-
-
[原创]小菜也分析永恒之塔木马
-
发表于: 2009-7-1 16:17
-
初学咋到可能有很多不对的地方多多指教，这里只拣简单的分析
38001135 /$ 55 push ebp
38001136 |. 8BEC mov ebp, esp
38001138 |. 81EC 0C020000 sub esp, 20C
3800113E |. 53 push ebx
3800113F |. 56 push esi
38001140 |. 57 push edi
38001141 |. 6A 40 push 40
38001143 |. 33DB xor ebx, ebx
38001145 |. 59 pop ecx
38001146 |. 33C0 xor eax, eax
38001148 |. 8DBD F9FEFFFF lea edi, dword ptr [ebp-107]
3800114E |. 889D F8FEFFFF mov byte ptr [ebp-108], bl
38001154 |. F3:AB rep stos dword ptr es:[edi]
38001156 |. 66:AB stos word ptr es:[edi]
38001158 |. AA stos byte ptr es:[edi]
38001159 |. 8D85 F8FEFFFF lea eax, dword ptr [ebp-108]
3800115F |. 50 push eax ; /Buffer
38001160 |. 68 04010000 push 104 ; |BufSize = 104 (260.)
38001165 |. FF15 14400038 call dword ptr [<&KERNEL32.GetTempPat>; \GetTempPathA //得到临时文件夹路径
3800116B |. 85C0 test eax, eax
3800116D |. 75 0B jnz short 3800117A
3800116F |. 68 5C500038 push 3800505C
38001174 |. E8 82140000 call 380025FB
38001179 |. 59 pop ecx
3800117A |> 53 push ebx ; /pModule
3800117B |. FF15 10400038 call dword ptr [<&KERNEL32.GetModuleH>; \GetModuleHandleA
38001181 |. FF75 0C push dword ptr [ebp+C] ; /ResourceType
38001184 |. FF75 10 push dword ptr [ebp+10] ; |ResourceName
38001187 |. FF35 EC5C0038 push dword ptr [38005CEC] ; |hModule = 38000000 (Vch2)
3800118D |. FF15 0C400038 call dword ptr [<&KERNEL32.FindResour>; \FindResourceA //查找资源文件
38001193 |. 8BF0 mov esi, eax
38001195 |. 3BF3 cmp esi, ebx
38001197 |. 0F84 A1000000 je 3800123E //查找资源文件失败退出
3800119D |. 56 push esi ; /hResource
3800119E |. FF35 EC5C0038 push dword ptr [38005CEC] ; |hModule = 38000000 (Vch2)
380011A4 |. FF15 08400038 call dword ptr [<&KERNEL32.LoadResour>; \LoadResource
380011AA |. 3BC3 cmp eax, ebx
380011AC |. 8945 10 mov dword ptr [ebp+10], eax
380011AF |. 0F84 89000000 je 3800123E //加载资源文件失败退出
380011B5 |. 50 push eax ; /nHandles
380011B6 |. FF15 04400038 call dword ptr [<&KERNEL32.LockResour>; \SetHandleCount
380011BC |. 3BC3 cmp eax, ebx
380011BE |. 8945 0C mov dword ptr [ebp+C], eax
380011C1 |. 74 72 je short 38001235
380011C3 |. 56 push esi ; /hResource
380011C4 |. FF35 EC5C0038 push dword ptr [38005CEC] ; |hModule = 38000000 (Vch2)
380011CA |. FF15 00400038 call dword ptr [<&KERNEL32.SizeofReso>; \SizeofResource
380011D0 |. 8BF8 mov edi, eax
380011D2 |. 8D85 F4FDFFFF lea eax, dword ptr [ebp-20C]
380011D8 |. 50 push eax ; /TempName
380011D9 |. 53 push ebx ; |Unique
380011DA |. 8D85 F8FEFFFF lea eax, dword ptr [ebp-108] ; |
380011E0 |. 68 50500038 push 38005050 ; |Prefix = "70d68t5n"
380011E5 |. 50 push eax ; |Path
380011E6 |. FF15 7C400038 call dword ptr [<&KERNEL32.GetTempFil>; \GetTempFileNameA //生成临时文件
380011EC |. 8D85 F4FDFFFF lea eax, dword ptr [ebp-20C]
380011F2 |. 50 push eax ; /src
380011F3 |. FF75 08 push dword ptr [ebp+8] ; |dest
380011F6 |. E8 0D200000 call <jmp.&MSVCRT.strcpy> ; \strcpy
380011FB |. 59 pop ecx
380011FC |. 8D85 F4FDFFFF lea eax, dword ptr [ebp-20C]
38001202 |. 59 pop ecx
38001203 |. 53 push ebx ; /hTemplateFile
38001204 |. 53 push ebx ; |Attributes
38001205 |. 6A 02 push 2 ; |Mode = CREATE_ALWAYS
38001207 |. 53 push ebx ; |pSecurity
38001208 |. 53 push ebx ; |ShareMode
38001209 |. 68 000000C0 push C0000000 ; |Access = GENERIC_READ|GENERIC_WRITE
3800120E |. 50 push eax ; |FileName
3800120F |. FF15 A4400038 call dword ptr [<&KERNEL32.CreateFile>; \CreateFileA
38001215 |. 8BF0 mov esi, eax
38001217 |. 83FE FF cmp esi, -1
3800121A |. 74 12 je short 3800122E //创建文件失败释放资源
3800121C |. 8D45 FC lea eax, dword ptr [ebp-4]
3800121F |. 53 push ebx ; /pOverlapped
38001220 |. 50 push eax ; |pBytesWritten
38001221 |. 57 push edi ; |nBytesToWrite
38001222 |. FF75 0C push dword ptr [ebp+C] ; |Buffer
38001225 |. 56 push esi ; |hFile
38001226 |. FF15 A8400038 call dword ptr [<&KERNEL32.WriteFile>>; \WriteFile //写文件了
3800122C |. 8BD8 mov ebx, eax
3800122E |> 56 push esi ; /hObject
3800122F |. FF15 AC400038 call dword ptr [<&KERNEL32.CloseHandl>; \CloseHandle
38001235 |> FF75 10 push dword ptr [ebp+10] ; /hResource
38001238 |. FF15 B0400038 call dword ptr [<&KERNEL32.FreeResour>; \FreeResource
3800123E |> 5F pop edi
3800123F |. 8BC3 mov eax, ebx
38001241 |. 5E pop esi
38001242 |. 5B pop ebx
38001243 |. C9 leave
38001244 \. C3 retn
38002B78 /$ 55 push ebp
38002B79 |. 8BEC mov ebp, esp
38002B7B |. 83EC 28 sub esp, 28
38002B7E |. 8BD2 mov edx, edx
38002B80 |. 90 nop
38002B81 |. 8BC9 mov ecx, ecx
38002B83 |. 90 nop
38002B84 |. 90 nop
38002B85 |. 8BC0 mov eax, eax
38002B87 |. 90 nop
38002B88 |. 8BC9 mov ecx, ecx
38002B8A |. 6A 28 push 28 ; /n = 28 (40.)
38002B8C |. 8D45 D8 lea eax, dword ptr [ebp-28] ; |
38002B8F |. 6A 00 push 0 ; |c = 00
38002B91 |. 50 push eax ; |s
38002B92 |. E8 77060000 call <jmp.&MSVCRT.memset> ; \memset
38002B97 |. 8D45 D8 lea eax, dword ptr [ebp-28]
38002B9A |. 68 38520038 push 38005238 ; /src = "__D_"
38002B9F |. 50 push eax ; |dest
38002BA0 |. E8 63060000 call <jmp.&MSVCRT.strcpy> ; \strcpy
38002BA5 |. FF75 0C push dword ptr [ebp+C] ; /src //AION
38002BA8 |. 8D45 D8 lea eax, dword ptr [ebp-28] ; |
38002BAB |. 50 push eax ; |dest
38002BAC |. E8 B9060000 call <jmp.&MSVCRT.strcat> ; \strcat //__D_AION
38002BB1 |. 83C4 1C add esp, 1C
38002BB4 |. 8D45 D8 lea eax, dword ptr [ebp-28]
38002BB7 |. 50 push eax ; /MutexName
38002BB8 |. 6A 01 push 1 ; |Inheritable = TRUE
38002BBA |. 68 01001F00 push 1F0001 ; |Access = 1F0001
38002BBF |. FF15 A0400038 call dword ptr [<&KERNEL32.OpenMutexA>; \OpenMutexA
38002BC5 |. F7D8 neg eax
38002BC7 |. 1BC0 sbb eax, eax
38002BC9 |. F7D8 neg eax //返回一句柄
38002BCB |. C9 leave
38002BCC \. C3 retn
380012B8 /. 55 push ebp
380012B9 |. 8BEC mov ebp, esp
380012BB |. 51 push ecx
380012BC |. 51 push ecx
380012BD |. 53 push ebx
380012BE |. 56 push esi
380012BF |. 57 push edi
380012C0 |. 8BD2 mov edx, edx
380012C2 |. 90 nop
380012C3 |. 8BC9 mov ecx, ecx
380012C5 |. 90 nop
380012C6 |. 90 nop
380012C7 |. 8BC0 mov eax, eax
380012C9 |. 90 nop
380012CA |. 8BC9 mov ecx, ecx
380012CC |. 68 B8500038 push 380050B8 ; ASCII "AION"
380012D1 |. FF35 EC5C0038 push dword ptr [38005CEC] ; Vch2.38000000
380012D7 |. E8 9C180000 call 38002B78 //调用上面的那个函数
380012DC |. 59 pop ecx
380012DD |. 85C0 test eax, eax
380012DF |. 59 pop ecx
380012E0 |. 0F85 10010000 jnz 380013F6 //退出
380012E6 |. 68 A4500038 push 380050A4 ; /s2 = "PlayNCLauncher.exe"
380012EB |. FF75 08 push dword ptr [ebp+8] ; |s1 //参数
380012EE |. E8 651F0000 call <jmp.&MSVCRT._stricmp> ; \_stricmp //参数和PlayNCLauncher.exe 比较
380012F3 |. 59 pop ecx
380012F4 |. 85C0 test eax, eax
380012F6 |. 59 pop ecx
380012F7 |. 0F85 83000000 jnz 38001380 //
380012FD |. 8B35 20400038 mov esi, dword ptr [<&KERNEL32.Sleep>; kernel32.Sleep
38001303 |. 6A 32 push 32 ; /Timeout = 50. ms
38001305 |. FFD6 call esi ; \Sleep //睡会
38001307 |. 8B3D 1C410038 mov edi, dword ptr [<&USER32.FindWin>; USER32.FindWindowA
3800130D |. BB 94500038 mov ebx, 38005094 ; ASCII "Aion引导程序"
38001312 |. 53 push ebx ; /Title => "Aion引导程序"
38001313 |. 68 8C500038 push 3800508C ; |Class = "#32770"
38001318 |. FFD7 call edi ; \FindWindowA //查找窗口
3800131A |. 85C0 test eax, eax
3800131C |. 8945 FC mov dword ptr [ebp-4], eax
3800131F |. 75 24 jnz short 38001345
38001321 |. 2145 08 and dword ptr [ebp+8], eax
38001324 |> 6A 05 /push 5
38001326 |. FFD6 |call esi
38001328 |. FF45 08 |inc dword ptr [ebp+8]
3800132B |. 53 |push ebx
3800132C |. 6A 00 |push 0
3800132E |. FFD7 |call edi
38001330 |. 85C0 |test eax, eax
38001332 |. 8945 FC |mov dword ptr [ebp-4], eax
38001335 |. 75 0E |jnz short 38001345
38001337 |. 817D 08 F4010>|cmp dword ptr [ebp+8], 1F4
3800133E |.^ 7C E4 \jl short 38001324
38001340 |. E9 B1000000 jmp 380013F6
38001345 |> 8365 F8 00 and dword ptr [ebp-8], 0
38001349 |. E8 F7FEFFFF call 38001245
3800134E |. 8BF8 mov edi, eax
38001350 |> 85FF /test edi, edi
38001352 |. 74 10 |je short 38001364
38001354 |. E8 ECFEFFFF |call 38001245
38001359 |. 68 F4010000 |push 1F4
3800135E |. 8BF8 |mov edi, eax
38001360 |. FFD6 |call esi
38001362 |.^ EB EC \jmp short 38001350
38001364 |> E8 3D010000 call 380014A6
38001369 |. 8D45 F8 lea eax, dword ptr [ebp-8]
3800136C |. 50 push eax ; /pProcessID
3800136D |. FF75 FC push dword ptr [ebp-4] ; |hWnd
38001370 |. FF15 20410038 call dword ptr [<&USER32.GetWindowThr>; \GetWindowThreadProcessId
38001376 |. FF75 F8 push dword ptr [ebp-8]
38001379 |. E8 7F000000 call 380013FD
3800137E |. EB 76 jmp short 380013F6
38001380 |> 68 80500038 push 38005080 ; /s2 = "aion.bin"
38001385 |. FF75 08 push dword ptr [ebp+8] ; |s1
38001388 |. E8 CB1E0000 call <jmp.&MSVCRT._stricmp> ; \_stricmp
3800138D |. 59 pop ecx
3800138E |. 85C0 test eax, eax
38001390 |. 59 pop ecx
38001391 |. 75 63 jnz short 380013F6
38001393 |. 33FF xor edi, edi
38001395 |. 68 74500038 push 38005074 ; /MutexName = "aiontemp"
3800139A |. 57 push edi ; |InitialOwner => FALSE
3800139B |. 57 push edi ; |pSecurity => NULL
3800139C |. FF15 1C400038 call dword ptr [<&KERNEL32.CreateMute>; \CreateMutexA //创建互斥aiontemp
380013A2 |. A3 405B0038 mov dword ptr [38005B40], eax
380013A7 |. FF15 18400038 call dword ptr [<&KERNEL32.GetLastErr>; [GetLastError
380013AD |. 3D B7000000 cmp eax, 0B7
380013B2 |. 75 14 jnz short 380013C8
380013B4 |. FF35 405B0038 push dword ptr [38005B40] ; /hObject = NULL
380013BA |. FF15 AC400038 call dword ptr [<&KERNEL32.CloseHandl>; \CloseHandle
380013C0 |. 893D 405B0038 mov dword ptr [38005B40], edi
380013C6 |. EB 2E jmp short 380013F6
380013C8 |> 8BD2 mov edx, edx
380013CA |. 90 nop
380013CB |. 8BC9 mov ecx, ecx
380013CD |. 90 nop
380013CE |. 90 nop
380013CF |. 8BC0 mov eax, eax
380013D1 |. 90 nop
380013D2 |. 8BC9 mov ecx, ecx
380013D4 |. 8B35 20400038 mov esi, dword ptr [<&KERNEL32.Sleep>; kernel32.Sleep
380013DA |. 68 70940000 push 9470 ; /Timeout = 38000. ms
380013DF |. FFD6 call esi ; \Sleep
380013E1 |. E8 0D030000 call 380016F3 //调用另一函数
380013E6 |. 3BC7 cmp eax, edi 比较返回值和edi等否？
380013E8 |. 74 0C je short 380013F6 相等退出
380013EA |. 68 28230000 push 2328
380013EF |. FFD6 call esi
380013F1 |. E8 FD020000 call 380016F3 调用另一函数
380013F6 |> 5F pop edi
380013F7 |. 5E pop esi
380013F8 |. 33C0 xor eax, eax
380013FA |. 5B pop ebx
380013FB |. C9 leave
380013FC \. C3 retn
调用38002B78若返回的句柄不为空则退出，为空的话参数和PlayNCLauncher.exe 比较，若比较结果不为0则参数和aion.bin比较为0转到（2），结果不为0退出，
（2）查找窗口Aion引导程序 结果为0的话调用函数38001245
38001828 /$ 55 push ebp
38001829 |. 8BEC mov ebp, esp
3800182B |. 81EC 08020000 sub esp, 208
38001831 |. 80A5 FCFEFFFF>and byte ptr [ebp-104], 0
38001838 |. 57 push edi
38001839 |. 6A 40 push 40
3800183B |. 33C0 xor eax, eax
3800183D |. 59 pop ecx
3800183E |. 8DBD FDFEFFFF lea edi, dword ptr [ebp-103]
38001844 |. F3:AB rep stos dword ptr es:[edi]
38001846 |. 66:AB stos word ptr es:[edi]
38001848 |. AA stos byte ptr es:[edi]
38001849 |. 8D85 FCFEFFFF lea eax, dword ptr [ebp-104]
3800184F |. 68 04010000 push 104 ; /BufSize = 104 (260.)
38001854 |. 50 push eax ; |PathBuffer
38001855 |. 6A 00 push 0 ; |hModule = NULL
38001857 |. FF15 B4400038 call dword ptr [<&KERNEL32.GetModuleF>; \GetModuleFileNameA //得到游戏的路径
3800185D |. 80A5 F8FDFFFF>and byte ptr [ebp-208], 0
38001864 |. 6A 40 push 40
38001866 |. 59 pop ecx
38001867 |. 33C0 xor eax, eax
38001869 |. 8DBD F9FDFFFF lea edi, dword ptr [ebp-207]
3800186F |. F3:AB rep stos dword ptr es:[edi]
38001871 |. 66:AB stos word ptr es:[edi]
38001873 |. AA stos byte ptr es:[edi]
38001874 |. 8D85 FCFEFFFF lea eax, dword ptr [ebp-104]
3800187A |. 50 push eax ; /s
3800187B |. E8 DE190000 call <jmp.&MSVCRT.strlen> ; \strlen
38001880 |. 59 pop ecx
38001881 |. 83E8 0D sub eax, 0D
38001884 |. 50 push eax ; /n
38001885 |. 8D85 FCFEFFFF lea eax, dword ptr [ebp-104] ; |
3800188B |. 50 push eax ; |String2
3800188C |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208] ; |
38001892 |. 50 push eax ; |String1
38001893 |. FF15 60400038 call dword ptr [<&KERNEL32.lstrcpynA>>; \lstrcpynA
38001899 |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
3800189F |. 68 1C510038 push 3800511C ; /src = "AIONLauncherInfo.ini"
380018A4 |. 50 push eax ; |dest
380018A5 |. E8 C0190000 call <jmp.&MSVCRT.strcat> ; \strcat //得到AIONLauncherInfo.ini 路径
380018AA |. 59 pop ecx
380018AB |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
380018B1 |. 59 pop ecx
380018B2 |. 50 push eax ; /IniFileName
380018B3 |. 6A 20 push 20 ; |BufSize = 20 (32.)
380018B5 |. 68 505B0038 push 38005B50 ; |ReturnBuffer = Vch2.38005B50
380018BA |. 68 605C0038 push 38005C60 ; |Default = ""
380018BF |. 68 10510038 push 38005110 ; |Key = "update_name"
380018C4 |. 68 00510038 push 38005100 ; |Section = "LAUNCHER_INFO"
380018C9 |. FF15 5C400038 call dword ptr [<&KERNEL32.GetPrivate>; \GetPrivateProfileStringA //读取ini
380018CF |. 33C0 xor eax, eax
380018D1 |. 5F pop edi
380018D2 |. C9 leave
380018D3 \. C3 retn
38001906 /$ 55 push ebp
38001907 |. 8BEC mov ebp, esp
38001909 |. 81EC 08020000 sub esp, 208
3800190F |. 68 B8500038 push 380050B8 ; ASCII "AION"
38001914 |. E8 19180000 call 38003132 // mibao.asp
38001919 |. 85C0 test eax, eax
3800191B |. 59 pop ecx
3800191C |. 74 47 je short 38001965
3800191E |. 50 push eax ; /src
3800191F |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208] ; |
38001925 |. 50 push eax ; |dest
38001926 |. E8 DD180000 call <jmp.&MSVCRT.strcpy> ; \strcpy
3800192B |. 59 pop ecx
3800192C |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
38001932 |. 59 pop ecx
38001933 |. 68 905B0038 push 38005B90 ; /<%s> = ""
38001938 |. 50 push eax ; |<%s>
38001939 |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208] ; |
3800193F |. 68 38510038 push 38005138 ; |format = "%s?action=testlock&u=%s"
38001944 |. 50 push eax ; |s
38001945 |. E8 26190000 call <jmp.&MSVCRT.sprintf> ; \sprintf
3800194A |. 8D45 F8 lea eax, dword ptr [ebp-8]
3800194D |. 50 push eax
3800194E |. 8D45 FC lea eax, dword ptr [ebp-4]
38001951 |. 50 push eax
38001952 |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
38001958 |. 50 push eax
38001959 |. E8 60110000 call 38002ABE
3800195E |. 83C4 1C add esp, 1C
38001961 |. 85C0 test eax, eax
38001963 |. 75 04 jnz short 38001969
38001965 |> 33C0 xor eax, eax
38001967 |. C9 leave
38001968 |. C3 retn
38001969 |> 8B45 FC mov eax, dword ptr [ebp-4]
3800196C |. 8B4D F8 mov ecx, dword ptr [ebp-8]
3800196F |. 68 34510038 push 38005134 ; /s2 = "1"
38001974 |. 802408 00 and byte ptr [eax+ecx], 0 ; |
38001978 |. FF75 FC push dword ptr [ebp-4] ; |s1
3800197B |. E8 D8180000 call <jmp.&MSVCRT._stricmp> ; \_stricmp
38001980 |. 59 pop ecx
38001981 |. 85C0 test eax, eax
38001983 |. 59 pop ecx
38001984 |. 75 2D jnz short 380019B3
38001986 |. 56 push esi
38001987 |. FF15 6C400038 call dword ptr [<&KERNEL32.GetCurrent>; [GetCurrentProcessId
3800198D |. 50 push eax ; /ProcessId
3800198E |. 6A 00 push 0 ; |Inheritable = FALSE
38001990 |. 6A 01 push 1 ; |Access = TERMINATE
38001992 |. FF15 2C400038 call dword ptr [<&KERNEL32.OpenProces>; \OpenProcess
38001998 |. 8B35 68400038 mov esi, dword ptr [<&KERNEL32.Termi>; kernel32.TerminateProcess
3800199E |. 85C0 test eax, eax
380019A0 |. 74 05 je short 380019A7
380019A2 |. 6A 00 push 0 ; /ExitCode = 0
380019A4 |. 50 push eax ; |hProcess
380019A5 |. FFD6 call esi ; \TerminateProcess
380019A7 |> 6A 00 push 0
380019A9 |. FF15 64400038 call dword ptr [<&KERNEL32.GetCurrent>; [GetCurrentProcess
380019AF |. 50 push eax
380019B0 |. FFD6 call esi
380019B2 |. 5E pop esi
380019B3 |> 6A 01 push 1
380019B5 |. 58 pop eax
380019B6 |. C9 leave
380019B7 \. C3 retn
text:380019DB
.text:380019DB push ebp
.text:380019DC mov ebp, esp
.text:380019DE push ecx
.text:380019DF push ebx
.text:380019E0 push esi
.text:380019E1 push edi
.text:380019E2 push offset ModuleName ; "Game.dll"
.text:380019E7 call sub_380027CF //加载game.dll
.text:380019EC mov edi, eax
.text:380019EE pop ecx
.text:380019EF test edi, edi
.text:380019F1 jz loc_38001B5E //失败退出
.text:380019F7 mov esi, ds:Sleep
.text:380019FD push 0C350h ; dwMilliseconds
.text:38001A02 call esi ; Sleep
.text:38001A04 mov ebx, offset Str
.text:38001A09
.text:38001A09 loc_38001A09: ; CODE XREF: sub_380019DB+132j
.text:38001A09 ; sub_380019DB+142j
.text:38001A09 push 4E20h ; dwMilliseconds
.text:38001A0E call esi ; Sleep
.text:38001A10 mov edx, edx
.text:38001A12 nop
.text:38001A13 mov ecx, ecx
.text:38001A15 nop
.text:38001A16 nop
.text:38001A17 mov eax, eax
.text:38001A19 nop
.text:38001A1A mov ecx, ecx
.text:38001A1C lea eax, [edi+54FEDCh]
.text:38001A22 mov dword_38005C50, eax
.text:38001A27 lea eax, [edi+54FEE0h]
.text:38001A2D mov dword_38005C54, eax
.text:38001A32 mov eax, dword_38005C50
.text:38001A37 mov eax, [eax]
.text:38001A39 mov dword_38005C50, eax
.text:38001A3E mov eax, dword_38005C54
.text:38001A43 mov eax, [eax]
.text:38001A45 mov dword_38005C54, eax
.text:38001A4A mov eax, dword_38005C54
.text:38001A4F sub eax, dword_38005C50
.text:38001A55 mov dword_38005C4C, eax
.text:38001A5A sar dword_38005C4C, 2
.text:38001A61 and [ebp+var_4], 0
.text:38001A65 cmp dword_38005C4C, 0
.text:38001A6C jbe loc_38001B03
.text:38001A72
.text:38001A72 loc_38001A72: ; CODE XREF: sub_380019DB+122j
.text:38001A72 mov eax, dword_38005C50
.text:38001A77 mov ecx, [ebp+var_4]
.text:38001A7A mov eax, [eax+ecx*4]
.text:38001A7D mov dword_38005C58, eax
.text:38001A82 cmp dword_38005C58, 0
.text:38001A89 jz short loc_38001AF1
.text:38001A8B mov eax, dword_38005C58
.text:38001A90 mov dword_38005C5C, eax
.text:38001A95 cmp dword_38005C5C, 0
.text:38001A9C jz short loc_38001AF1
.text:38001A9E mov eax, dword_38005C58
.text:38001AA3 add eax, 4
.text:38001AA6 push eax ; lpWideCharStr
.text:38001AA7 push offset Str ; lpMultiByteStr
.text:38001AAC call sub_380029C5
.text:38001AB1 mov eax, dword_38005C58
.text:38001AB6 add eax, 34h
.text:38001AB9 mov ecx, [eax]
.text:38001ABB cmp ecx, 1
.text:38001ABE jz short loc_38001AD1
.text:38001AC0 push offset asc_38005048 ; "人族"
.text:38001AC5 push offset byte_38005C30 ; Dest
.text:38001ACA call sub_38002915
.text:38001ACF jmp short loc_38001AE0
.text:38001AD1 ; ---------------------------------------------------------------------------
.text:38001AD1
.text:38001AD1 loc_38001AD1: ; CODE XREF: sub_380019DB+E3j
.text:38001AD1 push offset aZX ; "魔族"
.text:38001AD6 push offset byte_38005C30 ; Dest
.text:38001ADB call sub_38002915
.text:38001AE0
.text:38001AE0 loc_38001AE0: ; CODE XREF: sub_380019DB+F4j
.text:38001AE0 mov eax, dword_38005C58
.text:38001AE5 add eax, 94h
.text:38001AEA mov eax, [eax]
.text:38001AEC mov dword_38005B3C, eax
.text:38001AF1
.text:38001AF1 loc_38001AF1: ; CODE XREF: sub_380019DB+AEj
.text:38001AF1 ; sub_380019DB+C1j
.text:38001AF1 inc [ebp+var_4]
.text:38001AF4 mov eax, [ebp+var_4]
.text:38001AF7 cmp eax, dword_38005C4C
.text:38001AFD jb loc_38001A72
.text:38001B03
.text:38001B03 loc_38001B03: ; CODE XREF: sub_380019DB+91j
.text:38001B03 push ebx ; Str
.text:38001B04 call strlen
.text:38001B09 cmp eax, 2
.text:38001B0C pop ecx
.text:38001B0D jb loc_38001A09
.text:38001B13 push ebx ; Str
.text:38001B14 call strlen
.text:38001B19 cmp eax, 14h
.text:38001B1C pop ecx
.text:38001B1D ja loc_38001A09
.text:38001B23 add edi, 5933FCh
.text:38001B29 mov dword_38005C4C, edi
.text:38001B2F mov eax, dword_38005C4C
.text:38001B34 mov eax, [eax]
.text:38001B36 add eax, 18h
.text:38001B39 mov eax, [eax]
.text:38001B3B mov dword_38005B2C, eax
.text:38001B40 push 5 ; dwMilliseconds
.text:38001B42 call esi ; Sleep
.text:38001B44 call sub_38001B65
.text:38001B49 push 5 ; dwMilliseconds
.text:38001B4B call esi ; Sleep
.text:38001B4D call sub_38001C1F
.text:38001B52 push 1F4h ; dwMilliseconds
.text:38001B57 call esi ; Sleep
.text:38001B59 call sub_38001D2A
.text:38001B5E
.text:38001B5E loc_38001B5E: ; CODE XREF: sub_380019DB+16j
.text:38001B5E pop edi
.text:38001B5F pop esi
.text:38001B60 pop ebx
.text:38001B61 leave
.text:38001B62 retn 4
.text:38001B62 sub_380019DB endp
38001135 /$ 55 push ebp
38001136 |. 8BEC mov ebp, esp
38001138 |. 81EC 0C020000 sub esp, 20C
3800113E |. 53 push ebx
3800113F |. 56 push esi
38001140 |. 57 push edi
38001141 |. 6A 40 push 40
38001143 |. 33DB xor ebx, ebx
38001145 |. 59 pop ecx
38001146 |. 33C0 xor eax, eax
38001148 |. 8DBD F9FEFFFF lea edi, dword ptr [ebp-107]
3800114E |. 889D F8FEFFFF mov byte ptr [ebp-108], bl
38001154 |. F3:AB rep stos dword ptr es:[edi]
38001156 |. 66:AB stos word ptr es:[edi]
38001158 |. AA stos byte ptr es:[edi]
38001159 |. 8D85 F8FEFFFF lea eax, dword ptr [ebp-108]
3800115F |. 50 push eax ; /Buffer
38001160 |. 68 04010000 push 104 ; |BufSize = 104 (260.)
38001165 |. FF15 14400038 call dword ptr [<&KERNEL32.GetTempPat>; \GetTempPathA //得到临时文件夹路径
3800116B |. 85C0 test eax, eax
3800116D |. 75 0B jnz short 3800117A
3800116F |. 68 5C500038 push 3800505C
38001174 |. E8 82140000 call 380025FB
38001179 |. 59 pop ecx
3800117A |> 53 push ebx ; /pModule
3800117B |. FF15 10400038 call dword ptr [<&KERNEL32.GetModuleH>; \GetModuleHandleA
38001181 |. FF75 0C push dword ptr [ebp+C] ; /ResourceType
38001184 |. FF75 10 push dword ptr [ebp+10] ; |ResourceName
38001187 |. FF35 EC5C0038 push dword ptr [38005CEC] ; |hModule = 38000000 (Vch2)
3800118D |. FF15 0C400038 call dword ptr [<&KERNEL32.FindResour>; \FindResourceA //查找资源文件
38001193 |. 8BF0 mov esi, eax
38001195 |. 3BF3 cmp esi, ebx
38001197 |. 0F84 A1000000 je 3800123E //查找资源文件失败退出
3800119D |. 56 push esi ; /hResource
3800119E |. FF35 EC5C0038 push dword ptr [38005CEC] ; |hModule = 38000000 (Vch2)
380011A4 |. FF15 08400038 call dword ptr [<&KERNEL32.LoadResour>; \LoadResource
380011AA |. 3BC3 cmp eax, ebx
380011AC |. 8945 10 mov dword ptr [ebp+10], eax
380011AF |. 0F84 89000000 je 3800123E //加载资源文件失败退出
380011B5 |. 50 push eax ; /nHandles
380011B6 |. FF15 04400038 call dword ptr [<&KERNEL32.LockResour>; \SetHandleCount
380011BC |. 3BC3 cmp eax, ebx
380011BE |. 8945 0C mov dword ptr [ebp+C], eax
380011C1 |. 74 72 je short 38001235
380011C3 |. 56 push esi ; /hResource
380011C4 |. FF35 EC5C0038 push dword ptr [38005CEC] ; |hModule = 38000000 (Vch2)
380011CA |. FF15 00400038 call dword ptr [<&KERNEL32.SizeofReso>; \SizeofResource
380011D0 |. 8BF8 mov edi, eax
380011D2 |. 8D85 F4FDFFFF lea eax, dword ptr [ebp-20C]
380011D8 |. 50 push eax ; /TempName
380011D9 |. 53 push ebx ; |Unique
380011DA |. 8D85 F8FEFFFF lea eax, dword ptr [ebp-108] ; |
380011E0 |. 68 50500038 push 38005050 ; |Prefix = "70d68t5n"
380011E5 |. 50 push eax ; |Path
380011E6 |. FF15 7C400038 call dword ptr [<&KERNEL32.GetTempFil>; \GetTempFileNameA //生成临时文件
380011EC |. 8D85 F4FDFFFF lea eax, dword ptr [ebp-20C]
380011F2 |. 50 push eax ; /src
380011F3 |. FF75 08 push dword ptr [ebp+8] ; |dest
380011F6 |. E8 0D200000 call <jmp.&MSVCRT.strcpy> ; \strcpy
380011FB |. 59 pop ecx
380011FC |. 8D85 F4FDFFFF lea eax, dword ptr [ebp-20C]
38001202 |. 59 pop ecx
38001203 |. 53 push ebx ; /hTemplateFile
38001204 |. 53 push ebx ; |Attributes
38001205 |. 6A 02 push 2 ; |Mode = CREATE_ALWAYS
38001207 |. 53 push ebx ; |pSecurity
38001208 |. 53 push ebx ; |ShareMode
38001209 |. 68 000000C0 push C0000000 ; |Access = GENERIC_READ|GENERIC_WRITE
3800120E |. 50 push eax ; |FileName
3800120F |. FF15 A4400038 call dword ptr [<&KERNEL32.CreateFile>; \CreateFileA
38001215 |. 8BF0 mov esi, eax
38001217 |. 83FE FF cmp esi, -1
3800121A |. 74 12 je short 3800122E //创建文件失败释放资源
3800121C |. 8D45 FC lea eax, dword ptr [ebp-4]
3800121F |. 53 push ebx ; /pOverlapped
38001220 |. 50 push eax ; |pBytesWritten
38001221 |. 57 push edi ; |nBytesToWrite
38001222 |. FF75 0C push dword ptr [ebp+C] ; |Buffer
38001225 |. 56 push esi ; |hFile
38001226 |. FF15 A8400038 call dword ptr [<&KERNEL32.WriteFile>>; \WriteFile //写文件了
3800122C |. 8BD8 mov ebx, eax
3800122E |> 56 push esi ; /hObject
3800122F |. FF15 AC400038 call dword ptr [<&KERNEL32.CloseHandl>; \CloseHandle
38001235 |> FF75 10 push dword ptr [ebp+10] ; /hResource
38001238 |. FF15 B0400038 call dword ptr [<&KERNEL32.FreeResour>; \FreeResource
3800123E |> 5F pop edi
3800123F |. 8BC3 mov eax, ebx
38001241 |. 5E pop esi
38001242 |. 5B pop ebx
38001243 |. C9 leave
38001244 \. C3 retn
38002B78 /$ 55 push ebp
38002B79 |. 8BEC mov ebp, esp
38002B7B |. 83EC 28 sub esp, 28
38002B7E |. 8BD2 mov edx, edx
38002B80 |. 90 nop
38002B81 |. 8BC9 mov ecx, ecx
38002B83 |. 90 nop
38002B84 |. 90 nop
38002B85 |. 8BC0 mov eax, eax
38002B87 |. 90 nop
38002B88 |. 8BC9 mov ecx, ecx
38002B8A |. 6A 28 push 28 ; /n = 28 (40.)
38002B8C |. 8D45 D8 lea eax, dword ptr [ebp-28] ; |
38002B8F |. 6A 00 push 0 ; |c = 00
38002B91 |. 50 push eax ; |s
38002B92 |. E8 77060000 call <jmp.&MSVCRT.memset> ; \memset
38002B97 |. 8D45 D8 lea eax, dword ptr [ebp-28]
38002B9A |. 68 38520038 push 38005238 ; /src = "__D_"
38002B9F |. 50 push eax ; |dest
38002BA0 |. E8 63060000 call <jmp.&MSVCRT.strcpy> ; \strcpy
38002BA5 |. FF75 0C push dword ptr [ebp+C] ; /src //AION
38002BA8 |. 8D45 D8 lea eax, dword ptr [ebp-28] ; |
38002BAB |. 50 push eax ; |dest
38002BAC |. E8 B9060000 call <jmp.&MSVCRT.strcat> ; \strcat //__D_AION
38002BB1 |. 83C4 1C add esp, 1C
38002BB4 |. 8D45 D8 lea eax, dword ptr [ebp-28]
38002BB7 |. 50 push eax ; /MutexName
38002BB8 |. 6A 01 push 1 ; |Inheritable = TRUE
38002BBA |. 68 01001F00 push 1F0001 ; |Access = 1F0001
38002BBF |. FF15 A0400038 call dword ptr [<&KERNEL32.OpenMutexA>; \OpenMutexA
38002BC5 |. F7D8 neg eax
38002BC7 |. 1BC0 sbb eax, eax
38002BC9 |. F7D8 neg eax //返回一句柄
38002BCB |. C9 leave
38002BCC \. C3 retn
380012B8 /. 55 push ebp
380012B9 |. 8BEC mov ebp, esp
380012BB |. 51 push ecx
380012BC |. 51 push ecx
380012BD |. 53 push ebx
380012BE |. 56 push esi
380012BF |. 57 push edi
380012C0 |. 8BD2 mov edx, edx
380012C2 |. 90 nop
380012C3 |. 8BC9 mov ecx, ecx
380012C5 |. 90 nop
380012C6 |. 90 nop
380012C7 |. 8BC0 mov eax, eax
380012C9 |. 90 nop
380012CA |. 8BC9 mov ecx, ecx
380012CC |. 68 B8500038 push 380050B8 ; ASCII "AION"
380012D1 |. FF35 EC5C0038 push dword ptr [38005CEC] ; Vch2.38000000
380012D7 |. E8 9C180000 call 38002B78 //调用上面的那个函数
380012DC |. 59 pop ecx
380012DD |. 85C0 test eax, eax
380012DF |. 59 pop ecx
380012E0 |. 0F85 10010000 jnz 380013F6 //退出
380012E6 |. 68 A4500038 push 380050A4 ; /s2 = "PlayNCLauncher.exe"
380012EB |. FF75 08 push dword ptr [ebp+8] ; |s1 //参数
380012EE |. E8 651F0000 call <jmp.&MSVCRT._stricmp> ; \_stricmp //参数和PlayNCLauncher.exe 比较
380012F3 |. 59 pop ecx
380012F4 |. 85C0 test eax, eax
380012F6 |. 59 pop ecx
380012F7 |. 0F85 83000000 jnz 38001380 //
380012FD |. 8B35 20400038 mov esi, dword ptr [<&KERNEL32.Sleep>; kernel32.Sleep
38001303 |. 6A 32 push 32 ; /Timeout = 50. ms
38001305 |. FFD6 call esi ; \Sleep //睡会
38001307 |. 8B3D 1C410038 mov edi, dword ptr [<&USER32.FindWin>; USER32.FindWindowA
3800130D |. BB 94500038 mov ebx, 38005094 ; ASCII "Aion引导程序"
38001312 |. 53 push ebx ; /Title => "Aion引导程序"
38001313 |. 68 8C500038 push 3800508C ; |Class = "#32770"
38001318 |. FFD7 call edi ; \FindWindowA //查找窗口
3800131A |. 85C0 test eax, eax
3800131C |. 8945 FC mov dword ptr [ebp-4], eax
3800131F |. 75 24 jnz short 38001345
38001321 |. 2145 08 and dword ptr [ebp+8], eax
38001324 |> 6A 05 /push 5
38001326 |. FFD6 |call esi
38001328 |. FF45 08 |inc dword ptr [ebp+8]
3800132B |. 53 |push ebx
3800132C |. 6A 00 |push 0
3800132E |. FFD7 |call edi
38001330 |. 85C0 |test eax, eax
38001332 |. 8945 FC |mov dword ptr [ebp-4], eax
38001335 |. 75 0E |jnz short 38001345
38001337 |. 817D 08 F4010>|cmp dword ptr [ebp+8], 1F4
3800133E |.^ 7C E4 \jl short 38001324
38001340 |. E9 B1000000 jmp 380013F6
38001345 |> 8365 F8 00 and dword ptr [ebp-8], 0
38001349 |. E8 F7FEFFFF call 38001245
3800134E |. 8BF8 mov edi, eax
38001350 |> 85FF /test edi, edi
38001352 |. 74 10 |je short 38001364
38001354 |. E8 ECFEFFFF |call 38001245
38001359 |. 68 F4010000 |push 1F4
3800135E |. 8BF8 |mov edi, eax
38001360 |. FFD6 |call esi
38001362 |.^ EB EC \jmp short 38001350
38001364 |> E8 3D010000 call 380014A6
38001369 |. 8D45 F8 lea eax, dword ptr [ebp-8]
3800136C |. 50 push eax ; /pProcessID
3800136D |. FF75 FC push dword ptr [ebp-4] ; |hWnd
38001370 |. FF15 20410038 call dword ptr [<&USER32.GetWindowThr>; \GetWindowThreadProcessId
38001376 |. FF75 F8 push dword ptr [ebp-8]
38001379 |. E8 7F000000 call 380013FD
3800137E |. EB 76 jmp short 380013F6
38001380 |> 68 80500038 push 38005080 ; /s2 = "aion.bin"
38001385 |. FF75 08 push dword ptr [ebp+8] ; |s1
38001388 |. E8 CB1E0000 call <jmp.&MSVCRT._stricmp> ; \_stricmp
3800138D |. 59 pop ecx
3800138E |. 85C0 test eax, eax
38001390 |. 59 pop ecx
38001391 |. 75 63 jnz short 380013F6
38001393 |. 33FF xor edi, edi
38001395 |. 68 74500038 push 38005074 ; /MutexName = "aiontemp"
3800139A |. 57 push edi ; |InitialOwner => FALSE
3800139B |. 57 push edi ; |pSecurity => NULL
3800139C |. FF15 1C400038 call dword ptr [<&KERNEL32.CreateMute>; \CreateMutexA //创建互斥aiontemp
380013A2 |. A3 405B0038 mov dword ptr [38005B40], eax
380013A7 |. FF15 18400038 call dword ptr [<&KERNEL32.GetLastErr>; [GetLastError
380013AD |. 3D B7000000 cmp eax, 0B7
380013B2 |. 75 14 jnz short 380013C8
380013B4 |. FF35 405B0038 push dword ptr [38005B40] ; /hObject = NULL
380013BA |. FF15 AC400038 call dword ptr [<&KERNEL32.CloseHandl>; \CloseHandle
380013C0 |. 893D 405B0038 mov dword ptr [38005B40], edi
380013C6 |. EB 2E jmp short 380013F6
380013C8 |> 8BD2 mov edx, edx
380013CA |. 90 nop
380013CB |. 8BC9 mov ecx, ecx
380013CD |. 90 nop
380013CE |. 90 nop
380013CF |. 8BC0 mov eax, eax
380013D1 |. 90 nop
380013D2 |. 8BC9 mov ecx, ecx
380013D4 |. 8B35 20400038 mov esi, dword ptr [<&KERNEL32.Sleep>; kernel32.Sleep
380013DA |. 68 70940000 push 9470 ; /Timeout = 38000. ms
380013DF |. FFD6 call esi ; \Sleep
380013E1 |. E8 0D030000 call 380016F3 //调用另一函数
380013E6 |. 3BC7 cmp eax, edi 比较返回值和edi等否？
380013E8 |. 74 0C je short 380013F6 相等退出
380013EA |. 68 28230000 push 2328
380013EF |. FFD6 call esi
380013F1 |. E8 FD020000 call 380016F3 调用另一函数
380013F6 |> 5F pop edi
380013F7 |. 5E pop esi
380013F8 |. 33C0 xor eax, eax
380013FA |. 5B pop ebx
380013FB |. C9 leave
380013FC \. C3 retn
调用38002B78若返回的句柄不为空则退出，为空的话参数和PlayNCLauncher.exe 比较，若比较结果不为0则参数和aion.bin比较为0转到（2），结果不为0退出，
（2）查找窗口Aion引导程序 结果为0的话调用函数38001245
38001828 /$ 55 push ebp
38001829 |. 8BEC mov ebp, esp
3800182B |. 81EC 08020000 sub esp, 208
38001831 |. 80A5 FCFEFFFF>and byte ptr [ebp-104], 0
38001838 |. 57 push edi
38001839 |. 6A 40 push 40
3800183B |. 33C0 xor eax, eax
3800183D |. 59 pop ecx
3800183E |. 8DBD FDFEFFFF lea edi, dword ptr [ebp-103]
38001844 |. F3:AB rep stos dword ptr es:[edi]
38001846 |. 66:AB stos word ptr es:[edi]
38001848 |. AA stos byte ptr es:[edi]
38001849 |. 8D85 FCFEFFFF lea eax, dword ptr [ebp-104]
3800184F |. 68 04010000 push 104 ; /BufSize = 104 (260.)
38001854 |. 50 push eax ; |PathBuffer
38001855 |. 6A 00 push 0 ; |hModule = NULL
38001857 |. FF15 B4400038 call dword ptr [<&KERNEL32.GetModuleF>; \GetModuleFileNameA //得到游戏的路径
3800185D |. 80A5 F8FDFFFF>and byte ptr [ebp-208], 0
38001864 |. 6A 40 push 40
38001866 |. 59 pop ecx
38001867 |. 33C0 xor eax, eax
38001869 |. 8DBD F9FDFFFF lea edi, dword ptr [ebp-207]
3800186F |. F3:AB rep stos dword ptr es:[edi]
38001871 |. 66:AB stos word ptr es:[edi]
38001873 |. AA stos byte ptr es:[edi]
38001874 |. 8D85 FCFEFFFF lea eax, dword ptr [ebp-104]
3800187A |. 50 push eax ; /s
3800187B |. E8 DE190000 call <jmp.&MSVCRT.strlen> ; \strlen
38001880 |. 59 pop ecx
38001881 |. 83E8 0D sub eax, 0D
38001884 |. 50 push eax ; /n
38001885 |. 8D85 FCFEFFFF lea eax, dword ptr [ebp-104] ; |
3800188B |. 50 push eax ; |String2
3800188C |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208] ; |
38001892 |. 50 push eax ; |String1
38001893 |. FF15 60400038 call dword ptr [<&KERNEL32.lstrcpynA>>; \lstrcpynA
38001899 |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
3800189F |. 68 1C510038 push 3800511C ; /src = "AIONLauncherInfo.ini"
380018A4 |. 50 push eax ; |dest
380018A5 |. E8 C0190000 call <jmp.&MSVCRT.strcat> ; \strcat //得到AIONLauncherInfo.ini 路径
380018AA |. 59 pop ecx
380018AB |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
380018B1 |. 59 pop ecx
380018B2 |. 50 push eax ; /IniFileName
380018B3 |. 6A 20 push 20 ; |BufSize = 20 (32.)
380018B5 |. 68 505B0038 push 38005B50 ; |ReturnBuffer = Vch2.38005B50
380018BA |. 68 605C0038 push 38005C60 ; |Default = ""
380018BF |. 68 10510038 push 38005110 ; |Key = "update_name"
380018C4 |. 68 00510038 push 38005100 ; |Section = "LAUNCHER_INFO"
380018C9 |. FF15 5C400038 call dword ptr [<&KERNEL32.GetPrivate>; \GetPrivateProfileStringA //读取ini
380018CF |. 33C0 xor eax, eax
380018D1 |. 5F pop edi
380018D2 |. C9 leave
380018D3 \. C3 retn
38001906 /$ 55 push ebp
38001907 |. 8BEC mov ebp, esp
38001909 |. 81EC 08020000 sub esp, 208
3800190F |. 68 B8500038 push 380050B8 ; ASCII "AION"
38001914 |. E8 19180000 call 38003132 // mibao.asp
38001919 |. 85C0 test eax, eax
3800191B |. 59 pop ecx
3800191C |. 74 47 je short 38001965
3800191E |. 50 push eax ; /src
3800191F |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208] ; |
38001925 |. 50 push eax ; |dest
38001926 |. E8 DD180000 call <jmp.&MSVCRT.strcpy> ; \strcpy
3800192B |. 59 pop ecx
3800192C |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
38001932 |. 59 pop ecx
38001933 |. 68 905B0038 push 38005B90 ; /<%s> = ""
38001938 |. 50 push eax ; |<%s>
38001939 |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208] ; |
3800193F |. 68 38510038 push 38005138 ; |format = "%s?action=testlock&u=%s"
38001944 |. 50 push eax ; |s
38001945 |. E8 26190000 call <jmp.&MSVCRT.sprintf> ; \sprintf
3800194A |. 8D45 F8 lea eax, dword ptr [ebp-8]
3800194D |. 50 push eax
3800194E |. 8D45 FC lea eax, dword ptr [ebp-4]
38001951 |. 50 push eax
38001952 |. 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
38001958 |. 50 push eax
38001959 |. E8 60110000 call 38002ABE
3800195E |. 83C4 1C add esp, 1C
38001961 |. 85C0 test eax, eax
38001963 |. 75 04 jnz short 38001969
38001965 |> 33C0 xor eax, eax
38001967 |. C9 leave
38001968 |. C3 retn
38001969 |> 8B45 FC mov eax, dword ptr [ebp-4]
3800196C |. 8B4D F8 mov ecx, dword ptr [ebp-8]
3800196F |. 68 34510038 push 38005134 ; /s2 = "1"
38001974 |. 802408 00 and byte ptr [eax+ecx], 0 ; |
38001978 |. FF75 FC push dword ptr [ebp-4] ; |s1
3800197B |. E8 D8180000 call <jmp.&MSVCRT._stricmp> ; \_stricmp
38001980 |. 59 pop ecx
38001981 |. 85C0 test eax, eax
38001983 |. 59 pop ecx
38001984 |. 75 2D jnz short 380019B3
38001986 |. 56 push esi
38001987 |. FF15 6C400038 call dword ptr [<&KERNEL32.GetCurrent>; [GetCurrentProcessId
3800198D |. 50 push eax ; /ProcessId
3800198E |. 6A 00 push 0 ; |Inheritable = FALSE
38001990 |. 6A 01 push 1 ; |Access = TERMINATE
38001992 |. FF15 2C400038 call dword ptr [<&KERNEL32.OpenProces>; \OpenProcess
38001998 |. 8B35 68400038 mov esi, dword ptr [<&KERNEL32.Termi>; kernel32.TerminateProcess
3800199E |. 85C0 test eax, eax
380019A0 |. 74 05 je short 380019A7
380019A2 |. 6A 00 push 0 ; /ExitCode = 0
380019A4 |. 50 push eax ; |hProcess
380019A5 |. FFD6 call esi ; \TerminateProcess
380019A7 |> 6A 00 push 0
380019A9 |. FF15 64400038 call dword ptr [<&KERNEL32.GetCurrent>; [GetCurrentProcess
380019AF |. 50 push eax
380019B0 |. FFD6 call esi
380019B2 |. 5E pop esi
380019B3 |> 6A 01 push 1
380019B5 |. 58 pop eax
380019B6 |. C9 leave
380019B7 \. C3 retn
text:380019DB
.text:380019DB push ebp
.text:380019DC mov ebp, esp
.text:380019DE push ecx
.text:380019DF push ebx
.text:380019E0 push esi
.text:380019E1 push edi
.text:380019E2 push offset ModuleName ; "Game.dll"
.text:380019E7 call sub_380027CF //加载game.dll
.text:380019EC mov edi, eax
.text:380019EE pop ecx
.text:380019EF test edi, edi
.text:380019F1 jz loc_38001B5E //失败退出
.text:380019F7 mov esi, ds:Sleep
.text:380019FD push 0C350h ; dwMilliseconds
.text:38001A02 call esi ; Sleep
.text:38001A04 mov ebx, offset Str
.text:38001A09
.text:38001A09 loc_38001A09: ; CODE XREF: sub_380019DB+132j
.text:38001A09 ; sub_380019DB+142j
.text:38001A09 push 4E20h ; dwMilliseconds
.text:38001A0E call esi ; Sleep
.text:38001A10 mov edx, edx
.text:38001A12 nop
.text:38001A13 mov ecx, ecx
.text:38001A15 nop
.text:38001A16 nop
.text:38001A17 mov eax, eax
.text:38001A19 nop
.text:38001A1A mov ecx, ecx
.text:38001A1C lea eax, [edi+54FEDCh]
.text:38001A22 mov dword_38005C50, eax
.text:38001A27 lea eax, [edi+54FEE0h]
.text:38001A2D mov dword_38005C54, eax
.text:38001A32 mov eax, dword_38005C50
.text:38001A37 mov eax, [eax]
.text:38001A39 mov dword_38005C50, eax
.text:38001A3E mov eax, dword_38005C54
.text:38001A43 mov eax, [eax]
.text:38001A45 mov dword_38005C54, eax
.text:38001A4A mov eax, dword_38005C54
.text:38001A4F sub eax, dword_38005C50
.text:38001A55 mov dword_38005C4C, eax
.text:38001A5A sar dword_38005C4C, 2
.text:38001A61 and [ebp+var_4], 0
.text:38001A65 cmp dword_38005C4C, 0
.text:38001A6C jbe loc_38001B03
.text:38001A72
.text:38001A72 loc_38001A72: ; CODE XREF: sub_380019DB+122j
.text:38001A72 mov eax, dword_38005C50
.text:38001A77 mov ecx, [ebp+var_4]
.text:38001A7A mov eax, [eax+ecx*4]
.text:38001A7D mov dword_38005C58, eax
.text:38001A82 cmp dword_38005C58, 0
.text:38001A89 jz short loc_38001AF1
.text:38001A8B mov eax, dword_38005C58
.text:38001A90 mov dword_38005C5C, eax
.text:38001A95 cmp dword_38005C5C, 0
.text:38001A9C jz short loc_38001AF1
.text:38001A9E mov eax, dword_38005C58
.text:38001AA3 add eax, 4
.text:38001AA6 push eax ; lpWideCharStr
.text:38001AA7 push offset Str ; lpMultiByteStr
.text:38001AAC call sub_380029C5
.text:38001AB1 mov eax, dword_38005C58
.text:38001AB6 add eax, 34h
.text:38001AB9 mov ecx, [eax]
.text:38001ABB cmp ecx, 1
.text:38001ABE jz short loc_38001AD1
.text:38001AC0 push offset asc_38005048 ; "人族"
.text:38001AC5 push offset byte_38005C30 ; Dest
.text:38001ACA call sub_38002915
.text:38001ACF jmp short loc_38001AE0
.text:38001AD1 ; ---------------------------------------------------------------------------
.text:38001AD1
.text:38001AD1 loc_38001AD1: ; CODE XREF: sub_380019DB+E3j
.text:38001AD1 push offset aZX ; "魔族"
.text:38001AD6 push offset byte_38005C30 ; Dest
.text:38001ADB call sub_38002915
.text:38001AE0
.text:38001AE0 loc_38001AE0: ; CODE XREF: sub_380019DB+F4j
.text:38001AE0 mov eax, dword_38005C58
.text:38001AE5 add eax, 94h
.text:38001AEA mov eax, [eax]
.text:38001AEC mov dword_38005B3C, eax
.text:38001AF1
.text:38001AF1 loc_38001AF1: ; CODE XREF: sub_380019DB+AEj
.text:38001AF1 ; sub_380019DB+C1j
.text:38001AF1 inc [ebp+var_4]
.text:38001AF4 mov eax, [ebp+var_4]
.text:38001AF7 cmp eax, dword_38005C4C
.text:38001AFD jb loc_38001A72
.text:38001B03
.text:38001B03 loc_38001B03: ; CODE XREF: sub_380019DB+91j
.text:38001B03 push ebx ; Str
.text:38001B04 call strlen
.text:38001B09 cmp eax, 2
.text:38001B0C pop ecx
.text:38001B0D jb loc_38001A09
.text:38001B13 push ebx ; Str
.text:38001B14 call strlen
.text:38001B19 cmp eax, 14h
.text:38001B1C pop ecx
.text:38001B1D ja loc_38001A09
.text:38001B23 add edi, 5933FCh
.text:38001B29 mov dword_38005C4C, edi
.text:38001B2F mov eax, dword_38005C4C
.text:38001B34 mov eax, [eax]
.text:38001B36 add eax, 18h
.text:38001B39 mov eax, [eax]
.text:38001B3B mov dword_38005B2C, eax
.text:38001B40 push 5 ; dwMilliseconds
.text:38001B42 call esi ; Sleep
.text:38001B44 call sub_38001B65
.text:38001B49 push 5 ; dwMilliseconds
.text:38001B4B call esi ; Sleep
.text:38001B4D call sub_38001C1F
.text:38001B52 push 1F4h ; dwMilliseconds
.text:38001B57 call esi ; Sleep
.text:38001B59 call sub_38001D2A
.text:38001B5E
.text:38001B5E loc_38001B5E: ; CODE XREF: sub_380019DB+16j
.text:38001B5E pop edi
.text:38001B5F pop esi
.text:38001B60 pop ebx
.text:38001B61 leave
.text:38001B62 retn 4
.text:38001B62 sub_380019DB endp
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
