（3） (9千字)
和（2）完全一样的代码，难怪现在的软件奇大无比，实在是垃圾太多。:00492D32 B057 mov al, 57
:00492D34 BF00000100 mov edi, 00010000
:00492D39 B900003F00 mov ecx, 003F0000
:00492D3E 33D2 xor edx, edx
:00492D40 685C2D4900 push 00492D5C
:00492D45 64FF32 push dword ptr fs:[edx]
:00492D48 8925D0A84A00 mov dword ptr [004AA8D0], esp
:00492D4E 892DD4A84A00 mov dword ptr [004AA8D4], ebp
:00492D54 648922 mov dword ptr fs:[edx], esp
:00492D57 EB1A jmp 00492D73
:00492D59 90 nop
:00492D5A 90 nop
:00492D5B 90 nop
:00492D5C 8B25D0A84A00 mov esp, dword ptr [004AA8D0]
:00492D62 8B2DD4A84A00 mov ebp, dword ptr [004AA8D4]
:00492D68 5A pop edx
:00492D69 646789160000 mov fs:[0000], edx
:00492D6F 58 pop eax
:00492D70 33C0 xor eax, eax
:00492D72 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00492D57(U), :00492D8A(U), :00492D95(C)
|
:00492D73 F2 repnz
:00492D74 AE scasb
:00492D75 E325 jcxz 00492D9C
:00492D77 90 nop
:00492D78 90 nop
:00492D79 90 nop
:00492D7A 90 nop
:00492D7B 90 nop
:00492D7C 90 nop
:00492D7D 90 nop
:00492D7E 813F494E4943 cmp dword ptr [edi], 43494E49
:00492D84 7406 je 00492D8C
:00492D86 90 nop
:00492D87 90 nop
:00492D88 90 nop
:00492D89 90 nop
:00492D8A EBE7 jmp 00492D73
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00492D84(C)
|
:00492D8C 83C704 add edi, 00000004
:00492D8F 813F452E4252 cmp dword ptr [edi], 52422E45
:00492D95 75DC jne 00492D73
:00492D97 B801000000 mov eax, 00000001
:00492D9C 5A pop edx
:00492D9D 646789160000 mov fs:[0000], edx
:00492DA3 5A pop edx
:00492DA4 C3 ret
;--------------------------------------------------------------------
* Referenced by a CALL at Address:
|:00492CE2
|
:00492DA5 33D2 xor edx, edx
:00492DA7 68C32D4900 push 00492DC3
:00492DAC 64FF32 push dword ptr fs:[edx]
:00492DAF 8925D0A84A00 mov dword ptr [004AA8D0], esp
:00492DB5 892DD4A84A00 mov dword ptr [004AA8D4], ebp
:00492DBB 648922 mov dword ptr fs:[edx], esp
:00492DBE EB1A jmp 00492DDA
:00492DC0 90 nop
:00492DC1 90 nop
:00492DC2 90 nop
:00492DC3 8B25D0A84A00 mov esp, dword ptr [004AA8D0]
:00492DC9 8B2DD4A84A00 mov ebp, dword ptr [004AA8D4]
:00492DCF 5A pop edx
:00492DD0 646789160000 mov fs:[0000], edx
:00492DD6 58 pop eax
:00492DD7 33C0 xor eax, eax
:00492DD9 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00492DBE(U)
|
:00492DDA B804000000 mov eax, 00000004
:00492DDF BD4B484342 mov ebp, 4243484B
:00492DE4 CC int 03
:00492DE5 5A pop edx
:00492DE6 646789160000 mov fs:[0000], edx
:00492DEC 5A pop edx
:00492DED B801000000 mov eax, 00000001
:00492DF2 C3 ret
;--------------------------------------------------------------------
* Referenced by a CALL at Address:
|:00492CCD
|
:00492DF3 33D2 xor edx, edx
:00492DF5 68112E4900 push 00492E11
:00492DFA 64FF32 push dword ptr fs:[edx]
:00492DFD 8925D0A84A00 mov dword ptr [004AA8D0], esp
:00492E03 892DD4A84A00 mov dword ptr [004AA8D4], ebp
:00492E09 648922 mov dword ptr fs:[edx], esp
:00492E0C EB1A jmp 00492E28
:00492E0E 90 nop
:00492E0F 90 nop
:00492E10 90 nop
:00492E11 8B25D0A84A00 mov esp, dword ptr [004AA8D0]
:00492E17 8B2DD4A84A00 mov ebp, dword ptr [004AA8D4]
:00492E1D 5A pop edx
:00492E1E 646789160000 mov fs:[0000], edx
:00492E24 58 pop eax
:00492E25 33C0 xor eax, eax
:00492E27 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00492E0C(U)
|
:00492E28 B443 mov ah, 43
:00492E2A CD68 int 68
:00492E2C 5A pop edx
:00492E2D 646789160000 mov fs:[0000], edx
:00492E33 5A pop edx
:00492E34 663D86F3 cmp ax, F386
:00492E38 7407 je 00492E41
:00492E3A 90 nop
:00492E3B 90 nop
:00492E3C 90 nop
:00492E3D 90 nop
:00492E3E 33C0 xor eax, eax
:00492E40 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00492E38(C)
|
:00492E41 B801000000 mov eax, 00000001
:00492E46 C3 ret
;--------------------------------------------------------------------
* Referenced by a CALL at Address:
|:00492D07
|
:00492E47 33D2 xor edx, edx
:00492E49 68652E4900 push 00492E65
:00492E4E 64FF32 push dword ptr fs:[edx]
:00492E51 8925D0A84A00 mov dword ptr [004AA8D0], esp
:00492E57 892DD4A84A00 mov dword ptr [004AA8D4], ebp
:00492E5D 648922 mov dword ptr fs:[edx], esp
:00492E60 EB1A jmp 00492E7C
:00492E62 90 nop
:00492E63 90 nop
:00492E64 90 nop
:00492E65 8B25D0A84A00 mov esp, dword ptr [004AA8D0]
:00492E6B 8B2DD4A84A00 mov ebp, dword ptr [004AA8D4]
:00492E71 5A pop edx
:00492E72 646789160000 mov fs:[0000], edx
:00492E78 58 pop eax
:00492E79 33C0 xor eax, eax
:00492E7B C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00492E60(U)
|
:00492E7C 0F010DD8A84A00 sidt [004AA8D8]
:00492E83 A1DAA84A00 mov eax, dword ptr [004AA8DA]
:00492E88 83C008 add eax, 00000008
:00492E8B 8B18 mov ebx, dword ptr [eax]
:00492E8D 83C010 add eax, 00000010
:00492E90 8B00 mov eax, dword ptr [eax]
:00492E92 25FFFF0000 and eax, 0000FFFF
:00492E97 81E3FFFF0000 and ebx, 0000FFFF
:00492E9D 2BC3 sub eax, ebx
:00492E9F 83F81E cmp eax, 0000001E
:00492EA2 7406 je 00492EAA
:00492EA4 90 nop
:00492EA5 90 nop
:00492EA6 90 nop
:00492EA7 90 nop
:00492EA8 33C0 xor eax, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00492EA2(C)
|
:00492EAA 5A pop edx
:00492EAB 646789160000 mov fs:[0000], edx
:00492EB1 5A pop edx
:00492EB2 C3 ret
;--------------------------------------------------------------------
* Referenced by a CALL at Address:
|:00492D1C
|
* Possible StringData Ref from Data Obj ->"C:\ntice\nmtrans.dll"
|
:00492EB3 68E9A84A00 push 004AA8E9
* Reference To: KERNEL32.LoadLibraryA, Ord:0000h
|
:00492EB8 E8A737F7FF Call 00406664
:00492EBD 85C0 test eax, eax
:00492EBF 7419 je 00492EDA
:00492EC1 90 nop
:00492EC2 90 nop
:00492EC3 90 nop
:00492EC4 90 nop
* Possible StringData Ref from Data Obj ->"NmSymIsSoftICELoaded"
|
:00492EC5 68FEA84A00 push 004AA8FE
:00492ECA 50 push eax
* Reference To: KERNEL32.GetProcAddress, Ord:0000h
|
:00492ECB E8FC36F7FF Call 004065CC
:00492ED0 85C0 test eax, eax
:00492ED2 7406 je 00492EDA
:00492ED4 90 nop
:00492ED5 90 nop
:00492ED6 90 nop
:00492ED7 90 nop
:00492ED8 FFD0 call eax
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00492EBF(C), :00492ED2(C)
|
:00492EDA C3 ret
