请高人批点-软件逆向-看雪-安全社区|安全招聘|kanxue.com

请高人批点

2004-11-9 14:39 3690

请高人批点

vinfor

2004-11-9 14:39

3690

下面的代码是对文件进行加密的，有谁可以帮我分析一下

:005D900C 55                   push ebp
:005D900D 8BEC                   mov ebp, esp
:005D900F B912000000             mov ecx, 00000012

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D9019(C)
|
:005D9014 6A00                   push 00000000
:005D9016 6A00                   push 00000000
:005D9018 49                   dec ecx
:005D9019 75F9                   jne 005D9014
:005D901B 51                   push ecx
:005D901C 53                   push ebx
:005D901D 56                   push esi
:005D901E 57                   push edi
:005D901F 8945FC                mov dword ptr [ebp-04], eax
:005D9022 33C0                   xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D8FAE(C)
|
:005D9024 55                   push ebp
:005D9025 68BD935D00             push 005D93BD
:005D902A 64FF30                push dword ptr fs:[eax]
:005D902D 648920                mov dword ptr fs:[eax], esp
:005D9030 8B45FC                mov eax, dword ptr [ebp-04]
:005D9033 8B8010030000          mov eax, dword ptr [eax+00000310]
:005D9039 8B403C                mov eax, dword ptr [eax+3C]
:005D903C 8B10                   mov edx, dword ptr [eax]
:005D903E FF5214                call [edx+14]
:005D9041 85C0                   test eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D8FD4(C)
|
:005D9043 7542                   jne 005D9087
:005D9045 8D45D0                lea eax, dword ptr [ebp-30]

* Possible StringData Ref from Code Obj ->"No Files !"
                              |
:005D9048 BAD4935D00             mov edx, 005D93D4
:005D904D E856CCE2FF             call 00405CA8
:005D9052 8D45D0                lea eax, dword ptr [ebp-30]
:005D9055 50                   push eax
:005D9056 8D45C0                lea eax, dword ptr [ebp-40]

* Possible StringData Ref from Code Obj ->"文件不存在"
                              |
:005D9059 BAE8935D00             mov edx, 005D93E8
:005D905E E845CCE2FF             call 00405CA8
:005D9063 8D45C0                lea eax, dword ptr [ebp-40]
:005D9066 8D4DE0                lea ecx, dword ptr [ebp-20]
:005D9069 5A                   pop edx
:005D906A E8AD6F0700             call 0065001C
:005D906F 8D55E0                lea edx, dword ptr [ebp-20]
:005D9072 8D45F0                lea eax, dword ptr [ebp-10]
:005D9075 E8CACBE2FF             call 00405C44
:005D907A 8B45F0                mov eax, dword ptr [ebp-10]
:005D907D E82EE6F0FF             call 004E76B0
:005D9082 E9DD020000             jmp 005D9364

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D9043(C)
|
:005D9087 8B45FC                mov eax, dword ptr [ebp-04]
:005D908A 8B8000030000          mov eax, dword ptr [eax+00000300]
:005D9090 33D2                   xor edx, edx
:005D9092 8B08                   mov ecx, dword ptr [eax]
:005D9094 FF5164                call [ecx+64]
:005D9097 8B45FC                mov eax, dword ptr [ebp-04]
:005D909A 8B80F8020000          mov eax, dword ptr [eax+000002F8]
:005D90A0 33D2                   xor edx, edx
:005D90A2 8B08                   mov ecx, dword ptr [eax]
:005D90A4 FF5164                call [ecx+64]
:005D90A7 8B45FC                mov eax, dword ptr [ebp-04]
:005D90AA 8B80FC020000          mov eax, dword ptr [eax+000002FC]
:005D90B0 33D2                   xor edx, edx
:005D90B2 8B08                   mov ecx, dword ptr [eax]
:005D90B4 FF5164                call [ecx+64]
:005D90B7 8B45FC                mov eax, dword ptr [ebp-04]
:005D90BA 8B8010030000          mov eax, dword ptr [eax+00000310]
:005D90C0 8B403C                mov eax, dword ptr [eax+3C]
:005D90C3 8B10                   mov edx, dword ptr [eax]
:005D90C5 FF5214                call [edx+14]
:005D90C8 8BD0                   mov edx, eax
:005D90CA 8B45FC                mov eax, dword ptr [ebp-04]
:005D90CD 8B8008030000          mov eax, dword ptr [eax+00000308]
:005D90D3 E8F890EBFF             call 004921D0
:005D90D8 8B45FC                mov eax, dword ptr [ebp-04]
:005D90DB 8B8008030000          mov eax, dword ptr [eax+00000308]
:005D90E1 BA01000000             mov edx, 00000001
:005D90E6 E8F590EBFF             call 004921E0
:005D90EB 8B45FC                mov eax, dword ptr [ebp-04]
:005D90EE 8B8008030000          mov eax, dword ptr [eax+00000308]
:005D90F4 B201                   mov dl, 01
:005D90F6 E891A0E7FF             call 0045318C
:005D90FB A1EC956500             mov eax, dword ptr [006595EC]
:005D9100 8B00                   mov eax, dword ptr [eax]
:005D9102 66BAF5FF             mov dx, FFF5
:005D9106 E8E990E9FF             call 004721F4
:005D910B 8D55BC                lea edx, dword ptr [ebp-44]
:005D910E 8B45FC                mov eax, dword ptr [ebp-04]
:005D9111 8B8000030000          mov eax, dword ptr [eax+00000300]
:005D9117 E874EEE9FF             call 00477F90
:005D911C 8B45BC                mov eax, dword ptr [ebp-44]
:005D911F 8D55F8                lea edx, dword ptr [ebp-08]
:005D9122 E8F5E7F0FF             call 004E791C
:005D9127 33C0                   xor eax, eax
:005D9129 55                   push ebp
:005D912A 685D935D00             push 005D935D
:005D912F 64FF30                push dword ptr fs:[eax]
:005D9132 648920                mov dword ptr fs:[eax], esp
:005D9135 8B45FC                mov eax, dword ptr [ebp-04]
:005D9138 8B8010030000          mov eax, dword ptr [eax+00000310]
:005D913E 8B403C                mov eax, dword ptr [eax+3C]
:005D9141 8B10                   mov edx, dword ptr [eax]
:005D9143 FF5214                call [edx+14]
:005D9146 8BF0                   mov esi, eax
:005D9148 4E                   dec esi
:005D9149 85F6                   test esi, esi
:005D914B 0F8C57010000          jl 005D92A8
:005D9151 46                   inc esi
:005D9152 33DB                   xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D92A2(C)
|
:005D9154 8D4DF4                lea ecx, dword ptr [ebp-0C]
:005D9157 8B45FC                mov eax, dword ptr [ebp-04]
:005D915A 8B8010030000          mov eax, dword ptr [eax+00000310]
:005D9160 8B403C                mov eax, dword ptr [eax+3C]
:005D9163 8BD3                   mov edx, ebx
:005D9165 8B38                   mov edi, dword ptr [eax]
:005D9167 FF570C                call [edi+0C]
:005D916A 8D45B8                lea eax, dword ptr [ebp-48]
:005D916D 8B4DF4                mov ecx, dword ptr [ebp-0C]
:005D9170 8B55F8                mov edx, dword ptr [ebp-08]
:005D9173 E888BBE2FF             call 00404D00
:005D9178 8B45B8                mov eax, dword ptr [ebp-48]
:005D917B E82C54F2FF             call 004FE5AC
:005D9180 84C0                   test al, al
:005D9182 0F8507010000          jne 005D928F
:005D9188 8D45B4                lea eax, dword ptr [ebp-4C]

* Possible StringData Ref from Code Obj ->"$$$$@@@@.mpg"
                              |
:005D918B B9FC935D00             mov ecx, 005D93FC
:005D9190 8B55F8                mov edx, dword ptr [ebp-08]
:005D9193 E868BBE2FF             call 00404D00
:005D9198 8B45B4                mov eax, dword ptr [ebp-4C]
:005D919B E8D411E3FF             call 0040A374
:005D91A0 84C0                   test al, al
:005D91A2 7418                   je 005D91BC
:005D91A4 8D45B0                lea eax, dword ptr [ebp-50]

* Possible StringData Ref from Code Obj ->"$$$$@@@@.mpg"
                              |
:005D91A7 B9FC935D00             mov ecx, 005D93FC
:005D91AC 8B55F8                mov edx, dword ptr [ebp-08]
:005D91AF E84CBBE2FF             call 00404D00
:005D91B4 8B45B0                mov eax, dword ptr [ebp-50]
:005D91B7 E83053F2FF             call 004FE4EC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D91A2(C)
|
:005D91BC 8B45FC                mov eax, dword ptr [ebp-04]
:005D91BF 8B8014030000          mov eax, dword ptr [eax+00000314]
:005D91C5 83C034                add eax, 00000034
:005D91C8 8B4DF4                mov ecx, dword ptr [ebp-0C]
:005D91CB 8B55F8                mov edx, dword ptr [ebp-08]
:005D91CE E82DBBE2FF             call 00404D00
:005D91D3 8B45FC                mov eax, dword ptr [ebp-04]
:005D91D6 8B8014030000          mov eax, dword ptr [eax+00000314]
:005D91DC 83C038                add eax, 00000038

* Possible StringData Ref from Code Obj ->"$$$$@@@@.mpg"
                              |
:005D91DF B9FC935D00             mov ecx, 005D93FC
:005D91E4 8B55F8                mov edx, dword ptr [ebp-08]
:005D91E7 E814BBE2FF             call 00404D00
:005D91EC 8B45FC                mov eax, dword ptr [ebp-04]
:005D91EF 8B8014030000          mov eax, dword ptr [eax+00000314]
:005D91F5 C6403C01             mov [eax+3C], 01
:005D91F9 8D45AC                lea eax, dword ptr [ebp-54]
:005D91FC 8B4DF4                mov ecx, dword ptr [ebp-0C]
:005D91FF 8B55F8                mov edx, dword ptr [ebp-08]
:005D9202 E8F9BAE2FF             call 00404D00
:005D9207 8B55AC                mov edx, dword ptr [ebp-54]
:005D920A 8B45FC                mov eax, dword ptr [ebp-04]
:005D920D 8B800C030000          mov eax, dword ptr [eax+0000030C]
:005D9213 E884A0E7FF             call 0045329C
:005D9218 8B45FC                mov eax, dword ptr [ebp-04]
:005D921B 8B800C030000          mov eax, dword ptr [eax+0000030C]
:005D9221 B201                   mov dl, 01
:005D9223 E8649FE7FF             call 0045318C
:005D9228 8B45FC                mov eax, dword ptr [ebp-04]
:005D922B 8B8014030000          mov eax, dword ptr [eax+00000314]
:005D9231 E8DAE5FFFF             call 005D7810
:005D9236 84C0                   test al, al
:005D9238 7445                   je 005D927F
:005D923A 8D45A8                lea eax, dword ptr [ebp-58]
:005D923D 8B4DF4                mov ecx, dword ptr [ebp-0C]
:005D9240 8B55F8                mov edx, dword ptr [ebp-08]
:005D9243 E8B8BAE2FF             call 00404D00
:005D9248 8B45A8                mov eax, dword ptr [ebp-58]
:005D924B E89C52F2FF             call 004FE4EC
:005D9250 84C0                   test al, al
:005D9252 742B                   je 005D927F
:005D9254 8D45A4                lea eax, dword ptr [ebp-5C]
:005D9257 8B4DF4                mov ecx, dword ptr [ebp-0C]
:005D925A 8B55F8                mov edx, dword ptr [ebp-08]
:005D925D E89EBAE2FF             call 00404D00
:005D9262 8B45A4                mov eax, dword ptr [ebp-5C]
:005D9265 50                   push eax
:005D9266 8D45A0                lea eax, dword ptr [ebp-60]

* Possible StringData Ref from Code Obj ->"$$$$@@@@.mpg"
                              |
:005D9269 B9FC935D00             mov ecx, 005D93FC
:005D926E 8B55F8                mov edx, dword ptr [ebp-08]
:005D9271 E88ABAE2FF             call 00404D00
:005D9276 8B45A0                mov eax, dword ptr [ebp-60]
:005D9279 5A                   pop edx
:005D927A E8C152F2FF             call 004FE540

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:005D9238(C), :005D9252(C)
|
:005D927F 8B45FC                mov eax, dword ptr [ebp-04]
:005D9282 8B800C030000          mov eax, dword ptr [eax+0000030C]
:005D9288 33D2                   xor edx, edx
:005D928A E8FD9EE7FF             call 0045318C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D9182(C)
|
:005D928F 8D5301                lea edx, dword ptr [ebx+01]
:005D9292 8B45FC                mov eax, dword ptr [ebp-04]
:005D9295 8B8008030000          mov eax, dword ptr [eax+00000308]
:005D929B E8408FEBFF             call 004921E0
:005D92A0 43                   inc ebx
:005D92A1 4E                   dec esi
:005D92A2 0F85ACFEFFFF          jne 005D9154

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D914B(C)
|
:005D92A8 8D857CFFFFFF          lea eax, dword ptr [ebp+FFFFFF7C]
:005D92AE BA14945D00             mov edx, 005D9414
:005D92B3 E8F0C9E2FF             call 00405CA8
:005D92B8 8D857CFFFFFF          lea eax, dword ptr [ebp+FFFFFF7C]
:005D92BE 50                   push eax
:005D92BF 8D856CFFFFFF          lea eax, dword ptr [ebp+FFFFFF6C]

* Possible StringData Ref from Code Obj ->"完成"
                              |
:005D92C5 BA20945D00             mov edx, 005D9420
:005D92CA E8D9C9E2FF             call 00405CA8
:005D92CF 8D856CFFFFFF          lea eax, dword ptr [ebp+FFFFFF6C]
:005D92D5 8D4D8C                lea ecx, dword ptr [ebp-74]
:005D92D8 5A                   pop edx
:005D92D9 E83E6D0700             call 0065001C
:005D92DE 8D558C                lea edx, dword ptr [ebp-74]
:005D92E1 8D459C                lea eax, dword ptr [ebp-64]
:005D92E4 E85BC9E2FF             call 00405C44
:005D92E9 8B459C                mov eax, dword ptr [ebp-64]
:005D92EC E85BE4F0FF             call 004E774C
:005D92F1 33C0                   xor eax, eax
:005D92F3 5A                   pop edx
:005D92F4 59                   pop ecx
:005D92F5 59                   pop ecx
:005D92F6 648910                mov dword ptr fs:[eax], edx
:005D92F9 6864935D00             push 005D9364

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D9362(U)
|
:005D92FE 8B45FC                mov eax, dword ptr [ebp-04]
:005D9301 8B800C030000          mov eax, dword ptr [eax+0000030C]
:005D9307 33D2                   xor edx, edx
:005D9309 E87E9EE7FF             call 0045318C
:005D930E 8B45FC                mov eax, dword ptr [ebp-04]
:005D9311 8B8000030000          mov eax, dword ptr [eax+00000300]
:005D9317 B201                   mov dl, 01
:005D9319 8B08                   mov ecx, dword ptr [eax]
:005D931B FF5164                call [ecx+64]
:005D931E 8B45FC                mov eax, dword ptr [ebp-04]
:005D9321 8B80F8020000          mov eax, dword ptr [eax+000002F8]
:005D9327 B201                   mov dl, 01
:005D9329 8B08                   mov ecx, dword ptr [eax]
:005D932B FF5164                call [ecx+64]
:005D932E 8B45FC                mov eax, dword ptr [ebp-04]
:005D9331 8B80FC020000          mov eax, dword ptr [eax+000002FC]
:005D9337 B201                   mov dl, 01
:005D9339 8B08                   mov ecx, dword ptr [eax]
:005D933B FF5164                call [ecx+64]
:005D933E 8B45FC                mov eax, dword ptr [ebp-04]
:005D9341 8B8008030000          mov eax, dword ptr [eax+00000308]
:005D9347 33D2                   xor edx, edx
:005D9349 E83E9EE7FF             call 0045318C
:005D934E A1EC956500             mov eax, dword ptr [006595EC]
:005D9353 8B00                   mov eax, dword ptr [eax]
:005D9355 33D2                   xor edx, edx
:005D9357 E8988EE9FF             call 004721F4
:005D935C C3                   ret

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

收藏・1

免费・1

打赏

最新回复 (6)
vinfor 雪币： 202 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 21 粉丝 0 关注私信	vinfor 2004-11-9 16:26 2 楼 0 没有人看得懂吗？
vinfor 雪币： 202 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 21 粉丝 0 关注私信	vinfor 2004-11-10 10:09 3 楼 0 那位高手指点一二？
blowfish 雪币： 3246 活跃值： (339) 能力值： (RANK：20 ) 在线值：发帖 15 回帖 295 粉丝 7 关注私信	blowfish 2004-11-10 10:56 4 楼 0 有人能看懂才怪。用DeDe或者IDA + VCL sig分析。
great1234 雪币： 16 能力值： (RANK：10 ) 在线值：发帖 18 回帖 523 粉丝 1 关注私信	great1234 2004-11-10 11:56 5 楼 0 报告首长!---我看懂了,是数字和字母的组合
无奈无赖雪币： 117 活跃值： (20) 能力值： ( LV2，RANK：10 ) 在线值：发帖 24 回帖 728 粉丝 2 关注私信	无奈无赖 2004-11-10 13:41 6 楼 0 晕，我也看懂了呢，是一段代码。。。它由数字和字母和一些特殊符号组成。。
kimmal 雪币： 255 活跃值： (40) 能力值： ( LV4，RANK：50 ) 在线值：发帖 10 回帖 406 粉丝 0 关注私信	kimmal 1 2004-11-10 14:28 7 楼 0 嬉嬉，居然是汇编代码~!:o
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复