程序我脱壳了，就分析到这了，不知再怎么走。
0044AF1E FF db FF
0044AF1F FF db FF
0044AF20 . 8D45 F8 lea eax, dword ptr [ebp-8] ；我bp在这啦，不知道在真么走啦？
0044AF23 . 8B55 F4 mov edx, dword ptr [ebp-C]
0044AF26 . 8A12 mov dl, byte ptr [edx]
0044AF28 . E8 978CFBFF call 00403BC4
0044AF2D . 8D45 F0 lea eax, dword ptr [ebp-10]
0044AF30 . B9 98B04400 mov ecx, 0044B098 ; ASCII ":\t r2\_system1.dat"
0044AF35 . 8B55 F8 mov edx, dword ptr [ebp-8]
0044AF38 . E8 AB8DFBFF call 00403CE8
0044AF3D . 8B4D F0 mov ecx, dword ptr [ebp-10]
0044AF40 . B2 01 mov dl, 1
0044AF42 . A1 EC944400 mov eax, dword ptr [4494EC]
0044AF47 . E8 48E6FFFF call 00449594
0044AF4C . 8BF0 mov esi, eax
0044AF4E . 8B83 D8020000 mov eax, dword ptr [ebx+2D8]
0044AF54 . 8B10 mov edx, dword ptr [eax]
0044AF56 . FF92 CC000000 call dword ptr [edx+CC]
0044AF5C . 8B83 D8020000 mov eax, dword ptr [ebx+2D8]
0044AF62 . 8B88 08020000 mov ecx, dword ptr [eax+208]
0044AF68 . BA B4B04400 mov edx, 0044B0B4 ; ASCII "Speed"
0044AF6D . 8BC6 mov eax, esi
0044AF6F . 8B38 mov edi, dword ptr [eax]
0044AF71 . FF57 40 call dword ptr [edi+40]
0044AF74 . 8D4D EC lea ecx, dword ptr [ebp-14]
0044AF77 . 8B83 D8020000 mov eax, dword ptr [ebx+2D8]
0044AF7D . 8B80 08020000 mov eax, dword ptr [eax+208]
0044AF83 . BA C4B04400 mov edx, 0044B0C4 ; ASCII "NetSpeedID"
0044AF88 . E8 FF4EFCFF call 0040FE8C
0044AF8D . 8D4D E8 lea ecx, dword ptr [ebp-18]
0044AF90 . 8B83 D8020000 mov eax, dword ptr [ebx+2D8]
0044AF96 . 8B80 08020000 mov eax, dword ptr [eax+208]
0044AF9C . BA D8B04400 mov edx, 0044B0D8 ; ASCII "NetID"
0044AFA1 . E8 E64EFCFF call 0040FE8C
0044AFA6 . 8D55 FC lea edx, dword ptr [ebp-4]
0044AFA9 . 8B83 F4020000 mov eax, dword ptr [ebx+2F4]
0044AFAF . E8 2CC1FDFF call 004270E0
0044AFB4 . 8B45 FC mov eax, dword ptr [ebp-4]
0044AFB7 . 8B55 E8 mov edx, dword ptr [ebp-18]
0044AFBA . E8 ED8DFBFF call 00403DAC
0044AFBF . 75 34 jnz short 0044AFF5 ; ？？
0044AFC1 . 8D45 E4 lea eax, dword ptr [ebp-1C]
0044AFC4 . B9 E8B04400 mov ecx, 0044B0E8 ; ASCII ":\browse\setup.exe"
0044AFC9 . 8B55 F8 mov edx, dword ptr [ebp-8]
0044AFCC . E8 178DFBFF call 00403CE8
0044AFD1 . 8D45 E0 lea eax, dword ptr [ebp-20]
0044AFD4 . B9 04B14400 mov ecx, 0044B104 ; ASCII ":\browse"
0044AFD9 . 8B55 F8 mov edx, dword ptr [ebp-8]
0044AFDC . E8 078DFBFF call 00403CE8
0044AFE1 . 6A 05 push 5
0044AFE3 . 8B4D E0 mov ecx, dword ptr [ebp-20]
0044AFE6 . 33D2 xor edx, edx
0044AFE8 . 8B45 E4 mov eax, dword ptr [ebp-1C]
0044AFEB . E8 80020000 call 0044B270
0044AFF0 . E8 EF88FBFF call 004038E4
0044AFF5 > 8D4D DC lea ecx, dword ptr [ebp-24]
0044AFF8 . BA 01000000 mov edx, 1
0044AFFD . 8B45 EC mov eax, dword ptr [ebp-14]
0044B000 . E8 5B010000 call 0044B160
0044B005 . 8B45 DC mov eax, dword ptr [ebp-24]
0044B008 . 8B55 FC mov edx, dword ptr [ebp-4]
0044B00B . E8 9C8DFBFF call 00403DAC
0044B010 . 74 18 je short 0044B02A
0044B012 . B8 18B14400 mov eax, 0044B118
0044B017 . E8 64D5FFFF call 00448580 ; 必须进
0044B01C . 8BC6 mov eax, esi
0044B01E . E8 717DFBFF call 00402D94
0044B023 . E8 BC88FBFF call 004038E4
0044B028 . EB 3C jmp short 0044B066
0044B02A > 8B45 EC mov eax, dword ptr [ebp-14]
0044B02D . E8 A6020000 call 0044B2D8
0044B032 . 8D45 E4 lea eax, dword ptr [ebp-1C]
0044B035 . B9 3CB14400 mov ecx, 0044B13C ; ASCII ":\t r2\filelist.exe"
0044B03A . 8B55 F8 mov edx, dword ptr [ebp-8]
0044B03D . E8 A68CFBFF call 00403CE8
0044B042 . 8D45 E0 lea eax, dword ptr [ebp-20]
0044B045 . B9 58B14400 mov ecx, 0044B158 ; ASCII ":\t r2"
0044B04A . 8B55 F8 mov edx, dword ptr [ebp-8]
0044B04D . E8 968CFBFF call 00403CE8
0044B052 . 6A 05 push 5
0044B054 . 8B4D E0 mov ecx, dword ptr [ebp-20]
0044B057 . 33D2 xor edx, edx
0044B059 . 8B45 E4 mov eax, dword ptr [ebp-1C]
0044B05C . E8 0F020000 call 0044B270
0044B061 . E8 7E88FBFF call 004038E4
0044B066 > 33C0 xor eax, eax
0044B068 . 5A pop edx
0044B069 . 59 pop ecx
0044B06A . 59 pop ecx
0044B06B . 64:8910 mov dword ptr fs:[eax], edx
0044B06E . 68 88B04400 push 0044B088
0044B073 > 8D45 DC lea eax, dword ptr [ebp-24]
0044B076 . BA 09000000 mov edx, 9
0044B07B . E8 C089FBFF call 00403A40
0044B080 . C3 retn
0044B081 .^ E9 2E84FBFF jmp 004034B4
0044B086 .^ EB EB jmp short 0044B073
0044B088 . 5F pop edi
0044B089 . 5E pop esi
0044B08A . 5B pop ebx
0044B08B . 8BE5 mov esp, ebp
0044B08D . 5D pop ebp
0044B08E . C3 retn
[课程]Linux pwn 探索篇！
