代码。只贴核心部分,其他的包括后续攻击不贴了。
004DA260 55 PUSH EBP
004DA261 8BEC MOV EBP,ESP
004DA263 51 PUSH ECX
004DA264 FF31 PUSH DWORD PTR DS:[ECX]
004DA266 6A 02 PUSH 2
004DA268 FFB1 C9020000 PUSH DWORD PTR DS:[ECX+2C9]
004DA26E FF71 01 PUSH DWORD PTR DS:[ECX+1]
004DA271 B9 50424B00 MOV ECX,004B4250
004DA276 E8 C2B0F7FF CALL 0045533D
004DA27B 3C FF CMP AL,0FF
004DA27D 74 1E JE SHORT 004DA29D
004DA27F 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004DA282 8842 0C MOV BYTE PTR DS:[EDX+C],AL
004DA285 FFB2 A8040000 PUSH DWORD PTR DS:[EDX+4A8]
004DA28B 50 PUSH EAX
004DA28C FF72 01 PUSH DWORD PTR DS:[EDX+1]
004DA28F FF32 PUSH DWORD PTR DS:[EDX]
004DA291 E8 8C61F4FF CALL 00420422
004DA296 83C4 10 ADD ESP,10
004DA299 85C0 TEST EAX,EAX
004DA29B 75 05 JNZ SHORT 004DA2A2
004DA29D E9 72000000 JMP 004DA314
004DA2A2 68 FF000000 PUSH 0FF
004DA2A7 6A 78 PUSH 78
004DA2A9 68 F06A5000 PUSH 00506AF0
004DA2AE E8 605AFAFF CALL 0047FD13
004DA2B3 83C4 0C ADD ESP,0C
004DA2B6 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004DA2B9 8A4A 0C MOV CL,BYTE PTR DS:[EDX+C]
004DA2BC 884A 0D MOV BYTE PTR DS:[EDX+D],CL
004DA2BF 880D F06A5000 MOV BYTE PTR DS:[506AF0],CL
004DA2C5 E8 0867FFFF CALL 004D09D2
004DA2CA 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004DA2CD FF32 PUSH DWORD PTR DS:[EDX]
004DA2CF 51 PUSH ECX
004DA2D0 8B4A 08 MOV ECX,DWORD PTR DS:[EDX+8]
004DA2D3 E8 FD11F6FF CALL 0043B4D5
004DA2D8 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004DA2DB 85C0 TEST EAX,EAX
004DA2DD 74 06 JE SHORT 004DA2E5
004DA2DF 8A82 54020000 MOV AL,BYTE PTR DS:[EDX+254]
004DA2E5 8882 55020000 MOV BYTE PTR DS:[EDX+255],AL
004DA2EB 84C0 TEST AL,AL
004DA2ED 74 08 JE SHORT 004DA2F7
004DA2EF 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004DA2F2 E8 F9000000 CALL 004DA3F0
004DA2F7 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004DA2FA E8 C071F4FF CALL 004214BF
004DA2FF 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004DA302 E8 A181F4FF CALL 004224A8
004DA307 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004DA30A C781 AC040000 01>MOV DWORD PTR DS:[ECX+4AC],1
004DA314 8BE5 MOV ESP,EBP
004DA316 5D POP EBP
004DA317 C3 RETN
004DA3F0 55 PUSH EBP
004DA3F1 8BEC MOV EBP,ESP
004DA3F3 51 PUSH ECX
004DA3F4 6A 08 PUSH 8
004DA3F6 8A49 0C MOV CL,BYTE PTR DS:[ECX+C]
004DA3F9 880D F06A5000 MOV BYTE PTR DS:[506AF0],CL
004DA3FF 51 PUSH ECX
004DA400 E8 1BFFFFFF CALL 004DA320
004DA405 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004DA408 33D2 XOR EDX,EDX
004DA40A 8A82 F16A5000 MOV AL,BYTE PTR DS:[EDX+506AF1]
004DA410 3C FF CMP AL,0FF
004DA412 74 13 JE SHORT 004DA427
004DA414 884411 0E MOV BYTE PTR DS:[ECX+EDX+E],AL
004DA418 C68411 56020000 >MOV BYTE PTR DS:[ECX+EDX+256],60
004DA420 8345 F8 02 ADD DWORD PTR SS:[EBP-8],2
004DA424 42 INC EDX
004DA425 ^EB E3 JMP SHORT 004DA40A
004DA427 FF75 F8 PUSH DWORD PTR SS:[EBP-8]
004DA42A 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004DA42D E8 9E6DF4FF CALL 004211D0
004DA432 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004DA435 8981 D0020000 MOV DWORD PTR DS:[ECX+2D0],EAX
004DA43B 8BE5 MOV ESP,EBP
004DA43D 5D POP EBP
004DA43E C3 RETN
004DA320 55 PUSH EBP
004DA321 8BEC MOV EBP,ESP
004DA323 83EC 18 SUB ESP,18
004DA326 33C0 XOR EAX,EAX
004DA328 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
004DA32B 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
004DA32E 48 DEC EAX
004DA32F 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
004DA332 8A4D 08 MOV CL,BYTE PTR SS:[EBP+8]
004DA335 E8 9866FFFF CALL 004D09D2
004DA33A E8 2190F2FF CALL 00403360
004DA33F 50 PUSH EAX
004DA340 8D4D F0 LEA ECX,DWORD PTR SS:[EBP-10]
004DA343 E8 58C2F2FF CALL 004065A0
004DA348 EB 03 JMP SHORT 004DA34D
004DA34A FF45 FC INC DWORD PTR SS:[EBP-4]
004DA34D 837D FC 04 CMP DWORD PTR SS:[EBP-4],4
004DA351 7D 6D JGE SHORT 004DA3C0
004DA353 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004DA356 0FB645 F0 MOVZX EAX,BYTE PTR SS:[EBP-10]
004DA35A 0304CD 00D74800 ADD EAX,DWORD PTR DS:[ECX*8+48D700]
004DA361 8845 E8 MOV BYTE PTR SS:[EBP-18],AL
004DA364 0FB655 F1 MOVZX EDX,BYTE PTR SS:[EBP-F]
004DA368 0314CD 04D74800 ADD EDX,DWORD PTR DS:[ECX*8+48D704]
004DA36F 8855 E9 MOV BYTE PTR SS:[EBP-17],DL
004DA372 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18]
004DA375 51 PUSH ECX
004DA376 E8 09B5F5FF CALL 00435884
004DA37B 83C4 04 ADD ESP,4
004DA37E 3C FF CMP AL,0FF
004DA380 ^74 C8 JE SHORT 004DA34A
004DA382 3C 23 CMP AL,23
004DA384 ^7C C4 JL SHORT 004DA34A
004DA386 8845 F4 MOV BYTE PTR SS:[EBP-C],AL
004DA389 8AC8 MOV CL,AL
004DA38B E8 4266FFFF CALL 004D09D2
004DA390 E8 FBE8F3FF CALL 00418C90
004DA395 3C 02 CMP AL,2
004DA397 ^75 B1 JNZ SHORT 004DA34A
004DA399 8A45 F4 MOV AL,BYTE PTR SS:[EBP-C]
004DA39C 33D2 XOR EDX,EDX
004DA39E B9 F06A5000 MOV ECX,00506AF0
004DA3A3 380411 CMP BYTE PTR DS:[ECX+EDX],AL
004DA3A6 ^74 A2 JE SHORT 004DA34A
004DA3A8 803C11 FF CMP BYTE PTR DS:[ECX+EDX],0FF
004DA3AC 74 03 JE SHORT 004DA3B1
004DA3AE 42 INC EDX
004DA3AF ^EB F2 JMP SHORT 004DA3A3
004DA3B1 880411 MOV BYTE PTR DS:[ECX+EDX],AL
004DA3B4 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
004DA3B7 88442A EC MOV BYTE PTR DS:[EDX+EBP-14],AL
004DA3BB FF45 F8 INC DWORD PTR SS:[EBP-8]
004DA3BE ^EB 8A JMP SHORT 004DA34A
004DA3C0 C745 FC 00000000 MOV DWORD PTR SS:[EBP-4],0
004DA3C7 EB 03 JMP SHORT 004DA3CC
004DA3C9 FF45 FC INC DWORD PTR SS:[EBP-4]
004DA3CC 837D FC 04 CMP DWORD PTR SS:[EBP-4],4
004DA3D0 7D 13 JGE SHORT 004DA3E5
004DA3D2 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004DA3D5 8A442A EC MOV AL,BYTE PTR DS:[EDX+EBP-14]
004DA3D9 3C FF CMP AL,0FF
004DA3DB ^74 EC JE SHORT 004DA3C9
004DA3DD 50 PUSH EAX
004DA3DE E8 3DFFFFFF CALL 004DA320
004DA3E3 ^EB E4 JMP SHORT 004DA3C9
004DA3E5 8BE5 MOV ESP,EBP
004DA3E7 5D POP EBP
004DA3E8 C2 0400 RETN 4
|