挂钩Windows API(18) or dh, C_DATA4 shr 8 jmp @@cont@@0F: mov al, [ecx] inc ecx or edx, table_0F[eax*4] cmp edx, -1 jne @@cont@@error: mov eax, edx jmp @@exit@@dataw0: xor dh, C_DATA66 shr 8 test al, 00000001b jnz @@dataw0done