004AA68A . 8D85 E3FBFFFF lea eax,dword ptr ss:[ebp-0x41D]
004AA690 . BA 00040000 mov edx,0x400
004AA695 . E8 46C8F5FF call ZHWE.00406EE0 ; 第6个参数 【分配内存单元256】
004AA69A . 8D85 E3FBFFFF lea eax,dword ptr ss:[ebp-0x41D]
004AA6A0 . 50 push eax
004AA6A1 . 8D85 DCFBFFFF lea eax,dword ptr ss:[ebp-0x424] ; 第5个参数
004AA6A7 . E8 30FEFFFF call ZHWE.004AA4DC
004AA6AC . 8B85 DCFBFFFF mov eax,dword ptr ss:[ebp-0x424]
004AA6B2 . E8 A59EF5FF call ZHWE.0040455C
004AA6B7 . 50 push eax
004AA6B8 . 8B45 14 mov eax,dword ptr ss:[ebp+0x14] ; 第4个参数
004AA6BB . E8 9C9EF5FF call ZHWE.0040455C
004AA6C0 . 50 push eax
004AA6C1 . 8B45 18 mov eax,dword ptr ss:[ebp+0x18] ; 第3个参数
004AA6C4 . E8 939EF5FF call ZHWE.0040455C
004AA6C9 . 50 push eax
004AA6CA . 8B45 1C mov eax,dword ptr ss:[ebp+0x1C] ; 第2个参数
004AA6CD . E8 8A9EF5FF call ZHWE.0040455C
004AA6D2 . 50 push eax
004AA6D3 . 8B45 24 mov eax,dword ptr ss:[ebp+0x24] ; 第1个参数
004AA6D6 . E8 819EF5FF call ZHWE.0040455C
004AA6DB . 50 push eax
004AA6DC . E8 F3FDFFFF call <jmp.&perfect.generate_response> ;//堆栈压入了上面6个参数后,调用perfect.dll里面的generate_response函数(过程)
//下面是压入堆栈的参数信息
//参数1 01F15970 ASCII "10F569827F101EA9466BB22E6FB6F938"
//参数2 01F15418 ASCII "1258602986"
//参数3 01F0EF88 ASCII "password"
//参数4 01F15EB8 ASCII "BCC6EC5D19519737EC1E51D6620AA3B7B7174793727F26A9A92B215C689B852C48B13BEC6141EC368BABDF8119FF57747B57CC9388DECFBC8108DEC0DDB51125CFFF16F0DBEB36537B43D43DFF6BE719874B112AF5965CDB846AD293D0485B8E5D470F5281DCEE7FE9D9F2301BE30ECCAC3D77E56356F86961AEFE82E6149821010001"...
//参数5 01F15FE0 ASCII "30AC0ED21EE6A2EB26F0ECF770FCB2FF3704BB09FD0B811005154718CB1D4F22"
//参数6 0018D267 //分配了256个空的内存单元,用于存放generate_response执行后的结果
==========================================================================
//参数6 的代码
004AA68A . 8D85 E3FBFFFF lea eax,dword ptr ss:[ebp-0x41D]
004AA690 . BA 00040000 mov edx,0x400
004AA695 . E8 46C8F5FF call ZHWE.00406EE0 ; 第6个参数 【分配内存地址256】
004AA69A . 8D85 E3FBFFFF lea eax,dword ptr ss:[ebp-0x41D]
004AA6A0 . 50 push eax
--CALL--00406EE0-------------
00406EE0 /$ 33C9 xor ecx,ecx
00406EE2 |. E8 15BDFFFF call ZHWE.00402BFC
00406EE7 \. C3 retn
--CALL--00402BFC-------------
00402BFC /$ 57 push edi
00402BFD |. 89C7 mov edi,eax
00402BFF |. 88CD mov ch,cl
00402C01 |. 89C8 mov eax,ecx
00402C03 |. C1E0 10 shl eax,0x10
00402C06 |. 66:89C8 mov ax,cx
00402C09 |. 89D1 mov ecx,edx
00402C0B |. C1F9 02 sar ecx,0x2
00402C0E |. 78 09 js XZHWE.00402C19
00402C10 |. F3:AB rep stos dword ptr es:[edi]
00402C12 |. 89D1 mov ecx,edx
00402C14 |. 83E1 03 and ecx,0x3
00402C17 |. F3:AA rep stos byte ptr es:[edi]
00402C19 |> 5F pop edi
00402C1A \. C3 retn
==========================================================================
//参数5 的代码
004AA6A1 . 8D85 DCFBFFFF lea eax,dword ptr ss:[ebp-0x424] ; 第5个参数
004AA6A7 . E8 30FEFFFF call ZHWE.004AA4DC
004AA6AC . 8B85 DCFBFFFF mov eax,dword ptr ss:[ebp-0x424]
004AA6B2 . E8 A59EF5FF call ZHWE.0040455C
004AA6B7 . 50 push eax
--CALL--004AA4DC-------------
004AA4DC /$ 55 push ebp
004AA4DD |. 8BEC mov ebp,esp
004AA4DF |. 83C4 F0 add esp,-0x10 ; +16
004AA4E2 |. 33D2 xor edx,edx ; =0
004AA4E4 |. 8955 F0 mov [local.4],edx
004AA4E7 |. 8945 FC mov [local.1],eax
004AA4EA |. 33C0 xor eax,eax
004AA4EC |. 55 push ebp
004AA4ED |. 68 53A54A00 push ZHWE.004AA553
004AA4F2 |. 64:FF30 push dword ptr fs:[eax]
004AA4F5 |. 64:8920 mov dword ptr fs:[eax],esp
004AA4F8 |. 33C0 xor eax,eax
004AA4FA |. 8945 F8 mov [local.2],eax
004AA4FD |> E8 4684F5FF /call ZHWE.00402948
004AA502 |. BA FFFFFF7F |mov edx,0x7FFFFFFF
004AA507 |. 33C0 |xor eax,eax
004AA509 |. E8 E2A9F7FF |call ZHWE.00424EF0
004AA50E |. 25 FFFF0000 |and eax,0xFFFF
004AA513 |. 8945 F4 |mov [local.3],eax
004AA516 |. 8D4D F0 |lea ecx,[local.4]
004AA519 |. BA 04000000 |mov edx,0x4
004AA51E |. 8B45 F4 |mov eax,[local.3]
004AA521 |. E8 82E2F5FF |call ZHWE.004087A8
004AA526 |. 8B55 F0 |mov edx,[local.4]
004AA529 |. 8B45 FC |mov eax,[local.1]
004AA52C |. E8 339EF5FF |call ZHWE.00404364
004AA531 |. 8B45 FC |mov eax,[local.1]
004AA534 |. FF45 F8 |inc [local.2]
004AA537 |. 837D F8 10 |cmp [local.2],0x10
004AA53B |.^ 75 C0 \jnz XZHWE.004AA4FD
004AA53D |. 33C0 xor eax,eax
004AA53F |. 5A pop edx
004AA540 |. 59 pop ecx
004AA541 |. 59 pop ecx
004AA542 |. 64:8910 mov dword ptr fs:[eax],edx
004AA545 |. 68 5AA54A00 push ZHWE.004AA55A
004AA54A |> 8D45 F0 lea eax,[local.4]
004AA54D |. E8 4A9BF5FF call ZHWE.0040409C
004AA552 \. C3 retn
004AA553 .^ E9 2895F5FF jmp ZHWE.00403A80
004AA558 .^ EB F0 jmp XZHWE.004AA54A
004AA55A . 8BE5 mov esp,ebp
004AA55C . 5D pop ebp
004AA55D . C3 retn
--CALL--0040455C-------------
0040455C /$ 85C0 test eax,eax
0040455E |. 74 02 je XZHWE.00404562
00404560 |. C3 retn
00404561 | 00 db 00
00404562 |> B8 61454000 mov eax,ZHWE.00404561
00404567 \. C3 retn
==========================================================================
//参数1至4 的代码
004AA6B8 . 8B45 14 mov eax,dword ptr ss:[ebp+0x14] ; 第4个参数
004AA6BB . E8 9C9EF5FF call ZHWE.0040455C
004AA6C0 . 50 push eax
004AA6C1 . 8B45 18 mov eax,dword ptr ss:[ebp+0x18] ; 第3个参数
004AA6C4 . E8 939EF5FF call ZHWE.0040455C
004AA6C9 . 50 push eax
004AA6CA . 8B45 1C mov eax,dword ptr ss:[ebp+0x1C] ; 第2个参数
004AA6CD . E8 8A9EF5FF call ZHWE.0040455C
004AA6D2 . 50 push eax
004AA6D3 . 8B45 24 mov eax,dword ptr ss:[ebp+0x24] ; 第1个参数
004AA6D6 . E8 819EF5FF call ZHWE.0040455C
--CALL--0040455C-------------
0040455C /$ 85C0 test eax,eax
0040455E |. 74 02 je XZHWE.00404562
00404560 |. C3 retn
00404561 | 00 db 00
00404562 |> B8 61454000 mov eax,ZHWE.00404561
00404567 \. C3 retn
====================================
经我分析:generate_response 共传入了6个参数。
参数1 到 参数4 可能是字符串类型(因都调用了相同的call ZHWE.0040455C)。
参数5 和 参数6 不太清楚是什么类型,请高手们帮我分析下。我对汇编基本不了解
问题1:分析这6个参数的类型(最好能用DELPHI7 表示出来,比如字符串为string -----其它语言也可)。
2:分析generate_response是什么类型
注:若需要某个调用的CALL内容,请告诉我,我贴上面.
谢谢!
perfect.generate_response的内容如下:
004AA690 . BA 00040000 mov edx,0x400
004AA695 . E8 46C8F5FF call ZHWE.00406EE0 ; 第6个参数 【分配内存单元256】
004AA69A . 8D85 E3FBFFFF lea eax,dword ptr ss:[ebp-0x41D]
004AA6A0 . 50 push eax
004AA6A1 . 8D85 DCFBFFFF lea eax,dword ptr ss:[ebp-0x424] ; 第5个参数
004AA6A7 . E8 30FEFFFF call ZHWE.004AA4DC
004AA6AC . 8B85 DCFBFFFF mov eax,dword ptr ss:[ebp-0x424]
004AA6B2 . E8 A59EF5FF call ZHWE.0040455C
004AA6B7 . 50 push eax
004AA6B8 . 8B45 14 mov eax,dword ptr ss:[ebp+0x14] ; 第4个参数
004AA6BB . E8 9C9EF5FF call ZHWE.0040455C
004AA6C0 . 50 push eax
004AA6C1 . 8B45 18 mov eax,dword ptr ss:[ebp+0x18] ; 第3个参数
004AA6C4 . E8 939EF5FF call ZHWE.0040455C
004AA6C9 . 50 push eax
004AA6CA . 8B45 1C mov eax,dword ptr ss:[ebp+0x1C] ; 第2个参数
004AA6CD . E8 8A9EF5FF call ZHWE.0040455C
004AA6D2 . 50 push eax
004AA6D3 . 8B45 24 mov eax,dword ptr ss:[ebp+0x24] ; 第1个参数
004AA6D6 . E8 819EF5FF call ZHWE.0040455C
004AA6DB . 50 push eax
004AA6DC . E8 F3FDFFFF call <jmp.&perfect.generate_response> ;//堆栈压入了上面6个参数后,调用perfect.dll里面的generate_response函数(过程)
//下面是压入堆栈的参数信息
//参数1 01F15970 ASCII "10F569827F101EA9466BB22E6FB6F938"
//参数2 01F15418 ASCII "1258602986"
//参数3 01F0EF88 ASCII "password"
//参数4 01F15EB8 ASCII "BCC6EC5D19519737EC1E51D6620AA3B7B7174793727F26A9A92B215C689B852C48B13BEC6141EC368BABDF8119FF57747B57CC9388DECFBC8108DEC0DDB51125CFFF16F0DBEB36537B43D43DFF6BE719874B112AF5965CDB846AD293D0485B8E5D470F5281DCEE7FE9D9F2301BE30ECCAC3D77E56356F86961AEFE82E6149821010001"...
//参数5 01F15FE0 ASCII "30AC0ED21EE6A2EB26F0ECF770FCB2FF3704BB09FD0B811005154718CB1D4F22"
//参数6 0018D267 //分配了256个空的内存单元,用于存放generate_response执行后的结果
==========================================================================
//参数6 的代码
004AA68A . 8D85 E3FBFFFF lea eax,dword ptr ss:[ebp-0x41D]
004AA690 . BA 00040000 mov edx,0x400
004AA695 . E8 46C8F5FF call ZHWE.00406EE0 ; 第6个参数 【分配内存地址256】
004AA69A . 8D85 E3FBFFFF lea eax,dword ptr ss:[ebp-0x41D]
004AA6A0 . 50 push eax
--CALL--00406EE0-------------
00406EE0 /$ 33C9 xor ecx,ecx
00406EE2 |. E8 15BDFFFF call ZHWE.00402BFC
00406EE7 \. C3 retn
--CALL--00402BFC-------------
00402BFC /$ 57 push edi
00402BFD |. 89C7 mov edi,eax
00402BFF |. 88CD mov ch,cl
00402C01 |. 89C8 mov eax,ecx
00402C03 |. C1E0 10 shl eax,0x10
00402C06 |. 66:89C8 mov ax,cx
00402C09 |. 89D1 mov ecx,edx
00402C0B |. C1F9 02 sar ecx,0x2
00402C0E |. 78 09 js XZHWE.00402C19
00402C10 |. F3:AB rep stos dword ptr es:[edi]
00402C12 |. 89D1 mov ecx,edx
00402C14 |. 83E1 03 and ecx,0x3
00402C17 |. F3:AA rep stos byte ptr es:[edi]
00402C19 |> 5F pop edi
00402C1A \. C3 retn
==========================================================================
//参数5 的代码
004AA6A1 . 8D85 DCFBFFFF lea eax,dword ptr ss:[ebp-0x424] ; 第5个参数
004AA6A7 . E8 30FEFFFF call ZHWE.004AA4DC
004AA6AC . 8B85 DCFBFFFF mov eax,dword ptr ss:[ebp-0x424]
004AA6B2 . E8 A59EF5FF call ZHWE.0040455C
004AA6B7 . 50 push eax
--CALL--004AA4DC-------------
004AA4DC /$ 55 push ebp
004AA4DD |. 8BEC mov ebp,esp
004AA4DF |. 83C4 F0 add esp,-0x10 ; +16
004AA4E2 |. 33D2 xor edx,edx ; =0
004AA4E4 |. 8955 F0 mov [local.4],edx
004AA4E7 |. 8945 FC mov [local.1],eax
004AA4EA |. 33C0 xor eax,eax
004AA4EC |. 55 push ebp
004AA4ED |. 68 53A54A00 push ZHWE.004AA553
004AA4F2 |. 64:FF30 push dword ptr fs:[eax]
004AA4F5 |. 64:8920 mov dword ptr fs:[eax],esp
004AA4F8 |. 33C0 xor eax,eax
004AA4FA |. 8945 F8 mov [local.2],eax
004AA4FD |> E8 4684F5FF /call ZHWE.00402948
004AA502 |. BA FFFFFF7F |mov edx,0x7FFFFFFF
004AA507 |. 33C0 |xor eax,eax
004AA509 |. E8 E2A9F7FF |call ZHWE.00424EF0
004AA50E |. 25 FFFF0000 |and eax,0xFFFF
004AA513 |. 8945 F4 |mov [local.3],eax
004AA516 |. 8D4D F0 |lea ecx,[local.4]
004AA519 |. BA 04000000 |mov edx,0x4
004AA51E |. 8B45 F4 |mov eax,[local.3]
004AA521 |. E8 82E2F5FF |call ZHWE.004087A8
004AA526 |. 8B55 F0 |mov edx,[local.4]
004AA529 |. 8B45 FC |mov eax,[local.1]
004AA52C |. E8 339EF5FF |call ZHWE.00404364
004AA531 |. 8B45 FC |mov eax,[local.1]
004AA534 |. FF45 F8 |inc [local.2]
004AA537 |. 837D F8 10 |cmp [local.2],0x10
004AA53B |.^ 75 C0 \jnz XZHWE.004AA4FD
004AA53D |. 33C0 xor eax,eax
004AA53F |. 5A pop edx
004AA540 |. 59 pop ecx
004AA541 |. 59 pop ecx
004AA542 |. 64:8910 mov dword ptr fs:[eax],edx
004AA545 |. 68 5AA54A00 push ZHWE.004AA55A
004AA54A |> 8D45 F0 lea eax,[local.4]
004AA54D |. E8 4A9BF5FF call ZHWE.0040409C
004AA552 \. C3 retn
004AA553 .^ E9 2895F5FF jmp ZHWE.00403A80
004AA558 .^ EB F0 jmp XZHWE.004AA54A
004AA55A . 8BE5 mov esp,ebp
004AA55C . 5D pop ebp
004AA55D . C3 retn
--CALL--0040455C-------------
0040455C /$ 85C0 test eax,eax
0040455E |. 74 02 je XZHWE.00404562
00404560 |. C3 retn
00404561 | 00 db 00
00404562 |> B8 61454000 mov eax,ZHWE.00404561
00404567 \. C3 retn
==========================================================================
//参数1至4 的代码
004AA6B8 . 8B45 14 mov eax,dword ptr ss:[ebp+0x14] ; 第4个参数
004AA6BB . E8 9C9EF5FF call ZHWE.0040455C
004AA6C0 . 50 push eax
004AA6C1 . 8B45 18 mov eax,dword ptr ss:[ebp+0x18] ; 第3个参数
004AA6C4 . E8 939EF5FF call ZHWE.0040455C
004AA6C9 . 50 push eax
004AA6CA . 8B45 1C mov eax,dword ptr ss:[ebp+0x1C] ; 第2个参数
004AA6CD . E8 8A9EF5FF call ZHWE.0040455C
004AA6D2 . 50 push eax
004AA6D3 . 8B45 24 mov eax,dword ptr ss:[ebp+0x24] ; 第1个参数
004AA6D6 . E8 819EF5FF call ZHWE.0040455C
--CALL--0040455C-------------
0040455C /$ 85C0 test eax,eax
0040455E |. 74 02 je XZHWE.00404562
00404560 |. C3 retn
00404561 | 00 db 00
00404562 |> B8 61454000 mov eax,ZHWE.00404561
00404567 \. C3 retn
====================================
经我分析:generate_response 共传入了6个参数。
参数1 到 参数4 可能是字符串类型(因都调用了相同的call ZHWE.0040455C)。
参数5 和 参数6 不太清楚是什么类型,请高手们帮我分析下。我对汇编基本不了解
问题1:分析这6个参数的类型(最好能用DELPHI7 表示出来,比如字符串为string -----其它语言也可)。
2:分析generate_response是什么类型
注:若需要某个调用的CALL内容,请告诉我,我贴上面.
谢谢!
perfect.generate_response的内容如下:
解决方案 »
- delphi关闭窗体时cpu 100%的问题,急!!!
- 显示图像的简单问题,如何让他按y轴显示数据(up有分)应该不太难,怎么没人领分呢?可是问了很久都没人能做出来?郁闷
- 请教高手:如何在iis中用程序(delphi)创建web站点!!!
- 用过fastReport底高人看过来!
- 怎样在OleContainer1中调用word文档时,使鼠标无法拖动(即不准选中文字),主要是防止复制?
- 请问如何的将一个客户端的文件(可能是任何类型的文件)写入到Sql数据库???
- 如何使用 mscomm 控件?!
- 我在分辨率为800*600下写的程序,在十七寸彩显很好但到十五寸彩显下挤成了一团怎么办?
- 关于向注册表写入值
- 怎样把一个按钮的事件与DBNavigator的某个按钮的事件联系起来?
- 关于ADOquery的问题
- 求翻译:一段VC++的SOBEL算子程序,怎么都类型不匹配……
100015F0 >/$ 81EC 2C010000 sub esp,0x12C
100015F6 |. 8B8424 380100>mov eax,dword ptr ss:[esp+0x138]
100015FD |. 8B8C24 340100>mov ecx,dword ptr ss:[esp+0x134]
10001604 |. 53 push ebx
10001605 |. 55 push ebp
10001606 |. 56 push esi
10001607 |. 57 push edi
10001608 |. 50 push eax
10001609 |. 51 push ecx
1000160A |. E8 61FCFFFF call ZHWEpass.10001270
1000160F |. 894424 20 mov dword ptr ss:[esp+0x20],eax
10001613 |. E8 48800000 call ZHWEpass.10009660
10001618 |. 8D5424 40 lea edx,dword ptr ss:[esp+0x40]
1000161C |. 68 01010000 push 0x101
10001621 |. 52 push edx
10001622 |. 8BE8 mov ebp,eax
10001624 |. E8 97FFFFFF call ZHWEpass.100015C0
10001629 |. 8D4424 3C lea eax,dword ptr ss:[esp+0x3C]
1000162D |. 6A 07 push 0x7
1000162F |. 50 push eax
10001630 |. E8 8BFFFFFF call ZHWEpass.100015C0
10001635 |. 8B8424 640100>mov eax,dword ptr ss:[esp+0x164]
1000163C |. 8B9C24 580100>mov ebx,dword ptr ss:[esp+0x158]
10001643 |. B9 40000000 mov ecx,0x40
10001648 |. 8BF0 mov esi,eax
1000164A |. 8D7C24 50 lea edi,dword ptr ss:[esp+0x50]
1000164E |. 05 00010000 add eax,0x100
10001653 |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
10001655 |. 8B08 mov ecx,dword ptr ds:[eax]
10001657 |. 8BFB mov edi,ebx
10001659 |. 894C24 44 mov dword ptr ss:[esp+0x44],ecx
1000165D |. 83C9 FF or ecx,0xFFFFFFFF
10001660 |. 66:8B50 04 mov dx,word ptr ds:[eax+0x4]
10001664 |. 33C0 xor eax,eax
10001666 |. F2:AE repne scas byte ptr es:[edi]
10001668 |. F7D1 not ecx
1000166A |. 51 push ecx
1000166B |. 66:895424 4C mov word ptr ss:[esp+0x4C],dx
10001670 |. E8 778C0100 call ZHWEpass.1001A2EC
10001675 |. 8BD0 mov edx,eax
10001677 |. 8BFB mov edi,ebx
10001679 |. 83C9 FF or ecx,0xFFFFFFFF
1000167C |. 33C0 xor eax,eax
1000167E |. F2:AE repne scas byte ptr es:[edi]
10001680 |. F7D1 not ecx
10001682 |. 8BF1 mov esi,ecx
10001684 |. 8BFA mov edi,edx
10001686 |. C1E9 02 shr ecx,0x2
10001689 |. F3:AB rep stos dword ptr es:[edi]
1000168B |. 8BCE mov ecx,esi
1000168D |. 8BF3 mov esi,ebx
1000168F |. 83E1 03 and ecx,0x3
10001692 |. 895424 3C mov dword ptr ss:[esp+0x3C],edx
10001696 |. F3:AA rep stos byte ptr es:[edi]
10001698 |. 8BFB mov edi,ebx
1000169A |. 83C9 FF or ecx,0xFFFFFFFF
1000169D |. 33C0 xor eax,eax
1000169F |. F2:AE repne scas byte ptr es:[edi]
100016A1 |. F7D1 not ecx
100016A3 |. 49 dec ecx
100016A4 |. 8BFA mov edi,edx
100016A6 |. 8BC1 mov eax,ecx
100016A8 |. 8B5424 34 mov edx,dword ptr ss:[esp+0x34]
100016AC |. C1E9 02 shr ecx,0x2
100016AF |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
100016B1 |. 8BC8 mov ecx,eax
100016B3 |. 33C0 xor eax,eax
100016B5 |. 83E1 03 and ecx,0x3
100016B8 |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
100016BA |. 8BFB mov edi,ebx
100016BC |. 83C9 FF or ecx,0xFFFFFFFF
100016BF |. F2:AE repne scas byte ptr es:[edi]
100016C1 |. F7D1 not ecx
100016C3 |. 49 dec ecx
100016C4 |. 8BD9 mov ebx,ecx
100016C6 |. 8D4C24 2C lea ecx,dword ptr ss:[esp+0x2C]
100016CA |. 51 push ecx
100016CB |. 52 push edx
100016CC |. E8 2FF9FFFF call ZHWEpass.10001000
100016D1 |. 894424 3C mov dword ptr ss:[esp+0x3C],eax
100016D5 |. 83C4 24 add esp,0x24
100016D8 |. 8D4424 14 lea eax,dword ptr ss:[esp+0x14]
100016DC |. 50 push eax
100016DD |. E8 FEFDFFFF call ZHWEpass.100014E0
100016E2 |. 50 push eax
100016E3 |. E8 18F9FFFF call ZHWEpass.10001000
100016E8 |. 8B4C24 18 mov ecx,dword ptr ss:[esp+0x18]
100016EC |. 8B5424 1C mov edx,dword ptr ss:[esp+0x1C]
100016F0 |. 03D1 add edx,ecx
100016F2 |. 894424 24 mov dword ptr ss:[esp+0x24],eax
100016F6 |. 8D441A 01 lea eax,dword ptr ds:[edx+ebx+0x1]
100016FA |. 50 push eax
100016FB |. E8 EC8B0100 call ZHWEpass.1001A2EC
10001700 |. 8B4C24 1C mov ecx,dword ptr ss:[esp+0x1C]
10001704 |. 8BD0 mov edx,eax
10001706 |. 8B4424 20 mov eax,dword ptr ss:[esp+0x20]
1000170A |. 8BFA mov edi,edx
1000170C |. 03C1 add eax,ecx
1000170E |. 895424 40 mov dword ptr ss:[esp+0x40],edx
10001712 |. 8D4C18 01 lea ecx,dword ptr ds:[eax+ebx+0x1]
10001716 |. 33C0 xor eax,eax
10001718 |. 8BF1 mov esi,ecx
1000171A |. C1E9 02 shr ecx,0x2
1000171D |. F3:AB rep stos dword ptr es:[edi]
1000171F |. 8BCE mov ecx,esi
10001721 |. 8B7424 2C mov esi,dword ptr ss:[esp+0x2C]
10001725 |. 83E1 03 and ecx,0x3
10001728 |. F3:AA rep stos byte ptr es:[edi]
1000172A |. 8BCB mov ecx,ebx
1000172C |. 8BFA mov edi,edx
1000172E |. 8BC1 mov eax,ecx
10001730 |. C1E9 02 shr ecx,0x2
10001733 |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
10001735 |. 8BC8 mov ecx,eax
10001737 |. 83E1 03 and ecx,0x3
1000173A |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
1000173C |. 8B4C24 1C mov ecx,dword ptr ss:[esp+0x1C]
10001740 |. 8B7424 24 mov esi,dword ptr ss:[esp+0x24]
10001744 |. 8BC1 mov eax,ecx
10001746 |. 8D3C1A lea edi,dword ptr ds:[edx+ebx]
10001749 |. C1E9 02 shr ecx,0x2
1000174C |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
1000174E |. 8BC8 mov ecx,eax
10001750 |. 83E1 03 and ecx,0x3
10001753 |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
10001755 |. 8B4424 1C mov eax,dword ptr ss:[esp+0x1C]
10001759 |. 8B4C24 20 mov ecx,dword ptr ss:[esp+0x20]
1000175D |. 8B7424 28 mov esi,dword ptr ss:[esp+0x28]
10001761 |. 8D3C02 lea edi,dword ptr ds:[edx+eax]
10001764 |. 8BD1 mov edx,ecx
10001766 |. 03FB add edi,ebx
10001768 |. C1E9 02 shr ecx,0x2
1000176B |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
1000176D |. 8BCA mov ecx,edx
1000176F |. 83E1 03 and ecx,0x3
10001772 |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
10001774 |. E8 97860000 call ZHWEpass.10009E10
10001779 |. 894424 30 mov dword ptr ss:[esp+0x30],eax
1000177D |. E8 8E860000 call ZHWEpass.10009E10
10001782 |. 894424 34 mov dword ptr ss:[esp+0x34],eax
10001786 |. 8D4424 44 lea eax,dword ptr ss:[esp+0x44]
1000178A |. 8D4C24 30 lea ecx,dword ptr ss:[esp+0x30]
1000178E |. 50 push eax
1000178F |. 51 push ecx
10001790 |. E8 4B830000 call ZHWEpass.10009AE0
10001795 |. 8D5424 40 lea edx,dword ptr ss:[esp+0x40]
10001799 |. 8D4424 3C lea eax,dword ptr ss:[esp+0x3C]
1000179D |. 52 push edx
1000179E |. 50 push eax
1000179F |. E8 3C830000 call ZHWEpass.10009AE0
100017A4 |. 8B4C24 40 mov ecx,dword ptr ss:[esp+0x40]
100017A8 |. 55 push ebp
100017A9 |. 894D 10 mov [arg.3],ecx
100017AC |. 8B5424 48 mov edx,dword ptr ss:[esp+0x48]
100017B0 |. 8955 14 mov [arg.4],edx
100017B3 |. C745 18 00000>mov [arg.5],0x0
100017BA |. E8 31810000 call ZHWEpass.100098F0
100017BF |. 8BF8 mov edi,eax
100017C1 |. 57 push edi
100017C2 |. E8 258B0100 call ZHWEpass.1001A2EC
100017C7 |. 8BF0 mov esi,eax
100017C9 |. 8BCF mov ecx,edi
100017CB |. 33C0 xor eax,eax
100017CD |. 8BD1 mov edx,ecx
100017CF |. 8BFE mov edi,esi
100017D1 |. C1E9 02 shr ecx,0x2
100017D4 |. F3:AB rep stos dword ptr es:[edi]
100017D6 |. 8BCA mov ecx,edx
100017D8 |. 6A 01 push 0x1
100017DA |. 83E1 03 and ecx,0x3
100017DD |. 55 push ebp
100017DE |. F3:AA rep stos byte ptr es:[edi]
100017E0 |. 8B4424 3C mov eax,dword ptr ss:[esp+0x3C]
100017E4 |. 8B4C24 40 mov ecx,dword ptr ss:[esp+0x40]
100017E8 |. 8B7C24 60 mov edi,dword ptr ss:[esp+0x60]
100017EC |. 03C8 add ecx,eax
100017EE |. 56 push esi
100017EF |. 03CB add ecx,ebx
100017F1 |. 57 push edi
100017F2 |. 51 push ecx
100017F3 |. E8 18810000 call ZHWEpass.10009910
100017F8 |. 8BD8 mov ebx,eax
100017FA |. 83C4 38 add esp,0x38
100017FD |. 85DB test ebx,ebx
未完,见下楼
10001801 |. 5F pop edi
10001802 |. 5E pop esi
10001803 |. 5D pop ebp
10001804 |. 33C0 xor eax,eax
10001806 |. 5B pop ebx
10001807 |. 81C4 2C010000 add esp,0x12C
1000180D |. C2 1800 retn 0x18
10001810 |> 55 push ebp
10001811 |. E8 CA7F0000 call ZHWEpass.100097E0
10001816 |. 57 push edi
10001817 |. E8 E98C0100 call ZHWEpass.1001A505
1000181C |. 8B5424 24 mov edx,dword ptr ss:[esp+0x24]
10001820 |. 52 push edx
10001821 |. E8 DF8C0100 call ZHWEpass.1001A505
10001826 |. 8B4424 24 mov eax,dword ptr ss:[esp+0x24]
1000182A |. 50 push eax
1000182B |. E8 D58C0100 call ZHWEpass.1001A505
10001830 |. 8B4C24 30 mov ecx,dword ptr ss:[esp+0x30]
10001834 |. 51 push ecx
10001835 |. E8 CB8C0100 call ZHWEpass.1001A505
1000183A |. 53 push ebx
1000183B |. 56 push esi
1000183C |. E8 7FF8FFFF call ZHWEpass.100010C0
10001841 |. 8BF0 mov esi,eax
10001843 |. 83C9 FF or ecx,0xFFFFFFFF
10001846 |. 8BFE mov edi,esi
10001848 |. 33C0 xor eax,eax
1000184A |. 83C4 1C add esp,0x1C
1000184D |. F2:AE repne scas byte ptr es:[edi]
1000184F |. 8BBC24 540100>mov edi,dword ptr ss:[esp+0x154]
10001856 |. F7D1 not ecx
10001858 |. 49 dec ecx
10001859 |. 8BD1 mov edx,ecx
1000185B |. C1E9 02 shr ecx,0x2
1000185E |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds>
10001860 |. 8BCA mov ecx,edx
10001862 |. 83E1 03 and ecx,0x3
10001865 |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[>
10001867 |. 5F pop edi
10001868 |. 5E pop esi
10001869 |. 5D pop ebp
1000186A |. 5B pop ebx
1000186B |. 81C4 2C010000 add esp,0x12C
10001871 \. C2 1800 retn 0x18
完!!!