[求助]这个追码进哪个CALL?-付费问答-看雪-安全社区|安全招聘|kanxue.com

[旧帖] [求助]这个追码进哪个CALL? 0.00雪花

发表于: 2008-12-7 12:23 2684

[旧帖] [求助]这个追码进哪个CALL? 0.00雪花

wqhlgr

2008-12-7 12:23

2684

这个追码进哪个CALL?帮忙看看
004200C0 .  55          PUSH EBP
004200C1 .  8BEC       MOV EBP,ESP
004200C3 .  81C4 20F5FFFF ADD ESP,-0AE0
004200C9 .  53          PUSH EBX
004200CA .  56          PUSH ESI
004200CB .  57          PUSH EDI
004200CC .  8BF0       MOV ESI,EAX
004200CE .  B8 18784B00 MOV EAX,4.004B7818
004200D3 .  E8 64CA0600 CALL 4.0048CB3C
004200D8 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],8
004200E1 .  33D2       XOR EDX,EDX
004200E3 .  33C9       XOR ECX,ECX
004200E5 .  8955 FC    MOV DWORD PTR SS:[EBP-4],EDX
004200E8 .  33C0       XOR EAX,EAX
004200EA .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
004200F0 .  33D2       XOR EDX,EDX
004200F2 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],14
004200FB .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],20
00420104 .  894D F8    MOV DWORD PTR SS:[EBP-8],ECX
00420107 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
0042010D .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],14
00420116 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],2C
0042011F .  8945 F4    MOV DWORD PTR SS:[EBP-C],EAX
00420122 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420128 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],14
00420131 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],38
0042013A .  8955 F0    MOV DWORD PTR SS:[EBP-10],EDX
0042013D .  8D55 F0    LEA EDX,DWORD PTR SS:[EBP-10]
00420140 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420146 .  8B9E E0020000 MOV EBX,DWORD PTR DS:[ESI+2E0]
0042014C .  8BC3       MOV EAX,EBX
0042014E .  E8 D91E0400 CALL 4.0046202C
00420153 .  8D45 F0    LEA EAX,DWORD PTR SS:[EBP-10]
00420156 .  33D2       XOR EDX,EDX
00420158 .  8955 EC    MOV DWORD PTR SS:[EBP-14],EDX
0042015B .  8D55 EC    LEA EDX,DWORD PTR SS:[EBP-14]
0042015E .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420164 .  E8 83A90700 CALL 4.0049AAEC
00420169 .  8D55 EC    LEA EDX,DWORD PTR SS:[EBP-14]
0042016C .  8BC3       MOV EAX,EBX
0042016E .  8B12       MOV EDX,DWORD PTR DS:[EDX]
00420170 .  E8 E71E0400 CALL 4.0046205C
00420175 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
0042017B .  8D45 EC    LEA EAX,DWORD PTR SS:[EBP-14]
0042017E .  BA 02000000 MOV EDX,2
00420183 .  E8 C8A60700 CALL 4.0049A850
00420188 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
0042018E .  8D45 F0    LEA EAX,DWORD PTR SS:[EBP-10]
00420191 .  BA 02000000 MOV EDX,2
00420196 .  E8 B5A60700 CALL 4.0049A850
0042019B .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],44
004201A4 .  33C9       XOR ECX,ECX
004201A6 .  894D E8    MOV DWORD PTR SS:[EBP-18],ECX
004201A9 .  8D55 E8    LEA EDX,DWORD PTR SS:[EBP-18]
004201AC .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
004201B2 .  8B86 E0020000 MOV EAX,DWORD PTR DS:[ESI+2E0]
004201B8 .  E8 6F1E0400 CALL 4.0046202C
004201BD .  837D E8 00 CMP DWORD PTR SS:[EBP-18],0
004201C1 .  74 05       JE SHORT 4.004201C8
004201C3 .  8B4D E8    MOV ECX,DWORD PTR SS:[EBP-18]
004201C6 .  EB 05       JMP SHORT 4.004201CD
004201C8 >  B9 C0734B00 MOV ECX,4.004B73C0
004201CD >  8BF9       MOV EDI,ECX
004201CF .  33C0       XOR EAX,EAX
004201D1 .  56          PUSH ESI
004201D2 .  83C9 FF    OR ECX,FFFFFFFF
004201D5 .  F2:AE       REPNE SCAS BYTE PTR ES:[EDI]
004201D7 .  F7D1       NOT ECX
004201D9 .  2BF9       SUB EDI,ECX
004201DB .  8DB5 2CFEFFFF LEA ESI,DWORD PTR SS:[EBP-1D4]
004201E1 .  87F7       XCHG EDI,ESI
004201E3 .  8BD1       MOV EDX,ECX
004201E5 .  8BC7       MOV EAX,EDI
004201E7 .  C1E9 02    SHR ECX,2
004201EA .  8D45 E8    LEA EAX,DWORD PTR SS:[EBP-18]
004201ED .  F3:A5       REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
004201EF .  8BCA       MOV ECX,EDX
004201F1 .  BA 02000000 MOV EDX,2
004201F6 .  83E1 03    AND ECX,3
004201F9 .  F3:A4       REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
004201FB .  5E          POP ESI
004201FC .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420202 .  E8 49A60700 CALL 4.0049A850
00420207 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],50
00420210 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],5C
00420219 .  8B9E E8020000 MOV EBX,DWORD PTR DS:[ESI+2E8]
0042021F .  33C0       XOR EAX,EAX
00420221 .  8945 E4    MOV DWORD PTR SS:[EBP-1C],EAX
00420224 .  81C3 08020000 ADD EBX,208
0042022A .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420230 .  8D55 E4    LEA EDX,DWORD PTR SS:[EBP-1C]
00420233 .  8B03       MOV EAX,DWORD PTR DS:[EBX]
00420235 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420237 .  FF51 1C    CALL DWORD PTR DS:[ECX+1C]
0042023A .  8D55 E4    LEA EDX,DWORD PTR SS:[EBP-1C]
0042023D .  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
00420240 .  E8 3BA60700 CALL 4.0049A880
00420245 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
0042024B .  8D45 E4    LEA EAX,DWORD PTR SS:[EBP-1C]
0042024E .  BA 02000000 MOV EDX,2
00420253 .  E8 F8A50700 CALL 4.0049A850
00420258 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],68
00420261 .  837D F8 00 CMP DWORD PTR SS:[EBP-8],0
00420265 .  74 05       JE SHORT 4.0042026C
00420267 .  8B4D F8    MOV ECX,DWORD PTR SS:[EBP-8]
0042026A .  EB 05       JMP SHORT 4.00420271
0042026C >  B9 C1734B00 MOV ECX,4.004B73C1
00420271 >  51          PUSH ECX                               ; /Arg3
00420272 .  56          PUSH ESI                               ; |Arg2
00420273 .  33C0       XOR EAX,EAX                            ; |
00420275 .  8D55 E0    LEA EDX,DWORD PTR SS:[EBP-20]          ; |
00420278 .  8945 E0    MOV DWORD PTR SS:[EBP-20],EAX          ; |
0042027B .  52          PUSH EDX                               ; |Arg1
0042027C .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]             ; |
00420282 .  E8 D10B0000 CALL 4.00420E58                         ; \4.00420E58
00420287 .  83C4 0C    ADD ESP,0C
0042028A .  8D55 E0    LEA EDX,DWORD PTR SS:[EBP-20]
0042028D .  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
00420290 .  E8 EBA50700 CALL 4.0049A880
00420295 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
0042029B .  8D45 E0    LEA EAX,DWORD PTR SS:[EBP-20]
0042029E .  BA 02000000 MOV EDX,2
004202A3 .  E8 A8A50700 CALL 4.0049A850
004202A8 .  837D F8 00 CMP DWORD PTR SS:[EBP-8],0
004202AC .  74 05       JE SHORT 4.004202B3
004202AE .  8B7D F8    MOV EDI,DWORD PTR SS:[EBP-8]
004202B1 .  EB 05       JMP SHORT 4.004202B8
004202B3 >  BF C2734B00 MOV EDI,4.004B73C2
004202B8 >  57          PUSH EDI
004202B9 .  E8 7EC50600 CALL 4.0048C83C
004202BE .  59          POP ECX
004202BF .  8985 34FFFFFF MOV DWORD PTR SS:[EBP-CC],EAX
004202C5 .  8B85 34FFFFFF MOV EAX,DWORD PTR SS:[EBP-CC]
004202CB .  83C0 FB    ADD EAX,-5
004202CE .  50          PUSH EAX                               ; /Arg3
004202CF .  57          PUSH EDI                               ; |Arg2
004202D0 .  56          PUSH ESI                               ; |Arg1
004202D1 .  E8 220C0000 CALL 4.00420EF8                         ; \4.00420EF8
004202D6 .  83C4 0C    ADD ESP,0C
004202D9 .  0FB7D8       MOVZX EBX,AX
004202DC .  6A 05       PUSH 5                                  ; /Arg3 = 00000005
004202DE .  8B85 34FFFFFF MOV EAX,DWORD PTR SS:[EBP-CC]          ; |
004202E4 .  03C7       ADD EAX,EDI                            ; |
004202E6 .  83C0 FB    ADD EAX,-5                            ; |
004202E9 .  50          PUSH EAX                               ; |Arg2
004202EA .  8D95 2CF8FFFF LEA EDX,DWORD PTR SS:[EBP-7D4]          ; |
004202F0 .  52          PUSH EDX                               ; |Arg1
004202F1 .  E8 A2C30600 CALL 4.0048C698                         ; \4.0048C698
004202F6 .  C685 31F8FFFF>MOV BYTE PTR SS:[EBP-7CF],0
004202FD .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],74
00420306 .  83C4 0C    ADD ESP,0C
00420309 .  8D95 2CF8FFFF LEA EDX,DWORD PTR SS:[EBP-7D4]
0042030F .  8D45 DC    LEA EAX,DWORD PTR SS:[EBP-24]
00420312 .  E8 81A40700 CALL 4.0049A798
00420317 .  8BD0       MOV EDX,EAX
00420319 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
0042031F .  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
00420322 .  E8 59A50700 CALL 4.0049A880
00420327 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
0042032D .  8D45 DC    LEA EAX,DWORD PTR SS:[EBP-24]
00420330 .  BA 02000000 MOV EDX,2
00420335 .  E8 16A50700 CALL 4.0049A850
0042033A .  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
0042033D .  E8 32A80700 CALL 4.0049AB74
00420342 .  3BD8       CMP EBX,EAX
00420344 .  0F84 81000000 JE 4.004203CB
0042034A .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],80
00420353 .  BA C3734B00 MOV EDX,4.004B73C3                      ;  注册失败1,注册码不完整,请检查注册码是否已经全部复制或是否已经全部输入
00420358 .  8D45 D8    LEA EAX,DWORD PTR SS:[EBP-28]
0042035B .  E8 38A40700 CALL 4.0049A798
00420360 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420366 .  8B00       MOV EAX,DWORD PTR DS:[EAX]
00420368 .  E8 2FCC0300 CALL 4.0045CF9C
0042036D .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420373 .  8D45 D8    LEA EAX,DWORD PTR SS:[EBP-28]
00420376 .  BA 02000000 MOV EDX,2
0042037B .  E8 D0A40700 CALL 4.0049A850
00420380 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420386 .  8D45 F4    LEA EAX,DWORD PTR SS:[EBP-C]
00420389 .  BA 02000000 MOV EDX,2
0042038E .  E8 BDA40700 CALL 4.0049A850
00420393 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420399 .  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
0042039C .  BA 02000000 MOV EDX,2
004203A1 .  E8 AAA40700 CALL 4.0049A850
004203A6 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
004203AC .  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
004203AF .  BA 02000000 MOV EDX,2
004203B4 .  E8 97A40700 CALL 4.0049A850
004203B9 .  8B8D 38FFFFFF MOV ECX,DWORD PTR SS:[EBP-C8]
004203BF .  64:890D 00000>MOV DWORD PTR FS:[0],ECX
004203C6 .  E9 840A0000 JMP 4.00420E4F
004203CB >  6A 03       PUSH 3                                  ; /Arg3 = 00000003
004203CD .  8B85 34FFFFFF MOV EAX,DWORD PTR SS:[EBP-CC]          ; |
004203D3 .  03C7       ADD EAX,EDI                            ; |
004203D5 .  83C0 F8    ADD EAX,-8                            ; |
004203D8 .  50          PUSH EAX                               ; |Arg2
004203D9 .  8D95 2CF8FFFF LEA EDX,DWORD PTR SS:[EBP-7D4]          ; |
004203DF .  52          PUSH EDX                               ; |Arg1
004203E0 .  E8 B3C20600 CALL 4.0048C698                         ; \4.0048C698
004203E5 .  C685 2FF8FFFF>MOV BYTE PTR SS:[EBP-7D1],0
004203EC .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],8C
004203F5 .  83C4 0C    ADD ESP,0C
004203F8 .  8D95 2CF8FFFF LEA EDX,DWORD PTR SS:[EBP-7D4]
004203FE .  8D45 D4    LEA EAX,DWORD PTR SS:[EBP-2C]
00420401 .  E8 92A30700 CALL 4.0049A798
00420406 .  8BD0       MOV EDX,EAX
00420408 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
0042040E .  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
00420411 .  E8 6AA40700 CALL 4.0049A880
00420416 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
0042041C .  8D45 D4    LEA EAX,DWORD PTR SS:[EBP-2C]
0042041F .  BA 02000000 MOV EDX,2
00420424 .  E8 27A40700 CALL 4.0049A850
00420429 .  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
0042042C .  E8 43A70700 CALL 4.0049AB74
00420431 .  8BD8       MOV EBX,EAX
00420433 .  8D85 2CF8FFFF LEA EAX,DWORD PTR SS:[EBP-7D4]
00420439 .  53          PUSH EBX                               ; /Arg3
0042043A .  57          PUSH EDI                               ; |Arg2
0042043B .  50          PUSH EAX                               ; |Arg1
0042043C .  E8 57C20600 CALL 4.0048C698                         ; \4.0048C698
00420441 .  C6841D 2CF8FF>MOV BYTE PTR SS:[EBP+EBX-7D4],0
00420449 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],98
00420452 .  83C4 0C    ADD ESP,0C
00420455 .  8D95 2CF8FFFF LEA EDX,DWORD PTR SS:[EBP-7D4]
0042045B .  8D45 D0    LEA EAX,DWORD PTR SS:[EBP-30]
0042045E .  E8 35A30700 CALL 4.0049A798
00420463 .  8BD0       MOV EDX,EAX
00420465 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
0042046B .  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
0042046E .  E8 0DA40700 CALL 4.0049A880
00420473 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420479 .  8D45 D0    LEA EAX,DWORD PTR SS:[EBP-30]
0042047C .  BA 02000000 MOV EDX,2
00420481 .  E8 CAA30700 CALL 4.0049A850
00420486 .  8B8D 34FFFFFF MOV ECX,DWORD PTR SS:[EBP-CC]
0042048C .  8D043B       LEA EAX,DWORD PTR DS:[EBX+EDI]
0042048F .  2BCB       SUB ECX,EBX
00420491 .  8D95 2CF8FFFF LEA EDX,DWORD PTR SS:[EBP-7D4]
00420497 .  83C1 F8    ADD ECX,-8
0042049A .  51          PUSH ECX                               ; /Arg3
0042049B .  50          PUSH EAX                               ; |Arg2
0042049C .  52          PUSH EDX                               ; |Arg1
0042049D .  E8 F6C10600 CALL 4.0048C698                         ; \4.0048C698
004204A2 .  8B8D 34FFFFFF MOV ECX,DWORD PTR SS:[EBP-CC]
004204A8 .  83C4 0C    ADD ESP,0C
004204AB .  2BCB       SUB ECX,EBX
004204AD .  8D95 2CF8FFFF LEA EDX,DWORD PTR SS:[EBP-7D4]
004204B3 .  8D45 CC    LEA EAX,DWORD PTR SS:[EBP-34]
004204B6 .  C6840D 24F8FF>MOV BYTE PTR SS:[EBP+ECX-7DC],0
004204BE .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0A4
004204C7 .  E8 CCA20700 CALL 4.0049A798
004204CC .  8BD0       MOV EDX,EAX
004204CE .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
004204D4 .  8D45 F4    LEA EAX,DWORD PTR SS:[EBP-C]
004204D7 .  E8 A4A30700 CALL 4.0049A880
004204DC .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
004204E2 .  8D45 CC    LEA EAX,DWORD PTR SS:[EBP-34]
004204E5 .  BA 02000000 MOV EDX,2
004204EA .  E8 61A30700 CALL 4.0049A850
004204EF .  837D F8 00 CMP DWORD PTR SS:[EBP-8],0
004204F3 .  74 05       JE SHORT 4.004204FA
004204F5 .  8B4D F8    MOV ECX,DWORD PTR SS:[EBP-8]
004204F8 .  EB 05       JMP SHORT 4.004204FF
004204FA >  B9 09744B00 MOV ECX,4.004B7409
004204FF >  8BF9       MOV EDI,ECX
00420501 .  33C0       XOR EAX,EAX
00420503 .  56          PUSH ESI
00420504 .  83C9 FF    OR ECX,FFFFFFFF
00420507 .  F2:AE       REPNE SCAS BYTE PTR ES:[EDI]
00420509 .  F7D1       NOT ECX
0042050B .  2BF9       SUB EDI,ECX
0042050D .  8DB5 2CFDFFFF LEA ESI,DWORD PTR SS:[EBP-2D4]
00420513 .  87F7       XCHG EDI,ESI
00420515 .  8BD1       MOV EDX,ECX
00420517 .  8BC7       MOV EAX,EDI
00420519 .  C1E9 02    SHR ECX,2
0042051C .  F3:A5       REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
0042051E .  8BCA       MOV ECX,EDX
00420520 .  83E1 03    AND ECX,3
00420523 .  F3:A4       REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
00420525 .  837D F4 00 CMP DWORD PTR SS:[EBP-C],0
00420529 .  5E          POP ESI
0042052A .  74 05       JE SHORT 4.00420531
0042052C .  8B45 F4    MOV EAX,DWORD PTR SS:[EBP-C]
0042052F .  EB 05       JMP SHORT 4.00420536
00420531 >  B8 0A744B00 MOV EAX,4.004B740A
00420536 >  8BF8       MOV EDI,EAX
00420538 .  33C0       XOR EAX,EAX
0042053A .  56          PUSH ESI
0042053B .  83C9 FF    OR ECX,FFFFFFFF
0042053E .  F2:AE       REPNE SCAS BYTE PTR ES:[EDI]
00420540 .  F7D1       NOT ECX
00420542 .  2BF9       SUB EDI,ECX
00420544 .  8DB5 2CFCFFFF LEA ESI,DWORD PTR SS:[EBP-3D4]
0042054A .  87F7       XCHG EDI,ESI
0042054C .  8BD1       MOV EDX,ECX
0042054E .  8BC7       MOV EAX,EDI
00420550 .  C1E9 02    SHR ECX,2
00420553 .  F3:A5       REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
00420555 .  8BCA       MOV ECX,EDX
00420557 .  83E1 03    AND ECX,3
0042055A .  F3:A4       REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
0042055C .  A1 38F54B00 MOV EAX,DWORD PTR DS:[4BF538]
00420561 .  5E          POP ESI
00420562 .  8B18       MOV EBX,DWORD PTR DS:[EAX]
00420564 .  6A 15       PUSH 15                               ; /Arg3 = 00000015
00420566 .  6A 00       PUSH 0                                  ; |Arg2 = 00000000
00420568 .  8DBB CC030000 LEA EDI,DWORD PTR DS:[EBX+3CC]          ; |
0042056E .  57          PUSH EDI                               ; |Arg1
0042056F .  E8 94C10600 CALL 4.0048C708                         ; \4.0048C708
00420574 .  83C4 0C    ADD ESP,0C
00420577 .  8D83 E1030000 LEA EAX,DWORD PTR DS:[EBX+3E1]
0042057D .  68 00010000 PUSH 100                               ; /Arg3 = 00000100
00420582 .  6A 00       PUSH 0                                  ; |Arg2 = 00000000
00420584 .  50          PUSH EAX                               ; |Arg1
00420585 .  E8 7EC10600 CALL 4.0048C708                         ; \4.0048C708
0042058A .  83C4 0C    ADD ESP,0C
0042058D .  8D93 E1040000 LEA EDX,DWORD PTR DS:[EBX+4E1]
00420593 .  68 00010000 PUSH 100                               ; /Arg3 = 00000100
00420598 .  6A 00       PUSH 0                                  ; |Arg2 = 00000000
0042059A .  52          PUSH EDX                               ; |Arg1
0042059B .  E8 68C10600 CALL 4.0048C708                         ; \4.0048C708
004205A0 .  83C4 0C    ADD ESP,0C
004205A3 .  33C0       XOR EAX,EAX
004205A5 .  83C9 FF    OR ECX,FFFFFFFF
004205A8 .  56          PUSH ESI
004205A9 .  57          PUSH EDI
004205AA .  8BF7       MOV ESI,EDI
004205AC .  8DBD 2CFEFFFF LEA EDI,DWORD PTR SS:[EBP-1D4]
004205B2 .  F2:AE       REPNE SCAS BYTE PTR ES:[EDI]
004205B4 .  F7D1       NOT ECX
004205B6 .  2BF9       SUB EDI,ECX
004205B8 .  8BD1       MOV EDX,ECX
004205BA .  87F7       XCHG EDI,ESI
004205BC .  C1E9 02    SHR ECX,2
004205BF .  8BC7       MOV EAX,EDI
004205C1 .  F3:A5       REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
004205C3 .  8BCA       MOV ECX,EDX
004205C5 .  8D83 E1030000 LEA EAX,DWORD PTR DS:[EBX+3E1]
004205CB .  83E1 03    AND ECX,3
004205CE .  F3:A4       REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
004205D0 .  5F          POP EDI
004205D1 .  5E          POP ESI
004205D2 .  56          PUSH ESI
004205D3 .  8BF0       MOV ESI,EAX
004205D5 .  33C0       XOR EAX,EAX
004205D7 .  8DBD 2CFDFFFF LEA EDI,DWORD PTR SS:[EBP-2D4]
004205DD .  83C9 FF    OR ECX,FFFFFFFF
004205E0 .  F2:AE       REPNE SCAS BYTE PTR ES:[EDI]
004205E2 .  F7D1       NOT ECX
004205E4 .  2BF9       SUB EDI,ECX
004205E6 .  8BD1       MOV EDX,ECX
004205E8 .  87F7       XCHG EDI,ESI
004205EA .  C1E9 02    SHR ECX,2
004205ED .  8BC7       MOV EAX,EDI
004205EF .  F3:A5       REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
004205F1 .  8BCA       MOV ECX,EDX
004205F3 .  83E1 03    AND ECX,3
004205F6 .  F3:A4       REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
004205F8 .  81C3 E1040000 ADD EBX,4E1
004205FE .  33C0       XOR EAX,EAX
00420600 .  5E          POP ESI
00420601 .  8DBD 2CFCFFFF LEA EDI,DWORD PTR SS:[EBP-3D4]
00420607 .  56          PUSH ESI
00420608 .  83C9 FF    OR ECX,FFFFFFFF
0042060B .  F2:AE       REPNE SCAS BYTE PTR ES:[EDI]
0042060D .  F7D1       NOT ECX
0042060F .  2BF9       SUB EDI,ECX
00420611 .  8BF3       MOV ESI,EBX
00420613 .  87F7       XCHG EDI,ESI
00420615 .  8BD1       MOV EDX,ECX
00420617 .  8BC7       MOV EAX,EDI
00420619 .  C1E9 02    SHR ECX,2
0042061C .  F3:A5       REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
0042061E .  8BCA       MOV ECX,EDX
00420620 .  83E1 03    AND ECX,3
00420623 .  F3:A4       REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
00420625 .  A1 38F54B00 MOV EAX,DWORD PTR DS:[4BF538]
0042062A .  5E          POP ESI
0042062B .  8B10       MOV EDX,DWORD PTR DS:[EAX]
0042062D .  52          PUSH EDX
0042062E .  E8 C921FFFF CALL 4.004127FC
00420633 .  59          POP ECX
00420634 .  3C 01       CMP AL,1
00420636 .  0F85 EA040000 JNZ 4.00420B26
0042063C .  8B0D 38F54B00 MOV ECX,DWORD PTR DS:[4BF538]          ;  4._PlayForm
00420642 .  8B01       MOV EAX,DWORD PTR DS:[ECX]
00420644 .  50          PUSH EAX                               ; /Arg1
00420645 .  E8 0624FEFF CALL 4.00402A50                         ; \4.00402A50
0042064A .  59          POP ECX
0042064B .  3C 01       CMP AL,1
0042064D .  0F85 71020000 JNZ 4.004208C4
00420653 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0B0
0042065C .  BA 0B744B00 MOV EDX,4.004B740B                      ;  注册成功
00420661 .  8D45 C8    LEA EAX,DWORD PTR SS:[EBP-38]
00420664 .  E8 2FA10700 CALL 4.0049A798
00420669 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
0042066F .  8B00       MOV EAX,DWORD PTR DS:[EAX]
00420671 .  E8 26C90300 CALL 4.0045CF9C
00420676 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
0042067C .  8D45 C8    LEA EAX,DWORD PTR SS:[EBP-38]
0042067F .  BA 02000000 MOV EDX,2
00420684 .  E8 C7A10700 CALL 4.0049A850
00420689 .  8B0D 38F54B00 MOV ECX,DWORD PTR DS:[4BF538]          ;  4._PlayForm
0042068F .  33C0       XOR EAX,EAX
00420691 .  8B39       MOV EDI,DWORD PTR DS:[ECX]
00420693 .  B9 32000000 MOV ECX,32
00420698 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0C8
004206A1 .  8945 C4    MOV DWORD PTR SS:[EBP-3C],EAX
004206A4 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
004206AA .  8B87 A0030000 MOV EAX,DWORD PTR DS:[EDI+3A0]
004206B0 .  99          CDQ
004206B1 .  F7F9       IDIV ECX
004206B3 .  80C2 30    ADD DL,30
004206B6 .  8D85 28F7FFFF LEA EAX,DWORD PTR SS:[EBP-8D8]
004206BC .  8895 32FFFFFF MOV BYTE PTR SS:[EBP-CE],DL
004206C2 .  C685 33FFFFFF>MOV BYTE PTR SS:[EBP-CD],0
004206C9 .  68 04010000 PUSH 104                               ; /BufSize = 104 (260.)
004206CE .  50          PUSH EAX                               ; |Buffer
004206CF .  E8 A6EA0800 CALL <JMP.&KERNEL32.GetWindowsDirectoryA>; \GetWindowsDirectoryA
004206D4 .  68 14744B00 PUSH 4.004B7414                         ; //ai6vplaydd
004206D9 .  8D95 28F7FFFF LEA EDX,DWORD PTR SS:[EBP-8D8]          ; |
004206DF .  52          PUSH EDX                               ; |Arg1
004206E0 .  E8 C7C00600 CALL 4.0048C7AC                         ; \4.0048C7AC
004206E5 .  83C4 08    ADD ESP,8
004206E8 .  8D8D 32FFFFFF LEA ECX,DWORD PTR SS:[EBP-CE]
004206EE .  51          PUSH ECX                               ; /Arg2
004206EF .  8D85 28F7FFFF LEA EAX,DWORD PTR SS:[EBP-8D8]          ; |
004206F5 .  50          PUSH EAX                               ; |Arg1
004206F6 .  E8 B1C00600 CALL 4.0048C7AC                         ; \4.0048C7AC
004206FB .  83C4 08    ADD ESP,8
004206FE .  68 20744B00 PUSH 4.004B7420                         ; /.dat
00420703 .  8D95 28F7FFFF LEA EDX,DWORD PTR SS:[EBP-8D8]          ; |
00420709 .  52          PUSH EDX                               ; |Arg1
0042070A .  E8 9DC00600 CALL 4.0048C7AC                         ; \4.0048C7AC
0042070F .  83C4 08    ADD ESP,8
00420712 .  8D95 28F7FFFF LEA EDX,DWORD PTR SS:[EBP-8D8]
00420718 .  8D45 C0    LEA EAX,DWORD PTR SS:[EBP-40]
0042071B .  E8 78A00700 CALL 4.0049A798
00420720 .  8BD0       MOV EDX,EAX
00420722 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420728 .  8D45 C4    LEA EAX,DWORD PTR SS:[EBP-3C]
0042072B .  E8 50A10700 CALL 4.0049A880
00420730 .  B2 01       MOV DL,1
00420732 .  A1 E4664700 MOV EAX,DWORD PTR DS:[4766E4]
00420737 .  E8 0036FEFF CALL 4.00403D3C
0042073C .  8BD8       MOV EBX,EAX
0042073E .  BA 25744B00 MOV EDX,4.004B7425
00420743 .  8D45 BC    LEA EAX,DWORD PTR SS:[EBP-44]
00420746 .  E8 4DA00700 CALL 4.0049A798
0042074B .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420751 .  8B10       MOV EDX,DWORD PTR DS:[EAX]
00420753 .  8BC3       MOV EAX,EBX
00420755 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420757 .  FF51 34    CALL DWORD PTR DS:[ECX+34]
0042075A .  8D97 CC030000 LEA EDX,DWORD PTR DS:[EDI+3CC]
00420760 .  8D45 B8    LEA EAX,DWORD PTR SS:[EBP-48]
00420763 .  E8 30A00700 CALL 4.0049A798
00420768 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
0042076E .  8B10       MOV EDX,DWORD PTR DS:[EAX]
00420770 .  8BC3       MOV EAX,EBX
00420772 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420774 .  FF51 34    CALL DWORD PTR DS:[ECX+34]
00420777 .  8D97 E1030000 LEA EDX,DWORD PTR DS:[EDI+3E1]
0042077D .  8D45 B4    LEA EAX,DWORD PTR SS:[EBP-4C]
00420780 .  E8 13A00700 CALL 4.0049A798
00420785 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
0042078B .  8B10       MOV EDX,DWORD PTR DS:[EAX]
0042078D .  8BC3       MOV EAX,EBX
0042078F .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420791 .  FF51 34    CALL DWORD PTR DS:[ECX+34]
00420794 .  8D97 E1040000 LEA EDX,DWORD PTR DS:[EDI+4E1]
0042079A .  8D45 B0    LEA EAX,DWORD PTR SS:[EBP-50]
0042079D .  E8 F69F0700 CALL 4.0049A798
004207A2 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
004207A8 .  8B10       MOV EDX,DWORD PTR DS:[EAX]
004207AA .  8BC3       MOV EAX,EBX
004207AC .  8B08       MOV ECX,DWORD PTR DS:[EAX]
004207AE .  FF51 34    CALL DWORD PTR DS:[ECX+34]
004207B1 .  8B45 C4    MOV EAX,DWORD PTR SS:[EBP-3C]
004207B4 .  E8 D79F0700 CALL 4.0049A790
004207B9 .  8B55 C4    MOV EDX,DWORD PTR SS:[EBP-3C]
004207BC .  8BC3       MOV EAX,EBX
004207BE .  8B08       MOV ECX,DWORD PTR DS:[EAX]
004207C0 .  FF51 64    CALL DWORD PTR DS:[ECX+64]
004207C3 .  8BFB       MOV EDI,EBX
004207C5 .  897D A8    MOV DWORD PTR SS:[EBP-58],EDI
004207C8 .  85FF       TEST EDI,EDI
004207CA .  74 24       JE SHORT 4.004207F0
004207CC .  8B07       MOV EAX,DWORD PTR DS:[EDI]
004207CE .  8945 AC    MOV DWORD PTR SS:[EBP-54],EAX
004207D1 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0D4
004207DA .  BA 03000000 MOV EDX,3
004207DF .  8B45 A8    MOV EAX,DWORD PTR SS:[EBP-58]
004207E2 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
004207E4 .  FF51 FC    CALL DWORD PTR DS:[ECX-4]
004207E7 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0C8
004207F0 >  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
004207F6 .  8D45 B0    LEA EAX,DWORD PTR SS:[EBP-50]
004207F9 .  BA 02000000 MOV EDX,2
004207FE .  E8 4DA00700 CALL 4.0049A850
00420803 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420809 .  8D45 B4    LEA EAX,DWORD PTR SS:[EBP-4C]
0042080C .  BA 02000000 MOV EDX,2
00420811 .  E8 3AA00700 CALL 4.0049A850
00420816 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
0042081C .  8D45 B8    LEA EAX,DWORD PTR SS:[EBP-48]
0042081F .  BA 02000000 MOV EDX,2
00420824 .  E8 27A00700 CALL 4.0049A850
00420829 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
0042082F .  8D45 BC    LEA EAX,DWORD PTR SS:[EBP-44]
00420832 .  BA 02000000 MOV EDX,2
00420837 .  E8 14A00700 CALL 4.0049A850
0042083C .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420842 .  8D45 C0    LEA EAX,DWORD PTR SS:[EBP-40]
00420845 .  BA 02000000 MOV EDX,2
0042084A .  E8 01A00700 CALL 4.0049A850
0042084F .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420855 .  8D45 C4    LEA EAX,DWORD PTR SS:[EBP-3C]
00420858 .  BA 02000000 MOV EDX,2
0042085D .  E8 EE9F0700 CALL 4.0049A850
00420862 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0BC
0042086B .  C686 08030000>MOV BYTE PTR DS:[ESI+308],1
00420872 .  8BC6       MOV EAX,ESI
00420874 .  E8 0F470300 CALL 4.00454F88
00420879 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
0042087F .  8D45 F4    LEA EAX,DWORD PTR SS:[EBP-C]
00420882 .  BA 02000000 MOV EDX,2
00420887 .  E8 C49F0700 CALL 4.0049A850
0042088C .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420892 .  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
00420895 .  BA 02000000 MOV EDX,2
0042089A .  E8 B19F0700 CALL 4.0049A850
0042089F .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
004208A5 .  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
004208A8 .  BA 02000000 MOV EDX,2
004208AD .  E8 9E9F0700 CALL 4.0049A850
004208B2 .  8B8D 38FFFFFF MOV ECX,DWORD PTR SS:[EBP-C8]
004208B8 .  64:890D 00000>MOV DWORD PTR FS:[0],ECX
004208BF .  E9 8B050000 JMP 4.00420E4F
004208C4 >  A1 38F54B00 MOV EAX,DWORD PTR DS:[4BF538]
004208C9 .  B9 32000000 MOV ECX,32
004208CE .  8B30       MOV ESI,DWORD PTR DS:[EAX]
004208D0 .  33C0       XOR EAX,EAX
004208D2 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0EC
004208DB .  8945 A4    MOV DWORD PTR SS:[EBP-5C],EAX
004208DE .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
004208E4 .  8B86 A0030000 MOV EAX,DWORD PTR DS:[ESI+3A0]
004208EA .  99          CDQ
004208EB .  F7F9       IDIV ECX
004208ED .  80C2 30    ADD DL,30
004208F0 .  8D85 24F6FFFF LEA EAX,DWORD PTR SS:[EBP-9DC]
004208F6 .  8895 30FFFFFF MOV BYTE PTR SS:[EBP-D0],DL
004208FC .  C685 31FFFFFF>MOV BYTE PTR SS:[EBP-CF],0
00420903 .  68 04010000 PUSH 104                               ; /BufSize = 104 (260.)
00420908 .  50          PUSH EAX                               ; |Buffer
00420909 .  E8 6CE80800 CALL <JMP.&KERNEL32.GetWindowsDirectoryA>; \GetWindowsDirectoryA
0042090E .  68 26744B00 PUSH 4.004B7426                         ; //ai6vplaydd
00420913 .  8D95 24F6FFFF LEA EDX,DWORD PTR SS:[EBP-9DC]          ; |
00420919 .  52          PUSH EDX                               ; |Arg1
0042091A .  E8 8DBE0600 CALL 4.0048C7AC                         ; \4.0048C7AC
0042091F .  83C4 08    ADD ESP,8
00420922 .  8D8D 30FFFFFF LEA ECX,DWORD PTR SS:[EBP-D0]
00420928 .  51          PUSH ECX                               ; /Arg2
00420929 .  8D85 24F6FFFF LEA EAX,DWORD PTR SS:[EBP-9DC]          ; |
0042092F .  50          PUSH EAX                               ; |Arg1
00420930 .  E8 77BE0600 CALL 4.0048C7AC                         ; \4.0048C7AC
00420935 .  83C4 08    ADD ESP,8
00420938 .  68 32744B00 PUSH 4.004B7432                         ; /.dat
0042093D .  8D95 24F6FFFF LEA EDX,DWORD PTR SS:[EBP-9DC]          ; |
00420943 .  52          PUSH EDX                               ; |Arg1
00420944 .  E8 63BE0600 CALL 4.0048C7AC                         ; \4.0048C7AC
00420949 .  83C4 08    ADD ESP,8
0042094C .  8D95 24F6FFFF LEA EDX,DWORD PTR SS:[EBP-9DC]
00420952 .  8D45 A0    LEA EAX,DWORD PTR SS:[EBP-60]
00420955 .  E8 3E9E0700 CALL 4.0049A798
0042095A .  8BD0       MOV EDX,EAX
0042095C .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420962 .  8D45 A4    LEA EAX,DWORD PTR SS:[EBP-5C]
00420965 .  E8 169F0700 CALL 4.0049A880
0042096A .  B2 01       MOV DL,1
0042096C .  A1 E4664700 MOV EAX,DWORD PTR DS:[4766E4]
00420971 .  E8 C633FEFF CALL 4.00403D3C
00420976 .  8BD8       MOV EBX,EAX
00420978 .  BA 37744B00 MOV EDX,4.004B7437
0042097D .  8D45 9C    LEA EAX,DWORD PTR SS:[EBP-64]
00420980 .  E8 139E0700 CALL 4.0049A798
00420985 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
0042098B .  8B10       MOV EDX,DWORD PTR DS:[EAX]
0042098D .  8BC3       MOV EAX,EBX
0042098F .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420991 .  FF51 34    CALL DWORD PTR DS:[ECX+34]
00420994 .  8D96 CC030000 LEA EDX,DWORD PTR DS:[ESI+3CC]
0042099A .  8D45 98    LEA EAX,DWORD PTR SS:[EBP-68]
0042099D .  E8 F69D0700 CALL 4.0049A798
004209A2 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
004209A8 .  8B10       MOV EDX,DWORD PTR DS:[EAX]
004209AA .  8BC3       MOV EAX,EBX
004209AC .  8B08       MOV ECX,DWORD PTR DS:[EAX]
004209AE .  FF51 34    CALL DWORD PTR DS:[ECX+34]
004209B1 .  8D96 E1030000 LEA EDX,DWORD PTR DS:[ESI+3E1]
004209B7 .  8D45 94    LEA EAX,DWORD PTR SS:[EBP-6C]
004209BA .  E8 D99D0700 CALL 4.0049A798
004209BF .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
004209C5 .  8B10       MOV EDX,DWORD PTR DS:[EAX]
004209C7 .  8BC3       MOV EAX,EBX
004209C9 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
004209CB .  FF51 34    CALL DWORD PTR DS:[ECX+34]
004209CE .  8D96 E1040000 LEA EDX,DWORD PTR DS:[ESI+4E1]
004209D4 .  8D45 90    LEA EAX,DWORD PTR SS:[EBP-70]
004209D7 .  E8 BC9D0700 CALL 4.0049A798
004209DC .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
004209E2 .  8B10       MOV EDX,DWORD PTR DS:[EAX]
004209E4 .  8BC3       MOV EAX,EBX
004209E6 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
004209E8 .  FF51 34    CALL DWORD PTR DS:[ECX+34]
004209EB .  8B45 A4    MOV EAX,DWORD PTR SS:[EBP-5C]
004209EE .  E8 9D9D0700 CALL 4.0049A790
004209F3 .  8B55 A4    MOV EDX,DWORD PTR SS:[EBP-5C]
004209F6 .  8BC3       MOV EAX,EBX
004209F8 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
004209FA .  FF51 64    CALL DWORD PTR DS:[ECX+64]
004209FD .  8BF3       MOV ESI,EBX
004209FF .  8975 88    MOV DWORD PTR SS:[EBP-78],ESI
00420A02 .  85F6       TEST ESI,ESI
00420A04 .  74 24       JE SHORT 4.00420A2A
00420A06 .  8B06       MOV EAX,DWORD PTR DS:[ESI]
00420A08 .  8945 8C    MOV DWORD PTR SS:[EBP-74],EAX
00420A0B .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0F8
00420A14 .  BA 03000000 MOV EDX,3
00420A19 .  8B45 88    MOV EAX,DWORD PTR SS:[EBP-78]
00420A1C .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420A1E .  FF51 FC    CALL DWORD PTR DS:[ECX-4]
00420A21 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0EC
00420A2A >  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420A30 .  8D45 90    LEA EAX,DWORD PTR SS:[EBP-70]
00420A33 .  BA 02000000 MOV EDX,2
00420A38 .  E8 139E0700 CALL 4.0049A850
00420A3D .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420A43 .  8D45 94    LEA EAX,DWORD PTR SS:[EBP-6C]
00420A46 .  BA 02000000 MOV EDX,2
00420A4B .  E8 009E0700 CALL 4.0049A850
00420A50 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420A56 .  8D45 98    LEA EAX,DWORD PTR SS:[EBP-68]
00420A59 .  BA 02000000 MOV EDX,2
00420A5E .  E8 ED9D0700 CALL 4.0049A850
00420A63 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420A69 .  8D45 9C    LEA EAX,DWORD PTR SS:[EBP-64]
00420A6C .  BA 02000000 MOV EDX,2
00420A71 .  E8 DA9D0700 CALL 4.0049A850
00420A76 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420A7C .  8D45 A0    LEA EAX,DWORD PTR SS:[EBP-60]
00420A7F .  BA 02000000 MOV EDX,2
00420A84 .  E8 C79D0700 CALL 4.0049A850
00420A89 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420A8F .  8D45 A4    LEA EAX,DWORD PTR SS:[EBP-5C]
00420A92 .  BA 02000000 MOV EDX,2
00420A97 .  E8 B49D0700 CALL 4.0049A850
00420A9C .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0E0
00420AA5 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],104
00420AAE .  BA 38744B00 MOV EDX,4.004B7438                      ;  注册失败3,请检查用户名和注册码是否都正确输入了
00420AB3 .  8D45 84    LEA EAX,DWORD PTR SS:[EBP-7C]
00420AB6 .  E8 DD9C0700 CALL 4.0049A798
00420ABB .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420AC1 .  8B00       MOV EAX,DWORD PTR DS:[EAX]
00420AC3 .  E8 D4C40300 CALL 4.0045CF9C
00420AC8 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420ACE .  8D45 84    LEA EAX,DWORD PTR SS:[EBP-7C]
00420AD1 .  BA 02000000 MOV EDX,2
00420AD6 .  E8 759D0700 CALL 4.0049A850
00420ADB .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420AE1 .  8D45 F4    LEA EAX,DWORD PTR SS:[EBP-C]
00420AE4 .  BA 02000000 MOV EDX,2
00420AE9 .  E8 629D0700 CALL 4.0049A850
00420AEE .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420AF4 .  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
00420AF7 .  BA 02000000 MOV EDX,2
00420AFC .  E8 4F9D0700 CALL 4.0049A850
00420B01 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420B07 .  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
00420B0A .  BA 02000000 MOV EDX,2
00420B0F .  E8 3C9D0700 CALL 4.0049A850
00420B14 .  8B8D 38FFFFFF MOV ECX,DWORD PTR SS:[EBP-C8]
00420B1A .  64:890D 00000>MOV DWORD PTR FS:[0],ECX
00420B21 .  E9 29030000 JMP 4.00420E4F
00420B26 >  A1 38F54B00 MOV EAX,DWORD PTR DS:[4BF538]
00420B2B .  B9 32000000 MOV ECX,32
00420B30 .  8B30       MOV ESI,DWORD PTR DS:[EAX]
00420B32 .  33C0       XOR EAX,EAX
00420B34 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],11C
00420B3D .  8945 80    MOV DWORD PTR SS:[EBP-80],EAX
00420B40 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420B46 .  8B86 A0030000 MOV EAX,DWORD PTR DS:[ESI+3A0]
00420B4C .  99          CDQ
00420B4D .  F7F9       IDIV ECX
00420B4F .  80C2 30    ADD DL,30
00420B52 .  8D85 20F5FFFF LEA EAX,DWORD PTR SS:[EBP-AE0]
00420B58 .  8895 2EFFFFFF MOV BYTE PTR SS:[EBP-D2],DL
00420B5E .  C685 2FFFFFFF>MOV BYTE PTR SS:[EBP-D1],0
00420B65 .  68 04010000 PUSH 104                               ; /BufSize = 104 (260.)
00420B6A .  50          PUSH EAX                               ; |Buffer
00420B6B .  E8 0AE60800 CALL <JMP.&KERNEL32.GetWindowsDirectoryA>; \GetWindowsDirectoryA
00420B70 .  68 67744B00 PUSH 4.004B7467                         ; //ai6vplaydd
00420B75 .  8D95 20F5FFFF LEA EDX,DWORD PTR SS:[EBP-AE0]          ; |
00420B7B .  52          PUSH EDX                               ; |Arg1
00420B7C .  E8 2BBC0600 CALL 4.0048C7AC                         ; \4.0048C7AC
00420B81 .  83C4 08    ADD ESP,8
00420B84 .  8D8D 2EFFFFFF LEA ECX,DWORD PTR SS:[EBP-D2]
00420B8A .  51          PUSH ECX                               ; /Arg2
00420B8B .  8D85 20F5FFFF LEA EAX,DWORD PTR SS:[EBP-AE0]          ; |
00420B91 .  50          PUSH EAX                               ; |Arg1
00420B92 .  E8 15BC0600 CALL 4.0048C7AC                         ; \4.0048C7AC
00420B97 .  83C4 08    ADD ESP,8
00420B9A .  68 73744B00 PUSH 4.004B7473                         ; /.dat
00420B9F .  8D95 20F5FFFF LEA EDX,DWORD PTR SS:[EBP-AE0]          ; |
00420BA5 .  52          PUSH EDX                               ; |Arg1
00420BA6 .  E8 01BC0600 CALL 4.0048C7AC                         ; \4.0048C7AC
00420BAB .  83C4 08    ADD ESP,8
00420BAE .  8D95 20F5FFFF LEA EDX,DWORD PTR SS:[EBP-AE0]
00420BB4 .  8D85 7CFFFFFF LEA EAX,DWORD PTR SS:[EBP-84]
00420BBA .  E8 D99B0700 CALL 4.0049A798
00420BBF .  8BD0       MOV EDX,EAX
00420BC1 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420BC7 .  8D45 80    LEA EAX,DWORD PTR SS:[EBP-80]
00420BCA .  E8 B19C0700 CALL 4.0049A880
00420BCF .  B2 01       MOV DL,1
00420BD1 .  A1 E4664700 MOV EAX,DWORD PTR DS:[4766E4]
00420BD6 .  E8 6131FEFF CALL 4.00403D3C
00420BDB .  8BD8       MOV EBX,EAX
00420BDD .  BA 78744B00 MOV EDX,4.004B7478
00420BE2 .  8D85 78FFFFFF LEA EAX,DWORD PTR SS:[EBP-88]
00420BE8 .  E8 AB9B0700 CALL 4.0049A798
00420BED .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420BF3 .  8B10       MOV EDX,DWORD PTR DS:[EAX]
00420BF5 .  8BC3       MOV EAX,EBX
00420BF7 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420BF9 .  FF51 34    CALL DWORD PTR DS:[ECX+34]
00420BFC .  8D96 CC030000 LEA EDX,DWORD PTR DS:[ESI+3CC]
00420C02 .  8D85 74FFFFFF LEA EAX,DWORD PTR SS:[EBP-8C]
00420C08 .  E8 8B9B0700 CALL 4.0049A798
00420C0D .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420C13 .  8B10       MOV EDX,DWORD PTR DS:[EAX]
00420C15 .  8BC3       MOV EAX,EBX
00420C17 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420C19 .  FF51 34    CALL DWORD PTR DS:[ECX+34]
00420C1C .  8D96 E1030000 LEA EDX,DWORD PTR DS:[ESI+3E1]
00420C22 .  8D85 70FFFFFF LEA EAX,DWORD PTR SS:[EBP-90]
00420C28 .  E8 6B9B0700 CALL 4.0049A798
00420C2D .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420C33 .  8B10       MOV EDX,DWORD PTR DS:[EAX]
00420C35 .  8BC3       MOV EAX,EBX
00420C37 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420C39 .  FF51 34    CALL DWORD PTR DS:[ECX+34]
00420C3C .  8D96 E1040000 LEA EDX,DWORD PTR DS:[ESI+4E1]
00420C42 .  8D85 6CFFFFFF LEA EAX,DWORD PTR SS:[EBP-94]
00420C48 .  E8 4B9B0700 CALL 4.0049A798
00420C4D .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420C53 .  8B10       MOV EDX,DWORD PTR DS:[EAX]
00420C55 .  8BC3       MOV EAX,EBX
00420C57 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420C59 .  FF51 34    CALL DWORD PTR DS:[ECX+34]
00420C5C .  8B45 80    MOV EAX,DWORD PTR SS:[EBP-80]
00420C5F .  E8 2C9B0700 CALL 4.0049A790
00420C64 .  8B55 80    MOV EDX,DWORD PTR SS:[EBP-80]
00420C67 .  8BC3       MOV EAX,EBX
00420C69 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420C6B .  FF51 64    CALL DWORD PTR DS:[ECX+64]
00420C6E .  8BF3       MOV ESI,EBX
00420C70 .  89B5 64FFFFFF MOV DWORD PTR SS:[EBP-9C],ESI
00420C76 .  85F6       TEST ESI,ESI
00420C78 .  74 2A       JE SHORT 4.00420CA4
00420C7A .  8B06       MOV EAX,DWORD PTR DS:[ESI]
00420C7C .  8985 68FFFFFF MOV DWORD PTR SS:[EBP-98],EAX
00420C82 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],128
00420C8B .  BA 03000000 MOV EDX,3
00420C90 .  8B85 64FFFFFF MOV EAX,DWORD PTR SS:[EBP-9C]
00420C96 .  8B08       MOV ECX,DWORD PTR DS:[EAX]
00420C98 .  FF51 FC    CALL DWORD PTR DS:[ECX-4]
00420C9B .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],11C
00420CA4 >  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420CAA .  8D85 6CFFFFFF LEA EAX,DWORD PTR SS:[EBP-94]
00420CB0 .  BA 02000000 MOV EDX,2
00420CB5 .  E8 969B0700 CALL 4.0049A850
00420CBA .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420CC0 .  8D85 70FFFFFF LEA EAX,DWORD PTR SS:[EBP-90]
00420CC6 .  BA 02000000 MOV EDX,2
00420CCB .  E8 809B0700 CALL 4.0049A850
00420CD0 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420CD6 .  8D85 74FFFFFF LEA EAX,DWORD PTR SS:[EBP-8C]
00420CDC .  BA 02000000 MOV EDX,2
00420CE1 .  E8 6A9B0700 CALL 4.0049A850
00420CE6 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420CEC .  8D85 78FFFFFF LEA EAX,DWORD PTR SS:[EBP-88]
00420CF2 .  BA 02000000 MOV EDX,2
00420CF7 .  E8 549B0700 CALL 4.0049A850
00420CFC .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420D02 .  8D85 7CFFFFFF LEA EAX,DWORD PTR SS:[EBP-84]
00420D08 .  BA 02000000 MOV EDX,2
00420D0D .  E8 3E9B0700 CALL 4.0049A850
00420D12 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420D18 .  8D45 80    LEA EAX,DWORD PTR SS:[EBP-80]
00420D1B .  BA 02000000 MOV EDX,2
00420D20 .  E8 2B9B0700 CALL 4.0049A850
00420D25 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],110
00420D2E .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],134
00420D37 .  BA 79744B00 MOV EDX,4.004B7479                      ;  注册失败2,请检查用户名和注册码是否都正确输入了
00420D3C .  8D85 60FFFFFF LEA EAX,DWORD PTR SS:[EBP-A0]
00420D42 .  E8 519A0700 CALL 4.0049A798
00420D47 .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420D4D .  8B00       MOV EAX,DWORD PTR DS:[EAX]
00420D4F .  E8 48C20300 CALL 4.0045CF9C
00420D54 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420D5A .  8D85 60FFFFFF LEA EAX,DWORD PTR SS:[EBP-A0]
00420D60 .  BA 02000000 MOV EDX,2
00420D65 .  E8 E69A0700 CALL 4.0049A850
00420D6A .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420D70 .  8D45 F4    LEA EAX,DWORD PTR SS:[EBP-C]
00420D73 .  BA 02000000 MOV EDX,2
00420D78 .  E8 D39A0700 CALL 4.0049A850
00420D7D .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420D83 .  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
00420D86 .  BA 02000000 MOV EDX,2
00420D8B .  E8 C09A0700 CALL 4.0049A850
00420D90 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420D96 .  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
00420D99 .  BA 02000000 MOV EDX,2
00420D9E .  E8 AD9A0700 CALL 4.0049A850
00420DA3 .  8B8D 38FFFFFF MOV ECX,DWORD PTR SS:[EBP-C8]
00420DA9 .  64:890D 00000>MOV DWORD PTR FS:[0],ECX
00420DB0 .  E9 9A000000 JMP 4.00420E4F
00420DB5 .  66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],140
00420DBE .  BA A8744B00 MOV EDX,4.004B74A8                      ;  注册失败1,注册码不完整,请检查注册码是否已经全部复制或是否已经全部输入
00420DC3 .  8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
00420DC9 .  E8 CA990700 CALL 4.0049A798
00420DCE .  FF85 54FFFFFF INC DWORD PTR SS:[EBP-AC]
00420DD4 .  8B00       MOV EAX,DWORD PTR DS:[EAX]
00420DD6 .  E8 C1C10300 CALL 4.0045CF9C
00420DDB .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420DE1 .  8D85 5CFFFFFF LEA EAX,DWORD PTR SS:[EBP-A4]
00420DE7 .  BA 02000000 MOV EDX,2
00420DEC .  E8 5F9A0700 CALL 4.0049A850
00420DF1 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420DF7 .  8D45 F4    LEA EAX,DWORD PTR SS:[EBP-C]
00420DFA .  BA 02000000 MOV EDX,2
00420DFF .  E8 4C9A0700 CALL 4.0049A850
00420E04 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420E0A .  8D45 F8    LEA EAX,DWORD PTR SS:[EBP-8]
00420E0D .  BA 02000000 MOV EDX,2
00420E12 .  E8 399A0700 CALL 4.0049A850
00420E17 .  FF8D 54FFFFFF DEC DWORD PTR SS:[EBP-AC]
00420E1D .  8D45 FC    LEA EAX,DWORD PTR SS:[EBP-4]
00420E20 .  BA 02000000 MOV EDX,2
00420E25 .  E8 269A0700 CALL 4.0049A850
00420E2A .  33C9       XOR ECX,ECX
00420E2C .  898D 54FFFFFF MOV DWORD PTR SS:[EBP-AC],ECX
00420E32 .  8D85 38FFFFFF LEA EAX,DWORD PTR SS:[EBP-C8]
00420E38 .  50          PUSH EAX                               ; /Arg1
00420E39 .  E8 09710700 CALL 4.00497F47                         ; \4.00497F47
00420E3E .  59          POP ECX
00420E3F .  EB 0E       JMP SHORT 4.00420E4F

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法

收藏・0

免费・0

支持

最新回复 (3)
lixupeng 雪币： 563 活跃值： (95) 能力值： ( LV2，RANK：10 ) 在线值：发帖 31 回帖 1636 粉丝 0 关注私信	lixupeng 2 楼这个...自己跟踪下就知道了 2008-12-7 16:41 0
zhshw 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 10 粉丝 0 关注私信	zhshw 3 楼 CALL 4.00402A50 ; \4.00402A50 跟进这个找试试 0042064A . 59 POP ECX 0042064B . 3C 01 CMP AL,1 0042064D . 0F85 71020000 JNZ 4.004208C4 00420653 . 66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0B0 0042065C . BA 0B744B00 MOV EDX,4.004B740B ; 注册成功 2008-12-7 17:03 0
混世魔王雪币： 245 活跃值： (41) 能力值： ( LV7，RANK：110 ) 在线值：发帖 27 回帖 58 粉丝 0 关注私信	混世魔王 2 4 楼好像有个KEY 的文件判断。堆栈 [0012EF80]=00CC612C (00CC612C), ASCII "C:\WINDOWS/ai5iplaydd0.dat" esi=0012F008 2009-10-19 02:46 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

wqhlgr

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (3)
lixupeng 雪币： 563 活跃值： (95) 能力值： ( LV2，RANK：10 ) 在线值：发帖 31 回帖 1636 粉丝 0 关注私信	lixupeng 2 楼这个...自己跟踪下就知道了 2008-12-7 16:41 0
zhshw 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 10 粉丝 0 关注私信	zhshw 3 楼 CALL 4.00402A50 ; \4.00402A50 跟进这个找试试 0042064A . 59 POP ECX 0042064B . 3C 01 CMP AL,1 0042064D . 0F85 71020000 JNZ 4.004208C4 00420653 . 66:C785 48FFF>MOV WORD PTR SS:[EBP-B8],0B0 0042065C . BA 0B744B00 MOV EDX,4.004B740B ; 注册成功 2008-12-7 17:03 0
混世魔王雪币： 245 活跃值： (41) 能力值： ( LV7，RANK：110 ) 在线值：发帖 27 回帖 58 粉丝 0 关注私信	混世魔王 2 4 楼好像有个KEY 的文件判断。堆栈 [0012EF80]=00CC612C (00CC612C), ASCII "C:\WINDOWS/ai5iplaydd0.dat" esi=0012F008 2009-10-19 02:46 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复