64,654
社区成员
发帖
与我相关
我的任务
分享请发表友善的回复…
发表回复
kemengli 2012-01-18
- 打赏
- 举报
汇编看不懂，谢谢
那个网址我在网上看过，我想要可以运行的源代码。
那个网址我在网上看过，我想要可以运行的源代码。
赵4老师 2012-01-16
- 打赏
- 举报
; *** WlxLoggedOutSAS (11) ***
; SYM:WlxLoggedOutSAS#2E1F
0x77ca2e1f 55 push ebp
0x77ca2e20 8bec mov ebp,esp
0x77ca2e22 83ec20 sub esp,0x20
0x77ca2e25 8b4514 mov eax,[ebp+0x14]
0x77ca2e28 53 push ebx
0x77ca2e29 56 push esi
0x77ca2e2a 8b7508 mov esi,[ebp+0x8]
0x77ca2e2d 57 push edi
0x77ca2e2e 894628 mov [esi+0x28],eax
0x77ca2e31 e8a9010000 call 0x77ca2fdf
0x77ca2e36 85c0 test eax,eax
0x77ca2e38 0f851b8e0000 jne 0x77cabc59 ; (*+0x8E21)
0x77ca2e3e 8b4518 mov eax,[ebp+0x18]
0x77ca2e41 8b00 mov eax,[eax]
0x77ca2e43 83e008 and eax,0x8
0x77ca2e46 8986c0090000 mov [esi+0x9c0],eax
0x77ca2e4c 6a10 push 0x10
0x77ca2e4e 8d5e58 lea ebx,[esi+0x58]
0x77ca2e51 59 pop ecx
0x77ca2e52 33c0 xor eax,eax
0x77ca2e54 ff750c push dword ptr [ebp+0xc]
0x77ca2e57 8bfb mov edi,ebx
0x77ca2e59 f3ab rep stosd
0x77ca2e5b 56 push esi
0x77ca2e5c e81c020000 call 0x77ca307d
0x77ca2e61 83f801 cmp eax,0x1
0x77ca2e64 0f85d28e0000 jne 0x77cabd3c ; (*+0x8ED8)
0x77ca2e6a 8b4d1c mov ecx,[ebp+0x1c]
0x77ca2e6d 8b03 mov eax,[ebx]
0x77ca2e6f 8dbeb0040000 lea edi,[esi+0x4b0]
0x77ca2e75 8d9eb8040000 lea ebx,[esi+0x4b8]
0x77ca2e7b 8901 mov [ecx],eax
0x77ca2e7d 8b4510 mov eax,[ebp+0x10]
0x77ca2e80 8b8ec8040000 mov ecx,[esi+0x4c8]
0x77ca2e86 8908 mov [eax],ecx
0x77ca2e88 8b8ecc040000 mov ecx,[esi+0x4cc]
0x77ca2e8e 894804 mov [eax+0x4],ecx
0x77ca2e91 8b4518 mov eax,[ebp+0x18]
0x77ca2e94 832000 and dword ptr [eax],0x0
0x77ca2e97 8b8e98040000 mov ecx,[esi+0x498]
0x77ca2e9d 8d8698040000 lea eax,[esi+0x498]
0x77ca2ea3 890f mov [edi],ecx
0x77ca2ea5 8b4004 mov eax,[eax+0x4]
0x77ca2ea8 894704 mov [edi+0x4],eax
0x77ca2eab 8b86a4040000 mov eax,[esi+0x4a4]
0x77ca2eb1 8903 mov [ebx],eax
0x77ca2eb3 8b86a8040000 mov eax,[esi+0x4a8]
0x77ca2eb9 894304 mov [ebx+0x4],eax
0x77ca2ebc 8b86ac040000 mov eax,[esi+0x4ac]
0x77ca2ec2 66833800 cmp word ptr [eax],0x0
0x77ca2ec6 0f84998d0000 je 0x77cabc65 ; (*+0x8D9F)
0x77ca2ecc ffb6b4040000 push dword ptr [esi+0x4b4]
0x77ca2ed2 e8c0150000 call 0x77ca4497
0x77ca2ed7 8b5d20 mov ebx,[ebp+0x20]
0x77ca2eda 8903 mov [ebx],eax
0x77ca2edc ffb6bc040000 push dword ptr [esi+0x4bc]
0x77ca2ee2 e8b0150000 call 0x77ca4497
0x77ca2ee7 8dbeec040000 lea edi,[esi+0x4ec]
0x77ca2eed 894304 mov [ebx+0x4],eax
0x77ca2ef0 57 push edi
0x77ca2ef1 e8ad250000 call 0x77ca54a3
0x77ca2ef6 ffb6f4040000 push dword ptr [esi+0x4f4]
0x77ca2efc e896150000 call 0x77ca4497
0x77ca2f01 894308 mov [ebx+0x8],eax
0x77ca2f04 8d86c4040000 lea eax,[esi+0x4c4]
0x77ca2f0a 57 push edi
0x77ca2f0b 50 push eax
0x77ca2f0c e8431f0000 call 0x77ca4e54
0x77ca2f11 80bec604000000 cmp byte ptr [esi+0x4c6],0x0
0x77ca2f18 0f85d48d0000 jne 0x77cabcf2 ; (*+0x8DDA)
0x77ca2f1e 83630c00 and dword ptr [ebx+0xc],0x0
0x77ca2f22 6a18 push 0x18
0x77ca2f24 6a00 push 0x0
0x77ca2f26 ff150812ca77 call dword ptr [0x77ca1208] ; EXT:KERNEL32.DLL!LocalAlloc
0x77ca2f2c 8bf8 mov edi,eax
0x77ca2f2e 85ff test edi,edi
0x77ca2f30 0f849a000000 je 0x77ca2fd0 ; (*+0xA0)
0x77ca2f36 8b86e0040000 mov eax,[esi+0x4e0]
0x77ca2f3c c7451801000000 mov dword ptr [ebp+0x18],0x1
0x77ca2f43 f6406804 test byte ptr [eax+0x68],0x4
0x77ca2f47 0f85d18d0000 jne 0x77cabd1e ; (*+0x8DD7)
0x77ca2f4d 8d4508 lea eax,[ebp+0x8]
0x77ca2f50 c7450810000000 mov dword ptr [ebp+0x8],0x10
0x77ca2f57 50 push eax
0x77ca2f58 8d45e0 lea eax,[ebp-0x20]
0x77ca2f5b 50 push eax
0x77ca2f5c ff153c11ca77 call dword ptr [0x77ca113c] ; EXT:KERNEL32.DLL!GetComputerNameW
0x77ca2f62 85c0 test eax,eax
0x77ca2f64 7418 jz 0x77ca2f7e ; (*+0x1A)
0x77ca2f66 8d45e0 lea eax,[ebp-0x20]
0x77ca2f69 50 push eax
0x77ca2f6a ffb6ac040000 push dword ptr [esi+0x4ac]
0x77ca2f70 ff152812ca77 call dword ptr [0x77ca1228] ; EXT:KERNEL32.DLL!lstrcmpiW
0x77ca2f76 85c0 test eax,eax
0x77ca2f78 0f84a08d0000 je 0x77cabd1e ; (*+0x8DA6)
0x77ca2f7e c70702000000 mov dword ptr [edi],0x2 ; <==0x77CA2F64(*-0x1A)
0x77ca2f84 ff33 push dword ptr [ebx]
0x77ca2f86 56 push esi
0x77ca2f87 e8a4280000 call 0x77ca5830
0x77ca2f8c 33db xor ebx,ebx
0x77ca2f8e 894704 mov [edi+0x4],eax
0x77ca2f91 395d18 cmp [ebp+0x18],ebx
0x77ca2f94 0f848d8d0000 je 0x77cabd27 ; (*+0x8D93)
0x77ca2f9a 56 push esi
0x77ca2f9b e819290000 call 0x77ca58b9
0x77ca2fa0 395d18 cmp [ebp+0x18],ebx
0x77ca2fa3 894708 mov [edi+0x8],eax
0x77ca2fa6 0f84828d0000 je 0x77cabd2e ; (*+0x8D88)
0x77ca2fac 56 push esi
0x77ca2fad e870290000 call 0x77ca5922
0x77ca2fb2 395d18 cmp [ebp+0x18],ebx
0x77ca2fb5 89470c mov [edi+0xc],eax
0x77ca2fb8 0f84778d0000 je 0x77cabd35 ; (*+0x8D7D)
0x77ca2fbe 56 push esi
0x77ca2fbf e8c7290000 call 0x77ca598b
0x77ca2fc4 56 push esi
0x77ca2fc5 894710 mov [edi+0x10],eax
0x77ca2fc8 e8172a0000 call 0x77ca59e4
0x77ca2fcd 894714 mov [edi+0x14],eax
0x77ca2fd0 8b4524 mov eax,[ebp+0x24] ; <==0x77CA2F30(*-0xA0)
0x77ca2fd3 6a01 push 0x1
0x77ca2fd5 8938 mov [eax],edi
0x77ca2fd7 58 pop eax
0x77ca2fd8 5f pop edi
0x77ca2fd9 5e pop esi
0x77ca2fda 5b pop ebx
0x77ca2fdb c9 leave
0x77ca2fdc c22000 ret 0x20
;********************************************************************************
0x77ca2fdf 55 push ebp ; <==0x77CA2E31(*-0x1AE)
0x77ca2fe0 8bec mov ebp,esp
0x77ca2fe2 83ec18 sub esp,0x18
0x77ca2fe5 53 push ebx
0x77ca2fe6 56 push esi
0x77ca2fe7 8d45f8 lea eax,[ebp-0x8]
0x77ca2fea 57 push edi
0x77ca2feb 33db xor ebx,ebx
0x77ca2fed 50 push eax
0x77ca2fee 6819000200 push 0x20019
0x77ca2ff3 53 push ebx
0x77ca2ff4 68086bca77 push 0x77ca6b08 ; DATA:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
0x77ca2ff9 6802000080 push 0x80000002
0x77ca2ffe 895dec mov [ebp-0x14],ebx
0x77ca3001 895df0 mov [ebp-0x10],ebx
0x77ca3004 ff15ac12ca77 call dword ptr [0x77ca12ac] ; EXT:ADVAPI32.DLL!RegOpenKeyExW
0x77ca300a 85c0 test eax,eax
0x77ca300c 7556 jnz 0x77ca3064 ; (*+0x58)
0x77ca300e 6a04 push 0x4
0x77ca3010 8d45fc lea eax,[ebp-0x4]
0x77ca3013 5f pop edi
0x77ca3014 8b35b012ca77 mov esi,[0x77ca12b0] ; EXT:ADVAPI32.DLL!RegQueryValueExW
……
(^_^)
薛定谔之死猫 2012-01-16
- 打赏
- 举报
http://blog.chinaunix.net/space.php?uid=21880738&do=blog&id=1813140
