; push a pointer to "user32" onto stack
mov bx, 0x3233                 ; rest of ebx is null
push ebx
push 0x72657375
push esp
                       
这几句是干嘛用的没看懂 -_-!

0x3233和0x72657375是什么?

还有这段

find_functions:
pushad                         ; preserve registers
mov eax, [ebp + 0x3c]        ; eax = start of PE header
mov ecx, [ebp + eax + 0x78]        ; ecx = relative offset of export table
add ecx, ebp                 ; ecx = absolute addr of export table
mov ebx, [ecx + 0x20]         ; ebx = relative offset of names table
add ebx, ebp                 ; ebx = absolute addr of names table
xor edi, edi                 ; edi will count through the functions

其中这两句
mov ecx, [ebp + eax + 0x78]        ; ecx = relative offset of export table
add ecx, ebp                 ; ecx = absolute addr of export table
为什么还要加ebp呢,这里的eax是偏移量啊?

谢谢哦

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课