下面的代码是对文件进行加密的,有谁可以帮我分析一下
:005D900C 55 push ebp
:005D900D 8BEC mov ebp, esp
:005D900F B912000000 mov ecx, 00000012
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D9019(C)
|
:005D9014 6A00 push 00000000
:005D9016 6A00 push 00000000
:005D9018 49 dec ecx
:005D9019 75F9 jne 005D9014
:005D901B 51 push ecx
:005D901C 53 push ebx
:005D901D 56 push esi
:005D901E 57 push edi
:005D901F 8945FC mov dword ptr [ebp-04], eax
:005D9022 33C0 xor eax, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D8FAE(C)
|
:005D9024 55 push ebp
:005D9025 68BD935D00 push 005D93BD
:005D902A 64FF30 push dword ptr fs:[eax]
:005D902D 648920 mov dword ptr fs:[eax], esp
:005D9030 8B45FC mov eax, dword ptr [ebp-04]
:005D9033 8B8010030000 mov eax, dword ptr [eax+00000310]
:005D9039 8B403C mov eax, dword ptr [eax+3C]
:005D903C 8B10 mov edx, dword ptr [eax]
:005D903E FF5214 call [edx+14]
:005D9041 85C0 test eax, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D8FD4(C)
|
:005D9043 7542 jne 005D9087
:005D9045 8D45D0 lea eax, dword ptr [ebp-30]
* Possible StringData Ref from Code Obj ->"No Files !"
|
:005D9048 BAD4935D00 mov edx, 005D93D4
:005D904D E856CCE2FF call 00405CA8
:005D9052 8D45D0 lea eax, dword ptr [ebp-30]
:005D9055 50 push eax
:005D9056 8D45C0 lea eax, dword ptr [ebp-40]
* Possible StringData Ref from Code Obj ->"文件不存在"
|
:005D9059 BAE8935D00 mov edx, 005D93E8
:005D905E E845CCE2FF call 00405CA8
:005D9063 8D45C0 lea eax, dword ptr [ebp-40]
:005D9066 8D4DE0 lea ecx, dword ptr [ebp-20]
:005D9069 5A pop edx
:005D906A E8AD6F0700 call 0065001C
:005D906F 8D55E0 lea edx, dword ptr [ebp-20]
:005D9072 8D45F0 lea eax, dword ptr [ebp-10]
:005D9075 E8CACBE2FF call 00405C44
:005D907A 8B45F0 mov eax, dword ptr [ebp-10]
:005D907D E82EE6F0FF call 004E76B0
:005D9082 E9DD020000 jmp 005D9364
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D9043(C)
|
:005D9087 8B45FC mov eax, dword ptr [ebp-04]
:005D908A 8B8000030000 mov eax, dword ptr [eax+00000300]
:005D9090 33D2 xor edx, edx
:005D9092 8B08 mov ecx, dword ptr [eax]
:005D9094 FF5164 call [ecx+64]
:005D9097 8B45FC mov eax, dword ptr [ebp-04]
:005D909A 8B80F8020000 mov eax, dword ptr [eax+000002F8]
:005D90A0 33D2 xor edx, edx
:005D90A2 8B08 mov ecx, dword ptr [eax]
:005D90A4 FF5164 call [ecx+64]
:005D90A7 8B45FC mov eax, dword ptr [ebp-04]
:005D90AA 8B80FC020000 mov eax, dword ptr [eax+000002FC]
:005D90B0 33D2 xor edx, edx
:005D90B2 8B08 mov ecx, dword ptr [eax]
:005D90B4 FF5164 call [ecx+64]
:005D90B7 8B45FC mov eax, dword ptr [ebp-04]
:005D90BA 8B8010030000 mov eax, dword ptr [eax+00000310]
:005D90C0 8B403C mov eax, dword ptr [eax+3C]
:005D90C3 8B10 mov edx, dword ptr [eax]
:005D90C5 FF5214 call [edx+14]
:005D90C8 8BD0 mov edx, eax
:005D90CA 8B45FC mov eax, dword ptr [ebp-04]
:005D90CD 8B8008030000 mov eax, dword ptr [eax+00000308]
:005D90D3 E8F890EBFF call 004921D0
:005D90D8 8B45FC mov eax, dword ptr [ebp-04]
:005D90DB 8B8008030000 mov eax, dword ptr [eax+00000308]
:005D90E1 BA01000000 mov edx, 00000001
:005D90E6 E8F590EBFF call 004921E0
:005D90EB 8B45FC mov eax, dword ptr [ebp-04]
:005D90EE 8B8008030000 mov eax, dword ptr [eax+00000308]
:005D90F4 B201 mov dl, 01
:005D90F6 E891A0E7FF call 0045318C
:005D90FB A1EC956500 mov eax, dword ptr [006595EC]
:005D9100 8B00 mov eax, dword ptr [eax]
:005D9102 66BAF5FF mov dx, FFF5
:005D9106 E8E990E9FF call 004721F4
:005D910B 8D55BC lea edx, dword ptr [ebp-44]
:005D910E 8B45FC mov eax, dword ptr [ebp-04]
:005D9111 8B8000030000 mov eax, dword ptr [eax+00000300]
:005D9117 E874EEE9FF call 00477F90
:005D911C 8B45BC mov eax, dword ptr [ebp-44]
:005D911F 8D55F8 lea edx, dword ptr [ebp-08]
:005D9122 E8F5E7F0FF call 004E791C
:005D9127 33C0 xor eax, eax
:005D9129 55 push ebp
:005D912A 685D935D00 push 005D935D
:005D912F 64FF30 push dword ptr fs:[eax]
:005D9132 648920 mov dword ptr fs:[eax], esp
:005D9135 8B45FC mov eax, dword ptr [ebp-04]
:005D9138 8B8010030000 mov eax, dword ptr [eax+00000310]
:005D913E 8B403C mov eax, dword ptr [eax+3C]
:005D9141 8B10 mov edx, dword ptr [eax]
:005D9143 FF5214 call [edx+14]
:005D9146 8BF0 mov esi, eax
:005D9148 4E dec esi
:005D9149 85F6 test esi, esi
:005D914B 0F8C57010000 jl 005D92A8
:005D9151 46 inc esi
:005D9152 33DB xor ebx, ebx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D92A2(C)
|
:005D9154 8D4DF4 lea ecx, dword ptr [ebp-0C]
:005D9157 8B45FC mov eax, dword ptr [ebp-04]
:005D915A 8B8010030000 mov eax, dword ptr [eax+00000310]
:005D9160 8B403C mov eax, dword ptr [eax+3C]
:005D9163 8BD3 mov edx, ebx
:005D9165 8B38 mov edi, dword ptr [eax]
:005D9167 FF570C call [edi+0C]
:005D916A 8D45B8 lea eax, dword ptr [ebp-48]
:005D916D 8B4DF4 mov ecx, dword ptr [ebp-0C]
:005D9170 8B55F8 mov edx, dword ptr [ebp-08]
:005D9173 E888BBE2FF call 00404D00
:005D9178 8B45B8 mov eax, dword ptr [ebp-48]
:005D917B E82C54F2FF call 004FE5AC
:005D9180 84C0 test al, al
:005D9182 0F8507010000 jne 005D928F
:005D9188 8D45B4 lea eax, dword ptr [ebp-4C]
* Possible StringData Ref from Code Obj ->"$$$$@@@@.mpg"
|
:005D918B B9FC935D00 mov ecx, 005D93FC
:005D9190 8B55F8 mov edx, dword ptr [ebp-08]
:005D9193 E868BBE2FF call 00404D00
:005D9198 8B45B4 mov eax, dword ptr [ebp-4C]
:005D919B E8D411E3FF call 0040A374
:005D91A0 84C0 test al, al
:005D91A2 7418 je 005D91BC
:005D91A4 8D45B0 lea eax, dword ptr [ebp-50]
* Possible StringData Ref from Code Obj ->"$$$$@@@@.mpg"
|
:005D91A7 B9FC935D00 mov ecx, 005D93FC
:005D91AC 8B55F8 mov edx, dword ptr [ebp-08]
:005D91AF E84CBBE2FF call 00404D00
:005D91B4 8B45B0 mov eax, dword ptr [ebp-50]
:005D91B7 E83053F2FF call 004FE4EC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D91A2(C)
|
:005D91BC 8B45FC mov eax, dword ptr [ebp-04]
:005D91BF 8B8014030000 mov eax, dword ptr [eax+00000314]
:005D91C5 83C034 add eax, 00000034
:005D91C8 8B4DF4 mov ecx, dword ptr [ebp-0C]
:005D91CB 8B55F8 mov edx, dword ptr [ebp-08]
:005D91CE E82DBBE2FF call 00404D00
:005D91D3 8B45FC mov eax, dword ptr [ebp-04]
:005D91D6 8B8014030000 mov eax, dword ptr [eax+00000314]
:005D91DC 83C038 add eax, 00000038
* Possible StringData Ref from Code Obj ->"$$$$@@@@.mpg"
|
:005D91DF B9FC935D00 mov ecx, 005D93FC
:005D91E4 8B55F8 mov edx, dword ptr [ebp-08]
:005D91E7 E814BBE2FF call 00404D00
:005D91EC 8B45FC mov eax, dword ptr [ebp-04]
:005D91EF 8B8014030000 mov eax, dword ptr [eax+00000314]
:005D91F5 C6403C01 mov [eax+3C], 01
:005D91F9 8D45AC lea eax, dword ptr [ebp-54]
:005D91FC 8B4DF4 mov ecx, dword ptr [ebp-0C]
:005D91FF 8B55F8 mov edx, dword ptr [ebp-08]
:005D9202 E8F9BAE2FF call 00404D00
:005D9207 8B55AC mov edx, dword ptr [ebp-54]
:005D920A 8B45FC mov eax, dword ptr [ebp-04]
:005D920D 8B800C030000 mov eax, dword ptr [eax+0000030C]
:005D9213 E884A0E7FF call 0045329C
:005D9218 8B45FC mov eax, dword ptr [ebp-04]
:005D921B 8B800C030000 mov eax, dword ptr [eax+0000030C]
:005D9221 B201 mov dl, 01
:005D9223 E8649FE7FF call 0045318C
:005D9228 8B45FC mov eax, dword ptr [ebp-04]
:005D922B 8B8014030000 mov eax, dword ptr [eax+00000314]
:005D9231 E8DAE5FFFF call 005D7810
:005D9236 84C0 test al, al
:005D9238 7445 je 005D927F
:005D923A 8D45A8 lea eax, dword ptr [ebp-58]
:005D923D 8B4DF4 mov ecx, dword ptr [ebp-0C]
:005D9240 8B55F8 mov edx, dword ptr [ebp-08]
:005D9243 E8B8BAE2FF call 00404D00
:005D9248 8B45A8 mov eax, dword ptr [ebp-58]
:005D924B E89C52F2FF call 004FE4EC
:005D9250 84C0 test al, al
:005D9252 742B je 005D927F
:005D9254 8D45A4 lea eax, dword ptr [ebp-5C]
:005D9257 8B4DF4 mov ecx, dword ptr [ebp-0C]
:005D925A 8B55F8 mov edx, dword ptr [ebp-08]
:005D925D E89EBAE2FF call 00404D00
:005D9262 8B45A4 mov eax, dword ptr [ebp-5C]
:005D9265 50 push eax
:005D9266 8D45A0 lea eax, dword ptr [ebp-60]
* Possible StringData Ref from Code Obj ->"$$$$@@@@.mpg"
|
:005D9269 B9FC935D00 mov ecx, 005D93FC
:005D926E 8B55F8 mov edx, dword ptr [ebp-08]
:005D9271 E88ABAE2FF call 00404D00
:005D9276 8B45A0 mov eax, dword ptr [ebp-60]
:005D9279 5A pop edx
:005D927A E8C152F2FF call 004FE540
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:005D9238(C), :005D9252(C)
|
:005D927F 8B45FC mov eax, dword ptr [ebp-04]
:005D9282 8B800C030000 mov eax, dword ptr [eax+0000030C]
:005D9288 33D2 xor edx, edx
:005D928A E8FD9EE7FF call 0045318C
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D9182(C)
|
:005D928F 8D5301 lea edx, dword ptr [ebx+01]
:005D9292 8B45FC mov eax, dword ptr [ebp-04]
:005D9295 8B8008030000 mov eax, dword ptr [eax+00000308]
:005D929B E8408FEBFF call 004921E0
:005D92A0 43 inc ebx
:005D92A1 4E dec esi
:005D92A2 0F85ACFEFFFF jne 005D9154
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D914B(C)
|
:005D92A8 8D857CFFFFFF lea eax, dword ptr [ebp+FFFFFF7C]
:005D92AE BA14945D00 mov edx, 005D9414
:005D92B3 E8F0C9E2FF call 00405CA8
:005D92B8 8D857CFFFFFF lea eax, dword ptr [ebp+FFFFFF7C]
:005D92BE 50 push eax
:005D92BF 8D856CFFFFFF lea eax, dword ptr [ebp+FFFFFF6C]
* Possible StringData Ref from Code Obj ->"完成"
|
:005D92C5 BA20945D00 mov edx, 005D9420
:005D92CA E8D9C9E2FF call 00405CA8
:005D92CF 8D856CFFFFFF lea eax, dword ptr [ebp+FFFFFF6C]
:005D92D5 8D4D8C lea ecx, dword ptr [ebp-74]
:005D92D8 5A pop edx
:005D92D9 E83E6D0700 call 0065001C
:005D92DE 8D558C lea edx, dword ptr [ebp-74]
:005D92E1 8D459C lea eax, dword ptr [ebp-64]
:005D92E4 E85BC9E2FF call 00405C44
:005D92E9 8B459C mov eax, dword ptr [ebp-64]
:005D92EC E85BE4F0FF call 004E774C
:005D92F1 33C0 xor eax, eax
:005D92F3 5A pop edx
:005D92F4 59 pop ecx
:005D92F5 59 pop ecx
:005D92F6 648910 mov dword ptr fs:[eax], edx
:005D92F9 6864935D00 push 005D9364
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005D9362(U)
|
:005D92FE 8B45FC mov eax, dword ptr [ebp-04]
:005D9301 8B800C030000 mov eax, dword ptr [eax+0000030C]
:005D9307 33D2 xor edx, edx
:005D9309 E87E9EE7FF call 0045318C
:005D930E 8B45FC mov eax, dword ptr [ebp-04]
:005D9311 8B8000030000 mov eax, dword ptr [eax+00000300]
:005D9317 B201 mov dl, 01
:005D9319 8B08 mov ecx, dword ptr [eax]
:005D931B FF5164 call [ecx+64]
:005D931E 8B45FC mov eax, dword ptr [ebp-04]
:005D9321 8B80F8020000 mov eax, dword ptr [eax+000002F8]
:005D9327 B201 mov dl, 01
:005D9329 8B08 mov ecx, dword ptr [eax]
:005D932B FF5164 call [ecx+64]
:005D932E 8B45FC mov eax, dword ptr [ebp-04]
:005D9331 8B80FC020000 mov eax, dword ptr [eax+000002FC]
:005D9337 B201 mov dl, 01
:005D9339 8B08 mov ecx, dword ptr [eax]
:005D933B FF5164 call [ecx+64]
:005D933E 8B45FC mov eax, dword ptr [ebp-04]
:005D9341 8B8008030000 mov eax, dword ptr [eax+00000308]
:005D9347 33D2 xor edx, edx
:005D9349 E83E9EE7FF call 0045318C
:005D934E A1EC956500 mov eax, dword ptr [006595EC]
:005D9353 8B00 mov eax, dword ptr [eax]
:005D9355 33D2 xor edx, edx
:005D9357 E8988EE9FF call 004721F4
:005D935C C3 ret
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)