|
挂钩Windows API(16) @@cont: test dh, C_DATAW0 shr 8 jnz @@dataw0 @@dataw0done: test dh, C_MODRM shr 8 jnz @@modrm @@exitmodrm: test dl, C_MEM67 jnz @@mem67 @@mem67done: test dh, C_DATA66 shr 8 jnz @@data66 @@data66done: mov eax, ecx sub eax, [esp+4]
and edx,C_MEM1+C_MEM2+C_MEM4+C_DATA1+C_DATA2+C_DATA4
|