0041BC97 |. 6A 00 PUSH 0 ; /pOverlapped = NULL
0041BC99 |. 50 PUSH EAX ; |pBytesRead
0041BC9A |. 8B07 MOV EAX,DWORD PTR DS:[EDI] ; |
0041BC9C |. FF75 10 PUSH DWORD PTR SS:[EBP+10] ; |BytesToRead
0041BC9F |. 52 PUSH EDX ; |Buffer 这里应该是存放返回字符串的地方
0041BCA0 |. FF3430 PUSH DWORD PTR DS:[EAX+ESI] ; |hFile
0041BCA3 |. FF15 B4F14300 CALL DWORD PTR DS:[<&KERNEL32.ReadFile>] ; \ReadFile
0041BCA9 |. 85C0 TEST EAX,EAX
0041BCAB |. 75 39 JNZ SHORT SSF_Tran.0041BCE6
0041BCAD |. FF15 14F24300 CALL DWORD PTR DS:[<&KERNEL32.GetLastError>] ; [GetLastError
0041BCB3 |. 6A 05 PUSH 5
0041BCB5 |. 5E POP ESI
0041BCB6 |. 3BC6 CMP EAX,ESI
0041BCB8 |. 75 14 JNZ SHORT SSF_Tran.0041BCCE
0041BCBA |. E8 76A5FFFF CALL SSF_Tran.00416235
0041BCBF |. C700 09000000 MOV DWORD PTR DS:[EAX],9
0041BCC5 |. E8 74A5FFFF CALL SSF_Tran.0041623E
0041BCCA |. 8930 MOV DWORD PTR DS:[EAX],ESI
0041BCCC |. EB 10 JMP SHORT SSF_Tran.0041BCDE
0041BCCE |> 83F8 6D CMP EAX,6D
0041BCD1 |. 0F84 24010000 JE SSF_Tran.0041BDFB
0041BCD7 |. 50 PUSH EAX
0041BCD8 |. E8 E5A4FFFF CALL SSF_Tran.004161C2
0041BCDD |. 59 POP ECX
0041BCDE |> 83C8 FF OR EAX,FFFFFFFF
0041BCE1 |. E9 17010000 JMP SSF_Tran.0041BDFD
0041BCE6 |> 8B07 MOV EAX,DWORD PTR DS:[EDI] ; fie load without error
0041BCE8 |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
;跳到这里，还没有使用返回的字符串，就被覆盖掉了，为什么？
0041BCEB |. 0155 F8 ADD DWORD PTR SS:[EBP-8],EDX
0041BCEE |. 8D4C30 04 LEA ECX,DWORD PTR DS:[EAX+ESI+4]
0041BCF2 |. 8A4430 04 MOV AL,BYTE PTR DS:[EAX+ESI+4]
0041BCF6 |. A8 80 TEST AL,80
0041BCF8 |. 0F84 F8000000 JE SSF_Tran.0041BDF6
0041BCFE |. 85D2 TEST EDX,EDX
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
