.汾 2
.ֿ֧ shell
.ֿ֧ dp1
.ֿ֧ EThread
.ֿ֧ spec

. 1
.򼯱 ģԿ, ı
.򼯱 ݺַ, 
.򼯱 ϵͳ, 
.򼯱 ߳̾, 
.򼯱 Ӵ, 
.򼯱 ٳּ߳̾, 
.򼯱 NtQueryVirtualMemory, ֽڼ
.򼯱 ݼXORֵ, 
.򼯱 ڴ, ֽڼ
.򼯱 ڴ2, ֽڼ
.򼯱 ڴ, ֽڼ
.򼯱 ڴַ, , , "3"
.򼯱 Ƭ1, ֽڼ
.򼯱 Ƭ2, ֽڼ
.򼯱 GOMڴ, ֽڼ
.򼯱 GOMFZַ, , , "1"
.򼯱 GOMFZ1, ֽڼ
.򼯱 C1, ֽڼ
.򼯱 ɨ, ߼
.򼯱 ųĵַ, , , "0"
.򼯱 ݼ, ֽڼ
.򼯱 gomfz, , , "6"
.򼯱 gomfz1, ֽڼ
.򼯱 gomfz2, ֽڼ
.򼯱 gomfz3, ֽڼ
.򼯱 gomfz4, ֽڼ
.򼯱 gomfz5, ֽڼ
.򼯱 gomfz6, ֽڼ
.򼯱 gomfz, 

.ӳ _ӳ, , , ڱӳзö̬ӿʼ
.ֲ a, ı
.ֲ ָ, ı, , "0"
.ֲ ָ2, ı, , "0"
.ֲ a1, 
.ֲ sss, ֽڼ
.ֲ bbb, ֽڼ
.ֲ data, ֽڼ
.ֲ data2, ֽڼ

' data  { 118, 228, 255, 0 }
'  ({ 96, 156, 252, 139, 93, 16, 131, 195, 8, 15, 182, 3, 139, 75, 252, 41, 77, 12, 144, 139, 125, 8, 139, 77, 12, 131, 249, 0, 126, 30, 242, 174, 117, 26, 137, 125, 8, 137, 77, 12, 79, 139, 243, 139, 78, 252, 243, 166, 117, 225, 255, 77, 8, 199, 69, 12, 253, 255, 255, 255, 157, 97 })
'  (IPı (658073647))
'  (ıIP (47.104.77.246))
'  (ıIP (47.104.93.173))
'  (ıIP (47.104.134.229))
' a  ȡժҪ (ֽڼ (UUMainFrame))
'  (RtlComputeCrc32 (0, a, ȡı (a)))
'  (ȡCRC32_ı2 (a))
'  ()
' Ƭ1  { 220, 212, 212, 86, 92, 36, 102, 162, 186, 189, 235, 186, 182, 95, 115, 75 }  ' C
'  (Ƭ1)
'  (ı (Ƭ1))
'  (_Xor (-318311669, 456574657))
'  (_Xor (-164612662, 456574657))
' data  { 5, 0, 0, 0 }
' a1  ȡֽڼָ (data)
'  (_ָ뵽 (a1))
'  (ıIP (47.104.57.39))
' ʼģ ()
' Ϣ (ؽ., 0, , )
'  (ѹ (ֽڼ (http://116.211.143.120:8899/b.txt)))
'  (1, , )
ģʽ  ļǷ (ȡضĿ¼ (3)  \sydlq.bin)
'  (RtlComputeCrc32 (0, TPageControl, ȡı (TPageControl)))

 ()
'  (ʮƵֽڼ (8B FD 83 EF 10,  ))
'  (ı ({ 139, 189, 54, 102, 196, 154, 185, 16, 80, 233, 241, 72, 106, 204, 180, 40, 250, 188, 218, 64, 190, 130, 140, 42, 144, 63, 93, 46, 135, 160, 38, 16, 59, 189, 168, 252, 177, 40, 102, 4, 171, 86, 164, 68, 182, 229, 42, 61, 207, 134, 116, 52, 160, 141, 195, 108, 82, 54 }))
.'  (ļǷ (ȡضĿ¼ (3)  \й켣.txt)  )

    ' ɾļ (ȡضĿ¼ (3)  \й켣.txt)

.
'  (ѹ (ֽڼ (vmci.status)))
.'  (ļǷ (ȡĿ¼ ()  \data\sydebug.txt)  )
    ' Ŀ¼ (ȡĿ¼ ()  \data)
    ' Ƿ ()
    ' дļ (ȡĿ¼ ()  \data\sydebug.txt, {  })

    ' logļ  ļ (ȡĿ¼ ()  \data\sydebug.txt, #д, #)

.
' sss  { 51, 192, 135, 69, 252, 138, 0, 139, 213, 131, 234, 16, 136, 2 }
'  (ֽڼʮı_dtcser (sss))
' _д־ (ʮʮ ( (&Ҵö)))


'  (ʮıֽڼ_dtcser (EB105379456E67496E6520626567696E2000))
'  (ʮƵֽڼ (33 C0 EB 00 87 45 FC EB 00 8A 00 EB 00 8B D5 EB 00 83 EA 10 EB 00 88 02,  ))
' ڴ_ܼAPI (sss, 251)
'  (sss)
' bbb  ȡհֽڼ (22)
' ڴ_ܼAPI (sss, ȡֽڼָ (bbb), 251, 22)
'  (bbb, ֽڼ (ﳬʱɾƷ))
'  (sss ({ 188, 241, 206, 239, 179, 172, 202, 177, 163, 172, 201 }  { 190, 179, 253, 184, 195, 206, 239, 198, 183, 163, 161 }))
' ı (ı ({ 188, 241, 206, 239, 179, 172, 202, 177, 163, 172, 201 }  { 190, 179, 253, 184, 195, 206, 239, 198, 183, 163, 161 }))
'  (ֽڼʮ ({ 100, 161, 24, 0, 0, 0, 139, 64, 36, 137, 69, 252 },  ))
'  (ȡժҪ (ֽڼ (_EL_HideOwner)))
' a  ı (ļ (ȡضĿ¼ (3)  \sydebug\debugʼCRC.txt))
' ʼ ()

' ָ  ָı (a, #з, )

.' ƴѭ (ȡԱ (ָ), a1)

    ' ָ2  ָı (ָ [a1], :, )

    .'  (ȡԱ (ָ2)  2)

        ' Ա (Ա_CRC, ֵ (ָ2 [2]))

    .
    ' d41d8cd98f00b204e9800998ecf8427e
.' ƴѭβ ()

'  (RtlComputeCrc32 (0, ȡժҪ (ֽڼ ()), 32))
'  (RtlComputeCrc32 (0, d41d8cd98f00b204e9800998ecf8427e, 32))
' дļ (ȡضĿ¼ (3)  \sydebug\debugCRC.txt, ֽڼ (ı (ȡԱ (Ա_CRC))))
' data  ֽڼ (ntdll.dll)
'  (data)
'  (data)
'  (ı ({ 119, 111, 119, 54, 52, 46, 100, 108, 108 }))
'  ({ 119, 0, 111, 0, 119, 0, 54, 0, 52, 0, 99, 0, 112, 0, 117, 0, 46, 0, 100, 0, 108, 0, 108, 0, 0, 0 })
' ϵͳ.ȡھ3 (, , 1)
'  (GetWindowַ, GetDesktopWindowַ)
' ʼ ()
' ϵͳ.ȡ߳ ()

'  (Ƿ64λϵͳ ())
' ʼ ()
' _д־ (NtQueryVirtualMemoryַ:  ʮʮ (NtQueryVirtualMemoryַ))
' Hello (1)
' Ϣ (ʮʮ (NtQueryVirtualMemoryַ), 0, , )
'  (1, , )
'  ()
_ʱӳ ()  ' ڳʼִϺòԴ
 (0)  ' ֵԡ


.ӳ 
.ֲ ʱڴУ, ڴУ
.ֲ a1, 
.ֲ ss, ֽڼ

'  (ֽڼʮı_dtcser (ֽڼ (-1809072640)))
' ss  ʮƵֽڼ (6C 75 61 6F 70 65 6E,  )
'  (ss)
'  (ss)
'  ()






' ʱڴУ.ڴַ  ʮʮ (605B2F)

' ʱڴУ.ֽڼ  ʮƵֽڼ (FF 96 8C 01 00,  )  ' { 139, 21, 180, 224, 113, 0 }
'  (ʱڴУ.ֽڼ)
'  (ʱڴУ.ֽڼ)
'  (_Xor (ʱڴУ.ڴַ, 3091739), ʱڴУ.ֽڼ)

.' ƴѭ (ȡԱ (ڴУ), a1)
    '  (ʮʮ (_Xor (ڴУ [a1].ڴַ, 3091739)))
.' ƴѭβ ()

' ʱڴУ.ڴַ  5207604
' ʱڴУ.ֽڼ  { 103, 14, 20, 153, 152 }  ' {255,150,140,1,0}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  4316198
' ʱڴУ.ֽڼ  { 112, 234, 198, 73, 103 }  ' {232,114,94,209,255}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  4351318
' ʱڴУ.ֽڼ  { 112, 50, 137, 107, 103 }  ' {232,170,17,243,255}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  4440322
' ʱڴУ.ֽڼ  { 19, 24, 14, 154, 152 }  ' {139,128,150,2,0}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  4703836
' ʱڴУ.ֽڼ  { 19, 24, 92, 146, 152 }  ' {139,128,196,10,0}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  4780445
' ʱڴУ.ֽڼ  { 19, 29, 88, 102, 103 }  ' {139,133,192,254,255}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  4781203
' ʱڴУ.ֽڼ  { 19, 106, 21, 37, 88 }  ' {139,242,141,189,192}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  4781159
' ʱڴУ.ֽڼ  { 205, 19, 116, 25, 92 }  ' {85,139,236,129,196}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  4728691
' ʱڴУ.ֽڼ  { 205, 19, 116, 27, 92 }  ' {85,139,236,131,196}
' Ա (ڴУ, ʱڴУ)


' ʱڴУ.ڴַ  4832857
' ʱڴУ.ֽڼ  { 17, 8, 24, 153, 152 }  ' {137,144,128,1,0}
' Ա (ڴУ, ʱڴУ)


' ʱڴУ.ڴַ  5149442
' ʱڴУ.ֽڼ  { 112, 194, 201, 149, 152 }  ' {232,90,81,13,0}
' Ա (ڴУ, ʱڴУ)


' ʱڴУ.ڴַ  5149825
' ʱڴУ.ֽڼ  { 112, 65, 205, 149, 152 }  ' {232,217,85,13,0}
' Ա (ڴУ, ʱڴУ)


' ʱڴУ.ڴַ  5237575
' ʱڴУ.ֽڼ  { 112, 203, 34, 103, 103 }  ' {232,83,186,255,255}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  5237519
' ʱڴУ.ֽڼ  { 57, 156, 119, 233, 152 }  ' {161,4,239,113,0}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  5221767
' ʱڴУ.ֽڼ  { 19, 141, 244, 123, 233 }  ' {139,21,108,227,113}
' Ա (ڴУ, ʱڴУ)


' ʱڴУ.ڴַ  5184344
' ʱڴУ.ֽڼ  { 112, 168, 65, 150, 152 }  ' {232,48,217,14,0}
' Ա (ڴУ, ʱڴУ)


' ʱڴУ.ڴַ  5178571
' ʱڴУ.ֽڼ  { 205, 19, 116, 33, 223 }  ' {85,139,236,185,71}
' Ա (ڴУ, ʱڴУ)


' ʱڴУ.ڴַ  5189711
' ʱڴУ.ֽڼ  { 205, 19, 116, 27, 92 }  ' {85,139,236,131,196}
' Ա (ڴУ, ʱڴУ)


' ʱڴУ.ڴַ  7404433
' ʱڴУ.ֽڼ  { 112, 93, 222, 152, 152 }  ' {232,197,70,0,0}
' Ա (ڴУ, ʱڴУ)


' ʱڴУ.ڴַ  8260633
' ʱڴУ.ֽڼ  { 112, 141, 78, 129, 152 }  ' {232,21,214,25,0}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  8201992
' ʱڴУ.ֽڼ  { 57, 96, 122, 233, 152 }  ' {161,248,226,113,0}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  7679527
' ʱڴУ.ֽڼ  { 205, 19, 116, 201, 203 }  ' {85,139,236,81,83}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  7678283
' ʱڴУ.ֽڼ  { 205, 19, 116, 27, 92 }  ' {85,139,236,131,196}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  7365535
' ʱڴУ.ֽڼ  { 112, 115, 178, 121, 103 }  ' {232,235,42,225,255}
' Ա (ڴУ, ʱڴУ)


' ʱڴУ.ڴַ  7388292
' ʱڴУ.ֽڼ  { 17, 205, 112, 171, 74 }  ' {137,85,232,51,210}
' Ա (ڴУ, ʱڴУ)

.' ƴѭ (ȡԱ (ڴУ), a1)

    '  (ʮʮ (_Xor (ڴУ [a1].ڴַ, 3091739)))
.' ƴѭβ ()


.ӳ ʼ
.ֲ data, ֽڼ
.ֲ data2, ֽڼ
.ֲ GetWindowRectַ_, 
.ֲ GetWindowRectַ޸, 
.ֲ ģ, 
.ֲ _begin1, 
.ֲ Wow64EmulateAtlThunk, ֽڼ
.ֲ Wow64SystemServiceEx, ֽڼ
.ֲ ֽڼ, ֽڼ
.ֲ ı, ı
.ֲ ָ, 
.ֲ ַ_, ֽڼ
.ֲ TurboDispatchJumpAddressEnd, ֽڼ
.ֲ , ֽڼ
.ֲ ַ, 
.ֲ Ѱҵַ, 
.ֲ ַ, 
.ֲ ַ2, 
.ֲ ʱڴУ, ڴУ
.ֲ a1, 
.ֲ C2ҵ, 
.ֲ C3ҵ, 
.ֲ ɵı, 
.ֲ ʱȡֽڼ, ֽڼ

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

' ַ  ı (Wow64EmulateAtlThunk)
'  (ַ_)
' data  ֽڼ (\\.\DACDA348)
' data  ֽڼ (\\.\60200346)
' data  ֽڼ (\\.\0B5A100A)
' data  ֽڼ (\\.\56DB659B)
' data  ֽڼ (\\.\CCF01085)
' data  ֽڼ (\\.\7180F8B5)
' data  ֽڼ (\\.\68BCD21E)
' data  ֽڼ (\\.\65B5DFE4)
' data  ֽڼ (\\.\ADFE8F8E)

' data  ֽڼ (KernelBas.dll)

' data  { 110, 0, 116, 0, 100, 0, 108, 0, 108, 0, 46, 0, 100, 0, 108, 0, 108, 0, 0, 0 }

' data  ʮƵֽڼ (8B 45 F4 83 C0 20 8B 00 89 45 EC,  )
'  (data)

'  (data)
'  (ֽڼʮ (data,  ))
' ' _д־ (ʮʮ ( (&call_ڴ)))
' ' _д־ (ʮʮ ( (&call_GetClassNameA)))
'  ()

_begin1  0

ǰID  ȡǰ̱ʶ_ ()

data  { 246, 236, 252, 244, 244, 182, 252, 244, 244 }  ' ntdll.dll
 (data)
data2  { 214, 236, 215, 232, 253, 246, 200, 234, 247, 251, 253, 235, 235 }  ' NtOpenProcess
 (data2)
NtOpenProcessַ  GetProcAddress_ (GetModuleHandleA_ (ı (data)), ı (data2))
NtOpenProcess  ȡհֽڼ (80)
Ӳϵ_ָ뵽ֽڼ (NtOpenProcessַ, 80, NtOpenProcess)
 (NtOpenProcess)
NtOpenProcessַ  ȡֽڼָ_asm (NtOpenProcess)
. (Ƿرdep  )
    ڴ_ (-1, NtOpenProcessַ, 80, 64, ɵı)
.
NtOpenProcessַXor  ϵͳ_ȡ (1 (NtOpenProcessַ, 2), NtOpenProcessַ)
NtOpenProcessַ  _Xor (NtOpenProcessַ, NtOpenProcessַXor)

ʱַͬ [1]  -162699217

ʱַͬ [2]  -1386387409

ʱַͬ [3]  -444176337

'  (inet_ntoa (ʱַͬ [1]))
'  (inet_ntoa (ʱַͬ [2]))
'  (inet_ntoa (ʱַͬ [3]))

ʱͬ  ϵͳ_ȡ (1, 3)
' s  GetProcAddress_ (GetModuleHandleA_ (kernel32.dll), CreateFileA)

data  { 219, 234, 253, 249, 236, 253, 222, 241, 244, 253, 217 }  ' CreateFileA
 (data)
data2  { 243, 253, 234, 246, 253, 244, 171, 170, 182, 252, 244, 244 }  ' kernel32.dll
 (data2)
CreateFileAַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
 (data2)
 (data)
ֽڼ  { 196, 196, 182, 196, 211, 218, 201, 214, 207, 223 }
 (ֽڼ)
ı  ı (ֽڼ)
 (ֽڼ)
ָ  ȡıָ_asm (ı)
hDevice  _call_CreateFileA (CreateFileAַ, ָ, 3221225472, 3, 0, 3, 0, 0)
' CreateFileAַ  0
ı  
' Ϣ (ı (hDevice), 0, , )

' ǷΪ64λϵͳ  

. (ǷΪ64λϵͳ  )

    Wow64SystemServiceEx  { 207, 247, 239, 174, 172, 203, 225, 235, 236, 253, 245, 203, 253, 234, 238, 241, 251, 253, 221, 224 }

     (Wow64SystemServiceEx)

    Wow64dllַ  GetWow64dll ()

    Wow64SystemServiceExַ  GetProcAddress64 (Wow64dllַ, ı (Wow64SystemServiceEx))  ' Wow64SystemServiceExַ

     (Wow64SystemServiceEx)

    . (Wow64SystemServiceExַ  0)

        Wow64SystemServiceExַXor  ϵͳ_ȡ (1 (Wow64SystemServiceExַ, 2), Wow64SystemServiceExַ)

        Wow64SystemServiceExַ  _Xor (Wow64SystemServiceExַ, Wow64SystemServiceExַXor)

    .

    ' ----------------------------

    Wow64EmulateAtlThunk  { 207, 247, 239, 174, 172, 221, 245, 237, 244, 249, 236, 253, 217, 236, 244, 204, 240, 237, 246, 243 }  ' Wow64EmulateAtlThunk

     (Wow64EmulateAtlThunk)

    Wow64EmulateAtlThunkַ  GetProcAddress64 (Wow64dllַ, ı (Wow64EmulateAtlThunk))  ' Wow64EmulateAtlThunkַ

    ' Ϣ (Wow64EmulateAtlThunkַ:  ʮʮ (Wow64EmulateAtlThunkַ), 0, , )

    Wow64dllַ  ADD__ (Wow64dllַ, 2000)

     (Wow64EmulateAtlThunk)

    . (Wow64EmulateAtlThunkַ  0)

          { 76, 139, 207, 69, 139, 196, 72, 137, 68, 36, 40, 73, 139, 213, 73, 139, 206, 72, 137, 92, 36, 32, 255, 21 }

        ַ  ȡֽڼָ_asm ()  8

        Ѱҵַ  ڴ澫ȷ_wow64Ѱ (Wow64EmulateAtlThunkַ, 45056, ַ)

        ' Ϣ (Ѱҵַ:  ʮʮ (Ѱҵַ), 0, , )

        . (Ѱҵַ  0)

            Ѱҵַ  ADD__ (Ѱҵַ, 22)

            ַ  _ָ뵽_ڴ (ADD__ (Ѱҵַ, 2))

            ' Ϣ (ַ:  ʮʮ (ַ), 0, , )

            Wow64EmulateAtlThunkַ  ADD__ (ַ, ADD__ (Ѱҵַ, 6))

            Wow64EmulateAtlThunkַXor  ϵͳ_ȡ (1 (Wow64EmulateAtlThunkַ, 2), Wow64EmulateAtlThunkַ)

            Wow64EmulateAtlThunkַ  _Xor (Wow64EmulateAtlThunkַ, Wow64EmulateAtlThunkַXor)

            ' Ϣ (ҵ, 0, , )


        .

    .

    ' ----------------------------

    TurboDispatchJumpAddressEnd  { 204, 237, 234, 250, 247, 220, 241, 235, 232, 249, 236, 251, 240, 210, 237, 245, 232, 217, 252, 252, 234, 253, 235, 235, 221, 246, 252 }

     (TurboDispatchJumpAddressEnd)

    Wow64cpudllַ  GetWow64CPUdll ()

    TurboDispatchJumpAddressEndַ  GetProcAddress64 (Wow64cpudllַ, ı (TurboDispatchJumpAddressEnd))  ' TurboDispatchJumpAddressEndַ

    Wow64cpudllַ  ADD__ (Wow64cpudllַ, 2000)

     (TurboDispatchJumpAddressEnd)

    . (TurboDispatchJumpAddressEndַ  0)

        TurboDispatchJumpAddressEndַXor  ϵͳ_ȡ (1 (TurboDispatchJumpAddressEndַ, 2), TurboDispatchJumpAddressEndַ)

        TurboDispatchJumpAddressEndַ  _Xor (TurboDispatchJumpAddressEndַ, TurboDispatchJumpAddressEndַXor)

    .

.

.

½ھ  _ָ뵽 (7464176)

½ھ  _ָ뵽 (½ھ)

' Wow64EmulateAtlThunk  { 207, 247, 239, 174, 172, 221, 245, 237, 244, 249, 236, 253, 217, 236, 244, 204, 240, 237, 246, 243 }

'  (Wow64EmulateAtlThunk)

' Wow64EmulateAtlThunkַ  GetProcAddress64 (GetWow64dll (), ı (Wow64EmulateAtlThunk))  ' Wow64EmulateAtlThunk

' ' Ϣ (Wow64EmulateAtlThunkַ:  ʮʮ (Wow64EmulateAtlThunkַ), 0, , )

'  (Wow64EmulateAtlThunk)

.'  (Wow64EmulateAtlThunkַ  0)

    ' Wow64EmulateAtlThunkַXor  ϵͳ_ȡ (1 (Wow64EmulateAtlThunkַ, 2), Wow64EmulateAtlThunkַ)

    ' Wow64EmulateAtlThunkַ  _Xor (Wow64EmulateAtlThunkַ, Wow64EmulateAtlThunkַXor)

.




data  { 201, 237, 253, 234, 225, 200, 253, 234, 254, 247, 234, 245, 249, 246, 251, 253, 219, 247, 237, 246, 236, 253, 234 }  ' QueryPerformanceCounter
data2  { 243, 253, 234, 246, 253, 244, 171, 170, 182, 252, 244, 244 }  ' kernel32.dll
 (data)
 (data2)
QueryPerformanceCounterַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
 (data)
 (data2)

data  { 236, 241, 245, 253, 223, 253, 236, 204, 241, 245, 253 }  ' timeGetTime
data2  { 207, 209, 214, 213, 213, 182, 252, 244, 244 }  ' WINMM.dll
 (data)
 (data2)
timeGetTimeַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
 (data)
 (data2)
'  (ʮʮ (QueryPerformanceCounterַ), ʮʮ (timeGetTimeַ))
data  { 203, 244, 253, 253, 232 }  ' Sleep
data2  { 243, 253, 234, 246, 253, 244, 171, 170, 182, 252, 244, 244 }  ' kernel32.dll
 (data)
 (data2)
sleepַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
. (sleepַ  0  sleepַ  268435456)
    յĵ  
.
sleepַXor  ϵͳ_ȡ (1 (sleepַ, 2), sleepַ)
sleepַ  _Xor (sleepַ, sleepַXor)
 (data)
 (data2)
'  (sleepַ)

data  { 211, 241, 222, 249, 235, 236, 203, 225, 235, 236, 253, 245, 219, 249, 244, 244 }  ' KiFastSystemCall
data2  { 246, 236, 252, 244, 244, 182, 252, 244, 244 }  ' ntdll.dll
 (data)

 (data2)

NTDLLģַ  GetModuleHandleA_ (ı (data2))

KiFastSystemCallַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))

. (KiFastSystemCallַ  0  KiFastSystemCallַ  268435456)
    յĵ  
.
KiFastSystemCallַXor  ϵͳ_ȡ (1 (KiFastSystemCallַ, 2), KiFastSystemCallַ)
KiFastSystemCallַ  _Xor (KiFastSystemCallַ, KiFastSystemCallַXor)
 (data)
 (data2)

data  { 194, 239, 204, 253, 234, 245, 241, 246, 249, 236, 253, 200, 234, 247, 251, 253, 235, 235 }  ' ZwTerminateProcess
data2  { 246, 236, 252, 244, 244, 182, 252, 244, 244 }  ' ntdll.dll
 (data)
 (data2)
ZwTerminateProcessַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
. (ZwTerminateProcessַ  0  ZwTerminateProcessַ  268435456)
    յĵ  
.
ZwTerminateProcessַXor  ϵͳ_ȡ (1 (ZwTerminateProcessַ, 2), ZwTerminateProcessַ)
ZwTerminateProcessַ  _Xor (ZwTerminateProcessַ, ZwTerminateProcessַXor)
 (data)
 (data2)

data  { 214, 236, 201, 237, 253, 234, 225, 206, 241, 234, 236, 237, 249, 244, 213, 253, 245, 247, 234, 225 }  ' NtQueryVirtualMemory
data2  { 246, 236, 252, 244, 244, 182, 252, 244, 244 }  ' ntdll.dll
 (data)
 (data2)
NtQueryVirtualMemoryַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
. (NtQueryVirtualMemoryַ  0  NtQueryVirtualMemoryַ  268435456)
    յĵ  
.
NtQueryVirtualMemoryַXor  ϵͳ_ȡ (1 (NtQueryVirtualMemoryַ, 2), NtQueryVirtualMemoryַ)
NtQueryVirtualMemoryַ  _Xor (NtQueryVirtualMemoryַ, NtQueryVirtualMemoryַXor)
 (data)
 (data2)

data  { 223, 253, 236, 207, 241, 246, 252, 247, 239 }  ' GetWindow
data2  { 237, 235, 253, 234, 171, 170, 182, 252, 244, 244 }  ' user32.dll
 (data)
 (data2)
GetWindowַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
. (GetWindowַ  0  GetWindowַ  268435456)
    յĵ  
.
GetWindowַXor  ϵͳ_ȡ (1 (GetWindowַ, 2), GetWindowַ)
GetWindowַ  _Xor (GetWindowַ, GetWindowַXor)
 (data)
 (data2)

data  { 223, 253, 236, 220, 253, 235, 243, 236, 247, 232, 207, 241, 246, 252, 247, 239 }  ' GetDesktopWindow
data2  { 237, 235, 253, 234, 171, 170, 182, 252, 244, 244 }  ' user32.dll
 (data)
 (data2)
GetDesktopWindowַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
. (GetDesktopWindowַ  0  GetDesktopWindowַ  268435456)
    յĵ  
.
GetDesktopWindowַXor  ϵͳ_ȡ (1 (GetDesktopWindowַ, 2), GetDesktopWindowַ)
GetDesktopWindowַ  _Xor (GetDesktopWindowַ, GetDesktopWindowַXor)
 (data)
 (data2)

data  { 223, 253, 236, 207, 241, 246, 252, 247, 239, 204, 240, 234, 253, 249, 252, 200, 234, 247, 251, 253, 235, 235, 209, 252 }  ' GetWindowThreadProcessId
data2  { 237, 235, 253, 234, 171, 170, 182, 252, 244, 244 }  ' user32.dll
 (data)
 (data2)
GetWindowThreadProcessIdַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
. (GetWindowThreadProcessIdַ  0  GetWindowThreadProcessIdַ  268435456)
    յĵ  
.
GetWindowThreadProcessIdַXor  ϵͳ_ȡ (1 (GetWindowThreadProcessIdַ, 2), GetWindowThreadProcessIdַ)
GetWindowThreadProcessIdַ  _Xor (GetWindowThreadProcessIdַ, GetWindowThreadProcessIdַXor)
 (data)
 (data2)

data  { 223, 253, 236, 219, 244, 249, 235, 235, 214, 249, 245, 253, 217 }  ' GetClassNameA
data2  { 237, 235, 253, 234, 171, 170, 182, 252, 244, 244 }  ' user32.dll
 (data)
 (data2)
GetClassNameAַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
. (GetClassNameAַ  0  GetClassNameAַ  268435456)
    յĵ  
.
GetClassNameAַXor  ϵͳ_ȡ (1 (GetClassNameAַ, 2), GetClassNameAַ)
GetClassNameAַ  _Xor (GetClassNameAַ, GetClassNameAַXor)
 (data)
 (data2)

data  { 221, 246, 237, 245, 219, 240, 241, 244, 252, 207, 241, 246, 252, 247, 239, 235 }  ' EnumChildWindows
data2  { 237, 235, 253, 234, 171, 170, 182, 252, 244, 244 }  ' user32.dll
 (data)
 (data2)
' Ϣ (ʮʮ ( (&GetProcAddress_))  #з  ʮʮ ( (&GetModuleHandleA_)), 0, , )

ģ  GetModuleHandleA_ (ı (data2))

EnumChildWindowsַ  GetProcAddress_ (ģ, ı (data))
' Ϣ (ʮʮ (EnumChildWindowsַ), 0, , )

' _д־ (EnumChildWindowsַ  ʮʮ (EnumChildWindowsַ))
. (EnumChildWindowsַ  0  EnumChildWindowsַ  ģ  20000)
    յĵ  
.
EnumChildWindowsַXor  ϵͳ_ȡ (1 (EnumChildWindowsַ, 2), EnumChildWindowsַ)
' _д־ (EnumChildWindowsַ  ʮʮ (EnumChildWindowsַ))
EnumChildWindowsַ  _Xor (EnumChildWindowsַ, EnumChildWindowsַXor)
' _д־ (EnumChildWindowsַ  ʮʮ (EnumChildWindowsַ))
' _д־ (callEnumChildWindowsַ  ʮʮ ( (&call_EnumChildWindows)))
 (data)
 (data2)
. (EnumChildWindowsַ  0  EnumChildWindowsַ  268435456)
    յĵ  
.

data  { 203, 253, 246, 252, 213, 253, 235, 235, 249, 255, 253, 204, 241, 245, 253, 247, 237, 236, 217 }  ' SendMessageTimeoutA
data2  { 237, 235, 253, 234, 171, 170, 182, 252, 244, 244 }  ' user32.dll
 (data)
 (data2)
SendMessageTimeoutAַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
. (SendMessageTimeoutAַ  0  SendMessageTimeoutAַ  268435456)
    յĵ  
.
SendMessageTimeoutAַXor  ϵͳ_ȡ (1 (SendMessageTimeoutAַ, 2), SendMessageTimeoutAַ)
SendMessageTimeoutAַ  _Xor (SendMessageTimeoutAַ, SendMessageTimeoutAַXor)
 (data)
 (data2)
data  { 223, 253, 236, 207, 241, 246, 252, 247, 239, 202, 253, 251, 236 }  ' GetWindowRect
data2  { 237, 235, 253, 234, 171, 170, 182, 252, 244, 244 }  ' user32.dll
 (data)
 (data2)
GetWindowRectַ  GetProcAddress_ (GetModuleHandleA_ (ı (data2)), ı (data))
GetWindowRectַ_  Q_jcdz (Q_sljb (ı (data2)), ı (data))
GetWindowRectַ޸  _Xor (GetWindowRectַ, GetWindowRectַ_)
GetWindowRectַXor  ϵͳ_ȡ (1 (GetWindowRectַ, 2), GetWindowRectַ)
GetWindowRectַ  _Xor (GetWindowRectַ, GetWindowRectַXor)
 (data)
 (data2)
. (GetWindowRectַ޸  0)
    񵶼¼־ (9, , , )
    յĵ  
.
Ƿ  Ƿ ()

' ʱڴУ.ڴַ  4702426
' ʱڴУ.ֽڼ  { 55, 19, 79, 103 }  ' {175,139,215,255}
' Ա (ڴУ, ʱڴУ)

' ʱڴУ.ڴַ  4702396
' ʱڴУ.ֽڼ  { 81, 19, 79, 103 }  ' {201,139,215,255}
' Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  4769035
ʱڴУ.ֽڼ  { 57, 108, 122, 233, 152 }  ' {161,244,226,113,0}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  4780246
ʱڴУ.ֽڼ  { 17, 27, 12, 156 }  ' {137,131,148,4}
Ա (ڴУ, ʱڴУ)


ʱڴУ.ڴַ  4783439
ʱڴУ.ֽڼ  { 205, 19, 116, 25, 92 }  ' {85,139,236,129,196}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  4907945
ʱڴУ.ֽڼ  { 112, 121, 252, 66, 103 }  ' {232,225,100,218,255}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  5175563
ʱڴУ.ֽڼ  { 27, 88, 175, 41, 134 }  ' {131,192,55,177,30}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  5129133
ʱڴУ.ֽڼ  { 19, 205, 96, 21, 221, 144 }  ' {139,85,248,141,69,8}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  5128598
ʱڴУ.ֽڼ  { 19, 205, 96, 21, 221, 144 }  ' {139,85,248,141,69,8}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  5221278
ʱڴУ.ֽڼ  { 179, 81, 71, 103 }  ' {43,201,223,255}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  5198397
ʱڴУ.ֽڼ  { 250, 14, 122, 103 }  ' {98,150,226,255}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  5197997
ʱڴУ.ֽڼ  { 74, 15, 122, 103 }  ' {210,151,226,255}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  5207902
ʱڴУ.ֽڼ  { 19, 221, 100, 24, 160, 216 }  ' {139,69,252,128,56,64}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  7388292
ʱڴУ.ֽڼ  { 17, 205, 112, 171, 74 }  ' {137,85,232,51,210}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  7381799
ʱڴУ.ֽڼ  { 205, 19, 116, 25, 92, 40 }  ' {85,139,236,129,196,176}
Ա (ڴУ, ʱڴУ)

ʱڴУ.ڴַ  7436076
ʱڴУ.ֽڼ  { 19, 141, 44, 120, 233, 152 }  ' { 139, 21, 180, 224, 113, 0 }
Ա (ڴУ, ʱڴУ)

.' ƴѭ (ȡԱ (ڴУ), a1)
    '  (ʮʮ (_Xor (ڴУ [a1].ڴַ, 3091739)))
.' ƴѭβ ()


ʱڴУ.ڴַ  5207604
ʱڴУ.ֽڼ  { 103, 14, 20, 153, 152 }  ' {255,150,140,1,0}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  4316198
ʱڴУ.ֽڼ  { 112, 234, 198, 73, 103 }  ' {232,114,94,209,255}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  4351318
ʱڴУ.ֽڼ  { 112, 50, 137, 107, 103 }  ' {232,170,17,243,255}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  4440322
ʱڴУ.ֽڼ  { 19, 24, 14, 154, 152 }  ' {139,128,150,2,0}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  4703836
ʱڴУ.ֽڼ  { 19, 24, 92, 146, 152 }  ' {139,128,196,10,0}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  4780445
ʱڴУ.ֽڼ  { 19, 29, 88, 102, 103 }  ' {139,133,192,254,255}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  4781203
ʱڴУ.ֽڼ  { 19, 106, 21, 37, 88 }  ' {139,242,141,189,192}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  4781159
ʱڴУ.ֽڼ  { 205, 19, 116, 25, 92 }  ' {85,139,236,129,196}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  4728691
ʱڴУ.ֽڼ  { 205, 19, 116, 27, 92 }  ' {85,139,236,131,196}
Ա (ڴУ_򵥹, ʱڴУ)


ʱڴУ.ڴַ  4832857
ʱڴУ.ֽڼ  { 17, 8, 24, 153, 152 }  ' {137,144,128,1,0}
Ա (ڴУ_򵥹, ʱڴУ)


ʱڴУ.ڴַ  5149442
ʱڴУ.ֽڼ  { 112, 194, 201, 149, 152 }  ' {232,90,81,13,0}
Ա (ڴУ_򵥹, ʱڴУ)


ʱڴУ.ڴַ  5149825
ʱڴУ.ֽڼ  { 112, 65, 205, 149, 152 }  ' {232,217,85,13,0}
Ա (ڴУ_򵥹, ʱڴУ)


ʱڴУ.ڴַ  5237575
ʱڴУ.ֽڼ  { 112, 203, 34, 103, 103 }  ' {232,83,186,255,255}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  5237519
ʱڴУ.ֽڼ  { 57, 156, 119, 233, 152 }  ' {161,4,239,113,0}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  5221767
ʱڴУ.ֽڼ  { 19, 141, 244, 123, 233 }  ' {139,21,108,227,113}
Ա (ڴУ_򵥹, ʱڴУ)


ʱڴУ.ڴַ  5184344
ʱڴУ.ֽڼ  { 112, 168, 65, 150, 152 }  ' {232,48,217,14,0}
Ա (ڴУ_򵥹, ʱڴУ)


ʱڴУ.ڴַ  5178571
ʱڴУ.ֽڼ  { 205, 19, 116, 33, 223 }  ' {85,139,236,185,71}
Ա (ڴУ_򵥹, ʱڴУ)


ʱڴУ.ڴַ  5189711
ʱڴУ.ֽڼ  { 205, 19, 116, 27, 92 }  ' {85,139,236,131,196}
Ա (ڴУ_򵥹, ʱڴУ)


ʱڴУ.ڴַ  7404433
ʱڴУ.ֽڼ  { 112, 93, 222, 152, 152 }  ' {232,197,70,0,0}
Ա (ڴУ_򵥹, ʱڴУ)


ʱڴУ.ڴַ  8260633
ʱڴУ.ֽڼ  { 112, 141, 78, 129, 152 }  ' {232,21,214,25,0}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  8201992
ʱڴУ.ֽڼ  { 57, 96, 122, 233, 152 }  ' {161,248,226,113,0}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  7679527
ʱڴУ.ֽڼ  { 205, 19, 116, 201, 203 }  ' {85,139,236,81,83}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  7678283
ʱڴУ.ֽڼ  { 205, 19, 116, 27, 92 }  ' {85,139,236,131,196}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  7365535
ʱڴУ.ֽڼ  { 112, 115, 178, 121, 103 }  ' {232,235,42,225,255}
Ա (ڴУ_򵥹, ʱڴУ)

ʱڴУ.ڴַ  7388292
ʱڴУ.ֽڼ  { 17, 205, 112, 171, 74 }  ' {137,85,232,51,210}
Ա (ڴУ_򵥹, ʱڴУ)


.' ƴѭ (ȡԱ (ڴУ_򵥹), a1)

    '  (ڴУ_򵥹 [a1].ֽڼ)

    ' ʱȡֽڼ  ָ뵽ֽڼ (_Xor (ڴУ_򵥹 [a1].ڴַ, 3091739), ȡֽڼ (ڴУ_򵥹 [a1].ֽڼ))

    .'  (ʱȡֽڼ  ڴУ_򵥹 [a1].ֽڼ)

        ' Ϣ (ı (a1), 0, , )

    .

    '  (ڴУ_򵥹 [a1].ֽڼ)

.' ƴѭβ ()

' Ϣ (ͨ, 0, , )

.' ƴѭ (ȡԱ (ڴУ), a1)
    '  (ʮʮ (_Xor (ڴУ [a1].ڴַ, 3091739)))
.' ƴѭβ ()



 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ 
. data, ֽڼ, ο
.ֲ a1, 
.ֲ _begin2, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

_begin2  0

.ƴѭ (ȡֽڼ (data), a1)

    data [a1]  λ (data [a1], 152)

.ƴѭβ ()
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ GetModuleHandleA_, , , ģ,ֻܰĸ,,Ƿ.ִСд
. ģ, ı
.ֲ _begin3, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin3  0
 ({ 139, 125, 8, 139, 63, 87, 51, 192, 131, 201, 255, 242, 174, 95, 139, 241, 247, 214, 100, 161, 48, 0, 0, 0, 139, 64, 12, 139, 80, 12, 141, 64, 16, 255, 48, 51, 192, 82, 139, 74, 48, 15, 182, 28, 56, 15, 182, 20, 65, 43, 218, 131, 251, 0, 116, 12, 131, 251, 32, 116, 7, 131, 251, 224, 116, 2, 117, 9, 131, 192, 1, 59, 240, 116, 15, 117, 220, 90, 139, 18, 51, 192, 91, 59, 218, 83, 116, 6, 117, 203, 90, 139, 66, 24, 201, 194, 4, 0 })
 (0)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ GetProcAddress_, , , ͨȡַ,Сдһ
. ģ, 
. , ı
.ֲ _begin4, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin4  0

 ({ 139, 93, 8, 131, 251, 0, 116, 58, 139, 67, 60, 3, 195, 139, 80, 120, 3, 211, 139, 74, 24, 139, 66, 32, 81, 81, 80, 51, 192, 131, 201, 255, 139, 125, 12, 139, 63, 242, 174, 247, 209, 88, 81, 139, 125, 12, 139, 63, 139, 52, 24, 3, 243, 243, 166, 89, 116, 14, 131, 192, 4, 94, 78, 86, 117, 232, 51, 192, 201, 194, 8, 0, 94, 89, 43, 206, 139, 66, 36, 141, 4, 72, 15, 183, 4, 24, 139, 74, 28, 141, 4, 129, 139, 4, 24, 3, 195, 201, 194, 8, 0 })

 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ _ʱӳ

' ӳԳãڿԻЧ뷢ǰϵͳԶգ뽫ԵʱڱӳС ***עⲻҪ޸ıӳơֵ͡





.ӳ jfskfdhrr, , 
. Sendӿ, 
. ںCRCֵ, 
. textCRCֵ, 
. VMPCRCֵ, 
. textεַ, 
. textγ, 
. VMPεַ, 
. VMPγ, 
.ֲ ȡַ, 
.ֲ ȡ, 
.ֲ CRCУܳ, 
.ֲ crc, 
.ֲ ַ, 
.ֲ a1, 
.ֲ λ, 
.ֲ kernel32, ֽڼ
.ֲ GetProcAddress, ֽڼ
.ֲ ntdll, ֽڼ
.ֲ KiFastSystemCall, ֽڼ
.ֲ ַ_, ֽڼ
.ֲ _begin5, 
.ֲ ǰϵͳ汾, 
.ֲ APIṹ, ֽڼ

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־


ȡַ  0

ȡ  0

crc  567567457  ' ebp-0xc

_begin5  0


ݺַ  Sendӿ

ȫ_ںCRCֵ  ںCRCֵ

ȫ_textCRCֵ  textCRCֵ

ȫ_VMPCRCֵ  VMPCRCֵ

ȫ_textεַ  textεַ

ȫ_textγ  textγ

ȫ_VMPεַ  VMPεַ

ȫ_VMPγ  VMPγ

RtlAdjustPrivilege (19, , , 0)

Ƿرdep  رDEP ()

ǰϵͳ汾  ȡϵͳ汾1 ()
' Ϣ (ǰϵͳ汾:  ı (ǰϵͳ汾), 0, , )
. (ǰϵͳ汾  9)

    ǷΪ64λϵͳ  Ƿ64λϵͳ ()
    ' Ϣ (Ƿwin764:  ı (ǷΪ64λϵͳ), 0, , )
.

ʼ ()

ַ  GetProcAddress_ (GetModuleHandleA_ (de (0DO0FO3EO03O09O00O00O00O78O9COCBO2BO49OC9OC9OD1O03O62O00O12O0FO03O89)), de (0DO0FO3EO03O10O00O00O00O78O9COF3O2BO09O4AOCCO2CO4EOF5O48O2CO4AO71O2DO2AOCAO2FO02O00O33OC1O06O40))  ' ntdll.dll  NtRaiseHardError

kernel32  { 243, 253, 234, 246, 253, 244, 171, 170, 182, 252, 244, 244 }  ' ֽڼ (kernel32.dll)

 (kernel32)

GetProcAddress  { 223, 253, 236, 200, 234, 247, 251, 217, 252, 252, 234, 253, 235, 235 }  ' ֽڼ (GetProcAddress)

 (GetProcAddress)

GetProcAddressַ  GetProcAddress_ (GetModuleHandleA_ (ı (kernel32)), ı (GetProcAddress))

GetProcAddressAPIַ  Q_jcdz (Q_sljb (ı (kernel32)), ı (GetProcAddress))
' Ϣ (aaa, 0, , )

 (GetProcAddress)

 (kernel32)

' _д־ (API:  ʮʮ (GetProcAddressAPIַ))
' _д־ (:  ʮʮ (GetProcAddressַ))

' _д־ (ֵ:  ı (_Xor (GetProcAddressַ, GetProcAddressAPIַ)))

APIַǷ޸  _Xor (GetProcAddressַ, GetProcAddressAPIַ)


' ڴ_ֽڼ_asm (ַ, , 40, )
  ȡհֽڼ (40)

' Ϣ (ʮʮ (ȡֽڼָ_asm ())  #з  ʮʮ (ַ), 0, , )
' 111111111111111111111111
Ӳϵ_ָ뵽ֽڼ (ַ, 40, )

' Ϣ (.., 0, , )

' дļ (ȡضĿ¼ (3)  \312321.txt, )
.жϿʼ (KiFastSystemCallַ  0)

    ' ڴ_ֽڼ_asm (_Xor (KiFastSystemCallַ, KiFastSystemCallַXor), KiFastSystemCall, 5, )

    .жϿʼ (KiFastSystemCall [1]  235)

        ' յĵ  

    .Ĭ

    .жϽ

.Ĭ

.жϽ


ntdll  { 246, 236, 252, 244, 244, 182, 252, 244, 244 }
 (ntdll)
' Ϣ (ʮʮ (ַ)  #з  ʮʮ (ȡֽڼָ ()), 0, , )
NtGetContextThreadַ  GetProcAddress_ (GetModuleHandleA_ (ı (ntdll)), ı (GAME_ں (ֽڼ (#NtGetContextThread))))
 (ntdll)

ӲϵڴС1  ȡ (101, 504)

ӲϵڴС2  ȡ (720, 2004)

NtGetContextThread  ȡհֽڼ (50)

Ӳϵ_ָ뵽ֽڼ (NtGetContextThreadַ, 50, NtGetContextThread)


.ƴѭ (50, a1)
    .жϿʼ (NtGetContextThread [a1]  194)
        NTAPIC2λ  a1
        ѭ ()
    .Ĭ

    .жϽ

.ƴѭβ ()


APIṹ  ȡֽڼ (NtGetContextThread, NTAPIC2λ)
WriteDword (ADD__ (ȡֽڼָ_asm (APIṹ), 1), 0)
NTAPIֽͬڼCRC  ȡCRC32_ַ (ȡֽڼָ_asm (APIṹ), ȡֽڼ (APIṹ))


.жϿʼ (NtGetContextThread [1]  194)
    ' Ϣ (err=1, 0, , )

    ֹͣ  
    ַ޸  
.Ĭ

.жϽ

' дļ (ȡضĿ¼ (3)  \312321.txt, NtGetContextThread)

.ƴѭ (50, a1)

    ӲϵCRC  ӲϵCRC  NtGetContextThread [a1]

    . (λ  0)
        .жϿʼ (NtGetContextThread [a1]  194)
            λ  a1  1
        .Ĭ

        .жϽ

    .



.ƴѭβ ()

. ( [1]  104)
    ֹͣ  
    ' Ϣ (err=2, 0, , )

.
a1  0
.ƴѭ (λ, a1)

    . (NtGetContextThread [1]  104)
        ' Ϣ (err=4  #з  ı (ȡֽڼ (NtGetContextThread))  #з  ı (λ), 0, , )
        ֹͣ  
        Ӳϵ㺯޸  

    .

    . (NtGetContextThread [a1]  195)
        ֹͣ  
        Ӳϵ㺯޸  
        ' Ϣ (err=3  #з  ı (ȡֽڼ (NtGetContextThread))  #з  ı (λ), 0, , )
    .

.ƴѭβ ()


ӲϵXORֵ  ȡ (100, 255)

Ӳϵ_ܼAPI (NtGetContextThread, ӲϵXORֵ)


.жϿʼ ( [3]  194)
    ֹͣ  
    ַ޸  
    ' Ϣ (err=4, 0, , )

.Ĭ

.жϽ

'   ѹ ()

 ()

'   ȡհֽڼ (50)
' Ӳϵ_ָ뵽ֽڼ (ַ, 50, )
' Ӳϵ_ܼAPI (, XORֵ)

XORֵ  ȡ (100, 255)

' ģ汾 (ݺַ)
CRCڴУ鱣ַ  _ȡӳʵַ (&½ڴУ鱣)

У5ڴУ鱣ַ  _ȡӳʵַ (&У5)

δСַ  ȡ (32, 100)

CRCڴУ鱣ַ  ȡ (1058042480, 1858042480)

CRCڴУ鱣ַ1  λ (CRCڴУ鱣ַ, CRCڴУ鱣ַ)

' _д־ (У1:  ʮʮ (_ȡӳʵַ (&У1)))
' _д־ (У2:  ʮʮ (_ȡӳʵַ (&У2)))
' _д־ (У3:  ʮʮ (_ȡӳʵַ (&У3)))
' _д־ (У4:  ʮʮ (_ȡӳʵַ (&У4)))
' _д־ (У5:  ʮʮ (_ȡӳʵַ (&У5)))
' _д־ (У6:  ʮʮ (_ȡӳʵַ (&У6)))
' _д־ (У7:  ʮʮ (_ȡӳʵַ (&У7)))
' _д־ (У8:  ʮʮ (_ȡӳʵַ (&У8)))
' _д־ (У9:  ʮʮ (_ȡӳʵַ (&У9)))
' _д־ (У10:  ʮʮ (_ȡӳʵַ (&У10)))
' _д־ (У11:  ʮʮ (_ȡӳʵַ (&У11)))
' _д־ (У12:  ʮʮ (_ȡӳʵַ (&У12)))
' _д־ (У13:  ʮʮ (_ȡӳʵַ (&У13)))
' _д־ (У14:  ʮʮ (_ȡӳʵַ (&У14)))
' _д־ (У15:  ʮʮ (_ȡӳʵַ (&У15)))
' _д־ (У16:  ʮʮ (_ȡӳʵַ (&У16)))
' _д־ (У17:  ʮʮ (_ȡӳʵַ (&У17)))
' _д־ (У18:  ʮʮ (_ȡӳʵַ (&У18)))
' _д־ (У19:  ʮʮ (_ȡӳʵַ (&У19)))
' _д־ (У20:  ʮʮ (_ȡӳʵַ (&У20)))
' _д־ (У21:  ʮʮ (_ȡӳʵַ (&У21)))
' _д־ (У22:  ʮʮ (_ȡӳʵַ (&У22)))
' _д־ (У23:  ʮʮ (_ȡӳʵַ (&У23)))
' _д־ (У24:  ʮʮ (_ȡӳʵַ (&У24)))
' _д־ (У25:  ʮʮ (_ȡӳʵַ (&У25)))
' _д־ (У26:  ʮʮ (_ȡӳʵַ (&У26)))
' _д־ (У27:  ʮʮ (_ȡӳʵַ (&У27)))
' _д־ (У28:  ʮʮ (_ȡӳʵַ (&У28)))
' _д־ (У29:  ʮʮ (_ȡӳʵַ (&У29)))
' _д־ (У30:  ʮʮ (_ȡӳʵַ (&У30)))

ȡַ  CRCڴУ鱣ַ

CRCУܳ  ADD__ (ȡַ, 260)

.жѭ (ȡַ  CRCУܳ)

    ȡ  0

     ({ 139, 69, 252, 139, 0, 137, 69, 248 })

    ȡַ  ADD__ (ȡַ, 4)

    ' crc  λ (crc, ȡ)
    ' 007B01E6    8B45 F4         mov eax,dword ptr ss:[ebp-0xC]
    ' 007B01E9    3345 F8         xor eax,dword ptr ss:[ebp-0x8]
    ' 007B01EC    8945 F4         mov dword ptr ss:[ebp-0xC],eax
     ({ 139, 69, 244, 51, 69, 248, 137, 69, 244 })

.жѭβ ()

CRCڴУӳڴУ  crc

' ϵͳ.ҳʼ ()

' ߳ (&߳, , ߳̾)

' ߳ (&߳, , ߳̾)

' Ϣ (ca, 0, , )

' ַ  ı (ѹ ({ 13, 15, 62, 3, 33, 0, 0, 0, 120, 156, 203, 40, 41, 41, 176, 210, 215, 55, 52, 52, 211, 51, 50, 52, 212, 51, 52, 49, 214, 51, 52, 50, 176, 178, 176, 176, 180, 212, 79, 210, 43, 169, 40, 1, 0, 143, 29, 8, 117 }))
' http://sycheck.oss-cn-beijing.aliyuncs.com/sy.txt
ַ_  { 240, 236, 236, 232, 162, 183, 183, 235, 225, 251, 240, 253, 251, 243, 182, 247, 235, 235, 181, 251, 246, 181, 250, 253, 241, 242, 241, 246, 255, 182, 249, 244, 241, 225, 237, 246, 251, 235, 182, 251, 247, 245, 183, 235, 225, 182, 236, 224, 236 }
 (ַ_)
ַ  ı (ַ_)
 (ַ_)

ַ_  { 240, 236, 236, 232, 162, 183, 183, 235, 225, 251, 240, 253, 251, 243, 182, 247, 235, 235, 181, 251, 246, 181, 250, 253, 241, 242, 241, 246, 255, 182, 249, 244, 241, 225, 237, 246, 251, 235, 182, 251, 247, 245, 183, 235, 225, 251, 234, 251, 182, 236, 224, 236 }
 (ַ_)
CRCַ  ı (ַ_)
 (ַ_)
' Ϣ (1, 0, , )

ڴصַ (4198400, 5646783)
ڴصַ (5646793, 5652243)
ڴصַ (5652253, 5657927)
ڴصַ (5657937, 5835339)
ڴصַ (5835349, 5842635)
ڴصַ (5842645, 5951659)
ڴصַ (5951669, 6123763)
ڴصַ (6123773, 6124935)
ڴصַ (6124945, 6126087)
ڴصַ (6126097, 6608735)
ڴصַ (6608745, 6620207)
ڴصַ (6620217, 6621795)
ڴصַ (6621805, 6622003)
ڴصַ (6622013, 6622755)
ڴصַ (6622765, 6623935)
ڴصַ (6623945, 6625119)
ڴصַ (6625129, 6626263)
ڴصַ (6626273, 6626443)
ڴصַ (6626453, 6628271)
ڴصַ (6628281, 6628347)
ڴصַ (6628357, 6639647)
ڴصַ (6639657, 6640799)
ڴصַ (6640809, 6640971)
ڴصַ (6640981, 6641199)
ڴصַ (6641209, 6641435)
ڴصַ (6641445, 6641967)
ڴصַ (6641977, 6643955)
ڴصַ (6643965, 6644343)
ڴصַ (6644353, 6644687)
ڴصַ (6644697, 6645675)
ڴصַ (6645685, 6645715)
ڴصַ (6645725, 6646155)
ڴصַ (6646165, 6646263)
ڴصַ (6646273, 6646371)
ڴصַ (6646381, 6646455)
ڴصַ (6646465, 6779527)
ڴصַ (6779537, 6782279)
ڴصַ (6782289, 6785195)
ڴصַ (6785205, 6785471)
ڴصַ (6785481, 6791519)
ڴصַ (6791529, 6960935)
ڴصַ (6960945, 7068559)
ڴصַ (7068569, 7070179)
ڴصַ (7070189, 7220307)
ڴصַ (7220317, 7268207)
ڴصַ (7268217, 7285112)
' Ϣ (2, 0, , )

' *** Գ ***

' ڴصַ (4198400, 4194304  1452483  4)
' ڴصַ (4194304  1452489, 4194304  1457943  4)
' ڴصַ (4194304  1457949, 4194304  1463627  4)
' ڴصַ (4194304  1463633, 4194304  1641039  4)
' ڴصַ (4194304  1641045, 4194304  1648335  4)
' ڴصַ (4194304  1648341, 4194304  1757359  4)
' ڴصַ (4194304  1757365, 4194304  1929463  4)
' ڴصַ (4194304  1929469, 4194304  1930635  4)
' ڴصַ (4194304  1930641, 4194304  1931787  4)
' ڴصַ (4194304  1931793, 4194304  2414435  4)
' ڴصַ (4194304  2414441, 4194304  2425907  4)
' ڴصַ (4194304  2425913, 4194304  2427495  4)
' ڴصַ (4194304  2427501, 4194304  2427703  4)
' ڴصַ (4194304  2427709, 4194304  2428455  4)
' ڴصַ (4194304  2428461, 4194304  2429635  4)
' ڴصַ (4194304  2429641, 4194304  2430819  4)
' ڴصַ (4194304  2430825, 4194304  2431963  4)
' ڴصַ (4194304  2431969, 4194304  2432143  4)
' ڴصַ (4194304  2432149, 4194304  2433971  4)
' ڴصַ (4194304  2433977, 4194304  2434047  4)
' ڴصַ (4194304  2434053, 4194304  2445347  4)
' ڴصַ (4194304  2445353, 4194304  2446499  4)
' ڴصַ (4194304  2446505, 4194304  2446671  4)
' ڴصַ (4194304  2446677, 4194304  2446899  4)
' ڴصַ (4194304  2446905, 4194304  2447135  4)
' ڴصַ (4194304  2447141, 4194304  2447667  4)
' ڴصַ (4194304  2447673, 4194304  2449655  4)
' ڴصַ (4194304  2449661, 4194304  2450043  4)
' ڴصַ (4194304  2450049, 4194304  2450387  4)
' ڴصַ (4194304  2450393, 4194304  2451375  4)
' ڴصַ (4194304  2451381, 4194304  2451415  4)
' ڴصַ (4194304  2451421, 4194304  2451855  4)
' ڴصַ (4194304  2451861, 4194304  2451963  4)
' ڴصַ (4194304  2451969, 4194304  2452071  4)
' ڴصַ (4194304  2452077, 4194304  2452155  4)
' ڴصַ (4194304  2452161, 4194304  2585227  4)
' ڴصַ (4194304  2585233, 4194304  2587979  4)
' ڴصַ (4194304  2587985, 4194304  2590895  4)
' ڴصַ (4194304  2590901, 4194304  2591171  4)
' ڴصַ (4194304  2591177, 4194304  2597219  4)
' ڴصַ (4194304  2597225, 4194304  2766635  4)
' ڴصַ (4194304  2766641, 4194304  2874259  4)
' ڴصַ (4194304  2874265, 4194304  2875879  4)
' ڴصַ (4194304  2875885, 4194304  3026007  4)
' ڴصַ (4194304  3026013, 4194304  3073907  4)
' ڴصַ (4194304  3073913, 4194304  3090812  4)

' üı (ʮʮ ( (&УCRCӳ7)))
' Ϣ (fuck, 0, , )

 ( (&ӿں))

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ GAME_ں, ֽڼ
. ݰ, ֽڼ
.ֲ ݰ, 
.ֲ , 
.ֲ ݰ, 
.ֲ ݰ, ֽڼ
.ֲ ʱֽ1, ֽ
.ֲ ʱֽ2, ֽ
.ֲ ʱֽ3, ֽ
.ֲ ʱֽ4, ֽ
.ֲ ǰ, 
.ֲ _begin6, 

_begin6  0

ݰ  ȡֽڼ (ݰ)
ݰ  (ݰ  3)  4
ݰ  ݰ  { 60, 60, 60 }
  ݰ  3
ݰ  ȡհֽڼ ()
.ƴѭ (ݰ, ǰ)
    ʱֽ1  λ (ݰ [ǰ  4  3]  60, 63)
    ʱֽ2  λ (ݰ [ǰ  4  2]  60, 63)
    ʱֽ3  λ (ݰ [ǰ  4  1]  60, 63)
    ʱֽ4  λ (ݰ [ǰ  4]  60, 63)
    ݰ [ǰ  3  2]  λ (λ (ʱֽ1, 63)  4, λ (ʱֽ2, 48)  16)
    ݰ [ǰ  3  1]  λ (λ (ʱֽ2, 15)  16, λ (ʱֽ3, 60)  4)
    ݰ [ǰ  3]  λ (λ (ʱֽ3, 3)  64, ʱֽ4)
.ƴѭβ ()
. (ݰ  ݰ  4)
     (ȡֽڼ (ݰ,   ݰ  4  ݰ))
.
 (ݰ)

.ӳ ڴصַ, 
. ʼַ, 
. ַ, 
.ֲ _begin7, 

_begin7  0

' ı (ڴصַ(  ı (ʼַ)  ,  ı (ַ)  ))

Ա (ڴصַʼ, ʼַ)
Ա (ڴصַ, ַ)
 (0)

.ӳ ӿں, 
. , 
.ֲ _begin8, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin8  0
. (  2)

     ( (&ģ汾))

.

. (  4)

     ( (&жDLL))

.
. (  5)

     ( (&))

.
. (  6)

     ( (&ںCRCֵ))

.
. (  7)

     ( (&κ))

.
. (  8)

     ( (&ԶѰ·ӿ))

.
. (  9)

     ( (&߳̾))

.

 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ߳̾
. s, 

' ½߳̾  s


.ӳ ԶѰ·ӿ
. , , , 1 ʼѰ· 2Ѱ·
. 2, , , Ԥ  1 һѰ· 2 ڶѰ·
.ֲ ַ, 
.ֲ x, 
.ֲ y, 
.ֲ _begin9, 

_begin9  0
.жϿʼ (  1)

    ' NPCʼѰ·¼Ѱ·ַ

    ַ  _ָ뵽 (8948692)

    Ѱ·1X  _ָ뵽 (ADD__ (ַ, 124))

    Ѱ·1Y  _ָ뵽 (ADD__ (ַ, 128))

    ' log (ԶѰ·ʼ..Ŀĵ:  ı (x)  :  ı (y))
.ж (  2)
    ' Ѱ·УжĿĵǷ¼һ£һ
    ַ  _ָ뵽 (8948692)
    x  _ָ뵽 (ADD__ (ַ, 124))
    y  _ָ뵽 (ADD__ (ַ, 128))

    . (x  Ѱ·1X  y  Ѱ·1Y)
        ' //=󣬸ıCRCֵӶ˷ϵͳ ҴʽĹ
        ʹԶѰ·  

    .

.Ĭ

.жϽ



.ӳ κ
. 1
. 2
. 3
. 4
. 5
. 6
. 7
. 8
. 9
. 10
. 11
.ֲ _begin10, 

_begin10  0
. (1  1)  ' ٳ

     ()

    ݱ˿  ȡ (1234, 1313)

    Ƿٳ  2

      3

    ڴ  4

    Υٽ  5

    ںھ  6

    ' Ϣ (ı (ںھ), 0, , )

.
. (1  2)  ' ںִжδС

    ںִжδС  2

.
. (1  3)  ' ںִжδС

    Socket  _ָ뵽 (ADD__ (2, 4))

    ' Ϣ (ı (Socket), 0, , )

.



.ӳ 
. DefMsg, 
.ֲ һʱ, , ̬
.ֲ һαʱ, , ̬
.ֲ ʱ, 
.ֲ Ӳϼʱ, 
.ֲ Ϸٶ, 
.ֲ ٶ, 
.ֲ ħٶ, 
.ֲ , 
.ֲ ħ, 
.ֲ ܲ, 
.ֲ Ϸٶ, 
.ֲ ﹥ٶ, 
.ֲ ħٶ, 
.ֲ _DefMsg, _TDEFAULTMESSAGE
.ֲ Ϸǰٶ, 
.ֲ ȡַ, 
.ֲ _begin11, 
.ֲ ȡ, 
.ֲ ȡַ, 
.ֲ ȡַƫ, 
.ֲ a9, 
.ֲ ʱֽڼ, ֽڼ
.ֲ ֽڱ, ֽ
.ֲ д뿪ʼλ, 
.ֲ , 
.ֲ ȡַʱ, 
.ֲ eip, 
.ֲ call, 
.ֲ ִ, 
.ֲ ɵȨ, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
ȡַ  0
ȡַƫ  0
ȡ  0
ֽڱ  0
call  0
ִ  0
_begin11  0


. (½߳̾  0)

     ({ 100, 161, 24, 0, 0, 0, 139, 64, 36, 137, 69, 252 })
    ' _д־ (߳ID:  ı (ȡַ))
    ' _д־ (Addr:  ʮʮ ( (&Ӳϵ)))
    ' Ϣ (ID:  ı (ȡַ), 0, , )
    ½߳̾  OpenThread (8, , ȡַ)

.

RtlMoveMemory_TDEFAULTMESSAGE (_DefMsg, DefMsg, LocalSize_TDEFAULTMESSAGE (_DefMsg))

' _д־ (ı (ȡʱ ())  :  ı (һʱ)      ı (̴߳ʱ))
' _д־ (  ı (һʱ)     ı (̴߳ʱ))
.жϿʼ (һʱ  ̴߳ʱ)
    ' _д־ (ok...)
    ' Ϣ (ʼ, 0, , )
    дй켣 (87001)
    ȡ  ϵͳ_ȡ (1, ȡԱ (ڴУ))
    дй켣 (87002)
    ȡַ  ڴУ [ȡ].ڴַ
    дй켣 (87003)
    ȡַ  _Xor (ȡַ, 3091739)
    дй켣 (87004)
    ʱֽڼ  ڴУ [ȡ].ֽڼ
    дй켣 (87005)
    ȡַƫ  ϵͳ_ȡ (1, ȡֽڼ (ڴУ [ȡ].ֽڼ))
    дй켣 (87006)
    ȡַ  1 (ADD__ (ȡַ, ȡַƫ), 1)  ' ebp-0x4
    ' ȡַʱ  ȡַ
    ֽڱ  0
    '  ({ 96 })
    ' eip  GetEIP ()
    ' ִ 12823212
    ' üı (ʮʮ (eip))
    ִ  ADD__ (8208700, 4614512)
    дй켣 (87007)

    ' ȡַָ
    ' lea eax,dword ptr ss:[ebp-0x18]
    ' mov dword ptr ss:[ebp-0x14],eax
     ({ 141, 69, 232 })
     ({ 137, 69, 236 })

    . (Ƿرdep  )
        ڴ_ (-1, call, 4, 64, ɵȨ)

    .

    ' esi ȡַ
    ' mov esi,[ebp-0x4]
     ({ 139, 117, 252 })
    ' edi ַ
    ' lea edi,dword ptr ss:[ebp-0x10]
     ({ 141, 125, 240 })
    ' xor eax,eax
     ({ 51, 192 })
    ' call dword ptr ss:[ebp-0x14]
     ({ 255, 85, 236 })
    ִ  0
    '  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })
    дй켣 (87008)

    '  ({ 51, 192, 135, 69, 252, 138, 0, 139, 213, 131, 234, 16, 136, 2 })
    '  ({ 51, 192, 235, 0, 135, 69, 252, 235, 0, 138, 0, 235, 0, 139, 213, 235, 0, 131, 234, 16, 235, 0, 136, 2 })
    ' _д־ (ʮʮ (_Xor (ڴУ [ȡ].ֽڼ [ȡַƫ], 152))      ʮʮ (ֽڱ)      ʮʮ (ȡַ))
    '  ({ 97 })
    ' *** Գ ***
    ' * 67E810
    ' * 67DDCD
    ' * 67D054
    ' * 65CEB2
    ' * 61D410
    ' * 616EB6
    ' * 616C8D
    ' * 608685
    ' * 607F26
    ' * 607DB6
    ' * 605A45
    ' * 5F919F
    ' * 5F8E3C
    ' * 5E5A37
    ' Ϣ (ı (_Xor (ڴУ [ȡ].ֽڼ [ȡַƫ], 152))  #з  ı (ֽڱ)  #з  ʮʮ (ȡַ), 0, , )

    . (_Xor (ڴУ [ȡ].ֽڼ [ȡַƫ], 152)  ֽڱ)
        ' Ϣ (code=5115151, 0, , )
        '  (ʱֽڼ)
        ' Ϣ (޸:  ı (ȡ)     ı (ȡַƫ)  #з  ı (ֽڱ)      ı (_Xor (ڴУ [ȡ].ֽڼ [ȡַƫ], 152))  #з  ȡַ:  ʮʮ (ADD__ (ȡַ, ȡַƫ)  1)  #з  ֽڼʮ (ʱֽڼ,  ), 0, , )
        ־ (10001, ı (ȡ)  #з  ı (ȡַƫ))
        ' CRC޸  
        ' дļ (ȡĿ¼ ()  \data\code10001.txt, ֽڼ (ı (ȡ)  #з  ı (ȡַƫ)))
        д뿪ʼλ  ADD__ (4198400, ϵͳ_ȡ (1000, 30000))

          ADD__ (, 4)

        .ƴѭ (10000000, )

            WriteDword (ADD__ (д뿪ʼλ, ), 0)

              ADD__ (, 4)

        .ƴѭβ ()



    .
        ' Ϣ (ͨ, 0, , )
        ' _д־ (ͨ....  ı (a9))
    .
    дй켣 (87009)

    ' *** Գ ***

    ' * 6EF13D
    ' * 6D484D
    ' * 6CEC19
    ' * 68EB47
    ' * 67DC86
    ' * 67D988
    ' * 67D97C
    ' * 670A68
    ' * 669342
    ' * 61BE19
    ' * 61B99A
    ' * 60C65C
    ' * 60C614
    ' * 60809C
    ' * 603643
    ' * 6029D0
    ' * 601D54
    ' * 5FD68A
    ' * 512102
    ' * 520A13
    ' * 5A033C
    ' * 5A0450
    ' * 5F4E84
    ' * 5F919F

    ȡ  ϵͳ_ȡ (1, ȡԱ (ڴУ_򵥹))
    дй켣 (87010)

    ȡַ  ڴУ_򵥹 [ȡ].ڴַ
    дй켣 (87011)
    ȡַ  _Xor (ȡַ, 3091739)
    дй켣 (87012)
    ʱֽڼ  ڴУ_򵥹 [ȡ].ֽڼ
    дй켣 (87013)
    ȡַƫ  ϵͳ_ȡ (1, ȡֽڼ (ڴУ_򵥹 [ȡ].ֽڼ))
    дй켣 (87014)
    ȡַ  1 (ADD__ (ȡַ, ȡַƫ), 1)  ' ebp-0x4
    дй켣 (87015)
    ' ȡַʱ  ȡַ
    ֽڱ  0
    '  ({ 96 })
    ' eip  GetEIP ()
    ' ִ 12823212
    ' üı (ʮʮ (eip))
    ִ  ADD__ (8208700, 4614512)
    дй켣 (87016)

    ' ȡַָ
    ' lea eax,dword ptr ss:[ebp-0x18]
    ' mov dword ptr ss:[ebp-0x14],eax
     ({ 141, 69, 232 })
     ({ 137, 69, 236 })
    . (Ƿرdep  )
        ڴ_ (-1, call, 4, 64, ɵȨ)

    .

    ' esi ȡַ
    ' mov esi,[ebp-0x4]
     ({ 139, 117, 252 })
    ' edi ַ
    ' lea edi,dword ptr ss:[ebp-0x10]
     ({ 141, 125, 240 })
    ' xor eax,eax
     ({ 51, 192 })
    ' call dword ptr ss:[ebp-0x14]
     ({ 255, 85, 236 })
    ִ  0
    '  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })
    дй켣 (87017)

    '  ({ 51, 192, 135, 69, 252, 138, 0, 139, 213, 131, 234, 16, 136, 2 })
    '  ({ 51, 192, 235, 0, 135, 69, 252, 235, 0, 138, 0, 235, 0, 139, 213, 235, 0, 131, 234, 16, 235, 0, 136, 2 })
    ' _д־ (ʮʮ (_Xor (ڴУ [ȡ].ֽڼ [ȡַƫ], 152))      ʮʮ (ֽڱ)      ʮʮ (ȡַ))
    '  ({ 97 })
    ' *** Գ ***
    ' * 67E810
    ' * 67DDCD
    ' * 67D054
    ' * 65CEB2
    ' * 61D410
    ' * 616EB6
    ' * 616C8D
    ' * 608685
    ' * 607F26
    ' * 607DB6
    ' * 605A45
    ' * 5F919F
    ' * 5F8E3C
    ' * 5E5A37
    ' Ϣ (ı (_Xor (ڴУ [ȡ].ֽڼ [ȡַƫ], 152))  #з  ı (ֽڱ)  #з  ʮʮ (ȡַ), 0, , )

    . (_Xor (ڴУ_򵥹 [ȡ].ֽڼ [ȡַƫ], 152)  ֽڱ)
        ' Ϣ (code=5115151, 0, , )
        '  (ʱֽڼ)
        ' Ϣ (޸:  ı (ȡ)     ı (ȡַƫ)  #з  ı (ֽڱ)      ı (_Xor (ڴУ [ȡ].ֽڼ [ȡַƫ], 152))  #з  ȡַ:  ʮʮ (ADD__ (ȡַ, ȡַƫ)  1)  #з  ֽڼʮ (ʱֽڼ,  ), 0, , )
        ־ (10021, ı (ȡ)  #з  ı (ȡַƫ))
        ' CRC޸  
        ' дļ (ȡĿ¼ ()  \data\code10001.txt, ֽڼ (ı (ȡ)  #з  ı (ȡַƫ)))
        д뿪ʼλ  ADD__ (4198400, ϵͳ_ȡ (1000, 30000))

          ADD__ (, 4)

        .ƴѭ (10000000, )

            WriteDword (ADD__ (д뿪ʼλ, ), 0)

              ADD__ (, 4)

        .ƴѭβ ()
    .

    .


    дй켣 (87018)


    . (½߳̾  0)

        Ӳϵ (߳̾)

    .
        Ӳϵ (½߳̾)

    .

    ʱ  ȡʱ ()
    ' _д־ (ı (յĵ))
    ' Ϣ (ı (ӲϵѼ⵽), 0, , )

    '  ʹԶѰ· =٣ģCRC =ʱҼͨѶ
    ' ģԿCRC  _Xor (ģԿCRC, ֵ (ʹԶѰ·))

    ' ģԿCRC  _Xor (ģԿCRC, ֵ (ӲϵѼ⵽))

    ģԿCRC  _Xor (ģԿCRC, ֵ (ֹͣ))

    ' ģԿCRC  _Xor (ģԿCRC, ֵ (Ƿ))

    ģԿCRC  _Xor (ģԿCRC, ֵ ())

    ģԿCRC  _Xor (ģԿCRC, ֵ (յĿ))

    ģԿCRC  _Xor (ģԿCRC, ֵ (յĵ))

    ģԿCRC  _Xor (ģԿCRC, APIַǷ޸)

    ģԿCRC  _Xor (ģԿCRC, ֵ (յGOMFZ))

    ģԿCRC  _Xor (ģԿCRC, ֵ (̰ٳ))

    ģԿCRC  _Xor (ģԿCRC, ֵ (ؽ))

    . (Ķڴ  )

        . (APIַǷ޸  1  յGOMFZ  )

            Ķڴ  
        .

    .
    . (ʹԶѰ·    ֹͣ        յĿ    յĵ    յGOMFZ    ̰ٳ    ؽ  )
        ' _д־ (ı (ʹԶѰ·)  #з  ı (ֹͣ)  #з  ı ()  #з  ı (յĿ)  #з  ı (յĵ)  #з  ı (յGOMFZ)  #з  ı (̰ٳ)  #з  ı (ؽ))
        дļ (ȡĿ¼ ()  \data\code8911.txt, ֽڼ (ı (ʹԶѰ·)  #з  ı (ֹͣ)  #з  ı ()  #з  ı (յĿ)  #з  ı (յĵ)  #з  ı (յGOMFZ)  #з  ı (̰ٳ)  #з  ı (ؽ)))

    .



    '  (ʹԶѰ·    ֹͣ    Ƿ        յĿ    յĵ    APIַǷ޸  1  յGOMFZ  )
    ' _д־ (ı (ʹԶѰ·)  #з  ı (ֹͣ)  #з  ı (Ƿ)  #з  ı ()  #з  ı (յĿ)  #з  ı (յĵ)  #з  ı (APIַǷ޸)  #з  ı (յGOMFZ))
    ' Ϣ (ı (ʹԶѰ·)  #з  ı (ӲϵѼ⵽)  #з  ı (ֹͣ)  #з  ı (Ƿ)  #з  ı ()  #з  ı (⵽), 0, , )
    ' _д־ (ı (ʹԶѰ·)      ı (ֹͣ)      ı (Ƿ)      ı ()      ı (յĿ)      ı (յĵ)      ı (APIַǷ޸)      ı (յGOMFZ))


    .жϿʼ (_DefMsg.wParam  0)

        TSocketAPI_SendClientMessage (30001, ģԿCRC, ʱ  һαʱ, #sy_, 0, )

    .ж (_DefMsg.wParam  2)

        ȡǰϷٶ (Ϸٶ, ٶ, ħٶ)

        ȡٶ (, ħ, ܲ, Ϸٶ, ﹥ٶ, ħٶ)

        Ϸǰٶ  _Xor (Ϸǰٶ, Ϸٶ)

        Ϸǰٶ  _Xor (Ϸǰٶ, ٶ)

        Ϸǰٶ  _Xor (Ϸǰٶ, ħٶ)

        Ϸǰٶ  _Xor (Ϸǰٶ, )

        Ϸǰٶ  _Xor (Ϸǰٶ, ħ)

        Ϸǰٶ  _Xor (Ϸǰٶ, ܲ)

        Ϸǰٶ  _Xor (Ϸǰٶ, Ϸٶ)

        Ϸǰٶ  _Xor (Ϸǰٶ, ﹥ٶ)

        Ϸǰٶ  _Xor (Ϸǰٶ, ħٶ)

        ' _д־ (ı (Ϸǰٶ)     ı (ģԿCRC))

        Ϸǰٶ  _Xor (Ϸǰٶ, ģԿCRC)

        TSocketAPI_SendClientMessage (30001, Ϸǰٶ, ʱ  һαʱ, #sy_, 2, )

    .ж (_DefMsg.wParam  1)

        ȡǰϷٶ (Ϸٶ, ٶ, ħٶ)

        ȡٶ (, ħ, ܲ, Ϸٶ)

        Ϸǰٶ  _Xor (Ϸǰٶ, Ϸٶ)

        Ϸǰٶ  _Xor (Ϸǰٶ, ٶ)

        Ϸǰٶ  _Xor (Ϸǰٶ, ħٶ)

        Ϸǰٶ  _Xor (Ϸǰٶ, )

        Ϸǰٶ  _Xor (Ϸǰٶ, ħ)

        Ϸǰٶ  _Xor (Ϸǰٶ, ܲ)

        Ϸǰٶ  _Xor (Ϸǰٶ, Ϸٶ)

        ' _д־ (ı (Ϸǰٶ)     ı (ģԿCRC))

        Ϸǰٶ  _Xor (Ϸǰٶ, ģԿCRC)

        TSocketAPI_SendClientMessage (30001, Ϸǰٶ, ʱ  һαʱ, #sy_, 1, )
    .Ĭ

    .жϽ
    ' Ϣ (ӲϵѼ⵽:  ı (ӲϵѼ⵽), 0, , )


    һαʱ  ʱ
    ' Ϣ (͡  #з  ı (һʱ)  #з  ı (̴߳ʱ), 0, , )
    һʱ  ̴߳ʱ

.Ĭ
    ' _д־ (no...)

.жϽ

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ںCRCֵ
. 汾, 
. ָ, 
. , 
.ֲ data, ֽڼ
.ֲ data2, ı
.ֲ ָ, ı, , "0"
.ֲ a1, 
.ֲ _begin12, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin12  0
data  ָ뵽ֽڼ (ָ, )
data2  ı (ѹ (data))
ָ  ָı (data2, #з, )
.ƴѭ (ȡԱ (ָ), a1)
    Ա (Ա_CRC,  (ָ [a1]))
.ƴѭβ ()
' Ϣ (ı (ȡԱ (Ա_CRC)), 0, , )

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

.ӳ ģ汾
.ֲ Ƿ, ߼, ̬
.ֲ _begin13, 

' Ϣ (ca2, 0, , )
 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin13  0
ģԿ  AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ģԿCRC  RtlComputeCrc32 (0, ģԿ, ȡı (ģԿ))

TSocketAPI_SendClientMessage (30001, ģԿCRC, 0, #sy_ģ汾, 0, ģԿ)

. (ȡ (Ƿ))
    ' Ϣ (a, 0, , )

    Ƿ  


    ʼ ()

    ϵͳ.ҳʼ ()

    ϵͳ.ⲿڴɨʼ ()
    ' Ϣ (b, 0, , )

    ߳ (&߳, , ߳̾)
    ' Ϣ (c, 0, , )
    ' log (start1:  ʮʮ ( (&߳)))

    ߳ (&߳, , ߳̾)
    ' Ϣ (d, 0, , )
    ' log (start2:  ʮʮ ( (&߳)))

    '   25
    ' ڴ  10
    ' Υٽ  8
    ' Ϣ (e, 0, , )

    . (ݱ.Bind (0))

        ' ʱ߳̾  CreateThread_Ptr (0, 0, &UDP_ݵ, 0, 0, 0)
        ߳ (&UDP_ݵ, , ʱ߳̾)
        ' log (start3:  ʮʮ ( (&UDP_ݵ)))

        ' Ϣ (f, 0, , )

        ߳ (&߳, , ߳̾)
        ' Ϣ (g, 0, , )
        ' log (start5:  ʮʮ ( (&߳)))

    .


.

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־



.ӳ ߳
.ֲ _begin15, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin15  0
ϵͳ.߳ ()

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ UDP_ݵ
.ֲ Ƿɹ, ߼, , , out
.ֲ ַ, ı
.ֲ ˿, 
.ֲ , , , "2"
.ֲ ret, ֽڼ
.ֲ _begin16, 

_begin16  0
.жѭ ()
    . (жģ  )
        ѭ ()
    .

    . (ݱ.Recvfrom (Ƿɹ, , 8, 8, ַ, ˿, -1))

        . (Ƿɹ)

            ʱ  ȡʱ2 ()

            Զ̱־   [1]

            Զʱ  ȡʱ2 ( [2])

            '  (IP:  ַ  :  ı (˿)  |  ı (), ȡʱ ())
        .

        .

    .

    .
    . (жģ  )
        ѭ ()
    .

.жѭβ ()
߳5Ƿ˳  

.ӳ ȡʱ2, 
. תֵ, , ɿ
.ֲ ʱ, 
.ֲ , 
.ֲ ָ֤, 
.ֲ _begin18, 

_begin18  0
  0
. (תֵ  0)
    ʱ  ȡʱ ()
.
    ʱ  תֵ
.
ָ֤  ȡָ ()
WriteDword (ָ֤, ʱ)
 ()


.ӳ ȡָ, 
. , , ο
.ֲ _begin19, 

_begin19  0
 ({ 139, 69, 8, 139, 229, 93, 194, 4, 0 })
 (0)

.ӳ WriteDword
. ptr, 
. val, 
.ֲ _begin20, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin20  0
 ({ 80, 82, 139, 149, 12, 0, 0, 0, 139, 133, 8, 0, 0, 0, 137, 16, 90, 88 })
' push eax
' push edx
' mov edx , dword ptr [ebp+0000000Ch]
' mov eax , dword ptr [ebp+00000008h]
' mov dword ptr [eax] , edx
' pop edx
' pop eax
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ߳
.ֲ _begin21, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin21  0
. (ںھ  0)
    ںھ  ȡ1 ()

.

.'  (ںھ  0)
    ' Ϣ (ϵͳʼʧܣ, 0, , )
    '  ()
.

ϵͳ.ѭ߳ ()

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ȡ1, 
.ֲ , , , "0"
.ֲ , 
.ֲ a1, 
.ֲ ʽ, 
.ֲ չʽ, 
.ֲ ڴС, _
.ֲ ߶1, 
.ֲ 1, 
.ֲ _begin22, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin22  0
  ȡ̴ (ȡǰ̱ʶ_ (), )

.ƴѭ (, a1)

    ' ʽ  ȡʽ ( [a1], -16)

    ' չʽ  ȡʽ ( [a1], -20)

    Windowx_jx ( [a1], ڴС)

    ߶1  ڴС.ұ  ڴС.

    1  ڴС.ױ  ڴС.

    ' Ϣ (ı (߶1)  #з  ı (1)  #з  ı ( [a1]), 0, , )

    . (߶1  750  1  550)

        Ӵ  0

        API_öӴ ( [a1], &öӴ, 0)
        _call_Sleep (sleepַ, 1)
        ' _д־ (߶:  ı (߶1)    :  ı (1)   :  ı ( [a1])   Ӵ:  ı (Ӵ))

        . (Ӵ  0  Ӵ  1)

             ( [a1])
        .

    .



.ƴѭβ ()
 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ öӴ, ߼
. hwnd, 
.ֲ _begin23, 

_begin23  0
. (hwnd  0)
    Ӵ  ADD__ (Ӵ, 1)

     ()
.
 ()

.ӳ ȡ̴, , , IDȡжھɹشʧܷ0By:()ᴳ
. ID, 
. ھ, , ο , صĴھ飬봫
.ֲ Null, ı
.ֲ hWnd, 
.ֲ PID, 
.ֲ _begin24, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin24  0
 (ھ)
Null  ַ (0)
hWnd  FindWindowEx (0, 0, Null, Null)
.жѭ (hWnd  0)
    GetWindowThreadProcessId (hWnd, PID)
    ' _д־ (ھ:  ı (hWnd)    id:  ı (PID)   ID:  ı (ID))

    . (PID  ID)
        Ա (ھ, hWnd)
    .
    hWnd  FindWindowEx (0, hWnd, Null, Null)
.жѭβ ()
 (ȡԱ (ھ))
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־



.ӳ ߳
.ֲ _begin25, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin25  0
ϵͳ.ȡ߳ ()

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ Ҵö, ߼
. hwnd, 
.ֲ ret, ߼
.ֲ _begin26, 


 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin26  0

. (hwnd  0)

    ret  ϵͳ.Ҵö_1 (hwnd)

    . (ret  )

         ()

    .

     ()
.

 ()

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ֽڼʮı_dtcser, ı
. ԭ, ֽڼ
.ֲ ԭĳ, 
.ֲ , ı

 ({ 139, 93, 8, 139, 27, 137, 93, 244, 131, 125, 244, 0, 15, 132, 116, 2, 0, 0, 139, 91, 4, 137, 93, 248, 209, 101, 248 })
  ȡհı (ԭĳ)
 ({ 139, 248, 139, 117, 8, 139, 54, 131, 198, 8, 232, 0, 0, 0, 0, 91, 131, 195, 9, 233, 0, 2, 0, 0, 48, 48, 48, 49, 48, 50, 48, 51, 48, 52, 48, 53, 48, 54, 48, 55, 48, 56, 48, 57, 48, 65, 48, 66, 48, 67, 48, 68, 48, 69, 48, 70, 49, 48, 49, 49, 49, 50, 49, 51, 49, 52, 49, 53, 49, 54, 49, 55, 49, 56, 49, 57, 49, 65, 49, 66, 49, 67, 49, 68, 49, 69, 49, 70, 50, 48, 50, 49, 50, 50, 50, 51, 50, 52, 50, 53, 50, 54, 50, 55, 50, 56, 50, 57, 50, 65, 50, 66, 50, 67, 50, 68, 50, 69, 50, 70, 51, 48, 51, 49, 51, 50, 51, 51, 51, 52, 51, 53, 51, 54, 51, 55, 51, 56, 51, 57, 51, 65, 51, 66, 51, 67, 51, 68, 51, 69, 51, 70, 52, 48, 52, 49, 52, 50, 52, 51, 52, 52, 52, 53, 52, 54, 52, 55, 52, 56, 52, 57, 52, 65, 52, 66, 52, 67, 52, 68, 52, 69, 52, 70, 53, 48, 53, 49, 53, 50, 53, 51, 53, 52, 53, 53, 53, 54, 53, 55, 53, 56, 53, 57, 53, 65, 53, 66, 53, 67, 53, 68, 53, 69, 53, 70, 54, 48, 54, 49, 54, 50, 54, 51, 54, 52, 54, 53, 54, 54, 54, 55, 54, 56, 54, 57, 54, 65, 54, 66, 54, 67, 54, 68, 54, 69, 54, 70, 55, 48, 55, 49, 55, 50, 55, 51, 55, 52, 55, 53, 55, 54, 55, 55, 55, 56, 55, 57, 55, 65, 55, 66, 55, 67, 55, 68, 55, 69, 55, 70, 56, 48, 56, 49, 56, 50, 56, 51, 56, 52, 56, 53, 56, 54, 56, 55, 56, 56, 56, 57, 56, 65, 56, 66, 56, 67, 56, 68, 56, 69, 56, 70, 57, 48, 57, 49, 57, 50, 57, 51, 57, 52, 57, 53, 57, 54, 57, 55, 57, 56, 57, 57, 57, 65, 57, 66, 57, 67, 57, 68, 57, 69, 57, 70, 65, 48, 65, 49, 65, 50, 65, 51, 65, 52, 65, 53, 65, 54, 65, 55, 65, 56, 65, 57, 65, 65, 65, 66, 65, 67, 65, 68, 65, 69, 65, 70, 66, 48, 66, 49, 66, 50, 66, 51, 66, 52, 66, 53, 66, 54, 66, 55, 66, 56, 66, 57, 66, 65, 66, 66, 66, 67, 66, 68, 66, 69, 66, 70, 67, 48, 67, 49, 67, 50, 67, 51, 67, 52, 67, 53, 67, 54, 67, 55, 67, 56, 67, 57, 67, 65, 67, 66, 67, 67, 67, 68, 67, 69, 67, 70, 68, 48, 68, 49, 68, 50, 68, 51, 68, 52, 68, 53, 68, 54, 68, 55, 68, 56, 68, 57, 68, 65, 68, 66, 68, 67, 68, 68, 68, 69, 68, 70, 69, 48, 69, 49, 69, 50, 69, 51, 69, 52, 69, 53, 69, 54, 69, 55, 69, 56, 69, 57, 69, 65, 69, 66, 69, 67, 69, 68, 69, 69, 69, 70, 70, 48, 70, 49, 70, 50, 70, 51, 70, 52, 70, 53, 70, 54, 70, 55, 70, 56, 70, 57, 70, 65, 70, 66, 70, 67, 70, 68, 70, 69, 70, 70, 209, 109, 248, 139, 77, 248, 3, 206, 51, 192, 138, 6, 70, 209, 224, 102, 139, 20, 24, 102, 137, 23, 71, 71, 59, 241, 124, 236 })
 ()

.ӳ ʮıֽڼ_dtcser, ֽڼ
. ԭ, ı
.ֲ , 
.ֲ , ֽڼ

 ({ 139, 125, 8, 139, 63, 137, 125, 244, 131, 125, 244, 0, 15, 133, 31, 0, 0, 0, 139, 69, 252, 133, 192, 116, 19, 80, 139, 64, 4, 131, 192, 8, 80, 232, 184, 2, 0, 0, 89, 94, 139, 248, 243, 164, 233, 26, 1, 0, 0, 131, 201, 255, 51, 192, 242, 174, 247, 209, 73, 209, 233, 137, 77, 248, 131, 125, 248, 1, 15, 141, 4, 0, 0, 0, 201, 194, 4, 0, 139, 117, 8, 139, 54 })
  ȡհֽڼ ()
 ({ 131, 192, 8, 139, 248, 209, 101, 248, 139, 77, 248, 232, 0, 0, 0, 0, 91, 131, 195, 6, 235, 103, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 0, 0, 0, 0, 0, 0, 10, 11, 12, 13, 14, 15, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 10, 11, 12, 13, 14, 15, 3, 206, 51, 192, 102, 139, 6, 70, 70, 80, 37, 255, 0, 0, 0, 138, 52, 24, 88, 193, 232, 8, 138, 20, 24, 192, 230, 4, 8, 242, 136, 23, 71, 59, 241, 124, 223 })
 ()

.ӳ asm_ڴ, , , ڴ
. ȡַ, 
.ֲ _begin27, 

_begin27  0
 ({ 147, 139, 92, 36, 8, 139, 27, 147, 139, 229, 93, 194, 4, 0 })

 (-1)

.ӳ жDLL, ߼
.ֲ , 
.ֲ ʼʱ, , ̬
.ֲ ǿ˳, ߼

' Ϣ (жˡ, 0, , )
߳1Ƿ˳  

߳2Ƿ˳  

߳3Ƿ˳  

' ߳4Ƿ˳  

߳5Ƿ˳  

жģ  

ʼʱ  ȡʱ ()

.жѭ (߳1Ƿ˳    ߳2Ƿ˳    ߳3Ƿ˳    ߳5Ƿ˳  )

    _call_Sleep (sleepַ, 300)

    .жϿʼ (ȡʱ ()  ʼʱ  7000)

        ǿ˳  

        ѭ ()
    .Ĭ

    .жϽ

.жѭβ ()

' log (end:  ı (߳1Ƿ˳)     ı (߳2Ƿ˳)     ı (߳3Ƿ˳)     ı (߳5Ƿ˳)   )

. (ǿ˳)
    ͣ߳a (߳̾)
    ǿƽ߳ (߳̾)

    ͣ߳a (߳̾)
    ǿƽ߳ (߳̾)

    ͣ߳a (߳̾)
    ǿƽ߳ (߳̾)

    ͣ߳a (ʱ߳̾)
    ǿƽ߳ (ʱ߳̾)

.

ر߳̾ (߳̾)

ر߳̾ (߳̾)

ر߳̾ (߳̾)

ر߳̾ (ʱ߳̾)

_call_Sleep (sleepַ, 100)

 ()


.ӳ TSocketAPI_SendClientMessage
. Msg, 
. Recog, 
. param, 
. tag, 
. series, 
. S, ı

. (ݺַ  0)
    ӳ (ݺַ, , , Msg, Recog, param, tag, series, S)
.


.ӳ _ȡӳʵַ, 
. ӳָ, ӳָ
.ֲ _begin28, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin28  0

 ({ 83, 81, 139, 69, 8, 64, 139, 8, 128, 249, 232, 117, 248, 139, 72, 1, 141, 92, 8, 5, 139, 11, 193, 225, 8, 129, 249, 0, 85, 139, 236, 141, 64, 4, 117, 225, 139, 195, 89, 91, 201, 194, 4, 0 })
' 00000000    PUSH EBX
' 00000001    PUSH ECX
' 00000002    MOV EAX,[EBP+8]
' 00000005    INC EAX
' 00000006    MOV ECX,[EAX]
' 00000008    CMP CL,E8
' 0000000B    JNZ SHORT 00000005
' 0000000D    MOV ECX,[EAX+1]
' 00000010    LEA EBX,[EAX+ECX+5]
' 00000014    MOV ECX,[EBX]
' 00000016    SHL ECX,8
' 00000019    CMP ECX,EC8B5500
' 0000001F    LEA EAX,[EAX+4]
' 00000022    JNZ SHORT 00000005
' 00000024    MOV EAX,EBX
' 00000026    POP ECX
' 00000027    POP EBX
' 00000028    LEAVE
' 00000029    RETN 4
 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ log
. str, ı
.ֲ a, 

. (ļǷ (ȡĿ¼ ()  \data\log.txt)  )
    дļ (ȡĿ¼ ()  \data\log.txt, {  })
.
a  ļ (ȡĿ¼ ()  \data\log.txt, , )
Ƶļβ (a)
дı (a, str  #з)
رļ (a)


.ӳ ־
. ־, 
. s, ı, ɿ

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

дļ (ȡĿ¼ ()  \data\code  ı (־)  .txt, ֽڼ (ı (ȡʱ ())  #з  s))
_call_Sleep (sleepַ, 1000)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ call_GetWindow, 
. ַ, 
. һ, 
. , 
.ֲ _begin37, 


 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin37  0
ַ  _Xor (ַ, GetWindowַXor)

 ({ 201, 88, 135, 4, 36, 255, 224 })
 (0)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ رDEP, ߼
.ֲ s, 
.ֲ dep_flags, 
.ֲ hi, 


hi  Q_jcdz (Q_sljb (Kernel32.dll), SetProcessDEPPolicy)
. (hi  0)
    s  SetProcessDEPPolicy (0)
    . (s  1)
         ()
    .

.
. (s  1  hi  0)
    hi  Q_jcdz (Q_sljb (ntdll.dll), NtSetInformationProcess)
    . (hi  0)
        dep_flags  2
        s  FnNtSetInformationProcess (GetCurrentProcess (), 34, dep_flags, 4)
        . (s  0)
             ()
        .

        .

    .

.

.
 ()


.ӳ ȡٶ
. , , ο ɿ
. ħ, , ο ɿ
. ܲ, , ο ɿ
. Ϸٶ, , ο ɿ
. ﹥ٶ, , ο ɿ
. ħٶ, , ο ɿ
.ֲ ַ, 
.ֲ ݵַ, 
.ֲ ݵַ2, 
.ֲ _begin38, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin38  0
ַ  _ָ뵽 (7467500)
' _д־ (ַ:  ʮʮ (ַ))
ݵַ  _ָ뵽 (ַ)
' _д־ (ݵַ:  ʮʮ (ݵַ)   :  ʮʮ (ADD__ (ݵַ, 359))   ħ:  ʮʮ (ADD__ (ݵַ, 363))   ƶ:  ʮʮ (ADD__ (ݵַ, 367)))

  _ָ뵽 (ADD__ (ݵַ, 359))

ħ  _ָ뵽 (ADD__ (ݵַ, 363))

ܲ  _ָ뵽 (ADD__ (ݵַ, 367))

' [[854270]+510] Ϸٶ
ַ  8733296
ݵַ  _ָ뵽 (ַ)

ݵַ2  _ָ뵽 (ADD__ (ݵַ, 1296))
Ϸٶ  _ָ뵽 (ݵַ2)

ݵַ2  _ָ뵽 (ADD__ (ݵַ, 1300))
﹥ٶ  _ָ뵽 (ݵַ2)

ݵַ2  _ָ뵽 (ADD__ (ݵַ, 1304))
ħٶ  _ָ뵽 (ݵַ2)

' _д־ (Ϸٶ:  ı (Ϸٶ)  ﹥ٶ:  ı (﹥ٶ)  ħٶ:  ı (ħٶ)  :  ı ()   ħ:  ı (ħ)   ƶ:  ı (ܲ))

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ call_EnumChildWindows, 
. ַ, 
. һ, 
. , ӳָ
. , 
.ֲ _begin39, 


 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin39  0
ַ  _Xor (ַ, EnumChildWindowsַXor)

 ({ 201, 88, 135, 4, 36, 255, 224 })

 (0)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ȡǰϷٶ
. ϷٶA, , ο
. ٶA, , ο
. ħٶA, , ο
.ֲ Կ, ֽڼ
.ֲ Կָ, 
.ֲ ݽջ, ֽڼ
.ֲ Ҫܵ, ֽڼ
.ֲ ָ, 
.ֲ CALL, 
.ֲ Ϸٶ, 
.ֲ ٶ, 
.ֲ ħٶ, 
.ֲ _begin40, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

Կָ  0  ' 4
ָ  0  ' 8
CALL  5077668  ' c
Ϸٶ  0  ' 10
ٶ  0  ' 14
ħٶ  0  ' 18

_begin40  0

ݽջ  ȡհֽڼ (6)

Կ  { 64, 64, 78, 116 }
Կָ  ȡָ_ֽڼ (Կ)
ָ  ȡָ_ֽڼ (ݽջ)

' 00274F78      8B45 FC       mov eax,dword ptr ss:[ebp-0x4]          ;  Կ @@Nt
' 00274F7B      50            push eax
' 00274F7C      8D55 F8       lea edx,dword ptr ss:[ebp-0x8]          ;  յַ6ֽ
' mov edx,[edx]
' 00274F7F      A1 5CEA7100   mov eax,dword ptr ds:[0x71EA5C]
' 00274F84      8B00          mov eax,dword ptr ds:[eax]
' 00274F86      B9 06000000   mov ecx,0x6
' 00274F8B      FF55 F4       call dword ptr ss:[ebp-0xC]
 ({ 139, 69, 252, 80, 141, 85, 248, 139, 18, 161, 92, 234, 113, 0, 139, 0, 185, 6, 0, 0, 0, 255, 85, 244 })
' 00274F8F      8B45 F8       mov eax,dword ptr ss:[ebp-0x8]
' 00274F92      33D2          xor edx,edx
' 00274F94      36:0FB710     movzx edx,word ptr ss:[eax]
' 00274F98      8955 F0       mov dword ptr ss:[ebp-0x10],edx
' 00274F9D      36:0FB750 02  movzx edx,word ptr ss:[eax+0x2]
' 00274FA2      8955 EC       mov dword ptr ss:[ebp-0x14],edx
' 00274FA5      36:0FB750 04  movzx edx,word ptr ss:[eax+0x4]
' 00274FAA      8955 E8       mov dword ptr ss:[ebp-0x18],edx

 ({ 139, 69, 248, 51, 210, 54, 15, 183, 16, 137, 85, 240, 54, 15, 183, 80, 2, 137, 85, 236, 54, 15, 183, 80, 4, 137, 85, 232 })

ϷٶA  Ϸٶ

ٶA  ٶ

ħٶA  ħٶ

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

' log (ı (Ϸٶ)     ı (ٶ)     ı (ħٶ))

' ༭7.  ֽڼʮ (ݽջ,  )


.ӳ ڴ_ֽڼ_asm, ߼, , ȡַ -> ַ+ƫ[1] -> ַ+ƫ[2] -> ַ+ƫ[N] -> ֽڼ
. ȡַ, 
. , ֽڼ, ο
. ȡ, , , ָҪȡֽڼݵĳ
. ƫ, , ɿ 
.ֲ ֲ_, ߼

' VMP_ (read nc)

. (ȡ  ȡֽڼ ())
      ȡհֽڼ (ȡ)
.
 ({ 81, 86, 87, 156, 252, 51, 246, 135, 117, 8, 139, 125, 12, 139, 63, 131, 63, 1, 117, 11, 139, 79, 4, 131, 199, 8, 243, 164, 255, 69, 8, 157, 95, 94, 89 })
ֲ_  ȡַ  0
 (ֲ_)
' VM_ ()

.ӳ en, ı
. data, ı

 (ı (ֽڼʮ (ѹ (ֽڼ (data)), O)))


.ӳ de, ı
. data, ı

 (ı (ѹ (ʮƵֽڼ (data, O))))


.ӳ Ƿ, ߼
.ֲ a, ֽڼ
.ֲ b, ֽڼ
.ֲ c, ı
.ֲ _begin41, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
' SOFTWARE\VMware, Inc.\VMware Drivers
_begin41  0

a  { 203, 215, 222, 204, 207, 217, 202, 221, 196, 206, 213, 239, 249, 234, 253, 180, 184, 209, 246, 251, 182, 196, 206, 213, 239, 249, 234, 253, 184, 220, 234, 241, 238, 253, 234, 235 }
 (a)
' vmci.status
b  { 238, 245, 251, 241, 182, 235, 236, 249, 236, 237, 235 }
 (b)
c  _Function_GetKeyEx_String (#HKEY_LOCAL_MACHINE, ı (a), ı (b))

. (ȡı (c)  2)

     ()

.

 (a)
 (b)

' SYSTEM\CurrentControlSet\Services\Eventlog\Application\vmtools
a  { 203, 193, 203, 204, 221, 213, 196, 219, 237, 234, 234, 253, 246, 236, 219, 247, 246, 236, 234, 247, 244, 203, 253, 236, 196, 203, 253, 234, 238, 241, 251, 253, 235, 196, 221, 238, 253, 246, 236, 244, 247, 255, 196, 217, 232, 232, 244, 241, 251, 249, 236, 241, 247, 246, 196, 238, 245, 236, 247, 247, 244, 235 }
 (a)
' EventMessageFile
b  { 221, 238, 253, 246, 236, 213, 253, 235, 235, 249, 255, 253, 222, 241, 244, 253 }
 (b)

c  _Function_GetKeyEx_String (#HKEY_LOCAL_MACHINE, ı (a), ı (b))

. (ȡı (c)  2)

     ()

.

 (a)
 (b)

 ()

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ڴ_ֽ_asm, ߼, , ȡַ -> ַ+ƫ[1] -> ַ+ƫ[2] -> ַ+ƫ[N] -> ֽ
. ȡַ, 
. , ֽ, ο
. ƫ, , ɿ 
.ֲ ֲ_, ߼

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
 ({ 82, 51, 192, 135, 69, 8, 138, 0, 139, 85, 12, 136, 2, 255, 69, 8, 90 })
ֲ_  ȡַ  0
 (ֲ_)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ _Function_GetKeyEx_String, ı
. _hKey, 
. _lpSubKey, ı
. _lpValueName, ı
.ֲ Dim_hwnd, 
.ֲ Dim_Data, ı
.ֲ Dim_Type, 
.ֲ Dim_Length, 

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
RegOpenKeyExA (_hKey, _lpSubKey, 0, #KEY_QUERY_VALUE, Dim_hwnd)
. (Dim_hwnd  0)
    Dim_Data  ȡհı (255)
    RegQueryValueExA (Dim_hwnd, _lpValueName, 0, Dim_Type, Dim_Data, Dim_Length)
    RegQueryValueExA (Dim_hwnd, _lpValueName, 0, Dim_Type, Dim_Data, Dim_Length)
    Dim_Data  ȡı (Dim_Data, Dim_Length)
    RegCloseKey (Dim_hwnd)
     (Dim_Data)
.
 ()
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ _д־
. str, ı
.ֲ a, 

a  ļ (ȡضĿ¼ (3)  \log.txt, 2, )
Ƶļβ (a)
дı (a, str  #з)
رļ (a)

.ӳ ߾ȵȴ, , , , , 1000΢ = 1  1000 = 1
. ΢, 
.ֲ hTimer, 
.ֲ int64, LARGE_INTEGER


int64.QuadPart  -10  ΢

hTimer  CreateWaitableTimerA (0, , 0)

SetWaitableTimer (hTimer, int64, 0, 0, 0, )

.жѭ (MsgWaitForMultipleObjects (1, hTimer, , 4294967295, 255)  0)

.жѭβ ()

CloseHandle (hTimer)

.ӳ УCRCӳ6
.ֲ ַ, 
.ֲ У, 
.ֲ ս, 
.ֲ ȡַ, 
.ֲ ȡ, 
.ֲ ֲ_, ֽڼ
.ֲ _begin42, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
ȡַ  0
ȡ  0
ս  6543264


_begin42  0

ַ  _ȡӳʵַ (&У1)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У2)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У3)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У4)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У5)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У6)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У7)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У8)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У9)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У10)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У11)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У12)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У13)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У14)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У15)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У16)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У17)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У18)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У19)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У20)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У21)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У22)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У23)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У24)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У25)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У26)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У27)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У28)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У29)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)
ַ  _ȡӳʵַ (&У30)
У  У (ַ, ַ  101)
ս  _Xor (ս, У)

.жϿʼ (_Xor (ս, 6543264)  0)

    ' Ϣ (code=4574, 0, , )

    '  ()

    ' ֲ_  ѹ ()
    ֲ_  
     (ֲ_)

    ȡַ  ȡָ_ֽڼ (ֲ_)

    ' ڴ_ (ȡǰα_ (), ȡַ, ȡֽڼ (ֲ_), 64, ɵı)
    ־ (14)

     ({ 199, 69, 248, 0, 0, 0, 0, 139, 197, 131, 232, 4, 80, 106, 6, 106, 0, 106, 0, 106, 0, 104, 26, 2, 0, 192, 255, 117, 252, 255, 36, 36 })

     ()
    ZwTerminateProcess (-1, 1)

    ' 0094D013    B8 00000000     mov eax,0x0
    ' 0094D018    8900            mov dword ptr ds:[eax],eax
     ({ 184, 0, 0, 0, 0, 137, 0 })

.Ĭ

.жϽ


 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־



.ӳ У, 
. ȡַ1, 
. ַ, 
.ֲ ȡַ, 
.ֲ ȡ, 
.ֲ crc, 
.ֲ ʱ, 
.ֲ _begin43, 

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־


ȡַ  ȡַ1  ' ebp-0x4

ȡ  0  ' ebp-0x8

crc  4198400  ' ebp-0xc

_begin43  0

.жѭ (ȡַ  ַ)

    ȡ  0

     ({ 139, 69, 252, 139, 0, 137, 69, 248 })

    ȡַ  ADD__ (ȡַ, 4)

    ' crc  λ (crc, ȡ)
    ' 007B01E6    8B45 F4         mov eax,dword ptr ss:[ebp-0xC]
    ' 007B01E9    3345 F8         xor eax,dword ptr ss:[ebp-0x8]
    ' 007B01EC    8945 F4         mov dword ptr ss:[ebp-0xC],eax
     ({ 139, 69, 244, 51, 69, 248, 137, 69, 244 })

.жѭβ ()

 (crc)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

.ӳ call_GetDesktopWindow, 
. ַ, 
.ֲ _begin44, 

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin44  0
ַ  _Xor (ַ, GetDesktopWindowַXor)
 ({ 201, 88, 135, 4, 36, 255, 224 })

 (0)

'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ УCRCӳ1
.ֲ ebp_0x4, 
.ֲ ebp_0x8, 
.ֲ ebp_0xc, 
.ֲ ebp_0x10, ֽ, , , 
.ֲ ebp_0x14, ֽڼ, , , ֽ
.ֲ Dr0, , , , ebp-18
.ֲ Dr1, , , , 1c
.ֲ ֲ_, ֽڼ
.ֲ a1, 
.ֲ CRCֵ, 
.ֲ CRCԭʼֵ, 
.ֲ ޸ĵַ, , , "11"
.ֲ ɵı, 
.ֲ _begin45, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

ebp_0x4  0
ebp_0x8  0
ebp_0xc  0
ebp_0x10  0
ebp_0x14  {  }
Dr0  0
Dr1  0
'  ({ 139, 69, 240, 131, 192, 8, 137, 69, 244 })

' ڴ_ (-1, ebp_0xc, δСַ, 64, ɵı)
' ڴ_ (-1, ȡֽڼָ (ebp_0x14), δСַ, 64, ɵı)

CRCԭʼֵ  368722

' Ϣ (2, 0, , )

Dr1  CRCڴУ鱣ַ

CRCֵ  4198400

_begin45  0

'  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })
.жѭ (Dr1  ADD__ (CRCڴУ鱣ַ, 106))
    ' //////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    ' 0EEC243C    8BC5            mov eax,ebp
    ' 0EEC243E    83E8 10         sub eax,0x10
    ' 0EEC2441    8945 F4         mov dword ptr ss:[ebp-0xC],eax
    ' 0EEC2444    C700 86955114   mov dword ptr ds:[eax],0x14519586
    ' 0EEC244A    8130 2A3F9214   xor dword ptr ds:[eax],0x14923F2A
     ({ 139, 197, 131, 232, 16, 137, 69, 244, 199, 0, 134, 149, 81, 20, 129, 48, 42, 63, 146, 20 })
    ' //////////////////////////////////////////////////////////////////////////////////////////////////////////////////

    . (Ƿرdep  )

        ڴ_ (-1, ebp_0xc, 3, 64, ɵı)

    .

    ebp_0x4  CRCڴУ鱣ַ

    ebp_0x8  CRCڴУ鱣ַ1
    ' //////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    ' 02A0A935    8B75 FC         mov esi,dword ptr ss:[ebp-0x4]           ; ֵ1
    ' 02A0A938    8B4D F8         mov ecx,dword ptr ss:[ebp-0x8]           ; ֵ2
    ' 02A0A93B    33F1            xor esi,ecx                              ; óҪȡֽڵַ
    ' 02A0A93D    8B7D F4         mov edi,dword ptr ss:[ebp-0xC]           ; ȡֽ
    ' 02A0A940    0375 E8         add esi,dword ptr ss:[ebp-0x18]          ; ַƫ
    ' 02A0A943    57              push edi                                 ; 1
    ' 02A0A945    FF1424          call dword ptr ss:[esp]

    . (_Xor (ebp_0x10, 172)  0)
        ' Ϣ (չȥɡ, 0, , )
        ѭ ()
    .

     ({ 139, 117, 252, 139, 85, 248, 51, 242, 139, 125, 244, 3, 117, 232, 87, 255, 20, 36 })
    ' //////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    CRCֵ  _Xor (ebp_0x10, CRCֵ)
    Dr0  ADD__ (Dr0, 1)
    Dr1  ADD__ (Dr1, 1)
.жѭβ ()

'  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })

' Ϣ (ı (CRCֵ)  #з  ı (_Xor (CRCԭʼֵ, 4567113)), 0, , )

.ƴѭ (ֵ (CRCֵ  _Xor (CRCԭʼֵ, 4567113)), )

    ebp_0x14  

     (ebp_0x14)

    Ϣ (code=15674151, 0, , )

    ' ebp_0x14  ѹ ()
    ־ (151)
    '  ()
    ' ebp_0x4  ȡֽڼָ (ebp_0x14)
    ' 004651B1      8B45 EC       mov eax,dword ptr ss:[ebp-0x14]
    ' 004651B4      83C0 08       add eax,0x8
    ' 004651B7      8945 FC       mov dword ptr ss:[ebp-0x4],eax
     ({ 139, 69, 236, 131, 192, 8, 137, 69, 252 })

     ({ 199, 69, 248, 0, 0, 0, 0, 139, 197, 131, 232, 4, 80, 106, 6, 106, 0, 106, 0, 106, 0, 104, 26, 2, 0, 192, 255, 117, 252, 255, 36, 36 })

    ZwTerminateProcess (-1, 1)

    ' 0094D013    B8 00000000     mov eax,0x0
    ' 0094D018    8900            mov dword ptr ds:[eax],eax
     ({ 184, 0, 0, 0, 0, 137, 0 })

.ƴѭβ ()
Dr1  0
Dr0  0
' üı (ʮʮ (_ȡӳʵַ (&ضλCRC)))
' Ϣ (ca, 0, , )

ضλCRC ()
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־



.ӳ call_SendMessageTimeoutA, 
. ַ, 
. hWnd, 
. Msg, 
. wParam, 
. IParam, 
. fuFlags, 
. uTimeout, 
. IpdwResult, 
.ֲ _begin46, 


 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin46  0

ַ  _Xor (ַ, SendMessageTimeoutAַXor)

 ({ 201, 88, 135, 4, 36, 255, 224 })

 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ضλCRC
.ֲ a, 
.ֲ ebp_0x4, 
.ֲ ebp_0x8, 
.ֲ ebp_0xc, 
.ֲ ebp_0x10
.ֲ ebp_0x14
.ֲ ebp_0x18
.ֲ ebp_0x1c
.ֲ ebp_0x20
.ֲ ebp_0x24
.ֲ ebp_0x28
.ֲ ebp_0x2c
.ֲ ebp_0x30
.ֲ ebp_0x34
.ֲ ebp_0x38
.ֲ ebp_0x3c, ֽڼ
.ֲ a1, 
.ֲ _begin47, 

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

ebp_0x4  0
ebp_0x8  0
ebp_0xc  0
ebp_0x10  6280842
ebp_0x14  101565
ebp_0x18  4181283
ebp_0x1c  40255
ebp_0x20  247492
ebp_0x24  429807
ebp_0x28  138975
ebp_0x2c  998173
ebp_0x30  236019
ebp_0x34  408258
ebp_0x38  361
'  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })
ebp_0x3c  ȡհֽڼ (XORֵ)
'  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })

'  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })

ebp_0xc  543

ebp_0x4  101565

_begin47  0

.ƴѭ (11, a1)

    '  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })

    .жϿʼ (a1  1)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x10)
    .ж (a1  2)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x14)
    .ж (a1  3)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x18)
    .ж (a1  4)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x1c)
    .ж (a1  5)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x20)
    .ж (a1  6)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x24)
    .ж (a1  7)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x28)
    .ж (a1  8)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x2c)
    .ж (a1  9)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x30)
    .ж (a1  10)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x34)
    .ж (a1  11)
        ebp_0x4  _Xor (ebp_0x4, ebp_0x38)
    .Ĭ

    .жϽ
    '  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })

     ({ 139, 69, 252, 139, 0, 137, 69, 248 })

    ebp_0xc  _Xor (ebp_0xc, ebp_0x8)

.ƴѭβ ()

.жϿʼ (_Xor (138975, -1950867690)  ebp_0xc)

    '  ({ 139, 69, 196, 131, 192, 8, 137, 69, 252 })
    Ϣ (code=415611, 0, , )
    '  ()
    ebp_0x3c  
     (ebp_0x3c)

    ' ebp_0x3c  ѹ ()
    '  ({ 144, 144, 144, 144, 144, 144, 144, 144 })
    ' Ӳϵ_ܼAPI (, ebp_0x4, XORֵ)
    '  ({ 144, 144, 144, 144, 144, 144, 144, 144 })
    ' mov eax,[ebp-0x3c]
    ' add eax,0x8
    ' mov dword ptr ss:[ebp-0x4],eax
     ({ 139, 69, 196, 131, 192, 8, 137, 69, 252 })
    ־ (15)

     ({ 199, 69, 248, 0, 0, 0, 0, 139, 197, 131, 232, 4, 80, 106, 6, 106, 0, 106, 0, 106, 0, 104, 26, 2, 0, 192, 255, 117, 252, 255, 36, 36 })

    ZwTerminateProcess (-1, 1)

    ' 0094D013    B8 00000000     mov eax,0x0
    ' 0094D018    8900            mov dword ptr ds:[eax],eax
     ({ 184, 0, 0, 0, 0, 137, 0 })


.Ĭ

.жϽ

'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

.ӳ ZwTerminateProcess, 
. a, 
. b, 
.ֲ _begin48, 

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin48  0
call_ZwTerminateProcess (_Xor (ZwTerminateProcessַ, ZwTerminateProcessַXor), a, b)
 (0)
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ call_ZwTerminateProcess, 
. ַ, 
. һ, 
. , 
.ֲ _begin49, 


'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin49  0
 ({ 201, 88, 135, 4, 36, 255, 224 })
 (0)
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ADD__, , , ӷָ ֵ=1+2
. 1, 
. 2, 
.ֲ _begin50, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin50  0
'  ({ 139, 69, 8, 3, 69, 12, 201, 194, 8, 0 })
 ({ 139, 69, 8, 3, 69, 12, 139, 229, 93, 194, 8, 0 })
 (0)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ _Xor, 
. eax, 
. ebx, 
.ֲ _begin51, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin51  0
 ({ 139, 69, 8, 139, 85, 12, 51, 194, 139, 229, 93, 194, 8, 0 })

 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

.ӳ ȡָ_ֽڼ, 
. , ֽڼ
.ֲ _begin52, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin52  0
 ({ 139, 69, 8, 139, 0, 5, 8, 0, 0, 0, 201, 194, 4, 0 })
' mov eax,[ebp+8]
' mov eax,[eax]
' add eax,8
' leave
' retn 4
 (0)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ call_GetWindowThreadProcessId, 
. ַ, 
. һ, 
. , , ο
.ֲ _begin53, 


'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin53  0
ַ  _Xor (ַ, GetWindowThreadProcessIdַXor)
 ({ 201, 88, 135, 4, 36, 255, 224 })
 (0)
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ȡ, ı
. , 
.ֲ ȡı, ı
.ֲ _begin54, 

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
' Ϣ (3begin, 0, , )

ȡı  ȡհı (255)
_begin54  0
' GetClassName (, ȡı, 255)
call_GetClassNameA (GetClassNameAַ, , ȡıָ_asm (ȡı), 255)

' Ϣ (3end, 0, , )

 (ɾβ (ȡı))

'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

.ӳ _call_Sleep, 
. ַ, 
. һ, 
.ֲ _begin55, 


'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin55  0
ַ  _Xor (ַ, sleepַXor)

 ({ 201, 88, 135, 4, 36, 255, 224 })

 (0)
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ȡıָ_asm, 
. ıͱ, ı
.ֲ _begin56, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin56  0
 ({ 139, 69, 8, 139, 0, 201, 194, 4, 0 })
 (0)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ call_GetClassNameA, 
. ַ, 
. һ, 
. , 
. , 
.ֲ _begin57, 


 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin57  0
ַ  _Xor (ַ, GetClassNameAַXor)

 ({ 201, 88, 135, 4, 36, 255, 224 })

 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ȡCRC32_ı2, , , ȡıCRC32ıĩβֽ{0}
. ı, ı
.ֲ _begin58, 


'  ({ 86, 83, 87, 82, 81, 139, 69, 8, 139, 0, 133, 192, 116, 76, 139, 248, 139, 223, 87, 50, 192, 174, 117, 253, 94, 43, 251, 79, 82, 252, 51, 201, 73, 139, 209, 51, 192, 51, 219, 172, 50, 193, 138, 205, 138, 234, 138, 214, 182, 8, 102, 209, 235, 102, 209, 216, 115, 9, 102, 53, 32, 131, 102, 129, 243, 184, 237, 254, 206, 117, 235, 51, 200, 51, 211, 79, 117, 213, 247, 210, 247, 209, 139, 194, 193, 192, 16, 102, 139, 193, 89, 90, 95, 91, 94, 201, 194, 4, 0 })
 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin58  0
 (ȡCRC32_ַ (ȡıָ_asm (ı), ȡı (ı)))

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־



.ӳ ȡCRC32_ַ, , , ȡɶַⳤݵCRC32ֵ
. ַ, 
. , 
.ֲ _begin59, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin59  0
 ({ 86, 83, 87, 82, 81, 139, 69, 8, 133, 192, 126, 86, 139, 248, 139, 223, 87, 50, 192, 94, 139, 125, 12, 133, 255, 126, 71, 82, 252, 51, 201, 73, 139, 209, 51, 192, 51, 219, 172, 50, 193, 138, 205, 138, 234, 138, 214, 182, 8, 102, 209, 235, 102, 209, 216, 115, 9, 102, 53, 32, 131, 102, 129, 243, 184, 237, 254, 206, 117, 235, 51, 200, 51, 211, 79, 117, 213, 247, 210, 247, 209, 139, 194, 193, 192, 16, 102, 139, 193, 89, 90, 95, 91, 94, 201, 194, 4, 0, 51, 192, 235, 243 })
 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ Ӳϵ
. Ҫ߳̾, 
.ֲ ebp_0x4, 
.ֲ ebp_0x8, 
.ֲ ebp_0xc, 
.ֲ ebp_0x10, , , , -
.ֲ ebp_0x14, , , , ֽ-
.ֲ Dr0, , , , ebp-18
.ֲ Dr1, , , , 1c
.ֲ Dr2, , , , 20
.ֲ Dr3, , , , 24
.ֲ Dr6, , , , 28
.ֲ Dr7, , , , 2c
.ֲ ֲ_, ֽڼ
.ֲ ɵı, 
.ֲ ʱ_ӲϵCRC, 
.ֲ a1, 
.ֲ , ֽڼ
.ֲ һַָ, 
.ֲ һַָ1, 
.ֲ 2, ֽڼ
.ֲ a3, 
.ֲ д뿪ʼλ, 
.ֲ , 
.ֲ _begin60, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

ebp_0x4  0
ebp_0x8  0
ebp_0xc  0
ebp_0x10  0
ebp_0x14  0
Dr0  0
Dr1  0
Dr2  0
Dr3  0
Dr6  0
Dr7  0
_begin60  0
' ebp_0x10  ȡհֽڼ (ӲϵڴС1)

' ebp_0x14  ȡհֽڼ (ӲϵڴС2)

.' ѭж ()

    '   ȡհֽڼ (ӲϵڴС2)

    ' ebp_0x10  ȡհֽڼ (ӲϵڴС1)

    ' 2  ȡհֽڼ (ӲϵڴС1)

    ' ebp_0x14  ȡհֽڼ (ӲϵڴС2)

    ' ' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
    ' ' ȡָ
    ' ' ebp_0x8  ȡֽڼָ (ebp_0x14)
    ' ' 00401D63      8B45 E8       mov eax,dword ptr ss:[ebp-0x14]
    ' ' 00401D66      83C0 08       add eax,0x8
    ' ' 00401D69      8945 F8       mov dword ptr ss:[ebp-0x8],eax
    '  ({ 139, 69, 236, 131, 192, 8, 137, 69, 248 })
    ' ' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
    ' ' ȡָ
    ' ' ebp_0xc  ȡֽڼָ (ebp_0x10)
    ' ' 00401D63      8B45 F0       mov eax,dword ptr ss:[ebp-0x10]
    ' ' 00401D66      83C0 08       add eax,0x8
    ' ' 00401D69      8945 F4       mov dword ptr ss:[ebp-0xC],eax
    '  ({ 139, 69, 240, 131, 192, 8, 137, 69, 244 })
    ' ' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

.' ѭжβ (ebp_0x8  һַָ  ebp_0xc  һַָ1)

' һַָ  ebp_0x8

' һַָ1  ebp_0xc

' //---------------------------------------------------------
' //ڴռ716ֽ
' 0040142D  |.  33C9          xor ecx,ecx
' 0040142F  |>  41            /inc ecx
' 00401430  |.  90            |nop
' 00401431  |.  81F9 B3000000 |cmp ecx,0xB3
' 00401437  |.  0F8F 04000000 |jg cccc.00401441
' 0040143D  |.  50            |push eax
' 0040143E  |.  90            |nop
' 0040143F  |.^ EB EE         \jmp Xcccc.0040142F
 ({ 184, 0, 0, 0, 0, 51, 201, 65, 144, 129, 249, 179, 0, 0, 0, 15, 143, 4, 0, 0, 0, 80, 144, 235, 238 })
' //---------------------------------------------------------
' //ڴַ
' mov dword ptr ss:[ebp-0x8],esp
 ({ 137, 101, 248 })
' //---------------------------------------------------------
' //ڴռ50ֽ
' 0040142D  |.  33C9          xor ecx,ecx
' 0040142F  |>  41            /inc ecx
' 00401430  |.  90            |nop
' 00401431  |.  81F9 B3000000 |cmp ecx,0xc
' 00401437  |.  0F8F 04000000 |jg cccc.00401441
' 0040143D  |.  50            |push eax
' 0040143E  |.  90            |nop
' 0040143F  |.^ EB EE         \jmp Xcccc.0040142F
 ({ 184, 0, 0, 0, 0, 51, 201, 65, 144, 129, 249, 12, 0, 0, 0, 15, 143, 4, 0, 0, 0, 80, 144, 235, 238 })
' //ڴַ
' mov dword ptr ss:[ebp-0x10],esp
 ({ 137, 101, 244 })


. (Ƿرdep  )

    ڴ_ (-1, ebp_0xc, 50, 64, ɵı)
.

' дڴΪִ
' ڴ_ (-1, ebp_0xc, 100, 64, ɵı)
ebp_0x4  Ҫ߳̾

Ӳϵ_ܼAPI (NtGetContextThread, ebp_0xc, ӲϵXORֵ)

' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' д־
' WriteDword (ebp_0x8, 65599)
' 004011AD  |.  B8 99550600   mov eax,0x65599
' 004011B2      8B55 F8       mov edx,dword ptr ss:[ebp-0x8]
' 004011B5      8902          mov dword ptr ds:[edx],eax
 ({ 184, 153, 85, 6, 0, 139, 85, 248, 137, 2 })
' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' дֵ
WriteDword (ADD__ (ebp_0x8, 4), ӲϵXORֵ)
WriteDword (ADD__ (ebp_0x8, 8), ӲϵXORֵ)
WriteDword (ADD__ (ebp_0x8, 12), ӲϵXORֵ)
WriteDword (ADD__ (ebp_0x8, 16), ӲϵXORֵ)

' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' ȸֵAPIᱻǣûи˵APIûеóɹ
' 0040171F      B8 00010000   mov eax,0x100
' 00401724      8945 E8       mov dword ptr ss:[ebp-0x18],eax
' 00401727      8945 E4       mov dword ptr ss:[ebp-0x1C],eax
' 0040172A      8945 E0       mov dword ptr ss:[ebp-0x20],eax
' 0040172D      8945 DC       mov dword ptr ss:[ebp-0x24],eax
' 00401730      8945 D8       mov dword ptr ss:[ebp-0x28],eax
' 00401733      8945 D4       mov dword ptr ss:[ebp-0x2C],eax
 ({ 184, 0, 1, 0, 0, 137, 69, 232, 137, 69, 228, 137, 69, 224, 137, 69, 220, 137, 69, 216, 137, 69, 212 })
' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' call 
' 0045FBB3      FF75 F8       push dword ptr ss:[ebp-0x8]
' 0045FBB6      FF75 FC       push dword ptr ss:[ebp-0x4]
' 0045FBB9      FF55 F4       call dword ptr ss:[ebp-0xC]
' Ϣ (ʮʮ (ebp_0xc)  #з  ʮʮ (ebp_0x8), 0, , )

.' ƴѭ (50, a1)

    ' ʱ_ӲϵCRC  ʱ_ӲϵCRC  ebp_0x10 [a1]

.' ƴѭβ ()




 ({ 255, 117, 248, 255, 117, 252, 255, 85, 244 })


WriteDword (ebp_0xc, 0)
WriteDword (ADD__ (ebp_0xc, 4), 0)
WriteDword (ADD__ (ebp_0xc, 8), 0)
WriteDword (ADD__ (ebp_0xc, 16), 0)
WriteDword (ADD__ (ebp_0xc, 20), 0)
WriteDword (ADD__ (ebp_0xc, 24), 0)
WriteDword (ADD__ (ebp_0xc, 28), 0)
WriteDword (ADD__ (ebp_0xc, 32), 0)
WriteDword (ADD__ (ebp_0xc, 36), 0)
WriteDword (ADD__ (ebp_0xc, 40), 0)


' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' 
' ebp_0x10  {  }
' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' ȡֵ
' Dr0  _ָ뵽 (ebp_0x8  4)
' Dr1  _ָ뵽 (ebp_0x8  8)
' Dr2  _ָ뵽 (ebp_0x8  12)
' Dr3  _ָ뵽 (ebp_0x8  16)
' Dr6  _ָ뵽 (ebp_0x8  20)
' Dr7  _ָ뵽 (ebp_0x8  24)
' 0045FB77      8B45 F8       mov eax,dword ptr ss:[ebp-0x8]
' 0045FB7A      83C0 04       add eax,0x4
' 0045FB7D      8B10          mov edx,dword ptr ds:[eax]
' 0045FB7F      8955 E8       mov dword ptr ss:[ebp-0x18],edx
' 0045FB82      83C0 04       add eax,0x4
' 0045FB85      8B10          mov edx,dword ptr ds:[eax]
' 0045FB87      8955 E4       mov dword ptr ss:[ebp-0x1C],edx
' 0045FB8A      83C0 04       add eax,0x4
' 0045FB8D      8B10          mov edx,dword ptr ds:[eax]
' 0045FB8F      8955 E0       mov dword ptr ss:[ebp-0x20],edx
' 0045FB92      83C0 04       add eax,0x4
' 0045FB95      8B10          mov edx,dword ptr ds:[eax]
' 0045FB97      8955 DC       mov dword ptr ss:[ebp-0x24],edx
' 0045FB9A      83C0 04       add eax,0x4
' 0045FB9D      8B10          mov edx,dword ptr ds:[eax]
' 0045FB9F      8955 D8       mov dword ptr ss:[ebp-0x28],edx
' 0045FBA2      83C0 04       add eax,0x4
' 0045FBA5      8B10          mov edx,dword ptr ds:[eax]
' 0045FBA7      8955 D4       mov dword ptr ss:[ebp-0x2C],edx
 ({ 139, 69, 248, 131, 192, 4, 139, 16, 137, 85, 232, 131, 192, 4, 139, 16, 137, 85, 228, 131, 192, 4, 139, 16, 137, 85, 224, 131, 192, 4, 139, 16, 137, 85, 220, 131, 192, 4, 139, 16, 137, 85, 216, 131, 192, 4, 139, 16, 137, 85, 212 })
' ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
' _д־ (ʮʮ (Dr0)      ʮʮ (Dr1)      ʮʮ (Dr2)      ʮʮ (Dr3)      ʮʮ (Dr6)      ʮʮ (Dr7))

'  (ʮʮ (Dr0), ʮʮ (Dr1), ʮʮ (Dr2), ʮʮ (Dr3), ʮʮ (Dr6), ʮʮ (Dr7))
.' ƴѭ ( (ebp_0x10 [1]  194)   (ebp_0x10 [6]  194)   (ebp_0x10 [1]  233)   (ʱ_ӲϵCRC  ӲϵCRC)   (ebp_0x10 [6]  255)   (ebp_0x10 [17]  255)   (Ӳϵ㺯޸), )

    ' Dr0  ebp_0xc

.' ƴѭβ ()

.' ƴѭ (15, a3)

    .' ƴѭ ( (ebp_0x10 [a3]  144)   (ebp_0x10 [a3]  235), )

        ' ' Ϣ (543632, 0, , )

        ' Dr0  ebp_0xc

    .' ƴѭβ ()

.' ƴѭβ ()

. (Dr6  Dr7  Ķڴ  )
    ־ (17)
    񵶼¼־ (5, 0, , )
    Ϣ (code=53453, 0, , )

    յĵ  
    ' Ϣ (ı (յĵ), 0, , )
.

. (Dr0  0  Dr1  0  Dr2  0  Dr3  0)

     ()
.

' յĵ  
' ӲϵѼ⵽  
־ (10002)
' дļ (ȡĿ¼ ()  \data\code10002.txt, ֽڼ (ȡʱ ()))

д뿪ʼλ  ADD__ (4198400, ϵͳ_ȡ (1000, 30000))

  ADD__ (, 4)

.ƴѭ (10000000, )

    WriteDword (ADD__ (д뿪ʼλ, ), 0)

      ADD__ (, 4)

.ƴѭβ ()

' Ϣ (⵽Ӳϵ..., 0, , )

' Ӳϵ㺯޸  
' ebp_0x14  ѹ ()

' '''Ϣ (code=2425, 0, , )
' ebp_0x4  ȡֽڼָ (ebp_0x14)
' 004651B1      8B45 EC       mov eax,dword ptr ss:[ebp-0x14]
' 004651B4      83C0 08       add eax,0x8
' 004651B7      8945 FC       mov dword ptr ss:[ebp-0x4],eax
'  ({ 139, 69, 236, 131, 192, 8, 137, 69, 252 })

'  ({ 199, 69, 248, 0, 0, 0, 0, 139, 197, 131, 232, 4, 80, 106, 6, 106, 0, 106, 0, 106, 0, 104, 26, 2, 0, 192, 255, 117, 252, 255, 36, 36 })

ZwTerminateProcess (ȡǰα_ (), 1)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־



.ӳ Ӳϵ_ܼAPI
. , ֽڼ
. xor, 
.ֲ _begin61, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
' 00401449  |.  8B55 08       mov edx,[arg.1]
' 0040144C  |.  8B12          mov edx,dword ptr ds:[edx]
' 0040144E  |.  83C2 08       add edx,0x8
 ({ 139, 85, 8, 139, 18, 131, 194, 8 })  ' ҪܶݷŵEDX...

.ƴѭ (50, )
    ' 00401468      8A02          |mov al,byte ptr ds:[edx]
    ' 0040146A      8A65 0C       mov ah,byte ptr ss:[ebp+0xC]
    ' 0040146D      32C4          |xor al,ah
    ' 0040146F      8802          |mov byte ptr ds:[edx],al
    ' 00401471      83C2 01       |add edx,0x1
     ({ 138, 2, 138, 101, 12, 50, 196, 136, 2, 131, 194, 1 })

.ƴѭβ ()

_begin61  0

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ Ӳϵ_ܼAPI
. ԭʼݵַ, ֽڼ
. ַ, 
. XOR, 
.ֲ _begin62, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
' 00401449  |.  8B55 08       mov edx,[arg.1]
' 0040144C  |.  8B12          mov edx,dword ptr ds:[edx]
' 0040144E  |.  83C2 08       add edx,0x8
 ({ 139, 85, 8, 139, 18, 131, 194, 8 })  ' ԭʼݵָ붪EDX
' 00401451      8B55 0C       mov edx,dword ptr ss:[ebp+0xC]
' 00401454      8B1B          mov ebx,dword ptr ds:[ebx]
' 00401456      83C3 08       add ebx,0x8
 ({ 139, 93, 12 })  ' ѽܻŵEBX
'  ({ 139, 93, 12, 139, 27, 131, 195, 8 })  ' ѽܻŵEBX
.ƴѭ (50, )
     ({ 138, 2, 138, 101, 16, 50, 196, 136, 3, 131, 194, 1, 131, 195, 1 })
.ƴѭβ ()
_begin62  0
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ Ӳϵ_ָ뵽ֽڼ
. ַ, 
. , 
. , ֽڼ
.ֲ _begin63, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
' 004013FF      8B55 08       mov edx,dword ptr ss:[ebp+0x8]
' 00401402      8B5D 10       mov ebx,dword ptr ss:[ebp+0x10]
' 00401405      8B1B          mov ebx,dword ptr ds:[ebx]
' 00401407      83C3 08       add ebx,0x8
 ({ 139, 85, 8, 139, 93, 16, 139, 27, 131, 195, 8 })
' Ϣ (׼ȡ.., 0, , )

.ƴѭ (, )
    ' 0040140E      50            push eax
    ' 0040140F      8A02          mov al,byte ptr ds:[edx]
    ' 00401411      8803          mov byte ptr ds:[ebx],al
    ' 00401413      83C2 01       add edx,0x1
    ' 00401416      83C3 01       add ebx,0x1
    ' 00401419      58            pop eax
     ({ 80, 138, 2, 136, 3, 131, 194, 1, 131, 195, 1, 88 })

.ƴѭβ ()
_begin63  0
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ʼ
.ֲ ڴַ, 
.ֲ a1, 
.ֲ C2ҵ, 
.ֲ C3ҵ, 
.ֲ _begin64, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin64  0

ݼXORֵ  ȡ (100, 254)

NtQueryVirtualMemory  ȡհֽڼ (50)

ݼ  ȡհֽڼ (50)

ڴ_ָ뵽ֽڼ (_Xor (NtQueryVirtualMemoryַ, NtQueryVirtualMemoryַXor), 50, NtQueryVirtualMemory)

' дļ (ȡضĿ¼ (3)  \fVirtualQueryEx1.txt, NtQueryVirtualMemory)

C2ҵ  -1

C3ҵ  -1

.ƴѭ (50, a1)

    . (NtQueryVirtualMemory [a1]  195)

        C3ҵ  a1
    .

    . (NtQueryVirtualMemory [a1]  194)

        C2ҵ  a1

        ѭ ()

    .

.ƴѭβ ()

. (C2ҵ  -1)
    Ϣ (code=75345, 0, , )
    յĿ  

.
. (C2ҵ  -1  C3ҵ  -1)
    Ϣ (code=123546, 0, , )
    յĿ  

    ' Ϣ (յĿ񵶡, 0, , )
.

.'  (NtQueryVirtualMemory [6]  195)
    ' ' Ϣ (SSS, 0, , )
    ' 񵶼¼־ (4, 0, , )
    ' յĿ  

.

ڴ_ܼAPI (NtQueryVirtualMemory, ݼXORֵ)

' Ƭ1  { 188, 241, 206, 239, 179, 172, 202, 177, 163, 172, 201 }
' Ƭ2  { 190, 179, 253, 184, 195, 206, 239, 198, 183, 163, 161 }
' Ƭ1  { 71, 10, 53, 20, 72, 87, 49, 74, 88, 87, 50, 69, 72, 6, 67, 56, 53, 20, 61, 76, 88, 90 }  ' ﳬʱɾƷ

' ڴ  ȡհֽڼ (22)

' ڴַ  ȡֽڼָ_asm (ڴ)

' ڴ_ܼAPI (Ƭ1, ڴַ, 251, 22)

'  (ڴ)

' ڴַ [1]  ڴַ  8

' Ƭ1  { 36, 105, 86, 119, 43, 52, 82, 41, 59, 52, 81, 38, 43, 101, 32, 91, 86, 119, 94, 47, 59, 57 }  ' ﳬʱɾƷ
Ƭ1  { 244, 237, 249, 247, 232, 253, 246 }  ' luaopen
ڴ  Ƭ1
'  (ڴ)
ڴַ  ȡֽڼָ_asm (ڴ)
ڴַ [1]  ڴַ  8

' Ƭ1  { 81, 105, 42, 46, 86, 44, 44, 62, 88, 117, 168, 219, 184 }  ' 
Ƭ1  { 212, 237, 249, 184, 173, 182, 170 }  ' Lua 5.2
ڴ  Ƭ1
 (ڴ)
ڴַ  ȡֽڼָ_asm (ڴ)
ڴַ [2]  ڴַ  8


' Ƭ1  { 248, 4, 34, 194, 152, 29, 152, 242, 152, 242, 152, 242, 152, 242, 152, 242, 152, 171, 81, 57, 176, 57, 26, 152, 35, 204, 133, 248, 152, 103, 75, 5, 249, 91 }  ' gomfz
' GOMڴ  Ƭ1
'  (GOMڴ)
' ڴַ  ȡֽڼָ_asm (GOMڴ)
' ڴַ [3]  ڴַ  8

' Ƭ1  { 212, 237, 249, 184, 173, 182, 170 }  ' Lua 5.2
Ƭ1  { 44, 106, 42, 35, 46, 55, 44, 106, 32, 110, 36, 62, 40, 85, 40, 58, 59, 57 }  ' 򲻶Ͱ

ڴ2  Ƭ1

 (ڴ2)

ڴַ  ȡֽڼָ_asm (ڴ2)

ڴַ [3]  ڴַ  8

' _д־ (ı (ڴ)     ı (ڴ))
'  (ı (ڴ), ı (ڴ))
' Ϣ (ı (ڴ), 0, , )

' Ƭ1  { 29, 152, 19, 91, 38, 164, 22, 199, 152, 103, 78, 5, 249, 91 }  ' GOMFZר
' GOMFZ1  Ƭ1
'  (GOMFZ1)
' ڴַ  ȡֽڼָ_asm (GOMFZ1)
' GOMFZַ [1]  ڴַ  8

Ƭ1  { 220, 212, 212, 86, 92, 36, 102, 162, 186, 189, 235, 186, 182, 95, 115, 75 }  ' C
C1  Ƭ1
 (C1)
ڴַ  ȡֽڼָ_asm (C1)
GOMFZַ [1]  ڴַ  8

' Ƭ1  { 212, 237, 249, 184, 173, 182, 170 }  ' Lua 5.2
' GOMFZ1  Ƭ1
'  (GOMFZ1)
' ڴַ  ȡֽڼָ_asm (GOMFZ1)
' GOMFZַ [2]  ڴַ  8

Ƭ1  { 38, 164, 22, 199, 152 }  ' GOMFZר
gomfz1  Ƭ1
 (gomfz1)
ڴַ  ȡֽڼָ_asm (gomfz1)
gomfz [1]  ڴַ  8

Ƭ1  { 35, 204, 133, 248, 152 }  ' GOMFZר
gomfz2  Ƭ1
 (gomfz2)
ڴַ  ȡֽڼָ_asm (gomfz2)
gomfz [2]  ڴַ  8

Ƭ1  { 35, 228, 171, 199, 152 }  ' GOMFZר
gomfz3  Ƭ1
 (gomfz3)
ڴַ  ȡֽڼָ_asm (gomfz3)
gomfz [3]  ڴַ  8

Ƭ1  { 35, 72, 177, 248, 152 }  ' GOMFZר
gomfz4  Ƭ1
 (gomfz4)
ڴַ  ȡֽڼָ_asm (gomfz4)
gomfz [4]  ڴַ  8

Ƭ1  { 35, 160, 217, 248, 152 }  ' GOMFZר
gomfz5  Ƭ1
 (gomfz5)
ڴַ  ȡֽڼָ_asm (gomfz5)
gomfz [5]  ڴַ  8

Ƭ1  { 35, 120, 87, 255, 152 }  ' GOMFZר
gomfz6  Ƭ1
 (gomfz6)
ڴַ  ȡֽڼָ_asm (gomfz6)
gomfz [6]  ڴַ  8

' _д־ (ڴָ:  ʮʮ (GOMFZַ [1]  8))

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ȡֽڼָ_asm, 
. ֽڼ, ֽڼ, ο
.ֲ _begin65, 



 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin65  0
 ({ 139, 69, 8, 139, 0, 131, 248, 0, 116, 3, 131, 192, 8, 201, 194, 4, 0 })
 (0)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ , ߼
.ֲ a1, 
.ֲ array, , , "0"
.ֲ Count, 
.ֲ i, 
.ֲ eax, 
.ֲ _begin66, 
.ֲ API, 
.ֲ 񵶹, ߼
.ֲ Wow64EmulateAtlThunkַ_ֲ, 
.ֲ Wow64EmulateAtlThunkַ_ƫƵַ_ֲ, 
.ֲ Wow64EmulateAtlThunkַ_ʵתַ_ֲ, 
.ֲ Wow64EmulateAtlThunkַ_ǰתַ_ֲ, 
.ֲ Wow64EmulateAtlThunkַ_ǰתַ_ֲ1, 
.ֲ Wow64SystemServiceExַ_ֲ, 
.ֲ lea_r10ַ, 
.ֲ , 
.ֲ r10ƫ, 
.ֲ r10ֵ, 
.ֲ r12ƫ, 
.ֲ r12ֵ, 
.ֲ ȥĿ, ߼
.ֲ д뿪ʼλ, 
.ֲ , 
.ֲ ֲ_, ֽڼ
.ֲ ȡַ, 
.ֲ TurboDispatchJumpAddressEndַ_ֲ, 
.ֲ call_wow64CPU_1080ַ, 
.ֲ ַ, 
.ֲ callƫ, 
.ֲ callƫƵַ, 
.ֲ callƫƵַprt, 
.ֲ API޸, ֽ
.ֲ Wow64EmulateAtlThunk_ֲ, 

' Ϣ (ʼ, 0, , )
 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
ȡַ  0
̴߳ʱ  ADD__ (̴߳ʱ, 1)
_begin66  0
' ޸jmp
eax  _ָ뵽 (7465432)
eax  _ָ뵽 (eax)
eax  _ָ뵽 (eax)
eax  _ָ뵽 (ADD__ (eax, 24))
eax  1 (eax, 2)  ' 4324600
' Ϣ (ı (eax), 0, , )
API  _ָ뵽 (9024320)


. (API  0  API  268435456)

    Ϣ (code=5412335, 0, , )

    񵶹  

.

    ڴ_ֽ_asm (API, API޸)

    . (API޸  233)

        ' Ϣ (ʮʮ (API޸), 0, , )
        񵶹  

    .

.

.'  (2162300  eax)
    ' Ϣ (!!!  ı (eax), 0, , )

.
gomfz  ϵͳ_ȡ (1, 6)

. (ɨ  )

     ()

.
' ̴߳ʱ  ADD__ (̴߳ʱ, 1)
' Ϣ (ʼ, 0, , )

. (ǷΪ64λϵͳ  )

    Wow64SystemServiceExַ_ֲ  _Xor (Wow64SystemServiceExַ, Wow64SystemServiceExַXor)

    . (Wow64SystemServiceExַ_ֲ  0)

        lea_r10ַ  ADD__ (Wow64SystemServiceExַ_ֲ, 63)

          _ָ뵽_ڴ (lea_r10ַ)

        . (  361581769)

            lea_r10ַ  ADD__ (lea_r10ַ, 4)

            r10ƫ  _ָ뵽_ڴ (lea_r10ַ)

            ' r10ֵ  _ָ뵽_ڴ (lea_r10ַ  4  r10ƫ)
            r10ֵ  _ָ뵽_ڴ (ADD__ (ADD__ (lea_r10ַ, 4), r10ƫ))

            r12ƫ  ADD__ (r10ֵ, 256)

            r12ֵ  _ָ뵽_ڴ (r12ƫ)

            . (r12ֵ  Wow64dllַ)
                Ϣ (code=8645345, 0, , )
                ' Ϣ (1, 0, , )
                յĿ  
                ȥĿ  

            .

        .

    .


    TurboDispatchJumpAddressEndַ_ֲ  _Xor (TurboDispatchJumpAddressEndַ, TurboDispatchJumpAddressEndַXor)

    . (TurboDispatchJumpAddressEndַ_ֲ  0)

        ַ  ADD__ (TurboDispatchJumpAddressEndַ_ֲ, 37)  ' Ŀַ+39 ȥ2λΪ

          _ָ뵽_ڴ (ַ)

        ' Ϣ (ַ:  ʮʮ (ַ)  #з  ı (), 0, , )

        . (  369084555)

            call_wow64CPU_1080ַ  ADD__ (ַ, 2)

            callƫ  _ָ뵽_ڴ (ADD__ (call_wow64CPU_1080ַ, 2))

            ' r10ֵ  _ָ뵽_ڴ (lea_r10ַ  4  r10ƫ)
            callƫƵַ  ADD__ (ADD__ (call_wow64CPU_1080ַ, callƫ), 6)

            callƫƵַprt  _ָ뵽_ڴ (callƫƵַ)

            ' Ϣ (callƫ:  ı (callƫ)  #з  callƫƵַ:  ı (callƫƵַ)  #з  callƫƵַprt:  ı (callƫƵַprt)  #з  Wow64cpudllַ:  ı (Wow64cpudllַ), 0, , )

            . (callƫƵַprt  Wow64dllַ)

                ' Ϣ (2, 0, , )
                Ϣ (code=57567, 0, , )
                յĿ  

                ȥĿ  

            .

        .

    .


    Wow64EmulateAtlThunkַ_ֲ  _Xor (Wow64EmulateAtlThunkַ, Wow64EmulateAtlThunkַXor)

    Wow64EmulateAtlThunk_ֲ  _ָ뵽_ڴ (Wow64EmulateAtlThunkַ_ֲ)

    . (Wow64EmulateAtlThunk_ֲ  268435456)
        ' Ϣ (ʮʮ (Wow64EmulateAtlThunk_ֲ)  #з  ʮʮ (NTDLLģַ)  #з  ı (Wow64EmulateAtlThunk_ֲ)  #з  ı (NTDLLģַ), 0, , )
        Ϣ (code=67543, 0, , )
        յĿ  

        ȥĿ  
    .


.
' Ϣ (ı (ȥĿ)  #з  ı (hDevice), 0, , )

. (ȥĿ    hDevice  -1)

    Ϣ (code=k25144  #з  ı (ȥĿ)  #з  ı (hDevice), 0, , )

    ֲ_  

     (ֲ_)

    ȡַ  ȡָ_ֽڼ (ֲ_)
    ־ (101)
    ' ڴ_ (ȡǰα_ (), ȡַ, ȡֽڼ (ֲ_), 64, ɵı)

     ({ 199, 69, 248, 0, 0, 0, 0, 139, 197, 131, 232, 4, 80, 106, 6, 106, 0, 106, 0, 106, 0, 104, 26, 2, 0, 192, 255, 117, 252, 255, 36, 36 })

    д뿪ʼλ  ADD__ (4198400, ϵͳ_ȡ (1000, 30000))

      ADD__ (, 4)

    .ƴѭ (10000000, )

        WriteDword (ADD__ (д뿪ʼλ, ), 0)

          ADD__ (, 4)

    .ƴѭβ ()

.

ɨ  
' Ϣ (ʼ, 0, , )

Count  ޵ڴ (-1, , , array)
ɨ  
' Ϣ (:  ı (Count), 0, , )
' _д־ (:  ı (Count))
.' ƴѭ (Count, a1)
    ' ' _д־ (ҳ:  ʮʮ (array [a1]))
.' ƴѭβ ()


.жϿʼ (Count  0  2162300  eax  񵶹    CRC޸    ⲿ  )

    Ϣ (code=23464  #з  ı (Count)  #з  ı (eax)  #з  ı (񵶹)  #з  ı (CRC޸)  #з  ı (ⲿ), 0, , )

    ־ (102, ı (Count)  #з  ı (eax)  #з  ı (񵶹)  #з  ı (CRC޸)  #з  ı (ⲿ))

    ' Ϣ (1, 0, , )

    ' Ϣ (ca, 0, , )
    ֲ_  
    ' Ϣ (2, 0, , )

     (ֲ_)
    ' Ϣ (3, 0, , )

    ȡַ  ȡָ_ֽڼ (ֲ_)

    ' Ϣ (ʮʮ (ȡַ), 0, , )

    ' ڴ_ (ȡǰα_ (), ȡַ, ȡֽڼ (ֲ_), 64, ɵı)

     ({ 199, 69, 248, 0, 0, 0, 0, 139, 197, 131, 232, 4, 80, 106, 6, 106, 0, 106, 0, 106, 0, 104, 26, 2, 0, 192, 255, 117, 252, 255, 36, 36 })
    ' ־ (102)

    д뿪ʼλ  ADD__ (4198400, ϵͳ_ȡ (1000, 30000))

      ADD__ (, 4)

    .ƴѭ (10000000, )

        WriteDword (ADD__ (д뿪ʼλ, ), 0)

          ADD__ (, 4)

    .ƴѭβ ()
.Ĭ

.жϽ



.' ƴѭ (Count, i)

    ' ' Ϣ (addr:  ʮʮ (array [i]), 0, , )
    ' ' _д־ (addr:  ʮʮ (array [i]))

    .'  (array [i]  ڴַ [a1]  8)

        ' ' Ϣ (..., 0, , )
        ' ' _д־ (...  ʮʮ (array [i]))
        '  ()
    .
        ' ' _д־ (ֵ.....  ʮʮ (array [i]))

    .



.' ƴѭβ ()



 ()

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ޵ڴ, 
. , 
. , , ɿ
. Ƿ, ߼
. , , 
.ֲ ڴϢ_ֽڼ, 
.ֲ fVirtualQueryEx, 
.ֲ ڴϢָ, 
.ֲ fVirtualQueryExָ, 
.ֲ һַ, 
.ֲ , 
.ֲ ڴ鳤, 
.ֲ ڴַ, 
.ֲ ݻ, ֽڼ
.ֲ ȡ, 
.ֲ ʼַ, 
.ֲ ƴ, 
.ֲ ʱ, 
.ֲ ȡ1, 
.ֲ ʼ, 
.ֲ a1, 
.ֲ ɨ, 
.ֲ ַ, 
.ֲ ַ, 
.ֲ ʼ, 
.ֲ 򳤶, 
.ֲ ҳ״̬, 
.ֲ ǰ, 
.ֲ ҳ, 
.ֲ ɵȨ, 
.ֲ Protect, ߼
.ֲ ۼƴ, 
.ֲ GOMFZ, 
.ֲ a2, 
.ֲ GOMFZƫ, 
.ֲ C2ҵ, 
.ֲ C3ҵ, 
.ֲ _begin67, 
.ֲ ̾, 
.ֲ ģ, 
.ֲ ģ, ı
.ֲ ǰںִжδС, 
.ֲ result, 
.ֲ صַ, 
.ֲ ԭʼ, 
.ֲ ָ, 
.ֲ , 
.ֲ ȷڴ溯, ֽڼ
.ֲ װSEH, ֽڼ
.ֲ ɾSEH, ֽڼ
.ֲ SEHӿ, ֽڼ
.ֲ ȷڴ溯ַָ, 
.ֲ װSEHַָ, 
.ֲ ɾSEHַָ, 
.ֲ SEHӿַָ, 
.ֲ ԭַ, 
.ֲ eip, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

ڴϢ_ֽڼ  0
fVirtualQueryEx  0
ڴϢָ  0
fVirtualQueryExָ  0
һַ  -1
  0
ڴ鳤  0
ڴַ  0
ݻ  {  }
ȡ  0
ʼַ  0
ƴ  0
ʱ  0
ȡ1  0
ʼ  0
a1  0
ɨ  0
ַ  0
ַ  0
ʼ  0
򳤶  0
ҳ״̬  0
ǰ  0
ҳ  0
ɵȨ  0
Protect  
ۼƴ  0
GOMFZ  0
a2  0
GOMFZƫ  0
C2ҵ  0
C3ҵ  0
_begin67  0
̾  0
ģ  0
ģ  
ǰںִжδС  0
result  0
صַ  0
ԭʼ  0
ָ  0
  0
ȷڴ溯  {  }
װSEH  {  }
ɾSEH  {  }
SEHӿ  {  }
ȷڴ溯ַָ  0
װSEHַָ  0
ɾSEHַָ  0
SEHӿַָ  0
ԭַ  0
eip  0



' /ڴ
' fVirtualQueryEx size 0x15*4
' 1007A2AD      33C9                xor ecx,ecx
' 1007A2AF      41                  inc ecx
' 1007A2B0      90                  nop
' 1007A2B1      81F9 15000000       cmp ecx,0x15
' 1007A2B7      0F8F 04000000       jg 29.1007A2C1
' 1007A2BD      50                  push eax
' 1007A2BE      90                  nop
' 1007A2BF    ^ EB EE               jmp X29.1007A2AF
 ({ 51, 201, 65, 144, 129, 249, 21, 0, 0, 0, 15, 143, 4, 0, 0, 0, 80, 144, 235, 238 })
' 1007A2C1      8965 F0             mov dword ptr ss:[ebp-0x10],esp
 ({ 137, 101, 240 })
' ڴ
' ڴϢ size 0xA*4
' 1007A2AD      33C9                xor ecx,ecx
' 1007A2AF      41                  inc ecx
' 1007A2B0      90                  nop
' 1007A2B1      81F9 0A000000       cmp ecx,0xA
' 1007A2BE      90                  nop
' 1007A2BF    ^ EB EE               jmp X29.1007A2AF
 ({ 51, 201, 65, 144, 129, 249, 10, 0, 0, 0, 15, 143, 4, 0, 0, 0, 80, 144, 235, 238 })
' 1007A2C1      8965 F0             mov dword ptr ss:[ebp-0xC],esp
 ({ 137, 101, 244 })

̴߳ʱ  ADD__ (̴߳ʱ, 1)

ڴ_ܼAPI (NtQueryVirtualMemory, fVirtualQueryExָ, ݼXORֵ, 50)

ڴ_ָ뵽ֽڼ (fVirtualQueryExָ, 50, ݼ)

C2ҵ  -1

C3ҵ  -1

.ƴѭ (50, a1)

    . (ݼ [a1]  195)
        C3ҵ  a1
    .

    . (ݼ [a1]  194)
        C2ҵ  a1
        ѭ ()
    .

.ƴѭβ ()

. (C2ҵ  -1)
    Ϣ (code=867456, 0, , )
    յĿ  

.
. (C2ҵ  -1  C3ҵ  -1)
    Ϣ (code=6463234, 0, , )

    յĿ  

.
. (жģ  )

     (0)
.

'  (ݼ)

' дļ (ȡضĿ¼ (3)  \fVirtualQueryEx.txt, ָ뵽ֽڼ (fVirtualQueryExָ, 50))

' Ϣ (ʮʮ (fVirtualQueryExָ)  #з  ʮʮ ( (&call_ڴ))  #з  ʮʮ (ڴϢָ), 0, , )

' صַ   ( (ȡضĿ¼ (3)  \data.ini, setup, addr, ))
' Ϣ (صַ:  ʮʮ (صַ), 0, , )

. (Ƿرdep  )

    ڴ_ (-1, fVirtualQueryExָ, 50, 64, ɵȨ)

.

̴߳ʱ  ADD__ (̴߳ʱ, 1)

ڴ鳤  28
' ////////////////////////////////////////////////////////////////////////////////
' ڴ澫ȷҺ  { 164, 122, 29, 112, 29, 245, 241, 241, 241, 145, 109, 13, 122, 172, 225, 114, 50, 249, 254, 71, 242, 122, 186, 13, 216, 188, 253, 97, 122, 140, 249, 122, 188, 253, 114, 8, 241, 143, 239, 3, 95, 132, 235, 120, 140, 249, 120, 188, 253, 190, 122, 2, 122, 191, 13, 2, 87, 132, 16, 14, 188, 249, 54, 180, 253, 12, 14, 14, 14, 108, 144, 114, 140, 253, 12, 254, 117, 246, 241, 241, 241, 54, 180, 249, 241, 241, 241, 241, 122, 180, 249, 24, 241, 241, 241, 241, 122, 20, 172, 51, 253, 241 }


' װSEH  { 85, 139, 236, 199, 69, 8, 147, 19, 64, 0, 139, 69, 8, 201, 131, 236, 96, 156, 96, 255, 180, 36, 132, 0, 0, 0, 106, 0, 80, 221, 116, 36, 48, 155, 100, 255, 53, 0, 0, 0, 0, 100, 137, 37, 0, 0, 0, 0, 184, 1, 0, 0, 0, 255, 100, 36, 12, 184, 1, 0, 0, 0, 233, 0, 0, 0, 0, 139, 229, 93, 194, 8, 0 }
װSEH  { 205, 19, 116, 95, 221, 144, 11, 139, 216, 152, 19, 221, 144, 81, 27, 116, 248, 4, 248, 103, 44, 188, 28, 152, 152, 152, 242, 152, 200, 69, 236, 188, 168, 3, 252, 103, 173, 152, 152, 152, 152, 252, 17, 189, 152, 152, 152, 152, 32, 153, 152, 152, 152, 103, 252, 188, 148, 32, 153, 152, 152, 152, 113, 152, 152, 152, 152, 19, 125, 197, 90, 144, 152 }
'  (װSEH)

װSEHַָ  ȡֽڼָ_asm (װSEH)

' ɾSEH  { 85, 139, 236, 199, 69, 8, 147, 19, 64, 0, 81, 100, 139, 13, 0, 0, 0, 0, 129, 249, 255, 255, 0, 0, 126, 42, 139, 65, 4, 59, 69, 8, 116, 4, 139, 9, 235, 236, 139, 69, 4, 139, 225, 100, 143, 5, 0, 0, 0, 0, 131, 196, 12, 137, 68, 36, 28, 97, 157, 221, 36, 36, 155, 131, 196, 108, 255, 224, 89, 144, 139, 229, 93, 194, 8, 0 }
ɾSEH  { 205, 19, 116, 95, 221, 144, 11, 139, 216, 152, 201, 252, 19, 149, 152, 152, 152, 152, 25, 97, 103, 103, 152, 152, 230, 178, 19, 217, 156, 163, 221, 144, 236, 156, 19, 145, 115, 116, 19, 221, 156, 19, 121, 252, 23, 157, 152, 152, 152, 152, 27, 92, 148, 17, 220, 188, 132, 249, 5, 69, 188, 188, 3, 27, 92, 244, 103, 120, 193, 8, 19, 125, 197, 90, 144, 152 }
ɾSEHַָ  ȡֽڼָ_asm (ɾSEH)
'  (ɾSEH)

' SEHӿ  { 85, 139, 236, 139, 69, 8, 129, 56, 37, 0, 0, 192, 116, 70, 131, 120, 4, 0, 117, 64, 232, 0, 0, 0, 0, 88, 131, 192, 6, 235, 29, 100, 137, 37, 0, 0, 0, 0, 131, 196, 16, 97, 157, 221, 36, 36, 155, 100, 139, 37, 0, 0, 0, 0, 51, 192, 255, 100, 36, 12, 81, 139, 77, 16, 137, 129, 184, 0, 0, 0, 139, 69, 12, 137, 129, 196, 0, 0, 0, 89, 51, 192, 235, 5, 184, 1, 0, 0, 0, 137, 69, 8, 139, 69, 8, 233, 0, 0, 0, 0, 139, 229, 93, 194, 16, 0 }
SEHӿ  { 205, 19, 116, 19, 221, 144, 25, 160, 189, 152, 152, 88, 236, 222, 27, 224, 156, 152, 237, 216, 112, 152, 152, 152, 152, 192, 27, 88, 158, 115, 133, 252, 17, 189, 152, 152, 152, 152, 27, 92, 136, 249, 5, 69, 188, 188, 3, 252, 19, 189, 152, 152, 152, 152, 171, 88, 103, 252, 188, 148, 201, 19, 213, 136, 17, 25, 32, 152, 152, 152, 19, 221, 148, 17, 25, 92, 152, 152, 152, 193, 171, 88, 115, 157, 32, 153, 152, 152, 152, 17, 221, 144, 19, 221, 144, 113, 152, 152, 152, 152, 19, 125, 197, 90, 136, 152 }
SEHӿַָ  ȡֽڼָ_asm (SEHӿ)
'  (SEHӿ)

' ȷڴ溯  { 85, 139, 236, 129, 236, 8, 0, 0, 0, 199, 69, 252, 0, 0, 0, 0, 106, 0, 255, 117, 252, 232, 118, 0, 0, 0, 133, 192, 15, 132, 62, 0, 0, 0, 96, 156, 252, 139, 93, 16, 131, 195, 8, 15, 182, 3, 139, 75, 252, 41, 77, 12, 144, 139, 125, 8, 139, 77, 12, 131, 249, 0, 126, 30, 242, 174, 117, 26, 137, 125, 8, 137, 77, 12, 79, 139, 243, 139, 78, 252, 243, 166, 117, 225, 255, 77, 8, 199, 69, 12, 253, 255, 255, 255, 157, 97, 199, 69, 252, 0, 0, 0, 0, 106, 0, 255, 117, 252, 232, 241, 0, 0, 0, 131, 125, 12, 253, 15, 132, 7, 0, 0, 0, 199, 69, 8, 0, 0, 0, 0, 139, 69, 8, 233, 0, 0, 0, 0, 139, 229, 93, 194, 12, 0 }
ȷڴ溯  { 205, 19, 116, 25, 116, 144, 152, 152, 152, 95, 221, 100, 152, 152, 152, 152, 242, 152, 103, 237, 100, 112, 238, 152, 152, 152, 29, 88, 151, 28, 166, 152, 152, 152, 248, 4, 100, 19, 197, 136, 27, 91, 144, 151, 46, 155, 19, 211, 100, 177, 213, 148, 8, 19, 229, 144, 19, 213, 148, 27, 97, 152, 230, 134, 106, 54, 237, 130, 17, 229, 144, 17, 213, 148, 215, 19, 107, 19, 214, 100, 107, 62, 237, 121, 103, 213, 144, 95, 221, 148, 101, 103, 103, 103, 5, 249, 95, 221, 100, 152, 152, 152, 152, 242, 152, 103, 237, 100, 112, 105, 152, 152, 152, 27, 229, 148, 101, 151, 28, 159, 152, 152, 152, 95, 221, 144, 152, 152, 152, 152, 19, 221, 144, 113, 152, 152, 152, 152, 19, 125, 197, 90, 148, 152 }
ȷڴ溯ַָ  ȡֽڼָ_asm (ȷڴ溯)
'  (ȷڴ溯)

' ' Ϣ (ʮʮ (װSEHַָ)  #з  ʮʮ (ɾSEHַָ)  #з  ʮʮ (SEHӿַָ)  #з  ʮʮ (ȷڴ溯ַָ), 0, , )
' ////////////////////////////////////////////////////////////////////////////////


ǷѴ  

' ָ  1 (ȡֽڼָ (ڴ澫ȷҺ), 8)
' Ϣ (1, 0, , )

. (жģ  )

     (0)
.
' _Xor (NtQueryVirtualMemoryַ, NtQueryVirtualMemoryַXor)
' fVirtualQueryExָ
' call_ڴ (_Xor (NtQueryVirtualMemoryַ, NtQueryVirtualMemoryַXor), -1, ڴַ, 0, ڴϢָ, ڴ鳤, ȡָ (ڴ鳤))
.жѭ (call_ڴ (fVirtualQueryExָ, -1, ڴַ, 0, ڴϢָ, ڴ鳤, ȡָ (ڴ鳤))  0)

    ' Ϣ (2, 0, , )
    ' 77E4C520
    . (жģ  )

         (0)
    .


    ̴߳ʱ  ADD__ (̴߳ʱ, 1)
    ' 00460F0C      8B45 F4       mov eax,dword ptr ss:[ebp-0xC]
    ' 00460F0F      83C0 20       add eax,0x14
    ' 00460F12      8B00          mov eax,dword ptr ds:[eax]
    ' 00460F14      8945 EC       mov dword ptr ss:[ebp-0x14],eax
    '  ({ 139, 69, 244, 131, 192, 14, 139, 0, 137, 69, 236 })
    ' ǰڴ  ָ뵽 (ڴϢָ  20)

    ' eip  GetEIP ()
    ' Ϣ (ʮʮ (eip)  #з  ʮʮ (ȡָ (ǰ)), 0, , )
    '  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })
    ' _asm{

    ' mov edx,ڴϢָ

    ' mov ecx,[edx]
    ' mov ַ,ecx

    ' mov ecx,[edx+0x4]
    ' mov ַ,ecx

    ' mov ecx,[edx+0x8]
    ' mov ʼ,ecx

    ' mov ecx,[edx+0xc]
    ' mov 򳤶,ecx

    ' mov ecx,[edx+0x10]
    ' mov ҳ״̬,ecx

    ' mov ecx,[edx+0x14]
    ' mov ǰ,ecx

    ' mov ecx,[edx+0x18]
    ' mov ҳ,ecx

    ' }
    ' ַ  _ָ뵽_ڴ (ڴϢָ)

    ' ַ  _ָ뵽_ڴ (ADD__ (ڴϢָ, 4))

    ' ʼ  _ָ뵽_ڴ (ADD__ (ڴϢָ, 8))

    ' 򳤶  _ָ뵽_ڴ (ADD__ (ڴϢָ, 12))

    ' ҳ״̬  _ָ뵽_ڴ (ADD__ (ڴϢָ, 16))

    ' ǰ  _ָ뵽_ڴ (ADD__ (ڴϢָ, 12))

    ' ҳ  _ָ뵽_ڴ (ADD__ (ڴϢָ, 24))

    ' ԭʼ  ǰ


    . (ǰ  0  򳤶  65536  ǰ  1  򳤶  65536  ǰ  2)

        ǰ  SendMessageA (½ھ, 778, ǰID, ڴַ)


        ' Ϣ (ǰ:  ı (ǰ), 0, , )

    .
    ' _д־ (ַ:  ʮʮ (ַ)   򳤶:  ʮʮ (򳤶)   ǰ:  ı (ǰ)   addr:  ʮʮ (_ȡӳʵַ (&ڴ澫ȷ_1)))

    ' _д־ (ַ:  ʮʮ (ַ)   򳤶:  ʮʮ (򳤶)   ǰ:  ı (ǰ)   ԭʼ:  ı (_ָ뵽_ڴ (ADD__ (ڴϢָ, 20))))

    ' Ϣ (, 0, , )

    ' ǰ  call_SendMessageTimeoutA (SendMessageTimeoutAַ, ½ھ, 778, ǰID, ڴַ, 1, 2000, result)

    .'  (ַ  201064448)
        ' _д־ (ָ:  ʮʮ (fVirtualQueryExָ))

        ' Ϣ (ʮʮ (ڴϢָ), 0, , )

    .


    .'  (Ƿ  )

        .'  (ǰ  32  ǰ  64)

            ' Protect  
        .

        .

    .
        ' ' Protect  ǰ  2  ǰ  512  ǰ  128  ǰ  16
        ' Protect  4096  ҳ״̬  ǰ  1
    .
    ' ǰ  32 
    .'  (ں˴СУ  )

        .'  (ַ  4194304)

            ' ǰںִжδС  _Xor (򳤶, 2574336)

            .'  (ںִжδС  0)

                .'  (_Xor (ǰںִжδС, ںִжδС)  0)

                    ' յGOMFZ  
                .

            .
            ' ' _д־ (δXOR:  ʮʮ (򳤶)   XOr:  ʮʮ (ǰںִжδС)   :  ʮʮ (ںִжδС))

        .

    .


    . (յGOMFZ  )

        . (ǰ  64  򳤶  1638400)

            GOMFZ  ADD__ (GOMFZ, 1)
        .

    .

    . (жģ  )

        ѭ ()
    .

    . (һַ  ַ)
        Ϣ (code=577567, 0, , )
        յGOMFZ  
    .

    һַ  ַ

    . (жģ  )

        ѭ ()
    .
    ' дй켣 (27001)

    . (ǰ  4  򳤶  999  򳤶  4080192)  ' (ǰ  4  򳤶  1306624  򳤶  4080192)   򳤶  1000  򳤶  8000  ǰ  64
        ' ' дй켣 (27002)
        ' _д־ (ַ:  ʮʮ (ַ)   򳤶:  ʮʮ (򳤶)   ǰ:  ı (ǰ)    :  ı (ڴ))

        .ƴѭ (ȡԱ (ڴַ), a2)
            ' дй켣 (27003)
            ' ʼַ  ڴ澫ȷ_1 (ַ, 򳤶, ڴַ [a2])
            '  (ȷڴ溯)
            '  (SEHӿ)
            '  (ɾSEH)
            '  (װSEH)
            ' ////////////////////////////////////////////////////////////////////////////////
            ' eip  GetEIP ()

            ' Ϣ (ʮʮ (eip)  #з  ʮʮ (װSEHַָ), 0, , )

            '  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })
            ' 
            ' *** Գ ***
            ' ////////////////////////////////////////////////////////////
            ' _asm{
            ' ;edx ݿʼַ
            ' mov edx,װSEHַָ
            ' ;ecx ݳ
            ' mov ecx,[edx-4]
            ' mov ebx,0x0
            ' for1:
            ' cmp ebx,ecx
            ' je exit

            ' mov al,byte[edx]
            ' mov ah,152
            ' xor al,ah
            ' mov byte[edx],al

            ' add edx,0x1
            ' add ebx,0x1
            ' jmp for1
            ' exit:
            ' }end

            ' ////////////////////////////////////////////////////////////
            ' _asm{
            ' ;edx ݿʼַ
            ' mov edx,ɾSEHַָ
            ' ;ecx ݳ
            ' mov ecx,[edx-4]
            ' mov ebx,0x0
            ' for1:
            ' cmp ebx,ecx
            ' je exit

            ' mov al,byte[edx]
            ' mov ah,152
            ' xor al,ah
            ' mov byte[edx],al

            ' add edx,0x1
            ' add ebx,0x1
            ' jmp for1
            ' exit:
            ' }end

            ' ////////////////////////////////////////////////////////////
            ' _asm{
            ' ;edx ݿʼַ
            ' mov edx,SEHӿַָ
            ' ;ecx ݳ
            ' mov ecx,[edx-4]
            ' mov ebx,0x0
            ' for1:
            ' cmp ebx,ecx
            ' je exit

            ' mov al,byte[edx]
            ' mov ah,152
            ' xor al,ah
            ' mov byte[edx],al

            ' add edx,0x1
            ' add ebx,0x1
            ' jmp for1
            ' exit:
            ' }end

            ' ////////////////////////////////////////////////////////////
            ' _asm{
            ' ;edx ݿʼַ
            ' mov edx,ȷڴ溯ַָ
            ' ;ecx ݳ
            ' mov ecx,[edx-4]
            ' mov ebx,0x0
            ' for1:
            ' cmp ebx,ecx
            ' je exit

            ' mov al,byte[edx]
            ' mov ah,152
            ' xor al,ah
            ' mov byte[edx],al

            ' add edx,0x1
            ' add ebx,0x1
            ' jmp for1
            ' exit:
            ' }end

            ' _ (1 (װSEHַָ, 8), 152)
            ' ' Ϣ (ʮʮ (ɾSEHַָ), 0, , )

            ' _ (1 (ɾSEHַָ, 8), 152)
            ' ' Ϣ (~, 0, , )

            ' _ (1 (SEHӿַָ, 8), 152)

            ' _ (1 (ȷڴ溯ַָ, 8), 152)

            . (ǷѴ  )

                ' _asm{
                ' mov edx,ȷڴ溯ַָ
                ' add edx,21
                ' mov ԭַ,edx
                ' add edx,1

                ' mov ebx,װSEHַָ
                ' sub ebx,ԭַ
                ' sub ebx,5
                ' mov [edx],ebx

                ' mov edx,ȷڴ溯ַָ
                ' add edx,108
                ' mov ԭַ,edx
                ' add edx,1

                ' mov ebx,ɾSEHַָ
                ' sub ebx,ԭַ
                ' sub ebx,5
                ' mov [edx],ebx

                ' mov edx,װSEHַָ
                ' add edx,6
                ' mov ebx,SEHӿַָ
                ' mov [edx],ebx

                ' mov edx,ɾSEHַָ
                ' add edx,6
                ' mov ebx,SEHӿַָ
                ' mov [edx],ebx
                ' }

                ' ԭַ  ADD__ (ȷڴ溯ַָ, 21)

                ' WriteDword (ADD__ (ԭַ, 1), 1 (1 (װSEHַָ, ԭַ), 5))

                ' ԭַ  ADD__ (ȷڴ溯ַָ, 108)

                ' WriteDword (ADD__ (ԭַ, 1), 1 (1 (ɾSEHַָ, ԭַ), 5))

                ' WriteDword (ADD__ (װSEHַָ, 6), SEHӿַָ)

                ' WriteDword (ADD__ (ɾSEHַָ, 6), SEHӿַָ)

                ǷѴ  
            .
            ' ////////////////////////////////////////////////////////////////////////////////

            . (a2  1)
                ҳ״̬  ڴַ [a2]
                ' eip  GetEIP ()
                ' Ϣ (ʮʮ (eip), 0, , )
                '  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })

                ' _asm{
                ' ;edx ݿʼַ
                ' mov edx,ҳ״̬
                ' add edx,8
                ' ;ecx ݳ
                ' mov ecx,[edx-4]
                ' mov ebx,0x0
                ' for2:
                ' cmp ebx,ecx
                ' je exit2

                ' mov al,byte[edx]
                ' mov ah,152
                ' xor al,ah
                ' mov byte[edx],al

                ' add edx,0x1
                ' add ebx,0x1
                ' jmp for2
                ' exit2:
                ' }end

            .

            ' Ϣ (2:  ʮʮ (ҳ״̬), 0, , )

            ' Ϣ (ʮʮ (װSEHַָ)  #з  ʮʮ (ɾSEHַָ)  #з  ʮʮ (SEHӿַָ)  #з  ʮʮ (ȷڴ溯ַָ), 0, , )

            ' _ (ڴַ [a2], 152)
            '  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })

            ' eip  GetEIP ()
            ' Ϣ (ʮʮ (eip), 0, , )
            '  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })


            ҳ  ڴַ [a2]
            ' _asm{
            ' push ҳ
            ' push 򳤶
            ' push ַ
            ' call ȷڴ溯ַָ
            ' mov ʼַ,eax
            ' }
            '  ({ 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144, 144 })

            ' ʼַ  _call_ڴ澫ȷ (ȷڴ溯ַָ, ַ, 򳤶, ڴַ [a2])

            ' ʼַ  ڴ澫ȷ_1 (ַ, 򳤶, ڴַ [a2])

            ' Ϣ (3, 0, , )

            ' _ (ڴַ [a2], 152)

            '  (ȷڴ溯)
            '  (SEHӿ)
            '  (ɾSEH)
            '  (װSEH)
            ' ////////////////////////////////////////////////////////////////////////////////
            ' 
            ' *** Գ ***
            ' ////////////////////////////////////////////////////////////
            ' _asm{
            ' ;edx ݿʼַ
            ' mov edx,װSEHַָ
            ' ;ecx ݳ
            ' mov ecx,[edx-4]
            ' mov ebx,0x0
            ' for1:
            ' cmp ebx,ecx
            ' je exit

            ' mov al,byte[edx]
            ' mov ah,152
            ' xor al,ah
            ' mov byte[edx],al

            ' add edx,0x1
            ' add ebx,0x1
            ' jmp for1
            ' exit:
            ' }end

            ' ////////////////////////////////////////////////////////////
            ' _asm{
            ' ;edx ݿʼַ
            ' mov edx,ɾSEHַָ
            ' ;ecx ݳ
            ' mov ecx,[edx-4]
            ' mov ebx,0x0
            ' for1:
            ' cmp ebx,ecx
            ' je exit

            ' mov al,byte[edx]
            ' mov ah,152
            ' xor al,ah
            ' mov byte[edx],al

            ' add edx,0x1
            ' add ebx,0x1
            ' jmp for1
            ' exit:
            ' }end

            ' ////////////////////////////////////////////////////////////
            ' _asm{
            ' ;edx ݿʼַ
            ' mov edx,SEHӿַָ
            ' ;ecx ݳ
            ' mov ecx,[edx-4]
            ' mov ebx,0x0
            ' for1:
            ' cmp ebx,ecx
            ' je exit

            ' mov al,byte[edx]
            ' mov ah,152
            ' xor al,ah
            ' mov byte[edx],al

            ' add edx,0x1
            ' add ebx,0x1
            ' jmp for1
            ' exit:
            ' }end

            ' ////////////////////////////////////////////////////////////
            ' _asm{
            ' ;edx ݿʼַ
            ' mov edx,ȷڴ溯ַָ
            ' ;ecx ݳ
            ' mov ecx,[edx-4]
            ' mov ebx,0x0
            ' for1:
            ' cmp ebx,ecx
            ' je exit

            ' mov al,byte[edx]
            ' mov ah,152
            ' xor al,ah
            ' mov byte[edx],al

            ' add edx,0x1
            ' add ebx,0x1
            ' jmp for1
            ' exit:
            ' }end

            ' _ (1 (װSEHַָ, 8), 152)
            ' ' Ϣ (ʮʮ (ɾSEHַָ), 0, , )

            ' _ (1 (ɾSEHַָ, 8), 152)
            ' ' Ϣ (~, 0, , )

            ' _ (1 (SEHӿַָ, 8), 152)

            ' _ (1 (ȷڴ溯ַָ, 8), 152)
            ' ////////////////////////////////////////////////////////////////////////////////

            дй켣 (27004)
            . (ʼַ  0  򳤶  5000)
                дй켣 (27005)
                ' дй켣 (27006)

                ' Ϣ (4, 0, , )
                ' _asm{

                ' mov eax,ַ
                ' add eax,򳤶
                ' mov ҳ,eax
                ' }
                ' Ϣ (5, 0, , )

                . (ʼַ  ҳ)  ' ٱã
                    дй켣 (27007)
                    ' дй켣 (27008)
                    . (a2  2)

                        ҳ  ڴַ [a2]
                        ' _asm{
                        ' mov eax,ҳ
                        ' add eax,8
                        ' mov ҳ,eax
                        ' }
                        . (ʼַ  ҳ)  ' ٱãλ

                            ' ʼַ  ADD__ (ʼַ, 7)
                            ' _asm{
                            ' mov eax,ʼַ
                            ' add eax,7
                            ' mov eax,[eax]
                            ' mov ,eax
                            ' }

                            '   _ָ뵽 (ʼַ)
                            ' _д־ (ַ:  ʮʮ (ַ)   ʼַ:  ʮʮ (ʼַ)   :  ı ())

                            . (  538980654)
                                Ϣ (code=16543132421, 0, , )
                                ־ (161)

                                Ա (, ʼַ)

                                 (ȡԱ ())
                            .


                        .

                    .
                    . (a2  1)
                        ' Ϣ (5, 0, , )

                        ' ' _asm{
                        ' ' mov eax,ʼַ
                        ' ' add eax,6
                        ' ' mov eax,[eax]
                        ' ' mov ,eax
                        ' ' }
                        ' ' Ϣ (6, 0, , )

                        ' _д־ (ַ:  ʮʮ (ַ)   ʼַ:  ʮʮ (ʼַ)   :  ı ())

                        ' ' Ϣ (7, 0, , )

                        ҳ  ڴַ [a2]

                        ' _asm{
                        ' mov eax,ҳ
                        ' add eax,8
                        ' mov ҳ,eax
                        ' }

                        . (ʼַ  ҳ)

                            дй켣 (27010)

                            ' _asm{
                            ' mov eax,ʼַ
                            ' add eax,6
                            ' mov eax,[eax]
                            ' mov ,eax
                            ' }

                            '   _ָ뵽 (ʼַ)

                            дй켣 (27011)

                            ' дļ (ȡضĿ¼ (3)  \213-  ı (a2)  .txt, ֽڼ (ʮʮ (ʼַ)       ı (a2)     ʮʮ (ڴַ [a2])     ı ()))
                            ' _д־ (ַ:  ʮʮ (ַ)   ʼַ:  ʮʮ (ʼַ)   :  ı ())

                            . (  1931829102)
                                ' _д־ (ַ:  ʮʮ (ַ)   ʼַ:  ʮʮ (ʼַ)   :  ı ())
                                Ϣ (code=32135543, 0, , )
                                ־ (162)
                                Ա (, ʼַ)

                                 (ȡԱ ())
                            .


                        .



                    .


                    ' дй켣 (27009)

                .


            .

            . (a2  1)
                ҳ״̬  ڴַ [a2]
                ' _asm{
                ' ;edx ݿʼַ
                ' mov edx,ҳ״̬
                ' add edx,8
                ' ;ecx ݳ
                ' mov ecx,[edx-4]
                ' mov ebx,0x0
                ' for3:
                ' cmp ebx,ecx
                ' je exit3

                ' mov al,byte[edx]
                ' mov ah,152
                ' xor al,ah
                ' mov byte[edx],al

                ' add edx,0x1
                ' add ebx,0x1
                ' jmp for3
                ' exit3:
                ' }end
            .

            ' дй켣 (270010)
        .ƴѭβ ()
        ' дй켣 (270011)
    .

    дй켣 (27012)

    . (ǰ  64  򳤶  1306624  򳤶  4080192)  '  򳤶  1000  򳤶  8000  ǰ  64

        ̴߳ʱ  ADD__ (̴߳ʱ, 1)

        ' _д־ (ַ:  ʮʮ ( (&ڴ澫ȷ_1))   ַ:  ʮʮ (ַ)   򳤶:  ʮʮ (򳤶)   ǰ:  ı (ǰ))

        .ƴѭ (ȡԱ (ڴַ), a2)

            . (жģ  )

                ѭ ()
            .

            .'  (ַ  صַ  a2  2)
                ' Ϣ (ַ:  ʮʮ (ַ)  #з  򳤶:  ʮʮ (򳤶), 0, , )

            .


            ' _ (ָ, 241)

            ' ʼַ  _call_ڴ澫ȷ (ADD__ (ָ, 8), ַ, 򳤶, ڴַ [a2])

            ' _ (ָ, 241)

            . (a2  1)
                ҳ״̬  ڴַ [a2]
                ' _asm{
                ' ;edx ݿʼַ
                ' mov edx,ҳ״̬
                ' add edx,8
                ' ;ecx ݳ
                ' mov ecx,[edx-4]
                ' mov ebx,0x0
                ' for4:
                ' cmp ebx,ecx
                ' je exit4

                ' mov al,byte[edx]
                ' mov ah,152
                ' xor al,ah
                ' mov byte[edx],al

                ' add edx,0x1
                ' add ebx,0x1
                ' jmp for4
                ' exit4:
                ' }end
            .


            . (жģ  )

                 (0)
            .
            ' _ (ڴַ [a2], 152)
            дй켣 (27012)

            ʼַ  ڴ澫ȷ_1 (ַ, 򳤶, ڴַ [a2])
            дй켣 (27013)


            . (a2  1)
                ҳ״̬  ڴַ [a2]
                ' _asm{
                ' ;edx ݿʼַ
                ' mov edx,ҳ״̬
                ' add edx,8
                ' ;ecx ݳ
                ' mov ecx,[edx-4]
                ' mov ebx,0x0
                ' for5:
                ' cmp ebx,ecx
                ' je exit5

                ' mov al,byte[edx]
                ' mov ah,152
                ' xor al,ah
                ' mov byte[edx],al

                ' add edx,0x1
                ' add ebx,0x1
                ' jmp for5
                ' exit5:
                ' }end
            .

            ' _ (ڴַ [a2], 152)

            .'  (ַ  صַ  a2  2)

                ' Ϣ (ʼַ:  ı (ʼַ), 0, , )

            .

            . (жģ  )

                ѭ ()
            .

            ̴߳ʱ  ADD__ (̴߳ʱ, 1)

            .'  (򳤶  3145728)
                ' _д־ (ַ:  ʮʮ (ַ)   򳤶:  ʮʮ (򳤶)   ǰ:  ı (ǰ)   ʼַ:  ʮʮ (ʼַ)   :  ֽڼʮ (ڴ2,  ))
            .

            . (ʼַ  0)

                ' _д־ (ҵ:  ʮʮ (ʼַ)      ʮʮ (ADD__ (ڴַ [a2], 8)))

                . (ʼַ  ADD__ (ڴַ [a2], 8))

                    Ϣ (code=156112  #з  ʮʮ (ڴַ [a2])  #з  ı (a2), 0, , )

                    񵶼¼־ (471, a2, , )

                    Ա (, ʼַ)

                    ѭ ()
                    ' _д־ (뵽:  ı (ȡԱ ()))

                .
                ' _д־ (ַ:  ʮʮ (ַ)   򳤶:  ʮʮ (򳤶)   ǰ:  ı (ǰ)   ۼƴ:  ı (ۼƴ)   ҵ...)

                ' _д־ (ǰ:  ı (ǰ)   ҳ״̬:  ı (ҳ״̬)   ʼַ:  ʮʮ (ʼַ))

            .

                ' _д־ (ַ:  ʮʮ (ַ)   򳤶:  ʮʮ (򳤶)   ǰ:  ı (ǰ)   ۼƴ:  ı (ۼƴ))

            .
            ̴߳ʱ  ADD__ (̴߳ʱ, 1)

            _call_Sleep (sleepַ, 100)

        .ƴѭβ ()

        ۼƴ  ۼƴ  1


        ' _call_Sleep (sleepַ, 10)

        ̴߳ʱ  ADD__ (̴߳ʱ, 1)

        . (жģ  )

            ѭ ()
        .

    .

    ڴַ  ADD__ (ڴַ, 򳤶)

    ' _call_Sleep (sleepַ, 1)

    ̴߳ʱ  ADD__ (̴߳ʱ, 1)
.жѭβ ()

'  (װSEH)
'  (ɾSEH)
'  (SEHӿ)
'  (ȷڴ溯)

. (յGOMFZ  )

    . (GOMFZ  10)
        񵶼¼־ (3, 10, , )
        յGOMFZ  
    .

.

' _д־ (:  ı (ȡԱ ()))
' _д־ (----------------------------------------------------------------------------------)
̴߳ʱ  ADD__ (̴߳ʱ, 1)
 (ȡԱ ())

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ _call_ڴ澫ȷ, 
. ַ, 
. һ, 
. , 
. , 


 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

 ({ 201, 88, 135, 4, 36, 255, 224 })

 (0)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

.ӳ _ָ뵽_ڴ, 
. ָ, 
.ֲ _begin68, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin68  0
 ({ 139, 69, 8, 139, 0, 201, 194, 4, 0 })

 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

.ӳ call_ڴ, 
. ַ, 
. һ, 
. , 
. , 
. , 
. , 
. , 
.ֲ _begin69, 


 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin69  0
 ({ 201, 88, 135, 4, 36, 255, 224 })
 (0)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ڴ_ܼAPI
. , ֽڼ
. xor, 
.ֲ _begin70, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
' 00401449  |.  8B55 08       mov edx,[arg.1]
' 0040144C  |.  8B12          mov edx,dword ptr ds:[edx]
' 0040144E  |.  83C2 08       add edx,0x8
 ({ 139, 85, 8, 139, 18, 131, 194, 8 })  ' ҪܶݷŵEDX...

_begin70  0

.ƴѭ (50, )
    ' 00401468      8A02          |mov al,byte ptr ds:[edx]
    ' 0040146A      8A65 0C       mov ah,byte ptr ss:[ebp+0xC]
    ' 0040146D      32C4          |xor al,ah
    ' 0040146F      8802          |mov byte ptr ds:[edx],al
    ' 00401471      83C2 01       |add edx,0x1
     ({ 138, 2, 138, 101, 12, 50, 196, 136, 2, 131, 194, 1 })

.ƴѭβ ()

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ڴ_ܼAPI
. ԭʼݵַ, ֽڼ
. ַ, 
. XOR, 
. , 
.ֲ _begin71, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
' 00401449  |.  8B55 08       mov edx,[arg.1]
' 0040144C  |.  8B12          mov edx,dword ptr ds:[edx]
' 0040144E  |.  83C2 08       add edx,0x8
 ({ 139, 85, 8, 139, 18, 131, 194, 8 })  ' ԭʼݵָ붪EDX
' 00401451      8B55 0C       mov edx,dword ptr ss:[ebp+0xC]
' 00401454      8B1B          mov ebx,dword ptr ds:[ebx]
' 00401456      83C3 08       add ebx,0x8 ָ롣
 ({ 139, 93, 12 })  ' ѽܻŵEBX
'  ({ 139, 93, 12, 139, 27, 131, 195, 8 })  ' ѽܻŵEBX
_begin71  0
.ƴѭ (, )
    ' 004BF012    8A02            mov al,byte ptr ds:[edx]
    ' 004BF014    8A65 10         mov ah,byte ptr ss:[ebp+0x10]
    ' 004BF017    32C4            xor al,ah
    ' 004BF019    8803            mov byte ptr ds:[ebx],al
    ' 004BF01B    83C2 01         add edx,0x1
    ' 004BF01E    83C3 01         add ebx,0x1
     ({ 138, 2, 138, 101, 16, 50, 196, 136, 3, 131, 194, 1, 131, 195, 1 })
.ƴѭβ ()
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ڴ_ָ뵽ֽڼ
. ַ, 
. , 
. , ֽڼ
.ֲ _begin72, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
' 004013FF      8B55 08       mov edx,dword ptr ss:[ebp+0x8]
' 00401402      8B5D 10       mov ebx,dword ptr ss:[ebp+0x10]
' 00401405      8B1B          mov ebx,dword ptr ds:[ebx]
' 00401407      83C3 08       add ebx,0x8
 ({ 139, 85, 8, 139, 93, 16, 139, 27, 131, 195, 8 })
_begin72  0
.ƴѭ (, )
    ' 0040140E      50            push eax
    ' 0040140F      8A02          mov al,byte ptr ds:[edx]
    ' 00401411      8803          mov byte ptr ds:[ebx],al
    ' 00401413      83C2 01       add edx,0x1
    ' 00401416      83C3 01       add ebx,0x1
    ' 00401419      58            pop eax
     ({ 80, 138, 2, 136, 3, 131, 194, 1, 131, 195, 1, 88 })
.ƴѭβ ()
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ 񵶼¼־
. code, 
. , , ɿ
. Ӳ, , ɿ
. Ӳ2, , ɿ

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
' _call_Sleep (sleepַ, 50)
' дļ (ȡĿ¼ ()  \data\Code  ı (code)  .txt, ֽڼ (ı (ȡʱ ())  #з  ı (code)  #з  ı ()  #з  ı (Ӳ)  #з  ı (Ӳ2)))
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ڴ澫ȷ_1, , , ʧܷ0,ɹڴַ
. ڴַ, 
. ڴ泤, 
. , , , ڴַ
.ֲ _begin73, 

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

. (SEH_װSEH ())
    ' 00401095    60                   pushad                                             ; ݼĴ
    ' 00401096    9C                   pushfd                                             ; ݱ־λ
    ' 00401097    FC                   cld                                                ; ˳
    ' 00401099    8B5D 10              mov     ebx, dword ptr [ebp+10]                    ; 3 ֽڼ
    ' 0040109C    8B1B                 mov     ebx, dword ptr [ebx]                       ; ֽڼַ
    ' 0040109E    83C3 08              add     ebx, 8                                     ; ֽڼָ
    ' 004010A1    0FB603               movzx   eax, byte ptr [ebx]                        ; ֽڼ
    ' 004010A4    8B4B FC              mov     ecx, dword ptr [ebx-4]                     ; ֽڳ
    ' 004010A7    294D 0C              sub     dword ptr [ebp+C], ecx                     ; ҳ
    ' 004010AA    90                   nop
    ' 004010AB    8B7D 08              mov     edi, dword ptr [ebp+8]                     ; ҵַ
    ' 004010AE    8B4D 0C              mov     ecx, dword ptr [ebp+C]                     ; ҳ
    ' 004010B1    83F9 00              cmp     ecx, 0                                     ;  >0?
    ' 004010B4    7E 1E                jle      short 004010D4                            ; С  
    ' 004010B6    F2:AE                repne   scas byte ptr es:[edi]                     ; ֽ
    ' 004010B8    75 1A                jnz     short 004010D4                             ; ޷  
    ' 004010BA    897D 08              mov     dword ptr [ebp+8], edi                     ; ַ
    ' 004010BD    894D 0C              mov     dword ptr [ebp+C], ecx                     ; 泤
    ' 004010C0    4F                   dec     edi                                        ; ݼַ
    ' 004010C1    8BF3                 mov     esi, ebx                                   ; ֽڼָ
    ' 004010C3    8B4E FC              mov     ecx, dword ptr [esi-4]                     ; ֽڼ
    ' 004010C6    F3:A6                repe    cmps byte ptr es:[edi], byte ptr [esi]     ; 
    ' 004010C8  ^ 75 E1                jnz     short 004010AB                             ;   
    ' 004010CA    FF4D 08              dec     dword ptr [ebp+8]                          ; ݼַ
    ' 004010CD    C745 0C FDFFFFFF     mov     dword ptr [ebp+C], -3                      ; óɹ
    ' 004010D4    9D                   popfd                                              ; ָ־λ
    ' 004010D5    61                   popad                                              ; ָĴ
    ' 60 9C FC 8B 5D 10 8B 1B 83 C3 08 0F B6 03 8B 4B FC 29 4D 0C 90 8B 7D 08 8B 4D 0C 83 F9 00 7E 1E
    ' F2 AE 75 1A 89 7D 08 89 4D 0C 4F 8B F3 8B 4E FC F3 A6 75 E1 FF 4D 08 C7 45 0C FD FF FF FF 9D 61
     ({ 96, 156, 252, 139, 93, 16, 131, 195, 8, 15, 182, 3, 139, 75, 252, 41, 77, 12, 144, 139, 125, 8, 139, 77, 12, 131, 249, 0, 126, 30, 242, 174, 117, 26, 137, 125, 8, 137, 77, 12, 79, 139, 243, 139, 78, 252, 243, 166, 117, 225, 255, 77, 8, 199, 69, 12, 253, 255, 255, 255, 157, 97 })


.
SEH_ɾSEH ()

. (-3  ڴ泤)
    ڴַ  0
.
 (ڴַ)
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־



.ӳ SEH_װSEH, ߼, , (SEH_SEH())   Ժ SEH_ɾSEH()
. , ӳָ, ɿ

  &SEH_SEHӿ
' 0042866B    8B45 08               mov     eax, dword ptr [ebp+8]           ; EAX=SEHӿ
' 0042866E    C9                    leave                                    ; ƽջ
' 0042866F    83EC 60               sub     esp, 60                          ; 븡Ĵ
' 00428672    9C                    pushfd                                   ; ־Ĵ
' 00428673    60                    pushad                                   ; ͨüĴ
' 00428674    FFB424 84000000       push    dword ptr [esp+84]               ; 氲װ
' 0042867B    6A 00                 push    0                                ; ûӿ
' 0042867D    50                    push    eax                              ; SEH_ӿ
' 0042867E    DD7424 30             fsave   (108-byte) ptr [esp+30]          ; ݸĴ
' 77EC2FD4    9B                    wait
' 00428682    64:FF35 00000000      push    dword ptr fs:[0]                 ;  ԭSEHջ
' 00428689    64:8925 00000000      mov     dword ptr fs:[0], esp            ;  SEHջ
' 00428690    B8 01000000           mov     eax, 1                           ; EAX=1=װɹ
' 00428695    FF6424 0C             jmp     dword ptr [esp+C]                ; װ SEH 
' 8B 45 08 C9 83 EC 60 9C 60 FF B4 24 84 00 00 00 6A 00 50 DD 74 24 30 9B 64 FF 35 00 00 00 00 64 89
' 25 00 00 00 00 B8 01 00 00 00 FF 64 24 0C
 ({ 139, 69, 8, 201, 131, 236, 96, 156, 96, 255, 180, 36, 132, 0, 0, 0, 106, 0, 80, 221, 116, 36, 48, 155, 100, 255, 53, 0, 0, 0, 0, 100, 137, 37, 0, 0, 0, 0, 184, 1, 0, 0, 0, 255, 100, 36, 12 })
 ()

.ӳ SEH_ɾSEH, , ,  SEH_װSEH() ʹ
. , ӳָ, ɿ

  &SEH_SEHӿ
' 00401106    51                    push    ecx                              ;  Ĵ
' 00401107    64:8B0D 00000000      mov     ecx, dword ptr fs:[0]            ; ָ쳣ջ
' 0040110E    81F9 FFFF0000         cmp     ecx, 0FFFF                       ; ǷЧջַ
' 00401114    7E 2A                 jle     short 0040113F                   ; Чջַ 
' 00401116    8B41 04               mov     eax, dword ptr [ecx+4]           ; ȡ쳣ӿ
' 00401119    3B45 08               cmp     eax, dword ptr [ebp+8]           ; ж쳣ӿ
' 0040111C    74 04                 je      short 00401122                   ; 򵥽ӿ 
' 0040111E    8B09                  mov     ecx, dword ptr [ecx]             ; ¸쳣ջָ
' 00401120  ^ EB EC                 jmp     short 0040110E                   ; ѭж
' 00401122    8B45 04               mov     eax, dword ptr [ebp+4]           ; EAX=صַ
' 00401125    8BE1                  mov     esp, ecx                         ; ESP=SEHջ
' 00401127    64:8F05 00000000      pop     dword ptr fs:[0]                 ; ָϲSEHջ
' 0040112E    83C4 0C               add     esp, 0C                          ; ESP  ָ򱸷
' 00401131    894424 1C             mov     dword ptr [esp+1C], eax          ; 淵صַ
' 00401135    61                    popad                                    ; ָͨüĴ
' 00401136    9D                    popfd                                    ; ָ־Ĵ
' 00401137    DD2424                frstor  (108-byte) ptr [esp]             ; ָĴ
' 77EC2FD4    9B                    wait
' 0040113A    83C4 6C               add     esp, 6C                          ; ջ
' 0040113D  ^ FFE0                  jmp     eax                              ; Ҫη
' 0040113F    59                    pop     ecx                              ; ָ Ĵ
' 00401140    90                    nop                                      ; ޷Ͻӿ 
' 51 64 8B 0D 00 00 00 00 81 F9 FF FF 00 00 7E 2A 8B 41 04 3B 45 08 74 04 8B 09 EB EC 8B 45 04 8B
' E1 64 8F 05 00 00 00 00 83 C4 0C 89 44 24 1C 61 9D DD 24 24 9B 83 C4 6C FF E0 59 90

 ({ 81, 100, 139, 13, 0, 0, 0, 0, 129, 249, 255, 255, 0, 0, 126, 42, 139, 65, 4, 59, 69, 8, 116, 4, 139, 9, 235, 236, 139, 69, 4, 139, 225, 100, 143, 5, 0, 0, 0, 0, 131, 196, 12, 137, 68, 36, 28, 97, 157, 221, 36, 36, 155, 131, 196, 108, 255, 224, 89, 144 })

.ӳ SEH_SEHӿ, , , ӳ  (SEH_װSEH(&SEH_SEH򵥴))  ʹ
. 쳣, 
. ջṹ, 
. ̻߳, 
. Ȼ, , , DispatcherContext

' 00401095    8B45 08                mov     eax, dword ptr [ebp+8]           ; ӿ 1 쳣ṹ
' 00401098    8138 250000C0          cmp     dword ptr [eax], C0000025        ; ɴ쳣?
' 0040109E    74 45                  je      short 004010E5                   ; ɴ  
' 004010A0    8378 04 00             cmp     dword ptr [eax+4], 0             ; ɴ쳣?
' 004010A4    75 3F                  jnz     short 004010E5                   ; ɴ 
' 004010A6    E8 00000000            call    004010AB                         ; 2δƫ
' 004010AB    58                     pop     eax                              ; 2δƫ
' 004010AC    83C0 06                add     eax, 6                           ; 2δƫ
' 004010AF    EB 1C                  jmp     short 004010CD                   ; ת1δ
' 004010B1    64:8925 00000000       mov     dword ptr fs:[0], esp            ; 2δ
' 004010B8    83C4 10                add     esp, 10                          ; 2δ
' 004010BB    61                     popad                                    ; 2δ
' 004010BC    9D                     popfd                                    ; 2δ
' 004010BD    DD2424                 frstor  (108-byte) ptr [esp]             ; 2δ
' 77EC2FD4    9B                     wait
' 004010C0    64:8B25 00000000       mov     esp, dword ptr fs:[0]            ; 2δ
' 004010C7    33C0                   xor     eax, eax                         ; 2δ  װ
' 004010C9    FF6424 0C              jmp     dword ptr [esp+C]                ; 2δɷ
' 004010CD    51                     push    ecx                              ; 1δ ECX
' 004010CE    8B4D 10                mov     ecx, dword ptr [ebp+10]          ; ӿ 3 ̻߳
' 004010D1    8981 B8000000          mov     dword ptr [ecx+B8], eax          ; EIP = 2δ
' 004010D7    8B45 0C                mov     eax, dword ptr [ebp+C]           ; ӿ 2 쳣ջ
' 004010DA    8981 C4000000          mov     dword ptr [ecx+C4], eax          ; ESP =쳣ջ
' 004010E0    59                     pop     ecx                              ; 1δ ָECX
' 004010E1    33C0                   xor     eax, eax                         ; EAX=0 쳣Ѵ
' 004010E3    EB 05                  jmp     short 004010EA                   ;   
' 004010E5    B8 01000000            mov     eax, 1                           ; EAX=1 쳣δ
' 77682FDA    8945 08                mov     dword ptr [ebp+8], eax           ; 淵ֵ

' 8B 45 08 81 38 25 00 00 C0 74 46 83 78 04 00 75 40 E8 00 00 00 00 58 83 C0 06 EB 1D 64 89 25 00
' 00 00 00 83 C4 10 61 9D DD 24 24 9B 64 8B 25 00 00 00 00 33 C0 FF 64 24 0C 51 8B 4D 10 89 81 B8
' 00 00 00 8B 45 0C 89 81 C4 00 00 00 59 33 C0 EB 05 B8 01 00 00 00 89 45 08
 ({ 139, 69, 8, 129, 56, 37, 0, 0, 192, 116, 70, 131, 120, 4, 0, 117, 64, 232, 0, 0, 0, 0, 88, 131, 192, 6, 235, 29, 100, 137, 37, 0, 0, 0, 0, 131, 196, 16, 97, 157, 221, 36, 36, 155, 100, 139, 37, 0, 0, 0, 0, 51, 192, 255, 100, 36, 12, 81, 139, 77, 16, 137, 129, 184, 0, 0, 0, 139, 69, 12, 137, 129, 196, 0, 0, 0, 89, 51, 192, 235, 5, 184, 1, 0, 0, 0, 137, 69, 8 })
 (쳣)

.ӳ call_걾, 
. ַ, 
. һ, , ɿ
. , , ɿ
. , , ɿ
. , , ɿ
. , , ɿ
. , , ɿ
. , , ɿ
. , , ɿ
. , , ɿ
. ʮ, , ɿ
. ʮһ, , ɿ
.ֲ data, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

data  _call_걾 (ַ, һ, , , , , , , , , ʮ)

 (data)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ _call_걾, 
. ַ, 
. һ, 
. , 
. , 
. , 
. , 
. , 
. , 
. , 
. , 
. ʮ, 


 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
 ({ 201, 88, 135, 4, 36, 255, 224 })
 (0)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ȡϵͳ汾1, , , 0.δ֪ 1.Win95 2.Win98 3.WinME 4.WinNT 5.Win2000 6.WinXP 7.Win2003 8.Vista 9.Win7 10.Win8 11.win8.1 12.win10

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

 ({ 83, 49, 192, 100, 139, 29, 24, 0, 0, 0, 100, 139, 13, 48, 0, 0, 0, 133, 201, 121, 32, 185, 0, 0, 83, 0, 57, 75, 88, 117, 4, 176, 1, 235, 113, 57, 75, 84, 117, 4, 176, 2, 235, 104, 57, 75, 124, 117, 99, 176, 3, 235, 95, 139, 153, 168, 0, 0, 0, 139, 137, 164, 0, 0, 0, 131, 249, 4, 119, 4, 176, 4, 235, 74, 131, 249, 5, 117, 27, 131, 251, 0, 117, 4, 176, 5, 235, 60, 131, 251, 1, 117, 4, 176, 6, 235, 51, 131, 251, 2, 117, 4, 176, 7, 235, 42, 131, 249, 6, 117, 35, 131, 251, 0, 117, 4, 176, 8, 235, 28, 131, 251, 1, 117, 2, 176, 9, 131, 251, 2, 117, 2, 176, 10, 131, 251, 3, 117, 2, 176, 11, 131, 251, 4, 117, 2, 176, 12, 91, 201, 195 })

 (0)
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ Ƿ64λϵͳ, ߼, , Ƿ棬Ƿؼ
.ֲ hModule
.ֲ addr
.ֲ lpBuffer, ı
.ֲ ret
.ֲ kernel32, ֽڼ
.ֲ GetSystemWow64DirectoryA, ֽڼ

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
kernel32  { 243, 253, 234, 246, 253, 244, 171, 170, 182, 252, 244, 244 }  ' ֽڼ (kernel32.dll)
 (kernel32)
hModule  GetModuleHandleA_ (ı (kernel32))
 (kernel32)
GetSystemWow64DirectoryA  { 223, 253, 236, 203, 225, 235, 236, 253, 245, 207, 247, 239, 174, 172, 220, 241, 234, 253, 251, 236, 247, 234, 225, 217 }
 (GetSystemWow64DirectoryA)
addr  GetProcAddress_ (hModule, ı (GetSystemWow64DirectoryA))
 (GetSystemWow64DirectoryA)
. (addr  0)
     ()
.
lpBuffer  ȡհı (255)
ret  call_жϲϵͳ (addr, ȡıָ_asm (lpBuffer), 255)
 (ret  0)
' ʵıȣΪ0Ͳsyswow64Ŀ¼32λϵͳ>0syswow64Ŀ¼64λϵͳ
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־



.ӳ call_жϲϵͳ, 
. ӳַ
. 1
. 2

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

 ({ 201, 88, 135, 4, 36, 255, 224 })
 (0)
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

.ӳ _call_CreateFileA, 
. ַ, 
. һ, 
. , 
. , 
. , 
. , 
. , 
. , 


'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
 ({ 201, 88, 135, 4, 36, 255, 224 })
 (0)
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

.ӳ _, , , ֽڼͷʼ־볤  ȡֽڼָ-8
. , 
. xor, 
.ֲ _begin70, 
.ֲ len, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
len  0
' 00401374  |.  8B55 08       mov edx,[arg.1]
' 00401379      83EA 04       add edx,0x4 ݳ
' 0040137C  |.  8B02          mov eax,dword ptr ds:[edx]
' 0040137E  |.  8945 FC       mov [local.1],eax
' 00401381  |.  83C2 04       add edx,0x4 ݵַ
 ({ 139, 85, 8, 131, 194, 4, 139, 2, 137, 69, 252, 131, 194, 4 })  ' ҪܶݷŵEDX...

_begin70  0

.ƴѭ (len, )
    ' 00401468      8A02          |mov al,byte ptr ds:[edx]
    ' 0040146A      8A65 0C       mov ah,byte ptr ss:[ebp+0xC]
    ' 0040146D      32C4          |xor al,ah
    ' 0040146F      8802          |mov byte ptr ds:[edx],al
    ' 00401471      83C2 01       |add edx,0x1
     ({ 138, 2, 138, 101, 12, 50, 196, 136, 2, 131, 194, 1 })

.ƴѭβ ()
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ϵͳ_ȡ, , , һָΧڵֵʹñȡһϵе֮ǰӦʹáӡΪʼһֵΪ
. ȡСֵ, , ɿ, ڻ㡣ʡԣĬΪ 0
. ȡֵ, , ɿ, ڻ㡣ʡԣĬΪޡ

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

 ({ 81, 82, 15, 49, 105, 192, 253, 67, 3, 0, 5, 195, 158, 38, 0, 193, 232, 16, 37, 255, 127, 0, 0, 139, 77, 16, 133, 201, 117, 5, 185, 255, 255, 255, 127, 43, 77, 8, 65, 51, 210, 247, 241, 3, 85, 8, 139, 194, 90, 89, 139, 229, 93, 194, 16, 0 })
' PUSH EBP
' MOV EBP, ESP
' PUSH ECX
' PUSH EDX
' RDTSC
' IMUL EAX, EAX, 343FDh
' ADD EAX, 269EC3h
' SHR EAX, 10h
' AND EAX, 7FFFh
' MOV ECX, DWORD PTR SS:[EBP+10h]
' TEST ECX, ECX
' JNZ SHORT Jump
' MOV ECX, 7FFFFFFFh
' @Jump:
' SUB ECX, DWORD PTR SS:[EBP+8h]
' INC ECX
' XOR EDX, EDX
' DIV ECX
' ADD EDX, DWORD PTR SS:[EBP+8h]
' MOV EAX, EDX
' POP EDX
' POP ECX
' MOV ESP, EBP
' POP EBP
' RETN 10h
 (0)
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ڴ澫ȷ_ⲿڴ, , , ʧܷ0,ɹڴַ
. ڴַ, 
. ڴ泤, 
. , , , ڴַ
.ֲ _begin73, 

'  ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin73  0
. (SEH_װSEH_ⲿڴ ())

    ' 00401095    60                   pushad                                             ; ݼĴ
    ' 00401096    9C                   pushfd                                             ; ݱ־λ
    ' 00401097    FC                   cld                                                ; ˳
    ' 00401099    8B5D 10              mov     ebx, dword ptr [ebp+10]                    ; 3 ֽڼ
    ' 0040109C    8B1B                 mov     ebx, dword ptr [ebx]                       ; ֽڼַ
    ' 0040109E    83C3 08              add     ebx, 8                                     ; ֽڼָ
    ' 004010A1    0FB603               movzx   eax, byte ptr [ebx]                        ; ֽڼ
    ' 004010A4    8B4B FC              mov     ecx, dword ptr [ebx-4]                     ; ֽڳ
    ' 004010A7    294D 0C              sub     dword ptr [ebp+C], ecx                     ; ҳ
    ' 004010AA    90                   nop
    ' 004010AB    8B7D 08              mov     edi, dword ptr [ebp+8]                     ; ҵַ
    ' 004010AE    8B4D 0C              mov     ecx, dword ptr [ebp+C]                     ; ҳ
    ' 004010B1    83F9 00              cmp     ecx, 0                                     ;  >0?
    ' 004010B4    7E 1E                jle      short 004010D4                            ; С  
    ' 004010B6    F2:AE                repne   scas byte ptr es:[edi]                     ; ֽ
    ' 004010B8    75 1A                jnz     short 004010D4                             ; ޷  
    ' 004010BA    897D 08              mov     dword ptr [ebp+8], edi                     ; ַ
    ' 004010BD    894D 0C              mov     dword ptr [ebp+C], ecx                     ; 泤
    ' 004010C0    4F                   dec     edi                                        ; ݼַ
    ' 004010C1    8BF3                 mov     esi, ebx                                   ; ֽڼָ
    ' 004010C3    8B4E FC              mov     ecx, dword ptr [esi-4]                     ; ֽڼ
    ' 004010C6    F3:A6                repe    cmps byte ptr es:[edi], byte ptr [esi]     ; 
    ' 004010C8  ^ 75 E1                jnz     short 004010AB                             ;   
    ' 004010CA    FF4D 08              dec     dword ptr [ebp+8]                          ; ݼַ
    ' 004010CD    C745 0C FDFFFFFF     mov     dword ptr [ebp+C], -3                      ; óɹ
    ' 004010D4    9D                   popfd                                              ; ָ־λ
    ' 004010D5    61                   popad                                              ; ָĴ
    ' 60 9C FC 8B 5D 10 8B 1B 83 C3 08 0F B6 03 8B 4B FC 29 4D 0C 90 8B 7D 08 8B 4D 0C 83 F9 00 7E 1E
    ' F2 AE 75 1A 89 7D 08 89 4D 0C 4F 8B F3 8B 4E FC F3 A6 75 E1 FF 4D 08 C7 45 0C FD FF FF FF 9D 61
     ({ 96, 156, 252, 139, 93, 16, 131, 195, 8, 15, 182, 3, 139, 75, 252, 41, 77, 12, 144, 139, 125, 8, 139, 77, 12, 131, 249, 0, 126, 30, 242, 174, 117, 26, 137, 125, 8, 137, 77, 12, 79, 139, 243, 139, 78, 252, 243, 166, 117, 225, 255, 77, 8, 199, 69, 12, 253, 255, 255, 255, 157, 97 })


.
SEH_ɾSEH_ⲿڴ ()

. (-3  ڴ泤)
    ڴַ  0
.
 (ڴַ)
'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ڴ澫ȷ_wow64Ѱ, , , ʧܷ0,ɹڴַ
. ڴַ, 
. ڴ泤, 
. , , , ڴַ
.ֲ _begin73, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin73  0
. (SEH_װSEH_wow64Ѱ ())

    ' 00401095    60                   pushad                                             ; ݼĴ
    ' 00401096    9C                   pushfd                                             ; ݱ־λ
    ' 00401097    FC                   cld                                                ; ˳
    ' 00401099    8B5D 10              mov     ebx, dword ptr [ebp+10]                    ; 3 ֽڼ
    ' 0040109C    8B1B                 mov     ebx, dword ptr [ebx]                       ; ֽڼַ
    ' 0040109E    83C3 08              add     ebx, 8                                     ; ֽڼָ
    ' 004010A1    0FB603               movzx   eax, byte ptr [ebx]                        ; ֽڼ
    ' 004010A4    8B4B FC              mov     ecx, dword ptr [ebx-4]                     ; ֽڳ
    ' 004010A7    294D 0C              sub     dword ptr [ebp+C], ecx                     ; ҳ
    ' 004010AA    90                   nop
    ' 004010AB    8B7D 08              mov     edi, dword ptr [ebp+8]                     ; ҵַ
    ' 004010AE    8B4D 0C              mov     ecx, dword ptr [ebp+C]                     ; ҳ
    ' 004010B1    83F9 00              cmp     ecx, 0                                     ;  >0?
    ' 004010B4    7E 1E                jle      short 004010D4                            ; С  
    ' 004010B6    F2:AE                repne   scas byte ptr es:[edi]                     ; ֽ
    ' 004010B8    75 1A                jnz     short 004010D4                             ; ޷  
    ' 004010BA    897D 08              mov     dword ptr [ebp+8], edi                     ; ַ
    ' 004010BD    894D 0C              mov     dword ptr [ebp+C], ecx                     ; 泤
    ' 004010C0    4F                   dec     edi                                        ; ݼַ
    ' 004010C1    8BF3                 mov     esi, ebx                                   ; ֽڼָ
    ' 004010C3    8B4E FC              mov     ecx, dword ptr [esi-4]                     ; ֽڼ
    ' 004010C6    F3:A6                repe    cmps byte ptr es:[edi], byte ptr [esi]     ; 
    ' 004010C8  ^ 75 E1                jnz     short 004010AB                             ;   
    ' 004010CA    FF4D 08              dec     dword ptr [ebp+8]                          ; ݼַ
    ' 004010CD    C745 0C FDFFFFFF     mov     dword ptr [ebp+C], -3                      ; óɹ
    ' 004010D4    9D                   popfd                                              ; ָ־λ
    ' 004010D5    61                   popad                                              ; ָĴ
    ' 60 9C FC 8B 5D 10 8B 1B 83 C3 08 0F B6 03 8B 4B FC 29 4D 0C 90 8B 7D 08 8B 4D 0C 83 F9 00 7E 1E
    ' F2 AE 75 1A 89 7D 08 89 4D 0C 4F 8B F3 8B 4E FC F3 A6 75 E1 FF 4D 08 C7 45 0C FD FF FF FF 9D 61
     ({ 96, 156, 252, 139, 93, 16, 131, 195, 8, 15, 182, 3, 139, 75, 252, 41, 77, 12, 144, 139, 125, 8, 139, 77, 12, 131, 249, 0, 126, 30, 242, 174, 117, 26, 137, 125, 8, 137, 77, 12, 79, 139, 243, 139, 78, 252, 243, 166, 117, 225, 255, 77, 8, 199, 69, 12, 253, 255, 255, 255, 157, 97 })


.
SEH_ɾSEH_wow64Ѱ ()

. (-3  ڴ泤)
    ڴַ  0
.
 (ڴַ)
 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ 1, , , ָ ֵ=1-2
. 1, 
. 2, 
.ֲ _begin74, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־

_begin74  0

'  ({ 139, 69, 8, 43, 69, 12, 201, 194, 8, 0 })
 ({ 139, 69, 8, 43, 69, 12, 139, 229, 93, 194, 8, 0 })
 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


.ӳ ½ڴУ鱣, 
. ȡַ1, 
. ַ, 
.ֲ ַ, 
.ֲ _begin74, 

 ({ 235, 16, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 98, 101, 103, 105, 110, 0 })  ' VMPʼ־
_begin74  0

ַ  ϵͳ_ȡ (1, 30)

' _д־ (:  ı (ַ))

.жϿʼ (ַ  1)
     (У1 (ȡַ1, ַ))
.ж (ַ  2)
     (У2 (ȡַ1, ַ))
.ж (ַ  3)
     (У3 (ȡַ1, ַ))
.ж (ַ  4)
     (У4 (ȡַ1, ַ))
.ж (ַ  5)
     (У5 (ȡַ1, ַ))
.ж (ַ  6)
     (У6 (ȡַ1, ַ))
.ж (ַ  7)
     (У7 (ȡַ1, ַ))
.ж (ַ  8)
     (У8 (ȡַ1, ַ))
.ж (ַ  9)
     (У9 (ȡַ1, ַ))
.ж (ַ  10)
     (У10 (ȡַ1, ַ))
.ж (ַ  11)
     (У11 (ȡַ1, ַ))
.ж (ַ  12)
     (У12 (ȡַ1, ַ))
.ж (ַ  13)
     (У12 (ȡַ1, ַ))
.ж (ַ  14)
     (У14 (ȡַ1, ַ))
.ж (ַ  15)
     (У15 (ȡַ1, ַ))
.ж (ַ  16)
     (У16 (ȡַ1, ַ))
.ж (ַ  17)
     (У17 (ȡַ1, ַ))
.ж (ַ  18)
     (У18 (ȡַ1, ַ))
.ж (ַ  19)
     (У19 (ȡַ1, ַ))
.ж (ַ  20)
     (У20 (ȡַ1, ַ))
.ж (ַ  21)
     (У21 (ȡַ1, ַ))
.ж (ַ  22)
     (У22 (ȡַ1, ַ))
.ж (ַ  23)
     (У23 (ȡַ1, ַ))
.ж (ַ  24)
     (У24 (ȡַ1, ַ))
.ж (ַ  25)
     (У25 (ȡַ1, ַ))
.ж (ַ  26)
     (У26 (ȡַ1, ַ))
.ж (ַ  27)
     (У27 (ȡַ1, ַ))
.ж (ַ  28)
     (У28 (ȡַ1, ַ))
.ж (ַ  29)
     (У29 (ȡַ1, ַ))
.ж (ַ  30)
     (У30 (ȡַ1, ַ))
.Ĭ

.жϽ

' Ϣ (0ˣ, 0, , )

 (0)

 ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־


'  ({ 235, 14, 86, 77, 80, 114, 111, 116, 101, 99, 116, 32, 101, 110, 100, 0 })  ' VMP־

