菜鸟飘过 随便看下 大牛见笑了
1.
查找ASCII
楼主看到关键地方么
00402FB0 . 56 PUSH ESI
00402FB1 . 8BF1 MOV ESI,ECX
00402FB3 . 57 PUSH EDI
00402FB4 . 8B3D B8934100 MOV EDI,DWORD PTR DS:[<&USER32.UnregisterHotKey>] ; USER32.UnregisterHotKey
00402FBA . 8B46 1C MOV EAX,DWORD PTR DS:[ESI+1C]
00402FBD . 68 C0070000 PUSH 7C0 ; /HotKeyID = 7C0
00402FC2 . 50 PUSH EAX ; |hWnd
00402FC3 . FFD7 CALL EDI ; \UnregisterHotKey
00402FC5 . 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+1C]
00402FC8 . 68 C1070000 PUSH 7C1 ; /HotKeyID = 7C1
00402FCD . 51 PUSH ECX ; |hWnd
00402FCE . FFD7 CALL EDI ; \UnregisterHotKey
00402FD0 . 8B56 1C MOV EDX,DWORD PTR DS:[ESI+1C]
00402FD3 . 68 C2070000 PUSH 7C2 ; /HotKeyID = 7C2
00402FD8 . 52 PUSH EDX ; |hWnd
00402FD9 . FFD7 CALL EDI ; \UnregisterHotKey
00402FDB . 8B46 1C MOV EAX,DWORD PTR DS:[ESI+1C]
00402FDE . 68 C3070000 PUSH 7C3 ; /HotKeyID = 7C3
00402FE3 . 50 PUSH EAX ; |hWnd
00402FE4 . FFD7 CALL EDI ; \UnregisterHotKey
00402FE6 . 6A 05 PUSH 5 ; /IsShown = 5
00402FE8 . 6A 00 PUSH 0 ; |DefDir = NULL
00402FEA . 68 3CE24100 PUSH llk_exe.0041E23C ; |Parameters = ""
00402FEF . 68 2CE24100 PUSH llk_exe.0041E22C ; |IEXPLORE.EXE
00402FF4 . 68 24E24100 PUSH llk_exe.0041E224 ; |open
00402FF9 6A 00 PUSH 0
00402FFB FF15 24924100 CALL DWORD PTR DS:[<&SHELL32.ShellExecuteA>] ; //调用这个CALL弹出网页 ShellExecuteA
00403001 . 8BCE MOV ECX,ESI
00403003 . E8 68EE0000 CALL llk_exe.00411E70
00403008 . 5F POP EDI
00403009 . 5E POP ESI
0040300A . C3 RETN
2. bp ShellExecuteA 同样可以断下了
方法告诉了你 自己改吧