注册的时候有机器,这个关键跳怎么找?
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0053A2C1(C)
|
:0053A2E7 8B45FC mov eax, dword ptr [ebp-04]
:0053A2EA E865CAF1FF call 00456D54
* Possible StringData Ref from Code Obj ->"注册码不正确"
|
:0053A2EF BAF4A45300 mov edx, 0053A4F4
:0053A2F4 B930000000 mov ecx, 00000030
:0053A2F9 E8160EFBFF call 004EB114
:0053A2FE E9AA010000 jmp 0053A4AD
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0053A2E5(C)
|
:0053A303 B201 mov dl, 01
* Possible StringData Ref from Code Obj ->"Treg岪"
|
:0053A305 A13CAF4E00 mov eax, dword ptr [004EAF3C]
:0053A30A E8D50EFBFF call 004EB1E4
:0053A30F 8945F8 mov dword ptr [ebp-08], eax
:0053A312 8D45F4 lea eax, dword ptr [ebp-0C]
:0053A315 50 push eax
:0053A316 8B45FC mov eax, dword ptr [ebp-04]
:0053A319 8B8008030000 mov eax, dword ptr [eax+00000308]
:0053A31F 8B10 mov edx, dword ptr [eax]
:0053A321 FF92C8000000 call dword ptr [edx+000000C8]
:0053A327 50 push eax
:0053A328 8D951CFEFFFF lea edx, dword ptr [ebp+FFFFFE1C]
:0053A32E 8B45FC mov eax, dword ptr [ebp-04]
:0053A331 8B80F0020000 mov eax, dword ptr [eax+000002F0]
:0053A337 E83461F1FF call 00450470
:0053A33C 8B951CFEFFFF mov edx, dword ptr [ebp+FFFFFE1C]
:0053A342 8B45F8 mov eax, dword ptr [ebp-08]
:0053A345 59 pop ecx
:0053A346 E80110FBFF call 004EB34C
:0053A34B 66BA3828 mov dx, 2838
:0053A34F 0FB7C2 movzx eax, dx
:0053A352 898518FEFFFF mov dword ptr [ebp+FFFFFE18], eax
:0053A358 DB8518FEFFFF fild dword ptr [ebp+FFFFFE18]
:0053A35E DB2D04A55300 fld tbyte ptr [0053A504]
:0053A364 DED9 fcompp
:0053A366 DFE0 fstsw ax
:0053A368 9E sahf
:0053A369 0F851D010000 jne 0053A48C
:0053A36F 33C0 xor eax, eax
:0053A371 55 push ebp
:0053A372 6829A45300 push 0053A429
:0053A377 64FF30 push dword ptr fs:[eax]
:0053A37A 648920 mov dword ptr fs:[eax], esp
:0053A37D 33C0 xor eax, eax
:0053A37F 55 push ebp
:0053A380 6801A45300 push 0053A401
:0053A385 64FF30 push dword ptr fs:[eax]
:0053A388 648920 mov dword ptr fs:[eax], esp
:0053A38B 8D9510FEFFFF lea edx, dword ptr [ebp+FFFFFE10]
:0053A391 A1986A5400 mov eax, dword ptr [00546A98]
:0053A396 8B00 mov eax, dword ptr [eax]
:0053A398 E83B78F3FF call 00471BD8
:0053A39D 8B8510FEFFFF mov eax, dword ptr [ebp+FFFFFE10]
:0053A3A3 8D9514FEFFFF lea edx, dword ptr [ebp+FFFFFE14]
:0053A3A9 E8C6FBECFF call 00409F74
:0053A3AE 8D8514FEFFFF lea eax, dword ptr [ebp+FFFFFE14]
* Possible StringData Ref from Code Obj ->"\key.kc"
|
:0053A3B4 BA18A55300 mov edx, 0053A518
:0053A3B9 E84EADECFF call 0040510C
:0053A3BE 8B9514FEFFFF mov edx, dword ptr [ebp+FFFFFE14]
:0053A3C4 8D8528FEFFFF lea eax, dword ptr [ebp+FFFFFE28]
:0053A3CA E8BD8BECFF call 00402F8C
:0053A3CF 8D8528FEFFFF lea eax, dword ptr [ebp+FFFFFE28]
:0053A3D5 E84E89ECFF call 00402D28
:0053A3DA E8A185ECFF call 00402980
:0053A3DF 8B55F4 mov edx, dword ptr [ebp-0C]
:0053A3E2 8D8528FEFFFF lea eax, dword ptr [ebp+FFFFFE28]
:0053A3E8 E82BB1ECFF call 00405518
:0053A3ED E8C695ECFF call 004039B8
:0053A3F2 E88985ECFF call 00402980
:0053A3F7 33C0 xor eax, eax
:0053A3F9 5A pop edx
:0053A3FA 59 pop ecx
:0053A3FB 59 pop ecx
:0053A3FC 648910 mov dword ptr fs:[eax], edx
:0053A3FF EB0A jmp 0053A40B
:0053A401 E956A0ECFF jmp 0040445C
:0053A406 E87DA4ECFF call 00404888
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0053A3FF(U)
|
:0053A40B 33C0 xor eax, eax
:0053A40D 5A pop edx
:0053A40E 59 pop ecx
:0053A40F 59 pop ecx
:0053A410 648910 mov dword ptr fs:[eax], edx
:0053A413 6830A45300 push 0053A430
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0053A42E(U)
|
:0053A418 8D8528FEFFFF lea eax, dword ptr [ebp+FFFFFE28]
:0053A41E E8E58CECFF call 00403108
:0053A423 E85885ECFF call 00402980
:0053A428 C3 ret
:0053A429 E9E2A2ECFF jmp 00404710
:0053A42E EBE8 jmp 0053A418
:0053A430 8B45FC mov eax, dword ptr [ebp-04]
:0053A433 E81CC9F1FF call 00456D54
* Possible StringData Ref from Code Obj ->"注册成功，谢谢使用！确定后重新启动程序"
|
:0053A438 BA20A55300 mov edx, 0053A520
:0053A43D B940000000 mov ecx, 00000040
:0053A442 E8CD0CFBFF call 004EB114
:0053A447 A1986A5400 mov eax, dword ptr [00546A98]
:0053A44C 8B00 mov eax, dword ptr [eax]
:0053A44E E89972F3FF call 004716EC
:0053A453 6A03 push 00000003
:0053A455 6A00 push 00000000
:0053A457 6A00 push 00000000
:0053A459 8D950CFEFFFF lea edx, dword ptr [ebp+FFFFFE0C]
:0053A45F A1986A5400 mov eax, dword ptr [00546A98]
:0053A464 8B00 mov eax, dword ptr [eax]
:0053A466 E86D77F3FF call 00471BD8
:0053A46B 8B850CFEFFFF mov eax, dword ptr [ebp+FFFFFE0C]
:0053A471 E886AEECFF call 004052FC
:0053A476 50 push eax
* Possible StringData Ref from Code Obj ->"open"
|
:0053A477 6848A55300 push 0053A548
:0053A47C 8B45FC mov eax, dword ptr [ebp-04]
:0053A47F E8D0C8F1FF call 00456D54
:0053A484 50 push eax
* Reference To: SHELL32.ShellExecuteA, Ord:0168h
|
:0053A485 E8DE51F0FF Call 0043F668
:0053A48A EB17 jmp 0053A4A3
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0053A369(C)
|
:0053A48C 8B45FC mov eax, dword ptr [ebp-04]
:0053A48F E8C0C8F1FF call 00456D54
* Possible StringData Ref from Code Obj ->"注册码不正确"
|
:0053A494 BAF4A45300 mov edx, 0053A4F4
:0053A499 B930000000 mov ecx, 00000030
:0053A49E E8710CFBFF call 004EB114
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0053A48A(U)
|
:0053A4A3 B201 mov dl, 01
:0053A4A5 8B45F8 mov eax, dword ptr [ebp-08]
:0053A4A8 E81713FBFF call 004EB7C4
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
