<span class="pediy"><span class="pediy">
[part 5]
003B073A E8 4A2A0000 call 003B3189 ; 进去观光
003B31A5 B8 01000000 mov eax, 1
003B31D7 83BD 9ED24100 0>cmp dword ptr ss:[ebp+41D29E], 0
003B31E3 /0F84 C6120000 je 003B44AF ; 不需要注册？跳吧========〉下边在极度困倦下走了弯路
003B31F3 8D85 DD5C4000 lea eax, dword ptr ss:[ebp+405CDD]; ??
003B3209 83BD FC1D4200 0>cmp dword ptr ss:[ebp+421DFC], 0
003B3210 /75 54 jnz short 003B3266; 不知道是啥,我这里没跳
003B3217 E8 A51D0000 call 003B4FC1; ?
003B3249 3C 01 cmp al, 1
003B324B 74 14 je short 003B3261
003B3270 83BD FC1D4200 0>cmp dword ptr ss:[ebp+421DFC], 2
003B3277 75 66 jnz short 003B32DF
003B32FB 83BD FC1D4200 0>cmp dword ptr ss:[ebp+421DFC], 1
003B3302 75 37 jnz short 003B333B
003B3345 83BD FC1D4200 0>cmp dword ptr ss:[ebp+421DFC], 3
003B334C 75 26 jnz short 003B3374
003B33A6 E8 17270000 call 003B5AC2
003B5B06 60 pushad
003B5B0C C785 EAD24100 0>mov dword ptr ss:[ebp+41D2EA], 0
003B5B32 BB CCD24100 mov ebx, 41D2CC
003B5B3C 03DD add ebx, ebp ; buffer
003B5B43 B9 AAD24100 mov ecx, 41D2AA
003B5B4D 03CD add ecx, ebp ; subkey
; 猜想是读注册标记
003B5B54 53 push ebx
003B5B55 68 1F000200 push 2001F
003B5B5A 6A 00 push 0
003B5B5C 51 push ecx
003B5B5D 68 00000080 push 80000000
003B5B62 FF95 D2CF4100 call dword ptr ss:[ebp+41CFD2] ; advapi32.RegOpenKeyExA
0012FF68 003B5B68 /CALL to RegOpenKeyExA from 003B5B62
0012FF6C 80000000 |hKey = HKEY_CLASSES_ROOT
0012FF70 003B79DD |Subkey = "wrifile\shell\open\command\config"
0012FF74 00000000 |Reserved = 0
0012FF78 0002001F |Access = KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|20000
0012FF7C 003B79FF \pHandle = 003B79FF
003B5B9A 83F8 00 cmp eax, 0
003B5B9D 0F84 2A010000 je 003B5CCD ; JUMP
003B5D09 BE A6D24100 mov esi, 41D2A6
003B5D13 03F5 add esi, ebp
003B5D1A BF A2D24100 mov edi, 41D2A2
003B5D24 03FD add edi, ebp
003B5D30 B8 FECF4100 mov eax, 41CFFE
003B5D3A 03C5 add eax, ebp
003B5D53 BB DCD24100 mov ebx, 41D2DC
003B5D85 03DD add ebx, ebp
; 用这么多regs，气势逼人~~~
003B5D8C 8B8D CCD24100 mov ecx, dword ptr ss:[ebp+41D2CC] ; Reg的句柄
003B5D97 56 push esi
003B5D98 50 push eax
003B5D99 57 push edi
003B5D9A 6A 00 push 0
003B5D9C 53 push ebx ; 好奇怪的名字，大概是自动计算的
003B5D9D 51 push ecx
003B5D9E FF95 DECF4100 call dword ptr ss:[ebp+41CFDE] ; advapi32.RegQueryValueExA
0012FF64 003B5DA4 /CALL to RegQueryValueExA from 003B5D9E
0012FF68 0000006A |hKey = 6A
0012FF6C 003B7A0F |ValueName = ""9B,"",80,"",8B,"",80,"?,80,"?,80,"",84,"",81,""
0012FF70 00000000 |Reserved = NULL
0012FF74 003B79D5 |pValueType = 003B79D5
0012FF78 003B7731 |Buffer = 003B7731
0012FF7C 003B79D9 \pBufSize = 003B79D9
; *** 如果做的DBPE Cleaner，大概就是清理HKEY_CLASSES_ROOT\wrifile\shell\open\command\config\所有子项目
003B5DC0 66:3D 0000 cmp ax, 0
003B5DC9 /0F85 EE020000 jnz 003B60BD ; 做注册部分
003B60C2 8B85 CCD24100 mov eax, dword ptr ss:[ebp+41D2CC]
003B60CD 50 push eax
003B60CE FF95 DACF4100 call dword ptr ss:[ebp+41CFDA] ; advapi32.RegCloseKey
003B6106 61 popad
003B611E 8B85 EAD24100 mov eax, dword ptr ss:[ebp+41D2EA]
003B6129 C3 ret
003B33CC 8B85 7CD24100 mov eax, dword ptr ss:[ebp+41D27C]
003B33FF BB 8CD24100 mov ebx, 41D28C
003B341B 03DD add ebx, ebp
003B3422 B9 27354200 mov ecx, 423527
003B343E 03CD add ecx, ebp
003B3445 50 push eax
003B3446 53 push ebx
003B3447 51 push ecx
003B3448 FF95 64CF4100 call dword ptr ss:[ebp+41CF64] ; user32.wsprintfA
0012FF64 0000006A
0012FF94 003B344E /CALL to wsprintfA from 003B3448
0012FF98 003BDC5A |s = 003BDC5A
0012FF9C 003B79BF |Format = "%08lX"
0012FFA0 06781F8B \<%08lX> = 6781F8B
003B3453 83C4 0C add esp, 0C ; 平衡堆栈
; ecx ->
-------------------------------------------------------------------
003BDC5D 38 31 46 38 42 00 00 00 81F8B...
-------------------------------------------------------------------
003B3488 BE 0AD04100 mov esi, 41D00A
003B34A4 03F5 add esi, ebp
---------------------------------------------------------------------------
003BDC5A 30 36 37 38 31 46 38 42 00 00 00 00 00 00 00 00 06781F8B........
---------------------------------------------------------------------------
003B34BD BF 2CFA4100 mov edi, 41FA2C
003B34EF 03FD add edi, ebp
003B34F6 B9 16000000 mov ecx, 16
003B3500 F3:A4 rep movsb ; 传送...不明飞行物
003B3534 BE 27354200 mov esi, 423527
003B353E 03F5 add esi, ebp
003B3545 BF 42FA4100 mov edi, 41FA42
003B354F 03FD add edi, ebp
003B3556 B9 0A000000 mov ecx, 0A
003B3588 F3:A4 rep movsb
003B3599 E8 A1140000 call 003B4A3F
; 传送某种非0的数据
003B4A5B 8DB5 78D04100 lea esi, dword ptr ss:[ebp+41D078]
003B4A8E 8DBD 0AD04100 lea edi, dword ptr ss:[ebp+41D00A]
003B4AD8 8A07 mov al, byte ptr ds:[edi]
003B4AF1 8806 mov byte ptr ds:[esi], al
003B4AF8 47 inc edi
003B4AFE 46 inc esi
003B4B2C 3C 00 cmp al, 0
003B4B2E ^\0F85 77FFFFFF jnz 003B4AAB
003B4B8E 4E dec esi
003B4B94 8DBD 27354200 lea edi, dword ptr ss:[ebp+423527]
---------------------------------------------------------------------------
003BDC5A 30 36 37 38 31 46 38 42 00 00 00 00 00 00 00 00 06781F8B........
---------------------------------------------------------------------------
003B4BDE 8A07 mov al, byte ptr ds:[edi]
003B4BF7 8806 mov byte ptr ds:[esi], al
003B4BFE 47 inc edi
003B4C16 46 inc esi
003B4C2E 3C 00 cmp al, 0
003B4C30 ^\0F85 7BFFFFFF jnz 003B4BB1
003B4C3B 8806 mov byte ptr ds:[esi], al
003B4C6F 8D9D 02D34100 lea ebx, dword ptr ss:[ebp+41D302]
003B4C7A 8D85 78D04100 lea eax, dword ptr ss:[ebp+41D078]
003B4C85 8BF5 mov esi, ebp
003B4CB4 60 pushad
003B4CBA 53 push ebx
003B4CBB 50 push eax
003B4CBC E8 0C810000 call 003BCDCD ; 奇怪的算法解码出奇怪的信息
003B4CC6 61 popad
; 这里的代码把一堆东西拷来拷去，我没耐心也没兴致看算法，不做解说了。
003B4CF9 8DB5 02D34100 lea esi, dword ptr ss:[ebp+41D302]
003B4D04 8B06 mov eax, dword ptr ds:[esi]
003B4D0B 3385 9ED24100 xor eax, dword ptr ss:[ebp+41D29E]
003B4D16 8985 EED24100 mov dword ptr ss:[ebp+41D2EE], eax
003B4D4E 8B46 04 mov eax, dword ptr ds:[esi+4]
003B4D56 3385 9AD24100 xor eax, dword ptr ss:[ebp+41D29A]
003B4D61 8985 F2D24100 mov dword ptr ss:[ebp+41D2F2], eax
003B4D71 8DBD 20D04100 lea edi, dword ptr ss:[ebp+41D020]
003B4D7C 8DB5 F6D24100 lea esi, dword ptr ss:[ebp+41D2F6]
003B4DDC 8B07 mov eax, dword ptr ds:[edi]
003B4DE3 8906 mov dword ptr ds:[esi], eax
003B4DEA 8B47 04 mov eax, dword ptr ds:[edi+4]
003B4DF2 8946 04 mov dword ptr ds:[esi+4], eax
003B4E0C E8 1B1A0000 call 003B682C ; 从代码给我的印象来看，像是检查非法字符
003B4E28 3B85 EED24100 cmp eax, dword ptr ss:[ebp+41D2EE]
003B4E45 /0F85 D7000000 jnz 003B4F22
003B4F39 B8 00000000 mov eax, 0
003B4F43 8985 F2D24100 mov dword ptr ss:[ebp+41D2F2], eax
003B4F76 8985 EED24100 mov dword ptr ss:[ebp+41D2EE], eax
003B4F93 C3 ret
003B35CB 83F8 01 cmp eax, 1
003B35D3 /0F84 D60E0000 je 003B44AF
003B3622 8D85 DE5C4000 lea eax, dword ptr ss:[ebp+405CDE]
003B3660 E8 AF330000 call 003B6A14
003B6A58 60 pushad
003B6A5E 8D85 8FC74100 lea eax, dword ptr ss:[ebp+41C78F]
003B6A69 6A 00 push 0
003B6A6B 6A 20 push 20
003B6A6D 6A 03 push 3
003B6A6F 6A 00 push 0
003B6A71 6A 00 push 0
003B6A73 68 00000080 push 80000000
003B6A78 50 push eax
003B6A79 FF95 DBCE4100 call dword ptr ss:[ebp+41CEDB] ; kernel32.CreateFileA
0012FF60 003B6A7F /CALL to CreateFileA from 003B6A79
0012FF64 003B6EC2 |FileName = "regdial.dat"
0012FF68 80000000 |Access = GENERIC_READ
0012FF6C 00000000 |ShareMode = 0
0012FF70 00000000 |pSecurity = NULL
0012FF74 00000003 |Mode = OPEN_EXISTING
0012FF78 00000020 |Attributes = ARCHIVE
0012FF7C 00000000 \hTemplateFile = NULL
; 搞注册界面库，我们到沙罗双树园啦;-)
003B6A84 83F8 FF cmp eax, -1
003B6A87 /74 2D je short 003B6AB6 ; 读取失败？我们给他行行好，翻转ZF不跳
003B6AA0 50 push eax
003B6AA1 FF95 E3CE4100 call dword ptr ss:[ebp+41CEE3] ; kernel32.CloseHandle
003B6AAC /E9 14030000 jmp 003B6DC5
003B6DDC 61 popad
003B6DE2 B8 01000000 mov eax, 1
003B6DFE C3 ret
003B36A9 8D85 DF5C4000 lea eax, dword ptr ss:[ebp+405CDF] ; 无聊！！！
003B36E7 B8 87C74100 mov eax, 41C787
003B3703 03C5 add eax, ebp
003B370A E8 6F460000 call 003B7D7E
; 用来得到2个注册功能的窗口函数ShowTryWindow & GetRegister
003B7DAB 60 pushad
003B7DB1 8BD8 mov ebx, eax
003B7DC2 807B 08 00 cmp byte ptr ds:[ebx+8], 0
003B7DCB /0F84 1B030000 je 003B80EC ; nj
003B7DED 8BC3 mov eax, ebx
003B7DF4 83C0 08 add eax, 8
003B7DFC 50 push eax
003B7DFC 50 push eax
003B7DFD FF95 C13D4200 call dword ptr ss:[ebp+423DC1] ; kernel32.LoadLibraryA
0012FF78 003B7E03 /CALL to LoadLibraryA from 003B7DFD
0012FF7C 003B6EC2 \FileName = "regdial.dat"
; 考，居然是lib
003B7E08 8985 7FCC4100 mov dword ptr ss:[ebp+41CC7F], eax
003B7E13 83F8 00 cmp eax, 0
003B7E16 /75 46 jnz short 003B7E5E ; 翻转ZF
003B7EA2 8B33 mov esi, dword ptr ds:[ebx] ; Try.0041C863
003B7EBB 8B7B 04 mov edi, dword ptr ds:[ebx+4] ; Try.0041C881
003B7ED5 03F5 add esi, ebp
003B7EDC 03FD add edi, ebp
; 看名字也知道是要干啥
---------------------------------------------------------------------------
003B6F96 53 68 6F 77 54 72 79 57 69 6E 64 6F 77 00 47 65 ShowTryWindow.Ge
003B6FA6 74 52 65 67 69 73 74 65 72 00 00 00 00 00 00 00 tRegister.......
---------------------------------------------------------------------------
003B7EFF 803E 00 cmp byte ptr ds:[esi], 0
003B7F02 0F85 BE000000 jnz 003B7FC6 ; 2个都得到了？ 为了好看，完成后代码下放
003B7FD0 56 push esi
003B7FD1 FFB5 7FCC4100 push dword ptr ss:[ebp+41CC7F]
003B7FD7 FF95 C53D4200 call dword ptr ss:[ebp+423DC5] ; kernel32.GetProcAddress
0012FF74 003B7FDD /CALL to GetProcAddress from 003B7FD7
0012FF78 00000000 |hModule = NULL ; 我从中作梗
0012FF7C 003B6F96 \ProcNameOrOrdinal = "ShowTryWindow"
003B7FE2 83F8 00 cmp eax, 0
003B7FE5 /75 30 jnz short 003B8017 ; 翻转ZF,j
003B8038 8907 mov dword ptr ds:[edi], eax
003B8051 83C7 04 add edi, 4
; 指向GetRegister
003B805E 803E 00 cmp byte ptr ds:[esi], 0
003B8061 /74 0D je short 003B8070
003B8068 46 inc esi
003B806E ^\EB EE jmp short 003B805E
003B809D 46 inc esi
003B80CB ^\E9 2AFEFFFF jmp 003B7EFA
--------------------------------------------------------------------------
; 完成以后的代码，接003B7F02 0F85 BE000000 jnz 003B7FC6 ; 2个都得到了？ 为了好看，完成后代码下放
003B7F35 83C3 08 add ebx, 8
; 移动指针
003B7F65 803B 00 cmp byte ptr ds:[ebx], 0
003B7F68 /74 1F je short 003B7F89
003B7F81 43 inc ebx
003B7F87 ^\EB DC jmp short 003B7F65
003B7FB6 43 inc ebx
003B7FBC ^\E9 FCFDFFFF jmp 003B7DBD; 回去〉〉〉
003B7DC2 807B 08 00 cmp byte ptr ds:[ebx+8], 0
003B7DCB /0F84 1B030000 je 003B80EC ; 结束,j
003B80F1 61 popad
003B80F7 8B85 83CC4100 mov eax, dword ptr ss:[ebp+41CC83]
003B8102 C3 ret
003B373C B8 FFFFFFFF mov eax, -1
003B3746 83BD 81C84100 0>cmp dword ptr ss:[ebp+41C881], 0
003B3752 /0F84 570D0000 je 003B44AF; nj
003B376F 83BD 85C84100 0>cmp dword ptr ss:[ebp+41C885], 0
003B37A3 /0F84 060D0000 je 003B44AF; 还是nj
003B37D7 E8 060D0000 call 003B44E2
003B44E7 8D85 C1A04100 lea eax, dword ptr ss:[ebp+41A0C1]
003B44F2 68 C8000000 push 0C8
003B44F7 50 push eax ; buffer
003B44F8 FF95 BBCE4100 call dword ptr ss:[ebp+41CEBB] ; kernel32.GetWindowsDirectoryA
0012FF94 003B44FE /CALL to GetWindowsDirectoryA from 003B44F8
0012FF98 003B47F4 |Buffer = 003B47F4
0012FF9C 000000C8 \BufSize = C8 (200.)
003B4503 33C0 xor eax, eax
003B451C B9 C8000000 mov ecx, 0C8
003B4526 8DBD C1A04100 lea edi, dword ptr ss:[ebp+41A0C1]
003B4531 F2:AE repne scas byte ptr es:[edi] ; 复制目录
003B4538 C647 FF 5C mov byte ptr ds:[edi-1], 5C ; \
003B4541 C707 75736572 mov dword ptr ds:[edi], 72657375 ; user
003B455E C747 04 2E64617>mov dword ptr ds:[edi+4], 7461642E ; .dat
003B4592 C647 08 00 mov byte ptr ds:[edi+8], 0
003B45C4 8D85 C1A04100 lea eax, dword ptr ss:[ebp+41A0C1]
003B45CF 8D9D C1A14100 lea ebx, dword ptr ss:[ebp+41A1C1]
003B45DA 53 push ebx
003B45DB 50 push eax
003B45DC FF95 B7CE4100 call dword ptr ss:[ebp+41CEB7] ; kernel32.FindFirstFileA
003B45F9 8D9D C1A14100 lea ebx, dword ptr ss:[ebp+41A1C1]
003B462C 8D43 14 lea eax, dword ptr ds:[ebx+14]
003B4646 8D9D FCA24100 lea ebx, dword ptr ss:[ebp+41A2FC]
003B4679 53 push ebx
003B467A 50 push eax
003B467B FF95 B3CE4100 call dword ptr ss:[ebp+41CEB3] ; kernel32.FileTimeToSystemTime
0012FF94 003B4681 /CALL to FileTimeToSystemTime from 003B467B
0012FF98 003B4908 |pFileTime = 003B4908
0012FF9C 003B4A2F \pSystemTime = 003B4A2F
003B469D 8D9D FCA24100 lea ebx, dword ptr ss:[ebp+41A2FC]
; 计算一个sum
003B46A8 33C0 xor eax, eax
003B46AF 33D2 xor edx, edx
003B46CD 66:8B03 mov ax, word ptr ds:[ebx]
003B46E7 B9 6D010000 mov ecx, 16D
003B46F1 F7E1 mul ecx
003B470A 8985 80D24100 mov dword ptr ss:[ebp+41D280], eax
003B4742 33C0 xor eax, eax
003B475B 66:8B43 02 mov ax, word ptr ds:[ebx+2]
003B4764 B9 1E000000 mov ecx, 1E
003B476E F7E1 mul ecx
003B4775 0185 80D24100 add dword ptr ss:[ebp+41D280], eax
003B47AD 66:8B43 06 mov ax, word ptr ds:[ebx+6]
003B47B6 0185 80D24100 add dword ptr ss:[ebp+41D280], eax
003B47EE C3 ret ; 班师回朝
003B380E C785 88D24100 0>mov dword ptr ss:[ebp+41D288], 0
003B381D C785 84D24100 0>mov dword ptr ss:[ebp+41D284], 0
003B3836 83BD F01D4200 0>cmp dword ptr ss:[ebp+421DF0], 1
003B383D /0F85 10010000 jnz 003B3953 ; nj
003B3848 FFB5 FECF4100 push dword ptr ss:[ebp+41CFFE]
003B384E 8F85 42344200 pop dword ptr ss:[ebp+423442]
003B3859 FFB5 E41D4200 push dword ptr ss:[ebp+421DE4]
003B385F 8F85 46344200 pop dword ptr ss:[ebp+423446]
003B387C 8B9D E41D4200 mov ebx, dword ptr ss:[ebp+421DE4]
003B3899 399D FECF4100 cmp dword ptr ss:[ebp+41CFFE], ebx
003B389F /0F83 95000000 jnb 003B393A ; j
003B393F C785 84D24100 0>mov dword ptr ss:[ebp+41D284], 1
003B3974 83BD F01D4200 0>cmp dword ptr ss:[ebp+421DF0], 2
003B397B /0F85 E0000000 jnz 003B3A61 ; j
003B3A98 83BD F01D4200 0>cmp dword ptr ss:[ebp+421DF0], 3
003B3A9F 0F85 C3000000 jnz 003B3B68
003B3B9F 33C0 xor eax, eax
003B3BA6 83BD 88D24100 0>cmp dword ptr ss:[ebp+41D288], 1
003B3BAD 74 0D je short 003B3BBC
003B3BAF 83BD 84D24100 0>cmp dword ptr ss:[ebp+41D284], 1
003B3BB6 0F85 F5000000 jnz 003B3CB1
003B3BD3 8D85 081E4200 lea eax, dword ptr ss:[ebp+421E08] ; caption
003B3BDE 8D9D 261E4200 lea ebx, dword ptr ss:[ebp+421E26] ; http...
003B3BE9 8D8D 441E4200 lea ecx, dword ptr ss:[ebp+421E44] ; message
; 此时发现这两个牛插手了……
----------------------------------------------------------------------------
003BC777 20 45 6E 63 72 79 70 74 Encrypt
003BC787 65 64 20 62 79 20 7A 65 72 30 21 00 00 00 00 00 ed by zer0!.....
003BC797 00 00 00 00 00 00 63 6F 64 65 5F 69 6E 6A 65 63 ......code_injec
003BC7A7 74 00 00 00 00 00 00 00 00 t........
----------------------------------------------------------------------------
003B3C1C 89A5 74894100 mov dword ptr ss:[ebp+418974], esp
003B3C27 FFB5 81C84100 push dword ptr ss:[ebp+41C881]
003B3C2D 8F85 F9344200 pop dword ptr ss:[ebp+4234F9]
003B3C38 51 push ecx
003B3C39 53 push ebx
003B3C3A 50 push eax
003B3C3B FFB5 46344200 push dword ptr ss:[ebp+423446]
003B3C41 FFB5 42344200 push dword ptr ss:[ebp+423442]
003B3C47 E8 39810000 call 003BBD85 ; int3调用，都nop
003B3C7E 8BA5 74894100 mov esp, dword ptr ss:[ebp+418974]
003B3D22 83BD 84D24100 0>cmp dword ptr ss:[ebp+41D284], 1
003B3D29 74 09 je short 003B3D34
003B3D2B 83F8 02 cmp eax, 2
003B3D2E 0F85 C0040000 jnz 003B41F4
003B3D66 8D85 FD344200 lea eax, dword ptr ss:[ebp+4234FD]
003B3D99 8D9D 13354200 lea ebx, dword ptr ss:[ebp+423513]
003B3DA4 8D8D 27354200 lea ecx, dword ptr ss:[ebp+423527]
; 003BDC5A 30 36 37 38 31 46 38 42 06781F8B
003B3DAF 8D95 38204200 lea edx, dword ptr ss:[ebp+422038]
003B3DF9 89A5 74894100 mov dword ptr ss:[ebp+418974], esp
003B3E2C FFB5 85C84100 push dword ptr ss:[ebp+41C885]
003B3E32 8F85 F9344200 pop dword ptr ss:[ebp+4234F9]
003B3E4F 52 push edx
003B3E50 51 push ecx
003B3E51 53 push ebx
003B3E52 50 push eax
003B3E53 E8 2D7F0000 call 003BBD85; 还是他，nop
003B3E74 8BA5 74894100 mov esp, dword ptr ss:[ebp+418974]
003B3E91 83F8 02 cmp eax, 2
003B3E99 B8 00000000 mov eax, 0
003B3EA3 /0F84 C4040000 je 003B436D
003B3EDB B9 2A000000 mov ecx, 2A
003B3EE5 BF 0AD04100 mov edi, 41D00A
003B3EEF 03FD add edi, ebp
003B3F08 BE FD344200 mov esi, 4234FD
003B3F3A 03F5 add esi, ebp
003B3F41 F3:A4 rep movs byte ptr es:[edi], byte ptr ds:[esi]
