:00406AEC 899D70FFFFFF mov dword ptr [ebp+FFFFFF70], ebx
:00406AF2 899D60FFFFFF mov dword ptr [ebp+FFFFFF60], ebx
:00406AF8 899D34FFFFFF mov dword ptr [ebp+FFFFFF34], ebx
:00406AFE 899D24FFFFFF mov dword ptr [ebp+FFFFFF24], ebx
:00406B04 899D14FFFFFF mov dword ptr [ebp+FFFFFF14], ebx
:00406B0A 899D04FFFFFF mov dword ptr [ebp+FFFFFF04], ebx
:00406B10 899DF4FEFFFF mov dword ptr [ebp+FFFFFEF4], ebx
:00406B16 899DE4FEFFFF mov dword ptr [ebp+FFFFFEE4], ebx
:00406B1C 899DD4FEFFFF mov dword ptr [ebp+FFFFFED4], ebx
:00406B22 899DC4FEFFFF mov dword ptr [ebp+FFFFFEC4], ebx
:00406B28 899DB4FEFFFF mov dword ptr [ebp+FFFFFEB4], ebx
:00406B2E 899DA4FEFFFF mov dword ptr [ebp+FFFFFEA4], ebx
:00406B34 E8F7610000 call 0040CD30 ；跟进去看看
:00406B39 391D10204100 cmp dword ptr [00412010], ebx ；比较
:00406B3F 7510 jne 00406B51 ；不等则跳
:00406B41 6810204100 push 00412010
:00406B46 6804464000 push 00404604
* Reference To: MSVBVM60.__vbaNew2, Ord:0000h
|
:00406B4B FF15F8104000 Call dword ptr [004010F8]
*
*
*
ret
-------------------------------------------------------------------------------------------------------------------
Quote:
:0040CD30 55 push ebp
:0040CD31 8BEC mov ebp, esp
:0040CD33 83EC08 sub esp, 00000008
* Possible StringData Ref from Code Obj ->"�%?@"
|
:0040CD36 68A6134000 push 004013A6
:0040CD3B 64A100000000 mov eax, dword ptr fs:[00000000]
:0040CD41 50 push eax
:0040CD42 64892500000000 mov dword ptr fs:[00000000], esp
:0040CD49 83EC2C sub esp, 0000002C
:0040CD4C 53 push ebx
:0040CD4D 56 push esi
:0040CD4E 57 push edi
:0040CD4F 8965F8 mov dword ptr [ebp-08], esp
:0040CD52 C745FC38134000 mov [ebp-04], 00401338
:0040CD59 33C0 xor eax, eax //eax=0
* Possible StringData Ref from Code Obj ->"127.0.0.1"
|
:0040CD5B BAB8654000 mov edx, 004065B8 ；edx="127.0.0.1"
:0040CD60 8D4DD8 lea ecx, dword ptr [ebp-28] ；ecx指向变量c
:0040CD63 8945E0 mov dword ptr [ebp-20], eax ；dim a as string
:0040CD66 8945DC mov dword ptr [ebp-24], eax ；dim b as string
:0040CD69 8945D8 mov dword ptr [ebp-28], eax ；dim c as string
:0040CD6C 8945C8 mov dword ptr [ebp-38], eax
* Reference To: MSVBVM60.__vbaStrCopy, Ord:0000h
|
:0040CD6F FF1504114000 Call dword ptr [00401104] ；c="127.0.0.1"
:0040CD75 8D45E0 lea eax, dword ptr [ebp-20] ；eax指向变量a
:0040CD78 50 push eax ；Arg4:Long，长整型，4字节
* Possible StringData Ref from Code Obj ->"IP1"
|
:0040CD79 6850664000 push 00406650 ；Arg3:string
* Possible StringData Ref from Code Obj ->"Software\casinoonnet\casino\init"
|
:0040CD7E 6808664000 push 00406608 ；Arg2:lpSubkey，string
:0040CD83 6801000080 push 80000001 ；Arg1:这个值就是HKEY_CURRENT_USER，Long
:0040CD88 E883F6FFFF call 0040C410 ；函数调用:这是作者自己构造的一个函数。
；下面我们来看看这个函数
；初步确定与注册表有关
；我们要用到SmartCheck
*
*
*
ret
------------------------------------------------------------------------------------------------------------------
打开SmartCheck，载入Casino轮盘机器人，在Event里可以看到：
相关文章
