似乎参数不少，进入 CALL 看看：
代码:--------------------------------------------------------------------------------
01710000 55 PUSH EBP
01710001 8BEC MOV EBP, ESP
01710003 60 PUSHA
01710004 9C PUSHF
01710005 8B85 08000000 MOV EAX, [EBP+8] ; ntdll.7C930738
0171000B 81F0 7277B93B XOR EAX, 3BB97772
01710011 81F8 76753122 CMP EAX, 22317576
01710017 0F85 B5000000 JNZ 017100D2
0171001D E8 11000000 CALL 01710033
01710022 58 POP EAX ; 01770019
01710023 9D POPF
01710024 61 POPA
01710025 C9 LEAVE
01710026 81C4 14000000 ADD ESP, 14
0171002C - FFA424 C0FFFFFF JMP [ESP-40]
01710033 5E POP ESI ; 01770019
01710034 81EE 05000000 SUB ESI, 5
0171003A 68 44656C65 PUSH 656C6544
0171003F 68 00008F00 PUSH 8F0000
01710044 68 2E646C6C PUSH 6C6C642E
01710049 68 454C3332 PUSH 32334C45
0171004E 68 4B45524E PUSH 4E52454B
01710053 54 PUSH ESP
01710054 8B85 10000000 MOV EAX, [EBP+10]
0171005A 81F0 19068819 XOR EAX, 19880619
01710060 FF10 CALL [EAX]
01710062 81F8 00000000 CMP EAX, 0
01710068 0F85 0F000000 JNZ 0171007D
0171006E 54 PUSH ESP
0171006F 8B85 14000000 MOV EAX, [EBP+14]
01710075 81F0 03038719 XOR EAX, 19870303
0171007B FF10 CALL [EAX]
0171007D 68 46035465 PUSH 65540346
01710082 68 696D6500 PUSH 656D69
01710087 68 696C6554 PUSH 54656C69
0171008C 68 65417346 PUSH 46734165
01710091 68 6D54696D PUSH 6D69546D
01710096 68 79737465 PUSH 65747379
0171009B 68 47657453 PUSH 53746547
017100A0 54 PUSH ESP
017100A1 50 PUSH EAX
017100A2 8B85 0C000000 MOV EAX, [EBP+C]
017100A8 81F0 42736686 XOR EAX, 86667342
017100AE FF10 CALL [EAX]
017100B0 C606 68 MOV BYTE PTR [ESI], 68
017100B3 8986 01000000 MOV [ESI+1], EAX
017100B9 C9 LEAVE
017100BA 81EC 28000000 SUB ESP, 28
017100C0 50 PUSH EAX
017100C1 58 POP EAX ; 01770019
017100C2 9D POPF
017100C3 61 POPA
017100C4 C9 LEAVE
017100C5 81C4 14000000 ADD ESP, 14
017100CB - FFA424 C0FFFFFF JMP [ESP-40]
--------------------------------------------------------------------------------
