-
-
PCShrink 0.71 部分源代码(带Packer)
-
发表于: 2004-5-16 17:17 8344
-
:D 这个东西对资源处理太棒了.正在还原它的源代码...
请问IDA怎么自定义常量?还有assume什么的?
这里是部分源码,也许脱壳有用吧...
都弄好以后会发布带资源的Full Source包:D
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏记录
参与人
雪币
留言
时间
一路南寻
为你点赞~
2024-4-3 00:56
東陽不列山
为你点赞~
2024-3-14 01:58
嫉妒的死远点
为你点赞~
2024-2-8 00:04
Youlor
为你点赞~
2023-5-11 00:14
心游尘世外
为你点赞~
2023-3-28 02:07
飘零丶
为你点赞~
2023-3-28 01:54
一笑人间万事
为你点赞~
2023-3-22 03:53
shinratensei
为你点赞~
2023-3-19 01:29
QinBeast
为你点赞~
2023-3-19 01:28
伟叔叔
为你点赞~
2023-3-19 00:13
赞赏
|
|
---|---|
|
还想问一下最后的一大堆dword是什么?看不出来
|
|
|
|
; ┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
; ┃ This file is generated by The Fast Disassembler (Fdasm v0.1 beta) ┃ ; ┃ Copyright (c) 2004 by IcePlus, <IcePlus@hotmail.com> ┃ ; ┃ Build Feb. 7. 2004 ┃ ; ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛ DlgProc: ;对话框回调函数 enter 0000h, 00h push ebx push edi push esi mov eax, [ebp+08h] mov [_004037EFh], eax cmp dword [ebp+0Ch], 00000111h ;WM_COMMAND je _00401162h cmp dword [ebp+0Ch], 10h je _00401254h cmp dword [ebp+0Ch], 00000110h je _00401262h _00401159h: xor eax, eax pop esi pop edi pop ebx leave ret 0010h _00401162h: cmp dword [ebp+10h], 01h ;BUTTON_ID=='OK' jne _00401216h push 00h push dword [_004038D4h] call [EnableWindow] push 00h push dword [_004038D8h] call [EnableWindow] pushad call _0040243Fh popad push 000000FFh push _0040360Dh push 000003E8h push dword [_004037EFh] call [GetDlgItemTextA] push 000003ECh push dword [_004037EFh] call [IsDlgButtonChecked] mov [_00403897h], eax push 000003EDh push dword [_004037EFh] call [IsDlgButtonChecked] mov [_00403893h], eax push 000003F4h push dword [_004037EFh] call [IsDlgButtonChecked] mov [_0040389Fh], eax push 00000402h push dword [_004037EFh] call [IsDlgButtonChecked] mov [_004038C0h], eax pushad push _004038C8h push 00h push 00h push _0040106Fh ;线程回调函数 push 00h push 00h call [CreateThread] popad jmp _00401248h _00401216h: cmp dword [ebp+10h], 000003EBh je _00401373h cmp dword [ebp+10h], 02h je _00401254h cmp dword [ebp+10h], 000003F1h je _00401339h cmp dword [ebp+10h], 000003F0h je _00401356h jmp _00401159h _00401248h: mov eax, 00000001h pop esi pop edi pop ebx leave ret 0010h _00401254h: push 00h ;========================================================================== _0040243Fh: mov edi, _004038DCh xor eax, eax mov ecx, 00000010h repe stosd push 000003FFh push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _00402468h push 01h call _004022A6h _00402468h: push 000003EAh push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _00402483h push 02h call _004022A6h _00402483h: push 000003EEh push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _0040249Eh push 03h call _004022A6h _0040249Eh: push 000003F6h push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _004024B9h push 04h call _004022A6h _004024B9h: push 000003F7h push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _004024D4h push 05h call _004022A6h _004024D4h: push 000003FCh push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _004024EFh push 06h call _004022A6h _004024EFh: push 000003F8h push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _0040250Ah push 07h call _004022A6h _0040250Ah: push 00000401h push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _00402525h push 08h call _004022A6h _00402525h: push 000003FEh push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _00402540h push 09h call _004022A6h _00402540h: push 000003FDh push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _0040255Bh push 0Ah call _004022A6h _0040255Bh: push 000003FBh push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _00402576h push 0Bh call _004022A6h _00402576h: push 000003FAh push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _00402591h push 0Ch call _004022A6h _00402591h: push 000003F9h push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _004025ACh push 0Eh call _004022A6h _004025ACh: push 00000400h push dword [_004037EFh] call [IsDlgButtonChecked] or eax, eax je _004025C7h push 10h call _004022A6h _004025C7h: ret ;========================================================================== _004022A6h: pop edx pop ebx push edx mov esi, _004038DCh _004022AEh: lodsd cmp ebx, eax je _004022C3h or eax, eax jne _004022AEh sub esi, 04h mov [esi], ebx mov dword [esi+04h], 00000000h _004022C3h: ret ;========================================================================== _0040106F: ;ThreadFunction mov dword [_0040376Eh], _0040360Dh cmp dword [_0040389Fh], 01h jne _0040108Dh push dword [_0040376Eh] call _00402262h _0040108Dh: push dword [_0040376Eh] push _004031A3h call [lstrcat] call _00401666h cmp byte [_0040379Eh], FCh je _00401111h cmp byte [_0040379Eh], FFh je _004010E9h push _00403363h push _004031A3h call [lstrcat] push _0040342Fh push _004031A3h call [lstrcat] push 00h push _00403170h push _004031A3h push 00h call [MessageBoxA] xor eax, eax jmp _00401111h _004010E9h: push dword [_0040376Eh] push _004034C5h call [lstrcat] push 30h push _00403170h push _004034C5h push 00h call [MessageBoxA] mov eax, 00000002h _00401111h: push 00h push 00h push 10h push dword [_004037EFh] call [SendMessageA] push 00h call [ExitThread] ret ;========================================================================== _00402262h: pop ebx pop edi push ebx push edi push edi push _00403000h call [lstrcpy] pop edi push edi push _00403100h push _00403000h call [lstrcat] pop edi push 00h push _00403000h push edi call [CopyFileA] ret ;========================================================================== _00401666h: push dword [_0040376Eh] call [GetFileAttributesA] mov [_0040376Ah], eax cmp eax, FFh jne _0040167Ch ret _0040167Ch: push 20h push dword [_0040376Eh] call [SetFileAttributesA] mov esi, [_0040376Eh] call _00401DF3h call _00401DBEh jnb _0040169Ch ret _0040169Ch: mov [_00403782h], eax mov eax, [_00403782h] push eax call _00401E09h pop eax push _0040373Ah push _00403742h push _0040374Ah push eax call [GetFileTime] xor ecx, ecx call _00401D60h jb _00401BB9h cmp word [eax], 5A4Dh jne _00401BB9h call _00401D54h push 02h push esi call [IsBadReadPtr] or eax, eax jne _00401BB9h cmp word [esi], 4550h jne _00401BB9h cmp dword [esi+0Ch], 90909090h jne _00401722h push 10h push _00403170h push _0040349Eh push 00h call [MessageBoxA] mov byte [_0040379Eh], FCh jmp _00401BB9h _00401722h: call _00401DCBh mov ecx, 00001000h call _00401D60h jb _00401BB9h call _00401D54h mov dword [esi+0Ch], 90909090h movzx eax, word [esi+06h] mov [_004037BBh], eax mov eax, [esi+34h] mov [_00403C65h], eax mov eax, [esi+000000C0h] mov [_004038C4h], eax cmp dword [_004038C0h], 01h je _00401770h mov eax, [esi+78h] mov [_0040379Fh], eax _00401770h: movzx eax, word [esi+14h] add eax, 18h add eax, esi mov [_0040378Eh], eax mov ebx, [esi+000000D8h] or ebx, ebx je _0040179Fh call _00401FC6h add ebx, [_00403766h] mov ecx, [esi+000000DCh] mov edi, ebx xor eax, eax repe stosb _0040179Fh: mov ebx, [esi+000000A8h] or ebx, ebx je _004017BFh call _00401FC6h add ebx, [_00403766h] mov ecx, [esi+000000ACh] mov edi, ebx xor eax, eax stosb _004017BFh: mov dword [esi+000000D8h], 00000000h mov dword [esi+000000DCh], 00000000h mov dword [esi+000000D0h], 00000000h mov dword [esi+000000D4h], 00000000h mov dword [esi+000000A8h], 00000000h mov dword [esi+000000ACh], 00000000h mov eax, [esi+3Ch] mov [_004037A3h], eax push esi mov ebx, [esi+00000088h] mov eax, [esi+0000008Ch] or ebx, ebx je _00401872h mov [_004037B3h], eax mov [_00403C6Dh], ebx call _00401FC6h add ebx, [_00403766h] mov [_004037B7h], ebx call _004014CAh push ebx call _004013D7h cmp dword [_00403897h], 01h jne _00401868h call _0040152Ah xchg ebx, eax call _00401FC6h add ebx, [_00403766h] push ebx call _004015A6h sub eax, [_004037B7h] mov [_00403C69h], eax jmp _00401872h _00401868h: call _00401573h mov [_00403C69h], eax _00401872h: mov ebx, [_004037B3h] cmp eax, ebx jnb _00401886h sub ebx, eax cmp ebx, 00000200h jnb _00401890h _00401886h: mov dword [_0040389Bh], 00000000h _00401890h: cmp dword [_00403893h], 00h je _004018B3h push _00403CC9h push dword [_0040378Eh] call _00402050h push _00403CC9h call _00402222h _004018B3h: pop esi mov eax, [_004037BBh] mov [esi+06h], eax push esi mov eax, [_0040378Eh] mov edi, _00403C71h xor ecx, ecx mov cx, [esi+06h] _004018CDh: mov dword [_004037BFh], 00000000h cmp edi, _00403CC1h je _00401A42h mov dword [_004037AFh], 00000000h mov ebx, [_00403C6Dh] cmp [eax+0Ch], ebx jne _0040191Bh cmp dword [_0040389Bh], 01h jne _00401A42h mov ebx, [_00403C65h] add [_00403C6Dh], ebx mov dword [_004037AFh], 00000001h _0040191Bh: call _00401CF4h jb _00401A42h pushad push _00403137h push _00403363h call [lstrcat] popad pushad push _004038BBh push _00403363h call [lstrcat] popad push eax push ecx mov ebx, [eax+24h] or ebx, 80000000h mov [eax+24h], ebx mov ebx, [eax+0Ch] add ebx, [_00403C65h] mov [edi], ebx push edi mov esi, [eax+14h] add esi, [_00403766h] mov edi, esi push eax mov ecx, [eax+08h] mov edx, [eax+10h] cmp ecx, edx jna _0040197Ah mov ecx, edx _0040197Ah: pushad xchg edx, ecx mov byte [_00403604h], 09h mov edi, _00403605h call _00401F9Eh push _00403604h push _00403363h call [lstrcat] popad cmp dword [_004037AFh], 01h jne _004019D7h sub ecx, [_00403C69h] add esi, [_00403C69h] mov edi, esi call _00401C55h add eax, [_00403C69h] mov [_004037BFh], eax call _0040164Dh push eax call _00401DE2h mov [_004037B3h], eax jmp _004019ECh _004019D7h: call _00401C55h mov [_004037BFh], eax call _0040164Dh push eax call _00401DE2h _004019ECh: pushad mov edx, [_004037ABh] mov byte [_00403604h], 20h mov edi, _00403605h call _00401F9Eh push _0040370Dh push _00403363h call [lstrcat] push _00403604h push _00403363h call [lstrcat] popad pop ecx pop edx mov ebx, [edx+10h] cmp ebx, [_00403A50h] jna _00401A36h mov [_00403A50h], ebx _00401A36h: pop edi mov [edx+10h], eax mov [edi+04h], ecx add edi, 08h pop ecx pop eax _00401A42h: mov ebx, [_004038BBh] bswap ebx inc bl bswap ebx mov [eax], ebx mov [_004038BBh], ebx mov dword [eax+04h], 00000000h add eax, 28h add dword [_0040388Fh], 04h loopd _00401A6Bh jmp _00401A70h _00401A6Bh: jmp _004018CDh _00401A70h: pop esi sub eax, 28h mov edi, eax mov eax, [edi+14h] mov [_00403792h], eax mov ecx, [edi+10h] mov [_00403796h], ecx mov eax, [edi+08h] mov [_0040379Ah], eax cmp eax, ecx jnb _00401A95h mov eax, ecx _00401A95h: add eax, 00005425h mov [edi+08h], eax cmp dword [_004037BFh], 00h jne _00401ABFh mov ecx, [_00403796h] mov eax, [_0040379Ah] cmp eax, ecx jna _00401AC4h mov eax, ecx mov [_0040379Ah], ecx jmp _00401AC4h _00401ABFh: mov eax, [_004037BFh] _00401AC4h: mov [_004037C3h], eax push eax add eax, 00000425h mov [_004037E7h], eax call _00401DE2h mov [edi+10h], eax mov ecx, [esi+38h] mov eax, [edi+08h] add eax, [edi+0Ch] call _00401DE7h mov [esi+50h], eax add dword [_00403A50h], 00000425h pop eax mov dword [edi+24h], E0000020h add eax, [edi+0Ch] mov ebx, [esi+28h] mov [esi+28h], eax push eax add eax, [_00403C65h] sub eax, _00403944h mov [_00403947h], eax pop eax pushad add eax, 00000114h add [_00403A58h], eax add [_00403A64h], eax add [_00403A68h], eax add [_00403A80h], eax add [_00403A84h], eax add [_00403A88h], eax add [_00403A8Ch], eax mov ecx, [esi+00000080h] mov [_00403C61h], ecx mov [esi+00000080h], eax mov dword [esi+00000084h], 00000085h popad add ebx, [_00403C65h] mov [_00403B9Eh], ebx push esi call _00402185h mov ecx, 00000425h mov edi, [_00403766h] add edi, [_004037C3h] add edi, [_00403792h] mov esi, _00403944h repe movsb pop esi mov eax, [_004037E7h] push eax call _00401DE2h pop ecx xchg ecx, eax sub ecx, eax xor eax, eax repe stosb call _00401DCBh mov byte [_0040379Eh], 00h jmp _00401BBEh _00401BB9h: call _00401DCBh _00401BBEh: push _0040373Ah push _00403742h push _0040374Ah push dword [_00403782h] call [SetFileTime] mov edx, [_0040375Eh] mov edi, _00403473h call _00401F9Eh cmp byte [_0040379Eh], 00h jne _00401BFBh mov eax, [_00403782h] call _00401E09h _00401BFBh: mov edx, [_0040375Eh] mov edi, _0040348Fh call _00401F9Eh push _00403473h push _0040342Fh call [lstrcat] push _00403482h push _0040342Fh call [lstrcat] push _0040348Fh push _0040342Fh call [lstrcat] push dword [_00403782h] call [CloseHandle] push dword [_0040376Ah] push dword [_0040376Eh] call [SetFileAttributesA] ret ;========================================================================== _00401DF3h: push 00h push 20h push 03h push 00h push 00h push C0000000h push esi call [CreateFileA] ret ;========================================================================== _00401DBEh: cmp eax, FFh je _00401DC9h or eax, eax je _00401DC9h clc ret _00401DC9h: stc ret ;========================================================================== _00401E09h: xor ecx, ecx call _00401D60h jb _00401BB9h mov ecx, [_0040375Eh] or ecx, ecx je _00401F4Eh mov [_0040377Eh], ecx call _00401D54h mov eax, [esi+3Ch] mov [_00403762h], eax xor eax, eax mov ax, [esi+14h] add eax, 18h add eax, esi push esi push eax xchg edi, eax mov [_004038A3h], edi movzx ecx, word [esi+06h] xor ebx, ebx _00401E51h: call _00401F54h inc ebx cmp ebx, ecx je _00401E5Dh jmp _00401E51h _00401E5Dh: pop eax pop esi pushad push eax push esi call _004015F3h popad push eax xor edx, edx mov ecx, 00000028h xor eax, eax mov ax, [esi+06h] inc eax mul ecx xchg ebx, eax pop eax push eax add eax, ebx mov ecx, [esi+3Ch] call _00401DE7h xchg ebx, eax pop eax mov ecx, ebx sub ecx, [_00403766h] mov [esi+54h], ecx mov ecx, 00000200h mov [esi+3Ch], ecx movzx ecx, word [esi+06h] mov edi, ebx _00401EA1h: push eax push ecx mov ecx, edi sub ecx, [_00403766h] mov esi, [eax+14h] mov [eax+14h], ecx mov ebx, [eax+08h] cmp ebx, [eax+10h] jg _00401EC9h mov ecx, 00000200h push eax xchg ebx, eax call _00401DE7h xchg ebx, eax pop eax jmp _00401ECCh _00401EC9h: mov ebx, [eax+10h] _00401ECCh: mov [eax+10h], ebx add esi, [_00403766h] mov ecx, ebx repe movsb pop ecx pop eax add eax, 28h loopd _00401EA1h sub eax, 28h mov ecx, [eax+10h] add ecx, [eax+14h] push ecx call _00401DCBh mov byte [_0040379Eh], 00h pop ecx mov [_00403756h], ecx push 00h push 00h push ecx push dword [_00403782h] call [SetFilePointer] push dword [_00403782h] call [SetEndOfFile] xor ecx, ecx call _00401D60h jb _00401F53h call _00401D54h lea eax, [esi+58h] push eax push _00403752h push dword [_0040375Eh] push dword [_00403766h] call [CheckSumMappedFile] call _00401DCBh mov byte [_0040379Eh], 00h jmp _00401F53h _00401F4Eh: call _00401DCBh _00401F53h: ret ;========================================================================== _00401D60h: push ecx push _004037A7h push dword [_00403782h] call [GetFileSize] call _00401DBEh jnb _00401D7Bh pop ecx jmp _00401DBDh _00401D7Bh: mov [_0040375Eh], eax pop ecx add eax, ecx push 00h push eax push 00h push 04h push 00h push dword [_00403782h] call [CreateFileMappingA] call _00401DBEh jb _00401DBDh mov [_0040377Ah], eax push 00h push 00h push 00h push 02h push eax call [MapViewOfFile] call _00401DBEh jb _00401DBDh mov [_00403766h], eax _00401DBDh: ret ;========================================================================== _00401D54h: mov esi, [eax+3Ch] add esi, eax mov [_00403772h], esi ret ;========================================================================== _00401DCBh: push dword [_00403766h] call [UnmapViewOfFile] push dword [_0040377Ah] call [CloseHandle] ret ;========================================================================== _00401FC6h: push esi push edi push edx push ecx push eax mov eax, [_0040378Eh] mov ecx, [_004037BBh] _00401FD6h: mov edx, [eax+0Ch] cmp edx, ebx ja _00401FE2h add eax, 28h loopd _00401FD6h _00401FE2h: sub eax, 28h sub ebx, [eax+0Ch] add ebx, [eax+14h] pop eax pop ecx pop edx pop edi pop esi ret ;========================================================================== _004014CAh: push 00001F40h push 08h push dword [_004037DFh] call [HeapAlloc] mov [_004037D3h], eax mov [_004037D7h], eax push 00001F40h push 08h push dword [_004037DFh] call [HeapAlloc] mov [_004037CFh], eax mov [_004037CBh], eax ret ;========================================================================== _004013D7h: pop eax pop esi push eax or esi, esi je _00401452h movzx ecx, word [esi+0Ch] add cx, [esi+0Eh] add esi, 10h or ecx, ecx je _00401452h _004013EDh: mov ebx, [esi+04h] test ebx, 80000000h je _00401449h cmp dword [_004037E3h], 00h jne _00401422h pushad push dword [esi] call _00402291h popad jnb _00401418h mov dword [_004037DBh], 00000000h jmp _00401422h _00401418h: mov dword [_004037DBh], 00000001h _00401422h: and ebx, 7FFFFFFFh add ebx, [_004037B7h] pushad inc dword [_004037E3h] push ebx call _004013D7h dec dword [_004037E3h] popad _00401442h: add esi, 08h loopd _004013EDh jmp _00401452h _00401449h: pushad call _00401458h popad jmp _00401442h _00401452h: mov eax, [_00403C69h] ret ;========================================================================== _0040152Ah: push ebx push ecx push edx push esi push edi push dword [_004037D3h] call _00401552h push eax push dword [_004037CFh] call _00401552h pop ebx cmp ebx, eax ja _0040154Ch xchg ebx, eax _0040154Ch: pop edi pop esi pop edx pop ecx pop ebx ret ;========================================================================== _004015A6h: pop eax pop edi push eax push dword [_004037CFh] push edi call _004015C4h push eax push dword [_004037D3h] push eax call _004015C4h pop eax ret ;========================================================================== _00401573h: push ebx push ecx push edx push esi push edi push dword [_004037CFh] call _00401589h pop edi pop esi pop edx pop ecx pop ebx ret ;========================================================================== _00402050h: pop edx pop eax pop edi push edx mov ecx, [_004037BBh] dec ecx xor ebp, ebp _0040205Dh: push ecx call _00401CF4h jnb _0040206Dh xor ebp, ebp je _0040215Eh _0040206Dh: cmp ebp, 01h je _0040207Ch mov ebp, 00000001h jmp _0040215Eh _0040207Ch: push eax mov ebx, [eax-14h] add ebx, [eax-18h] add ebx, [_00403766h] push edi mov edi, ebx call _0040216Ch mov ecx, edi sub ecx, [eax-14h] sub ecx, [_00403766h] mov [_004038ABh], ecx mov ebx, edi pop edi pop eax push eax push ebx mov ebx, [eax+14h] add ebx, [eax+10h] add ebx, [_00403766h] push edi mov edi, ebx call _0040216Ch mov ecx, edi sub ecx, [eax+14h] sub ecx, [_00403766h] mov [_004038AFh], ecx pop edi mov ebp, edi pop edi mov esi, [eax+14h] add esi, [_00403766h] mov ecx, [_004038AFh] repe movsb pop eax mov ebx, [eax+34h] mov ecx, [eax-1Ch] sub ebx, ecx mov [eax-20h], ebx mov ebx, [_004038ABh] add ebx, [_004038AFh] mov [eax-18h], ebx mov edi, ebp mov ebx, [eax+0Ch] add ebx, [_00403C65h] mov [edi+04h], ebx mov ebx, [eax-1Ch] add ebx, [_004038ABh] add ebx, [_00403C65h] mov [edi], ebx mov ebx, [_004038AFh] mov [edi+08h], ebx mov ecx, [eax+34h] sub ecx, [eax+0Ch] sub ecx, ebx mov [edi+0Ch], ecx add edi, 10h pop ecx push ecx push eax inc ecx mov eax, ecx xor edx, edx mov ecx, 00000028h mul ecx mov ecx, eax pop eax mov esi, eax add esi, 28h push edi mov edi, eax repe movsb pop edi dec dword [_004037BBh] mov ebp, 00000001h sub eax, 28h _0040215Eh: pop ecx add eax, 28h loopd _00402166h jmp _0040216Bh _00402166h: jmp _0040205Dh _0040216Bh: ret ;========================================================================== _00402222h: pop eax pop ebx push eax pushad xchg edi, ebx add edi, 000000B0h _0040222Eh: sub edi, 10h cmp dword [edi], 00h je _0040222Eh xchg esi, edi mov edi, _0040383Fh _0040223Dh: mov ecx, 00000004h repe movsd sub esi, 20h cmp esi, _00403CC9h jnb _0040223Dh mov esi, _0040383Fh mov edi, _00403CC9h mov ecx, 000000A0h repe movsb popad ret ;========================================================================== _00401CF4h: push esi cmp dword [eax+14h], 00h je _00401D21h cmp dword [eax+10h], 00h je _00401D21h cmp dword [eax+08h], 50h jna _00401D21h call _00401D24h jb _00401D21h mov esi, _00403930h _00401D13h: xchg ebx, eax lodsd xchg ebx, eax cmp ebx, [eax] je _00401D21h or ebx, ebx jne _00401D13h pop esi clc ret _00401D21h: pop esi stc ret ;========================================================================== _00401F9Eh: push edi mov ecx, 00000003h xor eax, eax repe stosd pop edi mov eax, edx mov esi, 0000000Ah xor ecx, ecx _00401FB2h: xor edx, edx div esi push edx inc ecx or eax, eax jne _00401FB2h _00401FBCh: pop edx add dl, 30h mov al, dl stosb loopd _00401FBCh ret ;========================================================================== _00401C55h: push ecx push esi push ecx push ecx push 08h push dword [_004037DFh] call [HeapAlloc] mov [_0040375Ah], eax push 000A0000h push 08h push dword [_004037DFh] call [HeapAlloc] mov [_004038A7h], eax pop ecx cmp ecx, 50h jna _00401CC1h mov [_00403786h], esi mov [_004038B3h], ecx push _0040201Ch push dword [_004038A7h] push ecx push dword [_0040375Ah] push esi call [_aP_pack] mov [_004037ABh], eax or eax, eax je _00401CC1h pop edi pop ecx mov esi, [_0040375Ah] repe movsb jmp _00401CC8h _00401CC1h: pop edi pop ecx mov [_004037ABh], eax _00401CC8h: push dword [_0040375Ah] push 00h push dword [_004037DFh] call [HeapFree] push dword [_004038A7h] push 00h push dword [_004037DFh] call [HeapFree] mov eax, [_004037ABh] ret ;========================================================================== _0040164Dh: push ebx mov ebx, [_0040388Fh] mov dword [ebx+_0040383Fh], 00000001h mov [ebx+_00403867h], eax pop ebx ret ;========================================================================== _00401DE2h: mov ecx, 00000200h xor edx, edx div ecx or edx, edx je _00401DF0h inc eax _00401DF0h: mul ecx ret ;========================================================================== _00401DE7h: xor edx, edx div ecx or edx, edx je _00401DF0h inc eax _00401DF0h: mul ecx ret ;========================================================================== _00402185h: push esi push edi push ecx push edx mov ecx, 0000028Ch push ecx push ecx push 08h push dword [_004037DFh] call [HeapAlloc] mov [_0040375Ah], eax push 000FA000h push 08h push dword [_004037DFh] call [HeapAlloc] mov [_004038A7h], eax pop ecx push ecx push 00h push dword [_004038A7h] push ecx push dword [_0040375Ah] push _00403ADDh call [_aP_pack] push eax mov ecx, eax mov esi, [_0040375Ah] mov edi, _00403ADDh repe movsb push dword [_004038A7h] push 00h push dword [_004037DFh] call [HeapFree] push dword [_0040375Ah] push 00h push dword [_004037DFh] call [HeapFree] pop ecx pop eax sub eax, ecx push eax mov edi, _00403ADDh add edi, ecx mov ecx, eax xor eax, eax repe stosb pop eax pop edx pop ecx pop edi pop esi ret ;========================================================================== _00401F54h: push ebx push ecx mov eax, 00000028h mul bl add eax, [_004038A3h] mov esi, eax mov eax, [esi+10h] mov ecx, eax add eax, [esi+14h] add eax, [_00403766h] mov edi, eax dec edi xor eax, eax std repe scasb cld add edi, 02h sub edi, [esi+14h] sub edi, [_00403766h] mov ecx, 00000200h xchg edi, eax call _00401DE7h cmp eax, [esi+10h] jnl _00401F9Bh mov [esi+10h], eax _00401F9Bh: pop ecx pop ebx ret ;========================================================================== _004015F3h: pop eax pop esi pop edi push eax mov edx, [esi+000000A0h] or edx, edx je _0040164Ch movzx ecx, word [esi+06h] _00401605h: cmp [edi+0Ch], edx je _00401611h add edi, 28h loopd _00401605h jmp _0040164Ch _00401611h: cmp ecx, 01h jne _00401625h dec word [esi+06h] pushad xor eax, eax mov ecx, 00000028h repe stosb popad _00401625h: mov dword [edi+10h], 00000000h mov dword [esi+000000A0h], 00000000h mov dword [esi+000000A4h], 00000000h mov ax, [esi+16h] or ax, 0001h mov [esi+16h], ax _0040164Ch: ret ;========================================================================== _00402291h: pop edx pop ebx push edx mov esi, _004038DCh _00402299h: lodsd or eax, eax je _004022A4h cmp eax, ebx jne _00402299h clc ret _004022A4h: stc ret ;========================================================================== _00401458h: and ebx, 7FFFFFFFh add ebx, [_004037B7h] mov esi, ebx cmp dword [_004037DBh], 01h je _0040147Eh mov edx, [_004037CBh] add dword [_004037CBh], 08h jmp _0040148Bh _0040147Eh: mov edx, [_004037D7h] add dword [_004037D7h], 08h _0040148Bh: mov [edx], esi mov ecx, [esi+04h] push ebx push ecx push edx push esi push edi push ebp push ecx push 08h push dword [_004037DFh] call [HeapAlloc] pop ebp pop edi pop esi pop edx pop ecx pop ebx mov [edx+04h], eax push eax mov ebx, [esi] call _00401FC6h add ebx, [_00403766h] pop edi mov ecx, [esi+04h] mov esi, ebx repe movsb sub ebx, [_004037B7h] ret ;========================================================================== _00401552h: pop eax pop esi push eax mov edx, FFFFFFFFh _0040155Ah: mov eax, [esi] or eax, eax je _00401571h mov ebx, [eax] or ebx, ebx je _0040156Ch cmp ebx, edx jnb _0040156Ch mov edx, ebx _0040156Ch: add esi, 08h jmp _0040155Ah _00401571h: xchg edx, eax ret ;========================================================================== _004015C4h: pop eax pop edi pop edx push eax _004015C8h: mov eax, [edx] or eax, eax je _004015F0h mov ebx, [eax] mov ebx, edi sub ebx, [_00403766h] push eax push edx call _00401FF1h pop edx pop eax mov [eax], ebx mov esi, [edx+04h] mov ecx, [eax+04h] repe movsb add edx, 08h jmp _004015C8h _004015F0h: mov eax, edi ret ;========================================================================== _00401589h: pop eax pop esi push eax xor edx, edx _0040158Eh: mov eax, [esi] or eax, eax je _004015A4h mov ebx, [eax] add ebx, [eax+04h] cmp ebx, edx jna _0040159Fh mov edx, ebx _0040159Fh: add esi, 08h jmp _0040158Eh _004015A4h: xchg edx, eax ret ;========================================================================== _0040216Ch: push eax push edi std mov ecx, 0FFFFFFFh xor eax, eax repe scasb add edi, 04h cld pop edx cmp edx, edi jnb _00402183h mov edi, edx _00402183h: pop eax ret ;========================================================================== _00401D24h: pushad mov edx, [_004038C4h] cmp [eax+0Ch], edx je _00401D51h mov edx, [_0040379Fh] or edx, edx je _00401D4Eh mov ebx, [eax+0Ch] cmp ebx, edx jg _00401D4Eh je _00401D51h mov ebx, [eax+34h] or ebx, ebx je _00401D21h cmp ebx, edx jg _00401D51h _00401D4Eh: popad clc ret _00401D51h: popad stc ret ;========================================================================== _00401FF1h: push esi push edi push edx push ecx push eax mov eax, [_0040378Eh] mov ecx, [_004037BBh] _00402001h: mov edx, [eax+14h] cmp edx, ebx ja _0040200Dh add eax, 28h loopd _00402001h _0040200Dh: sub eax, 28h sub ebx, [eax+14h] add ebx, [eax+0Ch] pop eax pop ecx pop edx pop edi pop esi ret ;========================================================================== _0040201Ch: mov eax, [esp+04h] xor edx, edx mov ecx, 00000064h mul ecx xor edx, edx mov ecx, [_004038B3h] or ecx, ecx je _0040204Ah div ecx push 00h push eax push 00000402h push dword [_004038B7h] call [SendMessageA] _0040204Ah: mov eax, 00000001h ret ;========================================================================== ; UNPACK LOADER _00403944h: pushfd pushad mov ebp, 00000000h add [ebp+_00403A54h], ebp push dword [ebp+_00403A50h] push 40h call dword [ebp+_00403A88h] push eax push eax sub eax, _0040397Dh mov [ebp+_0040397Eh], eax pop edi lea esi, [ebp+_0040397Dh] mov ecx, 000000FCh repe movsd pop edi jmp edi mov ebp, 00000000h mov esi, edi add esi, 00000160h add edi, 000003ECh push edi push esi push edi push ebp push edi push esi call _004039A9h add esp, 08h pop ebp xchg ecx, eax pop esi pop edi repe movsb jmp _00403ADDh ;========================================================================== _004039A9h: push ebp mov ebp, esp pushad push ebp mov esi, [ebp+08h] mov edi, [ebp+0Ch] cld mov dl, 80h _004039B7h: movsb _004039B8h: call _00403A2Ah jnb _004039B7h xor ecx, ecx call _00403A2Ah jnb _004039E1h xor eax, eax call _00403A2Ah jnb _004039F2h mov al, 10h _004039D3h: call _00403A2Ah adc al, al jnb _004039D3h jne _00403A1Fh stosb jmp _004039B8h _004039E1h: call _00403A36h dec ecx loopd _004039FEh mov eax, ebp call _00403A34h jmp _00403A20h _004039F2h: lodsb shr eax, 01h je _00403A46h adc ecx, 02h mov ebp, eax jmp _00403A20h _004039FEh: xchg ecx, eax dec eax shl eax, 08h lodsb mov ebp, eax call _00403A34h cmp eax, 00007D00h jnb _00403A1Eh cmp eax, 00000500h jnb _00403A1Fh cmp eax, 7Fh ja _00403A20h _00403A1Eh: inc ecx _00403A1Fh: inc ecx _00403A20h: push esi mov esi, edi sub esi, eax repe movsb pop esi jmp _004039B8h add dl, dl jne _00403A33h mov dl, [esi] inc esi adc dl, dl _00403A33h: ret xor ecx, ecx inc ecx _00403A37h: call _00403A2Ah adc ecx, ecx call _00403A2Ah jb _00403A37h ret _00403A46h: pop ebp sub edi, [ebp+0Ch] mov [ebp-04h], edi popad pop ebp ret ;========================================================================== _00403A2Ah: add dl, dl jne _00403A33h mov dl, [esi] inc esi adc dl, dl _00403A33h: ret ;========================================================================== _00403A34h: xor ecx, ecx ;========================================================================== _00403A36h: inc ecx _00403A37h: call _00403A2Ah adc ecx, ecx call _00403A2Ah jb _00403A37h ret ;========================================================================== _00403ADDh: pop edi lea esi, [ebp+_00403C71h] _00403AE4h: push ebp push edi push esi lodsd or eax, eax je _00403B27h xchg edx, eax lodsd xchg ecx, eax push edi push ecx mov esi, edx repe movsb pop ecx pop edi cmp edx, [ebp+_00403C6Dh] jne _00403B15h mov eax, [ebp+_00403C69h] pushad mov esi, edi mov edi, edx mov ecx, eax repe movsb popad add edi, eax add edx, eax sub ecx, eax _00403B15h: push edx push edi call _004039A9h add esp, 08h pop esi pop edi pop ebp add esi, 08h jmp _00403AE4h _00403B27h: add esp, 0Ch lea esi, [ebp+_00403CC9h] _00403B30h: lodsd or eax, eax je _00403B5Eh xchg ebx, eax lodsd xchg edx, eax lodsd xchg ecx, eax push edi push esi xchg esi, ebx push edi push ecx repe movsb pop ecx pop esi mov edi, edx repe movsb pop esi lodsd xchg ecx, eax xor eax, eax repe stosb mov edi, [esi-10h] mov ecx, [esi-0Ch] sub ecx, edi xor eax, eax repe stosb pop edi jmp _00403B30h _00403B5Eh: call _00403BA4h jnb _00403B9Bh lea ebx, [ebp+_00403C46h] push ebx call dword [ebp+_00403A80h] or eax, eax je _00403B93h lea ebx, [ebp+_00403C51h] push ebx push eax call dword [ebp+_00403A84h] lea ebx, [ebp+_00403C30h] push 30h push 00h push ebx push 00h call eax _00403B93h: push 00h call dword [ebp+_00403A8Ch] _00403B9Bh: popad popfd mov edx, 00000000h jmp edx ;========================================================================== _00403BA4h: mov esi, [ebp+_00403C61h] or esi, esi je _00403BC8h mov edx, [ebp+_00403C65h] add esi, edx _00403BB6h: push edx push esi call _00403BCCh jb _00403BCAh add esi, 14h cmp dword [esi+0Ch], 00h jne _00403BB6h _00403BC8h: clc ret _00403BCAh: stc ret ;========================================================================== _00403A34h: xor ecx, ecx inc ecx _00403A37h: call _00403A2Ah adc ecx, ecx call _00403A2Ah jb _00403A37h ret ;========================================================================== _00403BCCh: pop eax pop esi pop edx push eax mov ecx, [esi] mov edi, [esi+10h] or ecx, ecx jne _00403BDBh mov ecx, edi _00403BDBh: add ecx, edx add edi, edx mov eax, [esi+0Ch] add eax, edx push ecx push edx push eax call dword [ebp+_00403A80h] pop edx pop ecx or eax, eax je _00403C2Eh mov [ebp+_00403C5Dh], eax _00403BF9h: mov ebx, [ecx] or ebx, ebx je _00403C2Ch test ebx, 80000000h jne _00403C0Bh add ebx, edx inc ebx inc ebx _00403C0Bh: and ebx, 7FFFFFFFh push ecx push edx push ebx push dword [ebp+_00403C5Dh] call dword [ebp+_00403A84h] pop edx pop ecx or eax, eax je _00403C2Eh stosd add ecx, 04h jmp _00403BF9h _00403C2Ch: clc ret _00403C2Eh: stc ret ;************************************************************************** _00403000h _00403100h _00403137h _00403170h _004031A3h _00403363h _0040342Fh _00403473h _00403482h _0040348Fh _0040349Eh _004034C5h _00403604h _00403605h _0040360Dh _0040370Dh _0040373Ah _00403742h _0040374Ah _00403752h _00403756h _0040375Ah _0040375Eh _00403762h _00403766h _0040376Ah _0040376Eh _00403772h _0040377Ah _0040377Eh _00403782h _00403786h _0040378Eh _00403792h _00403796h _0040379Ah _0040379Eh _0040379Fh _004037A3h _004037A7h _004037ABh _004037AFh _004037B3h _004037B7h _004037BBh _004037BFh _004037C3h _004037CBh _004037CFh _004037D3h _004037D7h _004037DBh _004037DFh _004037E3h _004037E7h _004037EFh _0040383Fh _00403867h _0040388Fh _00403893h _00403897h _0040389Bh _0040389Fh _004038A3h _004038A7h _004038ABh _004038AFh _004038B3h _004038B7h _004038BBh _004038C0h _004038C4h _004038C0h _004038C8h _004038D4h _004038D8h _004038DCh _00403930h _00403944h _00403947h _00403A50h _00403A58h _00403A64h _00403A68h _00403A80h _00403A84h _00403A88h _00403A8Ch _00403ADDh _00403B9Eh _00403C30h _00403C46h _00403C51h _00403C5Dh _00403C61h _00403C65h _00403C69h _00403C6Dh _00403C6Dh _00403C71h _00403CC1h _00403CC9h 本代码的着色效果由xTiNt自动完成 下载xTiNt http://211.90.75.84/web/kanaun/download/xTiNt.rar |
|
后面的DD好象没有什么用,你把它全填为零看看
|
|
谢谢,学习一下:D
|
看原图
赞赏
雪币:
留言: