005C3030 50 push eax//进入OD后停在这
005C3031 60 pushad
005C3032 29C0 sub eax,eax
005C3034 64:FF30 push dword ptr fs:[eax]
005C3037 E8 00000000 call TrialCre.005C303C
00C62A51 CC int3
00C62A52 66:3D 0400 cmp ax,4
00C62A56 74 25 je short 00C62A7D
00C6106C FF15 0410C700 call dword ptr ds:[C71004]; kernel32.GetModuleHandleA
00C61072 85C0 test eax,eax//返回这里
00C61074 894424 14 mov dword ptr ss:[esp+14],eax
00C61078 75 13 jnz short 00C6108D
00C6107A 56 push esi
00C6107B FF15 9C10C700 call dword ptr ds:[C7109C]
00C61081 85C0 test eax,eax
00C61083 894424 14 mov dword ptr ss:[esp+14],eax
00C61087 0F84 92000000 je 00C6111F
00C6108D 8B4424 18 mov eax,dword ptr ss:[esp+18]
00C61091 8B7D 08 mov edi,dword ptr ss:[ebp+8]
00C61094 C74424 1C 00000000 mov dword ptr ss:[esp+1C],0
00C6109C 8B08 mov ecx,dword ptr ds:[eax]
00C6109E 8B45 00 mov eax,dword ptr ss:[ebp]
00C610A1 03F9 add edi,ecx
00C610A3 85C0 test eax,eax
00C610A5 76 49 jbe short 00C610F0
00C610A7 8D75 0C lea esi,dword ptr ss:[ebp+C]
00C610AA 8B06 mov eax,dword ptr ds:[esi]
00C610AC 3D 00000080 cmp eax,80000000
00C610B1 73 04 jnb short 00C610B7
00C610B3 03D8 add ebx,eax
00C610B5 EB 06 jmp short 00C610BD
00C610B7 8D98 00000080 lea ebx,dword ptr ds:[eax+80000000]
00C610BD 8A4E 04 mov cl,byte ptr ds:[esi+4]
00C610C0 8B5424 14 mov edx,dword ptr ss:[esp+14]
00C610C4 51 push ecx
00C610C5 8B4C24 1C mov ecx,dword ptr ss:[esp+1C]
00C610C9 53 push ebx
00C610CA 52 push edx
00C610CB E8 A0000000 call 00C61170//进入！★
00C610D0 85C0 test eax,eax
00C610D2 74 67 je short 00C6113B
00C610D4 8B5C24 24 mov ebx,dword ptr ss:[esp+24]
00C610D8 8907 mov dword ptr ds:[edi],eax//正确的函数写入
00C610DA 8B4424 1C mov eax,dword ptr ss:[esp+1C]
00C610DE 8B4D 00 mov ecx,dword ptr ss:[ebp]
00C610E1 83C7 04 add edi,4
00C610E4 40 inc eax
00C610E5 83C6 05 add esi,5
00C610E8 3BC1 cmp eax,ecx
00C610EA 894424 1C mov dword ptr ss:[esp+1C],eax
00C610EE 72 BA jb short 00C610AA
00C610F0 8B45 00 mov eax,dword ptr ss:[ebp]
00C610F3 8B7C24 10 mov edi,dword ptr ss:[esp+10]
00C610F7 8D0C28 lea ecx,dword ptr ds:[eax+ebp]
00C610FA 8D6C81 0C lea ebp,dword ptr ds:[ecx+eax*4+C]
00C610FE 8B4D 04 mov ecx,dword ptr ss:[ebp+4]
00C61101 85C9 test ecx,ecx
00C61103 8D45 04 lea eax,dword ptr ss:[ebp+4]
00C61106 0F85 5BFFFFFF jnz 00C61067//循环
00C6110C 57 push edi
00C6110D E8 F38C0000 call 00C69E05
00C61112 83C4 04 add esp,4
00C61115 5F pop edi
00C61116 5E pop esi
00C61117 5D pop ebp
00C61118 5B pop ebx
00C61119 83C4 10 add esp,10
00C6111C C2 0400 retn 4
00C61170 8B4424 08 mov eax,dword ptr ss:[esp+8]
00C61174 8B4C24 04 mov ecx,dword ptr ss:[esp+4]
00C61178 56 push esi
00C61179 50 push eax
00C6117A 51 push ecx
00C6117B FF15 0810C700 call dword ptr ds:[C71008]; kernel32.GetProcAddress
00C61181 8B5424 10 mov edx,dword ptr ss:[esp+10]
00C61185 8BF0 mov esi,eax
00C61187 81E2 FF000000 and edx,0FF
00C6118D 8D42 FF lea eax,dword ptr ds:[edx-1]
00C61190 83F8 03 cmp eax,3
00C61193 77 73 ja short 00C61208//Magic Jump 改为JMP ★
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
