:00616381 8BC3 mov eax, ebx:00616383 E8D4D1FFFF call 0061355<----一个随机处理判断是否逃跑成功:00616388 84C0 test al, al:0061638A 7440 je 006163CC <----不成功就跳走:0061638C 66C743530600 mov [ebx+53], 0006:00616392 B81E000000 mov eax, 0000001E:00616397 E80CC9DEFF call 00402CA8:0061639C 890424 mov dword ptr [esp], eax:0061639F DB0424 fild dword ptr [esp]:006163A2 DB2DDC656100 fld tbyte ptr [006165DC]:006163A8 DEC9 fmulp st(1), st(0):006163AA D80550666100 fadd dword ptr [00616650]:006163B0 DB2DDC656100 fld tbyte ptr [006165DC]:006163B6 DEC1 faddp st(1), st(0):006163B8 DD9BF8D06500 fstp qword ptr [ebx+0065D0F8]:006163BE 9B wait:006163BF C6435201 mov [ebx+52], 01:006163C3 8BC3 mov eax, ebx:006163C5 E8924E0000 call 0061B25C:006163CA EB3F jmp 0061640B * Referenced by a (U)nconditional or (C)onditional Jump at Address:0061638A(C)
关键词：一个外挂的更改案例