魔术情书之去除5-ANTI_DEBUGGER代码过程-软件逆向-看雪-安全社区|安全招聘|kanxue.com

魔术情书之去除5-ANTI_DEBUGGER代码过程

发表于: 2004-9-21 21:58 7096

魔术情书之去除5-ANTI_DEBUGGER代码过程

pmma

2004-9-21 21:58

7096

【破解作者】 pmma
【作者邮箱】 [email]lyzhu110@163.com[/email]
【使用工具】 OLLYDBG1.10汉化版
【破解平台】 Win9x/NT/2000/XP
【软件名称】魔术情书 5
【软件简介】些情书的东东
【加壳方式】没有
【破解声明】只是对Crack感兴趣，失误之处敬请诸位大侠赐教！
--------------------------------------------------------------------------------
【破解内容】

OD载入，运行，竟然退出，有猫腻，看看，
00542BBA  |.  6A 00       PUSH 0                                  ; /lParam = 0
00542BBC  |.  68 640A5400 PUSH MSQingSh.00540A64 去看看                ; |Callback = MSQingSh.00540A64
00542BC1  |.  E8 B247ECFF CALL <JMP.&user32.EnumWindows>          ; \EnumWindows

好家伙，贼多的破解工具都上了黑名单了，记得好像有八十几个，作者就十BT类型的，但就我的实际跟踪过程看，
这里还不是重点，好像是骗人的，过了不久有一个call，跟进4－5层吧，又会看见一个EnumWindows，上面push的
地址很重要，下断，又是一连串的黑名单，简直是。。。我无语，这些说了简单，我可是跟了很辛苦，花了3－4个
小时搞定的，主要一直在第一个EnumWindows的push地址里面被困住了，明白即可。看看它刚才的垃圾代码
00540A64  /.  55          PUSH EBP
00540A65  |.  8BEC       MOV EBP,ESP
00540A67  |.  B9 69000000 MOV ECX,69
00540A6C  |>  6A 00       /PUSH 0
00540A6E  |.  6A 00       |PUSH 0
00540A70  |.  49          |DEC ECX
00540A71  |.^ 75 F9       \JNZ SHORT MSQingSh.00540A6C
00540A73  |.  51          PUSH ECX
00540A74  |.  53          PUSH EBX
00540A75  |.  56          PUSH ESI
00540A76  |.  8B75 08    MOV ESI,[ARG.1]
00540A79  |.  33C0       XOR EAX,EAX
00540A7B  |.  55          PUSH EBP
00540A7C  |.  68 14175400 PUSH MSQingSh.00541714
00540A81  |.  64:FF30    PUSH DWORD PTR FS:[EAX]
00540A84  |.  64:8920    MOV DWORD PTR FS:[EAX],ESP
00540A87  |.  68 FF000000 PUSH 0FF                               ; /Count = FF (255.)
00540A8C  |.  8D85 FCFEFFFF LEA EAX,[LOCAL.65]                      ; |
00540A92  |.  50          PUSH EAX                               ; |Buffer
00540A93  |.  56          PUSH ESI                               ; |hWnd
00540A94  |.  E8 A76AECFF CALL <JMP.&user32.GetWindowTextA>       ; \GetWindowTextA
00540A99  |.  85C0       TEST EAX,EAX                            ;  取得窗口标题
00540A9B  |.  7E 29       JLE SHORT MSQingSh.00540AC6
00540A9D  |.  68 FF000000 PUSH 0FF                               ; /Count = FF (255.)
00540AA2  |.  8D85 FCFDFFFF LEA EAX,[LOCAL.129]                   ; |
00540AA8  |.  50          PUSH EAX                               ; |Buffer
00540AA9  |.  56          PUSH ESI                               ; |hWnd
00540AAA  |.  E8 2169ECFF CALL <JMP.&user32.GetClassNameA>       ; \GetClassNameA
00540AAF  |.  85C0       TEST EAX,EAX                            得到窗口类的名称
00540AB1  |.  7E 13       JLE SHORT MSQingSh.00540AC6
00540AB3  |.  8D45 FC    LEA EAX,[LOCAL.1]
00540AB6  |.  8D95 FCFEFFFF LEA EDX,[LOCAL.65]
00540ABC  |.  B9 00010000 MOV ECX,100
00540AC1  |.  E8 5234ECFF CALL MSQingSh.00403F18
00540AC6  |>  8D95 F8FDFFFF LEA EDX,[LOCAL.130]
00540ACC  |.  B8 30175400 MOV EAX,MSQingSh.00541730
00540AD1  |.  E8 12FEFFFF CALL MSQingSh.005408E8
00540AD6  |.  8B95 F8FDFFFF MOV EDX,[LOCAL.130]                   ;  ExeSpy
00540ADC  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540ADF  |.  E8 A8FEFFFF CALL MSQingSh.0054098C
00540AE4  |.  84C0       TEST AL,AL
00540AE6  |.  0F85 F60B0000 JNZ MSQingSh.005416E2
00540AEC  |.  8D95 F4FDFFFF LEA EDX,[LOCAL.131]
00540AF2  |.  B8 40175400 MOV EAX,MSQingSh.00541740
00540AF7  |.  E8 ECFDFFFF CALL MSQingSh.005408E8
00540AFC  |.  8B95 F4FDFFFF MOV EDX,[LOCAL.131]                   ;  wxr95
00540B02  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540B05  |.  E8 82FEFFFF CALL MSQingSh.0054098C
00540B0A  |.  84C0       TEST AL,AL
00540B0C  |.  0F85 D00B0000 JNZ MSQingSh.005416E2
00540B12  |.  8D95 F0FDFFFF LEA EDX,[LOCAL.132]
00540B18  |.  B8 50175400 MOV EAX,MSQingSh.00541750
00540B1D  |.  E8 C6FDFFFF CALL MSQingSh.005408E8
00540B22  |.  8B95 F0FDFFFF MOV EDX,[LOCAL.132]                   ;  Regmon
00540B28  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540B2B  |.  E8 5CFEFFFF CALL MSQingSh.0054098C
00540B30  |.  84C0       TEST AL,AL
00540B32  |.  0F85 AA0B0000 JNZ MSQingSh.005416E2
00540B38  |.  8D95 ECFDFFFF LEA EDX,[LOCAL.133]
00540B3E  |.  B8 60175400 MOV EAX,MSQingSh.00541760
00540B43  |.  E8 A0FDFFFF CALL MSQingSh.005408E8
00540B48  |.  8B95 ECFDFFFF MOV EDX,[LOCAL.133]                   ;  Filemon
00540B4E  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540B51  |.  E8 36FEFFFF CALL MSQingSh.0054098C
00540B56  |.  84C0       TEST AL,AL
00540B58  |.  0F85 840B0000 JNZ MSQingSh.005416E2
00540B5E  |.  8D95 E8FDFFFF LEA EDX,[LOCAL.134]
00540B64  |.  B8 70175400 MOV EAX,MSQingSh.00541770
00540B69  |.  E8 7AFDFFFF CALL MSQingSh.005408E8
00540B6E  |.  8B95 E8FDFFFF MOV EDX,[LOCAL.134]                   ;  File Monitor
00540B74  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540B77  |.  E8 10FEFFFF CALL MSQingSh.0054098C
00540B7C  |.  84C0       TEST AL,AL
00540B7E  |.  0F85 5E0B0000 JNZ MSQingSh.005416E2
00540B84  |.  8D95 E4FDFFFF LEA EDX,[LOCAL.135]
00540B8A  |.  B8 88175400 MOV EAX,MSQingSh.00541788
00540B8F  |.  E8 54FDFFFF CALL MSQingSh.005408E8
00540B94  |.  8B95 E4FDFFFF MOV EDX,[LOCAL.135]                   ;  RegMonEx
00540B9A  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540B9D  |.  E8 EAFDFFFF CALL MSQingSh.0054098C
00540BA2  |.  84C0       TEST AL,AL
00540BA4  |.  0F85 380B0000 JNZ MSQingSh.005416E2
00540BAA  |.  8D95 E0FDFFFF LEA EDX,[LOCAL.136]
00540BB0  |.  B8 9C175400 MOV EAX,MSQingSh.0054179C
00540BB5  |.  E8 2EFDFFFF CALL MSQingSh.005408E8
00540BBA  |.  8B95 E0FDFFFF MOV EDX,[LOCAL.136]                   ;  Window Detective
00540BC0  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540BC3  |.  E8 C4FDFFFF CALL MSQingSh.0054098C
00540BC8  |.  84C0       TEST AL,AL
00540BCA  |.  0F85 120B0000 JNZ MSQingSh.005416E2
00540BD0  |.  8D95 DCFDFFFF LEA EDX,[LOCAL.137]
00540BD6  |.  B8 B8175400 MOV EAX,MSQingSh.005417B8
00540BDB  |.  E8 08FDFFFF CALL MSQingSh.005408E8
00540BE0  |.  8B95 DCFDFFFF MOV EDX,[LOCAL.137]                   ;  DebugView
00540BE6  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540BE9  |.  E8 9EFDFFFF CALL MSQingSh.0054098C
00540BEE  |.  84C0       TEST AL,AL
00540BF0  |.  0F85 EC0A0000 JNZ MSQingSh.005416E2
00540BF6  |.  8D95 D8FDFFFF LEA EDX,[LOCAL.138]
00540BFC  |.  B8 CC175400 MOV EAX,MSQingSh.005417CC
00540C01  |.  E8 E2FCFFFF CALL MSQingSh.005408E8
00540C06  |.  8B95 D8FDFFFF MOV EDX,[LOCAL.138]                   ;  ResSpy
00540C0C  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540C0F  |.  E8 78FDFFFF CALL MSQingSh.0054098C
00540C14  |.  84C0       TEST AL,AL
00540C16  |.  0F85 C60A0000 JNZ MSQingSh.005416E2
00540C1C  |.  8D95 D4FDFFFF LEA EDX,[LOCAL.139]
00540C22  |.  B8 DC175400 MOV EAX,MSQingSh.005417DC
00540C27  |.  E8 BCFCFFFF CALL MSQingSh.005408E8
00540C2C  |.  8B95 D4FDFFFF MOV EDX,[LOCAL.139]                   ;  Advanced Registry Tracer
00540C32  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540C35  |.  E8 52FDFFFF CALL MSQingSh.0054098C
00540C3A  |.  84C0       TEST AL,AL
00540C3C  |.  0F85 A00A0000 JNZ MSQingSh.005416E2
00540C42  |.  8D95 D0FDFFFF LEA EDX,[LOCAL.140]
00540C48  |.  B8 00185400 MOV EAX,MSQingSh.00541800
00540C4D  |.  E8 96FCFFFF CALL MSQingSh.005408E8
00540C52  |.  8B95 D0FDFFFF MOV EDX,[LOCAL.140]                   ;  regsnap
00540C58  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540C5B  |.  E8 2CFDFFFF CALL MSQingSh.0054098C
00540C60  |.  84C0       TEST AL,AL
00540C62  |.  0F85 7A0A0000 JNZ MSQingSh.005416E2
00540C68  |.  8D95 CCFDFFFF LEA EDX,[LOCAL.141]
00540C6E  |.  B8 10185400 MOV EAX,MSQingSh.00541810
00540C73  |.  E8 70FCFFFF CALL MSQingSh.005408E8
00540C78  |.  8B95 CCFDFFFF MOV EDX,[LOCAL.141]                   ;  MEMSPY
00540C7E  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540C81  |.  E8 06FDFFFF CALL MSQingSh.0054098C
00540C86  |.  84C0       TEST AL,AL
00540C88  |.  0F85 540A0000 JNZ MSQingSh.005416E2
00540C8E  |.  8D95 C8FDFFFF LEA EDX,[LOCAL.142]
00540C94  |.  B8 20185400 MOV EAX,MSQingSh.00541820
00540C99  |.  E8 4AFCFFFF CALL MSQingSh.005408E8
00540C9E  |.  8B95 C8FDFFFF MOV EDX,[LOCAL.142]                   ;  Memory Doctor
00540CA4  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540CA7  |.  E8 E0FCFFFF CALL MSQingSh.0054098C
00540CAC  |.  84C0       TEST AL,AL
00540CAE  |.  0F85 2E0A0000 JNZ MSQingSh.005416E2
00540CB4  |.  8D95 C4FDFFFF LEA EDX,[LOCAL.143]
00540CBA  |.  B8 38185400 MOV EAX,MSQingSh.00541838
00540CBF  |.  E8 24FCFFFF CALL MSQingSh.005408E8
00540CC4  |.  8B95 C4FDFFFF MOV EDX,[LOCAL.143]                   ;  ProcDump32
00540CCA  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540CCD  |.  E8 BAFCFFFF CALL MSQingSh.0054098C
00540CD2  |.  84C0       TEST AL,AL
00540CD4  |.  0F85 080A0000 JNZ MSQingSh.005416E2
00540CDA  |.  8D95 C0FDFFFF LEA EDX,[LOCAL.144]
00540CE0  |.  B8 4C185400 MOV EAX,MSQingSh.0054184C
00540CE5  |.  E8 FEFBFFFF CALL MSQingSh.005408E8
00540CEA  |.  8B95 C0FDFFFF MOV EDX,[LOCAL.144]                   ;  Memory Editor
00540CF0  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540CF3  |.  E8 94FCFFFF CALL MSQingSh.0054098C
00540CF8  |.  84C0       TEST AL,AL
00540CFA  |.  0F85 E2090000 JNZ MSQingSh.005416E2
00540D00  |.  8D95 BCFDFFFF LEA EDX,[LOCAL.145]
00540D06  |.  B8 64185400 MOV EAX,MSQingSh.00541864
00540D0B  |.  E8 D8FBFFFF CALL MSQingSh.005408E8
00540D10  |.  8B95 BCFDFFFF MOV EDX,[LOCAL.145]                   ;  FrogsICE
00540D16  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540D19  |.  E8 6EFCFFFF CALL MSQingSh.0054098C
00540D1E  |.  84C0       TEST AL,AL
00540D20  |.  0F85 BC090000 JNZ MSQingSh.005416E2
00540D26  |.  8D95 B8FDFFFF LEA EDX,[LOCAL.146]
00540D2C  |.  B8 78185400 MOV EAX,MSQingSh.00541878
00540D31  |.  E8 B2FBFFFF CALL MSQingSh.005408E8
00540D36  |.  8B95 B8FDFFFF MOV EDX,[LOCAL.146]                   ;  SMU Winspector
00540D3C  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540D3F  |.  E8 48FCFFFF CALL MSQingSh.0054098C
00540D44  |.  84C0       TEST AL,AL
00540D46  |.  0F85 96090000 JNZ MSQingSh.005416E2
00540D4C  |.  8D95 B4FDFFFF LEA EDX,[LOCAL.147]
00540D52  |.  B8 90185400 MOV EAX,MSQingSh.00541890
00540D57  |.  E8 8CFBFFFF CALL MSQingSh.005408E8
00540D5C  |.  8B95 B4FDFFFF MOV EDX,[LOCAL.147]                   ;  Memory Dumper
00540D62  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540D65  |.  E8 22FCFFFF CALL MSQingSh.0054098C
00540D6A  |.  84C0       TEST AL,AL
00540D6C  |.  0F85 70090000 JNZ MSQingSh.005416E2
00540D72  |.  8D95 B0FDFFFF LEA EDX,[LOCAL.148]
00540D78  |.  B8 A8185400 MOV EAX,MSQingSh.005418A8
00540D7D  |.  E8 66FBFFFF CALL MSQingSh.005408E8
00540D82  |.  8B95 B0FDFFFF MOV EDX,[LOCAL.148]                   ;  MemoryMonitor
00540D88  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540D8B  |.  E8 FCFBFFFF CALL MSQingSh.0054098C
00540D90  |.  84C0       TEST AL,AL
00540D92  |.  0F85 4A090000 JNZ MSQingSh.005416E2
00540D98  |.  8D95 ACFDFFFF LEA EDX,[LOCAL.149]
00540D9E  |.  B8 C0185400 MOV EAX,MSQingSh.005418C0
00540DA3  |.  E8 40FBFFFF CALL MSQingSh.005408E8
00540DA8  |.  8B95 ACFDFFFF MOV EDX,[LOCAL.149]                   ;  Memory Monitor
00540DAE  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540DB1  |.  E8 D6FBFFFF CALL MSQingSh.0054098C
00540DB6  |.  84C0       TEST AL,AL
00540DB8  |.  0F85 24090000 JNZ MSQingSh.005416E2
00540DBE  |.  8D95 A8FDFFFF LEA EDX,[LOCAL.150]
00540DC4  |.  B8 D8185400 MOV EAX,MSQingSh.005418D8
00540DC9  |.  E8 1AFBFFFF CALL MSQingSh.005408E8
00540DCE  |.  8B95 A8FDFFFF MOV EDX,[LOCAL.150]                   ;  URSoft W32Dasm
00540DD4  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540DD7  |.  E8 B0FBFFFF CALL MSQingSh.0054098C
00540DDC  |.  84C0       TEST AL,AL
00540DDE  |.  0F85 FE080000 JNZ MSQingSh.005416E2
00540DE4  |.  8D95 A4FDFFFF LEA EDX,[LOCAL.151]
00540DEA  |.  B8 F0185400 MOV EAX,MSQingSh.005418F0
00540DEF  |.  E8 F4FAFFFF CALL MSQingSh.005408E8
00540DF4  |.  8B95 A4FDFFFF MOV EDX,[LOCAL.151]                   ;  URSoft
00540DFA  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540DFD  |.  E8 8AFBFFFF CALL MSQingSh.0054098C
00540E02  |.  84C0       TEST AL,AL
00540E04  |.  0F85 D8080000 JNZ MSQingSh.005416E2
00540E0A  |.  8D95 A0FDFFFF LEA EDX,[LOCAL.152]
00540E10  |.  B8 00195400 MOV EAX,MSQingSh.00541900
00540E15  |.  E8 CEFAFFFF CALL MSQingSh.005408E8
00540E1A  |.  8B95 A0FDFFFF MOV EDX,[LOCAL.152]                   ;  NuMega SoftICE Loader
00540E20  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540E23  |.  E8 64FBFFFF CALL MSQingSh.0054098C
00540E28  |.  84C0       TEST AL,AL
00540E2A  |.  0F85 B2080000 JNZ MSQingSh.005416E2
00540E30  |.  8D95 9CFDFFFF LEA EDX,[LOCAL.153]
00540E36  |.  B8 20195400 MOV EAX,MSQingSh.00541920
00540E3B  |.  E8 A8FAFFFF CALL MSQingSh.005408E8
00540E40  |.  8B95 9CFDFFFF MOV EDX,[LOCAL.153]                   ;  NuMega
00540E46  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540E49  |.  E8 3EFBFFFF CALL MSQingSh.0054098C
00540E4E  |.  84C0       TEST AL,AL
00540E50  |.  0F85 8C080000 JNZ MSQingSh.005416E2
00540E56  |.  8D95 98FDFFFF LEA EDX,[LOCAL.154]
00540E5C  |.  B8 30195400 MOV EAX,MSQingSh.00541930
00540E61  |.  E8 82FAFFFF CALL MSQingSh.005408E8
00540E66  |.  8B95 98FDFFFF MOV EDX,[LOCAL.154]                   ;  TRW2000 for Windows 9x
00540E6C  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540E6F  |.  E8 18FBFFFF CALL MSQingSh.0054098C
00540E74  |.  84C0       TEST AL,AL
00540E76  |.  0F85 66080000 JNZ MSQingSh.005416E2
00540E7C  |.  8D95 94FDFFFF LEA EDX,[LOCAL.155]
00540E82  |.  B8 50195400 MOV EAX,MSQingSh.00541950
00540E87  |.  E8 5CFAFFFF CALL MSQingSh.005408E8
00540E8C  |.  8B95 94FDFFFF MOV EDX,[LOCAL.155]                   ;  TRW2000
00540E92  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540E95  |.  E8 F2FAFFFF CALL MSQingSh.0054098C
00540E9A  |.  84C0       TEST AL,AL
00540E9C  |.  0F85 40080000 JNZ MSQingSh.005416E2
00540EA2  |.  8D95 90FDFFFF LEA EDX,[LOCAL.156]
00540EA8  |.  B8 60195400 MOV EAX,MSQingSh.00541960
00540EAD  |.  E8 36FAFFFF CALL MSQingSh.005408E8
00540EB2  |.  8B95 90FDFFFF MOV EDX,[LOCAL.156]                   ;  aspack
00540EB8  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540EBB  |.  E8 CCFAFFFF CALL MSQingSh.0054098C
00540EC0  |.  84C0       TEST AL,AL
00540EC2  |.  0F85 1A080000 JNZ MSQingSh.005416E2
00540EC8  |.  8D95 8CFDFFFF LEA EDX,[LOCAL.157]
00540ECE  |.  B8 70195400 MOV EAX,MSQingSh.00541970
00540ED3  |.  E8 10FAFFFF CALL MSQingSh.005408E8
00540ED8  |.  8B95 8CFDFFFF MOV EDX,[LOCAL.157]                   ;  SoftICE
00540EDE  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540EE1  |.  E8 A6FAFFFF CALL MSQingSh.0054098C
00540EE6  |.  84C0       TEST AL,AL
00540EE8  |.  0F85 F4070000 JNZ MSQingSh.005416E2
00540EEE  |.  8D95 88FDFFFF LEA EDX,[LOCAL.158]
00540EF4  |.  B8 80195400 MOV EAX,MSQingSh.00541980
00540EF9  |.  E8 EAF9FFFF CALL MSQingSh.005408E8
00540EFE  |.  8B95 88FDFFFF MOV EDX,[LOCAL.158]                   ;  SmartCheck
00540F04  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540F07  |.  E8 80FAFFFF CALL MSQingSh.0054098C
00540F0C  |.  84C0       TEST AL,AL
00540F0E  |.  0F85 CE070000 JNZ MSQingSh.005416E2
00540F14  |.  8D95 84FDFFFF LEA EDX,[LOCAL.159]
00540F1A  |.  B8 94195400 MOV EAX,MSQingSh.00541994
00540F1F  |.  E8 C4F9FFFF CALL MSQingSh.005408E8
00540F24  |.  8B95 84FDFFFF MOV EDX,[LOCAL.159]                   ;  SoftSnoop
00540F2A  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540F2D  |.  E8 5AFAFFFF CALL MSQingSh.0054098C
00540F32  |.  84C0       TEST AL,AL
00540F34  |.  0F85 A8070000 JNZ MSQingSh.005416E2
00540F3A  |.  8D95 80FDFFFF LEA EDX,[LOCAL.160]
00540F40  |.  B8 A8195400 MOV EAX,MSQingSh.005419A8
00540F45  |.  E8 9EF9FFFF CALL MSQingSh.005408E8
00540F4A  |.  8B95 80FDFFFF MOV EDX,[LOCAL.160]                   ;  OllyDbg
00540F50  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540F53  |.  E8 34FAFFFF CALL MSQingSh.0054098C
00540F58  |.  84C0       TEST AL,AL
00540F5A  |.  0F85 82070000 JNZ MSQingSh.005416E2
00540F60  |.  8D95 7CFDFFFF LEA EDX,[LOCAL.161]
00540F66  |.  B8 B8195400 MOV EAX,MSQingSh.005419B8
00540F6B  |.  E8 78F9FFFF CALL MSQingSh.005408E8
00540F70  |.  8B95 7CFDFFFF MOV EDX,[LOCAL.161]                   ;  Debugger
00540F76  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540F79  |.  E8 0EFAFFFF CALL MSQingSh.0054098C
00540F7E  |.  84C0       TEST AL,AL
00540F80  |.  0F85 5C070000 JNZ MSQingSh.005416E2
00540F86  |.  8D95 78FDFFFF LEA EDX,[LOCAL.162]
00540F8C  |.  B8 CC195400 MOV EAX,MSQingSh.005419CC
00540F91  |.  E8 52F9FFFF CALL MSQingSh.005408E8
00540F96  |.  8B95 78FDFFFF MOV EDX,[LOCAL.162]                   ;  Z-Tracer
00540F9C  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540F9F  |.  E8 E8F9FFFF CALL MSQingSh.0054098C
00540FA4  |.  84C0       TEST AL,AL
00540FA6  |.  0F85 36070000 JNZ MSQingSh.005416E2
00540FAC  |.  8D95 74FDFFFF LEA EDX,[LOCAL.163]
00540FB2  |.  B8 E0195400 MOV EAX,MSQingSh.005419E0
00540FB7  |.  E8 2CF9FFFF CALL MSQingSh.005408E8
00540FBC  |.  8B95 74FDFFFF MOV EDX,[LOCAL.163]                   ;  DeGlucker
00540FC2  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540FC5  |.  E8 C2F9FFFF CALL MSQingSh.0054098C
00540FCA  |.  84C0       TEST AL,AL
00540FCC  |.  0F85 10070000 JNZ MSQingSh.005416E2
00540FD2  |.  8D95 70FDFFFF LEA EDX,[LOCAL.164]
00540FD8  |.  B8 F4195400 MOV EAX,MSQingSh.005419F4
00540FDD  |.  E8 06F9FFFF CALL MSQingSh.005408E8
00540FE2  |.  8B95 70FDFFFF MOV EDX,[LOCAL.164]                   ;  YDEBUG
00540FE8  |.  8B45 FC    MOV EAX,[LOCAL.1]
00540FEB  |.  E8 9CF9FFFF CALL MSQingSh.0054098C
00540FF0  |.  84C0       TEST AL,AL
00540FF2  |.  0F85 EA060000 JNZ MSQingSh.005416E2
00540FF8  |.  8D95 6CFDFFFF LEA EDX,[LOCAL.165]
00540FFE  |.  B8 041A5400 MOV EAX,MSQingSh.00541A04
00541003  |.  E8 E0F8FFFF CALL MSQingSh.005408E8
00541008  |.  8B95 6CFDFFFF MOV EDX,[LOCAL.165]                   ;  Servile Software Decoder
0054100E  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541011  |.  E8 76F9FFFF CALL MSQingSh.0054098C
00541016  |.  84C0       TEST AL,AL
00541018  |.  0F85 C4060000 JNZ MSQingSh.005416E2
0054101E  |.  8D95 68FDFFFF LEA EDX,[LOCAL.166]
00541024  |.  B8 281A5400 MOV EAX,MSQingSh.00541A28
00541029  |.  E8 BAF8FFFF CALL MSQingSh.005408E8
0054102E  |.  8B95 68FDFFFF MOV EDX,[LOCAL.166]                   ;  GT2000
00541034  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541037  |.  E8 50F9FFFF CALL MSQingSh.0054098C
0054103C  |.  84C0       TEST AL,AL
0054103E  |.  0F85 9E060000 JNZ MSQingSh.005416E2
00541044  |.  8D95 64FDFFFF LEA EDX,[LOCAL.167]
0054104A  |.  B8 381A5400 MOV EAX,MSQingSh.00541A38
0054104F  |.  E8 94F8FFFF CALL MSQingSh.005408E8
00541054  |.  8B95 64FDFFFF MOV EDX,[LOCAL.167]                   ;  File Analyzer
0054105A  |.  8B45 FC    MOV EAX,[LOCAL.1]
0054105D  |.  E8 2AF9FFFF CALL MSQingSh.0054098C
00541062  |.  84C0       TEST AL,AL
00541064  |.  0F85 78060000 JNZ MSQingSh.005416E2
0054106A  |.  8D95 60FDFFFF LEA EDX,[LOCAL.168]
00541070  |.  B8 501A5400 MOV EAX,MSQingSh.00541A50
00541075  |.  E8 6EF8FFFF CALL MSQingSh.005408E8
0054107A  |.  8B95 60FDFFFF MOV EDX,[LOCAL.168]                   ;  File Scanner
00541080  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541083  |.  E8 04F9FFFF CALL MSQingSh.0054098C
00541088  |.  84C0       TEST AL,AL
0054108A  |.  0F85 52060000 JNZ MSQingSh.005416E2
00541090  |.  8D95 5CFDFFFF LEA EDX,[LOCAL.169]
00541096  |.  B8 681A5400 MOV EAX,MSQingSh.00541A68
0054109B  |.  E8 48F8FFFF CALL MSQingSh.005408E8
005410A0  |.  8B95 5CFDFFFF MOV EDX,[LOCAL.169]                   ;  pe-scan
005410A6  |.  8B45 FC    MOV EAX,[LOCAL.1]
005410A9  |.  E8 DEF8FFFF CALL MSQingSh.0054098C
005410AE  |.  84C0       TEST AL,AL
005410B0  |.  0F85 2C060000 JNZ MSQingSh.005416E2
005410B6  |.  8D95 58FDFFFF LEA EDX,[LOCAL.170]
005410BC  |.  B8 781A5400 MOV EAX,MSQingSh.00541A78
005410C1  |.  E8 22F8FFFF CALL MSQingSh.005408E8
005410C6  |.  8B95 58FDFFFF MOV EDX,[LOCAL.170]                   ;  Intruder
005410CC  |.  8B45 FC    MOV EAX,[LOCAL.1]
005410CF  |.  E8 B8F8FFFF CALL MSQingSh.0054098C
005410D4  |.  84C0       TEST AL,AL
005410D6  |.  0F85 06060000 JNZ MSQingSh.005416E2
005410DC  |.  8D95 54FDFFFF LEA EDX,[LOCAL.171]
005410E2  |.  B8 8C1A5400 MOV EAX,MSQingSh.00541A8C
005410E7  |.  E8 FCF7FFFF CALL MSQingSh.005408E8
005410EC  |.  8B95 54FDFFFF MOV EDX,[LOCAL.171]                   ;  asprotect
005410F2  |.  8B45 FC    MOV EAX,[LOCAL.1]
005410F5  |.  E8 92F8FFFF CALL MSQingSh.0054098C
005410FA  |.  84C0       TEST AL,AL
005410FC  |.  0F85 E0050000 JNZ MSQingSh.005416E2
00541102  |.  8D95 50FDFFFF LEA EDX,[LOCAL.172]
00541108  |.  B8 A01A5400 MOV EAX,MSQingSh.00541AA0
0054110D  |.  E8 D6F7FFFF CALL MSQingSh.005408E8
00541112  |.  8B95 50FDFFFF MOV EDX,[LOCAL.172]                   ;  PE Identifier
00541118  |.  8B45 FC    MOV EAX,[LOCAL.1]
0054111B  |.  E8 6CF8FFFF CALL MSQingSh.0054098C
00541120  |.  84C0       TEST AL,AL
00541122  |.  0F85 BA050000 JNZ MSQingSh.005416E2
00541128  |.  8D95 4CFDFFFF LEA EDX,[LOCAL.173]
0054112E  |.  B8 B81A5400 MOV EAX,MSQingSh.00541AB8
00541133  |.  E8 B0F7FFFF CALL MSQingSh.005408E8
00541138  |.  8B95 4CFDFFFF MOV EDX,[LOCAL.173]                   ;  Amon's File
0054113E  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541141  |.  E8 46F8FFFF CALL MSQingSh.0054098C
00541146  |.  84C0       TEST AL,AL
00541148  |.  0F85 94050000 JNZ MSQingSh.005416E2
0054114E  |.  8D95 48FDFFFF LEA EDX,[LOCAL.174]
00541154  |.  B8 CC1A5400 MOV EAX,MSQingSh.00541ACC
00541159  |.  E8 8AF7FFFF CALL MSQingSh.005408E8
0054115E  |.  8B95 48FDFFFF MOV EDX,[LOCAL.174]                   ;  EXESCAN
00541164  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541167  |.  E8 20F8FFFF CALL MSQingSh.0054098C
0054116C  |.  84C0       TEST AL,AL
0054116E  |.  0F85 6E050000 JNZ MSQingSh.005416E2
00541174  |.  8D95 44FDFFFF LEA EDX,[LOCAL.175]
0054117A  |.  B8 DC1A5400 MOV EAX,MSQingSh.00541ADC
0054117F  |.  E8 64F7FFFF CALL MSQingSh.005408E8
00541184  |.  8B95 44FDFFFF MOV EDX,[LOCAL.175]                   ;  ChkExe
0054118A  |.  8B45 FC    MOV EAX,[LOCAL.1]
0054118D  |.  E8 FAF7FFFF CALL MSQingSh.0054098C
00541192  |.  84C0       TEST AL,AL
00541194  |.  0F85 48050000 JNZ MSQingSh.005416E2
0054119A  |.  8D95 40FDFFFF LEA EDX,[LOCAL.176]
005411A0  |.  B8 EC1A5400 MOV EAX,MSQingSh.00541AEC
005411A5  |.  E8 3EF7FFFF CALL MSQingSh.005408E8
005411AA  |.  8B95 40FDFFFF MOV EDX,[LOCAL.176]                   ;  Analyzer
005411B0  |.  8B45 FC    MOV EAX,[LOCAL.1]
005411B3  |.  E8 D4F7FFFF CALL MSQingSh.0054098C
005411B8  |.  84C0       TEST AL,AL
005411BA  |.  0F85 22050000 JNZ MSQingSh.005416E2
005411C0  |.  8D95 3CFDFFFF LEA EDX,[LOCAL.177]
005411C6  |.  B8 001B5400 MOV EAX,MSQingSh.00541B00
005411CB  |.  E8 18F7FFFF CALL MSQingSh.005408E8
005411D0  |.  8B95 3CFDFFFF MOV EDX,[LOCAL.177]                   ;  Filespy
005411D6  |.  8B45 FC    MOV EAX,[LOCAL.1]
005411D9  |.  E8 AEF7FFFF CALL MSQingSh.0054098C
005411DE  |.  84C0       TEST AL,AL
005411E0  |.  0F85 FC040000 JNZ MSQingSh.005416E2
005411E6  |.  8D95 38FDFFFF LEA EDX,[LOCAL.178]
005411EC  |.  B8 101B5400 MOV EAX,MSQingSh.00541B10
005411F1  |.  E8 F2F6FFFF CALL MSQingSh.005408E8
005411F6  |.  8B95 38FDFFFF MOV EDX,[LOCAL.178]                   ;  EXEInfo
005411FC  |.  8B45 FC    MOV EAX,[LOCAL.1]
005411FF  |.  E8 88F7FFFF CALL MSQingSh.0054098C
00541204  |.  84C0       TEST AL,AL
00541206  |.  0F85 D6040000 JNZ MSQingSh.005416E2
0054120C  |.  8D95 34FDFFFF LEA EDX,[LOCAL.179]
00541212  |.  B8 201B5400 MOV EAX,MSQingSh.00541B20
00541217  |.  E8 CCF6FFFF CALL MSQingSh.005408E8
0054121C  |.  8B95 34FDFFFF MOV EDX,[LOCAL.179]                   ;  Pe-sniffer
00541222  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541225  |.  E8 62F7FFFF CALL MSQingSh.0054098C
0054122A  |.  84C0       TEST AL,AL
0054122C  |.  0F85 B0040000 JNZ MSQingSh.005416E2
00541232  |.  8D95 30FDFFFF LEA EDX,[LOCAL.180]
00541238  |.  B8 341B5400 MOV EAX,MSQingSh.00541B34
0054123D  |.  E8 A6F6FFFF CALL MSQingSh.005408E8
00541242  |.  8B95 30FDFFFF MOV EDX,[LOCAL.180]                   ;  mscic
00541248  |.  8B45 FC    MOV EAX,[LOCAL.1]
0054124B  |.  E8 3CF7FFFF CALL MSQingSh.0054098C
00541250  |.  84C0       TEST AL,AL
00541252  |.  0F85 8A040000 JNZ MSQingSh.005416E2
00541258  |.  8D95 2CFDFFFF LEA EDX,[LOCAL.181]
0054125E  |.  B8 441B5400 MOV EAX,MSQingSh.00541B44
00541263  |.  E8 80F6FFFF CALL MSQingSh.005408E8
00541268  |.  8B95 2CFDFFFF MOV EDX,[LOCAL.181]                   ;  infoExe
0054126E  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541271  |.  E8 16F7FFFF CALL MSQingSh.0054098C
00541276  |.  84C0       TEST AL,AL
00541278  |.  0F85 64040000 JNZ MSQingSh.005416E2
0054127E  |.  8D95 28FDFFFF LEA EDX,[LOCAL.182]
00541284  |.  B8 541B5400 MOV EAX,MSQingSh.00541B54
00541289  |.  E8 5AF6FFFF CALL MSQingSh.005408E8
0054128E  |.  8B95 28FDFFFF MOV EDX,[LOCAL.182]                   ;  PEACE
00541294  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541297  |.  E8 F0F6FFFF CALL MSQingSh.0054098C
0054129C  |.  84C0       TEST AL,AL
0054129E  |.  0F85 3E040000 JNZ MSQingSh.005416E2
005412A4  |.  8D95 24FDFFFF LEA EDX,[LOCAL.183]
005412AA  |.  B8 641B5400 MOV EAX,MSQingSh.00541B64
005412AF  |.  E8 34F6FFFF CALL MSQingSh.005408E8
005412B4  |.  8B95 24FDFFFF MOV EDX,[LOCAL.183]                   ;  PEWizard
005412BA  |.  8B45 FC    MOV EAX,[LOCAL.1]
005412BD  |.  E8 CAF6FFFF CALL MSQingSh.0054098C
005412C2  |.  84C0       TEST AL,AL
005412C4  |.  0F85 18040000 JNZ MSQingSh.005416E2
005412CA  |.  8D95 20FDFFFF LEA EDX,[LOCAL.184]
005412D0  |.  B8 781B5400 MOV EAX,MSQingSh.00541B78
005412D5  |.  E8 0EF6FFFF CALL MSQingSh.005408E8
005412DA  |.  8B95 20FDFFFF MOV EDX,[LOCAL.184]                   ;  EDump
005412E0  |.  8B45 FC    MOV EAX,[LOCAL.1]
005412E3  |.  E8 A4F6FFFF CALL MSQingSh.0054098C
005412E8  |.  84C0       TEST AL,AL
005412EA  |.  0F85 F2030000 JNZ MSQingSh.005416E2
005412F0  |.  8D95 1CFDFFFF LEA EDX,[LOCAL.185]
005412F6  |.  B8 881B5400 MOV EAX,MSQingSh.00541B88
005412FB  |.  E8 E8F5FFFF CALL MSQingSh.005408E8
00541300  |.  8B95 1CFDFFFF MOV EDX,[LOCAL.185]                   ;  Blast Wave
00541306  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541309  |.  E8 7EF6FFFF CALL MSQingSh.0054098C
0054130E  |.  84C0       TEST AL,AL
00541310  |.  0F85 CC030000 JNZ MSQingSh.005416E2
00541316  |.  8D95 18FDFFFF LEA EDX,[LOCAL.186]
0054131C  |.  B8 9C1B5400 MOV EAX,MSQingSh.00541B9C
00541321  |.  E8 C2F5FFFF CALL MSQingSh.005408E8
00541326  |.  8B95 18FDFFFF MOV EDX,[LOCAL.186]                   ;  ICEUNP
0054132C  |.  8B45 FC    MOV EAX,[LOCAL.1]
0054132F  |.  E8 58F6FFFF CALL MSQingSh.0054098C
00541334  |.  84C0       TEST AL,AL
00541336  |.  0F85 A6030000 JNZ MSQingSh.005416E2
0054133C  |.  8D95 14FDFFFF LEA EDX,[LOCAL.187]
00541342  |.  B8 AC1B5400 MOV EAX,MSQingSh.00541BAC
00541347  |.  E8 9CF5FFFF CALL MSQingSh.005408E8
0054134C  |.  8B95 14FDFFFF MOV EDX,[LOCAL.187]                   ;  Dumper
00541352  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541355  |.  E8 32F6FFFF CALL MSQingSh.0054098C
0054135A  |.  84C0       TEST AL,AL
0054135C  |.  0F85 80030000 JNZ MSQingSh.005416E2
00541362  |.  8D95 10FDFFFF LEA EDX,[LOCAL.188]
00541368  |.  B8 BC1B5400 MOV EAX,MSQingSh.00541BBC
0054136D  |.  E8 76F5FFFF CALL MSQingSh.005408E8
00541372  |.  8B95 10FDFFFF MOV EDX,[LOCAL.188]                   ;  UNSHELL
00541378  |.  8B45 FC    MOV EAX,[LOCAL.1]
0054137B  |.  E8 0CF6FFFF CALL MSQingSh.0054098C
00541380  |.  84C0       TEST AL,AL
00541382  |.  0F85 5A030000 JNZ MSQingSh.005416E2
00541388  |.  8D95 0CFDFFFF LEA EDX,[LOCAL.189]
0054138E  |.  B8 CC1B5400 MOV EAX,MSQingSh.00541BCC
00541393  |.  E8 50F5FFFF CALL MSQingSh.005408E8
00541398  |.  8B95 0CFDFFFF MOV EDX,[LOCAL.189]                   ;  ENTPACK
0054139E  |.  8B45 FC    MOV EAX,[LOCAL.1]
005413A1  |.  E8 E6F5FFFF CALL MSQingSh.0054098C
005413A6  |.  84C0       TEST AL,AL
005413A8  |.  0F85 34030000 JNZ MSQingSh.005416E2
005413AE  |.  8D95 08FDFFFF LEA EDX,[LOCAL.190]
005413B4  |.  B8 DC1B5400 MOV EAX,MSQingSh.00541BDC
005413B9  |.  E8 2AF5FFFF CALL MSQingSh.005408E8
005413BE  |.  8B95 08FDFFFF MOV EDX,[LOCAL.190]                   ;  X-Tract
005413C4  |.  8B45 FC    MOV EAX,[LOCAL.1]
005413C7  |.  E8 C0F5FFFF CALL MSQingSh.0054098C
005413CC  |.  84C0       TEST AL,AL
005413CE  |.  0F85 0E030000 JNZ MSQingSh.005416E2
005413D4  |.  8D95 04FDFFFF LEA EDX,[LOCAL.191]
005413DA  |.  B8 EC1B5400 MOV EAX,MSQingSh.00541BEC
005413DF  |.  E8 04F5FFFF CALL MSQingSh.005408E8
005413E4  |.  8B95 04FDFFFF MOV EDX,[LOCAL.191]                   ;  TRON
005413EA  |.  8B45 FC    MOV EAX,[LOCAL.1]
005413ED  |.  E8 9AF5FFFF CALL MSQingSh.0054098C
005413F2  |.  84C0       TEST AL,AL
005413F4  |.  0F85 E8020000 JNZ MSQingSh.005416E2
005413FA  |.  8D95 00FDFFFF LEA EDX,[LOCAL.192]
00541400  |.  B8 FC1B5400 MOV EAX,MSQingSh.00541BFC
00541405  |.  E8 DEF4FFFF CALL MSQingSh.005408E8
0054140A  |.  8B95 00FDFFFF MOV EDX,[LOCAL.192]                   ;  GetExe
00541410  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541413  |.  E8 74F5FFFF CALL MSQingSh.0054098C
00541418  |.  84C0       TEST AL,AL
0054141A  |.  0F85 C2020000 JNZ MSQingSh.005416E2
00541420  |.  8D95 FCFCFFFF LEA EDX,[LOCAL.193]
00541426  |.  B8 0C1C5400 MOV EAX,MSQingSh.00541C0C
0054142B  |.  E8 B8F4FFFF CALL MSQingSh.005408E8
00541430  |.  8B95 FCFCFFFF MOV EDX,[LOCAL.193]                   ;  Ripper
00541436  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541439  |.  E8 4EF5FFFF CALL MSQingSh.0054098C
0054143E  |.  84C0       TEST AL,AL
00541440  |.  0F85 9C020000 JNZ MSQingSh.005416E2
00541446  |.  8D95 F8FCFFFF LEA EDX,[LOCAL.194]
0054144C  |.  B8 1C1C5400 MOV EAX,MSQingSh.00541C1C
00541451  |.  E8 92F4FFFF CALL MSQingSh.005408E8
00541456  |.  8B95 F8FCFFFF MOV EDX,[LOCAL.194]                   ;  ExeShape
0054145C  |.  8B45 FC    MOV EAX,[LOCAL.1]
0054145F  |.  E8 28F5FFFF CALL MSQingSh.0054098C
00541464  |.  84C0       TEST AL,AL
00541466  |.  0F85 76020000 JNZ MSQingSh.005416E2
0054146C  |.  8D95 F4FCFFFF LEA EDX,[LOCAL.195]
00541472  |.  B8 301C5400 MOV EAX,MSQingSh.00541C30
00541477  |.  E8 6CF4FFFF CALL MSQingSh.005408E8
0054147C  |.  8B95 F4FCFFFF MOV EDX,[LOCAL.195]                   ;  UNEXE
00541482  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541485  |.  E8 02F5FFFF CALL MSQingSh.0054098C
0054148A  |.  84C0       TEST AL,AL
0054148C  |.  0F85 50020000 JNZ MSQingSh.005416E2
00541492  |.  8D95 F0FCFFFF LEA EDX,[LOCAL.196]
00541498  |.  B8 401C5400 MOV EAX,MSQingSh.00541C40
0054149D  |.  E8 46F4FFFF CALL MSQingSh.005408E8
005414A2  |.  8B95 F0FCFFFF MOV EDX,[LOCAL.196]                   ;  ABKDE
005414A8  |.  8B45 FC    MOV EAX,[LOCAL.1]
005414AB  |.  E8 DCF4FFFF CALL MSQingSh.0054098C
005414B0  |.  84C0       TEST AL,AL
005414B2  |.  0F85 2A020000 JNZ MSQingSh.005416E2
005414B8  |.  8D95 ECFCFFFF LEA EDX,[LOCAL.197]
005414BE  |.  B8 501C5400 MOV EAX,MSQingSh.00541C50
005414C3  |.  E8 20F4FFFF CALL MSQingSh.005408E8
005414C8  |.  8B95 ECFCFFFF MOV EDX,[LOCAL.197]                   ;  UnROSE
005414CE  |.  8B45 FC    MOV EAX,[LOCAL.1]
005414D1  |.  E8 B6F4FFFF CALL MSQingSh.0054098C
005414D6  |.  84C0       TEST AL,AL
005414D8  |.  0F85 04020000 JNZ MSQingSh.005416E2
005414DE  |.  8D95 E8FCFFFF LEA EDX,[LOCAL.198]
005414E4  |.  B8 601C5400 MOV EAX,MSQingSh.00541C60
005414E9  |.  E8 FAF3FFFF CALL MSQingSh.005408E8
005414EE  |.  8B95 E8FCFFFF MOV EDX,[LOCAL.198]                   ;  unpack
005414F4  |.  8B45 FC    MOV EAX,[LOCAL.1]
005414F7  |.  E8 90F4FFFF CALL MSQingSh.0054098C
005414FC  |.  84C0       TEST AL,AL
005414FE  |.  0F85 DE010000 JNZ MSQingSh.005416E2
00541504  |.  8D95 E4FCFFFF LEA EDX,[LOCAL.199]
0054150A  |.  B8 701C5400 MOV EAX,MSQingSh.00541C70
0054150F  |.  E8 D4F3FFFF CALL MSQingSh.005408E8
00541514  |.  8B95 E4FCFFFF MOV EDX,[LOCAL.199]                   ;  COMUNP
0054151A  |.  8B45 FC    MOV EAX,[LOCAL.1]
0054151D  |.  E8 6AF4FFFF CALL MSQingSh.0054098C
00541522  |.  84C0       TEST AL,AL
00541524  |.  0F85 B8010000 JNZ MSQingSh.005416E2
0054152A  |.  8D95 E0FCFFFF LEA EDX,[LOCAL.200]
00541530  |.  B8 801C5400 MOV EAX,MSQingSh.00541C80
00541535  |.  E8 AEF3FFFF CALL MSQingSh.005408E8
0054153A  |.  8B95 E0FCFFFF MOV EDX,[LOCAL.200]                   ;  CRACK
00541540  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541543  |.  E8 44F4FFFF CALL MSQingSh.0054098C
00541548  |.  84C0       TEST AL,AL
0054154A  |.  0F85 92010000 JNZ MSQingSh.005416E2
00541550  |.  8D95 DCFCFFFF LEA EDX,[LOCAL.201]
00541556  |.  B8 901C5400 MOV EAX,MSQingSh.00541C90
0054155B  |.  E8 88F3FFFF CALL MSQingSh.005408E8
00541560  |.  8B95 DCFCFFFF MOV EDX,[LOCAL.201]                   ;  Un-Pack
00541566  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541569  |.  E8 1EF4FFFF CALL MSQingSh.0054098C
0054156E  |.  84C0       TEST AL,AL
00541570  |.  0F85 6C010000 JNZ MSQingSh.005416E2
00541576  |.  8D95 D8FCFFFF LEA EDX,[LOCAL.202]
0054157C  |.  B8 A01C5400 MOV EAX,MSQingSh.00541CA0
00541581  |.  E8 62F3FFFF CALL MSQingSh.005408E8
00541586  |.  8B95 D8FCFFFF MOV EDX,[LOCAL.202]                   ;  ExeManager
0054158C  |.  8B45 FC    MOV EAX,[LOCAL.1]
0054158F  |.  E8 F8F3FFFF CALL MSQingSh.0054098C
00541594  |.  84C0       TEST AL,AL
00541596  |.  0F85 46010000 JNZ MSQingSh.005416E2
0054159C  |.  8D95 D4FCFFFF LEA EDX,[LOCAL.203]
005415A2  |.  B8 B41C5400 MOV EAX,MSQingSh.00541CB4
005415A7  |.  E8 3CF3FFFF CALL MSQingSh.005408E8
005415AC  |.  8B95 D4FCFFFF MOV EDX,[LOCAL.203]                   ;  Unprotector
005415B2  |.  8B45 FC    MOV EAX,[LOCAL.1]
005415B5  |.  E8 D2F3FFFF CALL MSQingSh.0054098C
005415BA  |.  84C0       TEST AL,AL
005415BC  |.  0F85 20010000 JNZ MSQingSh.005416E2
005415C2  |.  8D95 D0FCFFFF LEA EDX,[LOCAL.204]
005415C8  |.  B8 C81C5400 MOV EAX,MSQingSh.00541CC8
005415CD  |.  E8 16F3FFFF CALL MSQingSh.005408E8
005415D2  |.  8B95 D0FCFFFF MOV EDX,[LOCAL.204]                   ;  hacker
005415D8  |.  8B45 FC    MOV EAX,[LOCAL.1]
005415DB  |.  E8 ACF3FFFF CALL MSQingSh.0054098C
005415E0  |.  84C0       TEST AL,AL
005415E2  |.  0F85 FA000000 JNZ MSQingSh.005416E2
005415E8  |.  8D95 CCFCFFFF LEA EDX,[LOCAL.205]
005415EE  |.  B8 D81C5400 MOV EAX,MSQingSh.00541CD8
005415F3  |.  E8 F0F2FFFF CALL MSQingSh.005408E8
005415F8  |.  8B95 CCFCFFFF MOV EDX,[LOCAL.205]                   ;  hack
005415FE  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541601  |.  E8 86F3FFFF CALL MSQingSh.0054098C
00541606  |.  84C0       TEST AL,AL
00541608  |.  0F85 D4000000 JNZ MSQingSh.005416E2
0054160E  |.  8D95 C8FCFFFF LEA EDX,[LOCAL.206]
00541614  |.  B8 E81C5400 MOV EAX,MSQingSh.00541CE8
00541619  |.  E8 CAF2FFFF CALL MSQingSh.005408E8                ;  KeyMake
0054161E  |.  8B95 C8FCFFFF MOV EDX,[LOCAL.206]
00541624  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541627  |.  E8 60F3FFFF CALL MSQingSh.0054098C
0054162C  |.  84C0       TEST AL,AL
0054162E  |.  0F85 AE000000 JNZ MSQingSh.005416E2
00541634  |.  8D95 C4FCFFFF LEA EDX,[LOCAL.207]
0054163A  |.  B8 F81C5400 MOV EAX,MSQingSh.00541CF8
0054163F  |.  E8 A4F2FFFF CALL MSQingSh.005408E8
00541644  |.  8B95 C4FCFFFF MOV EDX,[LOCAL.207]                   ;  AntiProtect
0054164A  |.  8B45 FC    MOV EAX,[LOCAL.1]
0054164D  |.  E8 3AF3FFFF CALL MSQingSh.0054098C
00541652  |.  84C0       TEST AL,AL
00541654  |.  0F85 88000000 JNZ MSQingSh.005416E2
0054165A  |.  8D95 C0FCFFFF LEA EDX,[LOCAL.208]
00541660  |.  B8 0C1D5400 MOV EAX,MSQingSh.00541D0C
00541665  |.  E8 7EF2FFFF CALL MSQingSh.005408E8
0054166A  |.  8B95 C0FCFFFF MOV EDX,[LOCAL.208]                   ;  ？
00541670  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541673  |.  E8 14F3FFFF CALL MSQingSh.0054098C
00541678  |.  84C0       TEST AL,AL
0054167A  |.  75 66       JNZ SHORT MSQingSh.005416E2
0054167C  |.  8D95 BCFCFFFF LEA EDX,[LOCAL.209]
00541682  |.  B8 1C1D5400 MOV EAX,MSQingSh.00541D1C
00541687  |.  E8 5CF2FFFF CALL MSQingSh.005408E8
0054168C  |.  8B95 BCFCFFFF MOV EDX,[LOCAL.209]                   ;  winzheng
00541692  |.  8B45 FC    MOV EAX,[LOCAL.1]
00541695  |.  E8 F2F2FFFF CALL MSQingSh.0054098C
0054169A  |.  84C0       TEST AL,AL
0054169C  |.  75 44       JNZ SHORT MSQingSh.005416E2
0054169E  |.  8D95 B8FCFFFF LEA EDX,[LOCAL.210]
005416A4  |.  B8 301D5400 MOV EAX,MSQingSh.00541D30
005416A9  |.  E8 3AF2FFFF CALL MSQingSh.005408E8
005416AE  |.  8B95 B8FCFFFF MOV EDX,[LOCAL.210]
005416B4  |.  8B45 FC    MOV EAX,[LOCAL.1]
005416B7  |.  E8 D0F2FFFF CALL MSQingSh.0054098C
005416BC  |.  84C0       TEST AL,AL
005416BE  |.  75 22       JNZ SHORT MSQingSh.005416E2
005416C0  |.  8D95 B4FCFFFF LEA EDX,[LOCAL.211]
005416C6  |.  B8 401D5400 MOV EAX,MSQingSh.00541D40
005416CB  |.  E8 18F2FFFF CALL MSQingSh.005408E8
005416D0  |.  8B95 B4FCFFFF MOV EDX,[LOCAL.211]                   ;  KeyGen
005416D6  |.  8B45 FC    MOV EAX,[LOCAL.1]
005416D9  |.  E8 AEF2FFFF CALL MSQingSh.0054098C
005416DE  |.  84C0       TEST AL,AL
005416E0  |.  74 0C       JE SHORT MSQingSh.005416EE
005416E2  |>  6A 00       PUSH 0                                  ; /lParam = 0
005416E4  |.  6A 00       PUSH 0                                  ; |wParam = 0
005416E6  |.  6A 12       PUSH 12                               ; |Message = WM_QUIT
005416E8  |.  56          PUSH ESI                               ; |hWnd
005416E9  |.  E8 5A5FECFF CALL <JMP.&user32.PostMessageA>       ; \PostMessageA
005416EE  |>  33C0       XOR EAX,EAX
005416F0  |.  5A          POP EDX
005416F1  |.  59          POP ECX
005416F2  |.  59          POP ECX
005416F3  |.  64:8910    MOV DWORD PTR FS:[EAX],EDX
005416F6  |.  68 1B175400 PUSH MSQingSh.0054171B
005416FB  |>  8D85 B4FCFFFF LEA EAX,[LOCAL.211]
00541701  |.  BA 52000000 MOV EDX,52
00541706  |.  E8 F125ECFF CALL MSQingSh.00403CFC
0054170B  |.  8D45 FC    LEA EAX,[LOCAL.1]
0054170E  |.  E8 C525ECFF CALL MSQingSh.00403CD8
00541713  \.  C3          RETN
00541714 .^ E9 D31FECFF JMP MSQingSh.004036EC
00541719 .^ EB E0       JMP SHORT MSQingSh.005416FB
0054171B .  8BC3       MOV EAX,EBX
0054171D .  5E          POP ESI
0054171E .  5B          POP EBX
0054171F .  8BE5       MOV ESP,EBP
00541721 .  5D          POP EBP
00541722 .  C2 0800    RETN 8

这是第一个EnumWindows，第二个类似，跳过即可
00530B8F  |.  55          PUSH EBP
00530B90  |.  68 28185300 PUSH MSQingSh.00531828
00530B95  |.  64:FF30    PUSH DWORD PTR FS:[EAX]
00530B98  |.  64:8920    MOV DWORD PTR FS:[EAX],ESP
00530B9B  |.  68 FF000000 PUSH 0FF                               ; /Count = FF (255.)
00530BA0  |.  8D85 FCFEFFFF LEA EAX,[LOCAL.65]                      ; |
00530BA6  |.  50          PUSH EAX                               ; |Buffer
00530BA7  |.  53          PUSH EBX                               ; |hWnd
00530BA8  |.  E8 9369EDFF CALL <JMP.&user32.GetWindowTextA>       ; \GetWindowTextA
00530BAD  |.  85C0       TEST EAX,EAX
00530BAF  |.  7E 29       JLE SHORT MSQingSh.00530BDA
00530BB1  |.  68 FF000000 PUSH 0FF                               ; /Count = FF (255.)
00530BB6  |.  8D85 FCFDFFFF LEA EAX,[LOCAL.129]                   ; |
00530BBC  |.  50          PUSH EAX                               ; |Buffer
00530BBD  |.  53          PUSH EBX                               ; |hWnd
00530BBE  |.  E8 0D68EDFF CALL <JMP.&user32.GetClassNameA>       ; \GetClassNameA
00530BC3  |.  85C0       TEST EAX,EAX
00530BC5  |.  7E 13       JLE SHORT MSQingSh.00530BDA
00530BC7  |.  8D45 FC    LEA EAX,[LOCAL.1]
00530BCA  |.  8D95 FCFEFFFF LEA EDX,[LOCAL.65]
00530BD0  |.  B9 00010000 MOV ECX,100
00530BD5  |.  E8 3E33EDFF CALL MSQingSh.00403F18
00530BDA    8D95 F8FDFFFF LEA EDX,DWORD PTR SS:[EBP-208]  *****第一个黑名单，跳到531802，就行了
00530BE0  |.  B8 44185300 MOV EAX,MSQingSh.00531844
00530BE5  |.  E8 12FEFFFF CALL MSQingSh.005309FC
00530BEA  |.  8B95 F8FDFFFF MOV EDX,[LOCAL.130]
00530BF0  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530BF3  |.  E8 A8FEFFFF CALL MSQingSh.00530AA0
00530BF8  |.  84C0       TEST AL,AL
00530BFA  |.  0F85 F60B0000 JNZ MSQingSh.005317F6
00530C00  |.  8D95 F4FDFFFF LEA EDX,[LOCAL.131]
00530C06  |.  B8 54185300 MOV EAX,MSQingSh.00531854
00530C0B  |.  E8 ECFDFFFF CALL MSQingSh.005309FC
00530C10  |.  8B95 F4FDFFFF MOV EDX,[LOCAL.131]
00530C16  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530C19  |.  E8 82FEFFFF CALL MSQingSh.00530AA0
00530C1E  |.  84C0       TEST AL,AL
00530C20  |.  0F85 D00B0000 JNZ MSQingSh.005317F6
00530C26  |.  8D95 F0FDFFFF LEA EDX,[LOCAL.132]
00530C2C  |.  B8 64185300 MOV EAX,MSQingSh.00531864
00530C31  |.  E8 C6FDFFFF CALL MSQingSh.005309FC
00530C36  |.  8B95 F0FDFFFF MOV EDX,[LOCAL.132]
00530C3C  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530C3F  |.  E8 5CFEFFFF CALL MSQingSh.00530AA0
00530C44  |.  84C0       TEST AL,AL
00530C46  |.  0F85 AA0B0000 JNZ MSQingSh.005317F6
00530C4C  |.  8D95 ECFDFFFF LEA EDX,[LOCAL.133]
00530C52  |.  B8 74185300 MOV EAX,MSQingSh.00531874
00530C57  |.  E8 A0FDFFFF CALL MSQingSh.005309FC
00530C5C  |.  8B95 ECFDFFFF MOV EDX,[LOCAL.133]
00530C62  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530C65  |.  E8 36FEFFFF CALL MSQingSh.00530AA0
00530C6A  |.  84C0       TEST AL,AL
00530C6C  |.  0F85 840B0000 JNZ MSQingSh.005317F6
00530C72  |.  8D95 E8FDFFFF LEA EDX,[LOCAL.134]
00530C78  |.  B8 84185300 MOV EAX,MSQingSh.00531884
00530C7D  |.  E8 7AFDFFFF CALL MSQingSh.005309FC
00530C82  |.  8B95 E8FDFFFF MOV EDX,[LOCAL.134]
00530C88  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530C8B  |.  E8 10FEFFFF CALL MSQingSh.00530AA0
00530C90  |.  84C0       TEST AL,AL
00530C92  |.  0F85 5E0B0000 JNZ MSQingSh.005317F6
00530C98  |.  8D95 E4FDFFFF LEA EDX,[LOCAL.135]
00530C9E  |.  B8 9C185300 MOV EAX,MSQingSh.0053189C
00530CA3  |.  E8 54FDFFFF CALL MSQingSh.005309FC
00530CA8  |.  8B95 E4FDFFFF MOV EDX,[LOCAL.135]
00530CAE  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530CB1  |.  E8 EAFDFFFF CALL MSQingSh.00530AA0
00530CB6  |.  84C0       TEST AL,AL
00530CB8  |.  0F85 380B0000 JNZ MSQingSh.005317F6
00530CBE  |.  8D95 E0FDFFFF LEA EDX,[LOCAL.136]
00530CC4  |.  B8 B0185300 MOV EAX,MSQingSh.005318B0
00530CC9  |.  E8 2EFDFFFF CALL MSQingSh.005309FC
00530CCE  |.  8B95 E0FDFFFF MOV EDX,[LOCAL.136]
00530CD4  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530CD7  |.  E8 C4FDFFFF CALL MSQingSh.00530AA0
00530CDC  |.  84C0       TEST AL,AL
00530CDE  |.  0F85 120B0000 JNZ MSQingSh.005317F6
00530CE4  |.  8D95 DCFDFFFF LEA EDX,[LOCAL.137]
00530CEA  |.  B8 CC185300 MOV EAX,MSQingSh.005318CC
00530CEF  |.  E8 08FDFFFF CALL MSQingSh.005309FC
00530CF4  |.  8B95 DCFDFFFF MOV EDX,[LOCAL.137]
00530CFA  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530CFD  |.  E8 9EFDFFFF CALL MSQingSh.00530AA0
00530D02  |.  84C0       TEST AL,AL
00530D04  |.  0F85 EC0A0000 JNZ MSQingSh.005317F6
00530D0A  |.  8D95 D8FDFFFF LEA EDX,[LOCAL.138]
00530D10  |.  B8 E0185300 MOV EAX,MSQingSh.005318E0
00530D15  |.  E8 E2FCFFFF CALL MSQingSh.005309FC
00530D1A  |.  8B95 D8FDFFFF MOV EDX,[LOCAL.138]
00530D20  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530D23  |.  E8 78FDFFFF CALL MSQingSh.00530AA0
00530D28  |.  84C0       TEST AL,AL
00530D2A  |.  0F85 C60A0000 JNZ MSQingSh.005317F6
00530D30  |.  8D95 D4FDFFFF LEA EDX,[LOCAL.139]
00530D36  |.  B8 F0185300 MOV EAX,MSQingSh.005318F0
00530D3B  |.  E8 BCFCFFFF CALL MSQingSh.005309FC
00530D40  |.  8B95 D4FDFFFF MOV EDX,[LOCAL.139]
00530D46  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530D49  |.  E8 52FDFFFF CALL MSQingSh.00530AA0
00530D4E  |.  84C0       TEST AL,AL
00530D50  |.  0F85 A00A0000 JNZ MSQingSh.005317F6
00530D56  |.  8D95 D0FDFFFF LEA EDX,[LOCAL.140]
00530D5C  |.  B8 14195300 MOV EAX,MSQingSh.00531914
00530D61  |.  E8 96FCFFFF CALL MSQingSh.005309FC
00530D66  |.  8B95 D0FDFFFF MOV EDX,[LOCAL.140]
00530D6C  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530D6F  |.  E8 2CFDFFFF CALL MSQingSh.00530AA0
00530D74  |.  84C0       TEST AL,AL
00530D76  |.  0F85 7A0A0000 JNZ MSQingSh.005317F6
00530D7C  |.  8D95 CCFDFFFF LEA EDX,[LOCAL.141]
00530D82  |.  B8 24195300 MOV EAX,MSQingSh.00531924
00530D87  |.  E8 70FCFFFF CALL MSQingSh.005309FC
00530D8C  |.  8B95 CCFDFFFF MOV EDX,[LOCAL.141]
00530D92  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530D95  |.  E8 06FDFFFF CALL MSQingSh.00530AA0
00530D9A  |.  84C0       TEST AL,AL
00530D9C  |.  0F85 540A0000 JNZ MSQingSh.005317F6
00530DA2  |.  8D95 C8FDFFFF LEA EDX,[LOCAL.142]
00530DA8  |.  B8 34195300 MOV EAX,MSQingSh.00531934
00530DAD  |.  E8 4AFCFFFF CALL MSQingSh.005309FC
00530DB2  |.  8B95 C8FDFFFF MOV EDX,[LOCAL.142]
00530DB8  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530DBB  |.  E8 E0FCFFFF CALL MSQingSh.00530AA0
00530DC0  |.  84C0       TEST AL,AL
00530DC2  |.  0F85 2E0A0000 JNZ MSQingSh.005317F6
00530DC8  |.  8D95 C4FDFFFF LEA EDX,[LOCAL.143]
00530DCE  |.  B8 4C195300 MOV EAX,MSQingSh.0053194C
00530DD3  |.  E8 24FCFFFF CALL MSQingSh.005309FC
00530DD8  |.  8B95 C4FDFFFF MOV EDX,[LOCAL.143]
00530DDE  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530DE1  |.  E8 BAFCFFFF CALL MSQingSh.00530AA0
00530DE6  |.  84C0       TEST AL,AL
00530DE8  |.  0F85 080A0000 JNZ MSQingSh.005317F6
00530DEE  |.  8D95 C0FDFFFF LEA EDX,[LOCAL.144]
00530DF4  |.  B8 60195300 MOV EAX,MSQingSh.00531960
00530DF9  |.  E8 FEFBFFFF CALL MSQingSh.005309FC
00530DFE  |.  8B95 C0FDFFFF MOV EDX,[LOCAL.144]
00530E04  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530E07  |.  E8 94FCFFFF CALL MSQingSh.00530AA0
00530E0C  |.  84C0       TEST AL,AL
00530E0E  |.  0F85 E2090000 JNZ MSQingSh.005317F6
00530E14  |.  8D95 BCFDFFFF LEA EDX,[LOCAL.145]
00530E1A  |.  B8 78195300 MOV EAX,MSQingSh.00531978
00530E1F  |.  E8 D8FBFFFF CALL MSQingSh.005309FC
00530E24  |.  8B95 BCFDFFFF MOV EDX,[LOCAL.145]
00530E2A  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530E2D  |.  E8 6EFCFFFF CALL MSQingSh.00530AA0
00530E32  |.  84C0       TEST AL,AL
00530E34  |.  0F85 BC090000 JNZ MSQingSh.005317F6
00530E3A  |.  8D95 B8FDFFFF LEA EDX,[LOCAL.146]
00530E40  |.  B8 8C195300 MOV EAX,MSQingSh.0053198C
00530E45  |.  E8 B2FBFFFF CALL MSQingSh.005309FC
00530E4A  |.  8B95 B8FDFFFF MOV EDX,[LOCAL.146]
00530E50  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530E53  |.  E8 48FCFFFF CALL MSQingSh.00530AA0
00530E58  |.  84C0       TEST AL,AL
00530E5A  |.  0F85 96090000 JNZ MSQingSh.005317F6
00530E60  |.  8D95 B4FDFFFF LEA EDX,[LOCAL.147]
00530E66  |.  B8 A4195300 MOV EAX,MSQingSh.005319A4
00530E6B  |.  E8 8CFBFFFF CALL MSQingSh.005309FC
00530E70  |.  8B95 B4FDFFFF MOV EDX,[LOCAL.147]
00530E76  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530E79  |.  E8 22FCFFFF CALL MSQingSh.00530AA0
00530E7E  |.  84C0       TEST AL,AL
00530E80  |.  0F85 70090000 JNZ MSQingSh.005317F6
00530E86  |.  8D95 B0FDFFFF LEA EDX,[LOCAL.148]
00530E8C  |.  B8 BC195300 MOV EAX,MSQingSh.005319BC
00530E91  |.  E8 66FBFFFF CALL MSQingSh.005309FC
00530E96  |.  8B95 B0FDFFFF MOV EDX,[LOCAL.148]
00530E9C  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530E9F  |.  E8 FCFBFFFF CALL MSQingSh.00530AA0
00530EA4  |.  84C0       TEST AL,AL
00530EA6  |.  0F85 4A090000 JNZ MSQingSh.005317F6
00530EAC  |.  8D95 ACFDFFFF LEA EDX,[LOCAL.149]
00530EB2  |.  B8 D4195300 MOV EAX,MSQingSh.005319D4
00530EB7  |.  E8 40FBFFFF CALL MSQingSh.005309FC
00530EBC  |.  8B95 ACFDFFFF MOV EDX,[LOCAL.149]
00530EC2  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530EC5  |.  E8 D6FBFFFF CALL MSQingSh.00530AA0
00530ECA  |.  84C0       TEST AL,AL
00530ECC  |.  0F85 24090000 JNZ MSQingSh.005317F6
00530ED2  |.  8D95 A8FDFFFF LEA EDX,[LOCAL.150]
00530ED8  |.  B8 EC195300 MOV EAX,MSQingSh.005319EC
00530EDD  |.  E8 1AFBFFFF CALL MSQingSh.005309FC
00530EE2  |.  8B95 A8FDFFFF MOV EDX,[LOCAL.150]
00530EE8  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530EEB  |.  E8 B0FBFFFF CALL MSQingSh.00530AA0
00530EF0  |.  84C0       TEST AL,AL
00530EF2  |.  0F85 FE080000 JNZ MSQingSh.005317F6
00530EF8  |.  8D95 A4FDFFFF LEA EDX,[LOCAL.151]
00530EFE  |.  B8 041A5300 MOV EAX,MSQingSh.00531A04
00530F03  |.  E8 F4FAFFFF CALL MSQingSh.005309FC
00530F08  |.  8B95 A4FDFFFF MOV EDX,[LOCAL.151]
00530F0E  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530F11  |.  E8 8AFBFFFF CALL MSQingSh.00530AA0
00530F16  |.  84C0       TEST AL,AL
00530F18  |.  0F85 D8080000 JNZ MSQingSh.005317F6
00530F1E  |.  8D95 A0FDFFFF LEA EDX,[LOCAL.152]
00530F24  |.  B8 141A5300 MOV EAX,MSQingSh.00531A14
00530F29  |.  E8 CEFAFFFF CALL MSQingSh.005309FC
00530F2E  |.  8B95 A0FDFFFF MOV EDX,[LOCAL.152]
00530F34  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530F37  |.  E8 64FBFFFF CALL MSQingSh.00530AA0
00530F3C  |.  84C0       TEST AL,AL
00530F3E  |.  0F85 B2080000 JNZ MSQingSh.005317F6
00530F44  |.  8D95 9CFDFFFF LEA EDX,[LOCAL.153]
00530F4A  |.  B8 341A5300 MOV EAX,MSQingSh.00531A34
00530F4F  |.  E8 A8FAFFFF CALL MSQingSh.005309FC
00530F54  |.  8B95 9CFDFFFF MOV EDX,[LOCAL.153]
00530F5A  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530F5D  |.  E8 3EFBFFFF CALL MSQingSh.00530AA0
00530F62  |.  84C0       TEST AL,AL
00530F64  |.  0F85 8C080000 JNZ MSQingSh.005317F6
00530F6A  |.  8D95 98FDFFFF LEA EDX,[LOCAL.154]
00530F70  |.  B8 441A5300 MOV EAX,MSQingSh.00531A44
00530F75  |.  E8 82FAFFFF CALL MSQingSh.005309FC
00530F7A  |.  8B95 98FDFFFF MOV EDX,[LOCAL.154]
00530F80  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530F83  |.  E8 18FBFFFF CALL MSQingSh.00530AA0
00530F88  |.  84C0       TEST AL,AL
00530F8A  |.  0F85 66080000 JNZ MSQingSh.005317F6
00530F90  |.  8D95 94FDFFFF LEA EDX,[LOCAL.155]
00530F96  |.  B8 641A5300 MOV EAX,MSQingSh.00531A64
00530F9B  |.  E8 5CFAFFFF CALL MSQingSh.005309FC
00530FA0  |.  8B95 94FDFFFF MOV EDX,[LOCAL.155]
00530FA6  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530FA9  |.  E8 F2FAFFFF CALL MSQingSh.00530AA0
00530FAE  |.  84C0       TEST AL,AL
00530FB0  |.  0F85 40080000 JNZ MSQingSh.005317F6
00530FB6  |.  8D95 90FDFFFF LEA EDX,[LOCAL.156]
00530FBC  |.  B8 741A5300 MOV EAX,MSQingSh.00531A74
00530FC1  |.  E8 36FAFFFF CALL MSQingSh.005309FC
00530FC6  |.  8B95 90FDFFFF MOV EDX,[LOCAL.156]
00530FCC  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530FCF  |.  E8 CCFAFFFF CALL MSQingSh.00530AA0
00530FD4  |.  84C0       TEST AL,AL
00530FD6  |.  0F85 1A080000 JNZ MSQingSh.005317F6
00530FDC  |.  8D95 8CFDFFFF LEA EDX,[LOCAL.157]
00530FE2  |.  B8 841A5300 MOV EAX,MSQingSh.00531A84
00530FE7  |.  E8 10FAFFFF CALL MSQingSh.005309FC
00530FEC  |.  8B95 8CFDFFFF MOV EDX,[LOCAL.157]
00530FF2  |.  8B45 FC    MOV EAX,[LOCAL.1]
00530FF5  |.  E8 A6FAFFFF CALL MSQingSh.00530AA0
00530FFA  |.  84C0       TEST AL,AL
00530FFC  |.  0F85 F4070000 JNZ MSQingSh.005317F6
00531002  |.  8D95 88FDFFFF LEA EDX,[LOCAL.158]
00531008  |.  B8 941A5300 MOV EAX,MSQingSh.00531A94
0053100D  |.  E8 EAF9FFFF CALL MSQingSh.005309FC
00531012  |.  8B95 88FDFFFF MOV EDX,[LOCAL.158]
00531018  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053101B  |.  E8 80FAFFFF CALL MSQingSh.00530AA0
00531020  |.  84C0       TEST AL,AL
00531022  |.  0F85 CE070000 JNZ MSQingSh.005317F6
00531028  |.  8D95 84FDFFFF LEA EDX,[LOCAL.159]
0053102E  |.  B8 A81A5300 MOV EAX,MSQingSh.00531AA8
00531033  |.  E8 C4F9FFFF CALL MSQingSh.005309FC
00531038  |.  8B95 84FDFFFF MOV EDX,[LOCAL.159]
0053103E  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531041  |.  E8 5AFAFFFF CALL MSQingSh.00530AA0
00531046  |.  84C0       TEST AL,AL
00531048  |.  0F85 A8070000 JNZ MSQingSh.005317F6
0053104E    8D95 80FDFFFF LEA EDX,DWORD PTR SS:[EBP-280]
00531054  |.  B8 BC1A5300 MOV EAX,MSQingSh.00531ABC
00531059  |.  E8 9EF9FFFF CALL MSQingSh.005309FC
0053105E    8B95 80FDFFFF MOV EDX,DWORD PTR SS:[EBP-280]
00531064  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531067  |.  E8 34FAFFFF CALL MSQingSh.00530AA0
0053106C  |.  84C0       TEST AL,AL
0053106E  |.  0F85 82070000 JNZ MSQingSh.005317F6
00531074  |.  8D95 7CFDFFFF LEA EDX,[LOCAL.161]
0053107A  |.  B8 CC1A5300 MOV EAX,MSQingSh.00531ACC
0053107F  |.  E8 78F9FFFF CALL MSQingSh.005309FC
00531084  |.  8B95 7CFDFFFF MOV EDX,[LOCAL.161]
0053108A  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053108D  |.  E8 0EFAFFFF CALL MSQingSh.00530AA0
00531092  |.  84C0       TEST AL,AL
00531094  |.  0F85 5C070000 JNZ MSQingSh.005317F6
0053109A  |.  8D95 78FDFFFF LEA EDX,[LOCAL.162]
005310A0  |.  B8 E01A5300 MOV EAX,MSQingSh.00531AE0
005310A5  |.  E8 52F9FFFF CALL MSQingSh.005309FC
005310AA  |.  8B95 78FDFFFF MOV EDX,[LOCAL.162]
005310B0  |.  8B45 FC    MOV EAX,[LOCAL.1]
005310B3  |.  E8 E8F9FFFF CALL MSQingSh.00530AA0
005310B8  |.  84C0       TEST AL,AL
005310BA  |.  0F85 36070000 JNZ MSQingSh.005317F6
005310C0  |.  8D95 74FDFFFF LEA EDX,[LOCAL.163]
005310C6  |.  B8 F41A5300 MOV EAX,MSQingSh.00531AF4
005310CB  |.  E8 2CF9FFFF CALL MSQingSh.005309FC
005310D0  |.  8B95 74FDFFFF MOV EDX,[LOCAL.163]
005310D6  |.  8B45 FC    MOV EAX,[LOCAL.1]
005310D9  |.  E8 C2F9FFFF CALL MSQingSh.00530AA0
005310DE  |.  84C0       TEST AL,AL
005310E0  |.  0F85 10070000 JNZ MSQingSh.005317F6
005310E6  |.  8D95 70FDFFFF LEA EDX,[LOCAL.164]
005310EC  |.  B8 081B5300 MOV EAX,MSQingSh.00531B08
005310F1  |.  E8 06F9FFFF CALL MSQingSh.005309FC
005310F6  |.  8B95 70FDFFFF MOV EDX,[LOCAL.164]
005310FC  |.  8B45 FC    MOV EAX,[LOCAL.1]
005310FF  |.  E8 9CF9FFFF CALL MSQingSh.00530AA0
00531104  |.  84C0       TEST AL,AL
00531106  |.  0F85 EA060000 JNZ MSQingSh.005317F6
0053110C  |.  8D95 6CFDFFFF LEA EDX,[LOCAL.165]
00531112  |.  B8 181B5300 MOV EAX,MSQingSh.00531B18
00531117  |.  E8 E0F8FFFF CALL MSQingSh.005309FC
0053111C  |.  8B95 6CFDFFFF MOV EDX,[LOCAL.165]
00531122  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531125  |.  E8 76F9FFFF CALL MSQingSh.00530AA0
0053112A  |.  84C0       TEST AL,AL
0053112C  |.  0F85 C4060000 JNZ MSQingSh.005317F6
00531132  |.  8D95 68FDFFFF LEA EDX,[LOCAL.166]
00531138  |.  B8 3C1B5300 MOV EAX,MSQingSh.00531B3C
0053113D  |.  E8 BAF8FFFF CALL MSQingSh.005309FC
00531142  |.  8B95 68FDFFFF MOV EDX,[LOCAL.166]
00531148  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053114B  |.  E8 50F9FFFF CALL MSQingSh.00530AA0
00531150  |.  84C0       TEST AL,AL
00531152  |.  0F85 9E060000 JNZ MSQingSh.005317F6
00531158  |.  8D95 64FDFFFF LEA EDX,[LOCAL.167]
0053115E  |.  B8 4C1B5300 MOV EAX,MSQingSh.00531B4C
00531163  |.  E8 94F8FFFF CALL MSQingSh.005309FC
00531168  |.  8B95 64FDFFFF MOV EDX,[LOCAL.167]
0053116E  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531171  |.  E8 2AF9FFFF CALL MSQingSh.00530AA0
00531176  |.  84C0       TEST AL,AL
00531178  |.  0F85 78060000 JNZ MSQingSh.005317F6
0053117E  |.  8D95 60FDFFFF LEA EDX,[LOCAL.168]
00531184  |.  B8 641B5300 MOV EAX,MSQingSh.00531B64
00531189  |.  E8 6EF8FFFF CALL MSQingSh.005309FC
0053118E  |.  8B95 60FDFFFF MOV EDX,[LOCAL.168]
00531194  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531197  |.  E8 04F9FFFF CALL MSQingSh.00530AA0
0053119C  |.  84C0       TEST AL,AL
0053119E  |.  0F85 52060000 JNZ MSQingSh.005317F6
005311A4  |.  8D95 5CFDFFFF LEA EDX,[LOCAL.169]
005311AA  |.  B8 7C1B5300 MOV EAX,MSQingSh.00531B7C
005311AF  |.  E8 48F8FFFF CALL MSQingSh.005309FC
005311B4  |.  8B95 5CFDFFFF MOV EDX,[LOCAL.169]
005311BA  |.  8B45 FC    MOV EAX,[LOCAL.1]
005311BD  |.  E8 DEF8FFFF CALL MSQingSh.00530AA0
005311C2  |.  84C0       TEST AL,AL
005311C4  |.  0F85 2C060000 JNZ MSQingSh.005317F6
005311CA  |.  8D95 58FDFFFF LEA EDX,[LOCAL.170]
005311D0  |.  B8 8C1B5300 MOV EAX,MSQingSh.00531B8C
005311D5  |.  E8 22F8FFFF CALL MSQingSh.005309FC
005311DA  |.  8B95 58FDFFFF MOV EDX,[LOCAL.170]
005311E0  |.  8B45 FC    MOV EAX,[LOCAL.1]
005311E3  |.  E8 B8F8FFFF CALL MSQingSh.00530AA0
005311E8  |.  84C0       TEST AL,AL
005311EA  |.  0F85 06060000 JNZ MSQingSh.005317F6
005311F0  |.  8D95 54FDFFFF LEA EDX,[LOCAL.171]
005311F6  |.  B8 A01B5300 MOV EAX,MSQingSh.00531BA0
005311FB  |.  E8 FCF7FFFF CALL MSQingSh.005309FC
00531200  |.  8B95 54FDFFFF MOV EDX,[LOCAL.171]
00531206  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531209  |.  E8 92F8FFFF CALL MSQingSh.00530AA0
0053120E  |.  84C0       TEST AL,AL
00531210  |.  0F85 E0050000 JNZ MSQingSh.005317F6
00531216  |.  8D95 50FDFFFF LEA EDX,[LOCAL.172]
0053121C  |.  B8 B41B5300 MOV EAX,MSQingSh.00531BB4
00531221  |.  E8 D6F7FFFF CALL MSQingSh.005309FC
00531226  |.  8B95 50FDFFFF MOV EDX,[LOCAL.172]
0053122C  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053122F  |.  E8 6CF8FFFF CALL MSQingSh.00530AA0
00531234  |.  84C0       TEST AL,AL
00531236  |.  0F85 BA050000 JNZ MSQingSh.005317F6
0053123C  |.  8D95 4CFDFFFF LEA EDX,[LOCAL.173]
00531242  |.  B8 CC1B5300 MOV EAX,MSQingSh.00531BCC
00531247  |.  E8 B0F7FFFF CALL MSQingSh.005309FC
0053124C  |.  8B95 4CFDFFFF MOV EDX,[LOCAL.173]
00531252  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531255  |.  E8 46F8FFFF CALL MSQingSh.00530AA0
0053125A  |.  84C0       TEST AL,AL
0053125C  |.  0F85 94050000 JNZ MSQingSh.005317F6
00531262  |.  8D95 48FDFFFF LEA EDX,[LOCAL.174]
00531268  |.  B8 E01B5300 MOV EAX,MSQingSh.00531BE0
0053126D  |.  E8 8AF7FFFF CALL MSQingSh.005309FC
00531272  |.  8B95 48FDFFFF MOV EDX,[LOCAL.174]
00531278  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053127B  |.  E8 20F8FFFF CALL MSQingSh.00530AA0
00531280  |.  84C0       TEST AL,AL
00531282  |.  0F85 6E050000 JNZ MSQingSh.005317F6
00531288  |.  8D95 44FDFFFF LEA EDX,[LOCAL.175]
0053128E  |.  B8 F01B5300 MOV EAX,MSQingSh.00531BF0
00531293  |.  E8 64F7FFFF CALL MSQingSh.005309FC
00531298  |.  8B95 44FDFFFF MOV EDX,[LOCAL.175]
0053129E  |.  8B45 FC    MOV EAX,[LOCAL.1]
005312A1  |.  E8 FAF7FFFF CALL MSQingSh.00530AA0
005312A6  |.  84C0       TEST AL,AL
005312A8  |.  0F85 48050000 JNZ MSQingSh.005317F6
005312AE  |.  8D95 40FDFFFF LEA EDX,[LOCAL.176]
005312B4  |.  B8 001C5300 MOV EAX,MSQingSh.00531C00
005312B9  |.  E8 3EF7FFFF CALL MSQingSh.005309FC
005312BE  |.  8B95 40FDFFFF MOV EDX,[LOCAL.176]
005312C4  |.  8B45 FC    MOV EAX,[LOCAL.1]
005312C7  |.  E8 D4F7FFFF CALL MSQingSh.00530AA0
005312CC  |.  84C0       TEST AL,AL
005312CE  |.  0F85 22050000 JNZ MSQingSh.005317F6
005312D4  |.  8D95 3CFDFFFF LEA EDX,[LOCAL.177]
005312DA  |.  B8 141C5300 MOV EAX,MSQingSh.00531C14
005312DF  |.  E8 18F7FFFF CALL MSQingSh.005309FC
005312E4  |.  8B95 3CFDFFFF MOV EDX,[LOCAL.177]
005312EA  |.  8B45 FC    MOV EAX,[LOCAL.1]
005312ED  |.  E8 AEF7FFFF CALL MSQingSh.00530AA0
005312F2  |.  84C0       TEST AL,AL
005312F4  |.  0F85 FC040000 JNZ MSQingSh.005317F6
005312FA  |.  8D95 38FDFFFF LEA EDX,[LOCAL.178]
00531300  |.  B8 241C5300 MOV EAX,MSQingSh.00531C24
00531305  |.  E8 F2F6FFFF CALL MSQingSh.005309FC
0053130A  |.  8B95 38FDFFFF MOV EDX,[LOCAL.178]
00531310  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531313  |.  E8 88F7FFFF CALL MSQingSh.00530AA0
00531318  |.  84C0       TEST AL,AL
0053131A  |.  0F85 D6040000 JNZ MSQingSh.005317F6
00531320  |.  8D95 34FDFFFF LEA EDX,[LOCAL.179]
00531326  |.  B8 341C5300 MOV EAX,MSQingSh.00531C34
0053132B  |.  E8 CCF6FFFF CALL MSQingSh.005309FC
00531330  |.  8B95 34FDFFFF MOV EDX,[LOCAL.179]
00531336  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531339  |.  E8 62F7FFFF CALL MSQingSh.00530AA0
0053133E  |.  84C0       TEST AL,AL
00531340  |.  0F85 B0040000 JNZ MSQingSh.005317F6
00531346  |.  8D95 30FDFFFF LEA EDX,[LOCAL.180]
0053134C  |.  B8 481C5300 MOV EAX,MSQingSh.00531C48
00531351  |.  E8 A6F6FFFF CALL MSQingSh.005309FC
00531356  |.  8B95 30FDFFFF MOV EDX,[LOCAL.180]
0053135C  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053135F  |.  E8 3CF7FFFF CALL MSQingSh.00530AA0
00531364  |.  84C0       TEST AL,AL
00531366  |.  0F85 8A040000 JNZ MSQingSh.005317F6
0053136C  |.  8D95 2CFDFFFF LEA EDX,[LOCAL.181]
00531372  |.  B8 581C5300 MOV EAX,MSQingSh.00531C58
00531377  |.  E8 80F6FFFF CALL MSQingSh.005309FC
0053137C  |.  8B95 2CFDFFFF MOV EDX,[LOCAL.181]
00531382  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531385  |.  E8 16F7FFFF CALL MSQingSh.00530AA0
0053138A  |.  84C0       TEST AL,AL
0053138C  |.  0F85 64040000 JNZ MSQingSh.005317F6
00531392  |.  8D95 28FDFFFF LEA EDX,[LOCAL.182]
00531398  |.  B8 681C5300 MOV EAX,MSQingSh.00531C68
0053139D  |.  E8 5AF6FFFF CALL MSQingSh.005309FC
005313A2  |.  8B95 28FDFFFF MOV EDX,[LOCAL.182]
005313A8  |.  8B45 FC    MOV EAX,[LOCAL.1]
005313AB  |.  E8 F0F6FFFF CALL MSQingSh.00530AA0
005313B0  |.  84C0       TEST AL,AL
005313B2  |.  0F85 3E040000 JNZ MSQingSh.005317F6
005313B8  |.  8D95 24FDFFFF LEA EDX,[LOCAL.183]
005313BE  |.  B8 781C5300 MOV EAX,MSQingSh.00531C78
005313C3  |.  E8 34F6FFFF CALL MSQingSh.005309FC
005313C8  |.  8B95 24FDFFFF MOV EDX,[LOCAL.183]
005313CE  |.  8B45 FC    MOV EAX,[LOCAL.1]
005313D1  |.  E8 CAF6FFFF CALL MSQingSh.00530AA0
005313D6  |.  84C0       TEST AL,AL
005313D8  |.  0F85 18040000 JNZ MSQingSh.005317F6
005313DE  |.  8D95 20FDFFFF LEA EDX,[LOCAL.184]
005313E4  |.  B8 8C1C5300 MOV EAX,MSQingSh.00531C8C
005313E9  |.  E8 0EF6FFFF CALL MSQingSh.005309FC
005313EE  |.  8B95 20FDFFFF MOV EDX,[LOCAL.184]
005313F4  |.  8B45 FC    MOV EAX,[LOCAL.1]
005313F7  |.  E8 A4F6FFFF CALL MSQingSh.00530AA0
005313FC  |.  84C0       TEST AL,AL
005313FE  |.  0F85 F2030000 JNZ MSQingSh.005317F6
00531404  |.  8D95 1CFDFFFF LEA EDX,[LOCAL.185]
0053140A  |.  B8 9C1C5300 MOV EAX,MSQingSh.00531C9C
0053140F  |.  E8 E8F5FFFF CALL MSQingSh.005309FC
00531414  |.  8B95 1CFDFFFF MOV EDX,[LOCAL.185]
0053141A  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053141D  |.  E8 7EF6FFFF CALL MSQingSh.00530AA0
00531422  |.  84C0       TEST AL,AL
00531424  |.  0F85 CC030000 JNZ MSQingSh.005317F6
0053142A  |.  8D95 18FDFFFF LEA EDX,[LOCAL.186]
00531430  |.  B8 B01C5300 MOV EAX,MSQingSh.00531CB0
00531435  |.  E8 C2F5FFFF CALL MSQingSh.005309FC
0053143A  |.  8B95 18FDFFFF MOV EDX,[LOCAL.186]
00531440  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531443  |.  E8 58F6FFFF CALL MSQingSh.00530AA0
00531448  |.  84C0       TEST AL,AL
0053144A  |.  0F85 A6030000 JNZ MSQingSh.005317F6
00531450  |.  8D95 14FDFFFF LEA EDX,[LOCAL.187]
00531456  |.  B8 C01C5300 MOV EAX,MSQingSh.00531CC0
0053145B  |.  E8 9CF5FFFF CALL MSQingSh.005309FC
00531460  |.  8B95 14FDFFFF MOV EDX,[LOCAL.187]
00531466  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531469  |.  E8 32F6FFFF CALL MSQingSh.00530AA0
0053146E  |.  84C0       TEST AL,AL
00531470  |.  0F85 80030000 JNZ MSQingSh.005317F6
00531476  |.  8D95 10FDFFFF LEA EDX,[LOCAL.188]
0053147C  |.  B8 D01C5300 MOV EAX,MSQingSh.00531CD0
00531481  |.  E8 76F5FFFF CALL MSQingSh.005309FC
00531486  |.  8B95 10FDFFFF MOV EDX,[LOCAL.188]
0053148C  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053148F  |.  E8 0CF6FFFF CALL MSQingSh.00530AA0
00531494  |.  84C0       TEST AL,AL
00531496  |.  0F85 5A030000 JNZ MSQingSh.005317F6
0053149C  |.  8D95 0CFDFFFF LEA EDX,[LOCAL.189]
005314A2  |.  B8 E01C5300 MOV EAX,MSQingSh.00531CE0
005314A7  |.  E8 50F5FFFF CALL MSQingSh.005309FC
005314AC  |.  8B95 0CFDFFFF MOV EDX,[LOCAL.189]
005314B2  |.  8B45 FC    MOV EAX,[LOCAL.1]
005314B5  |.  E8 E6F5FFFF CALL MSQingSh.00530AA0
005314BA  |.  84C0       TEST AL,AL
005314BC  |.  0F85 34030000 JNZ MSQingSh.005317F6
005314C2  |.  8D95 08FDFFFF LEA EDX,[LOCAL.190]
005314C8  |.  B8 F01C5300 MOV EAX,MSQingSh.00531CF0
005314CD  |.  E8 2AF5FFFF CALL MSQingSh.005309FC
005314D2  |.  8B95 08FDFFFF MOV EDX,[LOCAL.190]
005314D8  |.  8B45 FC    MOV EAX,[LOCAL.1]
005314DB  |.  E8 C0F5FFFF CALL MSQingSh.00530AA0
005314E0  |.  84C0       TEST AL,AL
005314E2  |.  0F85 0E030000 JNZ MSQingSh.005317F6
005314E8  |.  8D95 04FDFFFF LEA EDX,[LOCAL.191]
005314EE  |.  B8 001D5300 MOV EAX,MSQingSh.00531D00
005314F3  |.  E8 04F5FFFF CALL MSQingSh.005309FC
005314F8  |.  8B95 04FDFFFF MOV EDX,[LOCAL.191]
005314FE  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531501  |.  E8 9AF5FFFF CALL MSQingSh.00530AA0
00531506  |.  84C0       TEST AL,AL
00531508  |.  0F85 E8020000 JNZ MSQingSh.005317F6
0053150E  |.  8D95 00FDFFFF LEA EDX,[LOCAL.192]
00531514  |.  B8 101D5300 MOV EAX,MSQingSh.00531D10
00531519  |.  E8 DEF4FFFF CALL MSQingSh.005309FC
0053151E  |.  8B95 00FDFFFF MOV EDX,[LOCAL.192]
00531524  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531527  |.  E8 74F5FFFF CALL MSQingSh.00530AA0
0053152C  |.  84C0       TEST AL,AL
0053152E  |.  0F85 C2020000 JNZ MSQingSh.005317F6
00531534  |.  8D95 FCFCFFFF LEA EDX,[LOCAL.193]
0053153A  |.  B8 201D5300 MOV EAX,MSQingSh.00531D20
0053153F  |.  E8 B8F4FFFF CALL MSQingSh.005309FC
00531544  |.  8B95 FCFCFFFF MOV EDX,[LOCAL.193]
0053154A  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053154D  |.  E8 4EF5FFFF CALL MSQingSh.00530AA0
00531552  |.  84C0       TEST AL,AL
00531554  |.  0F85 9C020000 JNZ MSQingSh.005317F6
0053155A  |.  8D95 F8FCFFFF LEA EDX,[LOCAL.194]
00531560  |.  B8 301D5300 MOV EAX,MSQingSh.00531D30
00531565  |.  E8 92F4FFFF CALL MSQingSh.005309FC
0053156A  |.  8B95 F8FCFFFF MOV EDX,[LOCAL.194]
00531570  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531573  |.  E8 28F5FFFF CALL MSQingSh.00530AA0
00531578  |.  84C0       TEST AL,AL
0053157A  |.  0F85 76020000 JNZ MSQingSh.005317F6
00531580  |.  8D95 F4FCFFFF LEA EDX,[LOCAL.195]
00531586  |.  B8 441D5300 MOV EAX,MSQingSh.00531D44
0053158B  |.  E8 6CF4FFFF CALL MSQingSh.005309FC
00531590  |.  8B95 F4FCFFFF MOV EDX,[LOCAL.195]
00531596  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531599  |.  E8 02F5FFFF CALL MSQingSh.00530AA0
0053159E  |.  84C0       TEST AL,AL
005315A0  |.  0F85 50020000 JNZ MSQingSh.005317F6
005315A6  |.  8D95 F0FCFFFF LEA EDX,[LOCAL.196]
005315AC  |.  B8 541D5300 MOV EAX,MSQingSh.00531D54
005315B1  |.  E8 46F4FFFF CALL MSQingSh.005309FC
005315B6  |.  8B95 F0FCFFFF MOV EDX,[LOCAL.196]
005315BC  |.  8B45 FC    MOV EAX,[LOCAL.1]
005315BF  |.  E8 DCF4FFFF CALL MSQingSh.00530AA0
005315C4  |.  84C0       TEST AL,AL
005315C6  |.  0F85 2A020000 JNZ MSQingSh.005317F6
005315CC  |.  8D95 ECFCFFFF LEA EDX,[LOCAL.197]
005315D2  |.  B8 641D5300 MOV EAX,MSQingSh.00531D64
005315D7  |.  E8 20F4FFFF CALL MSQingSh.005309FC
005315DC  |.  8B95 ECFCFFFF MOV EDX,[LOCAL.197]
005315E2  |.  8B45 FC    MOV EAX,[LOCAL.1]
005315E5  |.  E8 B6F4FFFF CALL MSQingSh.00530AA0
005315EA  |.  84C0       TEST AL,AL
005315EC  |.  0F85 04020000 JNZ MSQingSh.005317F6
005315F2  |.  8D95 E8FCFFFF LEA EDX,[LOCAL.198]
005315F8  |.  B8 741D5300 MOV EAX,MSQingSh.00531D74
005315FD  |.  E8 FAF3FFFF CALL MSQingSh.005309FC
00531602  |.  8B95 E8FCFFFF MOV EDX,[LOCAL.198]
00531608  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053160B  |.  E8 90F4FFFF CALL MSQingSh.00530AA0
00531610  |.  84C0       TEST AL,AL
00531612  |.  0F85 DE010000 JNZ MSQingSh.005317F6
00531618  |.  8D95 E4FCFFFF LEA EDX,[LOCAL.199]
0053161E  |.  B8 841D5300 MOV EAX,MSQingSh.00531D84
00531623  |.  E8 D4F3FFFF CALL MSQingSh.005309FC
00531628  |.  8B95 E4FCFFFF MOV EDX,[LOCAL.199]
0053162E  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531631  |.  E8 6AF4FFFF CALL MSQingSh.00530AA0
00531636  |.  84C0       TEST AL,AL
00531638  |.  0F85 B8010000 JNZ MSQingSh.005317F6
0053163E  |.  8D95 E0FCFFFF LEA EDX,[LOCAL.200]
00531644  |.  B8 941D5300 MOV EAX,MSQingSh.00531D94
00531649  |.  E8 AEF3FFFF CALL MSQingSh.005309FC
0053164E  |.  8B95 E0FCFFFF MOV EDX,[LOCAL.200]
00531654  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531657  |.  E8 44F4FFFF CALL MSQingSh.00530AA0
0053165C  |.  84C0       TEST AL,AL
0053165E  |.  0F85 92010000 JNZ MSQingSh.005317F6
00531664  |.  8D95 DCFCFFFF LEA EDX,[LOCAL.201]
0053166A  |.  B8 A41D5300 MOV EAX,MSQingSh.00531DA4
0053166F  |.  E8 88F3FFFF CALL MSQingSh.005309FC
00531674  |.  8B95 DCFCFFFF MOV EDX,[LOCAL.201]
0053167A  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053167D  |.  E8 1EF4FFFF CALL MSQingSh.00530AA0
00531682  |.  84C0       TEST AL,AL
00531684  |.  0F85 6C010000 JNZ MSQingSh.005317F6
0053168A  |.  8D95 D8FCFFFF LEA EDX,[LOCAL.202]
00531690  |.  B8 B41D5300 MOV EAX,MSQingSh.00531DB4
00531695  |.  E8 62F3FFFF CALL MSQingSh.005309FC
0053169A  |.  8B95 D8FCFFFF MOV EDX,[LOCAL.202]
005316A0  |.  8B45 FC    MOV EAX,[LOCAL.1]
005316A3  |.  E8 F8F3FFFF CALL MSQingSh.00530AA0
005316A8  |.  84C0       TEST AL,AL
005316AA  |.  0F85 46010000 JNZ MSQingSh.005317F6
005316B0  |.  8D95 D4FCFFFF LEA EDX,[LOCAL.203]
005316B6  |.  B8 C81D5300 MOV EAX,MSQingSh.00531DC8
005316BB  |.  E8 3CF3FFFF CALL MSQingSh.005309FC
005316C0  |.  8B95 D4FCFFFF MOV EDX,[LOCAL.203]
005316C6  |.  8B45 FC    MOV EAX,[LOCAL.1]
005316C9  |.  E8 D2F3FFFF CALL MSQingSh.00530AA0
005316CE  |.  84C0       TEST AL,AL
005316D0  |.  0F85 20010000 JNZ MSQingSh.005317F6
005316D6  |.  8D95 D0FCFFFF LEA EDX,[LOCAL.204]
005316DC  |.  B8 DC1D5300 MOV EAX,MSQingSh.00531DDC
005316E1  |.  E8 16F3FFFF CALL MSQingSh.005309FC
005316E6  |.  8B95 D0FCFFFF MOV EDX,[LOCAL.204]
005316EC  |.  8B45 FC    MOV EAX,[LOCAL.1]
005316EF  |.  E8 ACF3FFFF CALL MSQingSh.00530AA0
005316F4  |.  84C0       TEST AL,AL
005316F6  |.  0F85 FA000000 JNZ MSQingSh.005317F6
005316FC  |.  8D95 CCFCFFFF LEA EDX,[LOCAL.205]
00531702  |.  B8 EC1D5300 MOV EAX,MSQingSh.00531DEC
00531707  |.  E8 F0F2FFFF CALL MSQingSh.005309FC
0053170C  |.  8B95 CCFCFFFF MOV EDX,[LOCAL.205]
00531712  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531715  |.  E8 86F3FFFF CALL MSQingSh.00530AA0
0053171A  |.  84C0       TEST AL,AL
0053171C  |.  0F85 D4000000 JNZ MSQingSh.005317F6
00531722  |.  8D95 C8FCFFFF LEA EDX,[LOCAL.206]
00531728  |.  B8 FC1D5300 MOV EAX,MSQingSh.00531DFC
0053172D  |.  E8 CAF2FFFF CALL MSQingSh.005309FC
00531732  |.  8B95 C8FCFFFF MOV EDX,[LOCAL.206]
00531738  |.  8B45 FC    MOV EAX,[LOCAL.1]
0053173B  |.  E8 60F3FFFF CALL MSQingSh.00530AA0
00531740  |.  84C0       TEST AL,AL
00531742  |.  0F85 AE000000 JNZ MSQingSh.005317F6
00531748  |.  8D95 C4FCFFFF LEA EDX,[LOCAL.207]
0053174E  |.  B8 0C1E5300 MOV EAX,MSQingSh.00531E0C
00531753  |.  E8 A4F2FFFF CALL MSQingSh.005309FC
00531758  |.  8B95 C4FCFFFF MOV EDX,[LOCAL.207]
0053175E  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531761  |.  E8 3AF3FFFF CALL MSQingSh.00530AA0
00531766  |.  84C0       TEST AL,AL
00531768  |.  0F85 88000000 JNZ MSQingSh.005317F6
0053176E  |.  8D95 C0FCFFFF LEA EDX,[LOCAL.208]
00531774  |.  B8 201E5300 MOV EAX,MSQingSh.00531E20
00531779  |.  E8 7EF2FFFF CALL MSQingSh.005309FC
0053177E  |.  8B95 C0FCFFFF MOV EDX,[LOCAL.208]
00531784  |.  8B45 FC    MOV EAX,[LOCAL.1]
00531787  |.  E8 14F3FFFF CALL MSQingSh.00530AA0
0053178C  |.  84C0       TEST AL,AL
0053178E  |.  75 66       JNZ SHORT MSQingSh.005317F6
00531790  |.  8D95 BCFCFFFF LEA EDX,[LOCAL.209]
00531796  |.  B8 301E5300 MOV EAX,MSQingSh.00531E30
0053179B  |.  E8 5CF2FFFF CALL MSQingSh.005309FC
005317A0  |.  8B95 BCFCFFFF MOV EDX,[LOCAL.209]
005317A6  |.  8B45 FC    MOV EAX,[LOCAL.1]
005317A9  |.  E8 F2F2FFFF CALL MSQingSh.00530AA0
005317AE  |.  84C0       TEST AL,AL
005317B0  |.  75 44       JNZ SHORT MSQingSh.005317F6
005317B2  |.  8D95 B8FCFFFF LEA EDX,[LOCAL.210]
005317B8  |.  B8 441E5300 MOV EAX,MSQingSh.00531E44
005317BD  |.  E8 3AF2FFFF CALL MSQingSh.005309FC
005317C2  |.  8B95 B8FCFFFF MOV EDX,[LOCAL.210]
005317C8  |.  8B45 FC    MOV EAX,[LOCAL.1]
005317CB  |.  E8 D0F2FFFF CALL MSQingSh.00530AA0
005317D0  |.  84C0       TEST AL,AL
005317D2  |.  75 22       JNZ SHORT MSQingSh.005317F6
005317D4  |.  8D95 B4FCFFFF LEA EDX,[LOCAL.211]
005317DA  |.  B8 541E5300 MOV EAX,MSQingSh.00531E54
005317DF  |.  E8 18F2FFFF CALL MSQingSh.005309FC
005317E4  |.  8B95 B4FCFFFF MOV EDX,[LOCAL.211]
005317EA  |.  8B45 FC    MOV EAX,[LOCAL.1]
005317ED  |.  E8 AEF2FFFF CALL MSQingSh.00530AA0
005317F2  |.  84C0       TEST AL,AL
005317F4  |.  74 0C       JE SHORT MSQingSh.00531802
005317F6  |>  6A 00       PUSH 0                                  ; /lParam = 0
005317F8  |.  6A 00       PUSH 0                                  ; |wParam = 0
005317FA  |.  6A 12       PUSH 12                               ; |Message = WM_QUIT
005317FC  |.  53          PUSH EBX                               ; |hWnd
005317FD  |.  E8 465EEDFF CALL <JMP.&user32.PostMessageA>       ; \PostMessageA
00531802  |>  33C0       XOR EAX,EAX
00531804  |.  5A          POP EDX
00531805  |.  59          POP ECX
00531806  |.  59          POP ECX
00531807  |.  64:8910    MOV DWORD PTR FS:[EAX],EDX
0053180A  |.  68 2F185300 PUSH MSQingSh.0053182F
0053180F  |>  8D85 B4FCFFFF LEA EAX,[LOCAL.211]
00531815  |.  BA 52000000 MOV EDX,52
0053181A  |.  E8 DD24EDFF CALL MSQingSh.00403CFC
0053181F  |.  8D45 FC    LEA EAX,[LOCAL.1]
00531822  |.  E8 B124EDFF CALL MSQingSh.00403CD8
00531827  \.  C3          RETN
00531828 .^ E9 BF1EEDFF JMP MSQingSh.004036EC
0053182D .^ EB E0       JMP SHORT MSQingSh.0053180F
0053182F .  8BC6       MOV EAX,ESI
00531831 .  5E          POP ESI
00531832 .  5B          POP EBX
00531833 .  8BE5       MOV ESP,EBP
00531835 .  5D          POP EBP
00531836 .  C2 0800    RETN 8

--------------------------------------------------------------------------------
【破解总结】

很BT的人，这么多的工具，我前几天上EXETOOLS才看见的，受不了，全部检测……
最近有空，参考FLY大虾的FLYODBG,把OD的名字改了，躲过它的封杀……
很菜，过期限制没能搞定，用消息断不下来。请高手帮帮我吧
--------------------------------------------------------------------------------
【版权声明】本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

收藏・0

免费・1

支持

最新回复 (8)
aqtata 雪币： 319 活跃值： (1086) 能力值： ( LV7，RANK：100 ) 在线值：发帖 76 回帖 358 粉丝 2 关注私信	aqtata 2 2 楼后面那么长代码贴出来又没个注释，不懂 2004-9-22 11:40 0
qiweixue 雪币： 258 活跃值： (230) 能力值： ( LV12，RANK：770 ) 在线值：发帖 47 回帖 1136 粉丝 3 关注私信	qiweixue 19 3 楼不错，好文・・ ANTI_DEBUGGER代码过程 @@ 支持・它的制作文件就由Wise Installer打包的・用16进制的看看，能不能把它的特征ANTI去掉・・ :p 2004-9-23 11:17 0
鸡蛋壳雪币： 427 活跃值： (412) 能力值： ( LV2，RANK：10 ) 在线值：发帖 456 回帖 3147 粉丝 9 关注私信	鸡蛋壳 4 楼国产的不敢玩了，太黑了，格式化，硬盘锁，靠。 2004-9-23 18:39 0
123112 雪币： 212 活跃值： (70) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 36 粉丝 1 关注私信	123112 1 5 楼请大家彼此间尊重! 2004-9-23 19:34 0
Winter-Night 雪币： 296 活跃值： (250) 能力值： ( LV9，RANK：210 ) 在线值：发帖 31 回帖 726 粉丝 1 关注私信	Winter-Night 5 6 楼楼主可不可以分享一下怎么改od名字？用ue32打开查找？万分感谢！ 2004-9-24 22:01 0
pmma 雪币： 178 活跃值： (159) 能力值： ( LV4，RANK：50 ) 在线值：发帖 24 回帖 191 粉丝 0 关注私信	pmma 1 7 楼用SPY看到的OD的类名用注册窗口类下段就可以了，但是OD的名字用 SHOWWINDOW再跟几步可以看到，要注意的是，这样还没有完，载入新的程序后标题还会被改成OD，再仔细的找找，就可以看见了，我在朋友家上的，没办法铁代码，SORRY了 2004-10-3 12:59 0
pmma 雪币： 178 活跃值： (159) 能力值： ( LV4，RANK：50 ) 在线值：发帖 24 回帖 191 粉丝 0 关注私信	pmma 1 8 楼一开始的注册窗口类断下的好象没有用，第2次的才是的，到底如何实现的，我没再看下去，用了定时器还是什么，我不知道，我不会编程，我也不是搞计算机的，自然写不出来这些代码…… Wise Installer的我不懂，3楼的大虾可一教我，谢了，对了，它的说明里说这个东东要给钱再寄给你完全版，我不知道是真是假，我觉得这种ANTI_DEBUGGER无聊，觉得幻影的通过IDT拦截INT 3中断的却很牛，很值得学习，用LDT抓住段描述符表是个很好的办法 2004-10-3 13:10 0
nbw 雪币： 339 活跃值： (1510) 能力值： ( LV13，RANK：970 ) 在线值：发帖 141 回帖 2842 粉丝 23 关注私信	nbw 24 9 楼看不懂就要顶 2004-10-3 16:56 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

pmma

发帖

191

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (8)
aqtata 雪币： 319 活跃值： (1086) 能力值： ( LV7，RANK：100 ) 在线值：发帖 76 回帖 358 粉丝 2 关注私信	aqtata 2 2 楼后面那么长代码贴出来又没个注释，不懂 2004-9-22 11:40 0
qiweixue 雪币： 258 活跃值： (230) 能力值： ( LV12，RANK：770 ) 在线值：发帖 47 回帖 1136 粉丝 3 关注私信	qiweixue 19 3 楼不错，好文・・ ANTI_DEBUGGER代码过程 @@ 支持・它的制作文件就由Wise Installer打包的・用16进制的看看，能不能把它的特征ANTI去掉・・ :p 2004-9-23 11:17 0
鸡蛋壳雪币： 427 活跃值： (412) 能力值： ( LV2，RANK：10 ) 在线值：发帖 456 回帖 3147 粉丝 9 关注私信	鸡蛋壳 4 楼国产的不敢玩了，太黑了，格式化，硬盘锁，靠。 2004-9-23 18:39 0
123112 雪币： 212 活跃值： (70) 能力值： ( LV4，RANK：50 ) 在线值：发帖 3 回帖 36 粉丝 1 关注私信	123112 1 5 楼请大家彼此间尊重! 2004-9-23 19:34 0
Winter-Night 雪币： 296 活跃值： (250) 能力值： ( LV9，RANK：210 ) 在线值：发帖 31 回帖 726 粉丝 1 关注私信	Winter-Night 5 6 楼楼主可不可以分享一下怎么改od名字？用ue32打开查找？万分感谢！ 2004-9-24 22:01 0
pmma 雪币： 178 活跃值： (159) 能力值： ( LV4，RANK：50 ) 在线值：发帖 24 回帖 191 粉丝 0 关注私信	pmma 1 7 楼用SPY看到的OD的类名用注册窗口类下段就可以了，但是OD的名字用 SHOWWINDOW再跟几步可以看到，要注意的是，这样还没有完，载入新的程序后标题还会被改成OD，再仔细的找找，就可以看见了，我在朋友家上的，没办法铁代码，SORRY了 2004-10-3 12:59 0
pmma 雪币： 178 活跃值： (159) 能力值： ( LV4，RANK：50 ) 在线值：发帖 24 回帖 191 粉丝 0 关注私信	pmma 1 8 楼一开始的注册窗口类断下的好象没有用，第2次的才是的，到底如何实现的，我没再看下去，用了定时器还是什么，我不知道，我不会编程，我也不是搞计算机的，自然写不出来这些代码…… Wise Installer的我不懂，3楼的大虾可一教我，谢了，对了，它的说明里说这个东东要给钱再寄给你完全版，我不知道是真是假，我觉得这种ANTI_DEBUGGER无聊，觉得幻影的通过IDT拦截INT 3中断的却很牛，很值得学习，用LDT抓住段描述符表是个很好的办法 2004-10-3 13:10 0
nbw 雪币： 339 活跃值： (1510) 能力值： ( LV13，RANK：970 ) 在线值：发帖 141 回帖 2842 粉丝 23 关注私信	nbw 24 9 楼看不懂就要顶 2004-10-3 16:56 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

魔术情书 之去除5-ANTI_DEBUGGER代码过程

魔术情书之去除5-ANTI_DEBUGGER代码过程