发现有MBX@XZXXXS之类的名称,而且有_BOX_区段名，可以肯定这个就是被捆绑并参与程序运行的文件（DLL），
我们下面就有把这个DLL给弄出来.
-----------------------------------------------------------------------------

②抓取捆绑的DLL。
-----------------------------------------------------------------------------
再次载入
0047EB53 >  E8 00000000     call Allok_Vi.0047EB58              《停在EP处。
0047EB58    60              pushad
0047EB59    E8 4F000000     call Allok_Vi.0047EBAD
0047EB5E    FD              std
0047EB5F    BE 208F9F0F     mov esi,0F9F8F20
0047EB64    ED              in eax,dx
0047EB65  ^ 7F 91           jg short Allok_Vi.0047EAF8
-----------------------------------------------------------------------------------------------
我们再验证下我刚才的猜想
BP GetFileTime ,中断后取消断点返回到
00484C92    C745 AC 0000000>mov dword ptr ss:[ebp-54],0
00484C99    EB 09           jmp short Allok_Vi.00484CA4
00484C9B    8B4D AC         mov ecx,dword ptr ss:[ebp-54]
00484C9E    83C1 01         add ecx,1
00484CA1    894D AC         mov dword ptr ss:[ebp-54],ecx
00484CA4    8B55 AC         mov edx,dword ptr ss:[ebp-54]
00484CA7    3B55 9C         cmp edx,dword ptr ss:[ebp-64]
00484CAA    0F83 E3000000   jnb Allok_Vi.00484D93
00484CB0    8B45 AC         mov eax,dword ptr ss:[ebp-54]
00484CB3    C1E0 04         shl eax,4
00484CB6    8B4D E0         mov ecx,dword ptr ss:[ebp-20]
00484CB9    8B51 04         mov edx,dword ptr ds:[ecx+4]
00484CBC    8B4D DC         mov ecx,dword ptr ss:[ebp-24]
00484CBF    030C02          add ecx,dword ptr ds:[edx+eax]

--------------------------------------------------------------------------------------------------
00484CA7    3B55 9C         cmp edx,dword ptr ss:[ebp-64]
堆栈 ss:[0012FBB8]=00000001                           ；捆绑文件数1
edx=00000000
--------------------------------------------------------------------------------------------------
00484CBC    8B4D DC         mov ecx,dword ptr ss:[ebp-24]
堆栈 ss:[0012FBF8]=003C2330, (ASCII "SkinMagic.dll")            ；捆绑文件名
ecx=003C2370
---------------------------------------------------------------------------------------------------
现在我们要为下面的主程序脱壳做准备.
查找字符可以找到2个”EXECUTABLE“双击来到
0048596D    68 C40B4900     push Allok_Vi.00490BC4                                                       ; ASCII "EXECUTABLE"
00485972    8B0D 90184900   mov ecx,dword ptr ds:[491890]                                                ; Allok_Vi.00400108
00485978    51              push ecx
00485979    8B55 E8         mov edx,dword ptr ss:[ebp-18]
0048597C    52              push edx

004859F0    8BE5            mov esp,ebp
004859F2    5D              pop ebp