[Asm] 纯文本查看 复制代码
000 | 004F8DC2 | F70485 005C6500 04000000 | test dword ptr ds:[eax*4+655C00],4 | eax: 1-> 1 ebx: 2E85808-> 2E85808 ecx: 2E85808-> | 00655C04: 4-> 4 |
001 | 004F8DCD | 74 25 | je gsp5.4F8DF4 | | |
002 | 004F8DCF | 6A 01 | push 1 | esp: 19F578-> 19F574 | 0019F574: 75AB62A0-> 1 |
003 | 004F8DD1 | BA A1010000 | mov edx,1A1 | edx: 0-> 1A1 | |
004 | 004F8DD6 | E8 F593FBFF | call <gsp5.sub_4B21D0> | ebx: 2E85808-> 19F368 ecx: 2E85808-> 1 edx: 1A1-> | 0019F570: 19F71C-> 4F8DDB |
005 | 004B233D | E8 CE7D0400 | call <gsp5.sub_4FA110> | eax: 1-> 2E82A30 ecx: 1-> 5EDE46 edx: 0-> 28E0000 | 0019F138: 400000-> 4B2342 | 好像CreateDialogIndirectParamW里
006 | 004B2342 | 83C4 0C | add esp,C | esp: 19F13C-> 19F148 | |
007 | 004B2345 | 8B8C24 24040000 | mov ecx,dword ptr ss:[esp+424] | ecx: 5EDE46-> BDFD1CB6 | 0019F56C: BDFD1CB6-> BDFD1CB6 |
008 | 004B234C | 5F | pop edi | esp: 19F148-> 19F14C edi: 779FAF60-> 2E85808 | 0019F148: 2E85808-> 2E85808 | edi:L"逅"
009 | 004B234D | 5E | pop esi | esp: 19F14C-> 19F150 esi: 10E6-> 63C0CC | 0019F14C: 63C0CC-> 63C0CC |
00A | 004B234E | 5D | pop ebp | esp: 19F150-> 19F154 ebp: 77A01BA0-> 19F5B4 | 0019F150: 19F5B4-> 19F5B4 |
00B | 004B234F | 5B | pop ebx | ebx: 19F368-> 2E85808 esp: 19F154-> 19F158 | 0019F154: 2E85808-> 2E85808 |
00C | 004B2350 | 33CC | xor ecx,esp | ecx: BDFD1CB6-> BDE4EDEE | |
00D | 004B2352 | E8 53BA1300 | call gsp5.5EDDAA | | 0019F154: 2E85808-> 4B2357 |
00E | 004B2357 | 81C4 18040000 | add esp,418 | esp: 19F158-> 19F570 | |
00F | 004B235D | C3 | ret | esp: 19F570-> 19F574 | 0019F570: 4F8DDB-> 4F8DDB |
010 | 004F8DDB | 83C4 04 | add esp,4 | | |
011 | 004F8DDB | 83C4 04 | add esp,4 | esp: 19F574-> 19F578 | |
012 | 004F8DDE | 33C0 | xor eax,eax | eax: 2E82A30-> 0 | |
013 | 004F8DE0 | 8B4D F4 | mov ecx,dword ptr ss:[ebp-C] | ecx: BDE4EDEE-> 19F644 | 0019F5A8: 19F644-> 19F644 |
014 | 004F8DE3 | 64:890D 00000000 | mov dword ptr fs:[0],ecx | | 00263000: 19F5A8-> 19F644 |
015 | 004F8DEA | 59 | pop ecx | ecx: 19F644-> BDFD185A esp: 19F578-> 19F57C | 0019F578: BDFD185A-> BDFD185A |
016 | 004F8DEB | 5F | pop edi | esp: 19F57C-> 19F580 | 0019F57C: 2E85808-> 2E85808 | edi:L"逅"
017 | 004F8DEC | 5E | pop esi | esp: 19F580-> 19F584 | 0019F580: 63C0CC-> 63C0CC |
018 | 004F8DED | 5B | pop ebx | ebx: 2E85808-> 1 esp: 19F584-> 19F588 | 0019F584: 1-> 1 |
019 | 004F8DEE | 8BE5 | mov esp,ebp | esp: 19F588-> 19F5B4 | |
01A | 004F8DF0 | 5D | pop ebp | esp: 19F5B4-> 19F5B8 ebp: 19F5B4-> 19F5D0 | 0019F5B4: 19F5D0-> 19F5D0 |
01B | 004F8DF1 | C2 0800 | ret 8 | esp: 19F5B8-> 19F5C4 | 0019F5B8: 5A6AD4-> 5A6AD4 |
01C | 005A6AD4 | C3 | ret | esp: 19F5C4-> 19F5C8 | 0019F5C4: 58B8D7-> 58B8D7 |
01D | 0058B8D7 | E9 B1000000 | jmp gsp5.58B98D | | |
01E | 0058B98D | 8BC3 | mov eax,ebx | eax: 0-> 1 | |
01F | 0058B98F | EB 02 | jmp gsp5.58B993 | | |
020 | 0058B993 | 5E | pop esi | esp: 19F5C8-> 19F5CC | 0019F5C8: 63C0CC-> 63C0CC |
021 | 0058B994 | 5B | pop ebx | ebx: 1-> 111 esp: 19F5CC-> 19F5D0 | 0019F5CC: 111-> 111 |
022 | 0058B995 | 5D | pop ebp | esp: 19F5D0-> 19F5D4 ebp: 19F5D0-> 19F600 | 0019F5D0: 19F600-> 19F600 |
023 | 0058B996 | C2 1C00 | ret 1C | esp: 19F5D4-> 19F5F4 | 0019F5D4: 58BAE4-> 58BAE4 |
024 | 0058BAE4 | EB DF | jmp gsp5.58BAC5 | | |
025 | 0058BAC5 | 5E | pop esi | esp: 19F5F4-> 19F5F8 esi: 63C0CC-> 2E85808 | 0019F5F4: 2E85808-> 2E85808 |
026 | 0058BAC6 | 5B | pop ebx | ebx: 111-> E104 esp: 19F5F8-> 19F5FC | 0019F5F8: E104-> E104 |
027 | 0058BAC7 | 5F | pop edi | esp: 19F5FC-> 19F600 | 0019F5FC: 2E85808-> 2E85808 | edi:L"逅"
028 | 0058BAC8 | 5D | pop ebp | esp: 19F600-> 19F604 ebp: 19F600-> 19F61C | 0019F600: 19F61C-> 19F61C |
029 | 0058BAC9 | C2 1000 | ret 10 | esp: 19F604-> 19F618 | 0019F604: 5A6BD9-> 5A6BD9 |
02A | 005A6BD9 | 85C0 | test eax,eax | | |
02B | 005A6BDB | 74 05 | je gsp5.5A6BE2 | | |
02C | 005A6BDD | 33C0 | xor eax,eax | eax: 1-> 0 | |
02D | 005A6BDF | 40 | inc eax | eax: 0-> 1 | |
02E | 005A6BE0 | EB 20 | jmp gsp5.5A6C02 | | |
02F | 005A6C02 | 5E | pop esi | esp: 19F618-> 19F61C esi: 2E85808-> 2E85C90 | 0019F618: 2E85C90-> 2E85C90 |
030 | 005A6C03 | 5D | pop ebp | esp: 19F61C-> 19F620 ebp: 19F61C-> 19F650 | 0019F61C: 19F650-> 19F650 |
031 | 005A6C04 | C2 1000 | ret 10 | esp: 19F620-> 19F634 | 0019F620: 5A9D84-> 5A9D84 |
032 | 005A9D84 | E8 DAD10400 | call <gsp5.sub_5F6F63> | ebx: E104-> 0 ecx: BDFD185A-> 5A9D89 esp: 19F634- | 0019F630: 0-> 5A9D89 |
033 | 005A9D89 | C2 1000 | ret 10 | esp: 19F654-> 19F668 | 0019F654: 5B28B5-> 5B28B5 |
034 | 005B28B5 | 8D4D E8 | lea ecx,dword ptr ss:[ebp-18] | ecx: 5A9D89-> 19F678 | |
035 | 005B28B8 | 8BF0 | mov esi,eax | esi: 2E85C90-> 1 | |
036 | 005B28BA | E8 3DFFFFFF | call <gsp5.sub_5B27FC> | eax: 1-> A39C98 ecx: 19F678-> 0 edx: 28E0000-> 0 | 0019F664: 0-> 5B28BF |
037 | 005B28BF | 8BC6 | mov eax,esi | eax: A39C98-> 1 | |
038 | 005B28C1 | EB 02 | jmp gsp5.5B28C5 | | |
039 | 005B28C5 | E8 99460400 | call <gsp5.sub_5F6F63> | ecx: 0-> 5B28CA esp: 19F668-> 19F694 ebp: 19F690- | 0019F664: 5B28BF-> 5B28CA |
03A | 005B28CA | C2 1000 | ret 10 | esp: 19F694-> 19F6A8 | 0019F694: 590863-> 590863 |
03B | 00590863 | 85C0 | test eax,eax | | |
03C | 00590865 | 74 13 | je gsp5.59087A | | |
03D | 00590867 | 8D4D E8 | lea ecx,dword ptr ss:[ebp-18] | ecx: 5B28CA-> 19F6B8 | |
03E | 0059086A | E8 45F9FFFF | call <gsp5.sub_5901B4> | eax: 1-> A39C98 ecx: 19F6B8-> 0 | 0019F6A4: 0-> 59086F |
03F | 0059086F | 33C0 | xor eax,eax | eax: A39C98-> 0 | |
040 | 00590871 | 40 | inc eax | eax: 0-> 1 | |
041 | 00590872 | E8 EC660600 | call <gsp5.sub_5F6F63> | ecx: 0-> 590877 esp: 19F6A8-> 19F6D4 ebp: 19F6D0- | 0019F6A4: 59086F-> 590877 |
042 | 00590877 | C2 1000 | ret 10 | esp: 19F6D4-> 19F6E8 | 0019F6D4: 58255A-> 58255A |
043 | 0058255A | 5F | pop edi | esp: 19F6E8-> 19F6EC edi: E104-> 2E85980 | 0019F6E8: 2E85980-> 2E85980 | edi:L"逅"
044 | 0058255B | 5E | pop esi | esp: 19F6EC-> 19F6F0 esi: 2E85980-> E104 | 0019F6EC: E104-> E104 |
045 | 0058255C | 5B | pop ebx | ebx: 0-> 111 esp: 19F6F0-> 19F6F4 | 0019F6F0: 111-> 111 |
046 | 0058255D | C9 | leave | esp: 19F6F4-> 19F724 ebp: 19F720-> 19F7D4 | |
047 | 0058255E | C2 0800 | ret 8 | esp: 19F724-> 19F730 | 0019F724: 59043C-> 59043C |
048 | 0059043C | 5B | pop ebx | esp: 19F730-> 19F734 | 0019F730: 111-> 111 |
049 | 0059043D | 5F | pop edi | esp: 19F734-> 19F738 | 0019F734: 2E85980-> 2E85980 | edi:L"逅"
04A | 0059043E | 5E | pop esi | esp: 19F738-> 19F73C esi: E104-> 2E85980 | 0019F738: 2E85980-> 2E85980 |
04B | 0059043F | C2 0800 | ret 8 | esp: 19F73C-> 19F748 | 0019F73C: 583289-> 583289 |
04C | 00583289 | 85C0 | test eax,eax | | |
04D | 0058328B | 0F84 D2010000 | je gsp5.583463 | | |
04E | 00583291 | C745 F0 01000000 | mov dword ptr ss:[ebp-10],1 | | 0019F7C4: 0-> 1 |
04F | 00583298 | E9 AD040000 | jmp gsp5.58374A | | |
050 | 0058374A | 8B45 14 | mov eax,dword ptr ss:[ebp+14] | eax: 1-> 19F7F0 | 0019F7E8: 19F7F0-> 19F7F0 |
051 | 0058374D | 85C0 | test eax,eax | | |
052 | 0058374F | 74 05 | je gsp5.583756 | | |
053 | 00583751 | 8B4D F0 | mov ecx,dword ptr ss:[ebp-10] | ecx: 590877-> 1 | 0019F7C4: 1-> 1 |
054 | 00583754 | 8908 | mov dword ptr ds:[eax],ecx | | 0019F7F0: 0-> 1 |
055 | 00583756 | 834D FC FF | or dword ptr ss:[ebp-4],FFFFFFFF | | 0019F7D0: 0-> FFFFFFFF |
056 | 0058375A | 8D4D EC | lea ecx,dword ptr ss:[ebp-14] | ecx: 1-> 19F7C0 | | [ebp-14]:&"P*O"
057 | 0058375D | E8 1BBBFFFF | call <gsp5.sub_57F27D> | eax: 19F7F0-> 7FFFFFFF | 0019F744: 0-> 583762 |
058 | 00583762 | 33C0 | xor eax,eax | eax: 7FFFFFFF-> 0 | |
059 | 00583764 | 40 | inc eax | eax: 0-> 1 | |
05A | 00583765 | E9 07FDFFFF | jmp gsp5.583471 | | |
05B | 00583471 | E8 ED3A0700 | call <gsp5.sub_5F6F63> | ebx: 111-> A39C98 ecx: 19F7C0-> 583476 esp: 19F74 | 0019F744: 583762-> 583476 |
05C | 00583476 | C2 1000 | ret 10 | esp: 19F7D8-> 19F7EC | 0019F7D8: 57E78F-> 57E78F |
05D | 0057E78F | 85C0 | test eax,eax | | |
05E | 0057E791 | 75 16 | jne gsp5.57E7A9 | | |
05F | 0057E7A9 | 8B45 FC | mov eax,dword ptr ss:[ebp-4] | | 0019F7F0: 1-> 1 |
060 | 0057E7AC | 5E | pop esi | esp: 19F7EC-> 19F7F0 | 0019F7EC: 2E85980-> 2E85980 |
061 | 0057E7AD | C9 | leave | esp: 19F7F0-> 19F7F8 ebp: 19F7F4-> 19F85C | |
062 | 0057E7AE | C2 0C00 | ret C | esp: 19F7F8-> 19F808 | 0019F7F8: 5815B1-> 5815B1 |
063 | 005815B1 | 81FF 10010000 | cmp edi,110 | | | edi:L"逅"
064 | 005815B7 | 8945 18 | mov dword ptr ss:[ebp+18],eax | | 0019F874: 0-> 1 |
065 | 005815BA | 75 38 | jne gsp5.5815F4 | | |
066 | 005815F4 | 8B45 18 | mov eax,dword ptr ss:[ebp+18] | | 0019F874: 1-> 1 |
067 | 005815F7 | 6A 07 | push 7 | esp: 19F808-> 19F804 | 0019F804: 0-> 7 |
068 | 005815F9 | 8D7B 58 | lea edi,dword ptr ds:[ebx+58] | edi: 111-> A39CF0 | | edi:L"逅", ebx+58:L"400000:b:00010003:00000006:000612EF"
069 | 005815FC | 59 | pop ecx | ecx: 583476-> 7 esp: 19F804-> 19F808 | 0019F804: 7-> 7 |
06A | 005815FD | 8D75 BC | lea esi,dword ptr ss:[ebp-44] | esi: 2E85980-> 19F818 | |
06B | 00581600 | F3:A5 | rep movsd | ecx: 7-> 0 esi: 19F818-> 19F834 edi: A39CF0-> A39 | |
06C | 00581602 | E8 5C590700 | call <gsp5.sub_5F6F63> | ebx: A39C98-> E104 ecx: 0-> 581607 esp: 19F808-> | 0019F804: 7-> 581607 |
06D | 00581607 | C2 1400 | ret 14 | esp: 19F860-> 19F878 | 0019F860: 5931EA-> 5931EA |
06E | 005931EA | 85C0 | test eax,eax | | |
06F | 005931EC | 74 05 | je gsp5.5931F3 | | |
070 | 005931EE | 33C0 | xor eax,eax | eax: 1-> 0 | |
071 | 005931F0 | 40 | inc eax | eax: 0-> 1 | |
072 | 005931F1 | EB 34 | jmp gsp5.593227 | | |
073 | 00593227 | 5F | pop edi | esp: 19F878-> 19F87C | 0019F878: 2E7FAA0-> 2E7FAA0 | edi:L"逅"
074 | 00593228 | 5E | pop esi | esp: 19F87C-> 19F880 esi: 111-> 2E7FAA0 | 0019F87C: 2E7FAA0-> 2E7FAA0 |
075 | 00593229 | 5B | pop ebx | ebx: E104-> 111 esp: 19F880-> 19F884 | 0019F880: 111-> 111 |
076 | 0059322A | C2 0800 | ret 8 | esp: 19F884-> 19F890 | 0019F884: 583289-> 583289 |
077 | 00583289 | 85C0 | test eax,eax | | |
078 | 0058328B | 0F84 D2010000 | je gsp5.583463 | | |
079 | 00583291 | C745 F0 01000000 | mov dword ptr ss:[ebp-10],1 | | 0019F90C: 0-> 1 |
07A | 00583298 | E9 AD040000 | jmp gsp5.58374A | | |
07B | 0058374A | 8B45 14 | mov eax,dword ptr ss:[ebp+14] | eax: 1-> 19F938 | 0019F930: 19F938-> 19F938 |
07C | 0058374D | 85C0 | test eax,eax | | |
07D | 0058374F | 74 05 | je gsp5.583756 | | |
07E | 00583751 | 8B4D F0 | mov ecx,dword ptr ss:[ebp-10] | ecx: 581607-> 1 | 0019F90C: 1-> 1 |
07F | 00583754 | 8908 | mov dword ptr ds:[eax],ecx | | 0019F938: 0-> 1 |
080 | 00583756 | 834D FC FF | or dword ptr ss:[ebp-4],FFFFFFFF | | 0019F918: 0-> FFFFFFFF |
081 | 0058375A | 8D4D EC | lea ecx,dword ptr ss:[ebp-14] | ecx: 1-> 19F908 | | [ebp-14]:&"P*O"
082 | 0058375D | E8 1BBBFFFF | call <gsp5.sub_57F27D> | eax: 19F938-> 7FFFFFFF | 0019F88C: 0-> 583762 |
083 | 00583762 | 33C0 | xor eax,eax | eax: 7FFFFFFF-> 0 | |
084 | 00583764 | 40 | inc eax | eax: 0-> 1 | |
085 | 00583765 | E9 07FDFFFF | jmp gsp5.583471 | | |
086 | 00583471 | E8 ED3A0700 | call <gsp5.sub_5F6F63> | ebx: 111-> A39C98 ecx: 19F908-> 583476 esp: 19F89 | 0019F88C: 583762-> 583476 |
087 | 00583476 | C2 1000 | ret 10 | esp: 19F920-> 19F934 | 0019F920: 57E78F-> 57E78F |
088 | 0057E78F | 85C0 | test eax,eax | | |
089 | 0057E791 | 75 16 | jne gsp5.57E7A9 | | |
08A | 0057E7A9 | 8B45 FC | mov eax,dword ptr ss:[ebp-4] | | 0019F938: 1-> 1 |
08B | 0057E7AC | 5E | pop esi | esp: 19F934-> 19F938 | 0019F934: 2E7FAA0-> 2E7FAA0 |
08C | 0057E7AD | C9 | leave | esp: 19F938-> 19F940 ebp: 19F93C-> 19F9A4 | |
08D | 0057E7AE | C2 0C00 | ret C | esp: 19F940-> 19F950 | 0019F940: 5815B1-> 5815B1 |
08E | 005815B1 | 81FF 10010000 | cmp edi,110 | | | edi:L"逅"
08F | 005815B7 | 8945 18 | mov dword ptr ss:[ebp+18],eax | | 0019F9BC: 0-> 1 |
090 | 005815BA | 75 38 | jne gsp5.5815F4 | | |
091 | 005815F4 | 8B45 18 | mov eax,dword ptr ss:[ebp+18] | | 0019F9BC: 1-> 1 |
092 | 005815F7 | 6A 07 | push 7 | esp: 19F950-> 19F94C | 0019F94C: 0-> 7 |
093 | 005815F9 | 8D7B 58 | lea edi,dword ptr ds:[ebx+58] | edi: 111-> A39CF0 | | edi:L"逅", ebx+58:L"400000:b:00010003:00000006:000612EF"
094 | 005815FC | 59 | pop ecx | ecx: 583476-> 7 esp: 19F94C-> 19F950 | 0019F94C: 7-> 7 |
095 | 005815FD | 8D75 BC | lea esi,dword ptr ss:[ebp-44] | esi: 2E7FAA0-> 19F960 | |
096 | 00581600 | F3:A5 | rep movsd | ecx: 7-> 0 esi: 19F960-> 19F97C edi: A39CF0-> A39 | |
097 | 00581602 | E8 5C590700 | call <gsp5.sub_5F6F63> | ebx: A39C98-> 58160A ecx: 0-> 581607 esp: 19F950- | 0019F94C: 7-> 581607 |
098 | 00581607 | C2 1400 | ret 14 | esp: 19F9A8-> 19F9C0 | 0019F9A8: 58163E-> 58163E |
099 | 0058163E | EB 10 | jmp gsp5.581650 | | |
09A | 00581650 | 5E | pop esi | esp: 19F9C0-> 19F9C4 esi: 1126A-> 0 | 0019F9C0: 0-> 0 |
09B | 00581651 | 5D | pop ebp | esp: 19F9C4-> 19F9C8 ebp: 19F9C4-> 19F9F0 | 0019F9C4: 19F9F0-> 19F9F0 |
09C | 00581652 | C2 1000 | ret 10 | esp: 19F9C8-> 19F9DC | 0019F9C8: 75AB438B-> 75AB438B |
09D | 75AB438B | 64:8025 CA0F0000 FE | and byte ptr fs:[FCA],FE | | 00263FCA: 620-> 620 |
09E | 75AB4393 | 817C24 04 CDABBADC | cmp dword ptr ss:[esp+4],DCBAABCD | | 0019F9E0: DCBAABCD-> DCBAABCD |
09F | 75AB439B | 74 11 | je user32.75AB43AE | | |
0A0 | 75AB43AE | 83C4 08 | add esp,8 | esp: 19F9DC-> 19F9E4 | |
0A1 | 75AB43B1 | 5B | pop ebx | esp: 19F9E4-> 19F9E8 | 0019F9E4: 58160A-> 58160A |
0A2 | 75AB43B2 | 5F | pop edi | esp: 19F9E8-> 19F9EC | 0019F9E8: 111-> 111 | edi:L"逅"
0A3 | 75AB43B3 | 5E | pop esi | esp: 19F9EC-> 19F9F0 | 0019F9EC: 0-> 0 |
0A4 | 75AB43B4 | 5D | pop ebp | esp: 19F9F0-> 19F9F4 ebp: 19F9F0-> 19FAD4 | 0019F9F0: 19FAD4-> 19FAD4 |
0A5 | 75AB43B5 | C2 1400 | ret 14 | esp: 19F9F4-> 19FA0C | 0019F9F4: 75A94F8C-> 75A94F8C |
0A6 | 75A94F8C | 8945 E0 | mov dword ptr ss:[ebp-20],eax | | 0019FAB4: 0-> 1 |
0A7 | 75A94F8F | 8B5D E4 | mov ebx,dword ptr ss:[ebp-1C] | ebx: 58160A-> 1126A | 0019FAB8: 1126A-> 1126A | [ebp-1C]:sub_58160A
0A8 | 75A94F92 | 85F6 | test esi,esi | | |
0A9 | 75A94F94 | 0F85 89000000 | jne user32.75A95023 | | |
0AA | 75A94F9A | 837D D8 00 | cmp dword ptr ss:[ebp-28],0 | | 0019FAAC: 0-> 0 |
0AB | 75A94F9E | 0F85 C9010000 | jne user32.75A9516D | | |
0AC | 75A94FA4 | C745 FC FEFFFFFF | mov dword ptr ss:[ebp-4],FFFFFFFE | | 0019FAD0: 0-> FFFFFFFE |
0AD | 75A94FAB | E8 58020000 | call user32.75A95208 | eax: 1-> 261000 ebx: 1126A-> 1 ecx: 581607-> 8000 | 0019FA08: 0-> 75A94FB0 |
0AE | 75A94FB0 | 83FF 7E | cmp edi,7E | | | edi:L"逅", 7E:'~'
0AF | 75A94FB3 | 0F84 16020000 | je user32.75A951CF | | |
0B0 | 75A94FB9 | 83FF 1A | cmp edi,1A | | | edi:L"逅"
0B1 | 75A94FBC | 0F84 0D020000 | je user32.75A951CF | | |
0B2 | 75A94FC2 | 8B45 E0 | mov eax,dword ptr ss:[ebp-20] | eax: 261000-> 1 | 0019FAB4: 1-> 1 |
0B3 | 75A94FC5 | 8B4D F0 | mov ecx,dword ptr ss:[ebp-10] | ecx: 80006010-> 19FC50 | 0019FAC4: 19FC50-> 19FC50 |
0B4 | 75A94FC8 | 64:890D 00000000 | mov dword ptr fs:[0],ecx | | 00263000: 19FAC4-> 19FC50 |
0B5 | 75A94FCF | 59 | pop ecx | ecx: 19FC50-> 15E6B28 esp: 19FA0C-> 19FA10 | 0019FA0C: 15E6B28-> 15E6B28 |
0B6 | 75A94FD0 | 5F | pop edi | esp: 19FA10-> 19FA14 edi: 111-> 0 | 0019FA10: 0-> 0 | edi:L"逅"
0B7 | 75A94FD1 | 5E | pop esi | esp: 19FA14-> 19FA18 esi: 0-> 14146E0 | 0019FA14: 14146E0-> 14146E0 |
0B8 | 75A94FD2 | 5B | pop ebx | ebx: 1-> 0 esp: 19FA18-> 19FA1C | 0019FA18: 0-> 0 |
0B9 | 75A94FD3 | 8BE5 | mov esp,ebp | esp: 19FA1C-> 19FAD4 | |
0BA | 75A94FD5 | 5D | pop ebp | esp: 19FAD4-> 19FAD8 ebp: 19FAD4-> 19FB38 | 0019FAD4: 19FB38-> 19FB38 |
0BB | 75A94FD6 | C2 1C00 | ret 1C | esp: 19FAD8-> 19FAF8 | 0019FAD8: 75A9473D-> 75A9473D |
0BC | 75A9473D | 64:8B0D 18000000 | mov ecx,dword ptr fs:[18] | ecx: 15E6B28-> 263000 | 00263018: 263000-> 263000 | 00000018:L" &"
0BD | 75A94744 | 8BD0 | mov edx,eax | edx: 19FD9C-> 1 | |
0BE | 75A94746 | 8B81 DC0F0000 | mov eax,dword ptr ds:[ecx+FDC] | eax: 1-> FFFFE000 | 00263FDC: FFFFE000-> FFFFE000 | ecx+FDC:L"592_none_71d995095ae1acb5"
0BF | 75A9474C | 85DB | test ebx,ebx | | |
0C0 | 75A9474E | 0F84 C6000000 | je user32.75A9481A | | |
0C1 | 75A9481A | 85C0 | test eax,eax | | |
0C2 | 75A9481C | 79 02 | jns user32.75A94820 | | |
0C3 | 75A9481E | 03C8 | add ecx,eax | ecx: 263000-> 261000 | |
0C4 | 75A94820 | 81A1 00080000 FFFFFFBF | and dword ptr ds:[ecx+800],BFFFFFFF | | 00261800: 40000388-> 388 | ecx+800:L"ows.isolationautomation_6595b64144ccf1df_1.0.18362.592_none_dff997e855d84330.manifest"
0C5 | 75A9482A | E9 35FFFFFF | jmp user32.75A94764 | | |
0C6 | 75A94764 | 837C24 3C 00 | cmp dword ptr ss:[esp+3C],0 | | 0019FB34: 1388-> 1388 | [esp+3C]:&"P*O"
0C7 | 75A94769 | 8B81 04080000 | mov eax,dword ptr ds:[ecx+804] | eax: FFFFE000-> 0 | 00261804: 0-> 0 | ecx+804:L"s.isolationautomation_6595b64144ccf1df_1.0.18362.592_none_dff997e855d84330.manifest"
0C8 | 75A9476F | 8981 04080000 | mov dword ptr ds:[ecx+804],eax | | 00261804: 0-> 0 | ecx+804:L"s.isolationautomation_6595b64144ccf1df_1.0.18362.592_none_dff997e855d84330.manifest"
0C9 | 75A94775 | 7D 7B | jge user32.75A947F2 | | |
0CA | 75A947F2 | 64:A1 18000000 | mov eax,dword ptr fs:[18] | eax: 0-> 263000 | 00263018: 263000-> 263000 | 00000018:L" &"
0CB | 75A947F8 | 8B88 DC0F0000 | mov ecx,dword ptr ds:[eax+FDC] | ecx: 261000-> FFFFE000 | 00263FDC: FFFFE000-> FFFFE000 |
0CC | 75A947FE | 85C9 | test ecx,ecx | | |
0CD | 75A94800 | 79 02 | jns user32.75A94804 | | |
0CE | 75A94802 | 03C1 | add eax,ecx | eax: 263000-> 261000 | |
0CF | 75A94804 | 81A0 00080000 FFFFFF7F | and dword ptr ds:[eax+800],7FFFFFFF | | 00261800: 388-> 388 |
0D0 | 75A9480E | C780 04080000 00000000 | mov dword ptr ds:[eax+804],0 | | 00261804: 0-> 0 |
0D1 | 75A94818 | EB 86 | jmp user32.75A947A0 | | |
0D2 | 75A947A0 | A1 282CB175 | mov eax,dword ptr ds:[75B12C28] | eax: 261000-> 21040 | 75B12C28: 21040-> 21040 | 75B12C28:&"V\r"
0D3 | 75A947A5 | F600 02 | test byte ptr ds:[eax],2 | | 00021040: D16-> D16 |
0D4 | 75A947A8 | 0F85 B07E0200 | jne user32.75ABC65E | | |
0D5 | 75ABC65E | 807C24 12 00 | cmp byte ptr ss:[esp+12],0 | | 0019FB0A: 1110000-> 1110000 |
0D6 | 75ABC663 | 0F84 4581FDFF | je user32.75A947AE | | |
0D7 | 75A947AE | 8BC2 | mov eax,edx | eax: 21040-> 1 | |
0D8 | 75A947B0 | 5F | pop edi | esp: 19FAF8-> 19FAFC edi: 0-> 14146E0 | 0019FAF8: 14146E0-> 14146E0 | edi:L"逅"
0D9 | 75A947B1 | 5E | pop esi | esp: 19FAFC-> 19FB00 esi: 14146E0-> 1126A | 0019FAFC: 1126A-> 1126A |
0DA | 75A947B2 | 5B | pop ebx | esp: 19FB00-> 19FB04 | 0019FB00: 0-> 0 |
0DB | 75A947B3 | 8BE5 | mov esp,ebp | esp: 19FB04-> 19FB38 | |
0DC | 75A947B5 | 5D | pop ebp | esp: 19FB38-> 19FB3C ebp: 19FB38-> 19FB68 | 0019FB38: 19FB68-> 19FB68 |
0DD | 75A947B6 | C2 1000 | ret 10 | esp: 19FB3C-> 19FB50 | 0019FB3C: 75A94403-> 75A94403 |
0DE | 75A94403 | 5F | pop edi | esp: 19FB50-> 19FB54 edi: 14146E0-> A0 | 0019FB50: A0-> A0 | edi:L"逅"
0DF | 75A94404 | 5E | pop esi | esp: 19FB54-> 19FB58 esi: 1126A-> 2E876A0 | 0019FB54: 2E876A0-> 2E876A0 |
0E0 | 75A94405 | 5B | pop ebx | ebx: 0-> 10005 esp: 19FB58-> 19FB5C | 0019FB58: 10005-> 10005 |
0E1 | 75A94406 | 8BE5 | mov esp,ebp | esp: 19FB5C-> 19FB68 | |
0E2 | 75A94408 | 5D | pop ebp | esp: 19FB68-> 19FB6C ebp: 19FB68-> 19FB90 | 0019FB68: 19FB90-> 19FB90 |
0E3 | 75A94409 | C2 1000 | ret 10 | esp: 19FB6C-> 19FB80 | 0019FB6C: 54D380-> 54D380 |
0E4 | 0054D380 | C3 | ret | esp: 19FB80-> 19FB84 | 0019FB80: 4CDD1D-> 4CDD1D |
0E5 | 004CDD1D | 83C4 04 | add esp,4 | esp: 19FB84-> 19FB88 | |
0E6 | 004CDD20 | 5E | pop esi | esp: 19FB88-> 19FB8C esi: 2E876A0-> 2E7FAA0 | 0019FB88: 2E7FAA0-> 2E7FAA0 |
0E7 | 004CDD21 | 8BE5 | mov esp,ebp | esp: 19FB8C-> 19FB90 | |
0E8 | 004CDD23 | 5D | pop ebp | esp: 19FB90-> 19FB94 ebp: 19FB90-> 19FBB4 | 0019FB90: 19FBB4-> 19FBB4 |
0E9 | 004CDD24 | C3 | ret | esp: 19FB94-> 19FB98 | 0019FB94: 4F98B5-> 4F98B5 |
0EA | 004F98B5 | 833D 08A26B00 00 | cmp dword ptr ds:[6BA208],0 | | 006BA208: 2E85FE8-> 2E85FE8 |
0EB | 004F98BC | 74 2C | je gsp5.4F98EA | | |
0EC | 004F98BE | B8 0180FFFF | mov eax,FFFF8001 | eax: 1-> FFFF8001 | |
0ED | 004F98C3 | 8D5424 10 | lea edx,dword ptr ss:[esp+10] | edx: 1-> 19FBA8 | |
0EE | 004F98C7 | 52 | push edx | esp: 19FB98-> 19FB94 | 0019FB94: 4F98B5-> 19FBA8 |
0EF | 004F98C8 | 66:A3 24F56B00 | mov word ptr ds:[6BF524],ax | | 006BF524: 1A0000-> 1A8001 | 006BF524:L"老老"
0F0 | 004F98CE | 66:A3 26F56B00 | mov word ptr ds:[6BF526],ax | | 006BF526: 1A-> 8001 | 006BF526:L"老"
0F1 | 004F98D4 | FF15 405A6300 | call dword ptr ds:[<&GetCursorPos>] | eax: FFFF8001-> 1 ecx: FFFFE000-> 0 edx: 19FBA8-> | 00635A40: 75A9F000-> 75A9F000 0019FB90: 19FBB4-> |
0F2 | 004F98DA | 8B4424 14 | mov eax,dword ptr ss:[esp+14] | eax: 1-> D7 | 0019FBAC: D7-> D7 | [esp+14]:L"逅"
0F3 | 004F98DE | 8B4C24 10 | mov ecx,dword ptr ss:[esp+10] | ecx: 0-> EB | 0019FBA8: EB-> EB |
0F4 | 004F98E2 | 50 | push eax | esp: 19FB98-> 19FB94 | 0019FB94: 19FBA8-> D7 |
0F5 | 004F98E3 | 51 | push ecx | esp: 19FB94-> 19FB90 | 0019FB90: 4F98DA-> EB |
0F6 | 004F98E4 | FF15 6C596300 | call dword ptr ds:[<&SetPhysicalCursorP | eax: D7-> 1 ecx: EB-> 46D70000 esp: 19FB90-> 19FB | 0063596C: 75AB5850-> 75AB5850 0019FB8C: 19FBB4-> |
0F7 | 004F98EA | 6A 00 | push 0 | esp: 19FB98-> 19FB94 | 0019FB94: D7-> 0 |
0F8 | 004F98EC | E8 EFAFFEFF | call <gsp5.sub_4E48E0> | eax: 1-> 2E85FE8 ecx: 46D70000-> 46D78000 | 0019FB90: EB-> 4F98F1 |
0F9 | 004F98F1 | 8B4424 10 | mov eax,dword ptr ss:[esp+10] | eax: 2E85FE8-> 0 | 0019FBA4: 0-> 0 |
0FA | 004F98F5 | 83C4 04 | add esp,4 | esp: 19FB94-> 19FB98 | |
0FB | 004F98F8 | 33D2 | xor edx,edx | | |
0FC | 004F98FA | E8 61A7F0FF | call <gsp5.sub_404060> | eax: 0-> 2E865E0 ecx: 46D78000-> 2E85FE8 | 0019FB94: 0-> 4F98FF |
0FD | 004F98FF | 5F | pop edi | esp: 19FB98-> 19FB9C edi: A0-> 1 | 0019FB98: 1-> 1 | edi:L"逅"
0FE | 004F9900 | 5E | pop esi | esp: 19FB9C-> 19FBA0 | 0019FB9C: 2E7FAA0-> 2E7FAA0 |
0FF | 004F9901 | 8BE5 | mov esp,ebp | esp: 19FBA0-> 19FBB4 | |
100 | 004F9903 | 5D | pop ebp | esp: 19FBB4-> 19FBB8 ebp: 19FBB4-> 19FC5C | 0019FBB4: 19FC5C-> 19FC5C |
101 | 004F9904 | C3 | ret | esp: 19FBB8-> 19FBBC | 0019FBB8: 517E31-> 517E31 |
102 | 00517E31 | 5B | pop ebx | ebx: 10005-> 111 esp: 19FBBC-> 19FBC0 | 0019FBBC: 111-> 111 |
103 | 00517E32 | 8BC7 | mov eax,edi | eax: 2E865E0-> 1 | | edi:L"逅"
104 | 00517E34 | 5F | pop edi | esp: 19FBC0-> 19FBC4 edi: 1-> 2E7FAA0 | 0019FBC0: 2E7FAA0-> 2E7FAA0 | edi:L"逅"
105 | 00517E35 | C2 0800 | ret 8 | esp: 19FBC4-> 19FBD0 | 0019FBC4: 583289-> 583289 |
106 | 00583289 | 85C0 | test eax,eax | | |
107 | 0058328B | 0F84 D2010000 | je gsp5.583463 | | |
108 | 00583291 | C745 F0 01000000 | mov dword ptr ss:[ebp-10],1 | | 0019FC4C: 0-> 1 |
109 | 00583298 | E9 AD040000 | jmp gsp5.58374A | | |
10A | 0058374A | 8B45 14 | mov eax,dword ptr ss:[ebp+14] | eax: 1-> 19FC78 | 0019FC70: 19FC78-> 19FC78 |
10B | 0058374D | 85C0 | test eax,eax | | |
10C | 0058374F | 74 05 | je gsp5.583756 | | |
10D | 00583751 | 8B4D F0 | mov ecx,dword ptr ss:[ebp-10] | ecx: 2E85FE8-> 1 | 0019FC4C: 1-> 1 |
10E | 00583754 | 8908 | mov dword ptr ds:[eax],ecx | | 0019FC78: 0-> 1 |
10F | 00583756 | 834D FC FF | or dword ptr ss:[ebp-4],FFFFFFFF | | 0019FC58: 0-> FFFFFFFF |
110 | 0058375A | 8D4D EC | lea ecx,dword ptr ss:[ebp-14] | ecx: 1-> 19FC48 | | [ebp-14]:&"P*O"
111 | 0058375D | E8 1BBBFFFF | call <gsp5.sub_57F27D> | eax: 19FC78-> 7FFFFFFF | 0019FBCC: 0-> 583762 |
112 | 00583762 | 33C0 | xor eax,eax | eax: 7FFFFFFF-> 0 | |
113 | 00583764 | 40 | inc eax | eax: 0-> 1 | |
114 | 00583765 | E9 07FDFFFF | jmp gsp5.583471 | | |
115 | 00583471 | E8 ED3A0700 | call <gsp5.sub_5F6F63> | ebx: 111-> A39C98 ecx: 19FC48-> 583476 esp: 19FBD | 0019FBCC: 583762-> 583476 |
116 | 00583476 | C2 1000 | ret 10 | esp: 19FC60-> 19FC74 | 0019FC60: 57E78F-> 57E78F |
117 | 0057E78F | 85C0 | test eax,eax | | |
118 | 0057E791 | 75 16 | jne gsp5.57E7A9 | | |
119 | 0057E7A9 | 8B45 FC | mov eax,dword ptr ss:[ebp-4] | | 0019FC78: 1-> 1 |
11A | 0057E7AC | 5E | pop esi | esp: 19FC74-> 19FC78 | 0019FC74: 2E7FAA0-> 2E7FAA0 |
11B | 0057E7AD | C9 | leave | esp: 19FC78-> 19FC80 ebp: 19FC7C-> 19FCE4 | |
11C | 0057E7AE | C2 0C00 | ret C | esp: 19FC80-> 19FC90 | 0019FC80: 5815B1-> 5815B1 |
11D | 005815B1 | 81FF 10010000 | cmp edi,110 | | | edi:L"逅"
11E | 005815B7 | 8945 18 | mov dword ptr ss:[ebp+18],eax | | 0019FCFC: 0-> 1 |
11F | 005815BA | 75 38 | jne gsp5.5815F4 | | |
120 | 005815F4 | 8B45 18 | mov eax,dword ptr ss:[ebp+18] | | 0019FCFC: 1-> 1 |
121 | 005815F7 | 6A 07 | push 7 | esp: 19FC90-> 19FC8C | 0019FC8C: 0-> 7 |
122 | 005815F9 | 8D7B 58 | lea edi,dword ptr ds:[ebx+58] | edi: 111-> A39CF0 | | edi:L"逅", ebx+58:L"400000:b:00010003:00000006:000612EF"
123 | 005815FC | 59 | pop ecx | ecx: 583476-> 7 esp: 19FC8C-> 19FC90 | 0019FC8C: 7-> 7 |
124 | 005815FD | 8D75 BC | lea esi,dword ptr ss:[ebp-44] | esi: 2E7FAA0-> 19FCA0 | |
125 | 00581600 | F3:A5 | rep movsd | ecx: 7-> 0 esi: 19FCA0-> 19FCBC edi: A39CF0-> A39 | |
126 | 00581602 | E8 5C590700 | call <gsp5.sub_5F6F63> | ebx: A39C98-> 58160A ecx: 0-> 581607 esp: 19FC90- | 0019FC8C: 7-> 581607 |
127 | 00581607 | C2 1400 | ret 14 | esp: 19FCE8-> 19FD00 | 0019FCE8: 58163E-> 58163E |
128 | 0058163E | EB 10 | jmp gsp5.581650 | | |
129 | 00581650 | 5E | pop esi | esp: 19FD00-> 19FD04 esi: 1126A-> 0 | 0019FD00: 0-> 0 |
12A | 00581651 | 5D | pop ebp | esp: 19FD04-> 19FD08 ebp: 19FD04-> 19FD30 | 0019FD04: 19FD30-> 19FD30 |
12B | 00581652 | C2 1000 | ret 10 | esp: 19FD08-> 19FD1C | 0019FD08: 75AB438B-> 75AB438B |
12C | 75AB438B | 64:8025 CA0F0000 FE | and byte ptr fs:[FCA],FE | | 00263FCA: 620-> 620 |
12D | 75AB4393 | 817C24 04 CDABBADC | cmp dword ptr ss:[esp+4],DCBAABCD | | 0019FD20: DCBAABCD-> DCBAABCD |
12E | 75AB439B | 74 11 | je user32.75AB43AE | | |
12F | 75AB43AE | 83C4 08 | add esp,8 | esp: 19FD1C-> 19FD24 | |
130 | 75AB43B1 | 5B | pop ebx | esp: 19FD24-> 19FD28 | 0019FD24: 58160A-> 58160A |
131 | 75AB43B2 | 5F | pop edi | esp: 19FD28-> 19FD2C | 0019FD28: 111-> 111 | edi:L"逅"
132 | 75AB43B3 | 5E | pop esi | esp: 19FD2C-> 19FD30 | 0019FD2C: 0-> 0 |
133 | 75AB43B4 | 5D | pop ebp | esp: 19FD30-> 19FD34 ebp: 19FD30-> 19FE14 | 0019FD30: 19FE14-> 19FE14 |
134 | 75AB43B5 | C2 1400 | ret 14 | esp: 19FD34-> 19FD4C | 0019FD34: 75A94F8C-> 75A94F8C |
135 | 75A94F8C | 8945 E0 | mov dword ptr ss:[ebp-20],eax | | 0019FDF4: 0-> 1 |
136 | 75A94F8F | 8B5D E4 | mov ebx,dword ptr ss:[ebp-1C] | ebx: 58160A-> 1126A | 0019FDF8: 1126A-> 1126A | [ebp-1C]:sub_58160A
137 | 75A94F92 | 85F6 | test esi,esi | | |
138 | 75A94F94 | 0F85 89000000 | jne user32.75A95023 | | |
139 | 75A94F9A | 837D D8 00 | cmp dword ptr ss:[ebp-28],0 | | 0019FDEC: 0-> 0 |
13A | 75A94F9E | 0F85 C9010000 | jne user32.75A9516D | | |
13B | 75A94FA4 | C745 FC FEFFFFFF | mov dword ptr ss:[ebp-4],FFFFFFFE | | 0019FE10: 0-> FFFFFFFE |
13C | 75A94FAB | E8 58020000 | call user32.75A95208 | eax: 1-> 261000 ebx: 1126A-> 1 ecx: 581607-> 8000 | 0019FD48: 0-> 75A94FB0 |
13D | 75A94FB0 | 83FF 7E | cmp edi,7E | | | edi:L"逅", 7E:'~'
13E | 75A94FB3 | 0F84 16020000 | je user32.75A951CF | | |
13F | 75A94FB9 | 83FF 1A | cmp edi,1A | | | edi:L"逅"
140 | 75A94FBC | 0F84 0D020000 | je user32.75A951CF | | |
141 | 75A94FC2 | 8B45 E0 | mov eax,dword ptr ss:[ebp-20] | eax: 261000-> 1 | 0019FDF4: 1-> 1 |
142 | 75A94FC5 | 8B4D F0 | mov ecx,dword ptr ss:[ebp-10] | ecx: 80006010-> 19FE78 | 0019FE04: 19FE78-> 19FE78 |
143 | 75A94FC8 | 64:890D 00000000 | mov dword ptr fs:[0],ecx | | 00263000: 19FE04-> 19FE78 |
144 | 75A94FCF | 59 | pop ecx | ecx: 19FE78-> 15E6FE8 esp: 19FD4C-> 19FD50 | 0019FD4C: 15E6FE8-> 15E6FE8 |
145 | 75A94FD0 | 5F | pop edi | esp: 19FD50-> 19FD54 edi: 111-> A39CD0 | 0019FD50: A39CD0-> A39CD0 | edi:L"逅"
146 | 75A94FD1 | 5E | pop esi | esp: 19FD54-> 19FD58 esi: 0-> 14146E0 | 0019FD54: 14146E0-> 14146E0 |
147 | 75A94FD2 | 5B | pop ebx | ebx: 1-> A39CC8 esp: 19FD58-> 19FD5C | 0019FD58: A39CC8-> A39CC8 |
148 | 75A94FD3 | 8BE5 | mov esp,ebp | esp: 19FD5C-> 19FE14 | |
149 | 75A94FD5 | 5D | pop ebp | esp: 19FE14-> 19FE18 ebp: 19FE14-> 19FE88 | 0019FE14: 19FE88-> 19FE88 |
14A | 75A94FD6 | C2 1C00 | ret 1C | esp: 19FE18-> 19FE38 | 0019FE18: 75A940DE-> 75A940DE |
14B | 75A940DE | 8BD0 | mov edx,eax | edx: 19FD9C-> 1 | |
14C | 75A940E0 | 8955 DC | mov dword ptr ss:[ebp-24],edx | | 0019FE64: 1126A-> 1 |
14D | 75A940E3 | 8B0D 282CB175 | mov ecx,dword ptr ds:[75B12C28] | ecx: 15E6FE8-> 21040 | 75B12C28: 21040-> 21040 | 75B12C28:&"V\r"
14E | 75A940E9 | F601 02 | test byte ptr ds:[ecx],2 | | 00021040: D16-> D16 |
14F | 75A940EC | 0F85 147E0200 | jne user32.75ABBF06 | | |
150 | 75ABBF06 | 837D D4 00 | cmp dword ptr ss:[ebp-2C],0 | | 0019FE5C: 0-> 0 |
151 | 75ABBF0A | 0F84 E281FDFF | je user32.75A940F2 | | |
152 | 75A940F2 | 8BC2 | mov eax,edx | | |
153 | 75A940F4 | 8B4D CC | mov ecx,dword ptr ss:[ebp-34] | ecx: 21040-> 9005 | 0019FE54: 9005-> 9005 |
154 | 75A940F7 | 890F | mov dword ptr ds:[edi],ecx | | 00A39CD0: 0-> 9005 | edi:L"逅"
155 | 75A940F9 | 8B4D F0 | mov ecx,dword ptr ss:[ebp-10] | | 0019FE78: 19FF60-> 19FF60 |
发表于 2021-2-15 10:31
|
发表于 2021-2-15 10:42
