.text:01001092 mov     edi, edi
.text:01001094 push    ebp
.text:01001095 mov     ebp, esp
.text:01001097 push    esi
.text:01001098 mov     esi, [ebp+arg_4]
.text:0100109B xor     eax, eax 
.text:0100109D test    esi, esi 
.text:0100109F mov     ecx, esi
.text:010010A1 jz      short loc_10010B5 
.text:010010A3 mov     edx, [ebp+arg_0]
.text:010010A6 cmp     word ptr [edx], 0 
.text:010010AA jz      short loc_10010B1 
.text:010010AC inc     edx 
.text:010010AD inc     edx 
.text:010010AE dec     esi 
.text:010010AF jnz     short loc_10010A6 
.text:010010B1 test    esi, esi 
.text:010010B3 jnz     short loc_10010BA 
.text:010010B5 mov     eax, 0C000000Dh
.text:010010BA mov     edx, [ebp+arg_8]
.text:010010BD test    edx, edx 
.text:010010BF jz      short loc_10010CE 
.text:010010C1 test    eax, eax 
.text:010010C3 jl      short loc_10010CB 
.text:010010C5 sub     ecx, esi 
.text:010010C7 mov     [edx], ecx
.text:010010C9 jmp     short loc_10010CE
.text:010010CB and     dword ptr [edx], 0
.text:010010CE pop     esi
.text:010010CF pop     ebp
.text:010010D0 retn    0Ch

NTSTATUS WINAPI SecondFunction(PULONG First,ULONG Number,PULONG Second)
{
	NTSTATUS NTstatus=0;
	ULONG Count=Number;
	if (Number!=0)
	{
		while(Number!=0)
		{
			if((*First&0xffff)!=0)
			{
				First+=2;
				Number--;
			}
			else
			{
				break;
			}
		}
	}
	NTstatus=0xC000000D;
	if (Second!=NULL)
	{
		if ((test eax,eax)>0)
		{
			Count=Count-Number;
			*Second=Count;
		} 
		else
		{
			and dword ptr [Second], 0
		}
	}
	return NTstatus;
}

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课