神奇的F5一下,自动生成伪代码. 没大看明白,认错了N多.以后有时间手工弄一下,44K太大了.
int __thiscall sub_10001000(int this, LPCSTR lpLibFileName, LPCSTR lpProcName, DWORD flOldProtect)
{
HMODULE v4; // eax@1
const void *v5; // edi@1
int v6; // esi@1
FARPROC v8; // eax@4
DWORD v9; // edx@1
const CHAR *v10; // eax@1
LPVOID v11; // eax@5
void *v12; // ST04_4@5
HANDLE v13; // eax@5
signed int v14; // [sp+Ch] [bp-24h]@1
signed int v15; // [sp+10h] [bp-20h]@1
struct _MEMORY_BASIC_INFORMATION Buffer; // [sp+14h] [bp-1Ch]@5
v6 = this;
v9 = flOldProtect;
v14 = 1073742008;
v5 = (const void *)(this + 4);
v15 = 14745344;
*(_DWORD *)(this + 4) = 1073742008;
v10 = lpLibFileName;
*(_DWORD *)(this + 8) = 14745344;
*(_DWORD *)(this + 5) = v9;
v4 = LoadLibraryA(v10);
*(_DWORD *)(v6 + 20) = v4;
if ( !v4 )
{
*(_DWORD *)v6 = 0;
return v6;
}
v8 = GetProcAddress(v4, lpProcName);
*(_DWORD *)v6 = v8;
if ( !v8 )
return v6;
VirtualQuery(v8, &Buffer, 0x1Cu);
VirtualProtect(*(LPVOID *)v6, 8u, 4u, &flOldProtect);
v11 = *(LPVOID *)v6;
v12 = *(void **)v6;
*(_DWORD *)(v6 + 12) = **(_DWORD **)v6;
*(_DWORD *)(v6 + 16) = *((_DWORD *)v11 + 1);
v13 = GetCurrentProcess();
WriteProcessMemory(v13, v12, v5, 8u, 0);
VirtualProtect(*(LPVOID *)v6, 8u, Buffer.Protect, 0);
MessageBoxA(0, "DLL_OK!", 0, 0);
return v6;
}
