各位大哥,请帮忙看看,我想跳过文件大小比较的函数,引用call已经找到,下面那个 je 是不是改成 jmp 就能跳过这段代码?小弟是新手,请指点下,谢谢!7C810A77 > 8BFF mov edi, edi
7C810A79 55 push ebp
7C810A7A 8BEC mov ebp, esp
7C810A7C 51 push ecx
7C810A7D 51 push ecx
7C810A7E 8D45 F8 lea eax, dword ptr ss:[ebp-8]
7C810A81 50 push eax
7C810A82 FF75 08 push dword ptr ss:[ebp+8]
7C810A85 E8 7FFFFFFF call kernel32.GetFileSizeEx
7C810A8A 85C0 test eax, eax
7C810A8C ^ 0F84 2996FFFF je kernel32.7C80A0BB
7C810A92 8B45 0C mov eax, dword ptr ss:[ebp+C]
7C810A95 85C0 test eax, eax
7C810A97 ^ 0F85 1496FFFF jnz kernel32.7C80A0B1
7C810A9D 837D F8 FF cmp dword ptr ss:[ebp-8], -1
7C810AA1 0F84 82C20200 je kernel32.7C83CD29
7C810AA7 8B45 F8 mov eax, dword ptr ss:[ebp-8]
7C810AAA C9 leave
7C810AAB C2 0800 retn 8
7C810AAE 90 nop
7C810AAF 90 nop
7C810AB0 FFFF ??? ; 未知命令
7C810AB2 FFFF ??? ; 未知命令
7C810AB4 17 pop ss
7C810AB5 17 pop ss
7C810AB6 807C20 17 80 cmp byte ptr ds:[eax+17], 80
7C810ABB 7C 3D jl short kernel32.7C810AFA
7C810ABD 2300 and eax, dword ptr ds:[eax]
7C810ABF 00C0 add al, al
7C810AC1 0F84 811E0200 je kernel32.7C832948
7C810AC7 50 push eax
7C810AC8 E8 9E88FFFF call kernel32.7C80936B
7C810ACD 33C0 xor eax, eax
7C810ACF ^ E9 A3E6FFFF jmp kernel32.7C80F177
7C810AD4 90 nop
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
