0046E5F0 /$ 55 PUSH EBP
0046E5F1 |. 8BEC MOV EBP,ESP
0046E5F3 |. 83EC 7C SUB ESP,7C
0046E5F6 |. A1 F48FEC00 MOV EAX,DWORD PTR DS:[EC8FF4]
0046E5FB |. 33C5 XOR EAX,EBP
0046E5FD |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
0046E600 |. 6A 14 PUSH 14
0046E602 |. E8 D5876F00 CALL <JMP.&MSVCR80.??2@YAPAXI@Z>
0046E607 |. 83C4 04 ADD ESP,4
0046E60A |. 8945 B0 MOV DWORD PTR SS:[EBP-50],EAX
0046E60D |. 837D B0 00 CMP DWORD PTR SS:[EBP-50],0
0046E611 |. 74 1F JE SHORT Zone.0046E632
0046E613 |. 68 B0F7D700 PUSH Zone.00D7F7B0 ; ASCII "./Data/Data.bwp"
0046E618 |. 8B4D B0 MOV ECX,DWORD PTR SS:[EBP-50]
0046E61B |. FF15 40F0D600 CALL DWORD PTR DS:[<&Foundation.??0IMPQ>; Foundati.??0IMPQFilePort@@QAE@PBD@Z
0046E621 |. 8B45 B0 MOV EAX,DWORD PTR SS:[EBP-50]
0046E624 |. C700 E8F8D700 MOV DWORD PTR DS:[EAX],Zone.00D7F8E8
0046E62A |. 8B4D B0 MOV ECX,DWORD PTR SS:[EBP-50]
0046E62D |. 894D 8C MOV DWORD PTR SS:[EBP-74],ECX
0046E630 |. EB 07 JMP SHORT Zone.0046E639
0046E632 |> C745 8C 00000>MOV DWORD PTR SS:[EBP-74],0
0046E639 |> 8B55 8C MOV EDX,DWORD PTR SS:[EBP-74]
0046E63C |. 8955 B4 MOV DWORD PTR SS:[EBP-4C],EDX
0046E63F |. FF15 48F0D600 CALL DWORD PTR DS:[<&Foundation.?Instan>; Foundati.?Instance@FilePortManager@@SAPAV1@XZ
0046E645 |. 8945 88 MOV DWORD PTR SS:[EBP-78],EAX
0046E648 |. 8B45 B4 MOV EAX,DWORD PTR SS:[EBP-4C]
0046E64B |. 50 PUSH EAX
0046E64C |. 8B4D 88 MOV ECX,DWORD PTR SS:[EBP-78]
0046E64F |. 8B11 MOV EDX,DWORD PTR DS:[ECX]
0046E651 |. 8B4D 88 MOV ECX,DWORD PTR SS:[EBP-78]
0046E654 |. 8B42 0C MOV EAX,DWORD PTR DS:[EDX+C]
0046E657 |. FFD0 CALL EAX
0046E659 |. 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48]
0046E65C |. E8 6FC46500 CALL Zone.00ACAAD0
0046E661 |. 68 DCF8D700 PUSH Zone.00D7F8DC ; ASCII "倾国倾城"
0046E666 |. 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
0046E669 |. FF15 5CFBD600 CALL DWORD PTR DS:[<&MSVCP80.??0?$basic>; MSVCP80.??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
0046E66F |. 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
0046E672 |. 51 PUSH ECX
0046E673 |. 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48]
0046E676 |. E8 65CC6500 CALL Zone.00ACB2E0
0046E67B |. 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
0046E67E |. FF15 80FDD600 CALL DWORD PTR DS:[<&MSVCP80.??1?$basic>; MSVCP80.??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
0046E684 |. E8 27450100 CALL Zone.00482BB0
0046E689 |. 50 PUSH EAX
0046E68A |. 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48]
0046E68D |. E8 EECA6500 CALL Zone.00ACB180
0046E692 |. E8 19450100 CALL Zone.00482BB0
0046E697 |. 8945 84 MOV DWORD PTR SS:[EBP-7C],EAX
0046E69A |. 8B55 84 MOV EDX,DWORD PTR SS:[EBP-7C]
0046E69D |. 8B02 MOV EAX,DWORD PTR DS:[EDX]
0046E69F |. 8B4D 84 MOV ECX,DWORD PTR SS:[EBP-7C]
0046E6A2 |. 8B50 2C MOV EDX,DWORD PTR DS:[EAX+2C]
0046E6A5 |. FFD2 CALL EDX
0046E6A7 |. E8 04450100 CALL Zone.00482BB0
0046E6AC |. 0FB680 0C0E00>MOVZX EAX,BYTE PTR DS:[EAX+E0C]
0046E6B3 |. 85C0 TEST EAX,EAX
0046E6B5 |. 75 11 JNZ SHORT Zone.0046E6C8
0046E6B7 |. 6A 00 PUSH 0 ; /pModule = NULL
0046E6B9 |. FF15 D0FAD600 CALL DWORD PTR DS:[<&KERNEL32.GetModule>; \GetModuleHandleA
0046E6BF |. 50 PUSH EAX
0046E6C0 |. 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48]
0046E6C3 |. E8 68C46500 CALL Zone.00ACAB30
0046E6C8 |> 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48]
0046E6CB |. 51 PUSH ECX
0046E6CC |. E8 8FEF6500 CALL Zone.00ACD660 ;
0046E6D1 |. 83C4 04 ADD ESP,4
0046E6D4 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0046E6D7 |. E8 64450100 CALL Zone.00482C40
0046E6DC |. FF15 44F0D600 CALL DWORD PTR DS:[<&Foundation.?Cleanu>; Foundati.?Cleanup@VTTestManagerBS@@SAXXZ
0046E6E2 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0046E6E5 |. 8955 90 MOV DWORD PTR SS:[EBP-70],EDX
0046E6E8 |. 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48]
0046E6EB |. E8 20C46500 CALL Zone.00ACAB10
0046E6F0 |. 8B45 90 MOV EAX,DWORD PTR SS:[EBP-70]
0046E6F3 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
0046E6F6 |. 33CD XOR ECX,EBP
0046E6F8 |. E8 61866F00 CALL Zone.00B66D5E
0046E6FD |. 8BE5 MOV ESP,EBP
0046E6FF |. 5D POP EBP
0046E700 \. C2 1000 RETN 10
重点是这么几句
0046E6C8 |> 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48]
0046E6CB |. 51 PUSH ECX
0046E6CC |. E8 8FEF6500 CALL Zone.00ACD660 PUSH ECX 是第一个参数
ECX来自LEA ECX,DWORD PTR SS:[EBP-48]
请教各位，如何查找这个 [EBP-48]呢
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
