009A963B > 55 push ebp
009A963C 8BEC mov ebp, esp
009A963E 81EC 0C010000 sub esp, 10C
009A9644 53 push ebx
009A9645 56 push esi
009A9646 57 push edi
009A9647 C785 04FFFFFF 0>mov dword ptr [ebp-FC], 0
009A9651 C745 FC 0000000>mov dword ptr [ebp-4], 0
009A9658 C745 EC 0000000>mov dword ptr [ebp-14], 0
009A965F C745 F8 0000000>mov dword ptr [ebp-8], 0
009A9666 C785 08FFFFFF 0>mov dword ptr [ebp-F8], 0
009A9670 C745 E4 0400000>mov dword ptr [ebp-1C], 4
009A9677 833D BCEE9800 0>cmp dword ptr [98EEBC], 0
009A967E 74 05 je short 009A9685
009A9680 E9 D4430000 jmp 009ADA59
009A9685 A1 BCEE9800 mov eax, dword ptr [98EEBC]
009A968A 83C0 01 add eax, 1
009A968D A3 BCEE9800 mov dword ptr [98EEBC], eax
009A9692 83F4 00 xor esp, 0
009A9695 7B 00 jpo short 009A9697
009A9697 8D80 68430000 lea eax, dword ptr [eax+4368]
009A969D 8D80 98BCFFFF lea eax, dword ptr [eax+FFFFBC98]
009A96A3 76 0F jbe short 009A96B4
009A96A5 66:9C pushfw
009A96A7 83E4 FF and esp, FFFFFFFF
009A96AA C1EC 00 shr esp, 0
009A96AD 66:9D popfw
009A96AF 8BDB mov ebx, ebx
009A96B1 77 01 ja short 009A96B4
009A96B3 E8 83EC0868 call 68A3833B
009A96B8 F6E3 mul bl
009A96BA 9A 0064FF35 000>call far 0000:35FF6400
009A96C1 0000 add byte ptr [eax], al
009A96C3 64:8925 0000000>mov dword ptr fs:[0], esp
009A96CA 7C 00 jl short 009A96CC
009A96CC 8DB6 C34D0000 lea esi, dword ptr [esi+4DC3]
009A96D2 81EE C34D0000 sub esi, 4DC3
009A96D8 C1EC 00 shr esp, 0
009A96DB 853C24 test dword ptr [esp], edi
009A96DE 76 15 jbe short 009A96F5
009A96E0 66:9C pushfw
009A96E2 90 nop
009A96E3 76 00 jbe short 009A96E5
009A96E5 C1E7 00 shl edi, 0
009A96E8 7C 00 jl short 009A96EA
009A96EA 66:9D popfw
009A96EC 7E 00 jle short 009A96EE
009A96EE EB 00 jmp short 009A96F0
009A96F0 8BE4 mov esp, esp
009A96F2 77 01 ja short 009A96F5
009A96F4 81E8 981EFFFF sub eax, FFFF1E98
009A96FA 78 00 js short 009A96FC
009A96FC 83F0 00 xor eax, 0
009A96FF 7E 00 jle short 009A9701
009A9701 F7C4 73370000 test esp, 3773
009A9707 7E 13 jle short 009A971C
009A9709 87FF xchg edi, edi
009A970B 87F6 xchg esi, esi
009A970D 8D92 DD710000 lea edx, dword ptr [edx+71DD]
009A9713 8D92 238EFFFF lea edx, dword ptr [edx+FFFF8E23]
009A9719 7F 01 jg short 009A971C
009A971B BD C7058CEE mov ebp, EE8C05C7
009A9720 98 cwde
009A9721 0001 add byte ptr [ecx], al
009A9723 0000 add byte ptr [eax], al
009A9725 008D 007C09EB add byte ptr [ebp+EB097C00], cl
009A972B 007D 00 add byte ptr [ebp], bh
009A972E 96 xchg eax, esi
009A972F 96 xchg eax, esi
009A9730 7D 01 jge short 009A9733
009A9732 2D B9EC0098 sub eax, 9800ECB9
009A9737 0081 E9000098 add byte ptr [ecx+980000E9], al
009A973D 0089 0D28EA98 add byte ptr [ecx+98EA280D], cl
009A9743 0043 4B add byte ptr [ebx+4B], al
009A9746 F7C1 1C3A0000 test ecx, 3A1C
009A974C 3BDE cmp ebx, esi
009A974E 85C8 test eax, ecx
009A9750 72 13 jb short 009A9765
009A9752 66:9C pushfw
---------------------------------------------------------------------
不用看了,貌似 圣天有狗壳!
谢谢大家!
[课程]Android-CTF解题方法汇总！
