After escaping the ' . 'character the subroutine will return an otherwise unmodified string if there were no asterisks found .

u5728u8f6cu4e49u4e86'.'u5b57u7b26u540euff0cu5982u679cu672au627eu5230u661fu53f7uff0c u5b50u7a0bu5e8fu5219u4f1a u8fd4u56deu4e00u4e2au672au4feeu6539u7684u5b57u7b26u4e32u3002

A subroutine which when called again after an execution resumes at the return point of its previous execution .

u4e00u4e2a u4f8bu884c u7a0bu5e8fuff0cu5728u5f00u59cbu6267u884cu540eu518du4e00u6b21u88abu8c03u7528u65f6uff0cu4eceu5b83u524du6b21u7684u6267u884cu7684 u8fd4u56deu70b9u7ee7u7eedu6267u884cu3002

First according to the process of decompilation classify the obfuscation used by malware into two types pay more attention on two cases i.e. junk insertion and subroutine exception return .

u9996u5148uff0cu5c06u6076u610fu4ee3u7801u4f7fu7528u7684u6df7u6dc6u6280u672fu6309u7167u53cdu7f16u8bd1u7684u8fc7u7a0bu5206u4e3au4e24u7c7buff0cu91cdu70b9u7814u7a76u4e86u5e72u6270u53cdu6c47u7f16u7684u5783u573eu4ee3u7801u63d2u5165u548c u5b50u7a0bu5e8fu5f02u5e38 u8fd4u56deu7b49u60c5u51b5u3002

Then priority analyzing subroutine call and return function presenting its implementation method under interpretive mode presenting simple and reliable implementation control strategy of macroprogram under interpretive mode which settle the nonsynchronous problem between decoding task and total task .

u63a5u7740u91cdu70b9u5206u6790u4e86 u5b50u7a0bu5e8fu8c03u7528u4e0e u8fd4u56deu529fu80fduff0cu63d0u51fau4e86u5176u5728u89e3u91cau65b9u5f0fu4e0bu7684u5b9eu73b0u65b9u6cd5uff1bu63d0u51fau4e86u89e3u91cau65b9u5f0fu4e0bu5b8fu7a0bu5e8fu7b80u5355u53efu9760u7684u5b9eu73b0u63a7u5236u7b56u7565uff0cu89e3u51b3u4e86u8bd1u7801u4efbu52a1u4e0eu603bu4f53u4efbu52a1u4e0du540cu6b65u7684u95eeu9898uff1b