Ta的论坛

[原创]现学现用之windbg的高级玩法外篇一：获取某软件的聊天记录
楼主，我是菜鸟，有个问题请教一下。
你是怎么通过看导出函数名称“?SaveMsg194@Msg@Util@@YAHPB_WKKKPAUITXMsgPack@@PAUITXData@@@Z”
来推断出函数原型是下面这样子的？
int __cdecl Util::Msg::SaveMsg194(wchar_t const *, unsigned long, unsigned long, unsigned long, struct ITXMsgPack *, struct ITXData *)

winampme

雪币： 20

活跃值： (29)

能力值：

( LV2，RANK：10 )

在线值：

发帖

22

回帖

63

粉丝

0

关注

私信

winampme 2013-10-30 12:23: 0

winampme

雪币： 20

活跃值： (29)

能力值：

( LV2，RANK：10 )

在线值：

发帖

22

回帖

63

粉丝

0

关注

私信

winampme 2013-9-6 20:28: 0

[求助]QQ 2013 sp1 聊天内容获取
大概什么价格哦？本人是菜鸟。

winampme

雪币： 20

活跃值： (29)

能力值：

( LV2，RANK：10 )

在线值：

发帖

22

回帖

63

粉丝

0

关注

私信

winampme 2013-9-5 15:02: 0

[求助]QQ 2013 sp1 聊天内容获取
一个星期前的版本，HOOK savemsg194可以搞定，但现在的QQ2013正式版 sp1截取不到聊天记录了。楼主找到原因了吗？

winampme

雪币： 20

活跃值： (29)

能力值：

( LV2，RANK：10 )

在线值：

发帖

22

回帖

63

粉丝

0

关注

私信

winampme 2013-8-5 16:03: 0

[求助]菜鸟求助（关于调试浏览器的问题）
有人可以帮忙调试下吗？

winampme 雪币： 20 活跃值： (29) 能力值： ( LV2，RANK：10 ) 在线值：发帖 22 回帖 63 粉丝 0 关注私信	winampme 2013-12-11 20:48 0 [求助]用VC2005，2010这些写的软件是不是可以很容易被反编译呢？我几年前用过C#写过软件哦，但记得好像可以用一个软件把源代码反编译出来，结构和我写的代码一样，只是里面的变量名换过了。
winampme 雪币： 20 活跃值： (29) 能力值： ( LV2，RANK：10 ) 在线值：发帖 22 回帖 63 粉丝 0 关注私信	winampme 2013-11-13 18:38 0 [求助]HOOK DLL函数的问题但我是用vc写的代码啊。我需要到vc代码里面输入两段汇编代码吗？另外我里面基本上没做操作哦，只是直接就调用dll中原来的函数。
winampme 雪币： 20 活跃值： (29) 能力值： ( LV2，RANK：10 ) 在线值：发帖 22 回帖 63 粉丝 0 关注私信	winampme 2013-11-13 17:57 0 [求助]HOOK DLL函数的问题看不懂哦
winampme 雪币： 20 活跃值： (29) 能力值： ( LV2，RANK：10 ) 在线值：发帖 22 回帖 63 粉丝 0 关注私信	winampme 2013-11-6 19:08 0 [原创]现学现用之windbg的高级玩法外篇一：获取某软件的聊天记录楼主，我是菜鸟，有个问题请教一下。你是怎么通过看导出函数名称“?SaveMsg194@Msg@Util@@YAHPB_WKKKPAUITXMsgPack@@PAUITXData@@@Z” 来推断出函数原型是下面这样子的？ int __cdecl Util::Msg::SaveMsg194(wchar_t const , unsigned long, unsigned long, unsigned long, struct ITXMsgPack , struct ITXData *)
winampme 雪币： 20 活跃值： (29) 能力值： ( LV2，RANK：10 ) 在线值：发帖 22 回帖 63 粉丝 0 关注私信	winampme 2013-10-30 12:23 0 [求助]请问如何通过逆向得出函数原型？ 31890C6F KernelUt.Util::Msg::GetMsgAbstract 68 DC000000 push 0DC 31890C74 \|. B8 B5C28E31 mov eax, 318EC2B5 31890C79 \|. E8 EA5E0500 call 318E6B68 31890C7E \|. 8B75 0C mov esi, dword ptr [ebp+C] 31890C81 \|. 8B7D 08 mov edi, dword ptr [ebp+8] 31890C84 \|. 8365 A8 00 and dword ptr [ebp-58], 0 31890C88 \|. 85F6 test esi, esi 31890C8A \|. 897D C0 mov dword ptr [ebp-40], edi 31890C8D \|. 8975 B8 mov dword ptr [ebp-48], esi 31890C90 \|. 75 14 jnz short 31890CA6 31890C92 \|. 68 3C7A8F31 push 318F7A3C 31890C97 \|. 8BCF mov ecx, edi 31890C99 \|. FF15 20658F31 call dword ptr [<&Common.CTXStringW::>; Common.CTXStringW::CTXStringW 31890C9F \|. 8BC7 mov eax, edi 31890CA1 \|. E9 6F090000 jmp 31891615 31890CA6 \|> 8D4D DC lea ecx, dword ptr [ebp-24] 31890CA9 \|. FF15 1C658F31 call dword ptr [<&Common.CTXStringW::>; Common.CTXStringW::CTXStringW 31890CAF \|. 8365 B4 00 and dword ptr [ebp-4C], 0 31890CB3 \|. C745 FC 01000>mov dword ptr [ebp-4], 1 31890CBA \|. 8B06 mov eax, dword ptr [esi] 31890CBC \|. 8D4D B4 lea ecx, dword ptr [ebp-4C] 31890CBF \|. 51 push ecx 31890CC0 \|. 56 push esi 31890CC1 \|. C645 FC 02 mov byte ptr [ebp-4], 2 31890CC5 \|. FF50 24 call dword ptr [eax+24] 31890CC8 \|. 8B5D B4 mov ebx, dword ptr [ebp-4C] 31890CCB \|. 85DB test ebx, ebx 31890CCD \|. 8B35 30658F31 mov esi, dword ptr [<&Common.CTXBSTR>; Common.CTXBSTR::~CTXBSTR 31890CD3 \|. 0F84 EF000000 je 31890DC8 31890CD9 \|. 8365 D8 00 and dword ptr [ebp-28], 0 31890CDD \|. 8D45 CC lea eax, dword ptr [ebp-34] 31890CE0 \|. 68 E4CD8F31 push 318FCDE4 ; UNICODE "pCustomData" 31890CE5 \|. 50 push eax 31890CE6 \|. C645 FC 03 mov byte ptr [ebp-4], 3 31890CEA \|. E8 84E3FDFF call 3186F073 31890CEF \|. 59 pop ecx 31890CF0 \|. 59 pop ecx 31890CF1 \|. 8B3B mov edi, dword ptr [ebx] 31890CF3 \|. 8D4D D8 lea ecx, dword ptr [ebp-28] 31890CF6 \|. 51 push ecx 31890CF7 \|. 8BC8 mov ecx, eax 31890CF9 \|. C645 FC 04 mov byte ptr [ebp-4], 4 31890CFD \|. 83C7 50 add edi, 50 31890D00 \|. FF15 2C658F31 call dword ptr [<&Common.CTXBSTR::ope>; Common.CTXBSTR::operator wchar_t * 31890D06 \|. 50 push eax 31890D07 \|. 53 push ebx 31890D08 \|. FF17 call dword ptr [edi] 31890D0A \|. 8D4D CC lea ecx, dword ptr [ebp-34] 31890D0D \|. FFD6 call esi 31890D0F \|. 837D D8 00 cmp dword ptr [ebp-28], 0 31890D13 \|. 0F84 9E000000 je 31890DB7 31890D19 \|. 8D4D C8 lea ecx, dword ptr [ebp-38] 31890D1C \|. FF15 B0608F31 call dword ptr [<&Common.CTXBSTR::CTX>; Common.CTXBSTR::CTXBSTR 31890D22 \|. 8B5D D8 mov ebx, dword ptr [ebp-28] 31890D25 \|. 8D45 A0 lea eax, dword ptr [ebp-60] 31890D28 \|. 68 5CCE8F31 push 318FCE5C ; UNICODE "bsAbstractText" 31890D2D \|. 50 push eax 31890D2E \|. C645 FC 05 mov byte ptr [ebp-4], 5 31890D32 \|. E8 3CE3FDFF call 3186F073 31890D37 \|. 59 pop ecx 31890D38 \|. 59 pop ecx 31890D39 \|. 8945 CC mov dword ptr [ebp-34], eax 31890D3C \|. 8B3B mov edi, dword ptr [ebx] 31890D3E \|. 8D4D C8 lea ecx, dword ptr [ebp-38] 31890D41 \|. C645 FC 06 mov byte ptr [ebp-4], 6 31890D45 \|. 83C7 44 add edi, 44 31890D48 \|. FF15 A8608F31 call dword ptr [<&Common.CTXBSTR::ope>; Common.CTXBSTR::operator& 31890D4E \|. 8B4D CC mov ecx, dword ptr [ebp-34] 31890D51 \|. 50 push eax 31890D52 \|. FF15 2C658F31 call dword ptr [<&Common.CTXBSTR::ope>; Common.CTXBSTR::operator wchar_t * 31890D58 \|. 50 push eax 31890D59 \|. 53 push ebx 31890D5A \|. FF17 call dword ptr [edi] 31890D5C \|. 8D4D A0 lea ecx, dword ptr [ebp-60] 31890D5F \|. C645 FC 05 mov byte ptr [ebp-4], 5 31890D63 \|. FFD6 call esi 31890D65 \|. 8D4D C8 lea ecx, dword ptr [ebp-38] 31890D68 \|. FF15 10618F31 call dword ptr [<&Common.CTXBSTR::IsE>; Common.CTXBSTR::IsEmpty 31890D6E \|. 85C0 test eax, eax 31890D70 \|. 75 40 jnz short 31890DB2 31890D72 \|. 8D45 C8 lea eax, dword ptr [ebp-38] 31890D75 \|. 50 push eax 31890D76 \|. 8D4D DC lea ecx, dword ptr [ebp-24] 31890D79 \|. FF15 8C618F31 call dword ptr [<&Common.CTXStringW::>; Common.CTXStringW::operator= 31890D7F \|. 8B4D C0 mov ecx, dword ptr [ebp-40] 31890D82 \|. 8D45 DC lea eax, dword ptr [ebp-24] 31890D85 \|. 50 push eax 31890D86 \|. FF15 14658F31 call dword ptr [<&Common.CTXStringW::>; Common.CTXStringW::CTXStringW 31890D8C \|. 8D4D C8 lea ecx, dword ptr [ebp-38] 31890D8F \|. C745 A8 01000>mov dword ptr [ebp-58], 1 31890D96 \|. FFD6 call esi 31890D98 \|. 8B45 D8 mov eax, dword ptr [ebp-28] 31890D9B \|> 85C0 test eax, eax 31890D9D \|. C645 FC 02 mov byte ptr [ebp-4], 2 31890DA1 \|. 0F84 4D080000 je 318915F4 31890DA7 \|. 8B08 mov ecx, dword ptr [eax] 31890DA9 \|. 50 push eax 31890DAA \|. FF51 08 call dword ptr [ecx+8] 31890DAD \|. E9 42080000 jmp 318915F4 31890DB2 \|> 8D4D C8 lea ecx, dword ptr [ebp-38] 31890DB5 \|. FFD6 call esi 31890DB7 \|> 8B45 D8 mov eax, dword ptr [ebp-28] 31890DBA \|. 85C0 test eax, eax 31890DBC \|. C645 FC 02 mov byte ptr [ebp-4], 2 31890DC0 \|. 74 06 je short 31890DC8 31890DC2 \|. 8B08 mov ecx, dword ptr [eax] 31890DC4 \|. 50 push eax 31890DC5 \|. FF51 08 call dword ptr [ecx+8] 31890DC8 \|> 8B5D B8 mov ebx, dword ptr [ebp-48] 31890DCB \|. 8B03 mov eax, dword ptr [ebx] 31890DCD \|. 8D4D 80 lea ecx, dword ptr [ebp-80] 31890DD0 \|. 51 push ecx 31890DD1 \|. 33FF xor edi, edi 31890DD3 \|. 53 push ebx 31890DD4 \|. 897D 80 mov dword ptr [ebp-80], edi 31890DD7 \|. FF50 3C call dword ptr [eax+3C] 31890DDA \|. 397D 80 cmp dword ptr [ebp-80], edi 31890DDD \|. 897D D8 mov dword ptr [ebp-28], edi 31890DE0 \|. 0F86 FA070000 jbe 318915E0 31890DE6 \|> 8B03 /mov eax, dword ptr [ebx] 31890DE8 \|. 8B3D 20658F31 \|mov edi, dword ptr [<&Common.CTXStr>; Common.CTXStringW::CTXStringW 31890DEE \|. 8D4D C7 \|lea ecx, dword ptr [ebp-39] 31890DF1 \|. 51 \|push ecx 31890DF2 \|. FF75 D8 \|push dword ptr [ebp-28] 31890DF5 \|. C645 C7 00 \|mov byte ptr [ebp-39], 0 31890DF9 \|. 53 \|push ebx 31890DFA \|. FF50 40 \|call dword ptr [eax+40] 31890DFD \|. 85C0 \|test eax, eax 31890DFF \|. 0F8C 16080000 \|jl 3189161B 31890E05 \|. 0FB645 C7 \|movzx eax, byte ptr [ebp-39] 31890E09 \|. 83F8 07 \|cmp eax, 7 ; Switch (cases 1..14) 31890E0C \|. 0F8F E3030000 \|jg 318911F5 31890E12 \|. 0F84 65040000 \|je 3189127D 31890E18 \|. 48 \|dec eax 31890E19 \|. 0F84 48020000 \|je 31891067 31890E1F \|. 48 \|dec eax 31890E20 \|. 74 18 \|je short 31890E3A 31890E22 \|. 48 \|dec eax 31890E23 \|. 74 0B \|je short 31890E30 31890E25 \|. 48 \|dec eax 31890E26 \|. 48 \|dec eax 31890E27 \|. 74 07 \|je short 31890E30 31890E29 \|. 48 \|dec eax 31890E2A \|. 0F85 A1070000 \|jnz 318915D1 31890E30 \|> 68 B4E68F31 \|push 318FE6B4 ; UNICODE "SYSMSG_IMAGE"; Cases 3,5,6 of switch 31890E09 31890E35 \|. E9 87070000 \|jmp 318915C1 31890E3A \|> 68 94E68F31 \|push 318FE694 ; UNICODE "SYSMSG_SYSFACE"; Case 2 of switch 31890E09 31890E3F \|. E8 6F97FEFF \|call 3187A5B3 31890E44 \|. 59 \|pop ecx 31890E45 \|. 50 \|push eax 31890E46 \|. 8D4D 94 \|lea ecx, dword ptr [ebp-6C] 31890E49 \|. FFD7 \|call edi 31890E4B \|. 83A5 70FFFFFF>\|and dword ptr [ebp-90], 0 31890E52 \|. 8B03 \|mov eax, dword ptr [ebx] 31890E54 \|. 8D8D 70FFFFFF \|lea ecx, dword ptr [ebp-90] 31890E5A \|. 51 \|push ecx 31890E5B \|. 68 F4D88F31 \|push 318FD8F4 31890E60 \|. FF75 D8 \|push dword ptr [ebp-28] 31890E63 \|. C645 FC 0D \|mov byte ptr [ebp-4], 0D 31890E67 \|. 53 \|push ebx 31890E68 \|. FF50 44 \|call dword ptr [eax+44] 31890E6B \|. 85C0 \|test eax, eax 31890E6D \|. 0F8C C1010000 \|jl 31891034 31890E73 \|. 8B85 70FFFFFF \|mov eax, dword ptr [ebp-90] 31890E79 \|. 85C0 \|test eax, eax 31890E7B \|. 0F84 B3010000 \|je 31891034 31890E81 \|. 8D55 D3 \|lea edx, dword ptr [ebp-2D] 31890E84 \|. 52 \|push edx 31890E85 \|. C645 D3 00 \|mov byte ptr [ebp-2D], 0 31890E89 \|. 8B08 \|mov ecx, dword ptr [eax] 31890E8B \|. 50 \|push eax 31890E8C \|. FF51 28 \|call dword ptr [ecx+28] 31890E8F \|. 807D D3 AA \|cmp byte ptr [ebp-2D], 0AA 31890E93 \|. 0F87 9B010000 \|ja 31891034 31890E99 \|. 8365 D4 00 \|and dword ptr [ebp-2C], 0 31890E9D \|. 8D45 D4 \|lea eax, dword ptr [ebp-2C] 31890EA0 \|. 50 \|push eax 31890EA1 \|. C645 FC 0E \|mov byte ptr [ebp-4], 0E 31890EA5 \|. E8 84F9FFFF \|call 3189082E 31890EAA \|. 837D D4 00 \|cmp dword ptr [ebp-2C], 0 31890EAE \|. 59 \|pop ecx 31890EAF \|. 0F84 6E010000 \|je 31891023 31890EB5 \|. 8D8D 78FFFFFF \|lea ecx, dword ptr [ebp-88] 31890EBB \|. FF15 1C658F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::CTXStringW 31890EC1 \|. 8D4D A4 \|lea ecx, dword ptr [ebp-5C] 31890EC4 \|. FF15 B0608F31 \|call dword ptr [<&Common.CTXBSTR::CT>; Common.CTXBSTR::CTXBSTR 31890ECA \|. 8365 8C 00 \|and dword ptr [ebp-74], 0 31890ECE \|. 0FB645 D3 \|movzx eax, byte ptr [ebp-2D] 31890ED2 \|. 50 \|push eax 31890ED3 \|. 8D85 78FFFFFF \|lea eax, dword ptr [ebp-88] 31890ED9 \|. 68 8CE68F31 \|push 318FE68C ; UNICODE "%d" 31890EDE \|. 50 \|push eax 31890EDF \|. C645 FC 11 \|mov byte ptr [ebp-4], 11 31890EE3 \|. FF15 EC608F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::Format 31890EE9 \|. 8B5D D4 \|mov ebx, dword ptr [ebp-2C] 31890EEC \|. 83C4 0C \|add esp, 0C 31890EEF \|. 8D85 78FFFFFF \|lea eax, dword ptr [ebp-88] 31890EF5 \|. 50 \|push eax 31890EF6 \|. 8D8D 64FFFFFF \|lea ecx, dword ptr [ebp-9C] 31890EFC \|. FF15 AC608F31 \|call dword ptr [<&Common.CTXBSTR::CT>; Common.CTXBSTR::CTXBSTR 31890F02 \|. 8B3B \|mov edi, dword ptr [ebx] 31890F04 \|. 8D4D 8C \|lea ecx, dword ptr [ebp-74] 31890F07 \|. 51 \|push ecx 31890F08 \|. 8BC8 \|mov ecx, eax 31890F0A \|. C645 FC 12 \|mov byte ptr [ebp-4], 12 31890F0E \|. 83C7 20 \|add edi, 20 31890F11 \|. FF15 2C658F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator wchar_t * 31890F17 \|. 50 \|push eax 31890F18 \|. 53 \|push ebx 31890F19 \|. FF17 \|call dword ptr [edi] 31890F1B \|. 8D8D 64FFFFFF \|lea ecx, dword ptr [ebp-9C] 31890F21 \|. C645 FC 11 \|mov byte ptr [ebp-4], 11 31890F25 \|. FFD6 \|call esi 31890F27 \|. 8B5D 8C \|mov ebx, dword ptr [ebp-74] 31890F2A \|. 85DB \|test ebx, ebx 31890F2C \|. 74 42 \|je short 31890F70 31890F2E \|. 8D85 48FFFFFF \|lea eax, dword ptr [ebp-B8] 31890F34 \|. 68 94D48F31 \|push 318FD494 ; UNICODE "strTip" 31890F39 \|. 50 \|push eax 31890F3A \|. E8 34E1FDFF \|call 3186F073 31890F3F \|. 59 \|pop ecx 31890F40 \|. 59 \|pop ecx 31890F41 \|. 8945 CC \|mov dword ptr [ebp-34], eax 31890F44 \|. 8B3B \|mov edi, dword ptr [ebx] 31890F46 \|. 8D4D A4 \|lea ecx, dword ptr [ebp-5C] 31890F49 \|. C645 FC 13 \|mov byte ptr [ebp-4], 13 31890F4D \|. 83C7 44 \|add edi, 44 31890F50 \|. FF15 A8608F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator& 31890F56 \|. 8B4D CC \|mov ecx, dword ptr [ebp-34] 31890F59 \|. 50 \|push eax 31890F5A \|. FF15 2C658F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator wchar_t * 31890F60 \|. 50 \|push eax 31890F61 \|. 53 \|push ebx 31890F62 \|. FF17 \|call dword ptr [edi] 31890F64 \|. 8D8D 48FFFFFF \|lea ecx, dword ptr [ebp-B8] 31890F6A \|. C645 FC 11 \|mov byte ptr [ebp-4], 11 31890F6E \|. FFD6 \|call esi 31890F70 \|> 8D4D A4 \|lea ecx, dword ptr [ebp-5C] 31890F73 \|. FF15 10618F31 \|call dword ptr [<&Common.CTXBSTR::Is>; Common.CTXBSTR::IsEmpty 31890F79 \|. 85C0 \|test eax, eax 31890F7B \|. 75 7B \|jnz short 31890FF8 31890F7D \|. 8D45 A4 \|lea eax, dword ptr [ebp-5C] 31890F80 \|. 50 \|push eax 31890F81 \|. 8D8D 44FFFFFF \|lea ecx, dword ptr [ebp-BC] 31890F87 \|. FF15 0C618F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::CTXStringW 31890F8D \|. 50 \|push eax 31890F8E \|. 8D85 58FFFFFF \|lea eax, dword ptr [ebp-A8] 31890F94 \|. 68 88E68F31 \|push 318FE688 31890F99 \|. 50 \|push eax 31890F9A \|. C645 FC 14 \|mov byte ptr [ebp-4], 14 31890F9E \|. FF15 F4618F31 \|call dword ptr [<&Common.operator+>] ; Common.operator+ 31890FA4 \|. 68 84E68F31 \|push 318FE684 31890FA9 \|. 50 \|push eax 31890FAA \|. 8D85 4CFFFFFF \|lea eax, dword ptr [ebp-B4] 31890FB0 \|. 50 \|push eax 31890FB1 \|. C645 FC 15 \|mov byte ptr [ebp-4], 15 31890FB5 \|. FF15 0C658F31 \|call dword ptr [<&Common.operator+>] ; Common.operator+ 31890FBB \|. 83C4 18 \|add esp, 18 31890FBE \|. 50 \|push eax 31890FBF \|. 8D4D 94 \|lea ecx, dword ptr [ebp-6C] 31890FC2 \|. C645 FC 16 \|mov byte ptr [ebp-4], 16 31890FC6 \|. FF15 10658F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::operator= 31890FCC \|. 8B3D 18658F31 \|mov edi, dword ptr [<&Common.CTXStr>; Common.CTXStringW::~CTXStringW 31890FD2 \|. 8D8D 4CFFFFFF \|lea ecx, dword ptr [ebp-B4] 31890FD8 \|. C645 FC 15 \|mov byte ptr [ebp-4], 15 31890FDC \|. FFD7 \|call edi ; <&Common.CTXStringW::~CTXStringW> 31890FDE \|. 8D8D 58FFFFFF \|lea ecx, dword ptr [ebp-A8] 31890FE4 \|. C645 FC 14 \|mov byte ptr [ebp-4], 14 31890FE8 \|. FFD7 \|call edi 31890FEA \|. 8D8D 44FFFFFF \|lea ecx, dword ptr [ebp-BC] 31890FF0 \|. C645 FC 11 \|mov byte ptr [ebp-4], 11 31890FF4 \|. FFD7 \|call edi 31890FF6 \|. EB 06 \|jmp short 31890FFE 31890FF8 \|> 8B3D 18658F31 \|mov edi, dword ptr [<&Common.CTXStr>; Common.CTXStringW::~CTXStringW 31890FFE \|> 8B45 8C \|mov eax, dword ptr [ebp-74] 31891001 \|. 85C0 \|test eax, eax 31891003 \|. C645 FC 10 \|mov byte ptr [ebp-4], 10 31891007 \|. 74 06 \|je short 3189100F 31891009 \|. 8B08 \|mov ecx, dword ptr [eax] 3189100B \|. 50 \|push eax 3189100C \|. FF51 08 \|call dword ptr [ecx+8] 3189100F \|> 8D4D A4 \|lea ecx, dword ptr [ebp-5C] 31891012 \|. FFD6 \|call esi 31891014 \|. 8D8D 78FFFFFF \|lea ecx, dword ptr [ebp-88] 3189101A \|. C645 FC 0E \|mov byte ptr [ebp-4], 0E 3189101E \|. FFD7 \|call edi 31891020 \|. 8B5D B8 \|mov ebx, dword ptr [ebp-48] 31891023 \|> 8B45 D4 \|mov eax, dword ptr [ebp-2C] 31891026 \|. 85C0 \|test eax, eax 31891028 \|. C645 FC 0D \|mov byte ptr [ebp-4], 0D 3189102C \|. 74 06 \|je short 31891034 3189102E \|. 8B08 \|mov ecx, dword ptr [eax] 31891030 \|. 50 \|push eax 31891031 \|. FF51 08 \|call dword ptr [ecx+8] 31891034 \|> 8D45 94 \|lea eax, dword ptr [ebp-6C] 31891037 \|. 50 \|push eax 31891038 \|. 8D4D DC \|lea ecx, dword ptr [ebp-24] 3189103B \|. FF15 BC618F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::operator+= 31891041 \|. 8B85 70FFFFFF \|mov eax, dword ptr [ebp-90] 31891047 \|. 85C0 \|test eax, eax 31891049 \|. C645 FC 0C \|mov byte ptr [ebp-4], 0C 3189104D \|. 74 06 \|je short 31891055 3189104F \|. 8B08 \|mov ecx, dword ptr [eax] 31891051 \|. 50 \|push eax 31891052 \|. FF51 08 \|call dword ptr [ecx+8] 31891055 \|> 8D4D 94 \|lea ecx, dword ptr [ebp-6C] 31891058 \|. C645 FC 02 \|mov byte ptr [ebp-4], 2 3189105C \|. FF15 18658F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::~CTXStringW 31891062 \|. E9 6A050000 \|jmp 318915D1 31891067 \|> 8365 D4 00 \|and dword ptr [ebp-2C], 0 ; Case 1 of switch 31890E09 3189106B \|. 8B03 \|mov eax, dword ptr [ebx] 3189106D \|. 8D4D D4 \|lea ecx, dword ptr [ebp-2C] 31891070 \|. 51 \|push ecx 31891071 \|. 68 CCD88F31 \|push 318FD8CC 31891076 \|. FF75 D8 \|push dword ptr [ebp-28] 31891079 \|. C645 FC 07 \|mov byte ptr [ebp-4], 7 3189107D \|. 53 \|push ebx 3189107E \|. FF50 44 \|call dword ptr [eax+44] 31891081 \|. 85C0 \|test eax, eax 31891083 \|. 0F8C 9E050000 \|jl 31891627 31891089 \|. 8D4D B0 \|lea ecx, dword ptr [ebp-50] 3189108C \|. FF15 B0608F31 \|call dword ptr [<&Common.CTXBSTR::CT>; Common.CTXBSTR::CTXBSTR 31891092 \|. 33C0 \|xor eax, eax 31891094 \|. 8945 C8 \|mov dword ptr [ebp-38], eax 31891097 \|. 8845 C6 \|mov byte ptr [ebp-3A], al 3189109A \|. 8945 98 \|mov dword ptr [ebp-68], eax 3189109D \|. 3945 D8 \|cmp dword ptr [ebp-28], eax 318910A0 \|. C645 FC 0A \|mov byte ptr [ebp-4], 0A 318910A4 \|. 0F86 1F010000 \|jbe 318911C9 318910AA \|. 8B7D D8 \|mov edi, dword ptr [ebp-28] 318910AD \|. 8B03 \|mov eax, dword ptr [ebx] 318910AF \|. 8D4D C6 \|lea ecx, dword ptr [ebp-3A] 318910B2 \|. 51 \|push ecx 318910B3 \|. 4F \|dec edi 318910B4 \|. 57 \|push edi 318910B5 \|. 53 \|push ebx 318910B6 \|. FF50 40 \|call dword ptr [eax+40] 318910B9 \|. 85C0 \|test eax, eax 318910BB \|. 0F8C 08010000 \|jl 318911C9 318910C1 \|. 807D C6 0C \|cmp byte ptr [ebp-3A], 0C 318910C5 \|. 0F85 FE000000 \|jnz 318911C9 318910CB \|. 8B03 \|mov eax, dword ptr [ebx] 318910CD \|. 8D4D 98 \|lea ecx, dword ptr [ebp-68] 318910D0 \|. 51 \|push ecx 318910D1 \|. 68 00DD8F31 \|push 318FDD00 318910D6 \|. 57 \|push edi 318910D7 \|. 53 \|push ebx 318910D8 \|. FF50 44 \|call dword ptr [eax+44] 318910DB \|. 85C0 \|test eax, eax 318910DD \|. 0F8C E6000000 \|jl 318911C9 318910E3 \|. 8B7D 98 \|mov edi, dword ptr [ebp-68] 318910E6 \|. 85FF \|test edi, edi 318910E8 \|. 0F84 DB000000 \|je 318911C9 318910EE \|. 8D4D C8 \|lea ecx, dword ptr [ebp-38] 318910F1 \|. E8 37E0FDFF \|call 3186F12D 318910F6 \|. 8B0F \|mov ecx, dword ptr [edi] 318910F8 \|. 50 \|push eax 318910F9 \|. 57 \|push edi 318910FA \|. FF51 34 \|call dword ptr [ecx+34] 318910FD \|. 8D8D 18FFFFFF \|lea ecx, dword ptr [ebp-E8] 31891103 \|. FF15 3C628F31 \|call dword ptr [<&Common.CTXCommPack>; Common.CTXCommPack::CTXCommPack 31891109 \|. 6A 01 \|push 1 3189110B \|. 8D45 C8 \|lea eax, dword ptr [ebp-38] 3189110E \|. 50 \|push eax 3189110F \|. 8D8D 18FFFFFF \|lea ecx, dword ptr [ebp-E8] 31891115 \|. C645 FC 0B \|mov byte ptr [ebp-4], 0B 31891119 \|. FF15 04638F31 \|call dword ptr [<&Common.CTXCommPack>; Common.CTXCommPack::SetBufferIn 3189111F \|. 8D8D 18FFFFFF \|lea ecx, dword ptr [ebp-E8] 31891125 \|. FF15 00638F31 \|call dword ptr [<&Common.CTXCommPack>; Common.CTXCommPack::JumpDWord 3189112B \|. 6A 01 \|push 1 3189112D \|. 8D45 D2 \|lea eax, dword ptr [ebp-2E] 31891130 \|. 50 \|push eax 31891131 \|. 8D8D 18FFFFFF \|lea ecx, dword ptr [ebp-E8] 31891137 \|. C645 D2 00 \|mov byte ptr [ebp-2E], 0 3189113B \|. FF15 A8628F31 \|call dword ptr [<&Common.CTXCommPack>; Common.CTXCommPack::GetByte 31891141 \|. 807D D2 02 \|cmp byte ptr [ebp-2E], 2 31891145 \|. 75 55 \|jnz short 3189119C 31891147 \|. 8D8D 18FFFFFF \|lea ecx, dword ptr [ebp-E8] 3189114D \|. C645 FC 0A \|mov byte ptr [ebp-4], 0A 31891151 \|. FF15 24628F31 \|call dword ptr [<&Common.CTXCommPack>; Common.CTXCommPack::~CTXCommPack 31891157 \|> 8B45 98 \|mov eax, dword ptr [ebp-68] 3189115A \|. 85C0 \|test eax, eax 3189115C \|. C645 FC 09 \|mov byte ptr [ebp-4], 9 31891160 \|. 74 06 \|je short 31891168 31891162 \|. 8B08 \|mov ecx, dword ptr [eax] 31891164 \|. 50 \|push eax 31891165 \|. FF51 08 \|call dword ptr [ecx+8] 31891168 \|> 8B45 C8 \|mov eax, dword ptr [ebp-38] 3189116B \|. 85C0 \|test eax, eax 3189116D \|. C645 FC 08 \|mov byte ptr [ebp-4], 8 31891171 \|. 74 0A \|je short 3189117D 31891173 \|. 8B08 \|mov ecx, dword ptr [eax] 31891175 \|. 50 \|push eax 31891176 \|. FF51 08 \|call dword ptr [ecx+8] 31891179 \|. 8365 C8 00 \|and dword ptr [ebp-38], 0 3189117D \|> 8D4D B0 \|lea ecx, dword ptr [ebp-50] 31891180 \|. FFD6 \|call esi 31891182 \|. 8B45 D4 \|mov eax, dword ptr [ebp-2C] 31891185 \|> 85C0 \|test eax, eax 31891187 \|. C645 FC 02 \|mov byte ptr [ebp-4], 2 3189118B \|. 0F84 40040000 \|je 318915D1 31891191 \|. 8B08 \|mov ecx, dword ptr [eax] 31891193 \|. 50 \|push eax 31891194 \|. FF51 08 \|call dword ptr [ecx+8] 31891197 \|. E9 35040000 \|jmp 318915D1 3189119C \|> 807D D2 01 \|cmp byte ptr [ebp-2E], 1 318911A0 \|. 75 15 \|jnz short 318911B7 318911A2 \|. 68 B4E68F31 \|push 318FE6B4 ; UNICODE "SYSMSG_IMAGE" 318911A7 \|. E8 0794FEFF \|call 3187A5B3 318911AC \|. 59 \|pop ecx 318911AD \|. 50 \|push eax 318911AE \|. 8D4D B0 \|lea ecx, dword ptr [ebp-50] 318911B1 \|. FF15 68628F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator= 318911B7 \|> 8D8D 18FFFFFF \|lea ecx, dword ptr [ebp-E8] 318911BD \|. C645 FC 0A \|mov byte ptr [ebp-4], 0A 318911C1 \|. FF15 24628F31 \|call dword ptr [<&Common.CTXCommPack>; Common.CTXCommPack::~CTXCommPack 318911C7 \|. EB 1A \|jmp short 318911E3 318911C9 \|> 8B45 D4 \|mov eax, dword ptr [ebp-2C] 318911CC \|. 8B38 \|mov edi, dword ptr [eax] 318911CE \|. 8D4D B0 \|lea ecx, dword ptr [ebp-50] 318911D1 \|. 8945 CC \|mov dword ptr [ebp-34], eax 318911D4 \|. 83C7 28 \|add edi, 28 318911D7 \|. FF15 A8608F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator& 318911DD \|. 50 \|push eax 318911DE \|. FF75 CC \|push dword ptr [ebp-34] 318911E1 \|. FF17 \|call dword ptr [edi] 318911E3 \|> 8D45 B0 \|lea eax, dword ptr [ebp-50] 318911E6 \|. 50 \|push eax 318911E7 \|. 8D4D DC \|lea ecx, dword ptr [ebp-24] 318911EA \|. FF15 FC628F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::operator+= 318911F0 \|.^ E9 62FFFFFF \|jmp 31891157 318911F5 \|> 83E8 0D \|sub eax, 0D 318911F8 \|. 0F84 BE030000 \|je 318915BC 318911FE \|. 83E8 03 \|sub eax, 3 31891201 \|. 0F84 F3010000 \|je 318913FA 31891207 \|. 48 \|dec eax 31891208 \|. 74 73 \|je short 3189127D 3189120A \|. 83E8 03 \|sub eax, 3 3189120D \|. 0F85 BE030000 \|jnz 318915D1 31891213 \|. 2145 BC \|and dword ptr [ebp-44], eax ; Case 14 of switch 31890E09 31891216 \|. 8B03 \|mov eax, dword ptr [ebx] 31891218 \|. 8D4D BC \|lea ecx, dword ptr [ebp-44] 3189121B \|. 51 \|push ecx 3189121C \|. 68 00DB8F31 \|push 318FDB00 31891221 \|. FF75 D8 \|push dword ptr [ebp-28] 31891224 \|. C645 FC 26 \|mov byte ptr [ebp-4], 26 31891228 \|. 53 \|push ebx 31891229 \|. FF50 44 \|call dword ptr [eax+44] 3189122C \|. 85C0 \|test eax, eax 3189122E \|. 7C 45 \|jl short 31891275 31891230 \|. 8D8D 68FFFFFF \|lea ecx, dword ptr [ebp-98] 31891236 \|. FF15 B0608F31 \|call dword ptr [<&Common.CTXBSTR::CT>; Common.CTXBSTR::CTXBSTR 3189123C \|. 8B45 BC \|mov eax, dword ptr [ebp-44] 3189123F \|. 8B38 \|mov edi, dword ptr [eax] 31891241 \|. 8D8D 68FFFFFF \|lea ecx, dword ptr [ebp-98] 31891247 \|. C645 FC 27 \|mov byte ptr [ebp-4], 27 3189124B \|. 8BD8 \|mov ebx, eax 3189124D \|. 83C7 34 \|add edi, 34 31891250 \|. FF15 A8608F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator& 31891256 \|. 50 \|push eax 31891257 \|. 53 \|push ebx 31891258 \|. FF17 \|call dword ptr [edi] 3189125A \|. 8D85 68FFFFFF \|lea eax, dword ptr [ebp-98] 31891260 \|. 50 \|push eax 31891261 \|. 8D4D DC \|lea ecx, dword ptr [ebp-24] 31891264 \|. FF15 8C618F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::operator= 3189126A \|. 8D8D 68FFFFFF \|lea ecx, dword ptr [ebp-98] 31891270 \|. FFD6 \|call esi 31891272 \|. 8B5D B8 \|mov ebx, dword ptr [ebp-48] 31891275 \|> 8B45 BC \|mov eax, dword ptr [ebp-44] 31891278 \|.^ E9 08FFFFFF \|jmp 31891185 3189127D \|> 8D4D 84 \|lea ecx, dword ptr [ebp-7C] ; Cases 7,11 of switch 31890E09 31891280 \|. FF15 B0608F31 \|call dword ptr [<&Common.CTXBSTR::CT>; Common.CTXBSTR::CTXBSTR 31891286 \|. 8365 AC 00 \|and dword ptr [ebp-54], 0 3189128A \|. 8365 9C 00 \|and dword ptr [ebp-64], 0 3189128E \|. 8B03 \|mov eax, dword ptr [ebx] 31891290 \|. 8D4D 9C \|lea ecx, dword ptr [ebp-64] 31891293 \|. 51 \|push ecx 31891294 \|. 68 74E68F31 \|push 318FE674 31891299 \|. FF75 D8 \|push dword ptr [ebp-28] 3189129C \|. C645 FC 19 \|mov byte ptr [ebp-4], 19 318912A0 \|. 53 \|push ebx 318912A1 \|. FF50 44 \|call dword ptr [eax+44] 318912A4 \|. 85C0 \|test eax, eax 318912A6 \|. 0F8C 1E010000 \|jl 318913CA 318912AC \|. 8B45 9C \|mov eax, dword ptr [ebp-64] 318912AF \|. 8B38 \|mov edi, dword ptr [eax] 318912B1 \|. 8BD8 \|mov ebx, eax 318912B3 \|. 8D45 AC \|lea eax, dword ptr [ebp-54] 318912B6 \|. 50 \|push eax 318912B7 \|. 8D4D 84 \|lea ecx, dword ptr [ebp-7C] 318912BA \|. 83C7 28 \|add edi, 28 318912BD \|. FF15 A8608F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator& 318912C3 \|. 50 \|push eax 318912C4 \|. 8D45 E0 \|lea eax, dword ptr [ebp-20] 318912C7 \|. 50 \|push eax 318912C8 \|. 53 \|push ebx 318912C9 \|. FF17 \|call dword ptr [edi] 318912CB \|. 6A 10 \|push 10 ; /n = 10 (16.) 318912CD \|. 8D45 E0 \|lea eax, dword ptr [ebp-20] ; \| 318912D0 \|. 68 A4D48F31 \|push 318FD4A4 ; \|s2 = KernelUt.318FD4A4 318912D5 \|. 50 \|push eax ; \|s1 318912D6 \|. E8 C75B0500 \|call <jmp.&MSVCR80.memcmp> ; \memcmp 318912DB \|. 83C4 0C \|add esp, 0C 318912DE \|. 85C0 \|test eax, eax 318912E0 \|. 75 66 \|jnz short 31891348 318912E2 \|. 68 40E68F31 \|push 318FE640 ; UNICODE "MainRecentPage_Text_Audio" 318912E7 \|. E8 C792FEFF \|call 3187A5B3 318912EC \|. 59 \|pop ecx 318912ED \|. 50 \|push eax 318912EE \|. 8D4D A0 \|lea ecx, dword ptr [ebp-60] 318912F1 \|. FF15 20658F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::CTXStringW 318912F7 \|. 8D45 A0 \|lea eax, dword ptr [ebp-60] 318912FA \|. 50 \|push eax 318912FB \|. 8D4D DC \|lea ecx, dword ptr [ebp-24] 318912FE \|. C645 FC 1A \|mov byte ptr [ebp-4], 1A 31891302 \|. FF15 BC618F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::operator+= 31891308 \|. 8D4D A0 \|lea ecx, dword ptr [ebp-60] 3189130B \|. C645 FC 19 \|mov byte ptr [ebp-4], 19 3189130F \|. FF15 18658F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::~CTXStringW 31891315 \|. 8B45 9C \|mov eax, dword ptr [ebp-64] 31891318 \|. 85C0 \|test eax, eax 3189131A \|. C645 FC 18 \|mov byte ptr [ebp-4], 18 3189131E \|. 74 06 \|je short 31891326 31891320 \|. 8B08 \|mov ecx, dword ptr [eax] 31891322 \|. 50 \|push eax 31891323 \|. FF51 08 \|call dword ptr [ecx+8] 31891326 \|> 8B45 AC \|mov eax, dword ptr [ebp-54] 31891329 \|. 85C0 \|test eax, eax 3189132B \|. C645 FC 17 \|mov byte ptr [ebp-4], 17 3189132F \|. 74 06 \|je short 31891337 31891331 \|. 8B08 \|mov ecx, dword ptr [eax] 31891333 \|. 50 \|push eax 31891334 \|. FF51 08 \|call dword ptr [ecx+8] 31891337 \|> 8D4D 84 \|lea ecx, dword ptr [ebp-7C] 3189133A \|. C645 FC 02 \|mov byte ptr [ebp-4], 2 3189133E \|. FFD6 \|call esi 31891340 \|> 8B5D B8 \|mov ebx, dword ptr [ebp-48] 31891343 \|. E9 89020000 \|jmp 318915D1 31891348 \|> 837D AC 00 \|cmp dword ptr [ebp-54], 0 3189134C \|. 74 79 \|je short 318913C7 3189134E \|. 8D8D 6CFFFFFF \|lea ecx, dword ptr [ebp-94] 31891354 \|. FF15 B0608F31 \|call dword ptr [<&Common.CTXBSTR::CT>; Common.CTXBSTR::CTXBSTR 3189135A \|. 8B5D AC \|mov ebx, dword ptr [ebp-54] 3189135D \|. 8D85 50FFFFFF \|lea eax, dword ptr [ebp-B0] 31891363 \|. 68 28CD8F31 \|push 318FCD28 ; UNICODE "bsAbstractText" 31891368 \|. 50 \|push eax 31891369 \|. C645 FC 1B \|mov byte ptr [ebp-4], 1B 3189136D \|. E8 01DDFDFF \|call 3186F073 31891372 \|. 59 \|pop ecx 31891373 \|. 59 \|pop ecx 31891374 \|. 8945 CC \|mov dword ptr [ebp-34], eax 31891377 \|. 8B3B \|mov edi, dword ptr [ebx] 31891379 \|. 8D8D 6CFFFFFF \|lea ecx, dword ptr [ebp-94] 3189137F \|. C645 FC 1C \|mov byte ptr [ebp-4], 1C 31891383 \|. 83C7 44 \|add edi, 44 31891386 \|. FF15 A8608F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator& 3189138C \|. 8B4D CC \|mov ecx, dword ptr [ebp-34] 3189138F \|. 50 \|push eax 31891390 \|. FF15 2C658F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator wchar_t * 31891396 \|. 50 \|push eax 31891397 \|. 53 \|push ebx 31891398 \|. FF17 \|call dword ptr [edi] 3189139A \|. 85C0 \|test eax, eax 3189139C \|. 8D8D 50FFFFFF \|lea ecx, dword ptr [ebp-B0] 318913A2 \|. 0F9DC3 \|setge bl 318913A5 \|. C645 FC 1B \|mov byte ptr [ebp-4], 1B 318913A9 \|. FFD6 \|call esi 318913AB \|. 84DB \|test bl, bl 318913AD \|. 74 10 \|je short 318913BF 318913AF \|. 8D85 6CFFFFFF \|lea eax, dword ptr [ebp-94] 318913B5 \|. 50 \|push eax 318913B6 \|. 8D4D DC \|lea ecx, dword ptr [ebp-24] 318913B9 \|. FF15 FC628F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::operator+= 318913BF \|> 8D8D 6CFFFFFF \|lea ecx, dword ptr [ebp-94] 318913C5 \|. FFD6 \|call esi 318913C7 \|> 8B5D B8 \|mov ebx, dword ptr [ebp-48] 318913CA \|> 8B45 9C \|mov eax, dword ptr [ebp-64] 318913CD \|. 85C0 \|test eax, eax 318913CF \|. C645 FC 18 \|mov byte ptr [ebp-4], 18 318913D3 \|. 74 06 \|je short 318913DB 318913D5 \|. 8B08 \|mov ecx, dword ptr [eax] 318913D7 \|. 50 \|push eax 318913D8 \|. FF51 08 \|call dword ptr [ecx+8] 318913DB \|> 8B45 AC \|mov eax, dword ptr [ebp-54] 318913DE \|. 85C0 \|test eax, eax 318913E0 \|. C645 FC 17 \|mov byte ptr [ebp-4], 17 318913E4 \|. 74 06 \|je short 318913EC 318913E6 \|. 8B08 \|mov ecx, dword ptr [eax] 318913E8 \|. 50 \|push eax 318913E9 \|. FF51 08 \|call dword ptr [ecx+8] 318913EC \|> 8D4D 84 \|lea ecx, dword ptr [ebp-7C] 318913EF \|. C645 FC 02 \|mov byte ptr [ebp-4], 2 318913F3 \|. FFD6 \|call esi 318913F5 \|. E9 D7010000 \|jmp 318915D1 318913FA \|> 68 04E68F31 \|push 318FE604 ; UNICODE "MainRecentPage_Text_PublicAcc"; Case 10 of switch 31890E09 318913FF \|. E8 AF91FEFF \|call 3187A5B3 31891404 \|. 59 \|pop ecx 31891405 \|. 50 \|push eax 31891406 \|. 8D4D 88 \|lea ecx, dword ptr [ebp-78] 31891409 \|. FFD7 \|call edi 3189140B \|. 83A5 40FFFFFF>\|and dword ptr [ebp-C0], 0 31891412 \|. 8365 90 00 \|and dword ptr [ebp-70], 0 31891416 \|. 8B03 \|mov eax, dword ptr [ebx] 31891418 \|. 8D4D 90 \|lea ecx, dword ptr [ebp-70] 3189141B \|. 51 \|push ecx 3189141C \|. 68 E8DA8F31 \|push 318FDAE8 31891421 \|. FF75 D8 \|push dword ptr [ebp-28] 31891424 \|. C645 FC 1F \|mov byte ptr [ebp-4], 1F 31891428 \|. 53 \|push ebx 31891429 \|. FF50 44 \|call dword ptr [eax+44] 3189142C \|. 85C0 \|test eax, eax 3189142E \|. 0F8C 58010000 \|jl 3189158C 31891434 \|. 83A5 7CFFFFFF>\|and dword ptr [ebp-84], 0 3189143B \|. 8B45 90 \|mov eax, dword ptr [ebp-70] 3189143E \|. 8B08 \|mov ecx, dword ptr [eax] 31891440 \|. 8D95 7CFFFFFF \|lea edx, dword ptr [ebp-84] 31891446 \|. 52 \|push edx 31891447 \|. 50 \|push eax 31891448 \|. C645 FC 20 \|mov byte ptr [ebp-4], 20 3189144C \|. FF51 28 \|call dword ptr [ecx+28] 3189144F \|. 8B9D 7CFFFFFF \|mov ebx, dword ptr [ebp-84] 31891455 \|. 85DB \|test ebx, ebx 31891457 \|. 0F84 1B010000 \|je 31891578 3189145D \|. 8365 D4 00 \|and dword ptr [ebp-2C], 0 31891461 \|. 8D85 60FFFFFF \|lea eax, dword ptr [ebp-A0] 31891467 \|. 68 00CD8F31 \|push 318FCD00 ; UNICODE "TxArrayData" 3189146C \|. 50 \|push eax 3189146D \|. C645 FC 21 \|mov byte ptr [ebp-4], 21 31891471 \|. E8 FDDBFDFF \|call 3186F073 31891476 \|. 59 \|pop ecx 31891477 \|. 59 \|pop ecx 31891478 \|. 8B3B \|mov edi, dword ptr [ebx] 3189147A \|. 8D4D D4 \|lea ecx, dword ptr [ebp-2C] 3189147D \|. 51 \|push ecx 3189147E \|. 8BC8 \|mov ecx, eax 31891480 \|. C645 FC 22 \|mov byte ptr [ebp-4], 22 31891484 \|. 81C7 20010000 \|add edi, 120 3189148A \|. FF15 2C658F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator wchar_t * 31891490 \|. 50 \|push eax 31891491 \|. 53 \|push ebx 31891492 \|. FF17 \|call dword ptr [edi] 31891494 \|. 8D8D 60FFFFFF \|lea ecx, dword ptr [ebp-A0] 3189149A \|. C645 FC 21 \|mov byte ptr [ebp-4], 21 3189149E \|. FFD6 \|call esi 318914A0 \|. 8B45 D4 \|mov eax, dword ptr [ebp-2C] 318914A3 \|. 85C0 \|test eax, eax 318914A5 \|. 0F84 BF000000 \|je 3189156A 318914AB \|. 8D55 CC \|lea edx, dword ptr [ebp-34] 318914AE \|. 33FF \|xor edi, edi 318914B0 \|. 52 \|push edx 318914B1 \|. 897D CC \|mov dword ptr [ebp-34], edi 318914B4 \|. 8B08 \|mov ecx, dword ptr [eax] 318914B6 \|. 50 \|push eax 318914B7 \|. FF51 60 \|call dword ptr [ecx+60] 318914BA \|. 397D CC \|cmp dword ptr [ebp-34], edi 318914BD \|. 0F86 A4000000 \|jbe 31891567 318914C3 \|. 897D BC \|mov dword ptr [ebp-44], edi 318914C6 \|. 8B45 D4 \|mov eax, dword ptr [ebp-2C] 318914C9 \|. 8B08 \|mov ecx, dword ptr [eax] 318914CB \|. 8D55 BC \|lea edx, dword ptr [ebp-44] 318914CE \|. 52 \|push edx 318914CF \|. 57 \|push edi 318914D0 \|. 50 \|push eax 318914D1 \|. C645 FC 23 \|mov byte ptr [ebp-4], 23 318914D5 \|. FF91 AC010000 \|call dword ptr [ecx+1AC] 318914DB \|. 397D BC \|cmp dword ptr [ebp-44], edi 318914DE \|. 74 76 \|je short 31891556 318914E0 \|. 8D8D 74FFFFFF \|lea ecx, dword ptr [ebp-8C] 318914E6 \|. FF15 B0608F31 \|call dword ptr [<&Common.CTXBSTR::CT>; Common.CTXBSTR::CTXBSTR 318914EC \|. 8B5D BC \|mov ebx, dword ptr [ebp-44] 318914EF \|. 8D85 54FFFFFF \|lea eax, dword ptr [ebp-AC] 318914F5 \|. 68 18CD8F31 \|push 318FCD18 ; UNICODE "bsTitle" 318914FA \|. 50 \|push eax 318914FB \|. C645 FC 24 \|mov byte ptr [ebp-4], 24 318914FF \|. E8 6FDBFDFF \|call 3186F073 31891504 \|. 59 \|pop ecx 31891505 \|. 59 \|pop ecx 31891506 \|. 8985 5CFFFFFF \|mov dword ptr [ebp-A4], eax 3189150C \|. 8B3B \|mov edi, dword ptr [ebx] 3189150E \|. 8D8D 74FFFFFF \|lea ecx, dword ptr [ebp-8C] 31891514 \|. C645 FC 25 \|mov byte ptr [ebp-4], 25 31891518 \|. 83C7 44 \|add edi, 44 3189151B \|. FF15 A8608F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator& 31891521 \|. 8B8D 5CFFFFFF \|mov ecx, dword ptr [ebp-A4] 31891527 \|. 50 \|push eax 31891528 \|. FF15 2C658F31 \|call dword ptr [<&Common.CTXBSTR::op>; Common.CTXBSTR::operator wchar_t * 3189152E \|. 50 \|push eax 3189152F \|. 53 \|push ebx 31891530 \|. FF17 \|call dword ptr [edi] 31891532 \|. 8D8D 54FFFFFF \|lea ecx, dword ptr [ebp-AC] 31891538 \|. C645 FC 24 \|mov byte ptr [ebp-4], 24 3189153C \|. FFD6 \|call esi 3189153E \|. 8D85 74FFFFFF \|lea eax, dword ptr [ebp-8C] 31891544 \|. 50 \|push eax 31891545 \|. 8D4D 88 \|lea ecx, dword ptr [ebp-78] 31891548 \|. FF15 8C618F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::operator= 3189154E \|. 8D8D 74FFFFFF \|lea ecx, dword ptr [ebp-8C] 31891554 \|. FFD6 \|call esi 31891556 \|> 8B45 BC \|mov eax, dword ptr [ebp-44] 31891559 \|. 85C0 \|test eax, eax 3189155B \|. C645 FC 21 \|mov byte ptr [ebp-4], 21 3189155F \|. 74 06 \|je short 31891567 31891561 \|. 8B08 \|mov ecx, dword ptr [eax] 31891563 \|. 50 \|push eax 31891564 \|. FF51 08 \|call dword ptr [ecx+8] 31891567 \|> 8B45 D4 \|mov eax, dword ptr [ebp-2C] 3189156A \|> 85C0 \|test eax, eax 3189156C \|. C645 FC 20 \|mov byte ptr [ebp-4], 20 31891570 \|. 74 06 \|je short 31891578 31891572 \|. 8B08 \|mov ecx, dword ptr [eax] 31891574 \|. 50 \|push eax 31891575 \|. FF51 08 \|call dword ptr [ecx+8] 31891578 \|> 8B85 7CFFFFFF \|mov eax, dword ptr [ebp-84] 3189157E \|. 85C0 \|test eax, eax 31891580 \|. C645 FC 1F \|mov byte ptr [ebp-4], 1F 31891584 \|. 74 06 \|je short 3189158C 31891586 \|. 8B08 \|mov ecx, dword ptr [eax] 31891588 \|. 50 \|push eax 31891589 \|. FF51 08 \|call dword ptr [ecx+8] 3189158C \|> 8D45 88 \|lea eax, dword ptr [ebp-78] 3189158F \|. 50 \|push eax 31891590 \|. 8D4D DC \|lea ecx, dword ptr [ebp-24] 31891593 \|. FF15 BC618F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::operator+= 31891599 \|. 8B45 90 \|mov eax, dword ptr [ebp-70] 3189159C \|. 85C0 \|test eax, eax 3189159E \|. C645 FC 1E \|mov byte ptr [ebp-4], 1E 318915A2 \|. 74 06 \|je short 318915AA 318915A4 \|. 8B08 \|mov ecx, dword ptr [eax] 318915A6 \|. 50 \|push eax 318915A7 \|. FF51 08 \|call dword ptr [ecx+8] 318915AA \|> 8D4D 88 \|lea ecx, dword ptr [ebp-78] 318915AD \|. C645 FC 02 \|mov byte ptr [ebp-4], 2 318915B1 \|. FF15 18658F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::~CTXStringW 318915B7 \|.^ E9 84FDFFFF \|jmp 31891340 318915BC \|> 68 E0E58F31 \|push 318FE5E0 ; UNICODE "SYSMSG_EMOJIFACE"; Case D of switch 31890E09 318915C1 \|> E8 ED8FFEFF \|call 3187A5B3 318915C6 \|. 59 \|pop ecx 318915C7 \|. 50 \|push eax 318915C8 \|. 8D4D DC \|lea ecx, dword ptr [ebp-24] 318915CB \|. FF15 6C618F31 \|call dword ptr [<&Common.CTXStringW:>; Common.CTXStringW::operator+= 318915D1 \|> FF45 D8 \|inc dword ptr [ebp-28] ; Default case of switch 31890E09 318915D4 \|. 8B45 D8 \|mov eax, dword ptr [ebp-28] 318915D7 \|. 3B45 80 \|cmp eax, dword ptr [ebp-80] 318915DA \|.^ 0F82 06F8FFFF \jb 31890DE6 318915E0 \|> 8B4D C0 mov ecx, dword ptr [ebp-40] 318915E3 \|. 8D45 DC lea eax, dword ptr [ebp-24] 318915E6 \|. 50 push eax 318915E7 \|. FF15 14658F31 call dword ptr [<&Common.CTXStringW::>; Common.CTXStringW::CTXStringW 318915ED \|> C745 A8 01000>mov dword ptr [ebp-58], 1 318915F4 \|> 8B45 B4 mov eax, dword ptr [ebp-4C] 318915F7 \|. 85C0 test eax, eax 318915F9 \|. C645 FC 01 mov byte ptr [ebp-4], 1 318915FD \|. 74 06 je short 31891605 318915FF \|. 8B08 mov ecx, dword ptr [eax] 31891601 \|. 50 push eax 31891602 \|. FF51 08 call dword ptr [ecx+8] 31891605 \|> 8D4D DC lea ecx, dword ptr [ebp-24] 31891608 \|. C645 FC 00 mov byte ptr [ebp-4], 0 3189160C \|. FF15 18658F31 call dword ptr [<&Common.CTXStringW::>; Common.CTXStringW::~CTXStringW 31891612 \|. 8B45 C0 mov eax, dword ptr [ebp-40] 31891615 \|> E8 D1550500 call 318E6BEB 3189161A \|. C3 retn 以上是GetMsgAbstract的代码。但在retn后面还有下面这一段代码才会开始下面一个函数的代码。谢谢！ 3189161B \|> 8B4D C0 mov ecx, dword ptr [ebp-40] 3189161E \|. 68 3C7A8F31 push 318F7A3C 31891623 \|. FFD7 call edi 31891625 \|.^ EB C6 jmp short 318915ED 31891627 \|> 8B4D C0 mov ecx, dword ptr [ebp-40] 3189162A \|. 68 3C7A8F31 push 318F7A3C 3189162F \|. FFD7 call edi 31891631 \|. 8B45 D4 mov eax, dword ptr [ebp-2C] 31891634 \|. C745 A8 01000>mov dword ptr [ebp-58], 1 3189163B \.^ E9 5BF7FFFF jmp 31890D9B
winampme 雪币： 20 活跃值： (29) 能力值： ( LV2，RANK：10 ) 在线值：发帖 22 回帖 63 粉丝 0 关注私信	winampme 2013-9-6 20:28 0 [求助]QQ 2013 sp1 聊天内容获取大概什么价格哦？本人是菜鸟。
winampme 雪币： 20 活跃值： (29) 能力值： ( LV2，RANK：10 ) 在线值：发帖 22 回帖 63 粉丝 0 关注私信	winampme 2013-9-5 15:02 0 [求助]QQ 2013 sp1 聊天内容获取一个星期前的版本，HOOK savemsg194可以搞定，但现在的QQ2013正式版 sp1截取不到聊天记录了。楼主找到原因了吗？
winampme 雪币： 20 活跃值： (29) 能力值： ( LV2，RANK：10 ) 在线值：发帖 22 回帖 63 粉丝 0 关注私信	winampme 2013-8-5 16:03 0 [求助]菜鸟求助（关于调试浏览器的问题）有人可以帮忙调试下吗？

winampme

账号登录 验证码登录

账号登录

验证码登录