<span class="pediy"><span class="pediy">
[part 3]
; ******************************************************************
; 当当当~~~~~ 醒醒啦！！！
; ******************************************************************
0042532D 8D85 D05C4000 lea eax, dword ptr ss:[ebp+405CD0] ; 没弄明白，也许是参数
00425334 B0 94 mov al, 94 ; 后边用来xor的key
00425336 E8 00000000 call Try.0042533B
0042533B 5E pop esi ; 取这条信令地址
0042533C 81C6 A6000000 add esi, 0A6 ; 加上这段解密代码的长度，指向下一部分，进行SMC解密
00425347 B9 68010000 mov ecx, 168h ; 解码长度
00425356 8A26 mov ah, byte ptr ds:[esi] ; 读取一个字节
0042535D 32E0 xor ah, al
00425376 F6D4 not ah
0042538F 8826 mov byte ptr ds:[esi], ah ; 解密后存回去
004253A8 46 inc esi ; 下一个字节
004253AE 49 dec ecx ; 计数器--
004253B4 83F9 00 cmp ecx, 0
004253B7 ^\75 98 jnz short Try.00425351 ; 循环直到都解密完成
; 精彩片断！！！！！！！！！！
004253BE FEC8 dec al ; 换一个key
004253C5 BB 4F434E55 mov ebx, 554E434F ; 不清楚，自己猜吧
0042540E B9 68010000 mov ecx, 168 ; 这一块长度
0042542A 8A240E mov ah, byte ptr ds:[esi+ecx] ; 读取一个字节
00425444 88240E mov byte ptr ds:[esi+ecx], ah ; 再写进去，什么名堂？
0042545E CC int 3 ; 别乱动，int 3解码
0042545F /E9 E5000000 jmp Try.00425549 ; 按 F4 ，int3的向量处理好解码了，过去看看
; 跳过的好像是下一次int3的向量,俺可不敢进去胡闹
00425464 |3D 534E5552 cmp eax, 52554E53
00425469 |75 24 jnz short Try.0042548F
00425482 FFD3 call ebx
00425489 CF iretd
00425576 B9 68010000 mov ecx, 168 ; TMD,没完没了了
00425592 8A240E mov ah, byte ptr ds:[esi+ecx]
004255AC 88240E mov byte ptr ds:[esi+ecx], ah
004255C6 CC int3
004255C7 E9 E5000000 jmp Try.004256B1 ; F4
004256DE B9 68010000 mov ecx, 168 ; KAO....
004256FA 8A240E mov ah, byte ptr ds:[esi+ecx]
00425714 88240E mov byte ptr ds:[esi+ecx], ah
0042572E CC int3
0042572F E9 E5000000 jmp Try.00425819
00425846 B9 68010000 mov ecx, 168 ; ……
00425862 8A240E mov ah, byte ptr ds:[esi+ecx]
0042587C 88240E mov byte ptr ds:[esi+ecx], ah
00425896 CC int3
00425897 E9 E5000000 jmp Try.00425981
004259AE B9 68010000 mov ecx, 168 ; my heart will go on
004259CA 8A240E mov ah, byte ptr ds:[esi+ecx]
004259E4 88240E mov byte ptr ds:[esi+ecx], ah
004259FE CC int3
004259FF /E9 E5000000 jmp Try.00425AE9
00425B16 B9 68010000 mov ecx, 168 ; 没完没了
00425B32 8A240E mov ah, byte ptr ds:[esi+ecx]
00425B4C 88240E mov byte ptr ds:[esi+ecx], ah
00425B66 CC int3
00425B67 E9 E5000000 jmp Try.00425C51
00425C7E B9 68010000 mov ecx, 168 ; 不见不散
00425C9A 8A240E mov ah, byte ptr ds:[esi+ecx]
00425CB4 88240E mov byte ptr ds:[esi+ecx], ah
00425CCE CC int3
00425CCF /E9 E5000000 jmp Try.00425DB9
00425C7E B9 68010000 mov ecx, 168 ; 有话好好说
00425C9A 8A240E mov ah, byte ptr ds:[esi+ecx]
00425CB4 88240E mov byte ptr ds:[esi+ecx], ah
00425CCE CC int3
00425CCF E9 E5000000 jmp Try.00425DB9
00425DE6 B9 68010000 mov ecx, 168 ; 声声慢……
00425E02 8A240E mov ah, byte ptr ds:[esi+ecx]
00425E1C 88240E mov byte ptr ds:[esi+ecx], ah
00425E36 CC int3
00425E37 E9 E5000000 jmp Try.00425F21
00425F4E B9 68010000 mov ecx, 168
00425F6A 8A240E mov ah, byte ptr ds:[esi+ecx]
00425F84 88240E mov byte ptr ds:[esi+ecx], ah
00425F9E CC int3
00425F9F E9 E5000000 jmp Try.00426089
004260B6 B9 68010000 mov ecx, 168
004260D2 8A240E mov ah, byte ptr ds:[esi+ecx]
004260EC 88240E mov byte ptr ds:[esi+ecx], ah
00426106 CC int3
00426107 E9 E5000000 jmp Try.004261F1
0042621E B9 68010000 mov ecx, 168
0042623A 8A240E mov ah, byte ptr ds:[esi+ecx]
00426254 88240E mov byte ptr ds:[esi+ecx], ah
0042626E CC int3
0042626F E9 E5000000 jmp Try.00426359
00426386 B9 68010000 mov ecx, 168
004263A2 8A240E mov ah, byte ptr ds:[esi+ecx]
004263BC 88240E mov byte ptr ds:[esi+ecx], ah
004263D6 CC int3
004263D7 E9 E5000000 jmp Try.004264C1
004264EE B9 68010000 mov ecx, 168
0042650A 8A240E mov ah, byte ptr ds:[esi+ecx]
00426524 88240E mov byte ptr ds:[esi+ecx], ah
0042653E CC int3
0042653F E9 E5000000 jmp Try.00426629
00426656 B9 68010000 mov ecx, 168
00426672 8A240E mov ah, byte ptr ds:[esi+ecx]
0042668C 88240E mov byte ptr ds:[esi+ecx], ah
004266A6 CC int3
004266A7 E9 E5000000 jmp Try.00426791
004267BE B9 68010000 mov ecx, 168
004267DA 8A240E mov ah, byte ptr ds:[esi+ecx]
004267F4 88240E mov byte ptr ds:[esi+ecx], ah
0042680E CC int3
0042680F E9 E5000000 jmp Try.004268F9
00426926 B9 68010000 mov ecx, 168
00426942 8A240E mov ah, byte ptr ds:[esi+ecx]
0042695C 88240E mov byte ptr ds:[esi+ecx], ah
00426976 CC int3
00426977 E9 E5000000 jmp Try.00426A61
00426A8E B9 68010000 mov ecx, 168
00426AAA 8A240E mov ah, byte ptr ds:[esi+ecx]
00426AC4 88240E mov byte ptr ds:[esi+ecx], ah
00426ADE CC int3
00426ADF E9 E5000000 jmp Try.00426BC9
00426BF6 B9 68010000 mov ecx, 168
00426C12 8A240E mov ah, byte ptr ds:[esi+ecx]
00426C2C 88240E mov byte ptr ds:[esi+ecx], ah
00426C46 CC int3
00426C47 E9 E5000000 jmp Try.00426D31
00426D5E B9 68010000 mov ecx, 168
00426D7A 8A240E mov ah, byte ptr ds:[esi+ecx]
00426D94 88240E mov byte ptr ds:[esi+ecx], ah
00426DAE CC int3
00426DAF E9 E5000000 jmp Try.00426E99
00426D5E B9 68010000 mov ecx, 168
00426D7A 8A240E mov ah, byte ptr ds:[esi+ecx]
00426D94 88240E mov byte ptr ds:[esi+ecx], ah
00426DAE CC int3
00426DAF E9 E5000000 jmp Try.00426E99
00426EC6 B9 68010000 mov ecx, 168
00426EE2 8A240E mov ah, byte ptr ds:[esi+ecx]
00426EFC 88240E mov byte ptr ds:[esi+ecx], ah
00426F16 CC int3
00426F17 E9 E5000000 jmp Try.00427001
0042702E B9 68010000 mov ecx, 168
0042704A 8A240E mov ah, byte ptr ds:[esi+ecx]
00427064 88240E mov byte ptr ds:[esi+ecx], ah
0042707E CC int3
0042707F E9 E5000000 jmp Try.00427169
00427196 B9 68010000 mov ecx, 168
004271B2 8A240E mov ah, byte ptr ds:[esi+ecx]
004271CC 88240E mov byte ptr ds:[esi+ecx], ah
004271E6 CC int3
004271E7 E9 E5000000 jmp Try.004272D1
004272FE B9 68010000 mov ecx, 168
0042731A 8A240E mov ah, byte ptr ds:[esi+ecx]
00427334 88240E mov byte ptr ds:[esi+ecx], ah
0042734E CC int3
0042734F E9 E5000000 jmp Try.00427439
-============================================================-
; 晕倒了快，拿个处理看看，调剂~~~
00429D84 3D 534E5552 cmp eax, 52554E53
00429D89 75 24 jnz short Try.00429DAF
00429DA2 FFD3 call ebx
00429DA9 CF iretd
00429DAF 81FB 4F434E55 cmp ebx, 554E434F
00429DB5 0F85 AD000000 jnz Try.00429E68
00429DBB 8A26 mov ah, byte ptr ds:[esi]
00429DC2 32E0 xor ah, al
00429DDB F6D4 not ah
00429DE2 8826 mov byte ptr ds:[esi], ah
00429DE9 46 inc esi
00429DEF 49 dec ecx
00429DF5 83F9 00 cmp ecx, 0
00429DF8 ^ 75 C1 jnz short Try.00429DBB
00429DFF FEC8 dec al
00429E06 8DBD 4E344200 lea edi, dword ptr ss:[ebp+42344E]
00429E11 0F010F sidt fword ptr ds:[edi]
00429E19 8B7F 02 mov edi, dword ptr ds:[edi+2]
00429E1C 8B1C24 mov ebx, dword ptr ss:[esp]
00429E24 803B E9 cmp byte ptr ds:[ebx], 0E9
00429E27 75 05 jnz short Try.00429E2E
00429E29 83C3 05 add ebx, 5
00429E2C EB 03 jmp short Try.00429E31
00429E2E 83C3 02 add ebx, 2
00429E36 66:895F 18 mov word ptr ds:[edi+18], bx
00429E3F C1EB 10 shr ebx, 10
00429E47 66:895F 1E mov word ptr ds:[edi+1E], bx
00429E50 BB 55010000 mov ebx, 155
00429E5A 0F23FB mov dr7, ebx ; Privileged command
00429E62 BB 4F434E55 mov ebx, 554E434F
00429E67 CF iretd
00429E68 CF iretd
-============================================================-
0042CB96 B9 68010000 mov ecx, 168
0042CBB2 8A240E mov ah, byte ptr ds:[esi+ecx]
0042CBCC 88240E mov byte ptr ds:[esi+ecx], ah
0042CBE6 CC int3
0042CBE7 E9 E5000000 jmp Try.0042CCD1
0042EFF9 E8 00000000 call Try.0042EFFE
0042EFFE 5D pop ebp
0042EFFF 81ED CB484100 sub ebp, Try.004148CB ; 长征过去……再来取delta
0042F005 58 pop eax
0042F038 80E4 01 and ah, 1
0042F052 32C0 xor al, al
0042F081 66:3185 2DD6410>xor word ptr ss:[ebp+41D62D], ax
0042F0BF 8D85 D15C4000 lea eax, dword ptr ss:[ebp+405CD1]
0042F0FE BE 944B4100 mov esi, Try.00414B94
0042F130 03F5 add esi, ebp
0042F149 B9 B6E80000 mov ecx, 0E8B6
0042F158 03F1 add esi, ecx
0042F187 4E dec esi
0042F1B5 BB 01000000 mov ebx, 1
; 又解码
0042F1C4 8A06 mov al, byte ptr ds:[esi]
0042F1F3 3246 01 xor al, byte ptr ds:[esi+1]
0042F1FB 32C3 xor al, bl
0042F219 3285 02AC4000 xor al, byte ptr ss:[ebp+40AC02]
0042F251 8806 mov byte ptr ds:[esi], al
0042F258 4E dec esi
0042F25E 43 inc ebx
0042F264 49 dec ecx
0042F26A 83F9 00 cmp ecx, 0
0042F26D ^\0F85 4CFFFFFF jnz Try.0042F1BF
0042F278 66:81BD 944B410>cmp word ptr ss:[ebp+414B94], 9090
0042F2AE - 75 FE jnz short Try.0042F2AE ; 搞怪？
0042F2C9 8B85 F1344200 mov eax, dword ptr ss:[ebp+4234F1]
0042F2CF 83F8 00 cmp eax, 0
0042F2D2 B9 7DDB0100 mov ecx, 1DB7D
0042F2D7 0F85 E0020000 jnz Try.0042F5BD
0042F2DD E8 00000000 call Try.0042F2E2
0042F2E2 5A pop edx
0042F310 2B95 F4D54100 sub edx, dword ptr ss:[ebp+41D5F4]
0042F31B 81EA E2F20000 sub edx, 0F2E2
0042F326 8995 DCD34100 mov dword ptr ss:[ebp+41D3DC], edx
0042F3B3 8D85 D25C4000 lea eax, dword ptr ss:[ebp+405CD2]
0042F458 B8 87CC4100 mov eax, Try.0041CC87
0042F462 03C5 add eax, ebp ; eax -> IID
0042F469 E8 10890000 call Try.00437D7E ; 取函数地址
00437DAB 60 pushad
----------------------------------------------------------------------
00437DB1 8BD8 mov ebx, eax
; ******************************************************************
; 大循环开始
00437DC2 807B 08 00 cmp byte ptr ds:[ebx+8], 0
00437DCB /0F84 1B030000 je Try.004380EC ; over
00437DED 8BC3 mov eax, ebx
00437DF4 83C0 08 add eax, 8
00437DFC 50 push eax
00437DFD FF95 C13D4200 call dword ptr ss:[ebp+423DC1] ; kernel32.LoadLibraryA
00437E08 8985 7FCC4100 mov dword ptr ss:[ebp+41CC7F], eax ; 保存 hModule
00437E13 83F8 00 cmp eax, 0 ; faint
00437E16 /75 46 jnz short Try.00437E5E ; JUMP
00437E1D C785 83CC4100 0>mov dword ptr ss:[ebp+41CC83], 0 ; failed....
00437E54 /E9 93020000 jmp Try.004380EC ; Game Over
00437EA2 8B33 mov esi, dword ptr ds:[ebx] ; Try.0041CCD4
00437EBB 8B7B 04 mov edi, dword ptr ds:[ebx+4]
00437ED5 03F5 add esi, ebp ; 修正地址
00437EDC 03FD add edi, ebp
00437EFF 803E 00 cmp byte ptr ds:[esi], 0 ; 表处理完了？
00437F02 0F85 BE000000 jnz Try.00437FC6 ;没有就处理 -> ***
00437F35 83C3 08 add ebx, 8
; ebx 指向下一个DLL名称
00437F65 803B 00 cmp byte ptr ds:[ebx], 0
00437F68 74 1F je short Try.00437F89
00437F81 43 inc ebx
00437F87 ^\EB DC jmp short Try.00437F65
00437FB6 43 inc ebx ; Try.004373CE
00437FBC ^\E9 FCFDFFFF jmp Try.00437DBD
; 大循环结束
; ******************************************************************
;***:
00437FD0 56 push esi
00437FD1 FFB5 7FCC4100 push dword ptr ss:[ebp+41CC7F]
00437FD7 FF95 C53D4200 call dword ptr ss:[ebp+423DC5] ; kernel32.GetProcAddress,取地址
00437FE2 83F8 00 cmp eax, 0
00437FE5 75 30 jnz short Try.00438017 ; GO
00437FEC C785 83CC4100 0>mov dword ptr ss:[ebp+41CC83], 0 ; failed again
..........
00438038 8907 mov dword ptr ds:[edi], eax ; 写入函数地址
00438051 83C7 04 add edi, 4 ; 下一个Thunk
; 使 esi 指向下一个函数名
0043805E /803E 00 cmp byte ptr ds:[esi], 0
00438061 | 74 0D je short Try.00438070
00438068 | 46 inc esi
0043806E \EB EE jmp short Try.0043805E
0043809D 46 inc esi ; skip NULL
004380CB ^\E9 2AFEFFFF jmp Try.00437EFA
004380F1 61 popad
004380F7 8B85 83CC4100 mov eax, dword ptr ss:[ebp+41CC83] ; 返回标志
00438102 C3 ret
----------------------------------------------------------------------
0042F473 BB 3AD34100 mov ebx, Try.0041D33A
0042F47D 03DD add ebx, ebp ; 出错信息
0042F484 66:3D 0000 cmp ax, 0
0042F48D /0F84 3D2B0000 je Try.00431FD0 ; 某个错误
0042F4C5 B9 60E50100 mov ecx, 1E560
0042F4E1 83C1 20 add ecx, 20
0042F516 6A 00 push 0
0042F518 51 push ecx
0042F519 6A 00 push 0
0042F51B 6A 04 push 4
0042F51D 6A 00 push 0
0042F51F 6A FF push -1
0042F521 FF95 C3CE4100 call dword ptr ss:[ebp+41CEC3] ; kernel32.CreateFileMappingA
0012FF8C 0042F527 /CALL to CreateFileMappingA from Try.0042F521
0012FF90 FFFFFFFF |hFile = FFFFFFFF
0012FF94 00000000 |pSecurity = NULL
0012FF98 00000004 |Protection = PAGE_READWRITE
0012FF9C 00000000 |MaximumSizeHigh = 0
0012FFA0 0001E580 |MaximumSizeLow = 1E580
0012FFA4 00000000 \MapName = NULL
0042F52C 6A 00 push 0
0042F52E 6A 00 push 0
0042F530 6A 00 push 0
0042F532 6A 02 push 2
0042F534 50 push eax
0042F535 FF95 BFCE4100 call dword ptr ss:[ebp+41CEBF] ; kernel32.MapViewOfFile
0012FF90 0042F53B /CALL to MapViewOfFile from Try.0042F535
0012FF94 00000060 |hMapObject = 00000060 (window)
0012FF98 00000002 |AccessMode = FILE_MAP_WRITE
0012FF9C 00000000 |OffsetHigh = 0
0012FFA0 00000000 |OffsetLow = 0
0012FFA4 00000000 \MapSize = 0
; map it...
0042F557 8985 F1344200 mov dword ptr ss:[ebp+4234F1], eax ; 保存
0042F574 B9 60E50100 mov ecx, 1E560
0042F5C2 8BD0 mov edx, eax
0042F5C9 8BF8 mov edi, eax ; 要解一部分loader代码到内存
0042F5D0 BE CD584000 mov esi, Try.004058CD
0042F5DA 03F5 add esi, ebp ; 未还原数据
0042F5F3 F3:A4 rep movsb
0042F5FF 8D85 D35C4000 lea eax, dword ptr ss:[ebp+405CD3]
0042F615 B8 804F4100 mov eax, Try.00414F80
0042F61F 2D CD584000 sub eax, Try.004058CD
0042F629 03C2 add eax, edx
0042F642 8B9D F5344200 mov ebx, dword ptr ss:[ebp+4234F5]
0042F64D 50 push eax
0042F67B C3 ret ; funy jump...
0042F67B C3 ret ; 二步瞬移~~~ ==> 003AF6B3
