VC++ 入口特征

 

***********
Stolen Code

push ebp
mov ebp,esp
push -1
push 49A4A8
push 4363B8
mov eax,dword ptr fs:[0]
push eax
mov dword ptr fs:[0],esp
sub esp,58
push ebx
push esi
push edi          
mov dword ptr ss:[ebp-18],esp

55 8B EC 6A FF 68 A8 A4 49 00 68 B8 63 43 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
53 56 57 89 65 E8