00404AC8 /$ 53 push ebx
00404AC9 |. 56 push esi
00404ACA |. 57 push edi
00404ACB |. 55 push ebp
00404ACC |. BB 34665E00 mov ebx, 005E6634
00404AD1 |. BE 00C05D00 mov esi, 005DC000
00404AD6 |. BF 48605E00 mov edi, 005E6048
00404ADB |. 807B 28 00 cmp byte ptr [ebx+28], 0
00404ADF 75 16 jnz short 00404AF7
00404AE1 |. 833F 00 cmp dword ptr [edi], 0
00404AE4 |. 74 11 je short 00404AF7
00404AE6 |> 8B17 /mov edx, dword ptr [edi]
00404AE8 |. 89D0 |mov eax, edx
00404AEA |. 33D2 |xor edx, edx
00404AEC |. 8917 |mov dword ptr [edi], edx
00404AEE |. 8BE8 |mov ebp, eax
00404AF0 |. FFD5 |call ebp
00404AF2 |. 833F 00 |cmp dword ptr [edi], 0
00404AF5 |.^ 75 EF \jnz short 00404AE6
00404AF7 |> 833D 04C05D00>cmp dword ptr [5DC004], 0
00404AFE 74 11 je short 00404B11
00404B00 |. E8 ABFEFFFF call 004049B0
00404B05 |. E8 32FFFFFF call 00404A3C
00404B0A |. 33C0 xor eax, eax
00404B0C |. A3 04C05D00 mov dword ptr [5DC004], eax
00404B11 |> 807B 28 02 /cmp byte ptr [ebx+28], 2
00404B15 |. 75 0A |jnz short 00404B21
00404B17 |. 833E 00 |cmp dword ptr [esi], 0
00404B1A |. 75 05 |jnz short 00404B21
00404B1C |. 33C0 |xor eax, eax
00404B1E |. 8943 0C |mov dword ptr [ebx+C], eax
00404B21 |> E8 22FDFFFF |call 00404848
00404B26 |. 807B 28 01 |cmp byte ptr [ebx+28], 1
00404B2A |. 76 05 |jbe short 00404B31
00404B2C |. 833E 00 |cmp dword ptr [esi], 0
00404B2F |. 74 21 |je short 00404B52
00404B31 |> 8B43 10 |mov eax, dword ptr [ebx+10]
00404B34 |. 85C0 |test eax, eax
00404B36 |. 74 1A |je short 00404B52
00404B38 |. E8 6B210000 |call 00406CA8
00404B3D |. 8B53 10 |mov edx, dword ptr [ebx+10]
00404B40 |. 8B42 10 |mov eax, dword ptr [edx+10]
00404B43 |. 3B42 04 |cmp eax, dword ptr [edx+4]
00404B46 |. 74 0A |je short 00404B52
00404B48 |. 85C0 |test eax, eax
00404B4A |. 74 06 |je short 00404B52
00404B4C |. 50 |push eax ; /hLibModule
00404B4D |. E8 42C8FFFF |call <jmp.&kernel32.FreeLibrary> ; \FreeLibrary
00404B52 |> E8 C9FCFFFF |call 00404820
00404B57 |. 807B 28 01 |cmp byte ptr [ebx+28], 1
00404B5B |. 75 03 |jnz short 00404B60
00404B5D |. FF53 24 |call dword ptr [ebx+24]
00404B60 |> 807B 28 00 |cmp byte ptr [ebx+28], 0
00404B64 |. 74 05 |je short 00404B6B
00404B66 |. E8 A1FEFFFF |call 00404A0C
00404B6B 833B 00 cmp dword ptr [ebx], 0
00404B6E |. 75 17 |jnz short 00404B87
00404B70 |. 833D 28605E00>|cmp dword ptr [5E6028], 0
00404B77 |. 74 06 |je short 00404B7F
00404B79 |. FF15 28605E00 |call dword ptr [5E6028]
00404B7F |> 8B06 |mov eax, dword ptr [esi]
00404B81 |. 50 |push eax ; /ExitCode
00404B82 |. E8 EDC7FFFF |call <jmp.&kernel32.ExitProcess> ; \ExitProcess
00404B87 |> 8B03 |mov eax, dword ptr [ebx]
00404B89 |. 56 |push esi
00404B8A |. 8BF0 |mov esi, eax
00404B8C |. 8BFB |mov edi, ebx
00404B8E |. B9 0B000000 |mov ecx, 0B
00404B93 |. F3:A5 |rep movs dword ptr es:[edi], dword >
00404B95 |. 5E |pop esi
00404B96 \.^ E9 76FFFFFF \jmp 00404B11
程序到这个就自动退出
[课程]Android-CTF解题方法汇总！
