把自己的汇编代码放在保护代码内

如果真 (汇编_安装 ())
    __ASM{}
汇编_删除 ()

汇编_安装

' __ASM{
' mov eax, dword ptr ss:[ebp+0x08]
' leave
' sub esp, 0x60
' pushfd
' pushad
' push dword ptr ss:[esp+0x84]
' push 0x00
' push eax
' fnsave ss:[esp+0x30]
' fwait
' push dword ptr fs:[0x00000000]
' mov dword ptr fs:[0x00000000], esp
' mov eax, 0x01
' jmp dword ptr ss:[esp+0x0C]
' }

汇编_删除

' __ASM{
' push ecx
' mov ecx, dword ptr fs:[0x00000000]
' lable_0x8:
' cmp ecx, 0xFFFF
' jle lable_0x3A
' mov eax, dword ptr ds:[ecx+0x04]
' cmp eax, dword ptr ss:[ebp+0x08]
' je lable_0x1C
' mov ecx, dword ptr ds:[ecx]
' jmp lable_0x8
' lable_0x1C:
' mov eax, dword ptr ss:[ebp+0x04]
' mov esp, ecx
' pop dword ptr fs:[0x00000000]
' add esp, 0x0C
' mov dword ptr ss:[esp+0x1C], eax
' popad
' popfd
' frstor ss:[esp]
' fwait
' add esp, 0x6C
' jmp eax
' lable_0x3A:
' pop ecx
' nop
' }

汇编_接口

' __ASM{
' mov eax, dword ptr ss:[ebp+0x08]
' cmp dword ptr ds:[eax], 0xC0000025
' je lable_0x51
' cmp dword ptr ds:[eax+0x04], 0x00
' jne lable_0x51
' call lable_0x16
' lable_0x16:
' pop eax
' add eax, 0x06
' jmp lable_0x39
' mov dword ptr fs:[0x00000000], esp
' add esp, 0x10
' popad
' popfd
' frstor ss:[esp]
' fwait
' mov esp, dword ptr fs:[0x00000000]
' xor eax, eax
' jmp dword ptr ss:[esp+0x0C]
' lable_0x39:
' push ecx
' mov ecx, dword ptr ss:[ebp+0x10]
' mov dword ptr ds:[ecx+0xB8], eax
' mov eax, dword ptr ss:[ebp+0x0C]
' mov dword ptr ds:[ecx+0xC4], eax
' pop ecx
' xor eax, eax
' jmp lable_0x56
' lable_0x51:
' mov eax, 0x01
' lable_0x56:
' mov dword ptr ss:[ebp+0x08], eax
' }

完整易

.版本 2

.子程序 汇编_安装, 逻辑型
.参数 保留参数, 子程序指针, 可空, 可空

保留参数 ＝ &汇编_接口
置入代码 ({ 139, 69, 8, 201, 131, 236, 96, 156, 96, 255, 180, 36, 132, 0, 0, 0, 106, 0, 80, 221, 116, 36, 48, 155, 100, 255, 53, 0, 0, 0, 0, 100, 137, 37, 0, 0, 0, 0, 184, 1, 0, 0, 0, 255, 100, 36, 12 })
返回 (真)

.子程序 汇编_接口, 整数型
.参数 异常代码, 整数型
.参数 堆栈结构, 整数型
.参数 线程环境, 整数型
.参数 调度环境, 整数型, , DispatcherContext

置入代码 ({ 139, 69, 8, 129, 56, 37, 0, 0, 192, 116, 70, 131, 120, 4, 0, 117, 64, 232, 0, 0, 0, 0, 88, 131, 192, 6, 235, 29, 100, 137, 37, 0, 0, 0, 0, 131, 196, 16, 97, 157, 221, 36, 36, 155, 100, 139, 37, 0, 0, 0, 0, 51, 192, 255, 100, 36, 12, 81, 139, 77, 16, 137, 129, 184, 0, 0, 0, 139, 69, 12, 137, 129, 196, 0, 0, 0, 89, 51, 192, 235, 5, 184, 1, 0, 0, 0, 137, 69, 8 })
返回 (异常代码)

.子程序 汇编_删除
.参数 保留参数, 子程序指针, 可空

保留参数 ＝ &汇编_接口
置入代码 ({ 81, 100, 139, 13, 0, 0, 0, 0, 129, 249, 255, 255, 0, 0, 126, 42, 139, 65, 4, 59, 69, 8, 116, 4, 139, 9, 235, 236, 139, 69, 4, 139, 225, 100, 143, 5, 0, 0, 0, 0, 131, 196, 12, 137, 68, 36, 28, 97, 157, 221, 36, 36, 155, 131, 196, 108, 255, 224, 89, 144 })