TA的每日心情 | 奋斗
2020-6-5 22:18 |
|---|
签到天数: 22 天 [LV.4]偶尔看看III
|
|
欢迎您注册加入！这里有您将更精采！
您需要 登录 才可以下载或查看，没有账号？注册
x
在整理硬盘时找到这些记录，由于记录时间已经很长仅供参考：
0047D3F0 /$ 55 PUSH EBP
0047D3F1 |. 8BEC MOV EBP,ESP
0047D3F3 |. 81EC 28010000 SUB ESP,128
0047D3F9 |. A0 1C498800 MOV AL,BYTE PTR DS:[88491C]
0047D3FE |. 53 PUSH EBX
0047D3FF |. 56 PUSH ESI
0047D400 |. 57 PUSH EDI
0047D401 |. 8BD9 MOV EBX,ECX
0047D403 |. 8885 D8FEFFFF MOV BYTE PTR SS:[EBP-128],AL
0047D409 |. B9 3F000000 MOV ECX,3F
0047D40E |. 33C0 XOR EAX,EAX
0047D410 |. 8DBD D9FEFFFF LEA EDI,DWORD PTR SS:[EBP-127]
0047D416 |. 68 80AF8600 PUSH ZeroOnli.0086AF80 ; /mode = "rb"
0047D41B |. F3:AB REP STOS DWORD PTR ES:[EDI] ; |
0047D41D |. 66:AB STOS WORD PTR ES:[EDI] ; |
0047D41F |. AA STOS BYTE PTR ES:[EDI] ; |
0047D420 |. 33FF XOR EDI,EDI ; |
0047D422 |. 68 70AF8600 PUSH ZeroOnli.0086AF70 ; |path = "ini//Oem.dat"
0047D427 |. 897D F4 MOV DWORD PTR SS:[EBP-C],EDI ; |
0047D42A |. FF15 C82A8300 CALL DWORD PTR DS:[<&MSVCRT.fopen>] ; \fopen
0047D430 |. 8BF0 MOV ESI,EAX
0047D432 |. 83C4 08 ADD ESP,8
0047D435 |. 3BF7 CMP ESI,EDI
0047D437 |. 75 1F JNZ SHORT ZeroOnli.0047D458
0047D439 |. 897D F4 MOV DWORD PTR SS:[EBP-C],EDI
0047D43C |. 33C0 XOR EAX,EAX
0047D43E |> 8A88 60AF8600 /MOV CL,BYTE PTR DS:[EAX+86AF60] ; 循环10次
0047D444 |. 888C05 D8FEFF>|MOV BYTE PTR SS:[EBP+EAX-128],CL
0047D44B |. 40 |INC EAX
0047D44C |. 84C9 |TEST CL,CL
0047D44E |.^ 75 EE \JNZ SHORT ZeroOnli.0047D43E
0047D450 |. 8B3D DC2A8300 MOV EDI,DWORD PTR DS:[<&MSVCRT.fread>] ; msvcrt.fread
0047D456 |. EB 4F JMP SHORT ZeroOnli.0047D4A7
0047D458 |> 8B3D DC2A8300 MOV EDI,DWORD PTR DS:[<&MSVCRT.fread>] ; msvcrt.fread
0047D45E |. 56 PUSH ESI ; /stream
0047D45F |. 6A 01 PUSH 1 ; |n = 1
0047D461 |. 8D4D F4 LEA ECX,DWORD PTR SS:[EBP-C] ; |
0047D464 |. 6A 04 PUSH 4 ; |size = 4
0047D466 |. 51 PUSH ECX ; |ptr
0047D467 |. FFD7 CALL EDI ; \fread
0047D469 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
0047D46C |. 83C4 10 ADD ESP,10
0047D46F |. 85C0 TEST EAX,EAX
0047D471 |. 75 16 JNZ SHORT ZeroOnli.0047D489
0047D473 |. 33C0 XOR EAX,EAX
0047D475 |> 8A88 60AF8600 /MOV CL,BYTE PTR DS:[EAX+86AF60]
0047D47B |. 888C05 D8FEFF>|MOV BYTE PTR SS:[EBP+EAX-128],CL
0047D482 |. 40 |INC EAX
0047D483 |. 84C9 |TEST CL,CL
0047D485 |.^ 75 EE \JNZ SHORT ZeroOnli.0047D475
0047D487 |. EB 14 JMP SHORT ZeroOnli.0047D49D
0047D489 |> 33C0 XOR EAX,EAX
0047D48B |> 8A88 70AF8600 /MOV CL,BYTE PTR DS:[EAX+86AF70]
0047D491 |. 888C05 D8FEFF>|MOV BYTE PTR SS:[EBP+EAX-128],CL
0047D498 |. 40 |INC EAX
0047D499 |. 84C9 |TEST CL,CL
0047D49B |.^ 75 EE \JNZ SHORT ZeroOnli.0047D48B
0047D49D |> 56 PUSH ESI ; /stream
0047D49E |. FF15 C02A8300 CALL DWORD PTR DS:[<&MSVCRT.fclose>] ; \fclose
0047D4A4 |. 83C4 04 ADD ESP,4
0047D4A7 |> 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
0047D4AA |. 8D85 D8FEFFFF LEA EAX,DWORD PTR SS:[EBP-128]
0047D4B0 |. 68 80AF8600 PUSH ZeroOnli.0086AF80 ; /mode = "rb"
0047D4B5 |. 50 PUSH EAX ; |path
0047D4B6 |. 8915 D0608800 MOV DWORD PTR DS:[8860D0],EDX ; |
0047D4BC |. FF15 C82A8300 CALL DWORD PTR DS:[<&MSVCRT.fopen>] ; \fopen
0047D4C2 |. 8BF0 MOV ESI,EAX
0047D4C4 |. 83C4 08 ADD ESP,8
0047D4C7 |. 85F6 TEST ESI,ESI
0047D4C9 |. 8975 EC MOV DWORD PTR SS:[EBP-14],ESI
0047D4CC |. 0F84 C3020000 JE ZeroOnli.0047D795
0047D4D2 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
0047D4D5 |. 85C0 TEST EAX,EAX
0047D4D7 |. 7E 0E JLE SHORT ZeroOnli.0047D4E7 ; 跳实现
0047D4D9 |. 56 PUSH ESI
0047D4DA |. 6A 01 PUSH 1
0047D4DC |. 8D4D F4 LEA ECX,DWORD PTR SS:[EBP-C]
0047D4DF |. 6A 04 PUSH 4
0047D4E1 |. 51 PUSH ECX
0047D4E2 |. FFD7 CALL EDI
0047D4E4 |. 83C4 10 ADD ESP,10
0047D4E7 |> 56 PUSH ESI
0047D4E8 |. 6A 01 PUSH 1
0047D4EA |. 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
0047D4ED |. 6A 04 PUSH 4
0047D4EF |. 52 PUSH EDX
0047D4F0 |. FFD7 CALL EDI ; 这里进入读取服务器加密DAT
0047D4F2 |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
0047D4F5 |. 33FF XOR EDI,EDI
0047D4F7 |. 83C4 10 ADD ESP,10
0047D4FA |. 3BC7 CMP EAX,EDI
0047D4FC |. 897D E4 MOV DWORD PTR SS:[EBP-1C],EDI
0047D4FF |. 0F8E 86020000 JLE ZeroOnli.0047D78B
0047D505 |. 8DB3 40080000 LEA ESI,DWORD PTR DS:[EBX+840]
0047D50B |. EB 02 JMP SHORT ZeroOnli.0047D50F
0047D50D |> 33FF /XOR EDI,EDI
0047D50F |> 6A 74 PUSH 74
0047D511 |. E8 D0B13800 |CALL <JMP.&MFC42.#823_??2@YAPAXI@Z>
0047D516 |. 83C4 04 |ADD ESP,4
0047D519 |. 3BC7 |CMP EAX,EDI
0047D51B |. 74 13 |JE SHORT ZeroOnli.0047D530
0047D51D |. 8A4D EB |MOV CL,BYTE PTR SS:[EBP-15]
0047D520 |. 8978 68 |MOV DWORD PTR DS:[EAX+68],EDI
0047D523 |. 8848 64 |MOV BYTE PTR DS:[EAX+64],CL
0047D526 |. 8978 6C |MOV DWORD PTR DS:[EAX+6C],EDI
0047D529 |. 8978 70 |MOV DWORD PTR DS:[EAX+70],EDI
0047D52C |. 8BD0 |MOV EDX,EAX
0047D52E |. EB 02 |JMP SHORT ZeroOnli.0047D532
0047D530 |> 33D2 |XOR EDX,EDX
0047D532 |> 8955 FC |MOV DWORD PTR SS:[EBP-4],EDX
0047D535 |. 8B4A 6C |MOV ECX,DWORD PTR DS:[EDX+6C]
0047D538 |. 8B42 68 |MOV EAX,DWORD PTR DS:[EDX+68]
0047D53B |. 3BC9 |CMP ECX,ECX
0047D53D |. 894D F8 |MOV DWORD PTR SS:[EBP-8],ECX
0047D540 |. 74 11 |JE SHORT ZeroOnli.0047D553
0047D542 |> 8B39 |/MOV EDI,DWORD PTR DS:[ECX]
0047D544 |. 83C1 04 ||ADD ECX,4
0047D547 |. 8938 ||MOV DWORD PTR DS:[EAX],EDI
0047D549 |. 8B7D F8 ||MOV EDI,DWORD PTR SS:[EBP-8]
0047D54C |. 83C0 04 ||ADD EAX,4
0047D54F |. 3BCF ||CMP ECX,EDI
0047D551 |.^ 75 EF |\JNZ SHORT ZeroOnli.0047D542
0047D553 |> 8942 6C |MOV DWORD PTR DS:[EDX+6C],EAX
0047D556 |. 8B55 EC |MOV EDX,DWORD PTR SS:[EBP-14]
0047D559 |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4] ; 先读取100字节
0047D55C |. 52 |PUSH EDX ; /stream
0047D55D |. 6A 01 |PUSH 1 ; |n = 1
0047D55F |. 6A 64 |PUSH 64 ; |size = 64 (100.)
0047D561 |. 50 |PUSH EAX ; |ptr
0047D562 |. FF15 DC2A8300 |CALL DWORD PTR DS:[<&MSVCRT.fread>] ; \fread
0047D568 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
0047D56B |. 83C4 10 |ADD ESP,10
0047D56E |. 6A 20 |PUSH 20 ; /先取$20字节解密
0047D570 |. 51 |PUSH ECX ; |ebx为加密DAT字串指针
0047D571 |. 8BCB |MOV ECX,EBX ; |下面核心解密
0047D573 |. E8 F8FDFFFF |CALL ZeroOnli.0047D370 ; \ZeroOnli.0047D370
{
0047D370 /$ 55 PUSH EBP
0047D371 |. 8BEC MOV EBP,ESP
0047D373 |. 83EC 14 SUB ESP,14
0047D376 |. 53 PUSH EBX
0047D377 |. 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8]
0047D37A |. 56 PUSH ESI
0047D37B |. 57 PUSH EDI
0047D37C |. 85DB TEST EBX,EBX
0047D37E |. 74 62 JE SHORT ZeroOnli.0047D3E2
0047D380 |. A1 4CAF8600 MOV EAX,DWORD PTR DS:[86AF4C] ; 解密密钥指针
0047D385 |. 8B0D 50AF8600 MOV ECX,DWORD PTR DS:[86AF50]
0047D38B |. 8B15 54AF8600 MOV EDX,DWORD PTR DS:[86AF54]
0047D391 |. 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
0047D394 |. A1 58AF8600 MOV EAX,DWORD PTR DS:[86AF58]
0047D399 |. 894D F0 MOV DWORD PTR SS:[EBP-10],ECX
0047D39C |. 66:8B0D 5CAF8>MOV CX,WORD PTR DS:[86AF5C]
0047D3A3 |. 8955 F4 MOV DWORD PTR SS:[EBP-C],EDX
0047D3A6 |. 8A15 5EAF8600 MOV DL,BYTE PTR DS:[86AF5E]
0047D3AC |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
0047D3AF |. 66:894D FC MOV WORD PTR SS:[EBP-4],CX
0047D3B3 |. 8D7D EC LEA EDI,DWORD PTR SS:[EBP-14]
0047D3B6 |. 83C9 FF OR ECX,FFFFFFFF
0047D3B9 |. 33C0 XOR EAX,EAX
0047D3BB |. 8855 FE MOV BYTE PTR SS:[EBP-2],DL
0047D3BE |. 33F6 XOR ESI,ESI
0047D3C0 |. F2:AE REPNE SCAS BYTE PTR ES:[EDI]
0047D3C2 |. 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+C]
0047D3C5 |. F7D1 NOT ECX
0047D3C7 |. 49 DEC ECX ; 计算密钥长度
0047D3C8 |. 85FF TEST EDI,EDI
0047D3CA |. 7E 16 JLE SHORT ZeroOnli.0047D3E2
0047D3CC |> 8BC6 /MOV EAX,ESI ; 注意这里，循环$20次
0047D3CE |. 99 |CDQ
0047D3CF |. F7F9 |IDIV ECX
0047D3D1 |. 8A4415 EC |MOV AL,BYTE PTR SS:[EBP+EDX-14] ; 从密钥第一个字节开始取
0047D3D5 |. 8A141E |MOV DL,BYTE PTR DS:[ESI+EBX] ; DAT数据表中从头开始取
0047D3D8 |. 32D0 |XOR DL,AL ; 异或运算
0047D3DA |. 88141E |MOV BYTE PTR DS:[ESI+EBX],DL ; 解密后存入[ESI+EBX]
0047D3DD |. 46 |INC ESI ; 自加1
0047D3DE |. 3BF7 |CMP ESI,EDI ; 判断循环长度是不是$20
0047D3E0 |.^ 7C EA \JL SHORT ZeroOnli.0047D3CC
0047D3E2 |> 5F POP EDI ; 前32字节解密完成
0047D3E3 |. 5E POP ESI
0047D3E4 |. 5B POP EBX
0047D3E5 |. 8BE5 MOV ESP,EBP
0047D3E7 |. 5D POP EBP
0047D3E8 \. C2 0800 RETN 8
}
0047D578 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4] ; 从这个地址开始
0047D57B |. 6A 20 |PUSH 20 ; /Arg2 = 00000020
0047D57D |. 83C2 20 |ADD EDX,20 ; |加上32字节
0047D580 |. 8BCB |MOV ECX,EBX ; |
0047D582 |. 52 |PUSH EDX ; |Arg1
0047D583 |. E8 E8FDFFFF |CALL ZeroOnli.0047D370 ; \这里同上面
0047D588 |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
0047D58B |. 6A 20 |PUSH 20 ; /Arg2 = 00000020
0047D58D |. 83C0 40 |ADD EAX,40 ; |＋64字节
0047D590 |. 8BCB |MOV ECX,EBX ; |
0047D592 |. 50 |PUSH EAX ; |Arg1
0047D593 |. E8 D8FDFFFF |CALL ZeroOnli.0047D370 ; \同上面我不进了
0047D598 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
0047D59B |. 33FF |XOR EDI,EDI
0047D59D |. 8B41 60 |MOV EAX,DWORD PTR DS:[ECX+60] ; 这里判断服务器列表有几个，在官服的有7个，这里只有一个
0047D5A0 |. 85C0 |TEST EAX,EAX ; 在1A30AF8中1字节就是服务器列表总数，这个数在下面循环中的次数
0047D5A2 |. 7E 7D |JLE SHORT ZeroOnli.0047D621
0047D5A4 |> 68 84000000 |/PUSH 84 ; (跳到这里)
0047D5A9 |. E8 38B13800 ||CALL <JMP.&MFC42.#823_??2@YAPAXI@Z> ; 这里在用到NEW函数，在这个OD中看不出来
0047D5AE |. 8B55 EC ||MOV EDX,DWORD PTR SS:[EBP-14] ; 下面读取84字节密文
0047D5B1 |. 8945 F0 ||MOV DWORD PTR SS:[EBP-10],EAX
0047D5B4 |. 52 ||PUSH EDX ; /stream
0047D5B5 |. 6A 01 ||PUSH 1 ; |n = 1
0047D5B7 |. 68 84000000 ||PUSH 84 ; |size = 84 (132.)
0047D5BC |. 50 ||PUSH EAX ; |ptr
0047D5BD |. FF15 DC2A8300 ||CALL DWORD PTR DS:[<&MSVCRT.fread>] ; \fread
0047D5C3 |. 8B45 F0 ||MOV EAX,DWORD PTR SS:[EBP-10] ; 上面密文读完
0047D5C6 |. 83C4 14 ||ADD ESP,14
0047D5C9 |. 8BCB ||MOV ECX,EBX ; 这里有3次和上面解密一样
0047D5CB |. 6A 20 ||PUSH 20 ; /Arg2 = 00000020
0047D5CD |. 50 ||PUSH EAX ; |Arg1
0047D5CE |. E8 9DFDFFFF ||CALL ZeroOnli.0047D370 ; \解密取服务器IP
0047D5D3 |. 8B4D F0 ||MOV ECX,DWORD PTR SS:[EBP-10]
0047D5D6 |. 6A 20 ||PUSH 20 ; /Arg2 = 00000020
0047D5D8 |. 83C1 20 ||ADD ECX,20 ; |
0047D5DB |. 51 ||PUSH ECX ; |Arg1
0047D5DC |. 8BCB ||MOV ECX,EBX ; |
0047D5DE |. E8 8DFDFFFF ||CALL ZeroOnli.0047D370 ; \ZeroOnli.0047D370
0047D5E3 |. 8B55 F0 ||MOV EDX,DWORD PTR SS:[EBP-10]
0047D5E6 |. 6A 20 ||PUSH 20 ; /Arg2 = 00000020
0047D5E8 |. 83C2 40 ||ADD EDX,40 ; |
0047D5EB |. 8BCB ||MOV ECX,EBX ; |
0047D5ED |. 52 ||PUSH EDX ; |Arg1
0047D5EE |. E8 7DFDFFFF ||CALL ZeroOnli.0047D370 ; \ZeroOnli.0047D370
0047D5F3 |. 8B45 F0 ||MOV EAX,DWORD PTR SS:[EBP-10]
0047D5F6 |. 6A 20 ||PUSH 20 ; /Arg2 = 00000020
0047D5F8 |. 83C0 60 ||ADD EAX,60 ; |
0047D5FB |. 8BCB ||MOV ECX,EBX ; |
0047D5FD |. 50 ||PUSH EAX ; |Arg1
0047D5FE |. E8 6DFDFFFF ||CALL ZeroOnli.0047D370 ; \ZeroOnli.0047D370
0047D603 |. 8B4D FC ||MOV ECX,DWORD PTR SS:[EBP-4] ; 现在最后有4字节
0047D606 |. 8D55 F0 ||LEA EDX,DWORD PTR SS:[EBP-10]
0047D609 |. 83C1 64 ||ADD ECX,64
0047D60C |. 52 ||PUSH EDX ; /Arg3
0047D60D |. 6A 01 ||PUSH 1 ; |Arg2 = 00000001
0047D60F |. 8B41 08 ||MOV EAX,DWORD PTR DS:[ECX+8] ; |
0047D612 |. 50 ||PUSH EAX ; |Arg1
0047D613 |. E8 48A50200 ||CALL ZeroOnli.004A7B60 ; \这个里面就是最后4字节解密，这里我还没调用
{
004A7B60 /$ 55 PUSH EBP
004A7B61 |. 8BEC MOV EBP,ESP
004A7B63 |. 83EC 0C SUB ESP,0C
004A7B66 |. 53 PUSH EBX
004A7B67 |. 8BD9 MOV EBX,ECX
004A7B69 |. 56 PUSH ESI
004A7B6A |. 57 PUSH EDI
004A7B6B |. 8B43 08 MOV EAX,DWORD PTR DS:[EBX+8]
004A7B6E |. 8B4B 0C MOV ECX,DWORD PTR DS:[EBX+C]
004A7B71 |. 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+C]
004A7B74 |. 2BC8 SUB ECX,EAX
004A7B76 |. C1F9 02 SAR ECX,2
004A7B79 |. 3BCF CMP ECX,EDI
004A7B7B |. 895D FC MOV DWORD PTR SS:[EBP-4],EBX
004A7B7E |. 0F83 FE000000 JNB ZeroOnli.004A7C82
004A7B84 |. 8B53 04 MOV EDX,DWORD PTR DS:[EBX+4]
004A7B87 |. 85D2 TEST EDX,EDX
004A7B89 |. 74 0B JE SHORT ZeroOnli.004A7B96 ; 跳实现
004A7B8B |. 8BC8 MOV ECX,EAX
004A7B8D |. 2BCA SUB ECX,EDX
004A7B8F |. C1F9 02 SAR ECX,2
004A7B92 |. 3BF9 CMP EDI,ECX
004A7B94 |. 72 02 JB SHORT ZeroOnli.004A7B98
004A7B96 |> 8BCF MOV ECX,EDI
004A7B98 |> 85D2 TEST EDX,EDX
004A7B9A |. 75 04 JNZ SHORT ZeroOnli.004A7BA0
004A7B9C |. 33C0 XOR EAX,EAX
004A7B9E |. EB 05 JMP SHORT ZeroOnli.004A7BA5
004A7BA0 |> 2BC2 SUB EAX,EDX
004A7BA2 |. C1F8 02 SAR EAX,2
004A7BA5 |> 03C1 ADD EAX,ECX
004A7BA7 |. 85C0 TEST EAX,EAX
004A7BA9 |. 8945 F4 MOV DWORD PTR SS:[EBP-C],EAX
004A7BAC |. 7D 02 JGE SHORT ZeroOnli.004A7BB0
004A7BAE |. 33C0 XOR EAX,EAX
004A7BB0 |> 8D1485 000000>LEA EDX,DWORD PTR DS:[EAX*4]
004A7BB7 |. 52 PUSH EDX
004A7BB8 |. E8 290B3600 CALL <JMP.&MFC42.#823_??2@YAPAXI@Z>
004A7BBD |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
004A7BC0 |. 8BC8 MOV ECX,EAX
004A7BC2 |. 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4]
004A7BC5 |. 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8]
004A7BC8 |. 83C4 04 ADD ESP,4
004A7BCB |. 3BC3 CMP EAX,EBX
004A7BCD |. 74 12 JE SHORT ZeroOnli.004A7BE1 ; 跳实现
004A7BCF |> 85C9 /TEST ECX,ECX
004A7BD1 |. 74 04 |JE SHORT ZeroOnli.004A7BD7
004A7BD3 |. 8B10 |MOV EDX,DWORD PTR DS:[EAX]
004A7BD5 |. 8911 |MOV DWORD PTR DS:[ECX],EDX
004A7BD7 |> 83C0 04 |ADD EAX,4
004A7BDA |. 83C1 04 |ADD ECX,4
004A7BDD |. 3BC3 |CMP EAX,EBX
004A7BDF |.^ 75 EE \JNZ SHORT ZeroOnli.004A7BCF
004A7BE1 |> 85FF TEST EDI,EDI
004A7BE3 |. 8BC1 MOV EAX,ECX
004A7BE5 |. 76 13 JBE SHORT ZeroOnli.004A7BFA
004A7BE7 |. 8BD7 MOV EDX,EDI
004A7BE9 |> 85C0 /TEST EAX,EAX
004A7BEB |. 74 07 |JE SHORT ZeroOnli.004A7BF4
004A7BED |. 8B75 10 |MOV ESI,DWORD PTR SS:[EBP+10]
004A7BF0 |. 8B36 |MOV ESI,DWORD PTR DS:[ESI]
004A7BF2 |. 8930 |MOV DWORD PTR DS:[EAX],ESI
004A7BF4 |> 83C0 04 |ADD EAX,4
004A7BF7 |. 4A |DEC EDX
004A7BF8 |.^ 75 EF \JNZ SHORT ZeroOnli.004A7BE9
004A7BFA |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004A7BFD |. 8D34BD 000000>LEA ESI,DWORD PTR DS:[EDI*4]
004A7C04 |. 8B78 08 MOV EDI,DWORD PTR DS:[EAX+8]
004A7C07 |. 8D140E LEA EDX,DWORD PTR DS:[ESI+ECX]
004A7C0A |. 3BDF CMP EBX,EDI
004A7C0C |. 74 1A JE SHORT ZeroOnli.004A7C28 ; 跳实现
004A7C0E |. 8BC2 MOV EAX,EDX
004A7C10 |. 2BC6 SUB EAX,ESI
004A7C12 |. 2BC1 SUB EAX,ECX
004A7C14 |. 03C3 ADD EAX,EBX
004A7C16 |> 85D2 /TEST EDX,EDX
004A7C18 |. 74 04 |JE SHORT ZeroOnli.004A7C1E
004A7C1A |. 8B08 |MOV ECX,DWORD PTR DS:[EAX]
004A7C1C |. 890A |MOV DWORD PTR DS:[EDX],ECX
004A7C1E |> 83C0 04 |ADD EAX,4
004A7C21 |. 83C2 04 |ADD EDX,4
004A7C24 |. 3BC7 |CMP EAX,EDI
004A7C26 |.^ 75 EE \JNZ SHORT ZeroOnli.004A7C16
004A7C28 |> 8B75 FC MOV ESI,DWORD PTR SS:[EBP-4]
004A7C2B |. 8B56 04 MOV EDX,DWORD PTR DS:[ESI+4]
004A7C2E |. 52 PUSH EDX ; /block
004A7C2F |. E8 AC0A3600 CALL <JMP.&MFC42.#825_??3@YAXPAX@Z> ; \free
004A7C34 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
004A7C37 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
004A7C3A |. 83C4 04 ADD ESP,4
004A7C3D |. 8D0C82 LEA ECX,DWORD PTR DS:[EDX+EAX*4]
004A7C40 |. 894E 0C MOV DWORD PTR DS:[ESI+C],ECX
004A7C43 |. 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]
004A7C46 |. 85C9 TEST ECX,ECX
004A7C48 |. 75 19 JNZ SHORT ZeroOnli.004A7C63
004A7C4A |. 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+C]
004A7C4D |. 33C0 XOR EAX,EAX
004A7C4F |. 8BC1 MOV EAX,ECX
004A7C51 |. 8956 04 MOV DWORD PTR DS:[ESI+4],EDX
004A7C54 |. 5F POP EDI
004A7C55 |. 8D0482 LEA EAX,DWORD PTR DS:[EDX+EAX*4]
004A7C58 |. 8946 08 MOV DWORD PTR DS:[ESI+8],EAX
004A7C5B |. 5E POP ESI
004A7C5C |. 5B POP EBX
004A7C5D |. 8BE5 MOV ESP,EBP
004A7C5F |. 5D POP EBP
004A7C60 |. C2 0C00 RETN 0C
}
0047D618 |. 8B4D FC ||MOV ECX,DWORD PTR SS:[EBP-4] ; 完成后把解密的内容存在
0047D61B |. 47 ||INC EDI ; 自加1
0047D61C |. 3B79 60 ||CMP EDI,DWORD PTR DS:[ECX+60] ; 和服务器表个数比较，如果官服的这里有7个要循环7次
0047D61F |.^ 7C 83 |\JL SHORT ZeroOnli.0047D5A4 ; 这里没跳，解密完成
0047D621 |> 8B46 08 |MOV EAX,DWORD PTR DS:[ESI+8]
0047D624 |. 8B56 0C |MOV EDX,DWORD PTR DS:[ESI+C]
0047D627 |. 2BD0 |SUB EDX,EAX
0047D629 |. 8BF8 |MOV EDI,EAX
0047D62B |. C1FA 02 |SAR EDX,2
0047D62E |. 83FA 01 |CMP EDX,1
0047D631 |. 0F83 B2000000 |JNB ZeroOnli.0047D6E9
0047D637 |. 8B4E 04 |MOV ECX,DWORD PTR DS:[ESI+4]
0047D63A |. 85C9 |TEST ECX,ECX
0047D63C |. 74 16 |JE SHORT ZeroOnli.0047D654
0047D63E |. 2BC1 |SUB EAX,ECX
0047D640 |. C1F8 02 |SAR EAX,2
0047D643 |. 83F8 01 |CMP EAX,1
0047D646 |. 76 0C |JBE SHORT ZeroOnli.0047D654
0047D648 |. 8BCE |MOV ECX,ESI
0047D64A |. E8 C1BE1900 |CALL ZeroOnli.00619510
0047D64F |. 8945 F8 |MOV DWORD PTR SS:[EBP-8],EAX
0047D652 |. EB 07 |JMP SHORT ZeroOnli.0047D65B
0047D654 |> C745 F8 01000>|MOV DWORD PTR SS:[EBP-8],1
0047D65B |> 8BCE |MOV ECX,ESI
0047D65D |. E8 AEBE1900 |CALL ZeroOnli.00619510
0047D662 |. 0345 F8 |ADD EAX,DWORD PTR SS:[EBP-8]
0047D665 |. 8945 D8 |MOV DWORD PTR SS:[EBP-28],EAX
0047D668 |. 79 02 |JNS SHORT ZeroOnli.0047D66C
0047D66A |. 33C0 |XOR EAX,EAX
0047D66C |> C1E0 02 |SHL EAX,2
0047D66F |. 50 |PUSH EAX
0047D670 |. E8 71B03800 |CALL <JMP.&MFC42.#823_??2@YAPAXI@Z>
0047D675 |. 8B4E 04 |MOV ECX,DWORD PTR DS:[ESI+4]
0047D678 |. 83C4 04 |ADD ESP,4
0047D67B |. 8945 DC |MOV DWORD PTR SS:[EBP-24],EAX
0047D67E |. 50 |PUSH EAX ; /Arg3
0047D67F |. 57 |PUSH EDI ; |Arg2
0047D680 |. 51 |PUSH ECX ; |Arg1
0047D681 |. 8BCE |MOV ECX,ESI ; |
0047D683 |. E8 F8EBFCFF |CALL ZeroOnli.0044C280 ; \ZeroOnli.0044C280
0047D688 |. 8D55 FC |LEA EDX,DWORD PTR SS:[EBP-4]
0047D68B |. 8BCE |MOV ECX,ESI
0047D68D |. 52 |PUSH EDX ; /Arg3
0047D68E |. 6A 01 |PUSH 1 ; |Arg2 = 00000001
0047D690 |. 50 |PUSH EAX ; |Arg1
0047D691 |. 8945 F8 |MOV DWORD PTR SS:[EBP-8],EAX ; |
0047D694 |. E8 17ECFCFF |CALL ZeroOnli.0044C2B0 ; \ZeroOnli.0044C2B0
0047D699 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
0047D69C |. 8B4E 08 |MOV ECX,DWORD PTR DS:[ESI+8]
0047D69F |. 83C0 04 |ADD EAX,4
0047D6A2 |. 50 |PUSH EAX ; /Arg3
0047D6A3 |. 51 |PUSH ECX ; |Arg2
0047D6A4 |. 57 |PUSH EDI ; |Arg1
0047D6A5 |. 8BCE |MOV ECX,ESI ; |
0047D6A7 |. E8 D4EBFCFF |CALL ZeroOnli.0044C280 ; \ZeroOnli.0044C280
0047D6AC |. 8B56 08 |MOV EDX,DWORD PTR DS:[ESI+8]
0047D6AF |. 8B46 04 |MOV EAX,DWORD PTR DS:[ESI+4]
0047D6B2 |. 52 |PUSH EDX
0047D6B3 |. 50 |PUSH EAX
0047D6B4 |. 8BCE |MOV ECX,ESI
0047D6B6 |. E8 75B91700 |CALL ZeroOnli.005F9030
0047D6BB |. 8B4E 04 |MOV ECX,DWORD PTR DS:[ESI+4]
0047D6BE |. 51 |PUSH ECX ; /block
0047D6BF |. E8 1CB03800 |CALL <JMP.&MFC42.#825_??3@YAXPAX@Z> ; \free
0047D6C4 |. 8B7D DC |MOV EDI,DWORD PTR SS:[EBP-24]
0047D6C7 |. 8B55 D8 |MOV EDX,DWORD PTR SS:[EBP-28]
0047D6CA |. 83C4 04 |ADD ESP,4
0047D6CD |. 8BCE |MOV ECX,ESI
0047D6CF |. 8D0497 |LEA EAX,DWORD PTR DS:[EDI+EDX*4]
0047D6D2 |. 8946 0C |MOV DWORD PTR DS:[ESI+C],EAX
0047D6D5 |. E8 36BE1900 |CALL ZeroOnli.00619510
0047D6DA |. 8D4C87 04 |LEA ECX,DWORD PTR DS:[EDI+EAX*4+4]
0047D6DE |. 897E 04 |MOV DWORD PTR DS:[ESI+4],EDI
0047D6E1 |. 894E 08 |MOV DWORD PTR DS:[ESI+8],ECX
0047D6E4 |. E9 8D000000 |JMP ZeroOnli.0047D776
0047D6E9 |> 8BD0 |MOV EDX,EAX
0047D6EB |. 2BD7 |SUB EDX,EDI
0047D6ED |. C1FA 02 |SAR EDX,2
0047D6F0 |. 83FA 01 |CMP EDX,1
0047D6F3 |. 73 42 |JNB SHORT ZeroOnli.0047D737
0047D6F5 |. 8D4F 04 |LEA ECX,DWORD PTR DS:[EDI+4]
0047D6F8 |. 51 |PUSH ECX ; /Arg3
0047D6F9 |. 50 |PUSH EAX ; |Arg2
0047D6FA |. 57 |PUSH EDI ; |Arg1
0047D6FB |. 8BCE |MOV ECX,ESI ; |
0047D6FD |. E8 7EEBFCFF |CALL ZeroOnli.0044C280 ; \ZeroOnli.0044C280
0047D702 |. 8B46 08 |MOV EAX,DWORD PTR DS:[ESI+8]
0047D705 |. 8D55 FC |LEA EDX,DWORD PTR SS:[EBP-4]
0047D708 |. 8BC8 |MOV ECX,EAX
0047D70A |. 52 |PUSH EDX ; /Arg3
0047D70B |. 2BCF |SUB ECX,EDI ; |
0047D70D |. BA 01000000 |MOV EDX,1 ; |
0047D712 |. C1F9 02 |SAR ECX,2 ; |
0047D715 |. 2BD1 |SUB EDX,ECX ; |
0047D717 |. 8BCE |MOV ECX,ESI ; |
0047D719 |. 52 |PUSH EDX ; |Arg2
0047D71A |. 50 |PUSH EAX ; |Arg1
0047D71B |. E8 90EBFCFF |CALL ZeroOnli.0044C2B0 ; \ZeroOnli.0044C2B0
0047D720 |. 8B4E 08 |MOV ECX,DWORD PTR DS:[ESI+8]
0047D723 |. 8BC7 |MOV EAX,EDI
0047D725 |. 3BF9 |CMP EDI,ECX
0047D727 |. 74 49 |JE SHORT ZeroOnli.0047D772
0047D729 |> 8B55 FC |/MOV EDX,DWORD PTR SS:[EBP-4]
0047D72C |. 8910 ||MOV DWORD PTR DS:[EAX],EDX
0047D72E |. 83C0 04 ||ADD EAX,4
0047D731 |. 3BC1 ||CMP EAX,ECX
0047D733 |.^ 75 F4 |\JNZ SHORT ZeroOnli.0047D729
0047D735 |. EB 3B |JMP SHORT ZeroOnli.0047D772
0047D737 |> 50 |PUSH EAX ; /Arg3
0047D738 |. 50 |PUSH EAX ; |Arg2
0047D739 |. 83C0 FC |ADD EAX,-4 ; |
0047D73C |. 8BCE |MOV ECX,ESI ; |
0047D73E |. 50 |PUSH EAX ; |Arg1
0047D73F |. E8 3CEBFCFF |CALL ZeroOnli.0044C280 ; \ZeroOnli.0044C280
0047D744 |. 8B4E 08 |MOV ECX,DWORD PTR DS:[ESI+8]
0047D747 |. 8D41 FC |LEA EAX,DWORD PTR DS:[ECX-4]
0047D74A |. 3BF8 |CMP EDI,EAX
0047D74C |. 74 0F |JE SHORT ZeroOnli.0047D75D
0047D74E |> 8B50 FC |/MOV EDX,DWORD PTR DS:[EAX-4]
0047D751 |. 83E8 04 ||SUB EAX,4
0047D754 |. 83E9 04 ||SUB ECX,4
0047D757 |. 3BC7 ||CMP EAX,EDI
0047D759 |. 8911 ||MOV DWORD PTR DS:[ECX],EDX
0047D75B |.^ 75 F1 |\JNZ SHORT ZeroOnli.0047D74E
0047D75D |> 8D4F 04 |LEA ECX,DWORD PTR DS:[EDI+4]
0047D760 |. 8BC7 |MOV EAX,EDI
0047D762 |. 3BF9 |CMP EDI,ECX
0047D764 |. 74 0C |JE SHORT ZeroOnli.0047D772
0047D766 |> 8B55 FC |/MOV EDX,DWORD PTR SS:[EBP-4]
0047D769 |. 8910 ||MOV DWORD PTR DS:[EAX],EDX
0047D76B |. 83C0 04 ||ADD EAX,4
0047D76E |. 3BC1 ||CMP EAX,ECX
0047D770 |.^ 75 F4 |\JNZ SHORT ZeroOnli.0047D766
0047D772 |> 8346 08 04 |ADD DWORD PTR DS:[ESI+8],4
0047D776 |> 8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C]
0047D779 |. 8B4D E0 |MOV ECX,DWORD PTR SS:[EBP-20]
0047D77C |. 40 |INC EAX
0047D77D |. 3BC1 |CMP EAX,ECX
0047D77F |. 8945 E4 |MOV DWORD PTR SS:[EBP-1C],EAX
0047D782 |.^ 0F8C 85FDFFFF \JL ZeroOnli.0047D50D
0047D788 |. 8B75 EC MOV ESI,DWORD PTR SS:[EBP-14]
0047D78B |> 56 PUSH ESI ; /stream
0047D78C |. FF15 C02A8300 CALL DWORD PTR DS:[<&MSVCRT.fclose>] ; \fclose
0047D792 |. 83C4 04 ADD ESP,4
0047D795 |> 5F POP EDI
0047D796 |. 5E POP ESI
0047D797 |. 5B POP EBX
0047D798 |. 8BE5 MOV ESP,EBP
0047D79A |. 5D POP EBP
0047D79B \. C3 RETN |
|
|Archiver|手机版|小黑屋|联系我们|宝峰科技
( 
滇公网安备 53050202000040号 | 滇ICP备09007156号-2 )
IP卡
狗仔卡
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
显身卡