-
-
[求助]此软件狗该如何破解？
-
2007-12-25 11:50 4123
-
请问高手可否帮忙帮这个dll破解掉，感谢！
+++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++
//********************** Start of Code in Object .text **************
Program Entry Point = 10001E98 (E:\桌面\反编译w32dasm\W32DASM\Rockey2.dll File Offset:00008E98)
:10001000 837C240801 cmp dword ptr [esp+08], 00000001
:10001005 7505 jne 1000100C
:10001007 E8A4000000 call 100010B0
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001005(C)
|
:1000100C B801000000 mov eax, 00000001
:10001011 C20C00 ret 000C
:10001014 90 nop
:10001015 90 nop
:10001016 90 nop
:10001017 90 nop
:10001018 90 nop
:10001019 90 nop
:1000101A 90 nop
:1000101B 90 nop
:1000101C 90 nop
:1000101D 90 nop
:1000101E 90 nop
:1000101F 90 nop
:10001020 E80B000000 call 10001030
:10001025 E926000000 jmp 10001050
:1000102A 90 nop
:1000102B 90 nop
:1000102C 90 nop
:1000102D 90 nop
:1000102E 90 nop
:1000102F 90 nop
* Referenced by a CALL at Address:
|:10001020
|
:10001030 68A0100010 push 100010A0
:10001035 6880100010 push 10001080
:1000103A 6A20 push 00000020
:1000103C 6814010000 push 00000114
:10001041 6868AA0010 push 1000AA68
:10001046 E8010B0000 call 10001B4C
:1000104B C3 ret
:1000104C 90 nop
:1000104D 90 nop
:1000104E 90 nop
:1000104F 90 nop
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001025(U)
|
:10001050 6860100010 push 10001060
:10001055 E8F20B0000 call 10001C4C
:1000105A 59 pop ecx
:1000105B C3 ret
:1000105C 90 nop
:1000105D 90 nop
:1000105E 90 nop
:1000105F 90 nop
:10001060 68A0100010 push 100010A0
:10001065 6A20 push 00000020
:10001067 6814010000 push 00000114
:1000106C 6868AA0010 push 1000AA68
:10001071 E8170C0000 call 10001C8D
:10001076 C3 ret
:10001077 90 nop
:10001078 90 nop
:10001079 90 nop
:1000107A 90 nop
:1000107B 90 nop
:1000107C 90 nop
:1000107D 90 nop
:1000107E 90 nop
:1000107F 90 nop
:10001080 56 push esi
:10001081 8BF1 mov esi, ecx
:10001083 8D8E10010000 lea ecx, dword ptr [esi+00000110]
:10001089 E8020A0000 call 10001A90
:1000108E 8BC6 mov eax, esi
:10001090 5E pop esi
:10001091 C3 ret
:10001092 90 nop
:10001093 90 nop
:10001094 90 nop
:10001095 90 nop
:10001096 90 nop
:10001097 90 nop
:10001098 90 nop
:10001099 90 nop
:1000109A 90 nop
:1000109B 90 nop
:1000109C 90 nop
:1000109D 90 nop
:1000109E 90 nop
:1000109F 90 nop
:100010A0 81C110010000 add ecx, 00000110
:100010A6 E9F5090000 jmp 10001AA0
:100010AB 90 nop
:100010AC 90 nop
:100010AD 90 nop
:100010AE 90 nop
:100010AF 90 nop
* Referenced by a CALL at Address:
|:10001007
|
:100010B0 81EC00010000 sub esp, 00000100
:100010B6 53 push ebx
* Reference To: USER32.wsprintfA, Ord:02ACh
|
:100010B7 8B1D28710010 mov ebx, dword ptr [10007128]
:100010BD 56 push esi
:100010BE 57 push edi
:100010BF 33FF xor edi, edi
:100010C1 BE78AB0010 mov esi, 1000AB78
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:100010EF(C)
|
:100010C6 57 push edi
:100010C7 8D442410 lea eax, dword ptr [esp+10]
* Possible StringData Ref from Data Obj ->"ROCKEY2_MUTEX%02d"
|
:100010CB 6830800010 push 10008030
:100010D0 50 push eax
:100010D1 FFD3 call ebx
:100010D3 83C40C add esp, 0000000C
:100010D6 8D4C240C lea ecx, dword ptr [esp+0C]
:100010DA 51 push ecx
:100010DB 8BCE mov ecx, esi
:100010DD E8DE090000 call 10001AC0
:100010E2 81C614010000 add esi, 00000114
:100010E8 47 inc edi
:100010E9 81FEF8CD0010 cmp esi, 1000CDF8
:100010EF 7CD5 jl 100010C6
:100010F1 5F pop edi
:100010F2 5E pop esi
:100010F3 5B pop ebx
:100010F4 81C400010000 add esp, 00000100
:100010FA C3 ret
:100010FB 90 nop
:100010FC 90 nop
:100010FD 90 nop
:100010FE 90 nop
:100010FF 90 nop
* Referenced by a CALL at Address:
|:1000148C
|
:10001100 8B4C2404 mov ecx, dword ptr [esp+04]
:10001104 83EC40 sub esp, 00000040
:10001107 8D442444 lea eax, dword ptr [esp+44]
:1000110B 50 push eax
:1000110C 51 push ecx
* Reference To: HID.HidD_GetPreparsedData, Ord:000Ah
|
:1000110D E80A0A0000 Call 10001B1C
:10001112 84C0 test al, al
:10001114 7509 jne 1000111F
:10001116 B80C0010A0 mov eax, A010000C
:1000111B 83C440 add esp, 00000040
:1000111E C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001114(C)
|
:1000111F 8B442444 mov eax, dword ptr [esp+44]
:10001123 8D542400 lea edx, dword ptr [esp]
:10001127 56 push esi
:10001128 52 push edx
:10001129 50 push eax
* Reference To: HID.HidP_GetCaps, Ord:0012h
|
:1000112A E8E7090000 Call 10001B16
:1000112F 85C0 test eax, eax
:10001131 7507 jne 1000113A
:10001133 BE0D0010A0 mov esi, A010000D
:10001138 EB14 jmp 1000114E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001131(C)
|
:1000113A 668B74240C mov si, word ptr [esp+0C]
:1000113F 6683EE49 sub si, 0049
:10001143 66F7DE neg si
:10001146 1BF6 sbb esi, esi
:10001148 81E6200010A0 and esi, A0100020
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001138(U)
|
:1000114E 8B4C2448 mov ecx, dword ptr [esp+48]
:10001152 51 push ecx
* Reference To: HID.HidD_FreePreparsedData, Ord:0001h
|
:10001153 E8B8090000 Call 10001B10
:10001158 84C0 test al, al
:1000115A 7505 jne 10001161
:1000115C BE0E0010A0 mov esi, A010000E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1000115A(C)
|
:10001161 8BC6 mov eax, esi
:10001163 5E pop esi
:10001164 83C440 add esp, 00000040
:10001167 C3 ret
:10001168 90 nop
:10001169 90 nop
:1000116A 90 nop
:1000116B 90 nop
:1000116C 90 nop
:1000116D 90 nop
:1000116E 90 nop
:1000116F 90 nop
* Referenced by a CALL at Address:
|:1000133C
|
:10001170 56 push esi
:10001171 33F6 xor esi, esi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1000117D(C)
|
:10001173 56 push esi
* Reference To: Rockey2.RY2_Close
|
:10001174 E8D7050000 call 10001750
:10001179 46 inc esi
:1000117A 83FE20 cmp esi, 00000020
:1000117D 7CF4 jl 10001173
:1000117F 5E pop esi
:10001180 C3 ret
:10001181 90 nop
:10001182 90 nop
:10001183 90 nop
:10001184 90 nop
:10001185 90 nop
:10001186 90 nop
:10001187 90 nop
:10001188 90 nop
:10001189 90 nop
:1000118A 90 nop
:1000118B 90 nop
:1000118C 90 nop
:1000118D 90 nop
:1000118E 90 nop
:1000118F 90 nop
* Referenced by a CALL at Address:
|:1000125F
|
:10001190 8B442408 mov eax, dword ptr [esp+08]
:10001194 8B4C2404 mov ecx, dword ptr [esp+04]
:10001198 6A49 push 00000049
:1000119A 50 push eax
:1000119B 51 push ecx
* Reference To: HID.HidD_SetFeature, Ord:000Fh
|
:1000119C E881090000 Call 10001B22
:100011A1 F6D8 neg al
:100011A3 1BC0 sbb eax, eax
:100011A5 25F7FFEF5F and eax, 5FEFFFF7
:100011AA 05090010A0 add eax, A0100009
:100011AF C3 ret
* Referenced by a CALL at Address:
|:10001278
|
:100011B0 56 push esi
:100011B1 8B74240C mov esi, dword ptr [esp+0C]
:100011B5 57 push edi
:100011B6 B912000000 mov ecx, 00000012
:100011BB 33C0 xor eax, eax
:100011BD 8BFE mov edi, esi
:100011BF F3 repz
:100011C0 AB stosd
:100011C1 AA stosb
:100011C2 8B7C240C mov edi, dword ptr [esp+0C]
:100011C6 57 push edi
* Reference To: HID.HidD_FlushQueue, Ord:0000h
|
:100011C7 E862090000 Call 10001B2E
:100011CC 84C0 test al, al
:100011CE 7508 jne 100011D8
:100011D0 5F pop edi
:100011D1 B80F0010A0 mov eax, A010000F
:100011D6 5E pop esi
:100011D7 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:100011CE(C)
|
:100011D8 6A49 push 00000049
:100011DA 56 push esi
:100011DB 57 push edi
* Reference To: HID.HidD_GetFeature, Ord:0004h
|
:100011DC E847090000 Call 10001B28
:100011E1 F6D8 neg al
:100011E3 1BC0 sbb eax, eax
:100011E5 5F pop edi
:100011E6 25F8FFEF5F and eax, 5FEFFFF8
:100011EB 5E pop esi
:100011EC 05080010A0 add eax, A0100008
:100011F1 C3 ret
+++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++
//********************** Start of Code in Object .text **************
Program Entry Point = 10001E98 (E:\桌面\反编译w32dasm\W32DASM\Rockey2.dll File Offset:00008E98)
:10001000 837C240801 cmp dword ptr [esp+08], 00000001
:10001005 7505 jne 1000100C
:10001007 E8A4000000 call 100010B0
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001005(C)
|
:1000100C B801000000 mov eax, 00000001
:10001011 C20C00 ret 000C
:10001014 90 nop
:10001015 90 nop
:10001016 90 nop
:10001017 90 nop
:10001018 90 nop
:10001019 90 nop
:1000101A 90 nop
:1000101B 90 nop
:1000101C 90 nop
:1000101D 90 nop
:1000101E 90 nop
:1000101F 90 nop
:10001020 E80B000000 call 10001030
:10001025 E926000000 jmp 10001050
:1000102A 90 nop
:1000102B 90 nop
:1000102C 90 nop
:1000102D 90 nop
:1000102E 90 nop
:1000102F 90 nop
* Referenced by a CALL at Address:
|:10001020
|
:10001030 68A0100010 push 100010A0
:10001035 6880100010 push 10001080
:1000103A 6A20 push 00000020
:1000103C 6814010000 push 00000114
:10001041 6868AA0010 push 1000AA68
:10001046 E8010B0000 call 10001B4C
:1000104B C3 ret
:1000104C 90 nop
:1000104D 90 nop
:1000104E 90 nop
:1000104F 90 nop
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001025(U)
|
:10001050 6860100010 push 10001060
:10001055 E8F20B0000 call 10001C4C
:1000105A 59 pop ecx
:1000105B C3 ret
:1000105C 90 nop
:1000105D 90 nop
:1000105E 90 nop
:1000105F 90 nop
:10001060 68A0100010 push 100010A0
:10001065 6A20 push 00000020
:10001067 6814010000 push 00000114
:1000106C 6868AA0010 push 1000AA68
:10001071 E8170C0000 call 10001C8D
:10001076 C3 ret
:10001077 90 nop
:10001078 90 nop
:10001079 90 nop
:1000107A 90 nop
:1000107B 90 nop
:1000107C 90 nop
:1000107D 90 nop
:1000107E 90 nop
:1000107F 90 nop
:10001080 56 push esi
:10001081 8BF1 mov esi, ecx
:10001083 8D8E10010000 lea ecx, dword ptr [esi+00000110]
:10001089 E8020A0000 call 10001A90
:1000108E 8BC6 mov eax, esi
:10001090 5E pop esi
:10001091 C3 ret
:10001092 90 nop
:10001093 90 nop
:10001094 90 nop
:10001095 90 nop
:10001096 90 nop
:10001097 90 nop
:10001098 90 nop
:10001099 90 nop
:1000109A 90 nop
:1000109B 90 nop
:1000109C 90 nop
:1000109D 90 nop
:1000109E 90 nop
:1000109F 90 nop
:100010A0 81C110010000 add ecx, 00000110
:100010A6 E9F5090000 jmp 10001AA0
:100010AB 90 nop
:100010AC 90 nop
:100010AD 90 nop
:100010AE 90 nop
:100010AF 90 nop
* Referenced by a CALL at Address:
|:10001007
|
:100010B0 81EC00010000 sub esp, 00000100
:100010B6 53 push ebx
* Reference To: USER32.wsprintfA, Ord:02ACh
|
:100010B7 8B1D28710010 mov ebx, dword ptr [10007128]
:100010BD 56 push esi
:100010BE 57 push edi
:100010BF 33FF xor edi, edi
:100010C1 BE78AB0010 mov esi, 1000AB78
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:100010EF(C)
|
:100010C6 57 push edi
:100010C7 8D442410 lea eax, dword ptr [esp+10]
* Possible StringData Ref from Data Obj ->"ROCKEY2_MUTEX%02d"
|
:100010CB 6830800010 push 10008030
:100010D0 50 push eax
:100010D1 FFD3 call ebx
:100010D3 83C40C add esp, 0000000C
:100010D6 8D4C240C lea ecx, dword ptr [esp+0C]
:100010DA 51 push ecx
:100010DB 8BCE mov ecx, esi
:100010DD E8DE090000 call 10001AC0
:100010E2 81C614010000 add esi, 00000114
:100010E8 47 inc edi
:100010E9 81FEF8CD0010 cmp esi, 1000CDF8
:100010EF 7CD5 jl 100010C6
:100010F1 5F pop edi
:100010F2 5E pop esi
:100010F3 5B pop ebx
:100010F4 81C400010000 add esp, 00000100
:100010FA C3 ret
:100010FB 90 nop
:100010FC 90 nop
:100010FD 90 nop
:100010FE 90 nop
:100010FF 90 nop
* Referenced by a CALL at Address:
|:1000148C
|
:10001100 8B4C2404 mov ecx, dword ptr [esp+04]
:10001104 83EC40 sub esp, 00000040
:10001107 8D442444 lea eax, dword ptr [esp+44]
:1000110B 50 push eax
:1000110C 51 push ecx
* Reference To: HID.HidD_GetPreparsedData, Ord:000Ah
|
:1000110D E80A0A0000 Call 10001B1C
:10001112 84C0 test al, al
:10001114 7509 jne 1000111F
:10001116 B80C0010A0 mov eax, A010000C
:1000111B 83C440 add esp, 00000040
:1000111E C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001114(C)
|
:1000111F 8B442444 mov eax, dword ptr [esp+44]
:10001123 8D542400 lea edx, dword ptr [esp]
:10001127 56 push esi
:10001128 52 push edx
:10001129 50 push eax
* Reference To: HID.HidP_GetCaps, Ord:0012h
|
:1000112A E8E7090000 Call 10001B16
:1000112F 85C0 test eax, eax
:10001131 7507 jne 1000113A
:10001133 BE0D0010A0 mov esi, A010000D
:10001138 EB14 jmp 1000114E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001131(C)
|
:1000113A 668B74240C mov si, word ptr [esp+0C]
:1000113F 6683EE49 sub si, 0049
:10001143 66F7DE neg si
:10001146 1BF6 sbb esi, esi
:10001148 81E6200010A0 and esi, A0100020
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001138(U)
|
:1000114E 8B4C2448 mov ecx, dword ptr [esp+48]
:10001152 51 push ecx
* Reference To: HID.HidD_FreePreparsedData, Ord:0001h
|
:10001153 E8B8090000 Call 10001B10
:10001158 84C0 test al, al
:1000115A 7505 jne 10001161
:1000115C BE0E0010A0 mov esi, A010000E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1000115A(C)
|
:10001161 8BC6 mov eax, esi
:10001163 5E pop esi
:10001164 83C440 add esp, 00000040
:10001167 C3 ret
:10001168 90 nop
:10001169 90 nop
:1000116A 90 nop
:1000116B 90 nop
:1000116C 90 nop
:1000116D 90 nop
:1000116E 90 nop
:1000116F 90 nop
* Referenced by a CALL at Address:
|:1000133C
|
:10001170 56 push esi
:10001171 33F6 xor esi, esi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1000117D(C)
|
:10001173 56 push esi
* Reference To: Rockey2.RY2_Close
|
:10001174 E8D7050000 call 10001750
:10001179 46 inc esi
:1000117A 83FE20 cmp esi, 00000020
:1000117D 7CF4 jl 10001173
:1000117F 5E pop esi
:10001180 C3 ret
:10001181 90 nop
:10001182 90 nop
:10001183 90 nop
:10001184 90 nop
:10001185 90 nop
:10001186 90 nop
:10001187 90 nop
:10001188 90 nop
:10001189 90 nop
:1000118A 90 nop
:1000118B 90 nop
:1000118C 90 nop
:1000118D 90 nop
:1000118E 90 nop
:1000118F 90 nop
* Referenced by a CALL at Address:
|:1000125F
|
:10001190 8B442408 mov eax, dword ptr [esp+08]
:10001194 8B4C2404 mov ecx, dword ptr [esp+04]
:10001198 6A49 push 00000049
:1000119A 50 push eax
:1000119B 51 push ecx
* Reference To: HID.HidD_SetFeature, Ord:000Fh
|
:1000119C E881090000 Call 10001B22
:100011A1 F6D8 neg al
:100011A3 1BC0 sbb eax, eax
:100011A5 25F7FFEF5F and eax, 5FEFFFF7
:100011AA 05090010A0 add eax, A0100009
:100011AF C3 ret
* Referenced by a CALL at Address:
|:10001278
|
:100011B0 56 push esi
:100011B1 8B74240C mov esi, dword ptr [esp+0C]
:100011B5 57 push edi
:100011B6 B912000000 mov ecx, 00000012
:100011BB 33C0 xor eax, eax
:100011BD 8BFE mov edi, esi
:100011BF F3 repz
:100011C0 AB stosd
:100011C1 AA stosb
:100011C2 8B7C240C mov edi, dword ptr [esp+0C]
:100011C6 57 push edi
* Reference To: HID.HidD_FlushQueue, Ord:0000h
|
:100011C7 E862090000 Call 10001B2E
:100011CC 84C0 test al, al
:100011CE 7508 jne 100011D8
:100011D0 5F pop edi
:100011D1 B80F0010A0 mov eax, A010000F
:100011D6 5E pop esi
:100011D7 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:100011CE(C)
|
:100011D8 6A49 push 00000049
:100011DA 56 push esi
:100011DB 57 push edi
* Reference To: HID.HidD_GetFeature, Ord:0004h
|
:100011DC E847090000 Call 10001B28
:100011E1 F6D8 neg al
:100011E3 1BC0 sbb eax, eax
:100011E5 5F pop edi
:100011E6 25F8FFEF5F and eax, 5FEFFFF8
:100011EB 5E pop esi
:100011EC 05080010A0 add eax, A0100008
:100011F1 C3 ret
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
赞赏
|
|
|---|---|
|
|
:100011F2 90 nop
:100011F3 90 nop :100011F4 90 nop :100011F5 90 nop :100011F6 90 nop :100011F7 90 nop :100011F8 90 nop :100011F9 90 nop :100011FA 90 nop :100011FB 90 nop :100011FC 90 nop :100011FD 90 nop :100011FE 90 nop :100011FF 90 nop * Referenced by a CALL at Address: |:10001288 | :10001200 8A442404 mov al, byte ptr [esp+04] :10001204 84C0 test al, al :10001206 7503 jne 1000120B :10001208 33C0 xor eax, eax :1000120A C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:10001206(C) | :1000120B 3C01 cmp al, 01 :1000120D 7506 jne 10001215 :1000120F B8210010A0 mov eax, A0100021 :10001214 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:1000120D(C) | :10001215 3C02 cmp al, 02 :10001217 7506 jne 1000121F :10001219 B8030010A0 mov eax, A0100003 :1000121E C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:10001217(C) | :1000121F 3C04 cmp al, 04 :10001221 7506 jne 10001229 :10001223 B8040010A0 mov eax, A0100004 :10001228 C3 ret * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:10001221(C) | :10001229 2C08 sub al, 08 :1000122B F6D8 neg al :1000122D 1BC0 sbb eax, eax :1000122F 25F9FF0000 and eax, 0000FFF9 :10001234 05060010A0 add eax, A0100006 :10001239 C3 ret :1000123A 90 nop :1000123B 90 nop :1000123C 90 nop :1000123D 90 nop :1000123E 90 nop :1000123F 90 nop * Referenced by a CALL at Addresses: |:10001847 , :1000192B , :10001A11 | :10001240 8B4C2404 mov ecx, dword ptr [esp+04] :10001244 53 push ebx :10001245 8B5C240C mov ebx, dword ptr [esp+0C] :10001249 56 push esi :1000124A 8D0449 lea eax, dword ptr [ecx+2*ecx] :1000124D 57 push edi :1000124E C1E003 shl eax, 03 :10001251 2BC1 sub eax, ecx :10001253 53 push ebx :10001254 8D3440 lea esi, dword ptr [eax+2*eax] :10001257 8B04B568AB0010 mov eax, dword ptr [4*esi+1000AB68] :1000125E 50 push eax :1000125F E82CFFFFFF call 10001190 :10001264 83C408 add esp, 00000008 :10001267 85C0 test eax, eax :10001269 753A jne 100012A5 :1000126B 8B7C2418 mov edi, dword ptr [esp+18] :1000126F 8B0CB568AB0010 mov ecx, dword ptr [4*esi+1000AB68] :10001276 57 push edi :10001277 51 push ecx :10001278 E833FFFFFF call 100011B0 :1000127D 83C408 add esp, 00000008 :10001280 85C0 test eax, eax :10001282 7521 jne 100012A5 :10001284 8A5701 mov dl, byte ptr [edi+01] :10001287 52 push edx :10001288 E873FFFFFF call 10001200 :1000128D 83C404 add esp, 00000004 :10001290 85C0 test eax, eax :10001292 7511 jne 100012A5 :10001294 8A4302 mov al, byte ptr [ebx+02] :10001297 8A5F02 mov bl, byte ptr [edi+02] :1000129A 2AC3 sub al, bl :1000129C F6D8 neg al :1000129E 1BC0 sbb eax, eax :100012A0 25FFFF10A0 and eax, A010FFFF * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:10001269(C), :10001282(C), :10001292(C) | :100012A5 5F pop edi :100012A6 5E pop esi :100012A7 5B pop ebx :100012A8 C3 ret :100012A9 90 nop :100012AA 90 nop :100012AB 90 nop :100012AC 90 nop :100012AD 90 nop :100012AE 90 nop :100012AF 90 nop * Referenced by a CALL at Addresses: |:100014D9 , :1000155C | :100012B0 56 push esi :100012B1 8B742408 mov esi, dword ptr [esp+08] :100012B5 33C9 xor ecx, ecx :100012B7 8BD6 mov edx, esi * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:100012CC(C) | :100012B9 8A02 mov al, byte ptr [edx] :100012BB 84C0 test al, al :100012BD 880431 mov byte ptr [ecx+esi], al :100012C0 740C je 100012CE :100012C2 41 inc ecx :100012C3 83C202 add edx, 00000002 :100012C6 81F900040000 cmp ecx, 00000400 :100012CC 7CEB jl 100012B9 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:100012C0(C) | :100012CE 5E pop esi :100012CF C3 ret * Referenced by a CALL at Addresses: |:10001566 , :10001588 | :100012D0 56 push esi :100012D1 8B742408 mov esi, dword ptr [esp+08] :100012D5 33C0 xor eax, eax :100012D7 33D2 xor edx, edx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:10001313(C) | :100012D9 8A0C32 mov cl, byte ptr [edx+esi] :100012DC 80F930 cmp cl, 30 :100012DF 7C0A jl 100012EB :100012E1 80F939 cmp cl, 39 :100012E4 7F05 jg 100012EB :100012E6 80E930 sub cl, 30 :100012E9 EB1C jmp 10001307 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:100012DF(C), :100012E4(C) | :100012EB 80F961 cmp cl, 61 :100012EE 7C0A jl 100012FA :100012F0 80F966 cmp cl, 66 :100012F3 7F05 jg 100012FA :100012F5 80E957 sub cl, 57 :100012F8 EB0D jmp 10001307 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:100012EE(C), :100012F3(C) | :100012FA 80F941 cmp cl, 41 :100012FD 7C10 jl 1000130F :100012FF 80F946 cmp cl, 46 :10001302 7F0B jg 1000130F :10001304 80E937 sub cl, 37 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:100012E9(U), :100012F8(U) | :10001307 0FBEC9 movsx ecx, cl :1000130A C1E004 shl eax, 04 :1000130D 03C1 add eax, ecx * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:100012FD(C), :10001302(C) | :1000130F 42 inc edx :10001310 83FA08 cmp edx, 00000008 :10001313 7CC4 jl 100012D9 :10001315 5E pop esi :10001316 C3 ret :10001317 90 nop :10001318 90 nop :10001319 90 nop :1000131A 90 nop :1000131B 90 nop :1000131C 90 nop :1000131D 90 nop :1000131E 90 nop :1000131F 90 nop Exported fn(): RY2_Find - Ord:0002h :10001320 B84C140000 mov eax, 0000144C :10001325 E8660A0000 call 10001D90 :1000132A 53 push ebx :1000132B 55 push ebp :1000132C 56 push esi :1000132D 33DB xor ebx, ebx :1000132F 57 push edi :10001330 33ED xor ebp, ebp :10001332 895C2418 mov dword ptr [esp+18], ebx :10001336 891DE8CC0010 mov dword ptr [1000CCE8], ebx :1000133C E82FFEFFFF call 10001170 :10001341 8D442430 lea eax, dword ptr [esp+30] :10001345 50 push eax * Reference To: HID.HidD_GetHidGuid, Ord:0005h | :10001346 E8FB070000 Call 10001B46 :1000134B 6A12 push 00000012 :1000134D 53 push ebx :1000134E 8D4C2438 lea ecx, dword ptr [esp+38] :10001352 53 push ebx :10001353 51 push ecx * Reference To: SETUPAPI.SetupDiGetClassDevsA, Ord:007Dh | :10001354 FF1520710010 Call dword ptr [10007120] :1000135A 8BF8 mov edi, eax :1000135C 83FFFF cmp edi, FFFFFFFF :1000135F 897C2410 mov dword ptr [esp+10], edi :10001363 750A jne 1000136F :10001365 BD100010A0 mov ebp, A0100010 :1000136A E90A030000 jmp 10001679 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:10001363(C) | :1000136F C74424401C000000 mov [esp+40], 0000001C :10001377 895C2414 mov dword ptr [esp+14], ebx * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:1000164E(C) | :1000137B 8B442414 mov eax, dword ptr [esp+14] :1000137F 8D542440 lea edx, dword ptr [esp+40] :10001383 52 push edx :10001384 8D4C2434 lea ecx, dword ptr [esp+34] :10001388 50 push eax :10001389 51 push ecx :1000138A 53 push ebx :1000138B 57 push edi * Reference To: SETUPAPI.SetupDiEnumDeviceInterfaces, Ord:0071h | :1000138C FF151C710010 Call dword ptr [1000711C] :10001392 85C0 test eax, eax :10001394 0F84BC020000 je 10001656 * Reference To: SETUPAPI.SetupDiGetDeviceInterfaceDetailA, Ord:008Fh | :1000139A 8B3518710010 mov esi, dword ptr [10007118] :100013A0 8D542418 lea edx, dword ptr [esp+18] :100013A4 53 push ebx :100013A5 52 push edx :100013A6 53 push ebx :100013A7 8D44244C lea eax, dword ptr [esp+4C] :100013AB 53 push ebx :100013AC 50 push eax :100013AD 57 push edi :100013AE FFD6 call esi :100013B0 8B542418 mov edx, dword ptr [esp+18] :100013B4 81FA00100000 cmp edx, 00001000 :100013BA 0F87A2020000 ja 10001662 :100013C0 B900040000 mov ecx, 00000400 :100013C5 33C0 xor eax, eax :100013C7 8DBC245C040000 lea edi, dword ptr [esp+0000045C] :100013CE 53 push ebx :100013CF F3 repz :100013D0 AB stosd :100013D1 8D4C2430 lea ecx, dword ptr [esp+30] :100013D5 8D442444 lea eax, dword ptr [esp+44] :100013D9 51 push ecx :100013DA 8B4C2418 mov ecx, dword ptr [esp+18] :100013DE 52 push edx :100013DF 8D942468040000 lea edx, dword ptr [esp+00000468] :100013E6 52 push edx :100013E7 50 push eax :100013E8 51 push ecx :100013E9 C784247404000005000000 mov dword ptr [esp+00000474], 00000005 :100013F4 FFD6 call esi :100013F6 85C0 test eax, eax :100013F8 0F846B020000 je 10001669 :100013FE 53 push ebx :100013FF 53 push ebx :10001400 6A03 push 00000003 :10001402 53 push ebx :10001403 6A03 push 00000003 :10001405 8D942474040000 lea edx, dword ptr [esp+00000474] :1000140C 68000000C0 push C0000000 :10001411 52 push edx * Reference To: KERNEL32.CreateFileA, Ord:0034h | :10001412 FF153C700010 Call dword ptr [1000703C] :10001418 8B15E8CC0010 mov edx, dword ptr [1000CCE8] :1000141E 8D0C52 lea ecx, dword ptr [edx+2*edx] :10001421 C1E103 shl ecx, 03 :10001424 2BCA sub ecx, edx :10001426 3BC3 cmp eax, ebx :10001428 8D0C49 lea ecx, dword ptr [ecx+2*ecx] :1000142B 89048D68AB0010 mov dword ptr [4*ecx+1000AB68], eax :10001432 0F8438020000 je 10001670 :10001438 8D542420 lea edx, dword ptr [esp+20] :1000143C C74424200C000000 mov [esp+20], 0000000C :10001444 52 push edx :10001445 50 push eax * Reference To: HID.HidD_GetAttributes, Ord:0002h | :10001446 E8F5060000 Call 10001B40 :1000144B 84C0 test al, al :1000144D 750A jne 10001459 :1000144F BD0B0010A0 mov ebp, A010000B :10001454 E9AC010000 jmp 10001605 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:1000144D(C) | :10001459 66817C24246E09 cmp word ptr [esp+24], 096E :10001460 0F859F010000 jne 10001605 :10001466 66817C24260102 cmp word ptr [esp+26], 0201 :1000146D 0F8592010000 jne 10001605 :10001473 8B0DE8CC0010 mov ecx, dword ptr [1000CCE8] :10001479 8D0449 lea eax, dword ptr [ecx+2*ecx] :1000147C C1E003 shl eax, 03 :1000147F 2BC1 sub eax, ecx :10001481 8D0440 lea eax, dword ptr [eax+2*eax] :10001484 8B0C8568AB0010 mov ecx, dword ptr [4*eax+1000AB68] :1000148B 51 push ecx :1000148C E86FFCFFFF call 10001100 :10001491 8BE8 mov ebp, eax :10001493 83C404 add esp, 00000004 :10001496 3BEB cmp ebp, ebx :10001498 0F8567010000 jne 10001605 :1000149E 8B0DE8CC0010 mov ecx, dword ptr [1000CCE8] :100014A4 8D54245C lea edx, dword ptr [esp+5C] :100014A8 6800040000 push 00000400 :100014AD 52 push edx :100014AE 8D0449 lea eax, dword ptr [ecx+2*ecx] :100014B1 C1E003 shl eax, 03 :100014B4 2BC1 sub eax, ecx :100014B6 8D0440 lea eax, dword ptr [eax+2*eax] :100014B9 8B0C8568AB0010 mov ecx, dword ptr [4*eax+1000AB68] :100014C0 51 push ecx * Reference To: HID.HidD_GetProductString, Ord:000Bh | :100014C1 E874060000 Call 10001B3A :100014C6 84C0 test al, al :100014C8 750A jne 100014D4 :100014CA BD120010A0 mov ebp, A0100012 :100014CF E931010000 jmp 10001605 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:100014C8(C) | :100014D4 8D54245C lea edx, dword ptr [esp+5C] :100014D8 52 push edx :100014D9 E8D2FDFFFF call 100012B0 :100014DE 83C404 add esp, 00000004 * Possible StringData Ref from Data Obj ->"USB DONGLE" | :100014E1 BE44800010 mov esi, 10008044 :100014E6 8D44245C lea eax, dword ptr [esp+5C] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:10001508(C) | :100014EA 8A10 mov dl, byte ptr [eax] :100014EC 8ACA mov cl, dl :100014EE 3A16 cmp dl, byte ptr [esi] :100014F0 751C jne 1000150E :100014F2 3ACB cmp cl, bl :100014F4 7414 je 1000150A :100014F6 8A5001 mov dl, byte ptr [eax+01] :100014F9 8ACA mov cl, dl :100014FB 3A5601 cmp dl, byte ptr [esi+01] :100014FE 750E jne 1000150E :10001500 83C002 add eax, 00000002 :10001503 83C602 add esi, 00000002 :10001506 3ACB cmp cl, bl :10001508 75E0 jne 100014EA * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:100014F4(C) | :1000150A 33C0 xor eax, eax :1000150C EB05 jmp 10001513 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:100014F0(C), :100014FE(C) | :1000150E 1BC0 sbb eax, eax :10001510 83D8FF sbb eax, FFFFFFFF * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:1000150C(U) | :10001513 3BC3 cmp eax, ebx :10001515 740A je 10001521 :10001517 BD200010A0 mov ebp, A0100020 :1000151C E9E4000000 jmp 10001605 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:10001515(C) | :10001521 8B0DE8CC0010 mov ecx, dword ptr [1000CCE8] :10001527 8D44245C lea eax, dword ptr [esp+5C] :1000152B 6800040000 push 00000400 :10001530 50 push eax :10001531 8D0449 lea eax, dword ptr [ecx+2*ecx] :10001534 C1E003 shl eax, 03 :10001537 2BC1 sub eax, ecx :10001539 8D0C40 lea ecx, dword ptr [eax+2*eax] :1000153C 8B148D68AB0010 mov edx, dword ptr [4*ecx+1000AB68] :10001543 52 push edx * Reference To: HID.HidD_GetSerialNumberString, Ord:000Ch | :10001544 E8EB050000 Call 10001B34 :10001549 84C0 test al, al :1000154B 750A jne 10001557 :1000154D BD110010A0 mov ebp, A0100011 :10001552 E9AE000000 jmp 10001605 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:1000154B(C) | :10001557 8D44245C lea eax, dword ptr [esp+5C] :1000155B 50 push eax :1000155C E84FFDFFFF call 100012B0 :10001561 8D4C2460 lea ecx, dword ptr [esp+60] :10001565 51 push ecx :10001566 E865FDFFFF call 100012D0 :1000156B 8B15E8CC0010 mov edx, dword ptr [1000CCE8] :10001571 8D0C52 lea ecx, dword ptr [edx+2*edx] :10001574 C1E103 shl ecx, 03 :10001577 2BCA sub ecx, edx :10001579 8D1449 lea edx, dword ptr [ecx+2*ecx] :1000157C 89049570AB0010 mov dword ptr [4*edx+1000AB70], eax :10001583 8D44246C lea eax, dword ptr [esp+6C] :10001587 50 push eax :10001588 E843FDFFFF call 100012D0 :1000158D 8B15E8CC0010 mov edx, dword ptr [1000CCE8] :10001593 8DBC246C040000 lea edi, dword ptr [esp+0000046C] :1000159A 83C40C add esp, 0000000C :1000159D 8D0C52 lea ecx, dword ptr [edx+2*edx] :100015A0 C1E103 shl ecx, 03 :100015A3 2BCA sub ecx, edx :100015A5 8D1449 lea edx, dword ptr [ecx+2*ecx] :100015A8 C1E202 shl edx, 02 :100015AB 89826CAB0010 mov dword ptr [edx+1000AB6C], eax :100015B1 8B8A70AB0010 mov ecx, dword ptr [edx+1000AB70] :100015B7 33C8 xor ecx, eax :100015B9 668B442428 mov ax, word ptr [esp+28] :100015BE 898A6CAB0010 mov dword ptr [edx+1000AB6C], ecx :100015C4 66898274AB0010 mov word ptr [edx+1000AB74], ax :100015CB 83C9FF or ecx, FFFFFFFF :100015CE 33C0 xor eax, eax :100015D0 F2 repnz :100015D1 AE scasb :100015D2 F7D1 not ecx :100015D4 8DB268AA0010 lea esi, dword ptr [edx+1000AA68] :100015DA 2BF9 sub edi, ecx :100015DC 8BC1 mov eax, ecx :100015DE 8974241C mov dword ptr [esp+1C], esi :100015E2 8BF7 mov esi, edi :100015E4 8B7C241C mov edi, dword ptr [esp+1C] :100015E8 C1E902 shr ecx, 02 :100015EB F3 repz :100015EC A5 movsd :100015ED 8BC8 mov ecx, eax :100015EF A1E8CC0010 mov eax, dword ptr [1000CCE8] :100015F4 83E103 and ecx, 00000003 :100015F7 40 inc eax :100015F8 F3 repz :100015F9 A4 movsb :100015FA 899A68AB0010 mov dword ptr [edx+1000AB68], ebx :10001600 A3E8CC0010 mov dword ptr [1000CCE8], eax |
|
|
他的文章
