此程序我经过１０个小时的分析仍无法分析出，请各位大虾帮忙！ 感谢！
此程序嵌套特别多。
0042FE1C 56 push esi
0042FE1D 66:837A 06 00 cmp word ptr [edx+6], 0
0042FE22 75 09 jnz short 0042FE2D
0042FE24 66:BE EBFF mov si, 0FFEB
0042FE28 E8 373DFDFF call 00403B64
0042FE2D 5E pop esi
0042FE2E C3 retn
0042FD12 0000 add byte ptr [eax], al
0042FD14 E0 00 loopdne short 0042FD16
0042FD16 0000 add byte ptr [eax], al
0042FD18 53 push ebx
0042FD19 8BD8 mov ebx, eax
0042FD1B 8BC3 mov eax, ebx
0042FD1D E8 A6280200 call 004525C8
0042FD22 85C0 test eax, eax
0042FD24 74 0C je short 0042FD32
0042FD26 8B93 14020000 mov edx, dword ptr [ebx+214]
0042FD2C 8990 4C020000 mov dword ptr [eax+24C], edx
0042FD32 8BC3 mov eax, ebx
0042FD34 E8 B3C90000 call 0043C6EC *** 此处call 0043C6EC
0042FD39 5B pop ebx
0042FD3A C3 retn
0043C6EC 53 push ebx
0043C6ED 8BD8 mov ebx, eax
0043C6EF 66:83BB 2201000>cmp word ptr [ebx+122], 0
0043C6F7 74 2D je short 0043C726
0043C6F9 8BC3 mov eax, ebx
0043C6FB 8B10 mov edx, dword ptr [eax]
0043C6FD FF52 3C call dword ptr [edx+3C]
0043C700 85C0 test eax, eax
0043C702 74 22 je short 0043C726
0043C704 8BC3 mov eax, ebx
0043C706 8B10 mov edx, dword ptr [eax]
0043C708 FF52 3C call dword ptr [edx+3C]
0043C70B 8B40 40 mov eax, dword ptr [eax+40]
0043C70E 3B83 20010000 cmp eax, dword ptr [ebx+120]
0043C714 74 10 je short 0043C726
0043C716 8BD3 mov edx, ebx
0043C718 8B83 24010000 mov eax, dword ptr [ebx+124]
0043C71E FF93 20010000 call dword ptr [ebx+120]
0043C724 5B pop ebx
0043C725 C3 retn
0043C726 F643 1C 10 test byte ptr [ebx+1C], 10
0043C72A 75 12 jnz short 0043C73E
0043C72C 837B 6C 00 cmp dword ptr [ebx+6C], 0
0043C730 74 0C je short 0043C73E
0043C732 8BD3 mov edx, ebx
0043C734 8B43 6C mov eax, dword ptr [ebx+6C]
0043C737 8B08 mov ecx, dword ptr [eax]
0043C739 FF51 18 call dword ptr [ecx+18]
0043C73C EB 18 jmp short 0043C756
0043C73E 66:83BB 2201000>cmp word ptr [ebx+122], 0
0043C746 74 0E je short 0043C756
0043C748 8BD3 mov edx, ebx
0043C74A 8B83 24010000 mov eax, dword ptr [ebx+124]
0043C750 FF93 20010000 call dword ptr [ebx+120] ***调用0048F42A
0043C756 5B pop ebx
0043C757 C3 retn
0048F41F . 00D6 add dh, dl
0048F421 . D5 D6 aad 0D6
0048F423 . B9 CBD1CBF7 mov ecx, F7CBD1CB
0048F428 . 2E: prefix cs:
0048F429 . 2E: prefix cs:
0048F42A . 2E:006A 00 add byte ptr cs:[edx], ch
0048F42E . 66:8B0D 44F44>mov cx, word ptr [48F444]
0048F435 . B2 02 mov dl, 2
0048F437 . B8 50F44800 mov eax, 0048F450
0048F43C . E8 4751FAFF call 00434588 ***此call出错
0048F441 . C3 retn
0048F442 00 db 00
0048F443 00 db 00
0048F444 . 0400 dw 0004
0048F446 00 db 00
0048F447 00 db 00
0048F448 FF db FF
0048F449 FF db FF
0048F44A FF db FF
0048F44B FF db FF
0048F44C 18 db 18
0048F44D 00 db 00
0048F44E 00 db 00
0048F44F 00 db 00
0048F450 B8 db B8
0048F451 B6 db B6
0048F452 B7 db B7
0048F453 D1 db D1
0048F454 D7 db D7
0048F455 A2 db A2
0048F456 B2 db B2
0048F457 E1 db E1
0048F458 D3 db D3
0048F459 . C3 retn
0048F45A BB db BB
0048F45B A7 db A7
0048F45C B2 db B2
0048F45D C5 db C5
0048F45E C4 db C4
0048F45F DC db DC
0048F460 B1 db B1
0048F461 A3 db A3
0048F462 B4 db B4
0048F463 E6 db E6
0048F464 BD db BD
0048F465 . E1 B9 FB 00 ascii "峁?,0
0048F469 00 db 00
0048F46A 00 db 00
0048F46B 00 db 00
0048F46C /. 55 push ebp ***此处是注册ok的开始地址
0048F46D |. 8BEC mov ebp, esp
0048F46F |. 33C9 xor ecx, ecx
0048F471 |. 51 push ecx
0048F472 |. 51 push ecx
0048F473 |. 51 push ecx
0048F474 |. 51 push ecx
0048F475 |. 51 push ecx
0048F476 |. 51 push ecx
0048F477 |. 53 push ebx
0048F478 |. 56 push esi
0048F479 |. 8BD8 mov ebx, eax
0048F47B |. BE 943D4900 mov esi, 00493D94
0048F480 |. 33C0 xor eax, eax
0048F482 |. 55 push ebp
0048F483 |. 68 D3F54800 push 0048F5D3
0048F488 |. 64:FF30 push dword ptr fs:[eax]
0048F48B |. 64:8920 mov dword ptr fs:[eax], esp
0048F48E |. 8D55 F4 lea edx, dword ptr [ebp-C]
0048F491 |. A1 D82B4900 mov eax, dword ptr [492BD8]
0048F496 |. 8B00 mov eax, dword ptr [eax]
0048F498 |. E8 EFC2FCFF call 0045B78C
0048F49D |. 8B45 F4 mov eax, dword ptr [ebp-C]
0048F4A0 |. 8D55 F8 lea edx, dword ptr [ebp-8]
0048F4A3 |. E8 949BF7FF call 0040903C
0048F4A8 |. 8B55 F8 mov edx, dword ptr [ebp-8]
0048F4AB |. 8D45 FC lea eax, dword ptr [ebp-4]
0048F4AE |. B9 E8F54800 mov ecx, 0048F5E8 ; ASCII "googleqqscan.ini"
0048F4B3 |. E8 A455F7FF call 00404A5C
0048F4B8 |. 8B45 FC mov eax, dword ptr [ebp-4]
0048F4BB |. E8 D49AF7FF call 00408F94
0048F4C0 |. 84C0 test al, al
0048F4C2 |. 74 08 je short 0048F4CC
0048F4C4 |. 8B45 FC mov eax, dword ptr [ebp-4]
0048F4C7 |. E8 D89AF7FF call 00408FA4
0048F4CC |> 8B55 FC mov edx, dword ptr [ebp-4]
0048F4CF |. 8BC6 mov eax, esi
0048F4D1 |. E8 3239F7FF call 00402E08
0048F4D6 |. 8BC6 mov eax, esi
0048F4D8 |. E8 C736F7FF call 00402BA4
0048F4DD |. E8 2A34F7FF call 0040290C
0048F4E2 |. 8D55 F0 lea edx, dword ptr [ebp-10]
0048F4E5 |. 8B83 58030000 mov eax, dword ptr [ebx+358]
0048F4EB |. E8 BCBCFAFF call 0043B1AC
0048F4F0 |. 8B55 F0 mov edx, dword ptr [ebp-10]
0048F4F3 |. 8BC6 mov eax, esi
0048F4F5 |. E8 2A59F7FF call 00404E24
0048F4FA |. E8 353FF7FF call 00403434
0048F4FF |. E8 0834F7FF call 0040290C
0048F504 |. 8D55 EC lea edx, dword ptr [ebp-14]
0048F507 |. A1 38414900 mov eax, dword ptr [494138]
0048F50C |. 48 dec eax
0048F50D |. E8 E697F7FF call 00408CF8
0048F512 |. 8B55 EC mov edx, dword ptr [ebp-14]
0048F515 |. 8BC6 mov eax, esi
0048F517 |. E8 0859F7FF call 00404E24
0048F51C |. E8 133FF7FF call 00403434
0048F521 |. E8 E633F7FF call 0040290C
0048F526 |. 8B83 74030000 mov eax, dword ptr [ebx+374]
0048F52C |. 8B10 mov edx, dword ptr [eax]
0048F52E |. FF92 C4000000 call dword ptr [edx+C4]
0048F534 |. 84C0 test al, al
0048F536 |. 74 18 je short 0048F550
0048F538 |. BA 04F64800 mov edx, 0048F604 ; ASCII "qcyes"
0048F53D |. 8BC6 mov eax, esi
0048F53F |. E8 E058F7FF call 00404E24
0048F544 |. E8 EB3EF7FF call 00403434
0048F549 |. E8 BE33F7FF call 0040290C
0048F54E |. EB 16 jmp short 0048F566
0048F550 |> BA 14F64800 mov edx, 0048F614 ; ASCII "qcno"
0048F555 |. 8BC6 mov eax, esi
0048F557 |. E8 C858F7FF call 00404E24
0048F55C |. E8 D33EF7FF call 00403434
0048F561 |. E8 A633F7FF call 0040290C
0048F566 |> 8B83 70030000 mov eax, dword ptr [ebx+370]
0048F56C |. E8 83AAFEFF call 00479FF4
0048F571 |. 8D55 E8 lea edx, dword ptr [ebp-18]
0048F574 |. E8 7F97F7FF call 00408CF8
0048F579 |. 8B55 E8 mov edx, dword ptr [ebp-18]
0048F57C |. 8BC6 mov eax, esi
0048F57E |. E8 A158F7FF call 00404E24
0048F583 |. E8 AC3EF7FF call 00403434
0048F588 |. E8 7F33F7FF call 0040290C
0048F58D |. 8BC6 mov eax, esi
0048F58F |. E8 3C39F7FF call 00402ED0
0048F594 |. E8 7333F7FF call 0040290C
0048F599 |. B8 24F64800 mov eax, 0048F624
0048F59E |. E8 DD50FAFF call 00434680
0048F5A3 |. 33C0 xor eax, eax
0048F5A5 |. 5A pop edx
0048F5A6 |. 59 pop ecx
0048F5A7 |. 59 pop ecx
0048F5A8 |. 64:8910 mov dword ptr fs:[eax], edx
0048F5AB |. 68 DAF54800 push 0048F5DA
0048F5B0 |> 8D45 E8 lea eax, dword ptr [ebp-18]
0048F5B3 |. BA 02000000 mov edx, 2
0048F5B8 |. E8 BF51F7FF call 0040477C
0048F5BD |. 8D45 F0 lea eax, dword ptr [ebp-10]
0048F5C0 |. E8 9351F7FF call 00404758
0048F5C5 |. 8D45 F4 lea eax, dword ptr [ebp-C]
0048F5C8 |. BA 03000000 mov edx, 3
0048F5CD |. E8 AA51F7FF call 0040477C
0048F5D2 \. C3 retn
0048F5D3 .- E9 244BF7FF jmp 004040FC
0048F5D8 .^ EB D6 jmp short 0048F5B0
0048F5DA . 5E pop esi
0048F5DB . 5B pop ebx
0048F5DC . 8BE5 mov esp, ebp
0048F5DE . 5D pop ebp
0048F5DF . C3 retn
文件地址：http://p2s.newhua.com/down/googleqqscan.zip
是upx的壳
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
