这是一个ASPRO压的记事本，发现调用API地址是动态分配的
下面的CALL DWORD PTR DS:[979E18]和CALL DWORD PTR DS:[979EC0]
两个调用但是经过跟踪发现都是JNZ USER32.77D4536E，调用同一个地址，找API调用也就不好找了，请大狭帮帮分析一下
004010DD 3C 22 CMP AL,22
004010DF 75 1B JNZ SHORT Notepad.004010FC
004010E1 56 PUSH ESI
004010E2 FF15 189E9700 CALL DWORD PTR DS:[979E18]-----到这进入（见绿色）
------------------------------------------------------------------------
00979E24 A1 60D0D677 MOV EAX,DWORD PTR DS:[77D6D060]
00979E29 F640 02 04 TEST BYTE PTR DS:[EAX+2],4
00979E2D 56 PUSH ESI
00979E2E 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8]
00979E32 - 0F85 36B53C77 JNZ USER32.77D4536E------------调用USER32
00979E38 803E 00 CMP BYTE PTR DS:[ESI],0
00979E3B - 0F84 C5D43977 JE USER32.77D17306
00979E41 46 INC ESI
00979E42 8BC6 MOV EAX,ESI
00979E44 5E POP ESI
00979E45 C2 0400 RETN 4
-------------------------------------------------------------------------
004010E8 8BF0 MOV ESI,EAX
004010EA 8A00 MOV AL,BYTE PTR DS:[EAX]
004010EC 84C0 TEST AL,AL
004010EE 74 04 JE SHORT Notepad.004010F4
004010F0 3C 22 CMP AL,22
004010F2 ^ 75 ED JNZ SHORT Notepad.004010E1
004010F4 803E 22 CMP BYTE PTR DS:[ESI],22
004010F7 75 15 JNZ SHORT Notepad.0040110E
004010F9 46 INC ESI
004010FA EB 12 JMP SHORT Notepad.0040110E
004010FC 3C 20 CMP AL,20
004010FE 7E 0E JLE SHORT Notepad.0040110E
00401100 56 PUSH ESI
00401101 FF15 C09E9700 CALL DWORD PTR DS:[979EC0]-----到这进入（见绿色）
-----------------------------------------------------------------------
00979ECC A1 60D0D677 MOV EAX,DWORD PTR DS:[77D6D060]
00979ED1 F640 02 04 TEST BYTE PTR DS:[EAX+2],4
00979ED5 56 PUSH ESI
00979ED6 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8]
00979EDA 3E:EB 02 JMP SHORT 00979EDF ; 多余的前缀
00979EDD CD 20 INT 20
00979EDF - 0F85 89B43C77 JNZ USER32.77D4536E------------调用USER32
00979EE5 803E 00 CMP BYTE PTR DS:[ESI],0
00979EE8 64:EB 02 JMP SHORT 00979EED ; 多余的前缀
00979EEB CD 20 INT 20
00979EED - 0F84 13D43977 JE USER32.77D17306
00979EF3 46 INC ESI
00979EF4 8BC6 MOV EAX,ESI
00979EF6 5E POP ESI
00979EF7 C2 0400 RETN 4
------------------------------------------------------------------------
00401107 8038 20 CMP BYTE PTR DS:[EAX],20
0040110A 8BF0 MOV ESI,EAX
0040110C ^ 7F F2 JG SHORT Notepad.00401100
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
