softdenfender采用双进程来防脱壳，如ShineGood所言“父进程要做的事是建立临时文件，写入前面GetTickCount所得值的加密值，再 CreateProcessA建立子进程，随后自己
退出，”，因此我们可以参考peaceclub提供的方法强制转单进程：
00723D2E /75 07 jnz short 00723D37 ; Ns.00723D37
00723D30 |74 05 je short 00723D37 ; Ns.00723D37
00723D32 |0010 add byte ptr ds:[eax],dl
00723D34 |40 inc eax ; Ns.00723D1C
00723D35 |00E8 add al,ch
00723D37 \0F84 9A000000 je 00723DD7 ; 强行跳转
00723D3D E8 01000000 call 00723D43 ; Ns.00723D43
00723D42 FF58 05 call far fword ptr ds:[eax+5]
00723D45 1100 adc dword ptr ds:[eax],eax ; Ns.00723D1C
0072C7FE 8B00 mov eax,dword ptr ds:[eax] //api出int3断点检测，共检测五个字节
0072C800 8038 CC cmp byte ptr ds:[eax],0CC
0072C803 74 22 je short 0072C827 ; Ns.0072C827
0072C805 8078 01 CC cmp byte ptr ds:[eax+1],0CC
0072C809 74 1C je short 0072C827 ; Ns.0072C827
0072C80B 8078 02 CC cmp byte ptr ds:[eax+2],0CC
0072C80F 74 16 je short 0072C827 ; Ns.0072C827
0072C811 8078 03 CC cmp byte ptr ds:[eax+3],0CC
0072C815 74 10 je short 0072C827 ; Ns.0072C827
0072C817 8078 04 CC cmp byte ptr ds:[eax+4],0CC
0072C81B 74 0A je short 0072C827 ; Ns.0072C827
0072C81D 50 push eax
0072C81E C3 retn
00406F50 53 push ebx
00406F51 8BD8 mov ebx, eax
00406F53 33C0 xor eax, eax
00406F55 A3 C4805D00 mov dword ptr [5D80C4], eax
00406F5A 6A 00 push 0
00406F5C E8 2BFFFFFF call 00406E8C
00406F61 A3 68F65D00 mov dword ptr [5DF668], eax ;返回这里
00406F66 A1 68F65D00 mov eax, dword ptr [5DF668]
00406F6B A3 D0805D00 mov dword ptr [5D80D0], eax
005D733C 55 push ebp ; oep
005D733D 8BEC mov ebp, esp
005D733F 83C4 F0 add esp, -10
005D7342 53 push ebx
005D7343 B8 246B5D00 mov eax, 005D6B24
005D7348 E8 03FCE2FF call 00406F50
005D734D 8B1D 44E55D00 mov ebx, dword ptr [5DE544] ; 返回这里
005D7353 8B03 mov eax, dword ptr [ebx]
005D7355 E8 8E68EBFF call 0048DBE8
005E9A7C 60 pushad
005E9A7D 9C pushfd
005E9A7E BF F4515E00 mov edi, 005E51F4
005E9A83 66:837F 02 14 cmp word ptr [edi+2], 14
005E9A88 75 22 jnz short 005E9AAC
005E9A8A 8B17 mov edx, dword ptr [edi]
005E9A8C 90 nop
005E9A8D 90 nop
005E9A8E 90 nop
005E9A8F 8B42 12 mov eax, dword ptr [edx+12]
005E9A92 8B18 mov ebx, dword ptr [eax]
005E9A94 891F mov dword ptr [edi], ebx
005E9A96 90 nop
005E9A97 EB 13 jmp short 005E9AAC
005E9A99 90 nop
005E9A9A 90 nop
005E9A9B 90 nop
005E9A9C 90 nop
005E9A9D 90 nop
005E9A9E 90 nop
005E9A9F 90 nop
005E9AA0 90 nop
005E9AA1 90 nop
005E9AA2 90 nop
005E9AA3 90 nop
005E9AA4 90 nop
005E9AA5 90 nop
005E9AA6 90 nop
005E9AA7 90 nop
005E9AA8 90 nop
005E9AA9 90 nop
005E9AAA 90 nop
005E9AAB 90 nop
005E9AAC 83C7 04 add edi, 4
005E9AAF 81FF 7C5B5E00 cmp edi, 005E5B80
005E9AB5 7D 02 jge short 005E9AB9
005E9AB7 ^ EB CA jmp short 005E9A83
005E9AB9 9D popfd
005E9ABA 61 popad
[注意]APP应用上架合规检测服务，协助应用顺利上架！
