就地取材加密
004754BF > 55 push ebp
004754C0 89E5 mov ebp, esp
004754C2 B9 08000000 mov ecx, 0x8
004754C7 6A 00 push 0x0
004754C9 49 dec ecx
004754CA ^ 75 FB jnz short 004754C7
004754CC 8944E4 1C mov dword ptr [esp+0x1C], eax
004754D0 895CE4 18 mov dword ptr [esp+0x18], ebx
004754D4 894CE4 14 mov dword ptr [esp+0x14], ecx
004754D8 8954E4 10 mov dword ptr [esp+0x10], edx
004754DC 8964E4 0C mov dword ptr [esp+0xC], esp
004754E0 896CE4 08 mov dword ptr [esp+0x8], ebp
004754E4 8974E4 04 mov dword ptr [esp+0x4], esi
004754E8 893CE4 mov dword ptr [esp], edi 以上为花指令等效为pushad
004754EB E8 00000000 call 004754F0 从这个位置开始加密的
004754F0 5A pop edx
004754F1 81EA F0544700 sub edx, 004754F0
004754F7 BB 00104000 mov ebx, 00401000 加密的起始位置
004754FC B9 00000300 mov ecx, 0x30000 这个是加密的大小
00475501 03DA add ebx, edx
00475503 8A43 01 mov al, byte ptr [ebx+0x1] 取得加密解密因子
00475506 3C 00 cmp al, 0x0
00475508 74 09 je short 00475513
0047550A 3003 xor byte ptr [ebx], al
0047550C 43 inc ebx
0047550D 43 inc ebx
0047550E 49 dec ecx
0047550F ^ 75 F2 jnz short 00475503 到这个位置加密或者解密结束
00475511 EB 04 jmp short 00475517
00475513 04 02 add al, 0x2
00475515 ^ EB F3 jmp short 0047550A 但是加密解密代码的话包含这几句
00475517 8B44E4 1C mov eax, dword ptr [esp+0x1C] 以下为花指令等效为popad
0047551B 8B5CE4 18 mov ebx, dword ptr [esp+0x18]
0047551F 8B4CE4 14 mov ecx, dword ptr [esp+0x14]
00475523 8B54E4 10 mov edx, dword ptr [esp+0x10]
00475527 8B64E4 0C mov esp, dword ptr [esp+0xC]
0047552B 8B6CE4 08 mov ebp, dword ptr [esp+0x8]
0047552F 8B74E4 04 mov esi, dword ptr [esp+0x4]
00475533 8B3CE4 mov edi, dword ptr [esp]
00475536 B9 00020000 mov ecx, 0x200
0047553B C1E1 06 shl ecx, 0x6
0047553E C1E9 0C shr ecx, 0xC
00475541 83EC FC sub esp, -0x4
00475544 49 dec ecx
00475545 ^ 75 FA jnz short 00475541
00475547 8B2CE4 mov ebp, dword ptr [esp]
0047554A B9 00020000 mov ecx, 0x200
0047554F C1E1 06 shl ecx, 0x6
00475552 C1E9 0C shr ecx, 0xC
00475555 83E9 04 sub ecx, 0x4
00475558 44 inc esp
00475559 49 dec ecx
0047555A ^ 75 FC jnz short 00475558
0047555C E8 00000000 call 00475561
00475561 812C24 F5040000 sub dword ptr [esp], 0x4F5 本指令的地址和下一个执行点的距离
00475568 C3 retn
二进制：55 89 E5 B9 08 00 00 00 6A 00 49 75 FB 89 44 E4 1C 89 5C E4 18 89 4C E4 14 89 54 E4 10 89 64 E4 0C 89 6C E4 08 89 74 E4 04 89 3C E4 E8 00 00 00 00 5A 81 EA F0 54 47 00 BB 00 10 40 00 B9 00 00 03 00 03 DA 8A 43 01 3C 00 74 09 30 03 43 43 49 75 F2 EB 04 04 02 EB F3 8B 44 E4 1C 8B 5C E4 18 8B 4C E4 14 8B 54 E4 10 8B 64 E4 0C 8B 6C E4 08 8B 74 E4 04 8B 3C E4 B9 00 02 00 00 C1 E1 06 C1 E9 0C 83 EC FC 49 75 FA 8B 2C E4 B9 00 02 00 00 C1 E1 06 C1 E9 0C 83 E9 04 44 49 75 FC E8 00 00 00 00 81 2C 24 F5 04 00 00 C3
本文转自文东会博客51CTO博客，原文链接http://blog.51cto.com/hackerwang/1251302如需转载请自行联系原作者
谢文东666
