1002E001 > 60 pushad
1002E002 E8 03000000 call 1002E00A ; F7 跟入
1002E007 - E9 EB045D45 jmp 555FE4F7
1002E00C 55 push ebp
1002E00D C3 retn
1002E00E E8 01000000 call 1002E014
1002E013 EB 5D jmp short 1002E072
1002E015 BB EDFFFFFF mov ebx, -13
1002E01A 03DD add ebx, ebp
1002E01C 81EB 00E00200 sub ebx, 2E000
1002E022 807D 4D 01 cmp byte ptr [ebp+4D], 1
1002E026 75 0C jnz short 1002E034
1002E028 8B7424 28 mov esi, dword ptr [esp+28]
CALL到这里
1002E008 /EB 04 jmp short 1002E00E
1002E00A |5D pop ebp
1002E00B |45 inc ebp
1002E00C |55 push ebp
1002E00D |C3 retn
1002E00E \E8 01000000 call 1002E014 ;F7 跟入
1002E013 EB 5D jmp short 1002E072
1002E015 BB EDFFFFFF mov ebx, -13
1002E01A 03DD add ebx, ebp
1002E01C 81EB 00E00200 sub ebx, 2E000
CALL到这里
1002E014 5D pop ebp
1002E015 BB EDFFFFFF mov ebx, -13
1002E01A 03DD add ebx, ebp
1002E01C 81EB 00E00200 sub ebx, 2E000
1002E022 807D 4D 01 cmp byte ptr [ebp+4D], 1
1002E026 75 0C jnz short 1002E034
1002E028 8B7424 28 mov esi, dword ptr [esp+28]
1002E02C 83FE 01 cmp esi, 1
1002E02F 895D 4E mov dword ptr [ebp+4E], ebx
1002E032 75 31 jnz short 1002E065 ; 这里没有实现 回车实现
1002E034 8D45 53 lea eax, dword ptr [ebp+53]
1002E037 50 push eax
1002E038 53 push ebx
1002E039 FFB5 ED090000 push dword ptr [ebp+9ED]
1002E03F 8D45 35 lea eax, dword ptr [ebp+35]
1002E042 50 push eax
1002E043 E9 82000000 jmp 1002E0CA
1002E048 0000 add byte ptr [eax], al
1002E04A 0000 add byte ptr [eax], al
1002E04C 0000 add byte ptr [eax], al
1002E04E 0000 add byte ptr [eax], al
1002E050 0000 add byte ptr [eax], al
1002E052 0000 add byte ptr [eax], al
1002E054 0000 add byte ptr [eax], al
来到这里
1002E065 B8 F8C0A523 mov eax, 23A5C0F8 应该在这里下断 可是这里一下断程序就运行了
1002E06A 50 push eax
1002E06B 50 push eax
1002E06C 0345 4E add eax, dword ptr [ebp+4E]
1002E06F 5B pop ebx
1002E070 85C0 test eax, eax
1002E072 74 1C je short 1002E090
1002E074 EB 01 jmp short 1002E077
1002E076 E8 81FBF8C0 call D0FBDBFC
1002E07B A5 movs dword ptr es:[edi], dword ptr [e>
1002E07C 237435 33 and esi, dword ptr [ebp+esi+33]
1002E080 D256 6A rcl byte ptr [esi+6A], cl
1002E083 0056 FF add byte ptr [esi-1], dl
1002E086 75 4E jnz short 1002E0D6
1002E088 FFD0 call eax
1002E08A 5E pop esi
1002E08B 83FE 00 cmp esi, 0
1002E08E 75 24 jnz short 1002E0B4
1002E090 33D2 xor edx, edx
1002E092 8B45 41 mov eax, dword ptr [ebp+41]
1002E095 85C0 test eax, eax
1002E097 74 07 je short 1002E0A0
1002E099 52 push edx
1002E09A 52 push edx
1002E09B FF75 35 push dword ptr [ebp+35]
1002E09E FFD0 call eax
1002E0A0 8B45 35 mov eax, dword ptr [ebp+35]
1002E0A3 85C0 test eax, eax
1002E0A5 74 0D je short 1002E0B4
1002E0A7 68 00800000 push 8000
1002E0AC 6A 00 push 0
1002E0AE FF75 35 push dword ptr [ebp+35]
1002E0B1 FF55 3D call dword ptr [ebp+3D]
1002E0B4 5B pop ebx
1002E0B5 0BDB or ebx, ebx
1002E0B7 61 popad ：这里应该是出栈
1002E0B8 75 06 jnz short 1002E0C0
1002E0BA 6A 01 push 1
1002E0BC 58 pop eax
1002E0BD C2 0C00 retn 0C
1002E0C0 33C0 xor eax, eax
1002E0C2 F7D8 neg eax
1002E0C4 1BC0 sbb eax, eax
1002E0C6 40 inc eax
1002E0C7 C2 0C00 retn 0C
1002E0CA B6 06 mov dh, 6
哎，一下断就运行，郁闷了 请达人们帮看看，新手
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
