out1.asm

当前支持 16-bit, 32-bit and 64-bit 的二进制文件

  push  byte +0x02
  push  byte +0x00
  call  dword near [___dyn_tls_init_callback]

loc_411974:
  push  byte +0x01
  call  dword near [MSVCR80D._CrtSetCheckCount]
  add  esp,byte +0x04
  mov  ecx,[MSVCR80D.__winitenv]
  mov  edx,[0x00417180]
  mov  [ecx],edx
  mov  eax,[0x00417180]
  push  eax
  mov  ecx,[0x00417184]
  push  ecx
  mov  edx,[0x0041717c]
  push  edx
  call  dword fn_41100f
  add  esp,byte +0x0c
  mov  [0x00417194],eax
  cmp  dword [0x00417188],byte +0x00
  jnz  loc_4119c3

loc_4119b7:
  mov  eax,[0x00417194]
  push  eax
  call  dword near [MSVCR80D.exit]

loc_4119c3:
  cmp  dword [0x00417198],byte +0x00
  jnz  loc_4119d2

loc_4119cc:
  call  dword near [MSVCR80D._cexit]

loc_4119d2:
  mov  dword [ebp-0x04],0xfffffffe
  jmp  short loc_411a2d

loc_411a2d:
  mov  eax,[0x00417194]

loc_411a32:
  mov  ecx,[ebp-0x10]
  mov  [fs:0x00000000],ecx
  pop  ecx
  pop  edi
  pop  esi
  pop  ebx
  mov  esp,ebp
  pop  ebp
  ret

; --- procedure at 411bf0 ---

; consists of 2 basic blocks.
; return depth: 0 bytes
; This procedure calls/invokes:
; - KERNEL32.RaiseException (import)

fn_411bf0:
  push  ebp
  mov  ebp,esp
  push  byte -0x02
  push  dword 0x00416a68
  push  dword 0x00411087
  mov  eax,[fs:0x00000000]
  push  eax
  sub  esp,byte +0x24
  push  ebx
  push  esi
  push  edi
  mov  eax,[___security_cookie]
  xor  [ebp-0x08],eax
  xor  eax,ebp
  push  eax
  lea  eax,[ebp-0x10]
  mov  [fs:0x00000000],eax
  mov  [ebp-0x18],esp
  xor  eax,eax
  mov  [ebp-0x19],al
  mov  dword [ebp-0x34],0x00001001
  mov  ecx,[ebp+0x08]
  mov  [ebp-0x30],ecx
  lea  edx,[ebp-0x19]
  mov  [ebp-0x2c],edx
  mov  [ebp-0x04],eax
  lea  ecx,[ebp-0x34]
  push  ecx
  push  byte +0x06
  push  eax
  push  dword 0x406d1388
  call  dword near [KERNEL32.RaiseException]
  jmp  short loc_411c59

loc_411c59:
  mov  dword [ebp-0x04],0xfffffffe
  movzx  eax,byte [ebp-0x19]
  mov  ecx,[ebp-0x10]
  mov  [fs:0x00000000],ecx
  pop  ecx
  pop  edi
  pop  esi
  pop  ebx
  mov  esp,ebp
  pop  ebp
  ret

; --- procedure at 411d10 ---

; consists of 1a basic blocks.
; return depth: 0 bytes
; This procedure calls/invokes:
; - @__security_check_cookie@4 (direct)
; - ?_RTC_GetErrorFuncW@@YAP6AHHPB_WH00ZZPBX@Z (direct)
; - ?_RTC_GetSrcLine@@YAHPAEPA_WKPAH1K@Z (direct)
; - ?_RTC_GetErrorFunc@@YAP6AHHPBDH00ZZPBX@Z (direct)
; - fn_411bf0 (direct)
; - fn_411fe0 (direct)
; - KERNEL32.DebugBreak (import)
; - KERNEL32.IsDebuggerPresent (import)

fn_411d10:
  push  ebp
  mov  ebp,esp
  sub  esp,0x00000e3c
  mov  eax,[___security_cookie]
  xor  eax,ebp
  mov  [ebp-0x04],eax
  push  ebx
  push  esi
  mov  esi,[ebp+0x14]
  push  edi
  mov  edi,[ebp+0x08]
  push  edi
  mov  [ebp+0xfffff1c4],esi
  mov  dword [ebp+0xfffff1cc],0x00000000
  call  dword fn_41103c
  mov  ebx,eax
  add  esp,byte +0x04
  test  ebx,ebx
  jnz  loc_411d5a

loc_411d4b:
  push  edi
  call  dword fn_4111c7
  add  esp,byte +0x04
  mov  [ebp+0xfffff1cc],eax

loc_411d5a:
  push  byte +0x00
  push  byte +0x00
  push  byte -0x01
  push  esi
  mov  esi,[KERNEL32.MultiByteToWideChar]
  push  byte +0x00
  push  dword 0x0000fde9
  call  esi
  cmp  eax,0x00000200
  jnc  loc_411da3

loc_411d77:
  mov  ecx,[ebp+0xfffff1c4]
  push  eax
  lea  eax,[ebp+0xfffff1d4]
  push  eax
  push  byte -0x01
  push  ecx
  push  byte +0x00
  push  dword 0x0000fde9
  call  esi
  test  eax,eax
  jz  loc_411da3

loc_411d95:
  lea  edx,[ebp+0xfffff1d4]
  mov  [ebp+0xfffff1d0],edx
  jmp  short loc_411dad

loc_411da3:
  mov  dword [ebp+0xfffff1d0],0x00415b88

loc_411dad:
  push  dword 0x00001002
  call  dword fn_411bf0
  mov  esi,[ebp+0x10]
  add  esp,byte +0x04
  test  eax,eax
  jz  loc_411de6

loc_411dc1:
  mov  eax,[ebp+0xfffff1d0]
  mov  ecx,[esi*4+0x00415a4c]
  push  eax
  push  edi
  push  ecx
  push  esi
  call  dword fn_411fe0
  add  esp,byte +0x10
  test  eax,eax
  jnz  dword loc_411f34

loc_411de2:
  xor  al,al
  jmp  short loc_411de8

loc_411de6:
  mov  al,0x01

loc_411de8:
  cmp  dword [ebp+0xfffff1cc],byte +0x00
  jnz  loc_411df9

loc_411df1:
  test  ebx,ebx
  jz  dword loc_411f2e

loc_411df9:
  test  al,al
  jz  loc_411e0b

loc_411dfd:
  call  dword near [KERNEL32.IsDebuggerPresent]
  test  eax,eax
  jnz  dword loc_411f2e

loc_411e0b:
  push  dword 0x00000104
  lea  edx,[ebp+0xfffffbec]
  push  edx
  lea  eax,[ebp+0xfffff1c8]
  push  eax
  push  dword 0x00000104
  lea  ecx,[ebp+0xfffffdf4]
  push  ecx
  add  edi,byte -0x05
  push  edi
  call  dword fn_41115e
  add  esp,byte +0x18
  test  ebx,ebx
  jz  loc_411e67

loc_411e3a:
  mov  edx,[ebp+0xfffff1d0]
  mov  ecx,[ebp+0xfffff1c8]
  push  edx
  push  esi
  push  dword 0x00415b38
  lea  eax,[ebp+0xfffffbec]
  push  eax
  mov  eax,[ebp+0x0c]
  push  ecx
  lea  edx,[ebp+0xfffffdf4]
  push  edx
  push  eax
  call  ebx
  jmp  dword loc_411f26

loc_411e67:
  mov  esi,[KERNEL32.WideCharToMultiByte]
  push  byte +0x00
  push  byte +0x00
  push  byte +0x00
  push  byte +0x00
  push  byte -0x01
  lea  ecx,[ebp+0xfffffdf4]
  push  ecx
  push  byte +0x00
  push  dword 0x0000fde9
  call  esi
  test  eax,eax
  jz  loc_411eb3

loc_411e8b:
  push  byte +0x00
  push  byte +0x00
  push  eax
  lea  edx,[ebp+0xfffff5d4]
  push  edx
  push  byte -0x01
  lea  eax,[ebp+0xfffffdf4]
  push  eax
  push  byte +0x00
  push  dword 0x0000fde9
  call  esi
  test  eax,eax
  lea  edi,[ebp+0xfffff5d4]
  jnz  loc_411eb8

loc_411eb3:
  mov  edi,0x00415b24

loc_411eb8:
  push  byte +0x00
  push  byte +0x00
  push  byte +0x00
  push  byte +0x00
  push  byte -0x01
  lea  ecx,[ebp+0xfffffbec]
  push  ecx
  push  byte +0x00
  push  dword 0x0000fde9
  call  esi
  test  eax,eax
  jz  loc_411efe

loc_411ed6:
  push  byte +0x00
  push  byte +0x00
  push  eax
  lea  edx,[ebp+0xfffff9e4]
  push  edx
  push  byte -0x01
  lea  eax,[ebp+0xfffffbec]
  push  eax
  push  byte +0x00
  push  dword 0x0000fde9
  call  esi
  test  eax,eax
  lea  eax,[ebp+0xfffff9e4]
  jnz  loc_411f03

loc_411efe:
  mov  eax,0x00415b0c

loc_411f03:
  mov  ecx,[ebp+0xfffff1c4]
  mov  edx,[ebp+0x10]
  push  ecx
  mov  ecx,[ebp+0x0c]
  push  edx
  push  dword 0x00415ae4
  push  eax
  mov  eax,[ebp+0xfffff1c8]
  push  eax
  push  edi
  push  ecx
  call  dword near [ebp+0xfffff1cc]

loc_411f26:
  add  esp,byte +0x1c
  cmp  eax,byte +0x01
  jnz  loc_411f34

loc_411f2e:
  call  dword near [KERNEL32.DebugBreak]

loc_411f34:
  mov  ecx,[ebp-0x04]
  pop  edi
  pop  esi
  xor  ecx,ebp
  pop  ebx
  call  dword fn_41101e
  mov  esp,ebp
  pop  ebp
  ret

; --- procedure at 411fe0 ---

; consists of 2 basic blocks.
; return depth: 0 bytes
; This procedure calls/invokes:
; - KERNEL32.RaiseException (import)

fn_411fe0:
  push  ebp
  mov  ebp,esp
  push  byte -0x02
  push  dword 0x00416a88
  push  dword 0x00411087
  mov  eax,[fs:0x00000000]
  push  eax
  sub  esp,byte +0x24
  push  ebx
  push  esi
  push  edi
  mov  eax,[___security_cookie]
  xor  [ebp-0x08],eax
  xor  eax,ebp
  push  eax
  lea  eax,[ebp-0x10]
  mov  [fs:0x00000000],eax
  mov  [ebp-0x18],esp
  xor  eax,eax
  mov  [ebp-0x19],al
  mov  dword [ebp-0x34],0x00001002
  mov  ecx,[ebp+0x08]
  mov  [ebp-0x30],ecx
  mov  edx,[ebp+0x0c]
  mov  [ebp-0x2c],edx
  mov  ecx,[ebp+0x10]
  mov  [ebp-0x28],ecx
  lea  edx,[ebp-0x19]
  mov  [ebp-0x24],edx
  mov  ecx,[ebp+0x14]
  mov  [ebp-0x20],ecx
  mov  [ebp-0x04],eax
  lea  edx,[ebp-0x34]
  push  edx
  push  byte +0x06
  push  eax
  push  dword 0x406d1388
  call  dword near [KERNEL32.RaiseException]
  jmp  short loc_41205b

loc_41205b:
  mov  dword [ebp-0x04],0xfffffffe
  movzx  eax,byte [ebp-0x19]
  mov  ecx,[ebp-0x10]
  mov  [fs:0x00000000],ecx
  pop  ecx
  pop  edi
  pop  esi
  pop  ebx
  mov  esp,ebp
  pop  ebp
  ret

; --- procedure at 4130b0 ---

; consists of 16 basic blocks.
; return depth: 0 bytes
; This procedure calls/invokes:
; - @__security_check_cookie@4 (direct)
; - KERNEL32.FreeLibrary (import)
; - KERNEL32.LoadLibraryA (import)

fn_4130b0:
  push  ebp
  mov  ebp,esp
  sub  esp,0x00000118
  mov  eax,[___security_cookie]
  xor  eax,ebp
  mov  [ebp-0x04],eax
  cmp  dword [0x004171cc],byte +0x00
  jz  loc_4130dc

loc_4130cc:
  xor  eax,eax
  mov  ecx,[ebp-0x04]
  xor  ecx,ebp
  call  dword fn_41101e
  mov  esp,ebp
  pop  ebp
  ret

loc_4130dc:
  mov  eax,[0x00417068]
  push  esi
  mov  esi,[KERNEL32.LoadLibraryA]
  push  eax
  mov  dword [0x004171cc],0x00000001
  call  esi
  test  eax,eax
  jnz  dword loc_41325d

loc_4130fd:
  push  dword 0x00416150
  call  esi
  mov  esi,eax
  test  esi,esi
  jnz  loc_413119

loc_41310a:
  pop  esi
  mov  ecx,[ebp-0x04]
  xor  ecx,ebp
  call  dword fn_41101e
  mov  esp,ebp
  pop  ebp
  ret

loc_413119:
  push  ebx
  mov  ebx,[KERNEL32.GetProcAddress]
  push  dword 0x00416140
  push  esi
  call  ebx
  test  eax,eax
  mov  [ebp+0xfffffeec],eax
  jnz  loc_413142

loc_413132:
  pop  ebx
  pop  esi
  mov  ecx,[ebp-0x04]
  xor  ecx,ebp
  call  dword fn_41101e
  mov  esp,ebp
  pop  ebp
  ret

loc_413142:
  push  edi
  push  dword 0x0041612c
  push  esi
  call  ebx
  mov  edi,eax
  test  edi,edi
  jz  loc_4131b9

loc_413151:
  push  dword 0x0041611c
  push  esi
  call  ebx
  mov  ebx,eax
  test  ebx,ebx
  jz  loc_4131b9

loc_41315f:
  lea  ecx,[ebp+0xfffffef0]
  push  ecx
  push  byte +0x01
  push  byte +0x00
  push  dword 0x004160e4
  push  dword 0x80000002
  call  dword near [ebp+0xfffffeec]
  test  eax,eax
  jnz  loc_4131b2

loc_41317e:
  mov  ecx,[ebp+0xfffffef0]
  lea  edx,[ebp+0xfffffef4]
  push  edx
  push  eax
  lea  eax,[ebp+0xfffffee8]
  push  eax
  push  byte +0x00
  push  dword 0x004160c8
  push  ecx
  call  edi
  test  eax,eax
  jnz  loc_4131b2

loc_4131a1:
  mov  edx,[ebp+0xfffffef4]
  add  edx,byte +0x0d
  cmp  edx,0x00000104
  jc  loc_4131cc

loc_4131b2:
  push  esi
  call  dword near [KERNEL32.FreeLibrary]

loc_4131b9:
  pop  edi
  pop  ebx
  xor  eax,eax
  pop  esi
  mov  ecx,[ebp-0x04]
  xor  ecx,ebp
  call  dword fn_41101e
  mov  esp,ebp
  pop  ebp
  ret

loc_4131cc:
  lea  eax,[ebp+0xfffffef4]
  push  eax
  mov  eax,[ebp+0xfffffef0]
  lea  ecx,[ebp+0xfffffef8]
  push  ecx
  lea  edx,[ebp+0xfffffee8]
  push  edx
  push  byte +0x00
  push  dword 0x004160c8
  push  eax
  call  edi
  mov  ecx,[ebp+0xfffffef0]
  push  ecx
  mov  edi,eax
  call  ebx
  push  esi
  call  dword near [KERNEL32.FreeLibrary]
  test  edi,edi
  jnz  loc_4131b9

loc_413207:
  mov  ecx,[ebp+0xfffffef4]
  mov  al,0x5c
  cmp  [ebp+ecx+0xfffffef6],al
  jz  loc_413221

loc_413218:
  mov  [ebp+ecx+0xfffffef7],al
  jmp  short loc_41322a

loc_413221:
  sub  ecx,byte +0x01
  mov  [ebp+0xfffffef4],ecx

loc_41322a:
  mov  esi,[0x00417068]
  xor  eax,eax
  lea  ecx,[ebp+ecx+0xfffffef8]
  lea  esp,[esp]

loc_413240:
  mov  dl,[esi+eax]
  mov  [ecx+eax],dl
  add  eax,byte +0x01
  cmp  eax,byte +0x0b
  jle  loc_413240

loc_41324e:
  lea  eax,[ebp+0xfffffef8]
  push  eax
  call  dword near [KERNEL32.LoadLibraryA]
  pop  edi
  pop  ebx

loc_41325d:
  mov  ecx,[ebp-0x04]
  xor  ecx,ebp
  pop  esi
  call  dword fn_41101e
  mov  esp,ebp
  pop  ebp
  ret