.text:74DC4275 ; public: long __thiscall CBase::SetCodeProperty(long, struct IDispatch *, int *)
.text:74DC4275 ?SetCodeProperty@CBase@@QAEJJPAUIDispatch@@PAH@Z proc near
.text:74DC4275 ; CODE XREF: BASICPROPPARAMS::SetCodeProperty(tagVARIANT *,CBase *,CVoid *)+2Ep
.text:74DC4275 ; CScriptElement::CommitFunctionPointersCode(CBase *,int)+1F7065p ...
.text:74DC4275
.text:74DC4275 var_4 = dword ptr -4
.text:74DC4275 arg_0 = dword ptr 8
.text:74DC4275 arg_4 = dword ptr 0Ch
.text:74DC4275 arg_8 = dword ptr 10h
.text:74DC4275
.text:74DC4275 ; FUNCTION CHUNK AT .text:74EA8AA0 SIZE 00000007 BYTES
.text:74DC4275
.text:74DC4275 mov edi, edi
.text:74DC4277 push ebp
.text:74DC4278 mov ebp, esp
.text:74DC427A push ecx
.text:74DC427B and [ebp+var_4], 0
.text:74DC427F push edi
.text:74DC4280 push 0
.text:74DC4282 push [ebp+arg_0]
.text:74DC4285 push esi
.text:74DC4286 call ?DidFindAAIndexAndDelete@CBase@@QAEHJW4AATYPE@CAttrValue@@@Z ; CBase::DidFindAAIndexAndDelete(long,CAttrValue::AATYPE)
//调用函数删除原来的属性
.text:74DC428B push 3
.text:74DC428D push [ebp+arg_0]
.text:74DC4290 mov edi, eax
.text:74DC4292 push esi
.text:74DC4293 call ?DidFindAAIndexAndDelete@CBase@@QAEHJW4AATYPE@CAttrValue@@@Z ; CBase::DidFindAAIndexAndDelete(long,CAttrValue::AATYPE)
.text:74DC4298 mov ecx, [ebp+arg_4]
.text:74DC429B or edi, eax
.text:74DC429D test ecx, ecx
.text:74DC429F jz short loc_74DC42B0
.text:74DC42A1 push 20h
.text:74DC42A3 push [ebp+arg_0]
.text:74DC42A6 mov eax, esi
.text:74DC42A8 call ?AddDispatchObject@CBase@@QAEJJPAUIDispatch@@W4AATYPE@CAttrValue@@W4AAExtraBits@4@@Z ; CBase::AddDispatchObject(long,IDispatch *,CAttrValue::AATYPE,CAttrValue::AAExtraBits)
.text:74DC42AD mov [ebp+var_4], eax
.text:74DC42B0
.text:74DC42B0 loc_74DC42B0: ; CODE XREF: CBase::SetCodeProperty(long,IDispatch *,int *)+2Aj
.text:74DC42B0 mov eax, [esi]
.text:74DC42B2 push 0
.text:74DC42B4 push 0
.text:74DC42B6 push 800117B6h
.text:74DC42BB mov ecx, esi
.text:74DC42BD call dword ptr [eax+98h]
.text:74DC42C3 mov eax, [ebp+arg_8]
.text:74DC42C6 test eax, eax
.text:74DC42C8 jnz loc_74EA8AA0
.text:74DC42CE
.text:74DC42CE loc_74DC42CE: ; CODE XREF: CBase::SetCodeProperty(long,IDispatch *,int *)+E482Dj
.text:74DC42CE mov eax, [ebp+var_4]
.text:74DC42D1 pop edi
.text:74DC42D2 leave
.text:74DC42D3 retn 0Ch
.text:74DC42D3 ?SetCodeProperty@CBase@@QAEJJPAUIDispatch@@PAH@Z endp
.text:74E3F034 ; protected: void __thiscall CAttrArray::Destroy(int)
.text:74E3F034 ?Destroy@CAttrArray@@IAEXH@Z proc near ; CODE XREF: CAttrArray::Set(long,PROPERTYDESC const *,tagVARIANT const *,CAttrValue::AATYPE,ushort,int)+D506p
.text:74E3F034 ; CBase::DeleteAt(ulong)+10p ...
.text:74E3F034
.text:74E3F034 ; FUNCTION CHUNK AT .text:74E784C3 SIZE 0000001E BYTES
.text:74E3F034 ; FUNCTION CHUNK AT .text:74E8909D SIZE 0000000C BYTES
.text:74E3F034
.text:74E3F034 mov edi, edi
.text:74E3F036 push edi
.text:74E3F037 mov edi, eax
.text:74E3F039 mov eax, [esi+10h]
.text:74E3F03C mov ecx, eax
.text:74E3F03E shr ecx, 1
.text:74E3F040 test cl, 1
.text:74E3F043 jnz loc_74E8909D
.text:74E3F049
.text:74E3F049 loc_74E3F049: ; CODE XREF: CAttrArray::Destroy(int)+4A06Aj
.text:74E3F049 mov ecx, edi
.text:74E3F04B shl ecx, 4
.text:74E3F04E add ecx, [esi+0Ch]
.text:74E3F051 cmp byte ptr [ecx], 3
.text:74E3F054 jnz loc_74E784C3
.text:74E3F05A
.text:74E3F05A loc_74E3F05A: ; CODE XREF: CAttrArray::Destroy(int)+394A8j
.text:74E3F05A call ?Free@CAttrValue@@QAEXXZ ; CAttrValue::Free(void)
.text:74E3F05F mov eax, [esi+10h]
.text:74E3F062 shr eax, 1
.text:74E3F064 test al, 1
.text:74E3F066 jnz loc_74E890A3
.text:74E3F06C
.text:74E3F06C loc_74E3F06C: ; CODE XREF: CAttrArray::Destroy(int)+4A070j
.text:74E3F06C push 10h
.text:74E3F06E pop eax
.text:74E3F06F mov edx, esi
.text:74E3F071 call ?Delete@CImplAry@@IAEXIH@Z ; CImplAry::Delete(uint,int)
//调用函数从属性数组中删除该索引对应的属性
.text:74E3F076 pop edi
.text:74E3F077 retn
.text:74E3F077 ?Destroy@CAttrArray@@IAEXH@Z endp
int __stdcall PlainRelease(LONG a1)
{
LONG v1; // eax@7
LONG v2; // eax@8
bool v3; // zf@1
int result; // eax@1
v3 = (*(_DWORD *)(a1 + 4))-- == 1;
result = *(_DWORD *)(a1 + 4);
if ( v3 )
{
if ( *(_DWORD *)(a1 + 12) && !(*(_BYTE *)(a1 + 28) & 4) )
(*(void (__stdcall **)(_DWORD))(*(_DWORD *)(a1 + 16) + 8))(*(_DWORD *)(a1 + 12));
if ( *(_DWORD *)(a1 + 20) )
(*(void (__stdcall **)(_DWORD))(*(_DWORD *)(a1 + 24) + 8))(*(_DWORD *)(a1 + 20));
v1 = InterlockedExchange(&dword_7515B03C, a1);
if ( v1 )
{
v2 = InterlockedExchange(&dword_7515B040, v1);
if ( v2 )
HeapFree(g_hProcessHeap, 0, (LPVOID)v2);
}
result = 0;
}
return result;
}
struct TEAROFF_THUNK
{
void * papfnVtblThis; // Thunk's vtable
ULONG ulRef; // Reference count for this thunk.
IID const * const * apIID; // Short circuit QI using these IIDs.
void * pvObject1; // Delegate other methods to this object using...
const void * apfnVtblObject1; // ...this array of pointers to member functions.
void * pvObject2; // Delegate methods to this object using...
void * apfnVtblObject2; // ...this array of pointers to member functions...
DWORD dwMask; // ...the index of the method is set in the mask.
DWORD n; // index of method into vtbl
void * apVtblPropDesc; // array of propdescs in Vtbl order
}
.text:74C68B19 ; public: virtual __thiscall CAttrCollectionator::~CAttrCollectionator(void)
.text:74C68B19 ??1CAttrCollectionator@@UAE@XZ proc near
.text:74C68B19 ; CODE XREF: CAttrCollectionator::`vector deleting destructor'(uint)+8p
.text:74C68B19 mov edi, edi
.text:74C68B1B push esi
.text:74C68B1C push 3
.text:74C68B1E mov esi, ecx
.text:74C68B20 push 8001145Ah
.text:74C68B25 push dword ptr [esi+14h]
.text:74C68B28 mov dword ptr [esi], offset ??_7CAttrCollectionator@@6B@ ; const CAttrCollectionator::`vftable'
.text:74C68B2E call ?DidFindAAIndexAndDelete@CBase@@QAEHJW4AATYPE@CAttrValue@@@Z ; CBase::DidFindAAIndexAndDelete(long,CAttrValue::AATYPE)
.text:74C68B33 mov eax, [esi+14h]
.text:74C68B36 mov ecx, [eax]
.text:74C68B38 push eax
.text:74C68B39 call dword ptr [ecx+0E0h]
.text:74C68B3F lea eax, [esi+1Ch]
.text:74C68B42 call ??1CImplAry@@QAE@XZ ; CImplAry::~CImplAry(void)
.text:74C68B47 mov ecx, esi
.text:74C68B49 pop esi
.text:74C68B4A jmp ??1CBase@@UAE@XZ ; CBase::~CBase(void)
.text:74C68B4A ??1CAttrCollectionator@@UAE@XZ endp
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
POC下载不到了，lz可否本地共享一份，谢谢。
