- 听众
- 收听
- 积分
- 2999
- 主题
- 回帖
- 0
- 精华
注册时间2006-7-29
最后登录1970-1-1
该用户从未签到
|
楼主 |
发表于 2008-6-15 12:48:10
|
显示全部楼层
----------------------------------------------------------------------------------------------------
第二层:未知壳
00401748 68 A0000000 PUSH 0A0 ; 第二层未知壳入口处.[F8]向下一直走.
0040174D FF15 AA914100 CALL DWORD PTR DS:[4191AA] ; GDI32.GetTextCharset
00401753 2315 10FE4000 AND EDX,DWORD PTR DS:[40FE10]
00401759 B8 D5D4C5E4 MOV EAX,E4C5D4D5
0040175E BA 8AF84694 MOV EDX,9446F88A
00401763 68 00000000 PUSH 0
00401768 FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
0040176E 330D F0FF4000 XOR ECX,DWORD PTR DS:[40FFF0]
00401774 2915 B0F84000 SUB DWORD PTR DS:[40F8B0],EDX
0040177A B9 FE6FDB94 MOV ECX,94DB6FFE
0040177F 60 PUSHAD
00401780 68 78000000 PUSH 78
00401785 FF15 AA914100 CALL DWORD PTR DS:[4191AA] ; GDI32.GetTextCharset
0040178B B8 99B0188D MOV EAX,8D18B099
00401790 23CA AND ECX,EDX
00401792 C1D2 13 RCL EDX,13
00401795 68 5A000000 PUSH 5A
0040179A FF15 CE914100 CALL DWORD PTR DS:[4191CE] ; GDI32.GetTextColor
004017A0 B8 F52BFF3B MOV EAX,3BFF2BF5
004017A5 0BC1 OR EAX,ECX
004017A7 E9 0C000000 JMP misfotos.004017B8
004017AC 81DA 41B3616E SBB EDX,6E61B341
004017B2 81E1 02074014 AND ECX,14400702
004017B8 68 F0000000 PUSH 0F0
004017BD FF15 AA914100 CALL DWORD PTR DS:[4191AA] ; GDI32.GetTextCharset
004017C3 C1C2 14 ROL EDX,14
004017C6 2BC1 SUB EAX,ECX
004017C8 1315 80FC4000 ADC EDX,DWORD PTR DS:[40FC80]
004017CE 6A 40 PUSH 40
004017D0 68 78000000 PUSH 78
004017D5 FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
004017DB 13C8 ADC ECX,EAX
004017DD B8 8EC095D3 MOV EAX,D395C08E
004017E2 E9 0A000000 JMP misfotos.004017F1
004017E7 2BC1 SUB EAX,ECX
004017E9 C1D9 13 RCR ECX,13
004017EC BA DA3D088C MOV EDX,8C083DDA
004017F1 68 5A000000 PUSH 5A
004017F6 FF15 AA914100 CALL DWORD PTR DS:[4191AA] ; GDI32.GetTextCharset
004017FC C1D0 17 RCL EAX,17
004017FF 1BD1 SBB EDX,ECX
00401801 E9 0B000000 JMP misfotos.00401811
00401806 B9 D9B0C767 MOV ECX,67C7B0D9
0040180B 0115 D0FF4000 ADD DWORD PTR DS:[40FFD0],EDX
00401811 68 00100000 PUSH 1000
00401816 68 82000000 PUSH 82
0040181B FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401821 23C1 AND EAX,ECX
00401823 81CA 3592BBAE OR EDX,AEBB9235
00401829 1905 10F94000 SBB DWORD PTR DS:[40F910],EAX
0040182F 68 46000000 PUSH 46
00401834 FF15 CE914100 CALL DWORD PTR DS:[4191CE] ; GDI32.GetTextColor
0040183A C1F1 1C SAL ECX,1C
0040183D B8 56BE5D76 MOV EAX,765DBE56
00401842 E9 0C000000 JMP misfotos.00401853
00401847 81D1 C57C94A5 ADC ECX,A5947CC5
0040184D 40 INC EAX
0040184E BA F96C60E2 MOV EDX,E2606CF9
00401853 68 6E000000 PUSH 6E
00401858 FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
0040185E 03C8 ADD ECX,EAX
00401860 81C2 41CE4169 ADD EDX,6941CE41
00401866 3BC8 CMP ECX,EAX
00401868 79 0F JNS SHORT misfotos.00401879
0040186A 330D A0FF4000 XOR ECX,DWORD PTR DS:[40FFA0]
00401870 C1D8 02 RCR EAX,2
00401873 210D B0FA4000 AND DWORD PTR DS:[40FAB0],ECX
00401879 C1D8 07 RCR EAX,7
0040187C 81CA B22C5ABB OR EDX,BB5A2CB2
00401882 1BD1 SBB EDX,ECX
00401884 68 14000000 PUSH 14
00401889 FF15 CE914100 CALL DWORD PTR DS:[4191CE] ; GDI32.GetTextColor
0040188F 310D F0F84000 XOR DWORD PTR DS:[40F8F0],ECX
00401895 81C2 610C3949 ADD EDX,49390C61
0040189B 1B05 A0FE4000 SBB EAX,DWORD PTR DS:[40FEA0]
004018A1 3BC8 CMP ECX,EAX
004018A3 76 0C JBE SHORT misfotos.004018B1
004018A5 81E1 29B246CB AND ECX,CB46B229
004018AB 81DA C19BC3A4 SBB EDX,A4C39BC1
004018B1 C1C0 06 ROL EAX,6
004018B4 0315 A0F84000 ADD EDX,DWORD PTR DS:[40F8A0]
004018BA 2105 50F94000 AND DWORD PTR DS:[40F950],EAX
004018C0 68 E8240000 PUSH 24E8
004018C5 68 14000000 PUSH 14
004018CA FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
004018D0 3115 20FD4000 XOR DWORD PTR DS:[40FD20],EDX
004018D6 81D1 FE912D27 ADC ECX,272D91FE
004018DC 68 78000000 PUSH 78
004018E1 FF15 CE914100 CALL DWORD PTR DS:[4191CE] ; GDI32.GetTextColor
004018E7 2B05 20F84000 SUB EAX,DWORD PTR DS:[40F820]
004018ED 0BC2 OR EAX,EDX
004018EF BA E1B9BFBE MOV EDX,BEBFB9E1
004018F4 81FA F5118A80 CMP EDX,808A11F5
004018FA 75 11 JNZ SHORT misfotos.0040190D
004018FC B8 3EC66BBE MOV EAX,BE6BC63E
00401901 81C9 41E9FB10 OR ECX,10FBE941
00401907 2905 B0F84000 SUB DWORD PTR DS:[40F8B0],EAX
0040190D B9 09053E33 MOV ECX,333E0509
00401912 BA A1807B32 MOV EDX,327B80A1
00401917 1B05 70FD4000 SBB EAX,DWORD PTR DS:[40FD70]
0040191D 68 28000000 PUSH 28
00401922 FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401928 C1C9 1E ROR ECX,1E
0040192B 0105 D0FA4000 ADD DWORD PTR DS:[40FAD0],EAX
00401931 E9 0D000000 JMP misfotos.00401943
00401936 B9 B16624FB MOV ECX,FB2466B1
0040193B 1915 00FD4000 SBB DWORD PTR DS:[40FD00],EDX
00401941 13D1 ADC EDX,ECX
00401943 6A 00 PUSH 0
00401945 68 F0000000 PUSH 0F0
0040194A FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
00401950 1105 90FF4000 ADC DWORD PTR DS:[40FF90],EAX
00401956 BA FAFEEA35 MOV EDX,35EAFEFA
0040195B 3BC1 CMP EAX,ECX
0040195D 79 09 JNS SHORT misfotos.00401968
0040195F 42 INC EDX
00401960 2B05 20FF4000 SUB EAX,DWORD PTR DS:[40FF20]
00401966 2BCA SUB ECX,EDX
00401968 3305 50FC4000 XOR EAX,DWORD PTR DS:[40FC50]
0040196E B9 FEA2EB76 MOV ECX,76EBA2FE
00401973 68 64000000 PUSH 64
00401978 FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
0040197E 13C8 ADC ECX,EAX
00401980 33CA XOR ECX,EDX
00401982 81C1 9D3A4307 ADD ECX,7433A9D
00401988 E9 0C000000 JMP misfotos.00401999
0040198D 81C2 EA541683 ADD EDX,831654EA
00401993 81D1 72147E2A ADC ECX,2A7E1472
00401999 68 3C000000 PUSH 3C
0040199E FF15 AA914100 CALL DWORD PTR DS:[4191AA] ; GDI32.GetTextCharset
004019A4 3315 E0FA4000 XOR EDX,DWORD PTR DS:[40FAE0]
004019AA 81C1 2DF6770C ADD ECX,0C77F62D
004019B0 81E9 A1DB420D SUB ECX,0D42DBA1
004019B6 3B05 64FD4000 CMP EAX,DWORD PTR DS:[40FD64]
004019BC 7E 04 JLE SHORT misfotos.004019C2
004019BE C1F2 09 SAL EDX,9
004019C1 41 INC ECX
004019C2 1105 C0FD4000 ADC DWORD PTR DS:[40FDC0],EAX
004019C8 2315 B0FD4000 AND EDX,DWORD PTR DS:[40FDB0]
004019CE FF15 4E924100 CALL DWORD PTR DS:[41924E] ; kernel32.VirtualAlloc
004019D4 8BF0 MOV ESI,EAX
004019D6 68 46000000 PUSH 46
004019DB FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
004019E1 81D1 E665EAFA ADC ECX,FAEA65E6
004019E7 3105 40FA4000 XOR DWORD PTR DS:[40FA40],EAX
004019ED 3BCA CMP ECX,EDX
004019EF 79 08 JNS SHORT misfotos.004019F9
004019F1 0BD1 OR EDX,ECX
004019F3 B9 D5A0E402 MOV ECX,2E4A0D5
004019F8 40 INC EAX
004019F9 0915 F0FE4000 OR DWORD PTR DS:[40FEF0],EDX
004019FF 0BD0 OR EDX,EAX
00401A01 68 32000000 PUSH 32
00401A06 FF15 AA914100 CALL DWORD PTR DS:[4191AA] ; GDI32.GetTextCharset
00401A0C 0BC8 OR ECX,EAX
00401A0E 0BC8 OR ECX,EAX
00401A10 3B15 40FE4000 CMP EDX,DWORD PTR DS:[40FE40]
00401A16 71 0E JNO SHORT misfotos.00401A26
00401A18 1905 30F94000 SBB DWORD PTR DS:[40F930],EAX
00401A1E BA 9DDD9596 MOV EDX,9695DD9D
00401A23 C1E9 1E SHR ECX,1E
00401A26 B8 3EE8BC94 MOV EAX,94BCE83E
00401A2B 81C1 861A3829 ADD ECX,29381A86
00401A31 81E9 F15DE68A SUB ECX,8AE65DF1
00401A37 56 PUSH ESI
00401A38 68 00000000 PUSH 0
00401A3D FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401A43 0115 90FA4000 ADD DWORD PTR DS:[40FA90],EDX
00401A49 81E1 B524DB34 AND ECX,34DB24B5
00401A4F BA 2A9C114C MOV EDX,4C119C2A
00401A54 3B05 EAFE4000 CMP EAX,DWORD PTR DS:[40FEEA]
00401A5A 79 0F JNS SHORT misfotos.00401A6B
00401A5C C1D1 1C RCL ECX,1C
00401A5F 81C9 B1DCFAD0 OR ECX,D0FADCB1
00401A65 81D2 D2D09685 ADC EDX,8596D0D2
00401A6B C1E8 16 SHR EAX,16
00401A6E 1BCA SBB ECX,EDX
00401A70 68 00000000 PUSH 0
00401A75 68 FA000000 PUSH 0FA
00401A7A FF15 A2914100 CALL DWORD PTR DS:[4191A2] ; GDI32.GetMetaRgn
00401A80 81CA 16FA2657 OR EDX,5726FA16
00401A86 0905 E0FF4000 OR DWORD PTR DS:[40FFE0],EAX
00401A8C 3B15 EAFE4000 CMP EDX,DWORD PTR DS:[40FEEA]
00401A92 76 0B JBE SHORT misfotos.00401A9F
00401A94 B9 395EFC83 MOV ECX,83FC5E39
00401A99 0B15 D0F94000 OR EDX,DWORD PTR DS:[40F9D0]
00401A9F 81C1 65825161 ADD ECX,61518265
00401AA5 C1E0 07 SHL EAX,7
00401AA8 C1EA 0B SHR EDX,0B
00401AAB 68 64000000 PUSH 64
00401AB0 FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401AB6 B8 F918B92E MOV EAX,2EB918F9
00401ABB 1BC2 SBB EAX,EDX
00401ABD E9 0B000000 JMP misfotos.00401ACD
00401AC2 B9 869B3EB7 MOV ECX,B73E9B86
00401AC7 1B05 F0FE4000 SBB EAX,DWORD PTR DS:[40FEF0]
00401ACD BB 60124000 MOV EBX,misfotos.00401260
00401AD2 68 96000000 PUSH 96
00401AD7 FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
00401ADD C1EA 05 SHR EDX,5
00401AE0 290D C0FD4000 SUB DWORD PTR DS:[40FDC0],ECX
00401AE6 3BD1 CMP EDX,ECX
00401AE8 7E 08 JLE SHORT misfotos.00401AF2
00401AEA BA C66B979C MOV EDX,9C976BC6
00401AEF C1C1 11 ROL ECX,11
00401AF2 03CA ADD ECX,EDX
00401AF4 3315 10FB4000 XOR EDX,DWORD PTR DS:[40FB10]
00401AFA 2BD1 SUB EDX,ECX
00401AFC 68 6E000000 PUSH 6E
00401B01 FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401B07 0305 20FE4000 ADD EAX,DWORD PTR DS:[40FE20]
00401B0D B9 A5000ABB MOV ECX,BB0A00A5
00401B12 03C2 ADD EAX,EDX
00401B14 68 14000000 PUSH 14
00401B19 FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
00401B1F 3315 90FC4000 XOR EDX,DWORD PTR DS:[40FC90]
00401B25 23D1 AND EDX,ECX
00401B27 68 A0000000 PUSH 0A0
00401B2C FF15 CE914100 CALL DWORD PTR DS:[4191CE] ; GDI32.GetTextColor
00401B32 B9 AAD1A3A8 MOV ECX,A8A3D1AA
00401B37 40 INC EAX
00401B38 81FA 3A9082CD CMP EDX,CD82903A
00401B3E 7A 07 JPE SHORT misfotos.00401B47
00401B40 0BD1 OR EDX,ECX
00401B42 B8 524E36FD MOV EAX,FD364E52
00401B47 B9 5A47DD0D MOV ECX,0DDD475A
00401B4C C1D2 10 RCL EDX,10
00401B4F FF33 PUSH DWORD PTR DS:[EBX]
00401B51 68 3C000000 PUSH 3C
00401B56 FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401B5C 2B0D D0FF4000 SUB ECX,DWORD PTR DS:[40FFD0]
00401B62 81CA 02BDDE9F OR EDX,9FDEBD02
00401B68 81F9 2D7FA92C CMP ECX,2CA97F2D
00401B6E 7D 0A JGE SHORT misfotos.00401B7A
00401B70 C1C2 1D ROL EDX,1D
00401B73 23D0 AND EDX,EAX
00401B75 B8 B6B34935 MOV EAX,3549B3B6
00401B7A 03D1 ADD EDX,ECX
00401B7C B9 C66C3771 MOV ECX,71376CC6
00401B81 68 B4000000 PUSH 0B4
00401B86 FF15 CE914100 CALL DWORD PTR DS:[4191CE] ; GDI32.GetTextColor
00401B8C 81C9 4AE9DD0F OR ECX,0FDDE94A
00401B92 23C2 AND EAX,EDX
00401B94 C1E2 18 SHL EDX,18
00401B97 8F06 POP DWORD PTR DS:[ESI]
00401B99 68 F0000000 PUSH 0F0
00401B9E FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
00401BA4 81D2 A513B20F ADC EDX,0FB213A5
00401BAA 81EA D9325608 SUB EDX,85632D9
00401BB0 3B0D 58FA4000 CMP ECX,DWORD PTR DS:[40FA58]
00401BB6 71 0E JNO SHORT misfotos.00401BC6
00401BB8 1105 00FC4000 ADC DWORD PTR DS:[40FC00],EAX
00401BBE 2B0D E0F84000 SUB ECX,DWORD PTR DS:[40F8E0]
00401BC4 13C2 ADC EAX,EDX
00401BC6 2B15 C0FE4000 SUB EDX,DWORD PTR DS:[40FEC0]
00401BCC B9 46AD58D4 MOV ECX,D458AD46
00401BD1 68 3C000000 PUSH 3C
00401BD6 FF15 AA914100 CALL DWORD PTR DS:[4191AA] ; GDI32.GetTextCharset
00401BDC 81D2 560493C0 ADC EDX,C0930456
00401BE2 2B05 50FC4000 SUB EAX,DWORD PTR DS:[40FC50]
00401BE8 B9 66C9A1A9 MOV ECX,A9A1C966
00401BED 8136 838221BB XOR DWORD PTR DS:[ESI],BB218283
00401BF3 68 F0000000 PUSH 0F0
00401BF8 FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401BFE C1C0 0A ROL EAX,0A
00401C01 1915 00FC4000 SBB DWORD PTR DS:[40FC00],EDX
00401C07 1BC8 SBB ECX,EAX
00401C09 81FA F18ED7B1 CMP EDX,B1D78EF1
00401C0F 71 0D JNO SHORT misfotos.00401C1E
00401C11 13D0 ADC EDX,EAX
00401C13 B8 9AB6D2C1 MOV EAX,C1D2B69A
00401C18 81D9 22BB5FB5 SBB ECX,B55FBB22
00401C1E C1C8 11 ROR EAX,11
00401C21 03D1 ADD EDX,ECX
00401C23 68 8C000000 PUSH 8C
00401C28 FF15 AA914100 CALL DWORD PTR DS:[4191AA] ; GDI32.GetTextCharset
00401C2E 0B05 00FE4000 OR EAX,DWORD PTR DS:[40FE00]
00401C34 81D9 C9CE2159 SBB ECX,5921CEC9
00401C3A 68 5A000000 PUSH 5A
00401C3F FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401C45 2BC2 SUB EAX,EDX
00401C47 1B0D 60FB4000 SBB ECX,DWORD PTR DS:[40FB60]
00401C4D E9 0F000000 JMP misfotos.00401C61
00401C52 1B05 30FB4000 SBB EAX,DWORD PTR DS:[40FB30]
00401C58 C1C2 04 ROL EDX,4
00401C5B 81C1 1206B1A2 ADD ECX,A2B10612
00401C61 8106 410E9B09 ADD DWORD PTR DS:[ESI],99B0E41
00401C67 68 14000000 PUSH 14
00401C6C 68 E6000000 PUSH 0E6
00401C71 FF15 A2914100 CALL DWORD PTR DS:[4191A2] ; GDI32.GetMetaRgn
00401C77 81DA D197286B SBB EDX,6B2897D1
00401C7D 81C1 E9767E1F ADD ECX,1F7E76E9
00401C83 E9 0B000000 JMP misfotos.00401C93
00401C88 B8 3A429A7D MOV EAX,7D9A423A
00401C8D 1315 20FD4000 ADC EDX,DWORD PTR DS:[40FD20]
00401C93 68 C8000000 PUSH 0C8
00401C98 FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
00401C9E C1D8 05 RCR EAX,5
00401CA1 BA 5A7944FA MOV EDX,FA44795A
00401CA6 3B0D 26FF4000 CMP ECX,DWORD PTR DS:[40FF26]
00401CAC 72 09 JB SHORT misfotos.00401CB7
00401CAE C1DA 02 RCR EDX,2
00401CB1 210D 70FA4000 AND DWORD PTR DS:[40FA70],ECX
00401CB7 1BD0 SBB EDX,EAX
00401CB9 B9 5E1AF8E0 MOV ECX,E0F81A5E
00401CBE 68 A0000000 PUSH 0A0
00401CC3 FF15 CE914100 CALL DWORD PTR DS:[4191CE] ; GDI32.GetTextColor
00401CC9 81DA B9742043 SBB EDX,432074B9
00401CCF C1E1 06 SHL ECX,6
00401CD2 E9 0B000000 JMP misfotos.00401CE2
00401CD7 81D1 0122DAA3 ADC ECX,A3DA2201
00401CDD BA 8E48FDE4 MOV EDX,E4FD488E
00401CE2 81C3 1151EC60 ADD EBX,60EC5111
00401CE8 68 D2000000 PUSH 0D2
00401CED FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401CF3 C1E9 13 SHR ECX,13
00401CF6 81EA DA05CDAB SUB EDX,ABCD05DA
00401CFC E9 0D000000 JMP misfotos.00401D0E
00401D01 B9 75BDE543 MOV ECX,43E5BD75
00401D06 BA 4D8AE267 MOV EDX,67E28A4D
00401D0B C1C8 03 ROR EAX,3
00401D0E 68 FA000000 PUSH 0FA
00401D13 68 C8000000 PUSH 0C8
00401D18 FF15 A2914100 CALL DWORD PTR DS:[4191A2] ; GDI32.GetMetaRgn
00401D1E BA 167E846E MOV EDX,6E847E16
00401D23 C1C8 03 ROR EAX,3
00401D26 3B15 74FC4000 CMP EDX,DWORD PTR DS:[40FC74]
00401D2C 76 0C JBE SHORT misfotos.00401D3A
00401D2E 1905 C0FE4000 SBB DWORD PTR DS:[40FEC0],EAX
00401D34 1B15 E0F84000 SBB EDX,DWORD PTR DS:[40F8E0]
00401D3A B8 E9C146FE MOV EAX,FE46C1E9
00401D3F 1B15 B0F84000 SBB EDX,DWORD PTR DS:[40F8B0]
00401D45 1B05 50FB4000 SBB EAX,DWORD PTR DS:[40FB50]
00401D4B 81C3 F3AE139F ADD EBX,9F13AEF3
00401D51 68 28000000 PUSH 28
00401D56 FF15 AA914100 CALL DWORD PTR DS:[4191AA] ; GDI32.GetTextCharset
00401D5C C1D9 0B RCR ECX,0B
00401D5F 81C1 F9C4B1D6 ADD ECX,D6B1C4F9
00401D65 1915 80FD4000 SBB DWORD PTR DS:[40FD80],EDX
00401D6B 68 A0000000 PUSH 0A0
00401D70 FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401D76 23D1 AND EDX,ECX
00401D78 0305 20FC4000 ADD EAX,DWORD PTR DS:[40FC20]
00401D7E C1DA 13 RCR EDX,13
00401D81 3B0D 6CFF4000 CMP ECX,DWORD PTR DS:[40FF6C]
00401D87 71 0E JNO SHORT misfotos.00401D97
00401D89 C1D2 1A RCL EDX,1A
00401D8C 81E2 8DCC5475 AND EDX,7554CC8D
00401D92 B8 BAC7C622 MOV EAX,22C6C7BA
00401D97 C1FA 12 SAR EDX,12
00401D9A C1C1 08 ROL ECX,8
00401D9D 81C6 6AED2E2F ADD ESI,2F2EED6A
00401DA3 68 E6000000 PUSH 0E6
00401DA8 FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
00401DAE 1B05 50F94000 SBB EAX,DWORD PTR DS:[40F950]
00401DB4 B9 6AA78799 MOV ECX,9987A76A
00401DB9 81FA F23E3F93 CMP EDX,933F3EF2
00401DBF 72 07 JB SHORT misfotos.00401DC8
00401DC1 23D0 AND EDX,EAX
00401DC3 B9 16DFEE35 MOV ECX,35EEDF16
00401DC8 81C1 12580249 ADD ECX,49025812
00401DCE 13C2 ADC EAX,EDX
00401DD0 68 C8000000 PUSH 0C8
00401DD5 68 0A000000 PUSH 0A
00401DDA FF15 A2914100 CALL DWORD PTR DS:[4191A2] ; GDI32.GetMetaRgn
00401DE0 81D2 46B0111A ADC EDX,1A11B046
00401DE6 B9 3DCFF281 MOV ECX,81F2CF3D
00401DEB B8 950F5EFE MOV EAX,FE5E0F95
00401DF0 81FA CA307D84 CMP EDX,847D30CA
00401DF6 7A 08 JPE SHORT misfotos.00401E00
00401DF8 1105 00FC4000 ADC DWORD PTR DS:[40FC00],EAX
00401DFE 1BC2 SBB EAX,EDX
00401E00 1BD1 SBB EDX,ECX
00401E02 C1F9 18 SAR ECX,18
00401E05 68 3C000000 PUSH 3C
00401E0A FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
00401E10 0BC8 OR ECX,EAX
00401E12 1BD0 SBB EDX,EAX
00401E14 0305 80FA4000 ADD EAX,DWORD PTR DS:[40FA80]
00401E1A 81C6 9A12D1D0 ADD ESI,D0D1129A
00401E20 81FB 48174000 CMP EBX,misfotos.00401748
00401E26 ^ 0F85 A6FCFFFF JNZ misfotos.00401AD2 ; 这里的向上回跳不要跳,我们直接执行到下一行的代码处,因为这里是循环.
00401E2C 68 50000000 PUSH 50 ; [F4]运行到这里,继续[F8]向下一直走.
00401E31 68 8C000000 PUSH 8C
00401E36 FF15 A2914100 CALL DWORD PTR DS:[4191A2] ; GDI32.GetMetaRgn
00401E3C 13D1 ADC EDX,ECX
00401E3E C1C8 1B ROR EAX,1B
00401E41 BA B13EEE10 MOV EDX,10EE3EB1
00401E46 81F9 9E40C622 CMP ECX,22C6409E
00401E4C 7E 0B JLE SHORT misfotos.00401E59
00401E4E 3305 50FB4000 XOR EAX,DWORD PTR DS:[40FB50]
00401E54 B9 79450E10 MOV ECX,100E4579
00401E59 3305 50FB4000 XOR EAX,DWORD PTR DS:[40FB50]
00401E5F B9 C18E4B4F MOV ECX,4F4B8EC1
00401E64 23D0 AND EDX,EAX
00401E66 68 14000000 PUSH 14
00401E6B FF15 DA914100 CALL DWORD PTR DS:[4191DA] ; GDI32.GetStockObject
00401E71 0905 60FF4000 OR DWORD PTR DS:[40FF60],EAX
00401E77 03C1 ADD EAX,ECX
00401E79 E9 0C000000 JMP misfotos.00401E8A
00401E7E C1E1 08 SHL ECX,8
00401E81 0B05 90FB4000 OR EAX,DWORD PTR DS:[40FB90]
00401E87 C1CA 0C ROR EDX,0C
00401E8A 68 BE000000 PUSH 0BE
00401E8F FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401E95 C1E1 1A SHL ECX,1A
00401E98 BA 66CD8033 MOV EDX,3380CD66
00401E9D 5B POP EBX
00401E9E 68 F0000000 PUSH 0F0
00401EA3 FF15 CE914100 CALL DWORD PTR DS:[4191CE] ; GDI32.GetTextColor
00401EA9 48 DEC EAX
00401EAA BA A97A171B MOV EDX,1B177AA9
00401EAF 81EA FD9A1BC0 SUB EDX,C01B9AFD
00401EB5 81F9 02AAC65E CMP ECX,5EC6AA02
00401EBB 72 08 JB SHORT misfotos.00401EC5
00401EBD C1F0 11 SAL EAX,11
00401EC0 B9 853F21A6 MOV ECX,A6213F85
00401EC5 C1F0 02 SAL EAX,2
00401EC8 BA B5C941E2 MOV EDX,E241C9B5
00401ECD 03D1 ADD EDX,ECX
00401ECF 68 AA000000 PUSH 0AA
00401ED4 68 BE000000 PUSH 0BE
00401ED9 FF15 A2914100 CALL DWORD PTR DS:[4191A2] ; GDI32.GetMetaRgn
00401EDF 81C1 428C77DA ADD ECX,DA778C42
00401EE5 2915 20FD4000 SUB DWORD PTR DS:[40FD20],EDX
00401EEB FFD3 CALL EBX ; 到这里后千万不要按[F8]去步过执行,那么会跑飞的.应该按[F7]进去,里边是下一个壳的OEP入口.
00401EED 68 3C000000 PUSH 3C
00401EF2 FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401EF8 03C1 ADD EAX,ECX
00401EFA C1C2 13 ROL EDX,13
00401EFD C1E8 18 SHR EAX,18
00401F00 E9 10000000 JMP misfotos.00401F15
00401F05 1315 A0FB4000 ADC EDX,DWORD PTR DS:[40FBA0]
00401F0B B9 824E7AB1 MOV ECX,B17A4E82
00401F10 B8 8AA4C975 MOV EAX,75C9A48A
00401F15 68 82000000 PUSH 82
00401F1A FF15 CE914100 CALL DWORD PTR DS:[4191CE] ; GDI32.GetTextColor
00401F20 190D 20FC4000 SBB DWORD PTR DS:[40FC20],ECX
00401F26 C1EA 0B SHR EDX,0B
00401F29 130D C0FD4000 ADC ECX,DWORD PTR DS:[40FDC0]
00401F2F E9 10000000 JMP misfotos.00401F44
00401F34 B8 6587CF97 MOV EAX,97CF8765
00401F39 81C1 0E541C99 ADD ECX,991C540E
00401F3F B8 957536C9 MOV EAX,C9367595
00401F44 61 POPAD
00401F45 68 64000000 PUSH 64
00401F4A FF15 F2914100 CALL DWORD PTR DS:[4191F2] ; GDI32.GetObjectType
00401F50 81D2 E1473A10 ADC EDX,103A47E1
00401F56 C1C1 02 ROL ECX,2
00401F59 C1D2 01 RCL EDX,1
00401F5C 3BC8 CMP ECX,EAX
00401F5E 76 07 JBE SHORT misfotos.00401F67
00401F60 BA 4E40CC04 MOV EDX,4CC404E
00401F65 23C8 AND ECX,EAX
00401F67 1915 40FE4000 SBB DWORD PTR DS:[40FE40],EDX
00401F6D 81D1 B9200B37 ADC ECX,370B20B9
00401F73 C1DA 10 RCR EDX,10
00401F76 68 64000000 PUSH 64
00401F7B 68 DC000000 PUSH 0DC
00401F80 FF15 A2914100 CALL DWORD PTR DS:[4191A2] ; GDI32.GetMetaRgn
00401F86 81C9 196ABB10 OR ECX,10BB6A19
00401F8C 0B05 50F94000 OR EAX,DWORD PTR DS:[40F950]
00401F92 81E2 C985C27A AND EDX,7AC285C9
00401F98 68 5A000000 PUSH 5A
00401F9D FF15 CE914100 CALL DWORD PTR DS:[4191CE] ; GDI32.GetTextColor
00401FA3 C1F9 06 SAR ECX,6
00401FA6 C1F0 0F SAL EAX,0F
00401FA9 B9 A58554AF MOV ECX,AF5485A5
00401FAE E9 0C000000 JMP misfotos.00401FBF
00401FB3 3305 D0FE4000 XOR EAX,DWORD PTR DS:[40FED0]
00401FB9 2315 00FB4000 AND EDX,DWORD PTR DS:[40FB00]
00401FBF C3 RETN
---------------------------------------------------------------------------------------------------- |
|