N久木有整ASM了，都快丢光了，现在想捡起来，结果杯具了：
.386
.model flat,stdcall
option casemap:none
include windows.inc
include kernel32.inc
include user32.inc
include gdi32.inc
includelib kernel32.lib
includelib user32.lib
includelib gdi32.lib
.data
szFormat db '%d * %d',0
szCaption db 'Caption',0
szClass db 'MyClass',0
szMenu1 db 'File',0
szMenu11 db 'Open',0
szMenu12 db 'Save',0
szMenu13 db 'Exit',0
.data?
hInstance dd ?
hMenu dd ?
hSubMenu dd ?
.code
MsgLoop:
push ebp
mov ebp,esp
push ebx
push edi
push esi
sub esp,sizeof PAINTSTRUCT + sizeof RECT + 4 + 16
mov edi,esp
mov ecx,sizeof PAINTSTRUCT + sizeof RECT + 4 + 16
xor eax,eax
cld
rep stosb
;buff:dword ptr [ebp - 12 - 16]
;hdc:dword ptr [ebp - 12 - 16 - 4]
;rect:dword ptr [ebp - 12 - 16 - 4 - sizeof RECT]
;paintstruct:dword ptr [ebp - 12 - 16 - 4 - sizeof RECT - sizeof PAINTSTRUCT]
;hWnd:dword ptr [ebp + 8]
;uMsg:dword ptr [ebp + 12]
;wParam:dword ptr [ebp + 16]
;lParam:dword ptr [ebp + 20]
mov eax,dword ptr [ebp + 12]
cmp eax,WM_CLOSE
jz wmClose
cmp eax,WM_PAINT
jz wmPaint
wmDefault:
invoke DefWindowProc,dword ptr [ebp + 8],dword ptr [ebp + 12],dword ptr [ebp + 16],dword ptr [ebp + 20]
jmp wmEnd
wmPaint:
lea eax,dword ptr [ebp - 12 - 16 - 4 - sizeof RECT - sizeof PAINTSTRUCT]
invoke BeginPaint,dword ptr [ebp + 8],eax
mov dword ptr [ebp - 12 - 16 - 4],eax
lea eax,dword ptr [ebp - 12 - 16 - 4 - sizeof RECT]
invoke GetClientRect,dword ptr [ebp + 8],eax
lea ebx,dword ptr [ebp - 12 - 16]
mov ecx,dword ptr [ebp - 12 - 16 - 4 - 4 -4]
mov eax,dword ptr [ebp - 12 - 16 - 4 - 4]
invoke wsprintf,ebx,offset szFormat,ecx,eax
lea ebx,dword ptr [ebp - 12 - 16]
lea eax,dword ptr [ebp - 12 - 16 - 4 - sizeof RECT]
invoke DrawText,dword ptr [ebp - 12 - 16 - 4],ebx,-1,eax,DT_SINGLELINE or DT_CENTER or DT_VCENTER
lea eax,dword ptr [ebp - 12 - 16 - 4 -sizeof RECT - sizeof PAINTSTRUCT]
invoke EndPaint,dword ptr [ebp + 8],eax
xor eax,eax
jmp wmEnd
wmClose:
invoke DestroyWindow,dword ptr [ebp + 8]
invoke PostQuitMessage,0
xor eax,eax
wmEnd:
mov esp,ebp
sub esp,12
pop esi
pop edi
pop ebx
mov esp,ebp
pop ebp
pop ecx
add esp,16
push ecx
ret
main:
push ebp
mov ebp,esp
sub esp,sizeof WNDCLASSEX + sizeof MSG + 4
mov ecx,sizeof WNDCLASSEX + sizeof MSG + 4
xor eax,eax
mov edi,esp
cld
rep stosb
;wndclassex:dword ptr [ebp - 4 - sizeof MSG - sizeof WNDCLASSEX]
;msg:dword ptr [ebp - 4 - sizeof MSG]
;hWnd:dword ptr [ebp - 4]
invoke GetModuleHandle,NULL
mov hInstance,eax
lea ebx,dword ptr [ebp - 4 - sizeof MSG - sizeof WNDCLASSEX]
assume ebx:ptr WNDCLASSEX
mov [ebx].hInstance,eax
invoke LoadIcon,NULL,IDI_APPLICATION
mov [ebx].hIcon,eax
invoke LoadCursor,NULL,IDC_ARROW
mov [ebx].hCursor,eax
mov [ebx].cbSize,sizeof WNDCLASSEX
mov [ebx].lpfnWndProc,offset MsgLoop
mov [ebx].lpszClassName,offset szClass
mov [ebx].hbrBackground,COLOR_WINDOW + 1
mov [ebx].style,CS_HREDRAW or CS_VREDRAW
invoke RegisterClassEx,ebx
invoke GetSystemMetrics,SM_CXSCREEN
sub eax,400
shr eax,1
push eax
invoke GetSystemMetrics,SM_CYSCREEN
sub eax,300
shr eax,1
pop ecx
invoke CreateWindowEx,WS_EX_CLIENTEDGE,\
offset szClass,\
offset szCaption,\
WS_VISIBLE or WS_OVERLAPPEDWINDOW,\
ecx,eax,400,300,0,0,0,0
mov dword ptr [ebp - 4],eax
invoke UpdateWindow,eax
;invoke ShowWindow,dword ptr [ebp - 4],SW_SHOW
add ebx,sizeof WNDCLASSEX
@@:
invoke GetMessage,ebx,dword ptr [ebp - 4],0,0
test eax,eax
jz @f
invoke TranslateMessage,ebx
invoke DispatchMessage,ebx
jmp @b
@@:
xor eax,eax
mov esp,ebp
pop ebp
ret
start:
call main
invoke ExitProcess,0
end start
运行一切正常，只是关闭后窗口被销毁，process却不能退出。
请大大帮我see一see哪儿有毛病。
[课程]Linux pwn 探索篇！
