CODE:00411570
CODE:00411570 ; *************** S U B R O U T I N E ******************
CODE:00411570
CODE:00411570
CODE:00411570 sub_411570 proc near
CODE:00411570 mov edx, [eax]
CODE:00411572 xor ecx, ecx
CODE:00411574 mov [eax], ecx
CODE:00411576 mov eax, edx
CODE:00411578 call sub_403D98
CODE:00411578
CODE:0041157D retn
CODE:0041157D
CODE:0041157D sub_411570 endp
CODE:0041157D
CODE:0041157D ; ---------------------------------------------------------------------------
CODE:00403D98
CODE:00403D98 ; *************** S U B R O U T I N E **************
CODE:00403D98
CODE:00403D98
CODE:00403D98 sub_403D98 proc near
CODE:00403D98 test eax, eax
CODE:00403D9A jz short locret_403DA3
CODE:00403D9A
CODE:00403D9C mov dl, 1
CODE:00403D9E mov ecx, [eax]
CODE:00403DA0 call dword ptr [ecx-4]
CODE:00403DA0
CODE:00403DA3
CODE:00403DA3 locret_403DA3: ;
CODE:00403DA3 retn
CODE:00403DA3
CODE:00403DA3 sub_403D98 endp
CODE:00403DA3
这里有一个Call Dword ptr[ecx-4] 是否可以断定这是一个虚拟函数的调用。
还有哪些情况下，会用到这样动态调用函数点的情况？谢谢
[培训]内核驱动高级班，冲击BAT一流互联网大厂工
作，每周日13:00-18:00直播授课
