005A6A0E . C2 0400 retn 4
005A6A11 8D40 00 lea eax, dword ptr [eax]
005A6A14 . FFFFFFFF dd FFFFFFFF
005A6A18 . 05000000 dd 00000005
005A6A1C . 2E 67 69 66 5>ascii ".gif]",0
005A6A22 00 db 00
005A6A23 00 db 00
005A6A24 . FFFFFFFF dd FFFFFFFF
005A6A28 . 05000000 dd 00000005
005A6A2C . 2E 6A 70 67 5>ascii ".jpg]",0
005A6A32 00 db 00
005A6A33 00 db 00
005A6A34 /$ 55 push ebp
005A6A35 |. 8BEC mov ebp, esp
005A6A37 |. 53 push ebx
005A6A38 |. 56 push esi
005A6A39 |. 57 push edi
005A6A3A |. 8BF1 mov esi, ecx
005A6A3C |. 8BFA mov edi, edx
005A6A3E |. 8BD8 mov ebx, eax
005A6A40 |. 56 push esi
005A6A41 |. 8B0D 5C0C5D00 mov ecx, dword ptr [5D0C5C] ; 005A6A1C
005A6A47 |. 8BD7 mov edx, edi
005A6A49 |. 8BC3 mov eax, ebx
005A6A4B |. E8 F4FEFFFF call 005A6944
005A6A50 |. 833E 00 cmp dword ptr [esi], 0
005A6A53 |. 75 10 jnz short 005A6A65
005A6A55 |. 56 push esi
005A6A56 |. 8B0D 600C5D00 mov ecx, dword ptr [5D0C60] ; 005A6A2C
005A6A5C |. 8BD7 mov edx, edi
005A6A5E |. 8BC3 mov eax, ebx
005A6A60 |. E8 DFFEFFFF call 005A6944
005A6A65 |> 5F pop edi
005A6A66 |. 5E pop esi
005A6A67 |. 5B pop ebx
005A6A68 |. 5D pop ebp
005A6A69 \. C3 retn
005A6A6A 8BC0 mov eax, eax
005A6A6C /$ 55 push ebp
005A6A6D |. 8BEC mov ebp, esp
005A6A6F |. 83C4 E0 add esp, -20
005A6A72 |. 53 push ebx
005A6A73 |. 56 push esi
005A6A74 |. 57 push edi
005A6A75 |. 33DB xor ebx, ebx
005A6A77 |. 895D E0 mov dword ptr [ebp-20], ebx
005A6A7A |. 895D F4 mov dword ptr [ebp-C], ebx
005A6A7D |. 895D FC mov dword ptr [ebp-4], ebx
005A6A80 |. 895D F8 mov dword ptr [ebp-8], ebx
005A6A83 |. 8BF2 mov esi, edx
005A6A85 |. 8BF8 mov edi, eax
005A6A87 |. 33C0 xor eax, eax
005A6A89 |. 55 push ebp
005A6A8A |. 68 5D6B5A00 push 005A6B5D
005A6A8F |. 64:FF30 push dword ptr fs:[eax]
005A6A92 |. 64:8920 mov dword ptr fs:[eax], esp
005A6A95 |. 8D4D FC lea ecx, dword ptr [ebp-4]
005A6A98 |. 8B16 mov edx, dword ptr [esi]
005A6A9A |. 8BC7 mov eax, edi
005A6A9C |. E8 93FFFFFF call 005A6A34
005A6AA1 |. E9 8A000000 jmp 005A6B30
005A6AA6 |> 8B5D FC /mov ebx, dword ptr [ebp-4]
005A6AA9 |. 85DB |test ebx, ebx
005A6AAB 74 05 je short 005A6AB2
005A6AAD |. 83EB 04 |sub ebx, 4
005A6AB0 |. 8B1B |mov ebx, dword ptr [ebx]
005A6AB2 |> 8D45 F8 |lea eax, dword ptr [ebp-8]
005A6AB5 |. 50 |push eax
005A6AB6 |. 8BCB |mov ecx, ebx
005A6AB8 |. 83E9 02 |sub ecx, 2
005A6ABB |. BA 02000000 |mov edx, 2
005A6AC0 |. 8B45 FC |mov eax, dword ptr [ebp-4]
005A6AC3 |. E8 50F1E5FF |call 00405C18
005A6AC8 |. 8D45 F4 |lea eax, dword ptr [ebp-C]
005A6ACB |. 50 |push eax
005A6ACC |. A1 B00E5D00 |mov eax, dword ptr [5D0EB0]
005A6AD1 |. 8B00 |mov eax, dword ptr [eax]
005A6AD3 |. 8B80 28130000 |mov eax, dword ptr [eax+1328]
005A6AD9 |. 8945 E4 |mov dword ptr [ebp-1C], eax
005A6ADC |. C645 E8 0B |mov byte ptr [ebp-18], 0B
005A6AE0 |. 8B45 F8 |mov eax, dword ptr [ebp-8]
005A6AE3 |. 8945 EC |mov dword ptr [ebp-14], eax
005A6AE6 |. C645 F0 0B |mov byte ptr [ebp-10], 0B
005A6AEA |. 8D55 E4 |lea edx, dword ptr [ebp-1C]
005A6AED |. B9 01000000 |mov ecx, 1
005A6AF2 |. B8 746B5A00 |mov eax, 005A6B74 ; ASCII "<img src='%s%s'/>"
005A6AF7 |. E8 2858E6FF |call 0040C324
005A6AFC |. 8B55 F4 |mov edx, dword ptr [ebp-C]
005A6AFF |. 8D45 F8 |lea eax, dword ptr [ebp-8]
005A6B02 |. E8 95ECE5FF |call 0040579C
005A6B07 |. 6A 00 |push 0
005A6B09 |. 8D45 E0 |lea eax, dword ptr [ebp-20]
005A6B0C |. 50 |push eax
005A6B0D |. 8B06 |mov eax, dword ptr [esi]
005A6B0F |. 8B4D F8 |mov ecx, dword ptr [ebp-8]
005A6B12 8B55 FC |mov edx, dword ptr [ebp-4]
005A6B15 E8 62F7F2FF |call 004D627C
005A6B1A 8B55 E0 mov edx, dword ptr [ebp-20]
005A6B1D 8BC6 |mov eax, esi
005A6B1F E8 34ECE5FF |call 00405758
005A6B24 8D4D FC |lea ecx, dword ptr [ebp-4]
005A6B27 8B16 |mov edx, dword ptr [esi]
005A6B29 8BC7 |mov eax, edi
005A6B2B E8 04FFFFFF |call 005A6A34
005A6B30 837D FC 00 cmp dword ptr [ebp-4], 0
005A6B34 ^ 0F85 6CFFFFFF jnz 005A6AA6
005A6B3A 33C0 xor eax, eax
005A6B3C 5A pop edx
005A6B3D 59 pop ecx
005A6B3E 59 pop ecx
005A6B3F |. 64:8910 mov dword ptr fs:[eax], edx
005A6B42 |. 68 646B5A00 push 005A6B64
005A6B47 |> 8D45 E0 lea eax, dword ptr [ebp-20]
005A6B4A |. E8 B5EBE5FF call 00405704
005A6B4F |. 8D45 F4 lea eax, dword ptr [ebp-C]
005A6B52 |. BA 03000000 mov edx, 3
005A6B57 |. E8 CCEBE5FF call 00405728
005A6B5C \. C3 retn
005A6B5D .^ E9 72E3E5FF jmp 00404ED4
005A6B62 .^ EB E3 jmp short 005A6B47
005A6B64 . 5F pop edi
005A6B65 . 5E pop esi
005A6B66 . 5B pop ebx
005A6B67 . 8BE5 mov esp, ebp
005A6B69 . 5D pop ebp
005A6B6A . C3 retn
005A6B6B 00 db 00
005A6B6C . FFFFFFFF dd FFFFFFFF
005A6B70 . 11000000 dd 00000011
005A6B74 . 3C 69 6D 67 2>ascii "<img src='%s%s'/"
005A6B84 . 3E 00 ascii ">",0
005A6B86 00 db 00
005A6B87 00 db 00
005A6B88 . 55 push ebp
005A6B89 . 8BEC mov ebp, esp
005A6B8B . 33C0 xor eax, eax
[课程]Android-CTF解题方法汇总！
