被狗 加密程这样了,怎么还原?
--------------------------------------------------------------------------------
00403911 .- E9 >jmp 005E9046 ; cr.005E9046
00403916 $- FF2>jmp near dword ptr ds:[401154] ; MSVBVM60.__vbaExceptHandler; 结构异常处理程序
0040391C > 90 nop
0040391D .- E9 >jmp 005E904F ; cr.005E904F
00403922 .- FF2>jmp near dword ptr ds:[4010AC] ; MSVBVM60._adj_fdiv_m16i
00403928 $ 90 nop
00403929 .- E9 >jmp 005E9058 ; cr.005E9058
0040392E .- FF2>jmp near dword ptr ds:[4011B4] ; MSVBVM60._adj_fdiv_m32i
00403934 $ 90 nop
00403935 .- E9 >jmp 005E9061 ; cr.005E9061
0040393A .- FF2>jmp near dword ptr ds:[4011E0] ; MSVBVM60._adj_fdiv_r
00403940 90 nop
00403941 .- E9 >jmp 005E906A ; cr.005E906A
00403946 .- FF2>jmp near dword ptr ds:[4011D4] ; MSVBVM60._adj_fdivr_m32
0040394C 90 nop
0040394D .- E9 >jmp 005E9073 ; cr.005E9073
00403952 .- FF2>jmp near dword ptr ds:[401164] ; MSVBVM60._adj_fdivr_m64
00403958 90 nop
00403959 .- E9 >jmp 005E907C ; cr.005E907C
0040395E .- FF2>jmp near dword ptr ds:[401160] ; MSVBVM60._adj_fprem
00403964 90 nop
00403965 .- E9 >jmp 005E9085 ; cr.005E9085
0040396A .- FF2>jmp near dword ptr ds:[40101C] ; MSVBVM60._adj_fptan
00403970 90 nop
00403971 .- E9 >jmp 005E908E ; cr.005E908E
00403976 .- FF2>jmp near dword ptr ds:[401018] ; MSVBVM60._CIcos
0040397C 90 nop
0040397D .- E9 >jmp 005E9097 ; cr.005E9097
00403982 .- FF2>jmp near dword ptr ds:[40119C] ; MSVBVM60._CIlog
00403988 90 nop
00403989 .- E9 >jmp 005E90A0 ; cr.005E90A0
0040398E .- FF2>jmp near dword ptr ds:[401140] ; MSVBVM60._CIsqrt
00403994 90 nop
00403995 .- E9 >jmp 005E90A9 ; cr.005E90A9
0040399A .- FF2>jmp near dword ptr ds:[40124C] ; MSVBVM60._allmul
004039A0 90 nop
004039A1 .- E9 >jmp 005E90B2 ; 1
004039A6 .- FF2>jmp near dword ptr ds:[4011C4] ; MSVBVM60.__vbaI4Str
004039AC 90 nop
004039AD .- E9 >jmp 005E90BB ; cr.005E90BB
004039B2 .- FF2>jmp near dword ptr ds:[4011D0] ; MSVBVM60.__vbaFreeStrList
004039B8 90 nop
004039B9 .- E9 >jmp 005E90C4 ; cr.005E90C4
004039BE .- FF2>jmp near dword ptr ds:[401070] ; MSVBVM60.__vbaSetSystemError
004039C4 90 nop
004039C5 .- E9 >jmp 005E90CD ; cr.005E90CD
004039CA .- FF2>jmp near dword ptr ds:[401024] ; MSVBVM60.__vbaStrI4
004039D0 90 nop
004039D1 .- E9 >jmp 005E90D6 ; cr.005E90D6
004039D6 .- FF2>jmp near dword ptr ds:[401050] ; MSVBVM60.__vbaFreeObjList
004039DC 90 nop
004039DD .- E9 >jmp 005E90DF ; cr.005E90DF
004039E2 .- FF2>jmp near dword ptr ds:[401104] ; MSVBVM60.__vbaVarTstEq
004039E8 90 nop
004039E9 .- E9 >jmp 005E90E8 ; cr.005E90E8
004039EE .- FF2>jmp near dword ptr ds:[401114] ; MSVBVM60.__vbaI2I4
004039F4 90 nop
004039F5 .- E9 >jmp 005E90F1 ; cr.005E90F1
004039FA .- FF2>jmp near dword ptr ds:[40112C] ; MSVBVM60.__vbaR4Var
00403A00 90 nop
00403A01 .- E9 >jmp 005E90FA ; cr.005E90FA
00403A06 .- FF2>jmp near dword ptr ds:[401130] ; MSVBVM60.__vbaLateIdCallLd
00403A0C 90 nop
00403A0D .- E9 >jmp 005E9103 ; cr.005E9103
00403A12 .- FF2>jmp near dword ptr ds:[4010B0] ; MSVBVM60.__vbaObjSetAddref
00403A18 90 nop
00403A19 .- E9 >jmp 005E910C ; cr.005E910C
00403A1E .- FF2>jmp near dword ptr ds:[401270] ; MSVBVM60.__vbaFreeStr
00403A24 90 nop
00403A25 .- E9 >jmp 005E9115 ; cr.005E9115
00403A2A .- FF2>jmp near dword ptr ds:[401068] ; MSVBVM60.__vbaStrCat
00403A30 90 nop
00403A31 .- E9 >jmp 005E911E ; cr.005E911E
00403A36 .- FF2>jmp near dword ptr ds:[401054] ; MSVBVM60.rtcAnsiValueBstr
00403A3C 90 nop
00403A3D .- E9 >jmp 005E9127 ; cr.005E9127
00403A42 .- FF2>jmp near dword ptr ds:[4010FC] ; MSVBVM60.__vbaStrCmp
00403A48 90 nop
00403A49 .- E9 >jmp 005E9130 ; cr.005E9130
00403A4E .- FF2>jmp near dword ptr ds:[4011EC] ; MSVBVM60.__vbaI4Var
00403A54 90 nop
00403A55 .- E9 >jmp 005E9139 ; cr.005E9139
00403A5A .- FF2>jmp near dword ptr ds:[40103C] ; MSVBVM60.__vbaStrVarMove
00403A60 90 nop
00403A61 .- E9 >jmp 005E9142 ; cr.005E9142
00403A66 .- FF2>jmp near dword ptr ds:[40109C] ; MSVBVM60.__vbaVarForInit
00403A6C 90 nop
00403A6D .- E9 >jmp 005E914B ; cr.005E914B
00403A72 .- FF2>jmp near dword ptr ds:[4011C0] ; MSVBVM60.__vbaStrCopy
00403A78 90 nop
00403A79 .- E9 >jmp 005E9154 ; cr.005E9154
00403A7E .- FF2>jmp near dword ptr ds:[401190] ; MSVBVM60.__vbaVarCat
00403A84 90 nop
00403A85 .- E9 >jmp 005E915D ; cr.005E915D
00403A8A .- FF2>jmp near dword ptr ds:[40113C] ; MSVBVM60.__vbaNew
00403A90 90 nop
00403A91 .- E9 >jmp 005E9166 ; cr.005E9166
00403A96 .- FF2>jmp near dword ptr ds:[401020] ; MSVBVM60.__vbaVarMove
00403A9C 90 nop
00403A9D .- E9 >jmp 005E916F ; cr.005E916F
00403AA2 .- FF2>jmp near dword ptr ds:[4010A4] ; MSVBVM60.rtcMsgBox
00403AA8 90 nop
00403AA9 .- E9 >jmp 005E9178 ; cr.005E9178
所有调用 vb 的一半的调用都让 狗给替换程自己的调用了,怎么修复这样的代码?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课