? ; Unknown command
00457E50 0C 00 or al,0
00457E52 0000 add byte ptr ds:[eax],al
00457E54 C9 leave
00457E55 FA cli
00457E56 C3 retn
55 8B EC 83 C4 F4 B8 C8 7C 45 00 E8 44 E4 FA FF A1 04 8F 45 00 8B 00 BA 54 7E 45 00 E8 83 DE FE
FF 8B 0D 68 8D 45 00 A1 04 8F 45 00 8B 00 8B 15 C8 5B 45 00 E8 2F E2 FE FF A1 04 8F 45 00 8B 00
E8 A3 E2 FE FF E8 F6 B8 FA FF 00 00 FF FF FF FF 0C 00 00 00 C9 FA C3
**********************************************************************
Borland Delphi 6.0 - 7.0
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
0047845C pymf> 55 push ebp
0047845D 8BEC mov ebp,esp
0047845F 83C4 E8 add esp,-18
00478462 33C0 xor eax,eax
00478464 8945 EC mov dword ptr ss:[ebp-14],eax
00478467 8945 E8 mov dword ptr ss:[ebp-18],eax
0047846A B8 6C824700 mov eax,pymf.0047826C
0047846F E8 94E3F8FF call pymf.00406808
00478474 33C0 xor eax,eax
00478476 55 push ebp
00478477 68 21854700 push pymf.00478521
0047847C 64:FF30 push dword ptr fs:[eax]
0047847F 64:8920 mov dword ptr fs:[eax],esp
00478482 E8 0DD5FFFF call pymf.00475994
00478487 84C0 test al,al
00478489 75 18 jnz short pymf.004784A3
0047848B 6A 24 push 24
0047848D 68 30854700 push pymf.00478530 ; ASCII "Error"
00478492 68 38854700 push pymf.00478538 ; ASCII "YMF7x4 driver is not found. Start the program anyway?"
00478497 6A 00 push 0
00478499 E8 C2ECF8FF call <jmp.&user32.MessageBoxA>
0047849E 83F8 06 cmp eax,6
004784A1 75 63 jnz short pymf.00478506
004784A3 8D55 E8 lea edx,dword ptr ss:[ebp-18]
004784A6 B8 01000000 mov eax,1
004784AB E8 BCA5F8FF call pymf.00402A6C
004784B0 8B45 E8 mov eax,dword ptr ss:[ebp-18]
004784B3 8D55 EC lea edx,dword ptr ss:[ebp-14]
004784B6 E8 3900F9FF call pymf.004084F4
004784BB 8B45 EC mov eax,dword ptr ss:[ebp-14]
004784BE BA 78854700 mov edx,pymf.00478578 ; ASCII "-clean"
004784C3 E8 5CC3F8FF call pymf.00404824
004784C8 75 07 jnz short pymf.004784D1
004784CA E8 B1C7FFFF call pymf.00474C80
004784CF EB 35 jmp short pymf.00478506
004784D1 A1 E8B24700 mov eax,dword ptr ds:[47B2E8]
004784D6 8B00 mov eax,dword ptr ds:[eax]
004784D8 E8 A75BFEFF call pymf.0045E084
004784DD 8B0D 00B14700 mov ecx,dword ptr ds:[47B100] ; pymf.0047CDC0
004784E3 A1 E8B24700 mov eax,dword ptr ds:[47B2E8]
004784E8 8B00 mov eax,dword ptr ds:[eax]
004784EA 8B15 F85B4700 mov edx,dword ptr ds:[475BF8] ; pymf.00475C44
004784F0 E8 A75BFEFF call pymf.0045E09C
004784F5 A1 E8B24700 mov eax,dword ptr ds:[47B2E8]
004784FA 8B00 mov eax,dword ptr ds:[eax]
004784FC E8 1B5CFEFF call pymf.0045E11C
00478501 E8 5ED6FFFF call pymf.00475B64
00478506 33C0 xor eax,eax
00478508 5A pop edx ; kernel32.7C816FD7
00478509 59 pop ecx ; kernel32.7C816FD7
0047850A 59 pop ecx ; kernel32.7C816FD7
0047850B 64:8910 mov dword ptr fs:[eax],edx ; ntdll.KiFastSystemCallRet
0047850E 68 28854700 push pymf.00478528
00478513 8D45 E8 lea eax,dword ptr ss:[ebp-18]
00478516 BA 02000000 mov edx,2
0047851B E8 2CBFF8FF call pymf.0040444C
00478520 C3 retn
55 8B EC 83 C4 E8 33 C0 89 45 EC 89 45 E8 B8 6C 82 47 00 E8 94 E3 F8 FF 33 C0 55 68 21 85 47 00
64 FF 30 64 89 20 E8 0D D5 FF FF 84 C0 75 18 6A 24 68 30 85 47 00 68 38 85 47 00 6A 00 E8 C2 EC
F8 FF 83 F8 06 75 63 8D 55 E8 B8 01 00 00 00 E8 BC A5 F8 FF 8B 45 E8 8D 55 EC E8 39 00 F9 FF 8B
45 EC BA 78 85 47 00 E8 5C C3 F8 FF 75 07 E8 B1 C7 FF FF EB 35 A1 E8 B2 47 00 8B 00 E8 A7 5B FE
FF 8B 0D 00 B1 47 00 A1 E8 B2 47 00 8B 00 8B 15 F8 5B 47 00 E8 A7 5B FE FF A1 E8 B2 47 00 8B 00
E8 1B 5C FE FF E8 5E D6 FF FF 33 C0 5A 59 59 64 89 10 68 28 85 47 00 8D 45 E8 BA 02 00 00 00 E8
2C BF F8 FF C3
**********************************************************************
MASM32 / TASM32
.text
.rdata
.data
.rsrc
00401000 RVA.>/$ 6A 00 push 0 ; /pModule = NULL
00401002 |. E8 830A0000 call <jmp.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 07304000 mov dword ptr ds:[403007],eax
0040100C |. 6A 00 push 0 ; /lParam = NULL
0040100E |. 68 6C104000 push RVA.0040106C ; |DlgProc = RVA.0040106C
00401013 |. 6A 00 push 0 ; |hOwner = NULL
00401015 |. 68 00304000 push RVA.00403000 ; |pTemplate = "DIALOG"
0040101A |. FF35 07304000 push dword ptr ds:[403007] ; |hInst = NULL
00401020 |. E8 F9090000 call <jmp.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401025 |. 50 push eax ; /ExitCode = 0
00401026 \. E8 4D0A0000 call <jmp.&KERNEL32.ExitProcess> ; \ExitProcess
0040102B /. 55 push ebp
0040102C |. 8BEC mov ebp,esp
0040102E |. 837D 0C 10 cmp dword ptr ss:[ebp+C],10
00401032 |. 75 0C jnz short RVA.00401040
00401034 |. 6A 00 push 0 ; /Result = 0
00401036 |. FF75 08 push dword ptr ss:[ebp+8] ; |hWnd = 00401000
00401039 |. E8 EC090000 call <jmp.&USER32.EndDialog> ; \EndDialog
0040103E |. EB 26 jmp short RVA.00401066
00401040 |> 817D 0C 11010000 cmp dword ptr ss:[ebp+C],111
00401047 |. 75 1D jnz short RVA.00401066
00401049 |. 8B45 10 mov eax,dword ptr ss:[ebp+10]
0040104C |. 66:3D B80B cmp ax,0BB8
00401050 |. 75 14 jnz short RVA.00401066
00401052 |. C1E8 10 shr eax,10
00401055 |. 66:0BC0 or ax,ax
00401058 |. 75 0A jnz short RVA.00401064
0040105A |. 6A 00 push 0 ; /Result = 0
0040105C |. FF75 08 push dword ptr ss:[ebp+8] ; |hWnd = 00401000
0040105F |. E8 C6090000 call <jmp.&USER32.EndDialog> ; \EndDialog
00401064 |> EB 00 jmp short RVA.00401066
00401066 |> 33C0 xor eax,eax
00401068 |. C9 leave
00401069 \. C2 1000 retn 10
6A 00 E8 83 0A 00 00 A3 07 30 40 00 6A 00 68 6C 10 40 00 6A 00 68 00 30 40 00 FF 35 07 30 40 00
E8 F9 09 00 00 50 E8 4D 0A 00 00 55 8B EC 83 7D 0C 10 75 0C 6A 00 FF 75 08 E8 EC 09 00 00 EB 26
81 7D 0C 11 01 00 00 75 1D 8B 45 10 66 3D B8 0B 75 14 C1 E8 10 66 0B C0 75 0A 6A 00 FF 75 08 E8
C6 09 00 00 EB 00 33 C0 C9 C2 10 00
**********************************************************************
Microsoft Visual Basic 5.0 / 6.0
.text
.data
.rsrc
00402360 Kill>/$ 68 2C4D4000 push KillBox.00404D2C ; ASCII "VB5!6&*"
00402365 |. E8 EEFFFFFF call <jmp.&MSVBVM60.#100>
0040236A |. 0000 add byte ptr ds:[eax],al
0040236C |. 0000 add byte ptr ds:[eax],al
0040236E |. 0000 add byte ptr ds:[eax],al
00402370 |. 3000 xor byte ptr ds:[eax],al
00402372 |. 0000 add byte ptr ds:[eax],al
00402374 |. 3800 cmp byte ptr ds:[eax],al
00402376 |. 0000 add byte ptr ds:[eax],al
00402378 |. 0000 add byte ptr ds:[eax],al
0040237A |. 0000 add byte ptr ds:[eax],al
0040237C |. 4F dec edi ; ntdll.7C930738
0040237D \. C2 F150 retn 50F1
68 2C 4D 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 4F C2 F1 50
**********************************************************************
Microsoft Visual C++ 4.x
.text
.rdata
.data
.idata
.reloc
00401CC0 memt> $ 64:A1 00000000 mov eax,dword ptr fs:[0]
00401CC6 . 55 push ebp
00401CC7 . 8BEC mov ebp,esp
00401CC9 . 6A FF push -1
00401CCB . 68 28804000 push memtest.00408028
00401CD0 . 68 001B4000 push memtest.00401B00
00401CD5 . 50 push eax
00401CD6 . 64:8925 00000000 mov dword ptr fs:[0],esp
00401CDD . 83EC 60 sub esp,60
00401CE0 . 53 push ebx
00401CE1 . 56 push esi
00401CE2 . 57 push edi ; ntdll.7C930738
00401CE3 . 8965 E8 mov dword ptr ss:[ebp-18],esp
00401CE6 . FF15 30D14000 call near dword ptr ds:[<&KERNEL32.GetVersion>] ; kernel32.GetVersion
00401CEC . A3 B89A4000 mov dword ptr ds:[409AB8],eax
00401CF1 . 33C0 xor eax,eax
00401CF3 . A0 B99A4000 mov al,byte ptr ds:[409AB9]
00401CF8 . A3 C49A4000 mov dword ptr ds:[409AC4],eax
00401CFD . A1 B89A4000 mov eax,dword ptr ds:[409AB8]
00401D02 . C12D B89A4000 10 shr dword ptr ds:[409AB8],10
00401D09 . 25 FF000000 and eax,0FF
00401D0E . A3 C09A4000 mov dword ptr ds:[409AC0],eax
00401D13 . C1E0 08 shl eax,8
00401D16 . 0305 C49A4000 add eax,dword ptr ds:[409AC4]
00401D1C . A3 BC9A4000 mov dword ptr ds:[409ABC],eax
00401D21 . E8 6A010000 call memtest.00401E90
00401D26 . 85C0 test eax,eax
00401D28 . 75 0A jnz short memtest.00401D34
00401D2A . 6A 1C push 1C
00401D2C . E8 2F010000 call memtest.00401E60
00401D31 . 83C4 04 add esp,4
00401D34 > C745 FC 00000000 mov dword ptr ss:[ebp-4],0
00401D3B . E8 00260000 call memtest.00404340
00401D40 . E8 EB250000 call memtest.00404330
00401D45 . FF15 2CD14000 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA
00401D4B . A3 80CD4000 mov dword ptr ds:[40CD80],eax
00401D50 . E8 8B210000 call memtest.00403EE0
00401D55 . A3 3C924000 mov dword ptr ds:[40923C],eax
00401D5A . 85C0 test eax,eax
00401D5C . 74 09 je short memtest.00401D67
00401D5E . 833D 80CD4000 00 cmp dword ptr ds:[40CD80],0
00401D65 . 75 0A jnz short memtest.00401D71
00401D67 > 6A FF push -1
00401D69 . E8 021B0000 call memtest.00403870
00401D6E . 83C4 04 add esp,4
00401D71 > E8 EA1E0000 call memtest.00403C60
00401D76 . E8 F51D0000 call memtest.00403B70
00401D7B . E8 C01A0000 call memtest.00403840
00401D80 . 8B35 80CD4000 mov esi,dword ptr ds:[40CD80]
00401D86 . 8A06 mov al,byte ptr ds:[esi]
00401D88 . 3C 22 cmp al,22
00401D8A . 74 0C je short memtest.00401D98
00401D8C . 3C 20 cmp al,20
00401D8E . 76 35 jbe short memtest.00401DC5
00401D90 > 46 inc esi
00401D91 . 803E 20 cmp byte ptr ds:[esi],20
00401D94 .^ 77 FA ja short memtest.00401D90
00401D96 . EB 2D jmp short memtest.00401DC5
00401D98 > 46 inc esi
00401D99 . 803E 22 cmp byte ptr ds:[esi],22
00401D9C . 74 26 je short memtest.00401DC4
00401D9E . 8A5D D8 mov bl,byte ptr ss:[ebp-28]
00401DA1 > 8A1E mov bl,byte ptr ds:[esi]
00401DA3 . 84DB test bl,bl
00401DA5 . 74 18 je short memtest.00401DBF
00401DA7 . 33C0 xor eax,eax
00401DA9 . 8AC3 mov al,bl
00401DAB . 50 push eax
00401DAC . E8 5F1D0000 call memtest.00403B10
00401DB1 . 83C4 04 add esp,4
00401DB4 . 85C0 test eax,eax
00401DB6 . 74 01 je short memtest.00401DB9
00401DB8 . 46 inc esi
00401DB9 > 46 inc esi
00401DBA . 803E 22 cmp byte ptr ds:[esi],22
00401DBD .^ 75 E2 jnz short memtest.00401DA1
00401DBF > 803E 22 cmp byte ptr ds:[esi],22
00401DC2 . 75 01 jnz short memtest.00401DC5
00401DC4 > 46 inc esi
00401DC5 > 803E 00 cmp byte ptr ds:[esi],0
00401DC8 . 74 0B je short memtest.00401DD5
00401DCA > 803E 20 cmp byte ptr ds:[esi],20
00401DCD . 77 06 ja short memtest.00401DD5
00401DCF . 46 inc esi
00401DD0 . 803E 00 cmp byte ptr ds:[esi],0
00401DD3 .^ 75 F5 jnz short memtest.00401DCA
00401DD5 > C745 BC 00000000 mov dword ptr ss:[ebp-44],0
00401DDC . 8D45 90 lea eax,dword ptr ss:[ebp-70]
00401DDF . 50 push eax ; /pStartupinfo = NULL
00401DE0 . FF15 28D14000 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA
00401DE6 . F645 BC 01 test byte ptr ss:[ebp-44],1
00401DEA . B8 0A000000 mov eax,0A
00401DEF . 74 08 je short memtest.00401DF9
00401DF1 . 8B45 C0 mov eax,dword ptr ss:[ebp-40] ; ntdll.7C92E64E
00401DF4 . 25 FFFF0000 and eax,0FFFF
00401DF9 > 50 push eax ; /Arg4 = 00000000
00401DFA . 56 push esi ; |Arg3 = FFFFFFFF
00401DFB . 6A 00 push 0 ; |Arg2 = 00000000
00401DFD . 6A 00 push 0 ; |/pModule = NULL
00401DFF . FF15 24D14000 call near dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; |\GetModuleHandleA
00401E05 . 50 push eax ; |Arg1 = 00000000
00401E06 . E8 F5F1FFFF call memtest.00401000 ; \memtest.00401000
00401E0B . 50 push eax
00401E0C . E8 5F1A0000 call memtest.00403870
00401E11 . EB 27 jmp short memtest.00401E3A
00401E13 . 8B45 EC mov eax,dword ptr ss:[ebp-14]
00401E16 . 8B00 mov eax,dword ptr ds:[eax]
00401E18 . 8B00 mov eax,dword ptr ds:[eax]
00401E1A . 8945 E0 mov dword ptr ss:[ebp-20],eax
00401E1D . 8B45 EC mov eax,dword ptr ss:[ebp-14]
00401E20 . 50 push eax
00401E21 . 8B45 E0 mov eax,dword ptr ss:[ebp-20]
00401E24 . 50 push eax
00401E25 . E8 561B0000 call memtest.00403980
00401E2A . 83C4 08 add esp,8
00401E2D . C3 retn
64 A1 00 00 00 00 55 8B EC 6A FF 68 28 80 40 00 68 00 1B 40 00 50 64 89 25 00 00 00 00 83 EC 60
53 56 57 89 65 E8 FF 15 30 D1 40 00 A3 B8 9A 40 00 33 C0 A0 B9 9A 40 00 A3 C4 9A 40 00 A1 B8 9A
40 00 C1 2D B8 9A 40 00 10 25 FF 00 00 00 A3 C0 9A 40 00 C1 E0 08 03 05 C4 9A 40 00 A3 BC 9A 40
00 E8 6A 01 00 00 85 C0 75 0A 6A 1C E8 2F 01 00 00 83 C4 04 C7 45 FC 00 00 00 00 E8 00 26 00 00
E8 EB 25 00 00 FF 15 2C D1 40 00 A3 80 CD 40 00 E8 8B 21 00 00 A3 3C 92 40 00 85 C0 74 09 83 3D
80 CD 40 00 00 75 0A 6A FF E8 02 1B 00 00 83 C4 04 E8 EA 1E 00 00 E8 F5 1D 00 00 E8 C0 1A 00 00
8B 35 80 CD 40 00 8A 06 3C 22 74 0C 3C 20 76 35 46 80 3E 20 77 FA EB 2D 46 80 3E 22 74 26 8A 5D
D8 8A 1E 84 DB 74 18 33 C0 8A C3 50 E8 5F 1D 00 00 83 C4 04 85 C0 74 01 46 46 80 3E 22 75 E2 80
3E 22 75 01 46 80 3E 00 74 0B 80 3E 20 77 06 46 80 3E 00 75 F5 C7 45 BC 00 00 00 00 8D 45 90 50
FF 15 28 D1 40 00 F6 45 BC 01 B8 0A 00 00 00 74 08 8B 45 C0 25 FF FF 00 00 50 56 6A 00 6A 00 FF
15 24 D1 40 00 50 E8 F5 F1 FF FF 50 E8 5F 1A 00 00 EB 27 8B 45 EC 8B 00 8B 00 89 45 E0 8B 45 EC
50 8B 45 E0 50 E8 56 1B 00 00 83 C4 08 C3
**********************************************************************
Microsoft Visual C++ 5.0
.text
.rdata
.data
.rsrc
0040B060 HEdi> $ 55 push ebp
0040B061 . 8BEC mov ebp,esp
0040B063 . 6A FF push -1
0040B065 . 68 C8264400 push HEdit.004426C8
0040B06A . 68 38E24000 push HEdit.0040E238 ; SE handler installation
0040B06F . 64:A1 00000000 mov eax,dword ptr fs:[0]
0040B075 . 50 push eax
0040B076 . 64:8925 00000000 mov dword ptr fs:[0],esp
0040B07D . 83C4 A8 add esp,-58
0040B080 . 53 push ebx
0040B081 . 56 push esi
0040B082 . 57 push edi ; ntdll.7C930738
0040B083 . 8965 E8 mov dword ptr ss:[ebp-18],esp
0040B086 . FF15 F0C14300 call near dword ptr ds:[<&KERNEL32.GetVersion>] ; kernel32.GetVersion
0040B08C . 33D2 xor edx,edx ; ntdll.KiFastSystemCallRet
0040B08E . 8AD4 mov dl,ah
0040B090 . 8915 A0174500 mov dword ptr ds:[4517A0],edx ; ntdll.KiFastSystemCallRet
0040B096 . 8BC8 mov ecx,eax
0040B098 . 81E1 FF000000 and ecx,0FF
0040B09E . 890D 9C174500 mov dword ptr ds:[45179C],ecx
0040B0A4 . C1E1 08 shl ecx,8
0040B0A7 . 03CA add ecx,edx ; ntdll.KiFastSystemCallRet
0040B0A9 . 890D 98174500 mov dword ptr ds:[451798],ecx
0040B0AF . C1E8 10 shr eax,10
0040B0B2 . A3 94174500 mov dword ptr ds:[451794],eax
0040B0B7 . E8 F45C0000 call HEdit.00410DB0
0040B0BC . 85C0 test eax,eax
0040B0BE . 75 0A jnz short HEdit.0040B0CA
0040B0C0 . 6A 1C push 1C
0040B0C2 . E8 79010000 call HEdit.0040B240
0040B0C7 . 83C4 04 add esp,4
0040B0CA > E8 11290000 call HEdit.0040D9E0
0040B0CF . 85C0 test eax,eax
0040B0D1 . 75 0A jnz short HEdit.0040B0DD
0040B0D3 . 6A 10 push 10
0040B0D5 . E8 66010000 call HEdit.0040B240
0040B0DA . 83C4 04 add esp,4
0040B0DD > C745 FC 00000000 mov dword ptr ss:[ebp-4],0
0040B0E4 . E8 B75A0000 call HEdit.00410BA0
0040B0E9 . E8 821B0000 call HEdit.0040CC70
0040B0EE . FF15 70C24300 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA
0040B0F4 . A3 D02E4500 mov dword ptr ds:[452ED0],eax
0040B0F9 . E8 42590000 call HEdit.00410A40
0040B0FE . A3 DC174500 mov dword ptr ds:[4517DC],eax
0040B103 . 85C0 test eax,eax
0040B105 . 74 09 je short HEdit.0040B110
0040B107 . A1 D02E4500 mov eax,dword ptr ds:[452ED0]
0040B10C . 85C0 test eax,eax
0040B10E . 75 0A jnz short HEdit.0040B11A
0040B110 > 6A FF push -1
0040B112 . E8 C9F7FFFF call HEdit.0040A8E0
0040B117 . 83C4 04 add esp,4
0040B11A > E8 71560000 call HEdit.00410790
0040B11F . E8 7C550000 call HEdit.004106A0
0040B124 . E8 87F7FFFF call HEdit.0040A8B0
0040B129 . 8B35 D02E4500 mov esi,dword ptr ds:[452ED0]
0040B12F . 8975 9C mov dword ptr ss:[ebp-64],esi
0040B132 . 803E 22 cmp byte ptr ds:[esi],22
0040B135 . 0F85 BE000000 jnz HEdit.0040B1F9
0040B13B > 46 inc esi
0040B13C . 8975 9C mov dword ptr ss:[ebp-64],esi
0040B13F . 8A06 mov al,byte ptr ds:[esi]
0040B141 . 3C 22 cmp al,22
0040B143 . 74 1C je short HEdit.0040B161
0040B145 . 84C0 test al,al
0040B147 . 74 18 je short HEdit.0040B161
0040B149 . 25 FF000000 and eax,0FF
0040B14E . 50 push eax
0040B14F . E8 EC540000 call HEdit.00410640
0040B154 . 83C4 04 add esp,4
0040B157 . 85C0 test eax,eax
0040B159 .^ 74 E0 je short HEdit.0040B13B
0040B15B . 46 inc esi
0040B15C . 8975 9C mov dword ptr ss:[ebp-64],esi
0040B15F .^ EB DA jmp short HEdit.0040B13B
0040B161 > 803E 22 cmp byte ptr ds:[esi],22
0040B164 . 75 04 jnz short HEdit.0040B16A
0040B166 . 46 inc esi
0040B167 . 8975 9C mov dword ptr ss:[ebp-64],esi
0040B16A > 8A06 mov al,byte ptr ds:[esi]
0040B16C . 84C0 test al,al
0040B16E . 74 0A je short HEdit.0040B17A
0040B170 . 3C 20 cmp al,20
0040B172 . 77 06 ja short HEdit.0040B17A
0040B174 . 46 inc esi
0040B175 . 8975 9C mov dword ptr ss:[ebp-64],esi
0040B178 .^ EB F0 jmp short HEdit.0040B16A
0040B17A > C745 D0 00000000 mov dword ptr ss:[ebp-30],0
0040B181 . 8D45 A4 lea eax,dword ptr ss:[ebp-5C]
0040B184 . 50 push eax ; /pStartupinfo = NULL
0040B185 . FF15 68C24300 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA
0040B18B . F645 D0 01 test byte ptr ss:[ebp-30],1
0040B18F . 74 0A je short HEdit.0040B19B
0040B191 . 8B45 D4 mov eax,dword ptr ss:[ebp-2C] ; kernel32.7C816FD7
0040B194 . 25 FFFF0000 and eax,0FFFF
0040B199 . EB 05 jmp short HEdit.0040B1A0
0040B19B > B8 0A000000 mov eax,0A
0040B1A0 > 50 push eax
0040B1A1 . 56 push esi
0040B1A2 . 6A 00 push 0
0040B1A4 . 6A 00 push 0 ; /pModule = NULL
0040B1A6 . FF15 78C24300 call near dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA
0040B1AC . 50 push eax
0040B1AD . E8 B5FC0000 call HEdit.0041AE67
0040B1B2 . 8945 A0 mov dword ptr ss:[ebp-60],eax
0040B1B5 . 50 push eax
0040B1B6 . E8 25F7FFFF call HEdit.0040A8E0
0040B1BB . EB 21 jmp short HEdit.0040B1DE
0040B1BD . 8B45 EC mov eax,dword ptr ss:[ebp-14]
0040B1C0 . 8B08 mov ecx,dword ptr ds:[eax]
0040B1C2 . 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E
0040B1C4 . 894D 98 mov dword ptr ss:[ebp-68],ecx
0040B1C7 . 50 push eax
0040B1C8 . 51 push ecx
0040B1C9 . E8 22520000 call HEdit.004103F0
0040B1CE . 83C4 08 add esp,8
0040B1D1 . C3 retn
55 8B EC 6A FF 68 C8 26 44 00 68 38 E2 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8
53 56 57 89 65 E8 FF 15 F0 C1 43 00 33 D2 8A D4 89 15 A0 17 45 00 8B C8 81 E1 FF 00 00 00 89 0D
9C 17 45 00 C1 E1 08 03 CA 89 0D 98 17 45 00 C1 E8 10 A3 94 17 45 00 E8 F4 5C 00 00 85 C0 75 0A
6A 1C E8 79 01 00 00 83 C4 04 E8 11 29 00 00 85 C0 75 0A 6A 10 E8 66 01 00 00 83 C4 04 C7 45 FC
00 00 00 00 E8 B7 5A 00 00 E8 82 1B 00 00 FF 15 70 C2 43 00 A3 D0 2E 45 00 E8 42 59 00 00 A3 DC
17 45 00 85 C0 74 09 A1 D0 2E 45 00 85 C0 75 0A 6A FF E8 C9 F7 FF FF 83 C4 04 E8 71 56 00 00 E8
7C 55 00 00 E8 87 F7 FF FF 8B 35 D0 2E 45 00 89 75 9C 80 3E 22 0F 85 BE 00 00 00 46 89 75 9C 8A
06 3C 22 74 1C 84 C0 74 18 25 FF 00 00 00 50 E8 EC 54 00 00 83 C4 04 85 C0 74 E0 46 89 75 9C EB
DA 80 3E 22 75 04 46 89 75 9C 8A 06 84 C0 74 0A 3C 20 77 06 46 89 75 9C EB F0 C7 45 D0 00 00 00
00 8D 45 A4 50 FF 15 68 C2 43 00 F6 45 D0 01 74 0A 8B 45 D4 25 FF FF 00 00 EB 05 B8 0A 00 00 00
50 56 6A 00 6A 00 FF 15 78 C2 43 00 50 E8 B5 FC 00 00 89 45 A0 50 E8 25 F7 FF FF EB 21 8B 45 EC
8B 08 8B 09 89 4D 98 50 51 E8 22 52 00 00 83 C4 08 C3
**********************************************************************
Microsoft Visual C++ 6.0 [Debug]
.text
.rdata
.data
.rsrc
005522F3 Baby>/$ 55 push ebp
005522F4 |. 8BEC mov ebp,esp
005522F6 |. 6A FF push -1
005522F8 |. 68 58235800 push Babylon.00582358
005522FD |. 68 6C5B5500 push Babylon.00555B6C ; SE handler installation
00552302 |. 64:A1 00000000 mov eax,dword ptr fs:[0]
00552308 |. 50 push eax
00552309 |. 64:8925 00000000 mov dword ptr fs:[0],esp
00552310 |. 83EC 58 sub esp,58
00552313 |. 53 push ebx
00552314 |. 56 push esi
00552315 |. 57 push edi ; ntdll.7C930738
00552316 |. 8965 E8 mov dword ptr ss:[ebp-18],esp
00552319 |. FF15 00635700 call near dword ptr ds:[<&KERNEL32.GetVersion>] ; kernel32.GetVersion
0055231F |. 33D2 xor edx,edx ; ntdll.KiFastSystemCallRet
00552321 |. 8AD4 mov dl,ah
00552323 |. 8915 00BF5D00 mov dword ptr ds:[5DBF00],edx ; ntdll.KiFastSystemCallRet
00552329 |. 8BC8 mov ecx,eax
0055232B |. 81E1 FF000000 and ecx,0FF
00552331 |. 890D FCBE5D00 mov dword ptr ds:[5DBEFC],ecx
00552337 |. C1E1 08 shl ecx,8
0055233A |. 03CA add ecx,edx ; ntdll.KiFastSystemCallRet
0055233C |. 890D F8BE5D00 mov dword ptr ds:[5DBEF8],ecx
00552342 |. C1E8 10 shr eax,10
00552345 |. A3 F4BE5D00 mov dword ptr ds:[5DBEF4],eax
0055234A |. 6A 01 push 1
0055234C |. E8 391D0000 call Babylon.0055408A
00552351 |. 59 pop ecx ; kernel32.7C816FD7
00552352 |. 85C0 test eax,eax
00552354 |. 75 08 jnz short Babylon.0055235E
00552356 |. 6A 1C push 1C
00552358 |. E8 C3000000 call Babylon.00552420
0055235D |. 59 pop ecx ; kernel32.7C816FD7
0055235E |> E8 99350000 call Babylon.005558FC
00552363 |. 85C0 test eax,eax
00552365 |. 75 08 jnz short Babylon.0055236F
00552367 |. 6A 10 push 10
00552369 |. E8 B2000000 call Babylon.00552420
0055236E |. 59 pop ecx ; kernel32.7C816FD7
0055236F |> 33F6 xor esi,esi
00552371 |. 8975 FC mov dword ptr ss:[ebp-4],esi
00552374 |. E8 1B840000 call Babylon.0055A794
00552379 |. FF15 0C625700 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA
0055237F |. A3 08D85D00 mov dword ptr ds:[5DD808],eax
00552384 |. E8 1B8C0000 call Babylon.0055AFA4
00552389 |. A3 7CBE5D00 mov dword ptr ds:[5DBE7C],eax
0055238E |. E8 C4890000 call Babylon.0055AD57
00552393 |. E8 06890000 call Babylon.0055AC9E
00552398 |. E8 A7380000 call Babylon.00555C44
0055239D |. 8975 D0 mov dword ptr ss:[ebp-30],esi
005523A0 |. 8D45 A4 lea eax,dword ptr ss:[ebp-5C]
005523A3 |. 50 push eax ; /pStartupinfo = NULL
005523A4 |. FF15 18625700 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA
005523AA |. E8 97880000 call Babylon.0055AC46
005523AF |. 8945 9C mov dword ptr ss:[ebp-64],eax
005523B2 |. F645 D0 01 test byte ptr ss:[ebp-30],1
005523B6 |. 74 06 je short Babylon.005523BE
005523B8 |. 0FB745 D4 movzx eax,word ptr ss:[ebp-2C]
005523BC |. EB 03 jmp short Babylon.005523C1
005523BE |> 6A 0A push 0A
005523C0 |. 58 pop eax ; kernel32.7C816FD7
005523C1 |> 50 push eax ; /Arg4 = 00000000
005523C2 |. FF75 9C push dword ptr ss:[ebp-64] ; |Arg3 = 00000001
005523C5 |. 56 push esi ; |Arg2 = FFFFFFFF
005523C6 |. 56 push esi ; |/pModule = FFFFFFFF ???
005523C7 |. FF15 68645700 call near dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; |\GetModuleHandleA
005523CD |. 50 push eax ; |Arg1 = 00000000
005523CE |. E8 2DC0EBFF call Babylon.0040E400 ; \Babylon.0040E400
005523D3 |. 8945 A0 mov dword ptr ss:[ebp-60],eax
005523D6 |. 50 push eax
005523D7 |. E8 95380000 call Babylon.00555C71
005523DC |. 8B45 EC mov eax,dword ptr ss:[ebp-14]
005523DF |. 8B08 mov ecx,dword ptr ds:[eax]
005523E1 |. 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E
005523E3 |. 894D 98 mov dword ptr ss:[ebp-68],ecx
005523E6 |. 50 push eax
005523E7 |. 51 push ecx
005523E8 |. E8 68550000 call Babylon.00557955
005523ED |. 59 pop ecx ; kernel32.7C816FD7
005523EE |. 59 pop ecx ; kernel32.7C816FD7
005523EF \. C3 retn
55 8B EC 6A FF 68 58 23 58 00 68 6C 5B 55 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
53 56 57 89 65 E8 FF 15 00 63 57 00 33 D2 8A D4 89 15 00 BF 5D 00 8B C8 81 E1 FF 00 00 00 89 0D
FC BE 5D 00 C1 E1 08 03 CA 89 0D F8 BE 5D 00 C1 E8 10 A3 F4 BE 5D 00 6A 01 E8 39 1D 00 00 59 85
C0 75 08 6A 1C E8 C3 00 00 00 59 E8 99 35 00 00 85 C0 75 08 6A 10 E8 B2 00 00 00 59 33 F6 89 75
FC E8 1B 84 00 00 FF 15 0C 62 57 00 A3 08 D8 5D 00 E8 1B 8C 00 00 A3 7C BE 5D 00 E8 C4 89 00 00
E8 06 89 00 00 E8 A7 38 00 00 89 75 D0 8D 45 A4 50 FF 15 18 62 57 00 E8 97 88 00 00 89 45 9C F6
45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 68 64 57 00 50 E8 2D C0 EB FF
89 45 A0 50 E8 95 38 00 00 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 68 55 00 00 59 59 C3
**********************************************************************
Microsoft Visual C++ 6.0
.text
.rdata
.data
.tls
.rsrc
004AD06E ACDS>/$ 55 push ebp
004AD06F |. 8BEC mov ebp,esp
004AD071 |. 6A FF push -1
004AD073 |. 68 28014E00 push ACDSee.004E0128
004AD078 |. 68 9C0C4B00 push ACDSee.004B0C9C ; SE handler installation
004AD07D |. 64:A1 00000000 mov eax,dword ptr fs:[0]
004AD083 |. 50 push eax
004AD084 |. 64:8925 00000000 mov dword ptr fs:[0],esp
004AD08B |. 83EC 58 sub esp,58
004AD08E |. 53 push ebx
004AD08F |. 56 push esi
004AD090 |. 57 push edi ; ntdll.7C930738
004AD091 |. 8965 E8 mov dword ptr ss:[ebp-18],esp
004AD094 |. FF15 A8744D00 call near dword ptr ds:[<&KERNEL32.GetVersion>] ; kernel32.GetVersion
004AD09A |. 33D2 xor edx,edx ; ntdll.KiFastSystemCallRet
004AD09C |. 8AD4 mov dl,ah
004AD09E |. 8915 F4584F00 mov dword ptr ds:[4F58F4],edx ; ntdll.KiFastSystemCallRet
004AD0A4 |. 8BC8 mov ecx,eax
004AD0A6 |. 81E1 FF000000 and ecx,0FF
004AD0AC |. 890D F0584F00 mov dword ptr ds:[4F58F0],ecx
004AD0B2 |. C1E1 08 shl ecx,8
004AD0B5 |. 03CA add ecx,edx ; ntdll.KiFastSystemCallRet
004AD0B7 |. 890D EC584F00 mov dword ptr ds:[4F58EC],ecx
004AD0BD |. C1E8 10 shr eax,10
004AD0C0 |. A3 E8584F00 mov dword ptr ds:[4F58E8],eax
004AD0C5 |. 6A 01 push 1
004AD0C7 |. E8 C12D0000 call ACDSee.004AFE8D
004AD0CC |. 59 pop ecx ; kernel32.7C816FD7
004AD0CD |. 85C0 test eax,eax
004AD0CF |. 75 08 jnz short ACDSee.004AD0D9
004AD0D1 |. 6A 1C push 1C
004AD0D3 |. E8 C3000000 call ACDSee.004AD19B
004AD0D8 |. 59 pop ecx ; kernel32.7C816FD7
004AD0D9 |> E8 4E230000 call ACDSee.004AF42C
004AD0DE |. 85C0 test eax,eax
004AD0E0 |. 75 08 jnz short ACDSee.004AD0EA
004AD0E2 |. 6A 10 push 10
004AD0E4 |. E8 B2000000 call ACDSee.004AD19B
004AD0E9 |. 59 pop ecx ; kernel32.7C816FD7
004AD0EA |> 33F6 xor esi,esi
004AD0EC |. 8975 FC mov dword ptr ss:[ebp-4],esi
004AD0EF |. E8 42510000 call ACDSee.004B2236
004AD0F4 |. FF15 7C724D00 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA
004AD0FA |. A3 58704F00 mov dword ptr ds:[4F7058],eax
004AD0FF |. E8 00500000 call ACDSee.004B2104
004AD104 |. A3 D8584F00 mov dword ptr ds:[4F58D8],eax
004AD109 |. E8 A94D0000 call ACDSee.004B1EB7
004AD10E |. E8 EB4C0000 call ACDSee.004B1DFE
004AD113 |. E8 EF080000 call ACDSee.004ADA07
004AD118 |. 8975 D0 mov dword ptr ss:[ebp-30],esi
004AD11B |. 8D45 A4 lea eax,dword ptr ss:[ebp-5C]
004AD11E |. 50 push eax ; /pStartupinfo = NULL
004AD11F |. FF15 74724D00 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA
004AD125 |. E8 7C4C0000 call ACDSee.004B1DA6
004AD12A |. 8945 9C mov dword ptr ss:[ebp-64],eax
004AD12D |. F645 D0 01 test byte ptr ss:[ebp-30],1
004AD131 |. 74 06 je short ACDSee.004AD139
004AD133 |. 0FB745 D4 movzx eax,word ptr ss:[ebp-2C]
004AD137 |. EB 03 jmp short ACDSee.004AD13C
004AD139 |> 6A 0A push 0A
004AD13B |. 58 pop eax ; kernel32.7C816FD7
004AD13C |> 50 push eax
004AD13D |. FF75 9C push dword ptr ss:[ebp-64]
004AD140 |. 56 push esi
004AD141 |. 56 push esi ; /pModule = FFFFFFFF ???
004AD142 |. FF15 90744D00 call near dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; \GetModuleHandleA
004AD148 |. 50 push eax
004AD149 |. E8 F9E50000 call ACDSee.004BB747
004AD14E |. 8945 A0 mov dword ptr ss:[ebp-60],eax
004AD151 |. 50 push eax
004AD152 |. E8 DD080000 call ACDSee.004ADA34
004AD157 |. 8B45 EC mov eax,dword ptr ss:[ebp-14]
004AD15A |. 8B08 mov ecx,dword ptr ds:[eax]
004AD15C |. 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E
004AD15E |. 894D 98 mov dword ptr ss:[ebp-68],ecx
004AD161 |. 50 push eax
004AD162 |. 51 push ecx
004AD163 |. E8 B3390000 call ACDSee.004B0B1B
004AD168 |. 59 pop ecx ; kernel32.7C816FD7
004AD169 |. 59 pop ecx ; kernel32.7C816FD7
004AD16A \. C3 retn
55 8B EC 6A FF 68 28 01 4E 00 68 9C 0C 4B 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
53 56 57 89 65 E8 FF 15 A8 74 4D 00 33 D2 8A D4 89 15 F4 58 4F 00 8B C8 81 E1 FF 00 00 00 89 0D
F0 58 4F 00 C1 E1 08 03 CA 89 0D EC 58 4F 00 C1 E8 10 A3 E8 58 4F 00 6A 01 E8 C1 2D 00 00 59 85
C0 75 08 6A 1C E8 C3 00 00 00 59 E8 4E 23 00 00 85 C0 75 08 6A 10 E8 B2 00 00 00 59 33 F6 89 75
FC E8 42 51 00 00 FF 15 7C 72 4D 00 A3 58 70 4F 00 E8 00 50 00 00 A3 D8 58 4F 00 E8 A9 4D 00 00
E8 EB 4C 00 00 E8 EF 08 00 00 89 75 D0 8D 45 A4 50 FF 15 74 72 4D 00 E8 7C 4C 00 00 89 45 9C F6
45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 90 74 4D 00 50 E8 F9 E5 00 00
89 45 A0 50 E8 DD 08 00 00 8B 45 EC 8B 08 8B 09 89 4D 98 50 51 E8 B3 39 00 00 59 59 C3
**********************************************************************
Microsoft Visual C++ 7.0 [Debug]
.text
.rdata
.data
.rsrc
004079A3 eMul> $ 6A 60 push 60
004079A5 . 68 B0244200 push eMuleUpd.004224B0
004079AA . E8 F5E1FFFF call eMuleUpd.00405BA4
004079AF . BF 94000000 mov edi,94
004079B4 . 8BC7 mov eax,edi ; ntdll.7C930738
004079B6 . E8 65FCFFFF call eMuleUpd.00407620
004079BB . 8965 E8 mov dword ptr ss:[ebp-18],esp
004079BE . 8BF4 mov esi,esp
004079C0 . 893E mov dword ptr ds:[esi],edi ; ntdll.7C930738
004079C2 . 56 push esi ; /pVersionInformation = FFFFFFFF
004079C3 . FF15 70024200 call near dword ptr ds:[<&KERNEL32.GetVersionExA>] ; \GetVersionExA
004079C9 . 8B4E 10 mov ecx,dword ptr ds:[esi+10]
004079CC . 890D 28BB4200 mov dword ptr ds:[42BB28],ecx
004079D2 . 8B46 04 mov eax,dword ptr ds:[esi+4]
004079D5 . A3 34BB4200 mov dword ptr ds:[42BB34],eax
004079DA . 8B56 08 mov edx,dword ptr ds:[esi+8]
004079DD . 8915 38BB4200 mov dword ptr ds:[42BB38],edx ; ntdll.KiFastSystemCallRet
004079E3 . 8B76 0C mov esi,dword ptr ds:[esi+C]
004079E6 . 81E6 FF7F0000 and esi,7FFF
004079EC . 8935 2CBB4200 mov dword ptr ds:[42BB2C],esi
004079F2 . 83F9 02 cmp ecx,2
004079F5 . 74 0C je short eMuleUpd.00407A03
004079F7 . 81CE 00800000 or esi,8000
004079FD . 8935 2CBB4200 mov dword ptr ds:[42BB2C],esi
00407A03 > C1E0 08 shl eax,8
00407A06 . 03C2 add eax,edx ; ntdll.KiFastSystemCallRet
00407A08 . A3 30BB4200 mov dword ptr ds:[42BB30],eax
00407A0D . 33F6 xor esi,esi
00407A0F . 56 push esi ; /pModule = FFFFFFFF ???
00407A10 . 8B3D 88014200 mov edi,dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; |kernel32.GetModuleHandleA
00407A16 . FFD7 call near edi ; \GetModuleHandleA
00407A18 . 66:8138 4D5A cmp word ptr ds:[eax],5A4D
00407A1D . 75 1F jnz short eMuleUpd.00407A3E
00407A1F . 8B48 3C mov ecx,dword ptr ds:[eax+3C]
00407A22 . 03C8 add ecx,eax
00407A24 . 8139 50450000 cmp dword ptr ds:[ecx],4550
00407A2A . 75 12 jnz short eMuleUpd.00407A3E
00407A2C . 0FB741 18 movzx eax,word ptr ds:[ecx+18]
00407A30 . 3D 0B010000 cmp eax,10B
00407A35 . 74 1F je short eMuleUpd.00407A56
00407A37 . 3D 0B020000 cmp eax,20B
00407A3C . 74 05 je short eMuleUpd.00407A43
00407A3E > 8975 E4 mov dword ptr ss:[ebp-1C],esi
00407A41 . EB 27 jmp short eMuleUpd.00407A6A
00407A43 > 83B9 84000000 0E cmp dword ptr ds:[ecx+84],0E
00407A4A .^ 76 F2 jbe short eMuleUpd.00407A3E
00407A4C . 33C0 xor eax,eax
00407A4E . 39B1 F8000000 cmp dword ptr ds:[ecx+F8],esi
00407A54 . EB 0E jmp short eMuleUpd.00407A64
00407A56 > 8379 74 0E cmp dword ptr ds:[ecx+74],0E
00407A5A .^ 76 E2 jbe short eMuleUpd.00407A3E
00407A5C . 33C0 xor eax,eax
00407A5E . 39B1 E8000000 cmp dword ptr ds:[ecx+E8],esi
00407A64 > 0F95C0 setne al
00407A67 . 8945 E4 mov dword ptr ss:[ebp-1C],eax
00407A6A > 6A 01 push 1
00407A6C . E8 A3550000 call eMuleUpd.0040D014
00407A71 . 59 pop ecx ; kernel32.7C816FD7
00407A72 . 85C0 test eax,eax
00407A74 . 75 08 jnz short eMuleUpd.00407A7E
00407A76 . 6A 1C push 1C
00407A78 . E8 02FFFFFF call eMuleUpd.0040797F
00407A7D . 59 pop ecx ; kernel32.7C816FD7
00407A7E > E8 572A0000 call eMuleUpd.0040A4DA
00407A83 . 85C0 test eax,eax
00407A85 . 75 08 jnz short eMuleUpd.00407A8F
00407A87 . 6A 10 push 10
00407A89 . E8 F1FEFFFF call eMuleUpd.0040797F
00407A8E . 59 pop ecx ; kernel32.7C816FD7
00407A8F > E8 756A0000 call eMuleUpd.0040E509
00407A94 . 8975 FC mov dword ptr ss:[ebp-4],esi
00407A97 . E8 6F680000 call eMuleUpd.0040E30B
00407A9C . 85C0 test eax,eax
00407A9E . 7D 08 jge short eMuleUpd.00407AA8
00407AA0 . 6A 1B push 1B
00407AA2 . E8 B3FEFFFF call eMuleUpd.0040795A
00407AA7 . 59 pop ecx ; kernel32.7C816FD7
00407AA8 > FF15 0C024200 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA
00407AAE . A3 10D44200 mov dword ptr ds:[42D410],eax
00407AB3 . E8 31670000 call eMuleUpd.0040E1E9
00407AB8 . A3 14BB4200 mov dword ptr ds:[42BB14],eax
00407ABD . E8 85660000 call eMuleUpd.0040E147
00407AC2 . 85C0 test eax,eax
00407AC4 . 7D 08 jge short eMuleUpd.00407ACE
00407AC6 . 6A 08 push 8
00407AC8 . E8 8DFEFFFF call eMuleUpd.0040795A
00407ACD . 59 pop ecx ; kernel32.7C816FD7
00407ACE > E8 41640000 call eMuleUpd.0040DF14
00407AD3 . 85C0 test eax,eax
00407AD5 . 7D 08 jge short eMuleUpd.00407ADF
00407AD7 . 6A 09 push 9
00407AD9 . E8 7CFEFFFF call eMuleUpd.0040795A
00407ADE . 59 pop ecx ; kernel32.7C816FD7
00407ADF > 6A 01 push 1
00407AE1 . E8 72030000 call eMuleUpd.00407E58
00407AE6 . 59 pop ecx ; kernel32.7C816FD7
00407AE7 . 8945 D8 mov dword ptr ss:[ebp-28],eax
00407AEA . 3BC6 cmp eax,esi
00407AEC . 74 07 je short eMuleUpd.00407AF5
00407AEE . 50 push eax
00407AEF . E8 66FEFFFF call eMuleUpd.0040795A
00407AF4 . 59 pop ecx ; kernel32.7C816FD7
00407AF5 > 8975 BC mov dword ptr ss:[ebp-44],esi
00407AF8 . 8D45 90 lea eax,dword ptr ss:[ebp-70]
00407AFB . 50 push eax ; /pStartupinfo = NULL
00407AFC . FF15 B4004200 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA
00407B02 . E8 B0630000 call eMuleUpd.0040DEB7
00407B07 . 8945 E0 mov dword ptr ss:[ebp-20],eax
00407B0A . F645 BC 01 test byte ptr ss:[ebp-44],1
00407B0E . 74 06 je short eMuleUpd.00407B16
00407B10 . 0FB745 C0 movzx eax,word ptr ss:[ebp-40]
00407B14 . EB 03 jmp short eMuleUpd.00407B19
00407B16 > 6A 0A push 0A
00407B18 . 58 pop eax ; kernel32.7C816FD7
00407B19 > 50 push eax
00407B1A . FF75 E0 push dword ptr ss:[ebp-20]
00407B1D . 56 push esi
00407B1E . 56 push esi
00407B1F . FFD7 call near edi ; ntdll.7C930738
00407B21 . 50 push eax
00407B22 . E8 33B50000 call eMuleUpd.0041305A
00407B27 . 8BF8 mov edi,eax
00407B29 . 897D D4 mov dword ptr ss:[ebp-2C],edi ; ntdll.7C930738
00407B2C . 3975 E4 cmp dword ptr ss:[ebp-1C],esi
00407B2F . 75 06 jnz short eMuleUpd.00407B37
00407B31 . 57 push edi ; ntdll.7C930738
00407B32 . E8 4E040000 call eMuleUpd.00407F85
00407B37 > E8 6B040000 call eMuleUpd.00407FA7
00407B3C . EB 2B jmp short eMuleUpd.00407B69
00407B3E . 8B45 EC mov eax,dword ptr ss:[ebp-14]
00407B41 . 8B08 mov ecx,dword ptr ds:[eax]
00407B43 . 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E
00407B45 . 894D DC mov dword ptr ss:[ebp-24],ecx
00407B48 . 50 push eax
00407B49 . 51 push ecx
00407B4A . E8 04620000 call eMuleUpd.0040DD53
00407B4F . 59 pop ecx ; kernel32.7C816FD7
00407B50 . 59 pop ecx ; kernel32.7C816FD7
00407B51 . C3 retn
6A 60 68 B0 24 42 00 E8 F5 E1 FF FF BF 94 00 00 00 8B C7 E8 65 FC FF FF 89 65 E8 8B F4 89 3E 56
FF 15 70 02 42 00 8B 4E 10 89 0D 28 BB 42 00 8B 46 04 A3 34 BB 42 00 8B 56 08 89 15 38 BB 42 00
8B 76 0C 81 E6 FF 7F 00 00 89 35 2C BB 42 00 83 F9 02 74 0C 81 CE 00 80 00 00 89 35 2C BB 42 00
C1 E0 08 03 C2 A3 30 BB 42 00 33 F6 56 8B 3D 88 01 42 00 FF D7 66 81 38 4D 5A 75 1F 8B 48 3C 03
C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 89 75 E4 EB 27
83 B9 84 00 00 00 0E 76 F2 33 C0 39 B1 F8 00 00 00 EB 0E 83 79 74 0E 76 E2 33 C0 39 B1 E8 00 00
00 0F 95 C0 89 45 E4 6A 01 E8 A3 55 00 00 59 85 C0 75 08 6A 1C E8 02 FF FF FF 59 E8 57 2A 00 00
85 C0 75 08 6A 10 E8 F1 FE FF FF 59 E8 75 6A 00 00 89 75 FC E8 6F 68 00 00 85 C0 7D 08 6A 1B E8
B3 FE FF FF 59 FF 15 0C 02 42 00 A3 10 D4 42 00 E8 31 67 00 00 A3 14 BB 42 00 E8 85 66 00 00 85
C0 7D 08 6A 08 E8 8D FE FF FF 59 E8 41 64 00 00 85 C0 7D 08 6A 09 E8 7C FE FF FF 59 6A 01 E8 72
03 00 00 59 89 45 D8 3B C6 74 07 50 E8 66 FE FF FF 59 89 75 BC 8D 45 90 50 FF 15 B4 00 42 00 E8
B0 63 00 00 89 45 E0 F6 45 BC 01 74 06 0F B7 45 C0 EB 03 6A 0A 58 50 FF 75 E0 56 56 FF D7 50 E8
33 B5 00 00 8B F8 89 7D D4 39 75 E4 75 06 57 E8 4E 04 00 00 E8 6B 04 00 00 EB 2B 8B 45 EC 8B 08
8B 09 89 4D DC 50 51 E8 04 62 00 00 59 59 C3
**********************************************************************
Microsoft Visual C++ 7.0 Method2 [Debug]
.text
.data
.rsrc
0100739D note> 6A 70 push 70
0100739F 68 98180001 push notepad.01001898
010073A4 E8 BF010000 call notepad.01007568
010073A9 33DB xor ebx,ebx
010073AB 53 push ebx
010073AC 8B3D CC100001 mov edi,dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; kernel32.GetModuleHandleA
010073B2 FFD7 call near edi ; ntdll.7C930738
010073B4 66:8138 4D5A cmp word ptr ds:[eax],5A4D
010073B9 75 1F jnz short notepad.010073DA
010073BB 8B48 3C mov ecx,dword ptr ds:[eax+3C]
010073BE 03C8 add ecx,eax
010073C0 8139 50450000 cmp dword ptr ds:[ecx],4550
010073C6 75 12 jnz short notepad.010073DA
010073C8 0FB741 18 movzx eax,word ptr ds:[ecx+18]
010073CC 3D 0B010000 cmp eax,10B
010073D1 74 1F je short notepad.010073F2
010073D3 3D 0B020000 cmp eax,20B
010073D8 74 05 je short notepad.010073DF
010073DA 895D E4 mov dword ptr ss:[ebp-1C],ebx
010073DD EB 27 jmp short notepad.01007406
010073DF 83B9 84000000 0E cmp dword ptr ds:[ecx+84],0E
010073E6 ^ 76 F2 jbe short notepad.010073DA
010073E8 33C0 xor eax,eax
010073EA 3999 F8000000 cmp dword ptr ds:[ecx+F8],ebx
010073F0 EB 0E jmp short notepad.01007400
010073F2 8379 74 0E cmp dword ptr ds:[ecx+74],0E
010073F6 ^ 76 E2 jbe short notepad.010073DA
010073F8 33C0 xor eax,eax
010073FA 3999 E8000000 cmp dword ptr ds:[ecx+E8],ebx
01007400 0F95C0 setne al
01007403 8945 E4 mov dword ptr ss:[ebp-1C],eax
01007406 895D FC mov dword ptr ss:[ebp-4],ebx
01007409 6A 02 push 2
0100740B FF15 38130001 call near dword ptr ds:[<&msvcrt.__set_app_type>] ; msvcrt.__set_app_type
01007411 59 pop ecx ; kernel32.7C816FD7
01007412 830D 9CAB0001 FF or dword ptr ds:[100AB9C],FFFFFFFF
01007419 830D A0AB0001 FF or dword ptr ds:[100ABA0],FFFFFFFF
01007420 FF15 34130001 call near dword ptr ds:[<&msvcrt.__p__fmode>] ; msvcrt.__p__fmode
01007426 8B0D B89A0001 mov ecx,dword ptr ds:[1009AB8]
0100742C 8908 mov dword ptr ds:[eax],ecx
0100742E FF15 30130001 call near dword ptr ds:[<&msvcrt.__p__commode>] ; msvcrt.__p__commode
01007434 8B0D B49A0001 mov ecx,dword ptr ds:[1009AB4]
0100743A 8908 mov dword ptr ds:[eax],ecx
0100743C A1 2C130001 mov eax,dword ptr ds:[<&msvcrt._adjust_fdiv>]
01007441 8B00 mov eax,dword ptr ds:[eax]
01007443 A3 A4AB0001 mov dword ptr ds:[100ABA4],eax
01007448 E8 A7010000 call notepad.010075F4
0100744D 391D 08960001 cmp dword ptr ds:[1009608],ebx
01007453 75 0C jnz short notepad.01007461
01007455 68 F4750001 push notepad.010075F4 ; Entry address
0100745A FF15 28130001 call near dword ptr ds:[<&msvcrt.__setusermatherr>] ; msvcrt.__setusermatherr
01007460 59 pop ecx ; kernel32.7C816FD7
01007461 E8 77010000 call notepad.010075DD
01007466 68 10900001 push notepad.01009010
0100746B 68 0C900001 push notepad.0100900C
01007470 E8 5D010000 call <jmp.&msvcrt._initterm>
01007475 A1 B09A0001 mov eax,dword ptr ds:[1009AB0]
0100747A 8945 DC mov dword ptr ss:[ebp-24],eax
0100747D 8D45 DC lea eax,dword ptr ss:[ebp-24]
01007480 50 push eax
01007481 FF35 AC9A0001 push dword ptr ds:[1009AAC]
01007487 8D45 D4 lea eax,dword ptr ss:[ebp-2C]
0100748A 50 push eax
0100748B 8D45 D0 lea eax,dword ptr ss:[ebp-30]
0100748E 50 push eax
0100748F 8D45 CC lea eax,dword ptr ss:[ebp-34]
01007492 50 push eax
01007493 FF15 20130001 call near dword ptr ds:[<&msvcrt.__getmainargs>] ; msvcrt.__getmainargs
01007499 8945 C8 mov dword ptr ss:[ebp-38],eax
0100749C 68 08900001 push notepad.01009008
010074A1 68 00900001 push notepad.01009000
010074A6 E8 27010000 call <jmp.&msvcrt._initterm>
010074AB 83C4 24 add esp,24
010074AE A1 1C130001 mov eax,dword ptr ds:[<&msvcrt._acmdln>]
010074B3 8B30 mov esi,dword ptr ds:[eax]
010074B5 8975 E0 mov dword ptr ss:[ebp-20],esi
010074B8 803E 22 cmp byte ptr ds:[esi],22
010074BB 75 3A jnz short notepad.010074F7
010074BD 46 inc esi
010074BE 8975 E0 mov dword ptr ss:[ebp-20],esi
010074C1 8A06 mov al,byte ptr ds:[esi]
010074C3 3AC3 cmp al,bl
010074C5 74 04 je short notepad.010074CB
010074C7 3C 22 cmp al,22
010074C9 ^ 75 F2 jnz short notepad.010074BD
010074CB 803E 22 cmp byte ptr ds:[esi],22
010074CE 75 04 jnz short notepad.010074D4
010074D0 46 inc esi
010074D1 8975 E0 mov dword ptr ss:[ebp-20],esi
010074D4 8A06 mov al,byte ptr ds:[esi]
010074D6 3AC3 cmp al,bl
010074D8 74 04 je short notepad.010074DE
010074DA 3C 20 cmp al,20
010074DC ^ 76 F2 jbe short notepad.010074D0
010074DE 895D AC mov dword ptr ss:[ebp-54],ebx
010074E1 8D45 80 lea eax,dword ptr ss:[ebp-80]
010074E4 50 push eax
010074E5 FF15 D0100001 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; kernel32.GetStartupInfoA
010074EB F645 AC 01 test byte ptr ss:[ebp-54],1
010074EF 74 11 je short notepad.01007502
010074F1 0FB745 B0 movzx eax,word ptr ss:[ebp-50]
010074F5 EB 0E jmp short notepad.01007505
010074F7 803E 20 cmp byte ptr ds:[esi],20
010074FA ^ 76 D8 jbe short notepad.010074D4
010074FC 46 inc esi
010074FD 8975 E0 mov dword ptr ss:[ebp-20],esi
01007500 ^ EB F5 jmp short notepad.010074F7
01007502 6A 0A push 0A
01007504 58 pop eax ; kernel32.7C816FD7
01007505 50 push eax
01007506 56 push esi
01007507 53 push ebx
01007508 53 push ebx
01007509 FFD7 call near edi ; ntdll.7C930738
0100750B 50 push eax
0100750C E8 25B4FFFF call notepad.01002936
01007511 8BF0 mov esi,eax
01007513 8975 C4 mov dword ptr ss:[ebp-3C],esi
01007516 395D E4 cmp dword ptr ss:[ebp-1C],ebx
01007519 75 07 jnz short notepad.01007522
0100751B 56 push esi
0100751C FF15 18130001 call near dword ptr ds:[<&msvcrt.exit>] ; msvcrt.exit
01007522 FF15 00130001 call near dword ptr ds:[<&msvcrt._cexit>] ; msvcrt._cexit
01007528 EB 2D jmp short notepad.01007557
0100752A 8B45 EC mov eax,dword ptr ss:[ebp-14]
0100752D 8B08 mov ecx,dword ptr ds:[eax]
0100752F 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E
01007531 894D D8 mov dword ptr ss:[ebp-28],ecx
01007534 50 push eax
01007535 51 push ecx
01007536 E8 8B000000 call <jmp.&msvcrt._XcptFilter>
0100753B 59 pop ecx ; kernel32.7C816FD7
0100753C 59 pop ecx ; kernel32.7C816FD7
0100753D C3 retn
6A 70 68 98 18 00 01 E8 BF 01 00 00 33 DB 53 8B 3D CC 10 00 01 FF D7 66 81 38 4D 5A 75 1F 8B 48
3C 03 C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 89 5D E4
EB 27 83 B9 84 00 00 00 0E 76 F2 33 C0 39 99 F8 00 00 00 EB 0E 83 79 74 0E 76 E2 33 C0 39 99 E8
00 00 00 0F 95 C0 89 45 E4 89 5D FC 6A 02 FF 15 38 13 00 01 59 83 0D 9C AB 00 01 FF 83 0D A0 AB
00 01 FF FF 15 34 13 00 01 8B 0D B8 9A 00 01 89 08 FF 15 30 13 00 01 8B 0D B4 9A 00 01 89 08 A1
2C 13 00 01 8B 00 A3 A4 AB 00 01 E8 A7 01 00 00 39 1D 08 96 00 01 75 0C 68 F4 75 00 01 FF 15 28
13 00 01 59 E8 77 01 00 00 68 10 90 00 01 68 0C 90 00 01 E8 5D 01 00 00 A1 B0 9A 00 01 89 45 DC
8D 45 DC 50 FF 35 AC 9A 00 01 8D 45 D4 50 8D 45 D0 50 8D 45 CC 50 FF 15 20 13 00 01 89 45 C8 68
08 90 00 01 68 00 90 00 01 E8 27 01 00 00 83 C4 24 A1 1C 13 00 01 8B 30 89 75 E0 80 3E 22 75 3A
46 89 75 E0 8A 06 3A C3 74 04 3C 22 75 F2 80 3E 22 75 04 46 89 75 E0 8A 06 3A C3 74 04 3C 20 76
F2 89 5D AC 8D 45 80 50 FF 15 D0 10 00 01 F6 45 AC 01 74 11 0F B7 45 B0 EB 0E 80 3E 20 76 D8 46
89 75 E0 EB F5 6A 0A 58 50 56 53 53 FF D7 50 E8 25 B4 FF FF 8B F0 89 75 C4 39 5D E4 75 07 56 FF
15 18 13 00 01 FF 15 00 13 00 01 EB 2D 8B 45 EC 8B 08 8B 09 89 4D D8 50 51 E8 8B 00 00 00 59 59
C3
**********************************************************************
Microsoft Visual C++ 7.0
.text
.rdata
.data
.rsrc
004A5D0A BitB> $ 6A 60 push 60
004A5D0C . 68 D07A4C00 push BitBuddy.004C7AD0
004A5D11 . E8 7A060000 call BitBuddy.004A6390
004A5D16 . BF 94000000 mov edi,94
004A5D1B . 8BC7 mov eax,edi ; ntdll.7C930738
004A5D1D . E8 CEE6FFFF call BitBuddy.004A43F0
004A5D22 . 8965 E8 mov dword ptr ss:[ebp-18],esp
004A5D25 . 8BF4 mov esi,esp
004A5D27 . 893E mov dword ptr ds:[esi],edi ; ntdll.7C930738
004A5D29 . 56 push esi ; /pVersionInformation = FFFFFFFF
004A5D2A . FF15 8CF24B00 call near dword ptr ds:[<&KERNEL32.GetVersionExA>] ; \GetVersionExA
004A5D30 . 8B4E 10 mov ecx,dword ptr ds:[esi+10]
004A5D33 . 890D 78614E00 mov dword ptr ds:[4E6178],ecx
004A5D39 . 8B46 04 mov eax,dword ptr ds:[esi+4]
004A5D3C . A3 84614E00 mov dword ptr ds:[4E6184],eax
004A5D41 . 8B56 08 mov edx,dword ptr ds:[esi+8]
004A5D44 . 8915 88614E00 mov dword ptr ds:[4E6188],edx ; ntdll.KiFastSystemCallRet
004A5D4A . 8B76 0C mov esi,dword ptr ds:[esi+C]
004A5D4D . 81E6 FF7F0000 and esi,7FFF
004A5D53 . 8935 7C614E00 mov dword ptr ds:[4E617C],esi
004A5D59 . 83F9 02 cmp ecx,2
004A5D5C . 74 0C je short BitBuddy.004A5D6A
004A5D5E . 81CE 00800000 or esi,8000
004A5D64 . 8935 7C614E00 mov dword ptr ds:[4E617C],esi
004A5D6A > C1E0 08 shl eax,8
004A5D6D . 03C2 add eax,edx ; ntdll.KiFastSystemCallRet
004A5D6F . A3 80614E00 mov dword ptr ds:[4E6180],eax
004A5D74 . 33F6 xor esi,esi
004A5D76 . 56 push esi ; /pModule = FFFFFFFF ???
004A5D77 . 8B3D 08F24B00 mov edi,dword ptr ds:[<&KERNEL32.GetModuleHandleA>] ; |kernel32.GetModuleHandleA
004A5D7D . FFD7 call near edi ; \GetModuleHandleA
004A5D7F . 66:8138 4D5A cmp word ptr ds:[eax],5A4D
004A5D84 . 75 1F jnz short BitBuddy.004A5DA5
004A5D86 . 8B48 3C mov ecx,dword ptr ds:[eax+3C]
004A5D89 . 03C8 add ecx,eax
004A5D8B . 8139 50450000 cmp dword ptr ds:[ecx],4550
004A5D91 . 75 12 jnz short BitBuddy.004A5DA5
004A5D93 . 0FB741 18 movzx eax,word ptr ds:[ecx+18]
004A5D97 . 3D 0B010000 cmp eax,10B
004A5D9C . 74 1F je short BitBuddy.004A5DBD
004A5D9E . 3D 0B020000 cmp eax,20B
004A5DA3 . 74 05 je short BitBuddy.004A5DAA
004A5DA5 > 8975 E4 mov dword ptr ss:[ebp-1C],esi
004A5DA8 . EB 27 jmp short BitBuddy.004A5DD1
004A5DAA > 83B9 84000000 0E cmp dword ptr ds:[ecx+84],0E
004A5DB1 .^ 76 F2 jbe short BitBuddy.004A5DA5
004A5DB3 . 33C0 xor eax,eax
004A5DB5 . 39B1 F8000000 cmp dword ptr ds:[ecx+F8],esi
004A5DBB . EB 0E jmp short BitBuddy.004A5DCB
004A5DBD > 8379 74 0E cmp dword ptr ds:[ecx+74],0E
004A5DC1 .^ 76 E2 jbe short BitBuddy.004A5DA5
004A5DC3 . 33C0 xor eax,eax
004A5DC5 . 39B1 E8000000 cmp dword ptr ds:[ecx+E8],esi
004A5DCB > 0F95C0 setne al
004A5DCE . 8945 E4 mov dword ptr ss:[ebp-1C],eax
004A5DD1 > 6A 01 push 1
004A5DD3 . E8 6C340000 call BitBuddy.004A9244
004A5DD8 . 59 pop ecx ; kernel32.7C816FD7
004A5DD9 . 85C0 test eax,eax
004A5DDB . 75 08 jnz short BitBuddy.004A5DE5
004A5DDD . 6A 1C push 1C
004A5DDF . E8 02FFFFFF call BitBuddy.004A5CE6
004A5DE4 . 59 pop ecx ; kernel32.7C816FD7
004A5DE5 > E8 EE300000 call BitBuddy.004A8ED8
004A5DEA . 85C0 test eax,eax
004A5DEC . 75 08 jnz short BitBuddy.004A5DF6
004A5DEE . 6A 10 push 10
004A5DF0 . E8 F1FEFFFF call BitBuddy.004A5CE6
004A5DF5 . 59 pop ecx ; kernel32.7C816FD7
004A5DF6 > E8 EA6F0000 call BitBuddy.004ACDE5
004A5DFB . 8975 FC mov dword ptr ss:[ebp-4],esi
004A5DFE . E8 BC630000 call BitBuddy.004AC1BF
004A5E03 . 85C0 test eax,eax
004A5E05 . 7D 08 jge short BitBuddy.004A5E0F
004A5E07 . 6A 1B push 1B
004A5E09 . E8 B3FEFFFF call BitBuddy.004A5CC1
004A5E0E . 59 pop ecx ; kernel32.7C816FD7
004A5E0F > FF15 54F14B00 call near dword ptr ds:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA
004A5E15 . A3 F4784E00 mov dword ptr ds:[4E78F4],eax
004A5E1A . E8 A46E0000 call BitBuddy.004ACCC3
004A5E1F . A3 D85F4E00 mov dword ptr ds:[4E5FD8],eax
004A5E24 . E8 F86D0000 call BitBuddy.004ACC21
004A5E29 . 85C0 test eax,eax
004A5E2B . 7D 08 jge short BitBuddy.004A5E35
004A5E2D . 6A 08 push 8
004A5E2F . E8 8DFEFFFF call BitBuddy.004A5CC1
004A5E34 . 59 pop ecx ; kernel32.7C816FD7
004A5E35 > E8 B46B0000 call BitBuddy.004AC9EE
004A5E3A . 85C0 test eax,eax
004A5E3C . 7D 08 jge short BitBuddy.004A5E46
004A5E3E . 6A 09 push 9
004A5E40 . E8 7CFEFFFF call BitBuddy.004A5CC1
004A5E45 . 59 pop ecx ; kernel32.7C816FD7
004A5E46 > 6A 01 push 1
004A5E48 . E8 42290000 call BitBuddy.004A878F
004A5E4D . 59 pop ecx ; kernel32.7C816FD7
004A5E4E . 8945 D8 mov dword ptr ss:[ebp-28],eax
004A5E51 . 3BC6 cmp eax,esi
004A5E53 . 74 07 je short BitBuddy.004A5E5C
004A5E55 . 50 push eax
004A5E56 . E8 66FEFFFF call BitBuddy.004A5CC1
004A5E5B . 59 pop ecx ; kernel32.7C816FD7
004A5E5C > 8975 BC mov dword ptr ss:[ebp-44],esi
004A5E5F . 8D45 90 lea eax,dword ptr ss:[ebp-70]
004A5E62 . 50 push eax ; /pStartupinfo = NULL
004A5E63 . FF15 58F14B00 call near dword ptr ds:[<&KERNEL32.GetStartupInfoA>] ; \GetStartupInfoA
004A5E69 . E8 236B0000 call BitBuddy.004AC991
004A5E6E . 8945 E0 mov dword ptr ss:[ebp-20],eax
004A5E71 . F645 BC 01 test byte ptr ss:[ebp-44],1
004A5E75 . 74 06 je short BitBuddy.004A5E7D
004A5E77 . 0FB745 C0 movzx eax,word ptr ss:[ebp-40]
004A5E7B . EB 03 jmp short BitBuddy.004A5E80
004A5E7D > 6A 0A push 0A
004A5E7F . 58 pop eax ; kernel32.7C816FD7
004A5E80 > 50 push eax
004A5E81 . FF75 E0 push dword ptr ss:[ebp-20]
004A5E84 . 56 push esi
004A5E85 . 56 push esi
004A5E86 . FFD7 call near edi ; ntdll.7C930738
004A5E88 . 50 push eax ; |Arg1 = 00000000
004A5E89 . E8 620BF8FF call BitBuddy.004269F0 ; \BitBuddy.004269F0
004A5E8E . 8BF8 mov edi,eax
004A5E90 . 897D D4 mov dword ptr ss:[ebp-2C],edi ; ntdll.7C930738
004A5E93 . 3975 E4 cmp dword ptr ss:[ebp-1C],esi
004A5E96 . 75 06 jnz short BitBuddy.004A5E9E
004A5E98 . 57 push edi ; ntdll.7C930738
004A5E99 . E8 1E2A0000 call BitBuddy.004A88BC
004A5E9E > E8 3B2A0000 call BitBuddy.004A88DE
004A5EA3 . EB 2B jmp short BitBuddy.004A5ED0
004A5EA5 . 8B45 EC mov eax,dword ptr ss:[ebp-14]
004A5EA8 . 8B08 mov ecx,dword ptr ds:[eax]
004A5EAA . 8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E64E
004A5EAC . 894D DC mov dword ptr ss:[ebp-24],ecx
004A5EAF . 50 push eax
004A5EB0 . 51 push ecx
004A5EB1 . E8 77690000 call BitBuddy.004AC82D
004A5EB6 . 59 pop ecx ; kernel32.7C816FD7
004A5EB7 . 59 pop ecx ; kernel32.7C816FD7
004A5EB8 . C3 retn
6A 60 68 D0 7A 4C 00 E8 7A 06 00 00 BF 94 00 00 00 8B C7 E8 CE E6 FF FF 89 65 E8 8B F4 89 3E 56
FF 15 8C F2 4B 00 8B 4E 10 89 0D 78 61 4E 00 8B 46 04 A3 84 61 4E 00 8B 56 08 89 15 88 61 4E 00
8B 76 0C 81 E6 FF 7F 00 00 89 35 7C 61 4E 00 83 F9 02 74 0C 81 CE 00 80 00 00 89 35 7C 61 4E 00
C1 E0 08 03 C2 A3 80 61 4E 00 33 F6 56 8B 3D 08 F2 4B 00 FF D7 66 81 38 4D 5A 75 1F 8B 48 3C 03
C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 89 75 E4 EB 27
83 B9 84 00 00 00 0E 76 F2 33 C0 39 B1 F8 00 00 00 EB 0E 83 79 74 0E 76 E2 33 C0 39 B1 E8 00 00
00 0F 95 C0 89 45 E4 6A 01 E8 6C 34 00 00 59 85 C0 75 08 6A 1C E8 02 FF FF FF 59 E8 EE 30 00 00
85 C0 75 08 6A 10 E8 F1 FE FF FF 59 E8 EA 6F 00 00 89 75 FC E8 BC 63 00 00 85 C0 7D 08 6A 1B E8
B3 FE FF FF 59 FF 15 54 F1 4B 00 A3 F4 78 4E 00 E8 A4 6E 00 00 A3 D8 5F 4E 00 E8 F8 6D 00 00 85
C0 7D 08 6A 08 E8 8D FE FF FF 59 E8 B4 6B 00 00 85 C0 7D 08 6A 09 E8 7C FE FF FF 59 6A 01 E8 42
29 00 00 59 89 45 D8 3B C6 74 07 50 E8 66 FE FF FF 59 89 75 BC 8D 45 90 50 FF 15 58 F1 4B 00 E8
23 6B 00 00 89 45 E0 F6 45 BC 01 74 06 0F B7 45 C0 EB 03 6A 0A 58 50 FF 75 E0 56 56 FF D7 50 E8
62 0B F8 FF 8B F8 89 7D D4 39 75 E4 75 06 57 E8 1E 2A 00 00 E8 3B 2A 00 00 EB 2B 8B 45 EC 8B 08
8B 09 89 4D DC 50 51 E8 77 69 00 00 59 59 C3
**********************************************************************
VC8 -> Microsoft Corporation *
.text
.rdata
.data
.rsrc
00495FCE > /6A 60 push 60
00495FD0 . |68 387B4C00 push foobar20.004C7B38
00495FD5 . |E8 A60C0000 call foobar20.00496C80
00495FDA . |8365 FC 00 and dword ptr ss:[ebp-4],0
00495FDE . |8D45 90 lea eax,dword ptr ss:[ebp-70]
00495FE1 . |50 push eax ; /pStartupinfo = 535C08DE
00495FE2 . |FF15 14414B00 call near dword ptr ds:[<&KERNEL32.GetStartupInfoW>] ; \GetStartupInfoW
00495FE8 . |C745 FC FEFFFFFF mov dword ptr ss:[ebp-4],-2
00495FEF . |BF 94000000 mov edi,94
00495FF4 . |57 push edi ; /HeapSize = 7C930738 (2090010424.)
00495FF5 . |6A 00 push 0 ; |Flags = 0
00495FF7 . |8B1D 10414B00 mov ebx,dword ptr ds:[<&KERNEL32.GetProcessHeap>] ; |kernel32.GetProcessHeap
00495FFD . |FFD3 call near ebx ; |[GetProcessHeap
00495FFF . |50 push eax ; |hHeap = 535C08DE
00496000 . |FF15 08414B00 call near dword ptr ds:[<&KERNEL32.HeapAlloc>] ; \HeapAlloc
00496006 . |8BF0 mov esi,eax
00496008 . |85F6 test esi,esi
0049600A . |75 0D jnz short foobar20.00496019
0049600C . |6A 12 push 12
0049600E . |E8 56FFFFFF call foobar20.00495F69
00496013 . |59 pop ecx ; kernel32.7C816FD7
00496014 . |E9 89010000 jmp foobar20.004961A2
00496019 > |893E mov dword ptr ds:[esi],edi ; ntdll.7C930738
0049601B . |56 push esi ; /pVersionInformation = FFFFFFFF
0049601C . |FF15 0C414B00 call near dword ptr ds:[<&KERNEL32.GetVersionExA>] ; \GetVersionExA
00496022 . |56 push esi
00496023 . |6A 00 push 0
00496025 . |85C0 test eax,eax
00496027 . |75 0E jnz short foobar20.00496037
00496029 . |FFD3 call near ebx
0049602B . |50 push eax ; |hHeap = 535C08DE
0049602C . |FF15 C8414B00 call near dword ptr ds:[<&KERNEL32.HeapFree>] ; \HeapFree
00496032 . |E9 6B010000 jmp foobar20.004961A2
00496037 > |8B46 10 mov eax,dword ptr ds:[esi+10]
0049603A . |8945 E0 mov dword ptr ss:[ebp-20],eax
0049603D . |8B46 04 mov eax,dword ptr ds:[esi+4]
00496040 . |8945 DC mov dword ptr ss:[ebp-24],eax
00496043 . |8B46 08 mov eax,dword ptr ds:[esi+8]
00496046 . |8945 D8 mov dword ptr ss:[ebp-28],eax
00496049 . |8B7E 0C mov edi,dword ptr ds:[esi+C]
0049604C . |81E7 FF7F0000 and edi,7FFF
00496052 . |FFD3 call near ebx
00496054 . |50 push eax ; |hHeap = 535C08DE
00496055 . |FF15 C8414B00 call near dword ptr ds:[<&KERNEL32.HeapFree>] ; \HeapFree
0049605B . |8B75 E0 mov esi,dword ptr ss:[ebp-20]
0049605E . |83FE 02 cmp esi,2
00496061 . |74 06 je short foobar20.00496069
00496063 . |81CF 00800000 or edi,8000
00496069 > |8B4D DC mov ecx,dword ptr ss:[ebp-24]
0049606C . |8BC1 mov eax,ecx
0049606E . |C1E0 08 shl eax,8
00496071 . |8B55 D8 mov edx,dword ptr ss:[ebp-28] ; ntdll.7C930738
00496074 . |03C2 add eax,edx ; ntdll.KiFastSystemCallRet
00496076 . |8935 CC084E00 mov dword ptr ds:[4E08CC],esi
0049607C . |A3 D4084E00 mov dword ptr ds:[4E08D4],eax
00496081 . |890D D8084E00 mov dword ptr ds:[4E08D8],ecx
00496087 . |8915 DC084E00 mov dword ptr ds:[4E08DC],edx ; ntdll.KiFastSystemCallRet
0049608D . |893D D0084E00 mov dword ptr ds:[4E08D0],edi ; ntdll.7C930738
00496093 . |E8 F5FEFFFF call foobar20.00495F8D
00496098 . |8945 E0 mov dword ptr ss:[ebp-20],eax
0049609B . |33DB xor ebx,ebx
0049609D . |43 inc ebx
0049609E . |53 push ebx
0049609F . |E8 8C100000 call foobar20.00497130
004960A4 . |59 pop ecx ; kernel32.7C816FD7
004960A5 . |85C0 test eax,eax
004960A7 . |75 08 jnz short foobar20.004960B1
004960A9 . |6A 1C push 1C
004960AB . |E8 B9FEFFFF call foobar20.00495F69
004960B0 . |59 pop ecx ; kernel32.7C816FD7
004960B1 > |E8 C5050000 call foobar20.0049667B
004960B6 . |85C0 test eax,eax
004960B8 . |75 08 jnz short foobar20.004960C2
004960BA . |6A 10 push 10
004960BC . |E8 A8FEFFFF call foobar20.00495F69
004960C1 . |59 pop ecx ; kernel32.7C816FD7
004960C2 > |E8 80790000 call foobar20.0049DA47
004960C7 . |895D FC mov dword ptr ss:[ebp-4],ebx
004960CA . |E8 38770000 call foobar20.0049D807
004960CF . |85C0 test eax,eax
004960D1 . |7D 08 jge short foobar20.004960DB
004960D3 . |6A 1B push 1B
004960D5 . |E8 9B080000 call foobar20.00496975
004960DA . |59 pop ecx ; kernel32.7C816FD7
004960DB > |E8 88760000 call foobar20.0049D768
004960E0 . |A3 9C544E00 mov dword ptr ds:[4E549C],eax
004960E5 . |E8 1D750000 call foobar20.0049D607
004960EA . |A3 AC084E00 mov dword ptr ds:[4E08AC],eax
004960EF . |E8 68740000 call foobar20.0049D55C
004960F4 . |85C0 test eax,eax
004960F6 . |7D 08 jge short foobar20.00496100
004960F8 . |6A 08 push 8
004960FA . |E8 76080000 call foobar20.00496975
004960FF . |59 pop ecx ; kernel32.7C816FD7
00496100 > |E8 31720000 call foobar20.0049D336
00496105 . |85C0 test eax,eax
00496107 . |7D 08 jge short foobar20.00496111
00496109 . |6A 09 push 9
0049610B . |E8 65080000 call foobar20.00496975
00496110 . |59 pop ecx ; kernel32.7C816FD7
00496111 > |53 push ebx
00496112 . |E8 7A090000 call foobar20.00496A91
00496117 . |59 pop ecx ; kernel32.7C816FD7
00496118 . |85C0 test eax,eax
0049611A . |74 07 je short foobar20.00496123
0049611C . |50 push eax
0049611D . |E8 53080000 call foobar20.00496975
00496122 . |59 pop ecx ; kernel32.7C816FD7
00496123 > |E8 C8710000 call foobar20.0049D2F0
00496128 . |845D BC test byte ptr ss:[ebp-44],bl
0049612B . |74 06 je short foobar20.00496133
0049612D . |0FB74D C0 movzx ecx,word ptr ss:[ebp-40]
00496131 . |EB 03 jmp short foobar20.00496136
00496133 > |6A 0A push 0A
00496135 . |59 pop ecx ; kernel32.7C816FD7
00496136 > |51 push ecx
00496137 . |50 push eax
00496138 . |6A 00 push 0
0049613A . |68 00004000 push foobar20.00400000
0049613F . |E8 8EAAF9FF call foobar20.00430BD2
00496144 . |8945 E4 mov dword ptr ss:[ebp-1C],eax
00496147 . |837D E0 00 cmp dword ptr ss:[ebp-20],0
0049614B . |75 06 jnz short foobar20.00496153
0049614D . |50 push eax
0049614E . |E8 9E0A0000 call foobar20.00496BF1
00496153 > |E8 BB0A0000 call foobar20.00496C13
00496158 . |EB 2E jmp short foobar20.00496188
0049615A . |8B45 EC mov eax,dword ptr ss:[ebp-14]
0049615D . |8B08 mov ecx,dword ptr ds:[eax]
0049615F . |8B09 mov ecx,dword ptr ds:[ecx] ; ntdll.7C92E10E
00496161 . |894D D4 mov dword ptr ss:[ebp-2C],ecx
00496164 . |50 push eax
00496165 . |51 push ecx
00496166 . |E8 16700000 call foobar20.0049D181
0049616B . |59 pop ecx ; kernel32.7C816FD7
0049616C . |59 pop ecx ; kernel32.7C816FD7
0049616D . |C3 retn
0049616E . |8B65 E8 mov esp,dword ptr ss:[ebp-18]
00496171 . |8B45 D4 mov eax,dword ptr ss:[ebp-2C] ; kernel32.7C816FD7
00496174 . |8945 E4 mov dword ptr ss:[ebp-1C],eax
00496177 . |837D E0 00 cmp dword ptr ss:[ebp-20],0
0049617B . |75 06 jnz short foobar20.00496183
0049617D . |50 push eax
0049617E . |E8 7F0A0000 call foobar20.00496C02
00496183 > |E8 9A0A0000 call foobar20.00496C22
00496188 > |C745 FC FEFFFFFF mov dword ptr ss:[ebp-4],-2
0049618F . |8B45 E4 mov eax,dword ptr ss:[ebp-1C]
00496192 . |EB 13 jmp short foobar20.004961A7
00496194 . |33C0 xor eax,eax
00496196 . |40 inc eax
00496197 . |C3 retn
00496198 . |8B65 E8 mov esp,dword ptr ss:[ebp-18]
0049619B . |C745 FC FEFFFFFF mov dword ptr ss:[ebp-4],-2
004961A2 > |B8 FF000000 mov eax,0FF
004961A7 > |E8 190B0000 call foobar20.00496CC5
004961AC . |C3 retn
004961AD foob> $ |E8 DD780000 call foobar20.0049DA8F
004961B2 .^\E9 17FEFFFF jmp foobar20.00495FCE
004961B7 $ 3B0D B0CC4D00 cmp ecx,dword ptr ds:[4DCCB0]
004961BD . 75 02 jnz short foobar20.004961C1
004961BF . F3: prefix rep:
004961C0 . C3 retn
6A 60 68 38 7B 4C 00 E8 A6 0C 00 00 83 65 FC 00 8D 45 90 50 FF 15 14 41 4B 00 C7 45 FC FE FF FF
FF BF 94 00 00 00 57 6A 00 8B 1D 10 41 4B 00 FF D3 50 FF 15 08 41 4B 00 8B F0 85 F6 75 0D 6A 12
E8 56 FF FF FF 59 E9 89 01 00 00 89 3E 56 FF 15 0C 41 4B 00 56 6A 00 85 C0 75 0E FF D3 50 FF 15
C8 41 4B 00 E9 6B 01 00 00 8B 46 10 89 45 E0 8B 46 04 89 45 DC 8B 46 08 89 45 D8 8B 7E 0C 81 E7
FF 7F 00 00 FF D3 50 FF 15 C8 41 4B 00 8B 75 E0 83 FE 02 74 06 81 CF 00 80 00 00 8B 4D DC 8B C1
C1 E0 08 8B 55 D8 03 C2 89 35 CC 08 4E 00 A3 D4 08 4E 00 89 0D D8 08 4E 00 89 15 DC 08 4E 00 89
3D D0 08 4E 00 E8 F5 FE FF FF 89 45 E0 33 DB 43 53 E8 8C 10 00 00 59 85 C0 75 08 6A 1C E8 B9 FE
FF FF 59 E8 C5 05 00 00 85 C0 75 08 6A 10 E8 A8 FE FF FF 59 E8 80 79 00 00 89 5D FC E8 38 77 00
00 85 C0 7D 08 6A 1B E8 9B 08 00 00 59 E8 88 76 00 00 A3 9C 54 4E 00 E8 1D 75 00 00 A3 AC 08 4E
00 E8 68 74 00 00 85 C0 7D 08 6A 08 E8 76 08 00 00 59 E8 31 72 00 00 85 C0 7D 08 6A 09 E8 65 08
00 00 59 53 E8 7A 09 00 00 59 85 C0 74 07 50 E8 53 08 00 00 59 E8 C8 71 00 00 84 5D BC 74 06 0F
B7 4D C0 EB 03 6A 0A 59 51 50 6A 00 68 00 00 40 00 E8 8E AA F9 FF 89 45 E4 83 7D E0 00 75 06 50
E8 9E 0A 00 00 E8 BB 0A 00 00 EB 2E 8B 45 EC 8B 08 8B 09 89 4D D4 50 51 E8 16 70 00 00 59 59 C3
8B 65 E8 8B 45 D4 89 45 E4 83 7D E0 00 75 06 50 E8 7F 0A 00 00 E8 9A 0A 00 00 C7 45 FC FE FF FF
FF 8B 45 E4 EB 13 33 C0 40 C3 8B 65 E8 C7 45 FC FE FF FF FF B8 FF 00 00 00 E8 19 0B 00 00 C3 E8
DD 78 00 00 E9 17 FE FF FF 3B 0D B0 CC 4D 00 75 02 F3 C3
**********************************************************************
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
谢谢楼主的辛苦
