哪位大侠帮我分析一下下面的算法,不胜感激!!在线等!!
:005F6F32 FF152C104000 Call dword ptr [0040102C]
:005F6F38 85C0 test eax, eax
:005F6F3A 750A jne 005F6F46
:005F6F3C B8C4DE4300 mov eax, 0043DEC4
:005F6F41 E983010000 jmp 005F70C9
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005F6F3A(C)
|
:005F6F46 8D45DC lea eax, dword ptr [ebp-24]
:005F6F49 8D4DD8 lea ecx, dword ptr [ebp-28]
:005F6F4C 50 push eax
:005F6F4D 51 push ecx
:005F6F4E E85DF9FEFF call 005E68B0 进入到下面:005E68B0
:005F6F53 663DFFFF cmp ax, FFFF
:005F6F57 0F8467010000 je 005F70C4
:005E68B0 55 push ebp
:005E68B1 8BEC mov ebp, esp
:005E68B3 83EC08 sub esp, 00000008
:005E68B6 68D6A24000 push 0040A2D6
:005E68BB 64A100000000 mov eax, dword ptr fs:[00000000]
:005E68C1 50 push eax
:005E68C2 64892500000000 mov dword ptr fs:[00000000], esp
:005E68C9 83EC0C sub esp, 0000000C
:005E68CC 53 push ebx
:005E68CD 56 push esi
:005E68CE 57 push edi
:005E68CF 8965F8 mov dword ptr [ebp-08], esp
:005E68D2 C745FC303F4000 mov [ebp-04], 00403F30
:005E68D9 8B7D0C mov edi, dword ptr [ebp+0C]
* Reference To: MSVBVM60.__vbaStrCmp, Ord:0000h
|
:005E68DC 8B350C114000 mov esi, dword ptr [0040110C]
:005E68E2 C745E800000000 mov [ebp-18], 00000000
:005E68E9 8B07 mov eax, dword ptr [edi]
:005E68EB 50 push eax
:005E68EC 68CC744200 push 004274CC
:005E68F1 FFD6 call esi
:005E68F3 8B4D08 mov ecx, dword ptr [ebp+08]
:005E68F6 8BD8 mov ebx, eax
:005E68F8 F7DB neg ebx
:005E68FA 8B11 mov edx, dword ptr [ecx]
:005E68FC 1BDB sbb ebx, ebx
:005E68FE 52 push edx
:005E68FF 68CC744200 push 004274CC
:005E6904 F7DB neg ebx
:005E6906 FFD6 call esi
:005E6908 F7D8 neg eax
:005E690A 1BC0 sbb eax, eax
:005E690C F7D8 neg eax
:005E690E 85D8 test eax, ebx
:005E6910 750E jne 005E6920
:005E6912 C745EC00000000 mov [ebp-14], 00000000
:005E6919 6865695E00 push 005E6965
:005E691E EB44 jmp 005E6964
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005E6910(C)
|
:005E6920 8B4508 mov eax, dword ptr [ebp+08]
:005E6923 50 push eax
:005E6924 E8777E0B00 call 0069E7A0
:005E6929 8BD0 mov edx, eax
:005E692B 8D4DE8 lea ecx, dword ptr [ebp-18]
* Reference To: MSVBVM60.__vbaStrMove, Ord:0000h
|
:005E692E FF1544124000 Call dword ptr [00401244]
:005E6934 8D4DE8 lea ecx, dword ptr [ebp-18]
* Reference To: MSVBVM60.__vbaFreeStr, Ord:0000h
|
:005E6937 FF1598124000 Call dword ptr [00401298]
:005E693D 8B0F mov ecx, dword ptr [edi]
:005E693F 8B151CD37000 mov edx, dword ptr [0070D31C]
:005E6945 51 push ecx
:005E6946 52 push edx
:005E6947 FFD6 call esi
:005E6949 F7D8 neg eax
:005E694B 1BC0 sbb eax, eax
:005E694D 6865695E00 push 005E6965
:005E6952 F7D8 neg eax
:005E6954 48 dec eax
:005E6955 8945EC mov dword ptr [ebp-14], eax
:005E6958 EB0A jmp 005E6964
:005E695A 8D4DE8 lea ecx, dword ptr [ebp-18]
* Reference To: MSVBVM60.__vbaFreeStr, Ord:0000h
|
:005E695D FF1598124000 Call dword ptr [00401298]
:005E6963 C3 ret
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课