0040459C > $ E8 E7010000 CALL <JMP.&comctl32.InitCommonControls> ; [InitCommonControls
004045A1 . 6A 00 PUSH 0 ; /pModule = NULL
004045A3 . E8 56010000 CALL <JMP.&kernel32.GetModuleHandleA> ; \GetModuleHandleA
004045A8 . A3 3C6F4000 MOV DWORD PTR DS:[406F3C],EAX
004045AD . 74 08 JE SHORT Sniffer.004045B7
004045AF 75 06 JNZ SHORT Sniffer.004045B7
004045B1 3230 XOR DH,BYTE PTR DS:[EAX]
004045B3 3036 XOR BYTE PTR DS:[ESI],DH
004045B5 00E8 ADD AL,CH
004045B7 74 03 JE SHORT Sniffer.004045BC
004045B9 75 01 JNZ SHORT Sniffer.004045BC
004045BB E8 E8AAFEFF CALL 003EF0A8
004045C0 FF83 F8017502 INC DWORD PTR DS:[EBX+27501F8]
004045C6 EB 58 JMP SHORT Sniffer.00404620
004045C8 68 70514000 PUSH Sniffer.00405170 ; ASCII "wpcap.dll"
004045CD E8 62010000 CALL <JMP.&kernel32.LoadLibraryA>
004045D2 0BC0 OR EAX,EAX
004045D4 74 05 JE SHORT Sniffer.004045DB
004045D6 A3 446F4000 MOV DWORD PTR DS:[406F44],EAX
004045DB 68 7A514000 PUSH Sniffer.0040517A ; ASCII "KERNEL32.DLL"
004045E0 . E8 4F010000 CALL <JMP.&kernel32.LoadLibraryA> ; \LoadLibraryA
004045E5 . 0BC0 OR EAX,EAX
004045E7 . 74 05 JE SHORT Sniffer.004045EE
004045E9 . A3 486F4000 MOV DWORD PTR DS:[406F48],EAX
004045EE > 68 23604000 PUSH Sniffer.00406023 ; /FileName = "WBDll.dll"
004045F3 . E8 3C010000 CALL <JMP.&kernel32.LoadLibraryA> ; \LoadLibraryA
004045F8 . 0BC0 OR EAX,EAX
004045FA . 74 07 JE SHORT Sniffer.00404603
004045FC . A3 386F4000 MOV DWORD PTR DS:[406F38],EAX
00404601 EB 07 JMP SHORT Sniffer.0040460A
00404603 > 6A 00 PUSH 0 ; /ExitCode = 0
00404605 . E8 CA000000 CALL <JMP.&kernel32.ExitProcess> ; \ExitProcess
0040460A > 6A 00 PUSH 0 ; /lParam = NULL
0040460C . 68 871E4000 PUSH Sniffer.00401E87 ; |DlgProc = Sniffer.00401E87
00404611 . 6A 00 PUSH 0 ; |hOwner = NULL
00404613 . 6A 66 PUSH 66 ; |pTemplate = 66
00404615 . FF35 3C6F4000 PUSH DWORD PTR DS:[406F3C] ; |hInst = NULL
0040461B . E8 1E000000 CALL <JMP.&user32.DialogBoxParamA> ; \DialogBoxParamA
00404620 > FF35 386F4000 PUSH DWORD PTR DS:[406F38] ; /hLibModule = NULL
00404626 . E8 B5000000 CALL <JMP.&kernel32.FreeLibrary> ; \FreeLibrary
0040462B . 6A 00 PUSH 0 ; /ExitCode = 0
0040462D . E8 A2000000 CALL <JMP.&kernel32.ExitProcess> ; \ExitProcess
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!