Ultra String Reference
Address Disassembly Text String
00401B2B push 00401BEC 樗!
00401C12 push 00401CF0 榍
00403788 push 00403808 software\borland\delphi\rtlfpumaskvalue
004037BC push 00403824 fpumaskvalue
00404285 push 004042C0 \n\n
0040539C push 00405538 kernel32.dll
004053AC push 00405548 getlongpathnamea
0040558B push 004057A0 software\borland\locales
004055A9 push 004057A0 software\borland\locales
004055C7 push 004057BC software\borland\delphi\locales
004076A9 mov edx, 004076F4 true
004076E0 mov edx, 00407704 false
004079A5 mov eax, 004079D0 \:
00408E0F mov edx, 00408F24 gg
00408F7A mov edx, 0040901C yy
00408F89 mov edx, 00409028 yyyy
004093BE mov edx, 004097E4 am/pm
004093D4 mov edx, 004097EC a/pampm
004093EA mov edx, 004097F0 ampm
00409533 mov edx, 004097E4 am/pm
00409572 mov edx, 004097EC a/pampm
004095B1 mov edx, 004097F0 ampm
004095FA mov edx, 004097F8 aaaa
00409641 mov edx, 00409800 aaa
004096D9 mov eax, 00409804
00409837 mov eax, 00409860 c
00409BD9 mov eax, 00409E6C e
00409EA4 mov ecx, 0040A060 am
00409ECD mov ecx, 0040A06C pm
00409FBE mov ecx, 0040A060 am
00409FE7 mov ecx, 0040A06C pm
0040A421 mov ecx, 0040A4B0 1
0040A4E8 mov ecx, 0040A694 1
0040A5AF mov edx, 0040A698 gg
0040A5C8 mov edx, 0040A6A4 gggyyyy
0040A5D5 mov edx, 0040A6A8 yyyy
0040A5EE mov edx, 0040A6B8 eeee
0040A5FD mov edx, 0040A6C0 yy
0040A616 mov edx, 0040A6CC ee
0040A631 mov edx, 0040A6D8 e
0040A7BF mov eax, 0040A87C .
0040A8E8 push 0040A944 \n\n
0040B908 mov ecx, 0040BB88 0
0040B92C mov ecx, 0040BB88 0
0040B976 mov ecx, 0040BB88 0
0040B9AD mov ecx, 0040BB94 m/d/yy
0040B9DA mov ecx, 0040BBA4 mmmm d, yyyy
0040BA1A mov ecx, 0040BBBC am
0040BA3C mov ecx, 0040BBC8 pm
0040BA6E mov ecx, 0040BB88 0
0040BA90 mov edx, 0040BBD4 h
0040BA9F mov edx, 0040BBE0 hh
0040BAAD mov ecx, 0040BB88 0
0040BAD0 mov ecx, 0040BB88 0
0040BAF2 mov edx, 0040BBEC ampm
0040BB01 mov edx, 0040BBFC ampm
0040BB2E push 0040BC18 :mm:ss
0040BD01 push 0040BD38 kernel32.dll
0040C4E5 mov eax, 00416250 hi@
0040C658 mov eax, 0040C2D0 (
0040C670 mov edx, 0040C6B0 0x
0040C7B8 push 0040C890 advapi32.dll
0040C7D7 push 0040C890 advapi32.dll
0040C7FA push 0040C8A0 queryserviceconfig2a
0040C80F push 0040C8B8 queryserviceconfig2w
0040C82E push 0040C8D0 changeserviceconfig2a
0040C843 push 0040C8E8 changeserviceconfig2w
0040C99F mov edx, 0040C9E4 \
0040C9AD mov edx, 0040C9E4 \
0040CD5F push 0040CDE4 -nod32
0040CD92 push 0040CDF4
0040CD97 push 0040CE00 -nod32
0040D364 push 0040D558 oleaut32.dll
0040D377 mov eax, 0040D568 variantchangetypeexvarneg
0040D38D mov eax, 0040D57C varneg
0040D3A3 mov eax, 0040D584 varnot
0040D3B9 mov eax, 0040D58C varadd
0040D3CF mov eax, 0040D594 varsub
0040D3E5 mov eax, 0040D59C varmul
0040D3FB mov eax, 0040D5A4 vardiv
0040D411 mov eax, 0040D5AC varidivvarmod
0040D427 mov eax, 0040D5B4 varmod
0040D43D mov eax, 0040D5BC varand
0040D453 mov eax, 0040D5C4 varor
0040D469 mov eax, 0040D5CC varxor
0040D47F mov eax, 0040D5D4 varcmp
0040D495 mov eax, 0040D5DC vari4fromstr
0040D4AB mov eax, 0040D5EC varr4fromstr
0040D4C1 mov eax, 0040D5FC varr8fromstr
0040D4D7 mov eax, 0040D60C vardatefromstr
0040D4ED mov eax, 0040D61C varcyfromstr
0040D503 mov eax, 0040D62C varboolfromstr
0040D519 mov eax, 0040D63C varbstrfromcy
0040E720 mov ecx, 0040E6AC 璇
0040F8D6 mov edx, 0040F9C0 string
0040F974 mov edx, 0040F9DC array
0040F987 mov edx, 0040F9EC byref
00411108 push 00411148 .
004116A4 mov edx, 00411790 \n\n
00414289 mov edx, 004143BC $
00414454 push 004144FC config
00414567 push 00414628 config
004145C6 mov edx, 00414638 hacker
00414A8E push 00414BB4 del "
00414AA6 push 00414BC4 "
00414AD6 mov edx, 00414BD0 del %0
00414D76 push 00415214 \
00414D7B push 00415220 system64.dat
00414D9F mov edx, 00415238 |
00414DCE mov edx, 00415238 |
00414DFD mov edx, 00415238 |
00414E2C mov edx, 00415238 |
00414E5B mov edx, 00415238 |
00414E8A mov edx, 00415238 |
00414EBC push 00415214 \
00414EC1 push 00415244 nv9_disp.dll
00414F06 mov eax, 00415258 bits
00414F3E mov eax, 00415268 [q[\metk}zzmf|kgf|zgd[m|t[mz~akm{tja\[txiziem|mz{
00414F52 mov ecx, 0041529C servicedll
00414F65 mov eax, 004152B0 [q[\metkgf|zgd[m|88;t[mz~akm{tja\[txiziem|mz{
00414F79 mov ecx, 0041529C servicedll
00414FF2 mov ecx, 004152E8 %systemroot%\system32\svchost.exe -k netservicesoftware\microsoft\windows nt\currentversion\svchost
00415009 push 00415318 software\microsoft\windows nt\currentversion\svchost
00415030 push 00415350 netservice
0041506B mov edx, 00415364 system\currentcontrolset\services\
0041509B push 0041538C dependongroup
004150AD push 0041539C rpcss
004150B6 push 004153A4 dependonserviceenum
004150CB push 004153B4 enum
004150DB push 004153C4 root\legacy_
004150F1 push 004153DC \0000
00415112 push 004153C4 root\legacy_
00415128 push 004153DC \0000
00415147 push 004153E4 0
0041516D push 00415364 system\currentcontrolset\services\
0041519F mov ecx, 0041529C servicedll |
发表于 2009-3-8 20:43:11
发表于 2009-3-8 20:48:15
发表于 2009-3-8 20:55:47
