Ⅰ 鎬庢牱鏌ョ湅QQ瀵嗙爜銆傦紵
濡傛灉鎮ㄦ兂瑕佹煡鐪婹Q瀵嗙爜錛屽彲浠ュ皾璇曚互涓嬫柟娉曪細
1. 閫氳繃瀵嗕繚鎵嬫満鏌ョ湅瀵嗙爜錛氬傛灉鎮ㄧ殑QQ璐﹀彿緇戝畾浜嗗瘑淇濇墜鏈猴紝鍙浠ラ氳繃鍙戦佺煭淇￠獙璇佺爜鐨勬柟寮忔壘鍥炲瘑鐮併傝風櫥褰昋Q瀹夊叏涓蹇冿紝閫夋嫨鈥滃瘑淇濆伐鍏封濓紝鐒跺悗閫夋嫨鈥滃瘑淇濇墜鏈衡濓紝鎸夌収鎻愮ず鎿嶄綔鍗沖彲銆
2. 閫氳繃瀵嗕繚闂棰樻煡鐪嬪瘑鐮侊細濡傛灉鎮ㄧ殑QQ璐﹀彿緇戝畾浜嗗瘑淇濋棶棰橈紝鍙浠ラ氳繃鍥炵瓟瀵嗕繚闂棰樼殑鏂瑰紡鏉ユ壘鍥炲瘑鐮併傝風櫥褰昋Q瀹夊叏涓蹇冿紝閫夋嫨鈥滃瘑淇濆伐鍏封濓紝鐒跺悗閫夋嫨鈥滃瘑淇濋棶棰樷濓紝鎸夌収鎻愮ず鎿嶄綔鍗沖彲銆
3. 閫氳繃濂藉弸鍗忓姪鏌ョ湅瀵嗙爜錛氬傛灉鎮ㄧ殑QQ璐﹀彿緇戝畾浜嗗ソ鍙嬶紝鍙浠ヨ峰ソ鍙嬪府蹇欐壘鍥炲瘑鐮併傝風櫥褰昋Q瀹夊叏涓蹇冿紝閫夋嫨鈥滃笎鍙風敵璇夆濓紝鐒跺悗鎸夌収鎻愮ず鎿嶄綔錛屾彁浜ょ敵璇夊悗錛屾偍鐨勫ソ鍙嬩細鏀跺埌鐢寵瘔閾炬帴錛岀偣鍑婚摼鎺ヨ繘鍏ョ敵璇夐〉闈錛屽府鍔╂偍鎵懼洖瀵嗙爜銆
4. 閫氳繃閭綆辨煡鐪嬪瘑鐮侊細濡傛灉鎮ㄧ殑QQ璐﹀彿緇戝畾浜嗛偖綆憋紝鍙浠ラ氳繃閭綆辨壘鍥炲瘑鐮併傝風櫥褰昋Q瀹夊叏涓蹇冿紝閫夋嫨鈥滃笎鍙風敵璇夆濓紝鐒跺悗鎸夌収鎻愮ず鎿嶄綔錛屾彁浜ょ敵璇夊悗錛岀郴緇熶細鍚戞偍鐨勯偖綆卞彂閫佷竴灝侀偖浠訛紝閭浠朵腑鍖呭惈閲嶇疆瀵嗙爜鐨勬搷浣滈摼鎺ワ紝鐐瑰嚮閾炬帴鍗沖彲閲嶇疆瀵嗙爜銆
5. 閫氳繃瀹樻柟瀹㈡湇鎵懼洖瀵嗙爜錛氬傛灉浠ヤ笂鏂規硶閮芥棤娉曟壘鍥炲瘑鐮侊紝寤鴻鎮ㄨ仈緋籕Q瀹樻柟瀹㈡湇瀵繪眰甯鍔┿傛偍鍙浠ラ氳繃瀹樻柟緗戠珯銆佸㈡埛絝鎴栬呭㈡湇鐢佃瘽絳夋柟寮忚仈緋誨㈡湇錛岃存槑鎮ㄧ殑鎯呭喌錛屽㈡湇浼氬崗鍔╂偍鎵懼洖鎴栭噸緗瀵嗙爜銆
Ⅱ QQ瀵嗙爜鍔犲瘑鍘熺悊
QQ2005 璐哄瞾鐗堢櫥褰曞彛浠ゅ姞瀵嗙畻娉曞強鍏舵簮浠ｇ爜http://www.cnhello.com Binny錛圔[email protected]錛 2005-12-11 3:27:33 鏌ョ湅: 嬈 鏄熺駭: 鏂囧瓧澶у皬: 杈冨ぇ 姝ｅ父 杈冨皬 鏀惰棌姝ら〉鍒365Key 鏀惰棌姝ら〉鍒版柊嫻猇iVi 銆愬艱匯戞嬁鍒癚Q 2005璐哄瞾鐗堝悗錛屽彂鐜板叾鍔犲瘑鍘熺悊騫舵病鏈夋柊鐨勬敼鍙橈紝緇忚繃璺熻釜鍜屽垎鏋愶紝緙栧埗鍑烘毚鍔涚牬瑙ｆ湰鍦癚Q瀵嗙爜鐨勭▼搴忋俀Q瀵嗙爜鍦ㄦｇ『鐧婚檰鍚庯紝浼氬皢鍔犲瘑鐨勭粨鏋滀繚瀛樺湪鐢ㄦ埛鐩褰曠殑ewh.db鏂囦歡涓錛屽姞瀵嗛噰鐢ㄥ叕寮鐨凪D5綆楁硶錛岄氳繃N嬈″驚鐜浠ュ強寮傛垨鍚庢眰鍙嶏紝鏈緇堣＄畻鍑哄姞瀵嗙殑緇撴灉錛屼笌鐢ㄦ埛鐨別wh.db鏂囦歡涓鐨勫瘑鏂囨瘮杈冨悗錛屽彂鍑衡滆緭鍏ュ瘑鐮佷笌涓婃℃垚鍔熺櫥褰曠殑瀵嗙爜涓嶄竴鑷,$0A鏄鍚﹀埌鏈嶅姟鍣ㄩ獙璇?鈥濓紙榪欐潯淇℃伅鍦˙asicCtrlDll.dll鐨勮祫婧愪腑錛$0A鍦–鐨勬牸寮忓寲涓涓哄洖杞︼級銆傛牴鎹榪欎釜鎻愮ず錛屽畬鎴愭湰鍦癚Q瀵嗙爜鐨勬毚鍔涚牬瑙ｃ 鎷垮埌QQ 2005璐哄瞾鐗堝悗錛屽彂鐜板叾鍔犲瘑鍘熺悊騫舵病鏈夋柊鐨勬敼鍙橈紝緇忚繃璺熻釜鍜屽垎鏋愶紝緙栧埗鍑烘毚鍔涚牬瑙ｆ湰鍦癚Q瀵嗙爜鐨勭▼搴忋
QQ瀵嗙爜鍦ㄦｇ『鐧婚檰鍚庯紝浼氬皢鍔犲瘑鐨勭粨鏋滀繚瀛樺湪鐢ㄦ埛鐩褰曠殑ewh.db鏂囦歡涓錛屽姞瀵嗛噰鐢ㄥ叕寮鐨凪D5綆楁硶錛岄氳繃N嬈″驚鐜浠ュ強寮傛垨鍚庢眰鍙嶏紝鏈緇堣＄畻鍑哄姞瀵嗙殑緇撴灉錛屼笌鐢ㄦ埛鐨別wh.db鏂囦歡涓鐨勫瘑鏂囨瘮杈冨悗錛屽彂鍑衡滆緭鍏ュ瘑鐮佷笌涓婃℃垚鍔熺櫥褰曠殑瀵嗙爜涓嶄竴鑷,$0A鏄鍚﹀埌鏈嶅姟鍣ㄩ獙璇?鈥濓紙榪欐潯淇℃伅鍦˙asicCtrlDll.dll鐨勮祫婧愪腑錛$0A鍦–鐨勬牸寮忓寲涓涓哄洖杞︼級銆傛牴鎹榪欎釜鎻愮ず錛屽畬鎴愭湰鍦癚Q瀵嗙爜鐨勬毚鍔涚牬瑙ｃ
鍦≦Q緋葷粺涓錛屸淨D鈥濇爣蹇椾唬琛≦Q Data錛屼緥濡傦紝鎴戜滑鍙浠ュ湪鏂囦歡User.db鎴杄wh.db涓鎵懼埌榪欎釜浠QD寮澶寸殑鏁版嵁緇撴瀯銆
涓銆 ewh.db鍘熷嬫暟鎹
51 44 01 01 03 00 04 03 00 BD AF A8 04 00 00 00
00 2E 06 00 07 03 00 B9 AB B4 10 00 00 00 07 22
AA 96 56 19 A3 9E 82 19 B7 2B BD 2D 34 4A 04 03
00 A9 B5 B2 04 00 00 00 3C A8 93 06
鍏朵腑錛岀孩鑹蹭負AST寰鐜嬈℃暟錛屽叞鑹蹭負EWH鍔犲瘑瀛楃︿覆錛岀豢鑹蹭負UIN QQ鍙鳳紙110340156=0x0693A83C錛孖ntel浣撶郴鍐呭瓨涓鎺掑垪欏哄簭涓猴細3CA89306錛夈
浜屻 ewh.db鏁版嵁緇撴瀯
HEX
鍋忕Щ DEC
鍋忕Щ 鏁版嵁 娉ㄩ噴 鍙橀噺
鏍囧織
0000 1 51 44 QD錛孮Q Data 鏁版嵁鏍囧織 Flag
0002 3 01 01 淇濈暀鐨勬暟鎹緇撴瀯 Reserve
0004 5 03 00 鎬繪暟鎹孌碉紙Data Sections錛夌殑涓鏁 Sections
0006 7 04 絎涓涓鏁版嵁孌碉紙綆縐1S錛屼笅鍚岋級鐨勭被鍨嬶紝鍙浠ヤ粠0x01鍒0x0F錛04浠ｈ〃鏈鏁版嵁娌＄粡榪囧姞瀵嗗勭悊銆 Type1S
0007 8 03 00 1S鏍囧織鐨勯暱搴︺ LenFlag1S
0009 10 BD AF A8 1S鏍囧織錛堜緥濡侫ST銆乁IN銆丒WH絳夛級錛屾槸緇忚繃綆鍗曠殑寮傛垨騫舵眰鍙嶈＄畻澶勭悊鐨勶紝姝ゅ勬槸AST錛屽彲鑳芥槸Algorithm Shift Times 鎴朅xxx Switch Time錛岀′粬鐨勫憿錛 Flag1S
000C 13 04 00 00 00 1S鏁版嵁鐨勯暱搴 LenData1S
0010 17 00 2E 06 00
= (404992) 1S鏁版嵁錛岃繖閲屾槸榪涜孧D5杞鎹㈢殑嬈℃暟銆
榪欎釜鏁版嵁鏄鍚岃＄畻鏈虹殑鎬ц兘鏈夊叧鐨勶紝鎬ц兘瓚婇珮鐨勮＄畻鏈猴紝鍦≦Q娉ㄥ唽鎴愬姛鍚庝駭鐢熺殑榪欎釜寰鐜鎺у埗鍙橀噺灝辮秺澶с Data1S
0014 21 07 2S鏁版嵁鐨勭被鍨嬶紝07浠ｈ〃浣跨敤MD5榪涜屽姞瀵 Type2S
0015 22 03 00 2S鏍囧織鐨勯暱搴 LenFlag2S
0017 24 B9 AB B4 2S鏍囧織錛屾ゅ勬槸EWH錛屼唬琛ㄦ湰鏁版嵁孌墊槸EWH瀵嗙爜鏁版嵁錛屽彲鑳芥槸Encrypt With Hash鐨勭緝鍐 Flag2S
001A 27 10 00 00 00 2S鏁版嵁鐨勯暱搴 LenData2S
001E 31 07 22 AA 96
56 19 A3 9E
82 19 B7 2B
BD 2D 34 4A 2S鏁版嵁錛屾槸緇忚繃MD5鍔犲瘑璁＄畻鍚庝駭鐢熺殑鏁版嵁錛屽綋鐒惰繕瑕佺粡榪囧紓鎴栧苟奼傚弽鐨勮＄畻澶勭悊錛屽弬鑰冧笅闈㈢▼搴忎腑鐨1000B858 琛屼唬鐮併 Data2S
002E 47 04 3S鏁版嵁鐨勭被鍨 Type3S
002F 48 03 00 3S鏍囧織鐨勯暱搴 LenFlag3S
0031 50 A9 B5 B2 3S鏍囧織錛屾ゅ勬槸UIN錛屼唬琛ㄦ湰鏁版嵁孌墊槸QQ鍙風爜錛屽彲鑳芥槸錛歎ser Identifier Number鐨勭緝鍐 Flag3S
0034 53 04 00 00 00 3S鏁版嵁鐨勯暱搴 LenData3S
0038 57 3C A8 93 06 3S鏁版嵁錛3C A8 93 06 = 110340156 Data3S
涓夈 鍔犲瘑鍘熺悊
涓嬮潰VB浼浠ｇ爜鐨勯儴鍒嗙﹀彿寮曡嚜浠ヤ笂絎浜岀偣銆婄粨鏋勮存槑銆嬩腑鐨勫彉閲忔爣蹇楋紝璇鋒敞鎰忕悊瑙ｏ細
Pwd = MD5(Pwd, Len(Pwd)) ' Pwd涓虹敤鎴瘋緭鍏ョ殑瀵嗙爜錛岀涓杞甅D5鍚庯紝Pwd鎴愪負16浣嶅瓧鑺傞暱搴︾殑MD5涓層
XorKey As Long = 0 'XorKey涓虹敤浜庤В瀵嗙殑瀛楄妭
For k = 1 To Data1S 鈥 1 '鍥犱負鍓嶉潰宸茬粡鍋氳繃涓杞錛屾墍浠ユゅ勮佸噺涓
Pwd = MD5(Pwd, 16)
Next k
XorKey = XorKey And &HFFFF
XorKey = (LenData2S And &HFF) Xor (LenData2S \ 256)
XorKey = &HFF - XorKey '奼傚弽
For k = 1 To 16
Pwd(k) = Pwd(k) Xor XorKey
Next k
If Pwd <> Data2S Then
MsgBox "杈撳叆瀵嗙爜涓庝笂嬈℃垚鍔熺櫥褰曠殑瀵嗙爜涓嶄竴鑷," & vbcrlf & "鏄鍚﹀埌鏈嶅姟鍣ㄩ獙璇?"
End If
閫氳繃浠ヤ笂鐨勬祦紼嬶紝鎴戠湡鐨勪僵鏈峇Q鐨勮捐¤咃紝濡傛ゅ法澶х殑寰鐜閲忥紝鍔犱笂寰鐜嬈℃暟鐨勯殢鏈烘э紝濡傛灉甯屾湜浜х敓涓涓猀Q MD5璇嶅吀綆鐩翠笉鍙鑳姐傝櫧鐒剁悊璁轟笂錛屽彲浠ヤ駭鐢熶竴涓狹D5瀛楀吀錛屼絾鏄錛岃繖涓瀛楀吀灝嗘湁1.15E+77*16涓瀛楄妭涔嬪法錛屽洜姝わ紝鍙濂芥牴鎹甧wh.db鏂囦歡鎻愪緵鐨勬暟鎹鏆村姏鐮磋В浜嗭紝涓嶇煡鏄涓嶆槸鏈夋洿濂界殑鏂規硶鍛錛
涓嶈繃鎴戠殑鎰熻夋槸錛屽驚鐜嬈℃暟鍔犲氫簡錛屽簲璇ヤ細浜х敓鏇村氱殑MD5紕版挒錛屼笉瑙佸緱鏄涓濂戒簨銆
榪樻湁涓縐嶇牬瑙ｆ濊礬錛屼篃璁告洿鍔犵洿鎺ワ紝灝嗗湪鍚庨潰鐨勬枃絝犱腑璇︾粏鎺㈣ㄣ備絾鏄鎴戝彧鏈夊湪鏈夋椂闂村仛瀹屽疄楠屽悗鎵嶆湁璧勬牸璇勮堪錛屼笉鍦ㄦ湰鏂囩珷鐨勮ㄨ鴻寖鍥村唴銆
鍥涖 鐮磋В綆楁硶
閲嶅嶈繘琛屾暟鍗佷竾嬈MD5鍔犲瘑錛屼細娑堣楄＄畻鏈哄緢澶氭椂闂達紝濡傛灉浣跨敤浼犵粺鐨刅B鎴朧C錛屽逛簬涓涓瀵嗙爜鐨勭瓑寰呮椂闂翠篃鏄寰堝彲瑙傜殑錛堜緥濡備嬌鐢╒B浠ｇ爜錛屾秷鑰楃殑鏃墮棿鍙鑳芥槸奼囩紪鐨400鍊嶏級錛屽洜姝わ紝鎴戜嬌鐢ㄦ眹緙栬璦鏉ョ紪鍒朵綆灞傚姞瀵嗚В瀵嗙畻娉曪紝閫氳繃MASM32緙栬瘧榪炴帴錛屾渶鍚庣敤楂樼駭璇璦璋冪敤銆傞氳繃鎻愪緵綆楁硶鍔ㄦ佸簱鐨勬柟寮忥紝鏂逛究鍏朵粬鏈夊叴瓚ｇ殑璇昏呰嚜宸卞炲姞涓板瘜鐨勫姛鑳姐備緥濡傚炲姞澶氱嚎紼嬬瓑錛岃繖涔熷皢鍦ㄤ互鍚庣殑鎺㈣ㄤ腑瀹炵幇銆傚湪姝や笉鍋氭繁鍏ヨㄨ恆
闄勫甫鐨勪緥瀛愪負VB鍜孷C璋冪敤奼囩紪璇璦鍔ㄦ佸簱鐨勪緥瀛愶紝VB浠ｇ爜綆鍗曞疄鐜頒簡閫氳繃瀵嗙爜瀛楀吀榪涜屽崟綰跨▼鐮磋В鐨勫姛鑳斤紝璇昏呭彲浠ヤ赴瀵屽叾鍐呭廣傚炲姞鏇村氱殑鍔熻兘銆
浜斻 QQ鏁版嵁緇撴瀯鍒嗘瀽
涓嬮潰涓哄姩鎬佸簱BasicCtrlDll.dll涓鍙嶆眹緙栫殑浠ｇ爜浠ュ強浠ｇ爜鍒嗘瀽錛屼富瑕佺敤浜庡垎鏋怑WH.DB涓鏁版嵁緇撴瀯浠ュ強QQ鏁版嵁瑙ｈ皟綆楁硶鐨勯棶棰樸傚彟澶栵紝榪欎釜綆楁硶涔熷彲浠ュ皢User.db涓鐨勬暟鎹鎻愬彇鍑烘潵銆傛繁鍏ョ爺絀朵笅鍘伙紝鍋氫竴涓鑱婂ぉ璁板綍鏌ョ湅鍣ㄤ箣綾葷殑杞浠朵篃闈為毦浜嬨
1000B71D B8 AC160110 mov eax,BasicCtr.100116AC
1000B722 E8 89460000 call BasicCtr.1000FDB0
1000B727 83EC 3C sub esp,3C
1000B72A 8B45 08 mov eax,dword ptr ss:[ebp+8] 灝嗘暟鎹鐨勫紑濮嬪湴鍧璧嬬粰EAX錛屽疄闄呮暟鎹涓**Data錛孍AX=*Data
1000B72D 53 push ebx
1000B72E 56 push esi
1000B72F 57 push edi
1000B730 8B30 mov esi,dword ptr ds:[eax] 闇瑕佽漿鎹㈢殑瀛楃︿覆錛孍AX鎸囩ず涓涓緇撴瀯錛岀涓涓鎴愬憳涓哄疄闄呯殑鏁版嵁鎸囬拡
1000B732 894D D8 mov dword ptr ss:[ebp-28],ecx 灞閮ㄥ彉閲廩ebp-28]淇濆瓨鍏ㄥ矓鐨勬爣蹇楃粨鏋勶紝ECX涓哄叏灞鍙傛暟鍦板潃錛屽湪璋冪敤鏈鍑芥暟鏃惰窡鍏
1000B735 8B46 F8 mov eax,dword ptr ds:[esi-8] 涓篊String緇撴瀯涓闀垮害鐨勬垚鍛橈紝琛ㄧず鎬誨叡澶氬皯涓瀛楄妭
1000B738 83F8 06 cmp eax,6 濡傛灉闀垮害灝忎簬6錛屽垯涓烘棤鏁堢殑鏁版嵁
1000B73B 0F82 81020000 jb BasicCtr.1000B9C2 濡傛灉姣6灝忓垯璺寵漿閫鍑猴紝璇存槑鏁版嵁閲忎笉澶熻В璋冪殑
1000B741 803E 51 cmp byte ptr ds:[esi],51 鏄鍚︿負 QQ Data 鐨勬暟鎹錛孮D涓篞Q鏁版嵁鏍囧織
1000B744 0F85 78020000 jnz BasicCtr.1000B9C2
1000B74A 807E 01 44 cmp byte ptr ds:[esi+1],44
1000B74E 0F85 6E020000 jnz BasicCtr.1000B9C2
1000B754 66:8B7E 04 mov di,word ptr ds:[esi+4] 瀵逛簬EWH鏉ヨ達紝涓虹4+1涓瀛楄妭錛屼負0003
1000B758 83C6 04 add esi,4 鎸囧悜鏁版嵁孌(Sections)鐨勪釜鏁
1000B75B 46 inc esi
1000B75C 83C0 FA add eax,-6 EAX鍘繪帀6涓瀛楄妭錛屽逛簬EWH鏉ヨ達紝鍓╀笅36H涓瀛楄妭
1000B75F 46 inc esi
1000B760 8945 08 mov dword ptr ss:[ebp+8],eax 鎸囧悜絎涓涓鏁版嵁孌
1000B763 E8 CE050000 call BasicCtr.1000BD36 鍦ㄥ唴瀛橈紙ECX+9C錛夊勫紑杈熶竴涓(100H)瀛楄妭鐨勭┖闂達紝絀洪棿鍦板潃榪斿洖鍒癊AX
1000B768 8365 E0 00 and dword ptr ss:[ebp-20],0 灞閮ㄥ彉閲廩ebp-20]娓呴浂
1000B76C 0FB7C7 movzx eax,di 杞鎹㈠埌EAX錛屽逛簬EWH錛宒i=3銆傝〃紺烘湁3孌墊暟鎹
1000B76F 85C0 test eax,eax
1000B771 8945 B8 mov dword ptr ss:[ebp-48],eax 灞閮ㄥ彉閲廩ebp-48]淇濆瓨鏁版嵁鐨勬墊暟
1000B774 0F8E 21020000 jle BasicCtr.1000B99B
1000B77A 837D 08 07 cmp dword ptr ss:[ebp+8],7 濡傛灉鏁翠釜闀垮害灝忎簬7錛屽垯鍓╀笅鐨勫簲璇ユ槸QQ鍙蜂簡銆傜涓嬈¤繘鍏ユ椂=36H
1000B77E 0F82 3E020000 jb BasicCtr.1000B9C2 濡傛灉鍓╀綑鐨勬暟鎹闀垮害灝忎簬7鍒欓鍑
1000B784 8A06 mov al,byte ptr ds:[esi] 絎涓嬈¤繘鍏ユ椂錛孍SI鎸囧悜絎7涓鏁版嵁鍗蟲暟鎹孌電殑綾誨瀷錛屼緥濡 04
1000B786 66:8B4E 01 mov cx,word ptr ds:[esi+1] CX=鍚庝竴涓鏁版嵁錛屽強鏁版嵁孌墊爣蹇楃殑闀垮害錛屼緥濡 0003
1000B78A 46 inc esi
1000B78B 8B55 08 mov edx,dword ptr ss:[ebp+8] 鍓╀綑鐨勬暟鎹闀垮害錛屽36H
1000B78E 836D 08 03 sub dword ptr ss:[ebp+8],3 鍘繪帀3涓錛屼緥濡傛垚涓33H=51
1000B792 894D C8 mov dword ptr ss:[ebp-38],ecx 灞閮ㄥ彉閲廩ebp-38]淇濆瓨鏁版嵁孌典腑鏍囧織闀垮害
1000B795 0FB7F9 movzx edi,cx EDI涓烘爣蹇楅暱搴︿簡
1000B798 46 inc esi
1000B799 8845 E4 mov byte ptr ss:[ebp-1C],al 灞閮ㄥ彉閲廩ebp-1C]淇濆瓨鏈孌電殑綾誨瀷
1000B79C 8D4F 04 lea ecx,dword ptr ds:[edi+4] ECX涓哄彇寰楃殑鏍囧織闀垮害鍐嶅姞涓4錛屼緥濡=7
1000B79F 46 inc esi 絎涓嬈℃椂錛孍SI鎸囧悜絎涓涓鏁版嵁孌電殑鏍囧織瀛楁典簡錛屼緥濡傛寚鍚態DAFA8錛岀9涓鏁版嵁寮濮
1000B7A0 394D 08 cmp dword ptr ss:[ebp+8],ecx 濡傛灉鍓╀綑鐨勬暟鎹姣斺滄爣蹇楅暱搴+4鈥濊繕灝戱紝鍒欐病鏈夋暟鎹錛屽洜姝や笉榪涜屽勭悊
1000B7A3 0F82 19020000 jb BasicCtr.1000B9C2
1000B7A9 8B0C37 mov ecx,dword ptr ds:[edi+esi] 璺寵繃鏁版嵁孌電殑鏍囧織閮ㄥ垎錛屽皢鏁版嵁孌電殑闀垮害璧嬪肩粰ECX銆備緥濡俒edi+esi]=4
1000B7AC 8D1C37 lea ebx,dword ptr ds:[edi+esi] EBX淇濆瓨鏂扮殑鎸囬拡錛屾寚鍚戞暟鎹孌典腑鏁版嵁閮ㄥ垎鐨勯暱搴﹂儴鍒嗭紝渚嬪傦紝[EBX]=4
1000B7AF 895D C4 mov dword ptr ss:[ebp-3C],ebx 灞閮ㄥ彉閲廩ebp-3C]淇濆瓨鏁版嵁孌典腑鏁版嵁閮ㄥ垎鐨勯暱搴︽寚閽
1000B7B2 8D4C0F 07 lea ecx,dword ptr ds:[edi+ecx+7] 浠庢爣蹇楋紙鑷韜闀3錛屽姞涓4涓闀垮害浣=7錛夊紑濮嬶紝鍔犱笂鏁版嵁闀垮害錛屼負瀹屾暣鏁版嵁闀垮害銆備緥濡侲
1000B7B6 3BCA cmp ecx,edx 濡傛灉鍓╀笅鐨勬暟鎹闀垮害錛堝36H錛変笉澶燂紝鍒欓鍑
1000B7B8 894D CC mov dword ptr ss:[ebp-34],ecx 灞閮ㄥ彉閲廩ebp-34]淇濆瓨鏈鏁版嵁孌電殑鎬婚暱搴
1000B7BB 0F87 01020000 ja BasicCtr.1000B9C2 濡傛灉灝忎簬鍒欓鍑虹▼搴
1000B7C1 8365 F0 00 and dword ptr ss:[ebp-10],0 灞閮ㄥ彉閲廩ebp-10]娓呴浂
1000B7C5 3C 01 cmp al,1 al淇濆瓨鏈孌電殑綾誨瀷錛屾湁鏁堢殑綾誨瀷鏄4鎴7
1000B7C7 74 18 je short BasicCtr.1000B7E1
1000B7C9 3C 02 cmp al,2
1000B7CB 74 14 je short BasicCtr.1000B7E1
1000B7CD 3C 03 cmp al,3
1000B7CF 74 10 je short BasicCtr.1000B7E1
1000B7D1 3C 04 cmp al,4
1000B7D3 74 0C je short BasicCtr.1000B7E1
1000B7D5 3C 05 cmp al,5
1000B7D7 74 08 je short BasicCtr.1000B7E1
1000B7D9 3C 07 cmp al,7
1000B7DB 74 04 je short BasicCtr.1000B7E1
1000B7DD 3C 06 cmp al,6
1000B7DF 75 19 jnz short BasicCtr.1000B7FA
1000B7E1 51 push ecx 涓烘湰孌電殑鎬婚暱搴︼紝鍖呮嫭錛堟電被鍨+鏍囧織闀垮害+鏍囧織+鏁版嵁闀垮害+鏁版嵁錛夛紝渚嬪傦紝瀵逛簬瀵嗙爜孌=1AH
1000B7E2 E8 23430000 call <MFC42.operator new>
1000B7E7 FF75 CC push dword ptr ss:[ebp-34] n=[ebp-34]錛屽矓閮ㄥ彉閲廩ebp-34]淇濆瓨鏈鏁版嵁孌電殑鎬婚暱搴
1000B7EA 8D4E FD lea ecx,dword ptr ds:[esi-3] [esi-3]鎸囧悜鏈孌電殑寮濮嬶紙浠庢電被鍨嬬畻璧鳳級
1000B7ED 8945 F0 mov dword ptr ss:[ebp-10],eax 灞閮ㄥ彉閲廩ebp-10]淇濆瓨鎷瘋礉鍚庣殑鏁版嵁
1000B7F0 51 push ecx src
1000B7F1 50 push eax dest
1000B7F2 E8 E5450000 call <MSVCRT.memcpy> memcpy錛屽皢鏈孌電殑鏁存墊暟鎹鎷瘋礉鍒版柊鐨勫湴鏂癸紝鏁版嵁鎸囬拡淇濆瓨鍦ㄥ矓閮ㄥ彉閲廩ebp-10]涓
1000B7F7 83C4 10 add esp,10
1000B7FA 8B45 C8 mov eax,dword ptr ss:[ebp-38] 灞閮ㄥ彉閲廩ebp-38]淇濆瓨鏁版嵁孌典腑鏍囧織闀垮害
1000B7FD 33C9 xor ecx,ecx
1000B7FF 32C4 xor al,ah 灝嗕綆浣嶉暱搴︿笌楂樹綅寮傛垨錛屼緥濡3 xor 0=3
1000B801 85FF test edi,edi EDI涓烘爣蹇椾綅鐨勯暱搴
1000B803 76 12 jbe short BasicCtr.1000B817 濡傛灉鏈孌墊病鏈夋墊爣蹇楋紝鍒欒煩杞
1000B805 8A1431 mov dl,byte ptr ds:[ecx+esi] 寮濮嬪驚鐜錛屽驚鐜嬈℃暟涓烘爣蹇楃殑闀垮害銆 ECX絎涓嬈℃椂涓0錛屽皢絎涓涓鏁版嵁鍔犺澆鍒癉L涓銆
1000B808 32D0 xor dl,al AL涓洪暱搴︾殑楂樹綅鍜屼綆浣嶇殑寮傛垨錛岃繖閲屼負3
1000B80A F6D2 not dl DL=NOT ([鏁版嵁] xor [鏁版嵁孌墊爣蹇楅暱搴︾殑楂樹綅 xor 鏁版嵁孌墊爣蹇楅暱搴︾殑浣庝綅])
1000B80C 881431 mov byte ptr ds:[ecx+esi],dl 鏁版嵁淇濆瓨鍦ㄥ師濮嬬殑鍐呭瓨涓鐩稿簲鐨勫湴鏂
1000B80F 41 inc ecx
1000B810 3BCF cmp ecx,edi
1000B812 72 F1 jb short BasicCtr.1000B805
1000B814 8B5D C4 mov ebx,dword ptr ss:[ebp-3C] 灞閮ㄥ彉閲廩ebp-3C]淇濆瓨鏁版嵁孌典腑鏁版嵁閮ㄥ垎鐨勯暱搴︽寚閽
1000B817 57 push edi EDI涓烘爣蹇椾綅鐨勯暱搴
1000B818 56 push esi ESI涓烘寚鍚戣В瀵嗕互鍚庣殑鏁版嵁錛屼緥濡侫ST
1000B819 8D4D E8 lea ecx,dword ptr ss:[ebp-18] 灞閮ㄥ彉閲廩ebp-18]瀛樻斁寮哄埗綾誨瀷杞鎹浠ュ悗鐨勬暟鎹鎸囬拡鐨勬寚閽堬紝渚嬪侫ST
1000B81C E8 5B430000 call <MFC42.CString::CString> 灝嗚В瀵嗗悗鐨勬暟鎹鍙樻垚CString綾誨瀷銆傝繑鍥炵殑綾誨瀷鏀懼湪EAX鎸囩ず鐨勫湴鍧涓
1000B821 8365 FC 00 and dword ptr ss:[ebp-4],0 灞閮ㄥ彉閲廩ebp-4]娓呴浂
1000B825 6A FC push -4
1000B827 58 pop eax EAX=-4=FFFFFFFC
1000B828 8BF3 mov esi,ebx ebx淇濆瓨鏁版嵁孌典腑鏁版嵁閮ㄥ垎鐨勯暱搴︽寚閽
1000B82A 2BC7 sub eax,edi EAX=EAX-EDI=FFFFFFFC-3=FFFFFFF9
1000B82C 8B1E mov ebx,dword ptr ds:[esi] ebx涓烘暟鎹孌典腑鏁版嵁閮ㄥ垎鐨勯暱搴︿簡
1000B82E 0145 08 add dword ptr ss:[ebp+8],eax 絎涓嬈℃椂錛孾EBP+8]=33銆傛墽琛屽悗=2C錛岀浉褰撲簬33H-7H=2CH
1000B831 83C6 04 add esi,4 ESI鎸囧悜鏁版嵁孌典腑鐨勬暟鎹閮ㄥ垎浜
1000B834 395D 08 cmp dword ptr ss:[ebp+8],ebx [ebp+8]=2C錛宔bx=4
1000B837 0F82 6A010000 jb BasicCtr.1000B9A7
1000B83D 807D E4 07 cmp byte ptr ss:[ebp-1C],7 灞閮ㄥ彉閲廩ebp-1C]淇濆瓨鏈孌電殑綾誨瀷錛 4鎴栬7
1000B841 74 06 je short BasicCtr.1000B849
1000B843 807D E4 06 cmp byte ptr ss:[ebp-1C],6 濡傛灉綾誨瀷涓嶄負6錛屽垯鎵ц1000B862
1000B847 75 19 jnz short BasicCtr.1000B862
1000B849 8AC3 mov al,bl 濡傛灉鏁版嵁孌電殑綾誨瀷涓7錛屽垯鎵ц屾よ鍙ャ侭L鍖呭惈鏈孌電殑闀垮害
1000B84B 33FF xor edi,edi
1000B84D 32C7 xor al,bh al=錛堥暱搴︾殑浣庝綅 xor 闀垮害鐨勯珮浣嶏級
1000B84F 85DB test ebx,ebx
1000B851 76 0F jbe short BasicCtr.1000B862 濡傛灉闀垮害涓0錛屽垯琛ㄧず娌℃湁瀵嗙爜
1000B853 8A0C37 mov cl,byte ptr ds:[edi+esi]
1000B856 32C8 xor cl,al
1000B858 F6D1 not cl DL=NOT ([鏁版嵁] xor [鏁版嵁孌墊爣蹇楅暱搴︾殑楂樹綅xor 鏁版嵁孌墊爣蹇楅暱搴︾殑浣庝綅])
1000B85A 880C37 mov byte ptr ds:[edi+esi],cl
1000B85D 47 inc edi
1000B85E 3BFB cmp edi,ebx
1000B860 72 F1 jb short BasicCtr.1000B853 寰鐜鐩村埌鍏ㄩ儴鏁版嵁瑙ｈ皟瀹屾瘯
1000B862 53 push ebx 鏁版嵁涓茬殑闀垮害
1000B863 56 push esi 鍘熷嬬殑闇瑕佸彉鎹㈢殑鏁版嵁
1000B864 8D4D EC lea ecx,dword ptr ss:[ebp-14] 灞閮ㄥ彉閲廩ebp-14]瀛樻斁寮哄埗CString綾誨瀷杞鎹浠ュ悗鐨勬暟鎹鎸囬拡鐨勬寚閽堬紝渚嬪侱B2E0600
1000B867 E8 10430000 call <MFC42.CString::CString>
1000B86C 8A45 E4 mov al,byte ptr ss:[ebp-1C] 灞閮ㄥ彉閲廩ebp-1C]淇濆瓨鏈孌電殑綾誨瀷錛4鎴栬7
1000B86F 295D 08 sub dword ptr ss:[ebp+8],ebx 鍘繪帀宸茬粡澶勭悊鐨勬暟鎹錛屾墽琛屽悗 [ebp+8]=28H錛宔bx涓烘暟鎹孌典腑鏁版嵁閮ㄥ垎鐨勯暱搴
1000B872 03F3 add esi,ebx ESI鎸囧悜涓嬩竴涓鏁版嵁孌電殑寮濮嬮儴鍒嗭紝ebx淇濆瓨鏁版嵁孌典腑鏁版嵁閮ㄥ垎鐨勯暱搴︽寚閽
1000B874 33FF xor edi,edi
1000B876 84C0 test al,al 嫻嬭瘯鏈孌電殑綾誨瀷鏄鍚︿負0
1000B878 C645 FC 01 mov byte ptr ss:[ebp-4],1 灞閮ㄥ竷灝斿瀷鍙橀噺[ebp-4]=1
1000B87C 0F86 A3010000 jbe BasicCtr.1000BA25 濡傛灉鏈孌電殑鏁版嵁綾誨瀷涓0錛屽垯鎵ц 1000BA25鍚庨鍑
1000B882 3C 07 cmp al,7
1000B884 0F86 B6000000 jbe BasicCtr.1000B940 濡傛灉灝忎簬絳変簬7錛屽垯璺寵漿鍒1000B940鎵ц屻傚逛簬EWH鏉ヨ村氨鏄榪欐牱
1000B88A 3C 08 cmp al,8
1000B88C 0F84 74010000 je BasicCtr.1000BA06 濡傛灉鏁版嵁綾誨瀷涓8錛屽垯鐩存帴閫鍑恆
1000B892 3C 09 cmp al,9
1000B894 74 5D je short BasicCtr.1000B8F3
1000B896 3C 0A cmp al,0A
1000B898 0F85 87010000 jnz BasicCtr.1000BA25
1000B89E 8B4D D8 mov ecx,dword ptr ss:[ebp-28] 褰撴暟鎹綾誨瀷涓篈鏃訛紝鎵ц屾湰紼嬪簭浠ｇ爜
1000B8A1 8D45 D4 lea eax,dword ptr ss:[ebp-2C]
1000B8A4 50 push eax
1000B8A5 E8 47FEFFFF call BasicCtr.1000B6F1
1000B8AA 8B45 D4 mov eax,dword ptr ss:[ebp-2C]
1000B8AD FF75 EC push dword ptr ss:[ebp-14]
1000B8B0 8B08 mov ecx,dword ptr ds:[eax]
1000B8B2 53 push ebx
1000B8B3 50 push eax
1000B8B4 FF91 BC000000 call dword ptr ds:[ecx+BC]
1000B8BA 8BD8 mov ebx,eax
1000B8BC 85DB test ebx,ebx
1000B8BE 0F85 12010000 jnz BasicCtr.1000B9D6
1000B8C4 8B45 D4 mov eax,dword ptr ss:[ebp-2C]
1000B8C7 6A 04 push 4
1000B8C9 8945 DC mov dword ptr ss:[ebp-24],eax
1000B8CC 8D45 DC lea eax,dword ptr ss:[ebp-24]
1000B8CF 50 push eax
1000B8D0 8D4D C0 lea ecx,dword ptr ss:[ebp-40]
1000B8D3 E8 A4420000 call <MFC42.CString::CString>
1000B8D8 50 push eax
1000B8D9 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000B8DC C645 FC 03 mov byte ptr ss:[ebp-4],3
1000B8E0 E8 C3400000 call <MFC42.CString::operator=>
1000B8E5 C645 FC 01 mov byte ptr ss:[ebp-4],1
1000B8E9 8D4D C0 lea ecx,dword ptr ss:[ebp-40]
1000B8EC E8 AB400000 call <MFC42.CString::~CString>
1000B8F1 EB 50 jmp short BasicCtr.1000B943
1000B8F3 8B4D D8 mov ecx,dword ptr ss:[ebp-28] 褰撴暟鎹綾誨瀷涓9鏃訛紝鎵ц岃繖涓鎿嶄綔
1000B8F6 8D45 D0 lea eax,dword ptr ss:[ebp-30]
1000B8F9 50 push eax
1000B8FA E8 4E180000 call BasicCtr.1000D14D
1000B8FF 8B45 D0 mov eax,dword ptr ss:[ebp-30]
1000B902 FF75 EC push dword ptr ss:[ebp-14]
1000B905 8B08 mov ecx,dword ptr ds:[eax]
1000B907 53 push ebx
1000B908 50 push eax
1000B909 FF51 78 call dword ptr ds:[ecx+78]
1000B90C 8BD8 mov ebx,eax
1000B90E 85DB test ebx,ebx
1000B910 0F85 D4000000 jnz BasicCtr.1000B9EA
1000B916 8B45 D0 mov eax,dword ptr ss:[ebp-30]
1000B919 6A 04 push 4
1000B91B 8945 DC mov dword ptr ss:[ebp-24],eax
1000B91E 8D45 DC lea eax,dword ptr ss:[ebp-24]
1000B921 50 push eax
1000B922 8D4D BC lea ecx,dword ptr ss:[ebp-44]
1000B925 E8 52420000 call <MFC42.CString::CString>
1000B92A 50 push eax
1000B92B 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000B92E C645 FC 02 mov byte ptr ss:[ebp-4],2
1000B932 E8 71400000 call <MFC42.CString::operator=>
1000B937 C645 FC 01 mov byte ptr ss:[ebp-4],1
1000B93B 8D4D BC lea ecx,dword ptr ss:[ebp-44]
1000B93E EB AC jmp short BasicCtr.1000B8EC
1000B940 6A 01 push 1 褰撴暟鎹孌電殑綾誨瀷<=7鏃訛紝鐩存帴浠庢ゅ勬墽琛
1000B942 5F pop edi
1000B943 8B5D D8 mov ebx,dword ptr ss:[ebp-28] 灞閮ㄥ彉閲廩ebp-28]淇濆瓨鍏ㄥ矓鐨勬爣蹇楃粨鏋
1000B946 8D45 EC lea eax,dword ptr ss:[ebp-14] 灞閮ㄥ彉閲廩ebp-14]瀛樻斁寮哄埗綾誨瀷杞鎹浠ュ悗鐨勬暟鎹鎸囬拡鐨勬寚閽堬紝渚嬪侱B2E0600
1000B949 50 push eax EAX瀛樻斁寮哄埗綾誨瀷杞鎹浠ュ悗鐨勬暟鎹鎸囬拡
1000B94A 8D45 E8 lea eax,dword ptr ss:[ebp-18] 灞閮ㄥ彉閲廩ebp-18]瀛樻斁寮哄埗綾誨瀷杞鎹浠ュ悗鐨勬暟鎹鎸囬拡鐨勬寚閽堬紝渚嬪侫ST
1000B94D FF75 E4 push dword ptr ss:[ebp-1C] 灞閮ㄥ彉閲廩ebp-1C]涓鐨勭涓涓瀛楄妭淇濆瓨鏈孌電殑綾誨瀷錛4鎴栬7
1000B950 8BCB mov ecx,ebx
1000B952 50 push eax
1000B953 E8 B4FCFFFF call BasicCtr.1000B60C call 1000B60C(CString,Flag,CString)
1000B958 85FF test edi,edi
1000B95A 74 18 je short BasicCtr.1000B974
1000B95C 8B45 E0 mov eax,dword ptr ss:[ebp-20] 灞閮ㄥ彉閲廩ebp-28]絎涓嬈′負0錛屼負涓涓璁℃暟鍣
1000B95F 8B4B 64 mov ecx,dword ptr ds:[ebx+64] 瀛樺湪浜庢爣蹇楃粨鏋勪腑錛屼負涓涓鍏ㄥ矓鍦板潃
1000B962 8B55 F0 mov edx,dword ptr ss:[ebp-10] 灞閮ㄥ彉閲廩ebp-10]淇濆瓨鎷瘋礉鍚庣殑鏁版嵁錛屽嵆娌℃湁緇忚繃澶勭悊鐨勩備緥濡040300BDAF鈥︹
1000B965 C1E0 02 shl eax,2 EAX=EAX*2
1000B968 891401 mov dword ptr ds:[ecx+eax],edx 灝嗘湭鍋氳В璋冪殑鍘熷嬫暟鎹鏀懼埌鍏ㄥ矓緇撴瀯涓鏌愪釜鎸囬拡鎸囩ず鐨勫唴瀛樹腑
1000B96B 8B4B 78 mov ecx,dword ptr ds:[ebx+78] 瀛樺湪浜庢爣蹇楃粨鏋勪腑錛屼負涓涓鍏ㄥ矓鍦板潃
1000B96E 8B55 CC mov edx,dword ptr ss:[ebp-34] 灞閮ㄥ彉閲廩ebp-34]淇濆瓨鏈鏁版嵁孌電殑鎬婚暱搴
1000B971 891401 mov dword ptr ds:[ecx+eax],edx 灝嗘暟鎹闀垮害鏀懼埌鍏ㄥ矓緇撴瀯涓鏌愪釜鎸囬拡鎸囩ず鐨勫唴瀛樹腑
1000B974 8065 FC 00 and byte ptr ss:[ebp-4],0 灞閮ㄥ竷灝斿瀷鍙橀噺[ebp-4]=0
1000B978 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000B97B E8 1C400000 call <MFC42.CString::~CString> 娓呴櫎鏁版嵁孌典腑鐨勬暟鎹閮ㄥ垎CString
1000B980 834D FC FF or dword ptr ss:[ebp-4],FFFFFFFF 灞閮ㄥ竷灝斿瀷鍙橀噺[ebp-4]=-1錛屼負True
1000B984 8D4D E8 lea ecx,dword ptr ss:[ebp-18]
1000B987 E8 10400000 call <MFC42.CString::~CString> 娓呴櫎鏁版嵁孌典腑鐨勬爣蹇楅儴鍒咰String錛屼緥濡侫ST
1000B98C FF45 E0 inc dword ptr ss:[ebp-20] 灞閮ㄥ彉閲廩ebp-28]璁℃暟鍣ㄥ姞涓
1000B98F 8B45 E0 mov eax,dword ptr ss:[ebp-20]
1000B992 3B45 B8 cmp eax,dword ptr ss:[ebp-48] 灞閮ㄥ彉閲廩ebp-48]淇濆瓨鏁版嵁鐨勬墊暟
1000B995 0F8C DFFDFFFF jl BasicCtr.1000B77A 寰鐜瑙ｈ皟姣忎釜鏁版嵁孌
1000B99B 8B45 08 mov eax,dword ptr ss:[ebp+8] 鏈鍚庡墿浣欑殑闀垮害
1000B99E F7D8 neg eax
1000B9A0 1BC0 sbb eax,eax
1000B9A2 83E0 04 and eax,4
1000B9A5 EB 1E jmp short BasicCtr.1000B9C5
1000B9A7 837D F0 00 cmp dword ptr ss:[ebp-10],0
1000B9AB 74 09 je short BasicCtr.1000B9B6
1000B9AD FF75 F0 push dword ptr ss:[ebp-10]
1000B9B0 E8 FF3F0000 call <MFC42.operator delete>
1000B9B5 59 pop ecx
1000B9B6 834D FC FF or dword ptr ss:[ebp-4],FFFFFFFF
1000B9BA 8D4D E8 lea ecx,dword ptr ss:[ebp-18]
1000B9BD E8 DA3F0000 call <MFC42.CString::~CString>
1000B9C2 6A 04 push 4
1000B9C4 58 pop eax
1000B9C5 8B4D F4 mov ecx,dword ptr ss:[ebp-C]
1000B9C8 5F pop edi
1000B9C9 5E pop esi
1000B9CA 5B pop ebx
1000B9CB 64:890D 000000 mov dword ptr fs:[0],ecx
1000B9D2 C9 leave
1000B9D3 C2 0400 retn 4
1000B9D6 837D F0 00 cmp dword ptr ss:[ebp-10],0
1000B9DA 74 09 je short BasicCtr.1000B9E5
1000B9DC FF75 F0 push dword ptr ss:[ebp-10]
1000B9DF E8 D03F0000 call <MFC42.operator delete>
1000B9E4 59 pop ecx
1000B9E5 8B45 D4 mov eax,dword ptr ss:[ebp-2C]
1000B9E8 EB 12 jmp short BasicCtr.1000B9FC
1000B9EA 837D F0 00 cmp dword ptr ss:[ebp-10],0
1000B9EE 74 09 je short BasicCtr.1000B9F9
1000B9F0 FF75 F0 push dword ptr ss:[ebp-10]
1000B9F3 E8 BC3F0000 call <MFC42.operator delete>
1000B9F8 59 pop ecx
1000B9F9 8B45 D0 mov eax,dword ptr ss:[ebp-30]
1000B9FC 8B08 mov ecx,dword ptr ds:[eax]
1000B9FE 50 push eax
1000B9FF FF51 08 call dword ptr ds:[ecx+8]
1000BA02 8BF3 mov esi,ebx
1000BA04 EB 03 jmp short BasicCtr.1000BA09
1000BA06 6A 04 push 4
1000BA08 5E pop esi
1000BA09 8065 FC 00 and byte ptr ss:[ebp-4],0
1000BA0D 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000