mov eax,dword ptr ds:[0x4356BA0]
sub esp,0x18
cmp eax,0x2
jnz Xchina_lo.0043716C
mov ax,word ptr ds:[0x4356B9C]
mov cx,word ptr ss:[esp+0x1C]
mov dx,word ptr ss:[esp+0x20]
mov word ptr ss:[esp+0x4],ax
mov eax,dword ptr ss:[esp+0xA]
mov word ptr ss:[esp+0x8],cx
mov word ptr ss:[esp+0x6],dx
mov edx,dword ptr ss:[esp+0x24]
mov ecx,eax
xor ecx,edx
mov dx,word ptr ss:[esp+0x28]
and ecx,0xFFFFFF
xor eax,ecx
mov cx,word ptr ss:[esp+0x30]
mov word ptr ss:[esp+0x12],dx
mov dword ptr ss:[esp+0xA],eax
mov eax,dword ptr ss:[esp+0x2C]
lea edx,dword ptr ss:[esp]
push 0x16
push edx
mov word ptr ss:[esp+0x8],0x16
mov word ptr ss:[esp+0xA],0x1EA4
mov dword ptr ss:[esp+0x16],eax
mov word ptr ss:[esp+0x1C],cx
call china_lo.00435F00
感谢2位朋友的回答,不过我可以肯定地说
置代码 ({ })
pushad ()
这里是具体代码部分
popad ()
ret ()
代码 = _取代码 ()
调用汇编代码 (进程ID, 代码)
这是清风汇编模块的指令
取个例子:call 00435F00 这个call如果是无参call的话,那么到易语言里就应该写成
置代码 ({ })
pushad ()
mov_eax("00435F00")
call_eax()
popad ()
ret ()
代码 = _取代码 ()
调用汇编代码 (进程ID, 代码)