100104F0 $ 55 PUSH EBP
100104F1 . 8BEC MOV EBP,ESP
100104F3 . 57 PUSH EDI
100104F4 . 56 PUSH ESI
100104F5 . 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
100104F8 . 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]
100104FB . 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
100104FE . 8BC1 MOV EAX,ECX
10010500 . 8BD1 MOV EDX,ECX
10010502 . 03C6 ADD EAX,ESI
10010504 . 3BFE CMP EDI,ESI
10010506 . 76 08 JBE SHORT ystzn.10010510
10010508 . 3BF8 CMP EDI,EAX
1001050A . 0F82 78010000 JB ystzn.10010688
10010510 > F7C7 03000000 TEST EDI,3
10010516 . 75 14 JNZ SHORT ystzn.1001052C
10010518 . C1E9 02 SHR ECX,2
1001051B . 83E2 03 AND EDX,3
1001051E . 83F9 08 CMP ECX,8
10010521 . 72 29 JB SHORT ystzn.1001054C
10010523 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
10010525 . FF2495 380601>JMP DWORD PTR DS:[EDX*4+10010638]
1001052C > 8BC7 MOV EAX,EDI
1001052E . BA 03000000 MOV EDX,3
10010533 . 83E9 04 SUB ECX,4
10010536 . 72 0C JB SHORT ystzn.10010544
10010538 . 83E0 03 AND EAX,3
1001053B . 03C8 ADD ECX,EAX
1001053D . FF2485 500501>JMP DWORD PTR DS:[EAX*4+10010550]
10010544 > FF248D 480601>JMP DWORD PTR DS:[ECX*4+10010648]
1001054B 90 NOP
1001054C > FF248D CC0501>JMP DWORD PTR DS:[ECX*4+100105CC]
10010553 90 DB 90
10010554 . 60050110 DD ystzn.10010560 ; 分支表 (1-based) 被用于 1001053D
10010558 . 8C050110 DD ystzn.1001058C
1001055C . B0050110 DD ystzn.100105B0
10010560 > 23D1 AND EDX,ECX
10010562 . 8A06 MOV AL,BYTE PTR DS:[ESI]
10010564 . 8807 MOV BYTE PTR DS:[EDI],AL
10010566 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
10010569 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
1001056C . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
1001056F . C1E9 02 SHR ECX,2
10010572 . 8847 02 MOV BYTE PTR DS:[EDI+2],AL
10010575 . 83C6 03 ADD ESI,3
10010578 . 83C7 03 ADD EDI,3
1001057B . 83F9 08 CMP ECX,8
1001057E .^ 72 CC JB SHORT ystzn.1001054C
10010580 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
10010582 . FF2495 380601>JMP DWORD PTR DS:[EDX*4+10010638]
10010589 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
1001058C > 23D1 AND EDX,ECX
1001058E . 8A06 MOV AL,BYTE PTR DS:[ESI]
10010590 . 8807 MOV BYTE PTR DS:[EDI],AL
10010592 . 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
10010595 . C1E9 02 SHR ECX,2
10010598 . 8847 01 MOV BYTE PTR DS:[EDI+1],AL
1001059B . 83C6 02 ADD ESI,2
1001059E . 83C7 02 ADD EDI,2
100105A1 . 83F9 08 CMP ECX,8
100105A4 .^ 72 A6 JB SHORT ystzn.1001054C
100105A6 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
100105A8 . FF2495 380601>JMP DWORD PTR DS:[EDX*4+10010638]
100105AF 90 NOP
100105B0 > 23D1 AND EDX,ECX
100105B2 . 8A06 MOV AL,BYTE PTR DS:[ESI]
100105B4 . 8807 MOV BYTE PTR DS:[EDI],AL
100105B6 . 46 INC ESI
100105B7 . C1E9 02 SHR ECX,2
100105BA . 47 INC EDI
100105BB . 83F9 08 CMP ECX,8
100105BE .^ 72 8C JB SHORT ystzn.1001054C
100105C0 . F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
100105C2 . FF2495 380601>JMP DWORD PTR DS:[EDX*4+10010638]
100105C9 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
100105CC . 2F060110 DD ystzn.1001062F ; 分支表 被用于 1001054C
100105D0 . 1C060110 DD ystzn.1001061C
100105D4 . 14060110 DD ystzn.10010614
100105D8 . 0C060110 DD ystzn.1001060C
100105DC . 04060110 DD ystzn.10010604
100105E0 . FC050110 DD ystzn.100105FC
100105E4 . F4050110 DD ystzn.100105F4
100105E8 . EC050110 DD ystzn.100105EC
100105EC > 8B448E E4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-1C]
100105F0 . 89448F E4 MOV DWORD PTR DS:[EDI+ECX*4-1C],EAX
100105F4 > 8B448E E8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-18]
100105F8 . 89448F E8 MOV DWORD PTR DS:[EDI+ECX*4-18],EAX
100105FC > 8B448E EC MOV EAX,DWORD PTR DS:[ESI+ECX*4-14]
10010600 . 89448F EC MOV DWORD PTR DS:[EDI+ECX*4-14],EAX
10010604 > 8B448E F0 MOV EAX,DWORD PTR DS:[ESI+ECX*4-10]
10010608 . 89448F F0 MOV DWORD PTR DS:[EDI+ECX*4-10],EAX
1001060C > 8B448E F4 MOV EAX,DWORD PTR DS:[ESI+ECX*4-C]
10010610 . 89448F F4 MOV DWORD PTR DS:[EDI+ECX*4-C],EAX
10010614 > 8B448E F8 MOV EAX,DWORD PTR DS:[ESI+ECX*4-8]
10010618 . 89448F F8 MOV DWORD PTR DS:[EDI+ECX*4-8],EAX
1001061C > 8B448E FC MOV EAX,DWORD PTR DS:[ESI+ECX*4-4]
10010620 . 89448F FC MOV DWORD PTR DS:[EDI+ECX*4-4],EAX
10010624 . 8D048D 000000>LEA EAX,DWORD PTR DS:[ECX*4]
1001062B . 03F0 ADD ESI,EAX
1001062D . 03F8 ADD EDI,EAX
1001062F > FF2495 380601>JMP DWORD PTR DS:[EDX*4+10010638]
10010636 8BFF MOV EDI,EDI
10010638 . 48060110 DD ystzn.10010648 ; 分支表 被用于 10010582
1001063C . 50060110 DD ystzn.10010650
10010640 . 5C060110 DD ystzn.1001065C
10010644 . 70060110 DD ystzn.10010670
10010648 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
1001064B . 5E POP ESI
1001064C . 5F POP EDI
1001064D . C9 LEAVE
1001064E . C3 RETN
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
