代码如下：
005E4440 55 push ebp
005E4441 8BEC mov ebp, esp
005E4443 51 push ecx
005E4444 56 push esi
005E4445 8BF1 mov esi, ecx
005E4447 8D45 08 lea eax, dword ptr [ebp+8]
005E444A 50 push eax
005E444B 8D4D FC lea ecx, dword ptr [ebp-4]
005E444E 51 push ecx
005E444F 8D4E 34 lea ecx, dword ptr [esi+34]
005E4452 E8 D9DD0200 call 00612230 ;此call的代码看下面
005E4457 8B4E 44 mov ecx, dword ptr [esi+44]
005E445A 8B45 FC mov eax, dword ptr [ebp-4] ;跟踪eax时，看这里找不到ebp-4的来源
005E445D 3BC1 cmp eax, ecx
005E445F 5E pop esi
005E4460 75 08 jnz short 005E446A
005E4462 33C0 xor eax, eax
005E4464 8BE5 mov esp, ebp
005E4466 5D pop ebp
005E4467 C2 0400 retn 4
005E446A 8B40 10 mov eax, dword ptr [eax+10]
005E446D 8BE5 mov esp, ebp
005E446F 5D pop ebp
005E4470 C2 0400 retn 4
005E4452 E8 D9DD0200 call 00612230
=================================
00612230 55 push ebp
00612231 8BEC mov ebp, esp
00612233 51 push ecx
00612234 8B51 10 mov edx, dword ptr [ecx+10]
00612237 8B42 04 mov eax, dword ptr [edx+4]
0061223A 53 push ebx
0061223B 8A58 15 mov bl, byte ptr [eax+15]
0061223E 84DB test bl, bl
00612240 56 push esi
00612241 57 push edi
00612242 8B7D 0C mov edi, dword ptr [ebp+C]
00612245 75 1E jnz short 00612265
00612247 8B37 mov esi, dword ptr [edi]
00612249 8DA424 00000000 lea esp, dword ptr [esp]
00612250 3970 0C cmp dword ptr [eax+C], esi
00612253 7D 05 jge short 0061225A
00612255 8B40 08 mov eax, dword ptr [eax+8]
00612258 EB 04 jmp short 0061225E
0061225A 8BD0 mov edx, eax
0061225C 8B00 mov eax, dword ptr [eax]
0061225E 8A58 15 mov bl, byte ptr [eax+15]
00612261 84DB test bl, bl
00612263 ^ 74 EB je short 00612250
00612265 8B41 10 mov eax, dword ptr [ecx+10]
00612268 3BD0 cmp edx, eax
0061226A 8955 0C mov dword ptr [ebp+C], edx
0061226D 74 1A je short 00612289
0061226F 8B0F mov ecx, dword ptr [edi]
00612271 3B4A 0C cmp ecx, dword ptr [edx+C]
00612274 7C 13 jl short 00612289
00612276 8D45 0C lea eax, dword ptr [ebp+C]
00612279 8B10 mov edx, dword ptr [eax]
0061227B 8B45 08 mov eax, dword ptr [ebp+8]
0061227E 5F pop edi
0061227F 5E pop esi
00612280 8910 mov dword ptr [eax], edx
00612282 5B pop ebx
00612283 8BE5 mov esp, ebp
00612285 5D pop ebp
00612286 C2 0800 retn 8 ;通过f7跟到这里就返回了，没有执行到下面的代码
00612289 8945 FC mov dword ptr [ebp-4], eax
0061228C 8D45 FC lea eax, dword ptr [ebp-4]
0061228F 8B10 mov edx, dword ptr [eax]
00612291 8B45 08 mov eax, dword ptr [ebp+8]
00612294 5F pop edi
00612295 5E pop esi
00612296 8910 mov dword ptr [eax], edx
00612298 5B pop ebx
00612299 8BE5 mov esp, ebp
0061229B 5D pop ebp
0061229C C2 0800 retn 8
不知道这个ebp-4从那里来的
因为学习汇编也不久，实在不知道如何下手..还请达人指点
[课程]Android-CTF解题方法汇总！
