Question

下面汇编代码是什么意思

push ebp
mov ebp,esp
xor edi,edi
push edi
sub esp,04h
mov [ebp-08h],63h //c
mov [ebp-07h],6Dh //m
mov [ebp-06h],64h //d
mov [ebp-05h],2Eh //.
mov [ebp-04h],65h //e
mov [ebp-03h],78h //x
mov [ebp-02h],65h //e
push 1
lea eax,[ebp-08h]
push eax
mov edx,0x7c86114d
call edx
leave //mov esp,ebp pop ebp

Answer 1

push ebp
mov ebp,esp ；
xor edi,edi
push edi ;局部变量
sub esp,04h ；局部变量
mov [ebp-08h],63h //c
mov [ebp-07h],6Dh //m
mov [ebp-06h],64h //d
mov [ebp-05h],2Eh //.
mov [ebp-04h],65h //e
mov [ebp-03h],78h //x
mov [ebp-02h],65h //e 局部变量赋值
push 1 ；压入参数
lea eax,[ebp-08h]
push eax ；压入参数,字符串的首地址
mov edx,0x7c86114d
call edx ；调用winexec
leave //mov esp,ebp pop ebp

很简单，就是调用一个API函数，该函数在0x7c86114d。这个和WINDOWS版本有关，在win sp2上是winexec函数,相当于:
winexec("cmd.exe", 1)

Answer 2

貌似是执行cmd.exe程序