[psac]

006AF1BC 8B9D 31050000 mov ebx,dword ptr ss:[ebp+531] ; ebx=0
006AF1C2 0BDB or ebx,ebx
006AF1C4 74 08 je short DrvStudy.006AF1CE ; ebx==0,跳
006AF1C6 8B03 mov eax,dword ptr ds:[ebx]
006AF1C8 8785 35050000 xchg dword ptr ss:[ebp+535],eax
006AF1CE 8B95 22040000 mov edx,dword ptr ss:[ebp+422] ; 跳到這裡, ebx=0x400000, 基位址
006AF1D4 8B85 2D050000 mov eax,dword ptr ss:[ebp+52D] ; eax=0x400000
006AF1DA 2BD0 sub edx,eax
006AF1DC 74 79 je short DrvStudy.006AF257 ; ecx==0, 跳
下面就是恢復IAT了
006AF257 8B95 22040000 mov edx,dword ptr ss:[ebp+422] ; 跳到這裡, edx=0x400000, 基位址
006AF25D 8BB5 41050000 mov esi,dword ptr ss:[ebp+541] ; esi=0
006AF263 0BF6 or esi,esi
006AF265 74 11 je short DrvStudy.006AF278 ; esi==0, 跳
006AF267 03F2 add esi,edx
006AF269 AD lods dword ptr ds:[esi]
006AF26A 0BC0 or eax,eax
006AF26C 74 0A je short DrvStudy.006AF278
006AF26E 03C2 add eax,edx
006AF270 8BF8 mov edi,eax
006AF272 66:AD lods word ptr ds:[esi]
006AF274 66:AB stos word ptr es:[edi]
006AF276 ^ EB F1 jmp short DrvStudy.006AF269
006AF278 BE 00001E00 mov esi,1E0000 ; 跳到這裡, esi=1e0000
006AF27D 8B95 22040000 mov edx,dword ptr ss:[ebp+422] ; edx=基位址


006AF283 03F2 add esi,edx ; esi=51e0000
006AF285 8B46 0C mov eax,dword ptr ds:[esi+C] ; 指向下一個dll檔案名的RVA
006AF288 85C0 test eax,eax ; 不為空就不跳
006AF28A 0F84 0A010000 je DrvStudy.006AF39A
006AF290 03C2 add eax,edx ; 得到下一個dll檔案名
006AF292 8BD8 mov ebx,eax
006AF294 50 push eax
006AF295 FF95 4D0F0000 call dword ptr ss:[ebp+F4D] ; 取kernel32.dll的關鍵句
006AF29B 85C0 test eax,eax ; 成功, 跳
006AF29D 75 07 jnz short DrvStudy.006AF2A6
006AF29F 53 push ebx
006AF2A0 FF95 510F0000 call dword ptr ss:[ebp+F51]
006AF2A6 8985 45050000 mov dword ptr ss:[ebp+545],eax ; 跳到這裡, kernel32.dll關鍵句存入ebp+545
006AF2AC C785 49050000 00000000 mov dword ptr ss:[ebp+549],0 ; [ebp+549]=0
006AF2B6 8B95 22040000 mov edx,dword ptr ss:[ebp+422] ; edx=基位址
006AF2BC 8B06 mov eax,dword ptr ds:[esi] ; eax=0
006AF2BE 85C0 test eax,eax
006AF2C0 75 03 jnz short DrvStudy.006AF2C5 ; eax==0, 不跳
006AF2C2 8B46 10 mov eax,dword ptr ds:[esi+10] ; IAT的FirThunk基位址
006AF2C5 03C2 add eax,edx
006AF2C7 0385 49050000 add eax,dword ptr ss:[ebp+549] ; 指向下1個API
006AF2CD 8B18 mov ebx,dword ptr ds:[eax]
006AF2CF 8B7E 10 mov edi,dword ptr ds:[esi+10]
006AF2D2 03FA add edi,edx
006AF2D4 03BD 49050000 add edi,dword ptr ss:[ebp+549]
006AF2DA 85DB test ebx,ebx
006AF2DC 0F84 A2000000 je DrvStudy.006AF384
006AF2E2 F7C3 00000080 test ebx,80000000
006AF2E8 75 04 jnz short DrvStudy.006AF2EE
006AF2EA 03DA add ebx,edx
006AF2EC 43 inc ebx ; 取函數名
006AF2ED 43 inc ebx ; 取函數名
006AF2EE 53 push ebx
006AF2EF 81E3 FFFFFF7F and ebx,7FFFFFFF
006AF2F5 53 push ebx ; 函數名入棧
006AF2F6 FFB5 45050000 push dword ptr ss:[ebp+545] ; kernel32.dll關鍵句入棧
006AF2FC FF95 490F0000 call dword ptr ss:[ebp+F49] ; GetProcAddress
006AF302 85C0 test eax,eax
006AF304 5B pop ebx
006AF305 75 6F jnz short DrvStudy.006AF376 ; 跳
取API函數位址成功後跳到下面的地方
006AF376 8907 mov dword ptr ds:[edi],eax ; API位址存入edi指向位址
006AF378 8385 49050000 04 add dword ptr ss:[ebp+549],4 ; 取下一個API
006AF37F ^ E9 32FFFFFF jmp DrvStudy.006AF2B6 ; 跳
006AF384 8906 mov dword ptr ds:[esi],eax
006AF386 8946 0C mov dword ptr ds:[esi+C],eax
006AF389 8946 10 mov dword ptr ds:[esi+10],eax
006AF38C 83C6 14 add esi,14
006AF38F 8B95 22040000 mov edx,dword ptr ss:[ebp+422]
006AF395 ^ E9 EBFEFFFF jmp DrvStudy.006AF285 ; 跳去恢復下個匯入dll中的函數