7C812A5B 5E pop esi ; mxdsg1.003279BC
7C812A5C C9 leave
7C812A5D C2 1000 retn 10
7C812A60 85FF test edi, edi
7C812A62 ^ 0F8E 3693FFFF jle 7C80BD9E
7C812A68 8B55 FC mov edx, dword ptr [ebp-4]
7C812A6B 8955 0C mov dword ptr [ebp+C], edx
7C812A6E 0FB716 movzx edx, word ptr [esi]
7C812A71 8B7D F8 mov edi, dword ptr [ebp-8]
7C812A74 8A143A mov dl, byte ptr [edx+edi]
7C812A77 8811 mov byte ptr [ecx], dl
7C812A79 8B78 0C mov edi, dword ptr [eax+C]
7C812A7C 0FB6D2 movzx edx, dl
7C812A7F 66:8B1457 mov dx, word ptr [edi+edx*2]
7C812A83 66:3B16 cmp dx, word ptr [esi]
7C812A86 0F85 99890300 jnz 7C84B425
7C812A8C 8B50 08 mov edx, dword ptr [eax+8]
7C812A8F 66:8B5A 04 mov bx, word ptr [edx+4]
7C812A93 3819 cmp byte ptr [ecx], bl
7C812A95 0F84 97890300 je 7C84B432
7C812A9B 46 inc esi
7C812A9C 46 inc esi
7C812A9D 41 inc ecx
7C812A9E FF4D 0C dec dword ptr [ebp+C]
7C812AA1 ^ 75 CB jnz short 7C812A6E
7C812AA3 ^ E9 F692FFFF jmp 7C80BD9E
7C812AA8 8B4D 10 mov ecx, dword ptr [ebp+10]
7C812AAB E8 2478FFFF call 7C80A2D4
7C812AB0 8B55 0C mov edx, dword ptr [ebp+C]
7C812AB3 8BD8 mov ebx, eax
7C812AB5 43 inc ebx
7C812AB6 ^ E9 11A3FFFF jmp 7C80CDCC
7C812ABB 8BD9 mov ebx, ecx
7C812ABD 895D 08 mov dword ptr [ebp+8], ebx
7C812AC0 ^ E9 06A2FFFF jmp 7C80CCCB
7C812AC5 8B35 9C47887C mov esi, dword ptr [7C88479C]
7C812ACB ^ E9 01A2FFFF jmp 7C80CCD1
7C812AD0 8365 C0 00 and dword ptr [ebp-40], 0
7C812AD4 ^ E9 78FFFFFF jmp 7C812A51
7C812AD9 90 nop
7C812ADA 90 nop
7C812ADB 90 nop
7C812ADC 90 nop
7C812ADD 90 nop
7C812ADE > 8BFF mov edi, edi
7C812AE0 55 push ebp
7C812AE1 8BEC mov ebp, esp
7C812AE3 81EC 30010000 sub esp, 130
7C812AE9 A1 CC46887C mov eax, dword ptr [7C8846CC]
7C812AEE 56 push esi
7C812AEF 8B75 08 mov esi, dword ptr [ebp+8]
7C812AF2 8945 FC mov dword ptr [ebp-4], eax
7C812AF5 8B06 mov eax, dword ptr [esi]
7C812AF7 57 push edi
7C812AF8 BF 9C000000 mov edi, 9C
7C812AFD 3BC7 cmp eax, edi
7C812AFF 74 0B je short 7C812B0C
7C812B01 3D 94000000 cmp eax, 94
7C812B06 0F85 5BE20200 jnz 7C840D67
7C812B0C 8D85 E0FEFFFF lea eax, dword ptr [ebp-120]
7C812B12 50 push eax
7C812B13 C785 E0FEFFFF 1>mov dword ptr [ebp-120], 11C
7C812B1D E8 4383FFFF call GetVersionExW
7C812B22 85C0 test eax, eax
7C812B24 0F84 D6060000 je 7C813200
7C812B2A 393E cmp dword ptr [esi], edi
7C812B2C 8B85 E4FEFFFF mov eax, dword ptr [ebp-11C]
7C812B32 8946 04 mov dword ptr [esi+4], eax
7C812B35 8B85 E8FEFFFF mov eax, dword ptr [ebp-118]
7C812B3B 8946 08 mov dword ptr [esi+8], eax
7C812B3E 8B85 ECFEFFFF mov eax, dword ptr [ebp-114]
7C812B44 8946 0C mov dword ptr [esi+C], eax
7C812B47 8B85 F0FEFFFF mov eax, dword ptr [ebp-110]
7C812B4D 8946 10 mov dword ptr [esi+10], eax
7C812B50 0F84 74060000 je 7C8131CA
7C812B56 66:83A5 D8FEFFF>and word ptr [ebp-128], 0
7C812B5E 8D85 F4FEFFFF lea eax, dword ptr [ebp-10C]
7C812B64 50 push eax
7C812B65 8D85 D0FEFFFF lea eax, dword ptr [ebp-130]
7C812B6B 83C6 14 add esi, 14
7C812B6E 50 push eax
7C812B6F 89B5 DCFEFFFF mov dword ptr [ebp-124], esi
7C812B75 66:C785 DAFEFFF>mov word ptr [ebp-126], 80
7C812B7E FF15 4010807C call dword ptr [<&ntdll.RtlInitUnicod>; ntdll.RtlInitUnicodeString
7C812B84 6A 00 push 0
7C812B86 8D85 D0FEFFFF lea eax, dword ptr [ebp-130]
7C812B8C 50 push eax
7C812B8D 8D85 D8FEFFFF lea eax, dword ptr [ebp-128]
7C812B93 50 push eax
7C812B94 FF15 7C10807C call dword ptr [<&ntdll.RtlUnicodeStr>; ntdll.RtlUnicodeStringToAnsiString
7C812B9A 33C9 xor ecx, ecx
7C812B9C 85C0 test eax, eax
7C812B9E 0F9DC1 setge cl
7C812BA1 8BC1 mov eax, ecx
7C812BA3 8B4D FC mov ecx, dword ptr [ebp-4]
7C812BA6 5F pop edi
7C812BA7 5E pop esi
7C812BA8 E8 556BFFFF call 7C809702
7C812BAD C9 leave
7C812BAE C2 0400 retn 4
7C812BB1 90 nop
7C812BB2 90 nop
7C812BB3 90 nop
7C812BB4 90 nop
7C812BB5 90 nop
7C812BB6 > 8BFF mov edi, edi
7C812BB8 55 push ebp
7C812BB9 8BEC mov ebp, esp
7C812BBB 8B45 08 mov eax, dword ptr [ebp+8]
7C812BBE 8B0D 3C40887C mov ecx, dword ptr [7C88403C]
7C812BC4 8B89 2C010000 mov ecx, dword ptr [ecx+12C]
7C812BCA 8B55 10 mov edx, dword ptr [ebp+10]
7C812BCD 25 05000400 and eax, 40005
7C812BD2 56 push esi
7C812BD3 0D 00100000 or eax, 1000
7C812BD8 33F6 xor esi, esi
7C812BDA 3BD1 cmp edx, ecx
7C812BDC 73 36 jnb short 7C812C14
7C812BDE 85D2 test edx, edx
7C812BE0 75 2E jnz short 7C812C10
7C812BE2 C1E1 04 shl ecx, 4
7C812BE5 8BF1 mov esi, ecx
7C812BE7 83C8 02 or eax, 2
7C812BEA 85F6 test esi, esi
7C812BEC 74 26 je short 7C812C14
7C812BEE 6A 00 push 0
7C812BF0 6A 00 push 0
7C812BF2 FF75 0C push dword ptr [ebp+C]
7C812BF5 52 push edx
7C812BF6 6A 00 push 0
7C812BF8 50 push eax
7C812BF9 FF15 0813807C call dword ptr [<&ntdll.RtlCreateHeap>; ntdll.RtlCreateHeap
7C812BFF 8BF0 mov esi, eax
7C812C01 85F6 test esi, esi
7C812C03 0F84 C2DC0200 je 7C8408CB
7C812C09 8BC6 mov eax, esi
7C812C0B 5E pop esi
7C812C0C 5D pop ebp
7C812C0D C2 0C00 retn 0C
7C812C10 8BD1 mov edx, ecx
7C812C12 ^ EB D6 jmp short 7C812BEA
7C812C14 3955 0C cmp dword ptr [ebp+C], edx
7C812C17 ^ 76 D5 jbe short 7C812BEE
7C812C19 E9 A5DC0200 jmp 7C8408C3
7C812C1E 90 nop
7C812C1F 90 nop
7C812C20 90 nop
7C812C21 90 nop
7C812C22 90 nop
7C812C23 > 6A 50 push 50
7C812C25 68 902C817C push 7C812C90
7C812C2A E8 97F8FEFF call 7C8024C6
7C812C2F 33F6 xor esi, esi
7C812C31 8975 D4 mov dword ptr [ebp-2C], esi
7C812C34 8975 D8 mov dword ptr [ebp-28], esi
7C812C37 8975 FC mov dword ptr [ebp-4], esi
7C812C3A 3975 08 cmp dword ptr [ebp+8], esi
7C812C3D 0F85 ADF00200 jnz 7C841CF0
7C812C43 64:A1 18000000 mov eax, dword ptr fs:[18]
7C812C49 8945 B8 mov dword ptr [ebp-48], eax
7C812C4C 8B40 30 mov eax, dword ptr [eax+30]
7C812C4F 8945 CC mov dword ptr [ebp-34], eax
7C812C52 FF70 08 push dword ptr [eax+8]
7C812C55 FF15 B412807C call dword ptr [<&ntdll.RtlImageNtHea>; ntdll.RtlImageNtHeader
7C812C5B 8945 C8 mov dword ptr [ebp-38], eax
7C812C5E 3BC6 cmp eax, esi
7C812C60 0F84 57F10200 je 7C841DBD
7C812C66 66:8B48 48 mov cx, word ptr [eax+48]
7C812C6A 66:894D DA mov word ptr [ebp-26], cx
7C812C6E 66:8B40 4A mov ax, word ptr [eax+4A]
7C812C72 66:8945 D8 mov word ptr [ebp-28], ax
7C812C76 834D FC FF or dword ptr [ebp-4], FFFFFFFF
7C812C7A E8 22000000 call 7C812CA1
7C812C7F 8B45 D8 mov eax, dword ptr [ebp-28]
7C812C82 E8 7AF8FEFF call 7C802501
7C812C87 C2 0400 retn 4
7C812C8A 90 nop
7C812C8B 90 nop
7C812C8C 90 nop
7C812C8D 90 nop
7C812C8E 90 nop
7C812C8F 90 nop
7C812C90 FFFF ??? ; 未知命令
7C812C92 FFFF ??? ; 未知命令
7C812C94 0000 add byte ptr [eax], al
7C812C96 0000 add byte ptr [eax], al
7C812C98 CC int3
7C812C99 1D 847C9090 sbb eax, 90907C84
7C812C9E 90 nop
7C812C9F 90 nop
7C812CA0 90 nop
7C812CA1 3975 D4 cmp dword ptr [ebp-2C], esi
7C812CA4 0F85 29F10200 jnz 7C841DD3
7C812CAA C3 retn
7C812CAB 90 nop
7C812CAC 90 nop
7C812CAD 90 nop
7C812CAE 90 nop
7C812CAF 90 nop
7C812CB0 8BFF mov edi, edi
7C812CB2 55 push ebp
7C812CB3 8BEC mov ebp, esp
7C812CB5 56 push esi
7C812CB6 8B75 10 mov esi, dword ptr [ebp+10]
7C812CB9 57 push edi
7C812CBA 33C0 xor eax, eax
7C812CBC 6A 09 push 9
7C812CBE 59 pop ecx
7C812CBF 8BFE mov edi, esi
7C812CC1 F3:AB rep stos dword ptr es:[edi]
7C812CC3 8B4D 0C mov ecx, dword ptr [ebp+C]
7C812CC6 66:8B01 mov ax, word ptr [ecx]
7C812CC9 66:8906 mov word ptr [esi], ax
7C812CCC 8B45 08 mov eax, dword ptr [ebp+8]
7C812CCF 33FF xor edi, edi
7C812CD1 66:897E 02 mov word ptr [esi+2], di
7C812CD5 8B50 08 mov edx, dword ptr [eax+8]
7C812CD8 8956 04 mov dword ptr [esi+4], edx
7C812CDB 8B50 1C mov edx, dword ptr [eax+1C]
7C812CDE 8956 08 mov dword ptr [esi+8], edx
7C812CE1 8B50 20 mov edx, dword ptr [eax+20]
7C812CE4 8956 0C mov dword ptr [esi+C], edx
7C812CE7 8B50 24 mov edx, dword ptr [eax+24]
7C812CEA 8956 10 mov dword ptr [esi+10], edx
7C812CED 0FBE50 28 movsx edx, byte ptr [eax+28]
7C812CF1 8956 14 mov dword ptr [esi+14], edx
7C812CF4 66:8B51 02 mov dx, word ptr [ecx+2]
7C812CF8 66:8956 20 mov word ptr [esi+20], dx
7C812CFC 66:8B51 04 mov dx, word ptr [ecx+4]
7C812D00 66:8956 22 mov word ptr [esi+22], dx
7C812D04 66:8B11 mov dx, word ptr [ecx]
7C812D07 66:3BD7 cmp dx, di
7C812D0A 0F85 08050300 jnz 7C843218
7C812D10 66:8B49 02 mov cx, word ptr [ecx+2]
7C812D14 66:83F9 03 cmp cx, 3
7C812D18 0F84 EE040300 je 7C84320C
7C812D1E 33D2 xor edx, edx
7C812D20 66:83F9 04 cmp cx, 4
7C812D24 0F95C2 setne dl
7C812D27 4A dec edx
7C812D28 83E2 9C and edx, FFFFFF9C
7C812D2B 81C2 4A020000 add edx, 24A
7C812D31 8956 18 mov dword ptr [esi+18], edx
7C812D34 8B40 18 mov eax, dword ptr [eax+18]
7C812D37 57 push edi
7C812D38 8946 1C mov dword ptr [esi+1C], eax
7C812D3B E8 E3FEFFFF call GetProcessVersion
7C812D40 3D 33000300 cmp eax, 30033
7C812D45 0F82 1D050300 jb 7C843268
7C812D4B 5F pop edi
7C812D4C 5E pop esi
7C812D4D 5D pop ebp
7C812D4E C2 0C00 retn 0C
7C812D51 90 nop
7C812D52 90 nop
7C812D53 90 nop
7C812D54 90 nop
7C812D55 90 nop
7C812D56 > 8BFF mov edi, edi
7C812D58 55 push ebp
7C812D59 8BEC mov ebp, esp
7C812D5B 83EC 38 sub esp, 38
7C812D5E 56 push esi
7C812D5F 8B35 D410807C mov esi, dword ptr [<&ntdll.NtQueryS>; ntdll.ZwQuerySystemInformation
7C812D65 6A 00 push 0
7C812D67 6A 2C push 2C
7C812D69 8D45 C8 lea eax, dword ptr [ebp-38]
7C812D6C 50 push eax
7C812D6D 6A 00 push 0
7C812D6F FFD6 call esi
7C812D71 85C0 test eax, eax
7C812D73 7C 20 jl short 7C812D95
7C812D75 6A 00 push 0
7C812D77 6A 0C push 0C
7C812D79 8D45 F4 lea eax, dword ptr [ebp-C]
7C812D7C 50 push eax
7C812D7D 6A 01 push 1
7C812D7F FFD6 call esi
7C812D81 85C0 test eax, eax
7C812D83 7C 10 jl short 7C812D95
7C812D85 FF75 08 push dword ptr [ebp+8]
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
