76FE6F01 > B8 0FE08F07 mov eax,0x78FE00F ; 函数被HOOK 了
76FE6F06 - FFE0 jmp eax
76FE6F08 0056 57 add byte ptr ds:[esi+0x57],dl
76FE6F0B 33FF xor edi,edi
76FE6F0D 813D 48700077 2>cmp dword ptr ds:[0x77007048],ws2_32.76FE2E2>
76FE6F17 75 7B jnz short ws2_32.76FE6F94
76FE6F19 393D 70700077 cmp dword ptr ds:[0x77007070],edi
76FE6F1F 74 73 je short ws2_32.76FE6F94
76FE6F21 FF35 44700077 push dword ptr ds:[0x77007044]
76FE6F27 FF15 4812FE76 call dword ptr ds:[<&API-MS-Win-Core-Process>; kernel32.TlsGetValue
76FE6F2D 8945 F8 mov dword ptr ss:[ebp-0x8],eax
76FE6F30 3BC7 cmp eax,edi
76FE6F32 74 60 je short ws2_32.76FE6F94
76FE6F34 897D FC mov dword ptr ss:[ebp-0x4],edi
76FE6F37 FF75 08 push dword ptr ss:[ebp+0x8]
76FE6F3A E8 81C0FFFF call ws2_32.76FE2FC0
76FE6F3F 8BF0 mov esi,eax
76FE6F41 3BF7 cmp esi,edi
76FE6F43 0F84 CA830000 je ws2_32.76FEF313
76FE6F49 8B4D F8 mov ecx,dword ptr ss:[ebp-0x8]
76FE6F4C 8B45 10 mov eax,dword ptr ss:[ebp+0x10]
76FE6F4F 53 push ebx
76FE6F50 83C1 08 add ecx,0x8
76FE6F53 8D55 FC lea edx,dword ptr ss:[ebp-0x4]
76FE6F56 52 push edx ; 179309.0054F034
76FE6F57 51 push ecx
76FE6F58 57 push edi
76FE6F59 57 push edi
76FE6F5A FF75 14 push dword ptr ss:[ebp+0x14] ; 179309.004F7EBC
76FE6F5D 8D4D 08 lea ecx,dword ptr ss:[ebp+0x8]
76FE6F60 51 push ecx
76FE6F61 6A 01 push 0x1
76FE6F63 8945 F0 mov dword ptr ss:[ebp-0x10],eax
76FE6F66 8B45 0C mov eax,dword ptr ss:[ebp+0xC]
76FE6F69 8D4D F0 lea ecx,dword ptr ss:[ebp-0x10]
76FE6F6C 51 push ecx
76FE6F6D FF75 08 push dword ptr ss:[ebp+0x8] ; ntdll.76E86C01
76FE6F70 8945 F4 mov dword ptr ss:[ebp-0xC],eax
76FE6F73 8B46 0C mov eax,dword ptr ds:[esi+0xC]
76FE6F76 FF50 64 call dword ptr ds:[eax+0x64]
76FE6F79 8BCE mov ecx,esi
76FE6F7B 8BD8 mov ebx,eax
76FE6F7D E8 1EC0FFFF call ws2_32.76FE2FA0
76FE6F82 3BDF cmp ebx,edi
76FE6F84 5B pop ebx ; ntdll.76E8539C
76FE6F85 0F85 7A830000 jnz ws2_32.76FEF305
76FE6F8B 8B45 08 mov eax,dword ptr ss:[ebp+0x8]
76FE6F8E 5F pop edi ; ntdll.76E8539C
76FE6F8F 5E pop esi ; ntdll.76E8539C
76FE6F90 C9 leave
76FE6F91 C2 1000 retn 0x10
下咯
