; 传入编辑框中=》Vip用户名：83034
00459EEF 8B83 FC020000 mov eax,dword ptr ds:[ebx+2FC]
00459EF5 8B80 20020000 mov eax,dword ptr ds:[eax+220]
00459EFB 8B08 mov ecx,dword ptr ds:[eax]
00459EFD FF51 38 call dword ptr ds:[ecx+38]
00459F00 E8 37FCFFFF call 超强灰鸽.00459B3C
; 该函数检测是否存在隐藏模块,返回eax=0x1 表示检测到隐藏模块
00459F05 84C0 test al,al
00459F07 0F84 96020000 je 超强灰鸽.0045A1A3 ; not jump
00459F0D E8 E6FAFFFF call 超强灰鸽.004599F8
; 打开令牌环，设置系统调试权限
00459F12 E8 61FCFFFF call 超强灰鸽.00459B78
; 检测隐藏模块,映射出具体的文件名
00459F17 8B83 FC020000 mov eax,dword ptr ds:[ebx+2FC]
00459F1D 8B80 20020000 mov eax,dword ptr ds:[eax+220]
00459F23 BA 84A24500 mov edx,超强灰鸽.0045A284
00459F28 8B08 mov ecx,dword ptr ds:[eax]
00459F2A FF51 38 call dword ptr ds:[ecx+38]
; 该函数处理一些消息
00459F2D A1 C8DC4500 mov eax,dword ptr ds:[45DCC8]
00459F32 33D2 xor edx,edx
00459F34 52 push edx
00459F35 50 push eax
00459F36 8D45 E0 lea eax,dword ptr ss:[ebp-20]
00459F39 E8 EAE1FAFF call 超强灰鸽.00408128
; 获取隐藏进程ID ?
00459F3E 8B4D E0 mov ecx,dword ptr ss:[ebp-20]
; ecx=00ee546c ascii "916"\\1804
00459F41 8D45 E4 lea eax,dword ptr ss:[ebp-1C]
00459F44 BA B4A24500 mov edx,超强灰鸽.0045A2B4
00459F49 E8 92A2FAFF call 超强灰鸽.004041E0
00459F4E 8B55 E4 mov edx,dword ptr ss:[ebp-1C]
|
