这个函数传入的参数的个数和类型？
100040B3 >/$ 55 push ebp
100040B4 |. 8BEC mov ebp, esp
100040B6 |. 83EC 10 sub esp, 10
100040B9 |. 8B45 08 mov eax, dword ptr [ebp+8]
100040BC |. 56 push esi
100040BD |. 57 push edi
100040BE |. 33FF xor edi, edi
100040C0 |. 3BC7 cmp eax, edi
100040C2 |. 0F84 E4000000 je 100041AC
100040C8 |. 8B4D 0C mov ecx, dword ptr [ebp+C]
100040CB |. 3BCF cmp ecx, edi
100040CD |. 0F84 D9000000 je 100041AC
100040D3 |. 0FBF91 F01C03>movsx edx, word ptr [ecx+31CF0]
100040DA |. 2BD7 sub edx, edi
100040DC |. 897D F0 mov dword ptr [ebp-10], edi
100040DF |. 897D F8 mov dword ptr [ebp-8], edi
100040E2 |. 66:897D F4 mov word ptr [ebp-C], di
100040E6 |. 66:897D FC mov word ptr [ebp-4], di
100040EA |. 0F84 92000000 je 10004182
100040F0 |. 4A dec edx ; Switch (cases 1..10)
100040F1 |. 74 74 je short 10004167
100040F3 |. 83EA 03 sub edx, 3
100040F6 |. 74 50 je short 10004148
100040F8 |. 4A dec edx
100040F9 |. 74 2E je short 10004129
100040FB |. 83EA 0B sub edx, 0B
100040FE |. 74 07 je short 10004107
10004100 |. 6A FE push -2
10004102 |. E9 A7000000 jmp 100041AE
10004107 |> 8DB0 000F0000 lea esi, dword ptr [eax+F00] ; Case 10 of switch 100040F0
1000410D |. 8D55 F0 lea edx, dword ptr [ebp-10]
10004110 |. 56 push esi
10004111 |. 05 E80E0000 add eax, 0EE8
10004116 |. 52 push edx
10004117 |. 81C1 F41C0300 add ecx, 31CF4
1000411D |. 50 push eax
1000411E |. 51 push ecx
1000411F |. E8 9D1D0000 call 10005EC1
10004124 |> 83C4 10 add esp, 10
10004127 |. EB 75 jmp short 1000419E
10004129 |> 8DB0 000F0000 lea esi, dword ptr [eax+F00] ; Case 5 of switch 100040F0
1000412F |. 8D55 F0 lea edx, dword ptr [ebp-10]
10004132 |. 56 push esi
10004133 |. 05 E80E0000 add eax, 0EE8
10004138 |. 52 push edx
10004139 |. 81C1 F41C0300 add ecx, 31CF4
1000413F |. 50 push eax
10004140 |. 51 push ecx
10004141 |. E8 2A1D0000 call 10005E70
10004146 |.^ EB DC jmp short 10004124
10004148 |> 8DB0 000F0000 lea esi, dword ptr [eax+F00] ; Case 4 of switch 100040F0
1000414E |. 8D55 F0 lea edx, dword ptr [ebp-10]
10004151 |. 56 push esi
10004152 |. 05 E80E0000 add eax, 0EE8
10004157 |. 52 push edx
10004158 |. 81C1 F41C0300 add ecx, 31CF4
1000415E |. 50 push eax
1000415F |. 51 push ecx
10004160 |. E8 E51C0000 call 10005E4A
10004165 |.^ EB BD jmp short 10004124
10004167 |> 8DB0 000F0000 lea esi, dword ptr [eax+F00] ; Case 1 of switch 100040F0
1000416D |. 05 E80E0000 add eax, 0EE8
10004172 |. 56 push esi
10004173 |. 81C1 F41C0300 add ecx, 31CF4
10004179 |. 50 push eax
1000417A |. 51 push ecx
1000417B |. E8 AE190000 call 10005B2E
10004180 |. EB 19 jmp short 1000419B
10004182 |> 8DB0 000F0000 lea esi, dword ptr [eax+F00]
10004188 |. 05 E80E0000 add eax, 0EE8
1000418D |. 56 push esi
1000418E |. 81C1 F41C0300 add ecx, 31CF4
10004194 |. 50 push eax
10004195 |. 51 push ecx
10004196 |. E8 941B0000 call 10005D2F
1000419B |> 83C4 0C add esp, 0C
1000419E |> 66:3BC7 cmp ax, di
100041A1 |. 75 0C jnz short 100041AF
100041A3 |. 56 push esi
100041A4 |. E8 76000000 call 1000421F
100041A9 |. 59 pop ecx
100041AA |. EB 03 jmp short 100041AF
100041AC |> 6A 80 push -80
100041AE |> 58 pop eax ; Default case of switch 100040F0
100041AF |> 5F pop edi
100041B0 |. 5E pop esi
100041B1 |. C9 leave
100041B2 \. C2 0800 retn 8
附件里面有Dll和导出函数表，上面一段代码为函数:MedDecomp12lead(2 个参数)
指点指点我吧……
[课程]Linux pwn 探索篇！
