虫虫联盟

 找回密码
 立即注册

扫一扫,访问微社区

QQ登录

只需一步,快速开始

新浪微博登陆

只需一步, 快速开始

查看: 1565|回复: 1

[源码分享] 【类人猿】TC内联汇编库

[复制链接]
  • TA的每日心情

    2018-6-1 15:26
  • 签到天数: 18 天

    [LV.4]偶尔看看III

    13

    主题

    33

    帖子

    300

    积分

    中级会员

    Rank: 3Rank: 3

    积分
    300
    QQ
    类人猿 发表于 2017-8-29 23:50:26 | 显示全部楼层 |阅读模式
    本帖最后由 楚楚 于 2017-8-30 21:09 编辑

         TC可以直接内联汇编,这个库是本人初稿,新建个T文件辅助进去即可。此库给大家吃一颗定心丸。TC图色超强,内存一样无比强大。  学TC一起放手干吧!
         免费无私公开给大家拿去完善。
    1. function 远程注入数据(Hwnd,字节集)
    2.     字节集=字节集&" C3"
    3.     var size_Str=strlen(strreplace(字节集," ",""))+20
    4.     var addr= (申请指定窗口内存空间(Hwnd,size_Str))
    5.     //调试输出(strformat("%x", addr))
    6.     写data(Hwnd,addr,字节集)
    7.     var PID=根据窗口句柄获取进程pid(Hwnd)
    8.     var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)  
    9.     var RetValue=dllcall("kernel32.dll","long","CreateRemoteThread","DWROD",进程句柄,"int",0,"int",0,"DWROD",addr,"DWROD",0,"DWROD",0,"DWROD",0)
    10. end


    11. function 申请指定窗口内存空间(Hwnd,size)
    12.     var PID=根据窗口句柄获取进程pid(Hwnd)
    13.     var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
    14.     var Addr=dllcall("kernel32.dll","long","VirtualAllocEx","long",进程句柄,"int",0,"long",size,"long",4096,"int",64)
    15.     return Addr
    16. end

    17. function 写Unicode(Hwnd,addr,Str_Unicode)
    18.     var UnicodeStr=""
    19.     var len=strlen(Str_Unicode)
    20.     var StrValue
    21.     var AddValue=0
    22.     for(var i = 0; i < len; i++)
    23.         StrValue=strgetat(Str_Unicode,i)
    24.         写2byte(Hwnd,addr+AddValue,StrValue)
    25.         AddValue=AddValue+2     
    26.     end  
    27.    
    28.    
    29. end

    30. function 写Ascii(Hwnd,addr,Str_Ascii)
    31.     var AsciiCode=""
    32.     var len=strlen(Str_Ascii)
    33.     for(var i = 0; i < len; i++)
    34.         AsciiCode = AsciiCode &" "& strformat("%x",strgetat(Str_Ascii,i))
    35.         AsciiCode=strtrim(AsciiCode)//去掉两头空格
    36.         //        调试输出(AsciiCode)
    37.         写data(Hwnd,addr,AsciiCode)
    38.     end  
    39. end

    40. function 写data(Hwnd,addr,ByteArray)
    41.     var Ret=0
    42.     var RetArray
    43.     var n = strsplit(ByteArray," ",RetArray) //RetArray是返回数组
    44.     var VarValue
    45.     var PID=information(Hwnd,5)
    46.     var 进程句柄
    47.     for(var i=0;i <n;i++)
    48.         VarValue=进制_十六转十(RetArray[i])
    49.         进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
    50.         //        调试输出("进程句柄:"& 进程句柄)
    51.         Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr+i,"DWORD*",getvarpointer(VarValue)+8,"int",1,"int*",0)
    52.         //        调试输出("写入是否成功: "& Ret)
    53.     end
    54.     return Ret
    55.     //调试输出("坐标是的值是:"& Value)
    56. end



    57. function 写float(Hwnd,addr,value)
    58.     var Ret
    59.     var VarValue=floattohex(value)
    60.     if(value<=4294967295)
    61.         var PID=information(Hwnd,5)
    62.         var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
    63.         traceprint("进程句柄:"& 进程句柄)
    64.         Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",4,"int*",0)
    65.         traceprint("写入是否成功: "& Ret)
    66.         return Ret
    67.     else
    68.         return 0
    69.     end
    70. end



    71. function 写4byte(Hwnd,addr,value)
    72.     var Ret
    73.     if(value<=4294967295)
    74.         var VarValue=value
    75.         var PID=information(Hwnd,5)
    76.         var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
    77.         //        调试输出("进程句柄:"& 进程句柄)
    78.         Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",4,"int*",0)
    79.         //        调试输出("写入是否成功: "& Ret)
    80.         return Ret
    81.     else
    82.         return 0
    83.     end
    84.    
    85.     //调试输出("坐标是的值是:"& Value)
    86. end

    87. function 写2byte(Hwnd,addr,value)
    88.     var Ret
    89.     if(value<=65535)
    90.         var VarValue=value
    91.         var PID=information(Hwnd,5)
    92.         var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
    93.         //        调试输出("进程句柄:"& 进程句柄)
    94.         Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",2,"int*",0)
    95.         //        调试输出("写入是否成功: "& Ret)
    96.         return Ret
    97.     else
    98.         return 0
    99.     end
    100.    
    101.     //调试输出("坐标是的值是:"& Value)
    102. end


    103. function 写byte(Hwnd,addr,value)
    104.     var Ret
    105.     if(value<=255)
    106.         var VarValue=value
    107.         var PID=information(Hwnd,5)
    108.         var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
    109.         traceprint("进程句柄:"& 进程句柄)
    110.         Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",1,"int*",0)
    111.         traceprint("写入是否成功: "& Ret)
    112.         return Ret
    113.     else
    114.         return 0
    115.     end
    116.    
    117.     //调试输出("坐标是的值是:"& Value)
    118. end

    119. function 读4dword(Hwnd,addr)
    120.     var VarValue=0//这个很重要哦,赋值表示他是一个整数型
    121.     var PID=information(Hwnd,5)
    122.     var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
    123.     dllcall("kernel32.dll","BOOL","ReadProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",4,"int*",0)
    124.     return VarValue
    125. end


    126. function 根据窗口句柄获取进程pid(窗口句柄)
    127.     var PID=information(窗口句柄,5)
    128.     return PID
    129. end

    130. function 申请本地内存空间(Size)
    131.     var 申请本地内存指针
    132.     申请本地内存指针=dllcall("kernel32.dll","DWROD","LocalAlloc","DWORD",0,"DWORD",Size)//第一个参数为0即可,第二个参数是4字节数
    133.     return 申请本地内存指针
    134. end

    135. function 获取本地内存指针大小(内存指针)
    136.     var Size
    137.     Size=dllcall("kernel32.dll","DWROD","LocalSize","DWORD",内存指针)//这个是读取内存空间的大小
    138.     return Size
    139. end

    140. function 释放本地内存指针(内存指针)//==============返回值是0的话就成功
    141.     var RetValue
    142.     RetValue=dllcall("kernel32.dll","DWROD","LocalFree","HLOCAL",内存指针)//第一个参数为0即可,第二个参数是4字节数
    143.     return RetValue
    144. end


    145. function 进制_十六转十(十六进制文本)//传进去的二进制必须为文本型
    146.     var i,数组文本,临时文本,计算结果
    147.     数组文本 = "0123456789ABCDEF"
    148.     临时文本 = struppercase(十六进制文本)
    149.     for(i = 0; i < strlen(十六进制文本); i++)
    150.         计算结果 = 计算结果 * 16 + strfind(数组文本,strsub(临时文本,i,i+1))
    151.     end
    152.     return 计算结果
    153. end

    154. function 进制_十转十六(十进制数值)
    155.     var 余数,计算结果
    156.     var 余数数组 = array("0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "A", "B", "C", "D", "E", "F")
    157.     while(十进制数值 >= 0)
    158.         余数 = 十进制数值 % 16
    159.         计算结果 = 余数数组[余数] & 计算结果
    160.         十进制数值 = (十进制数值 - 余数) / 16
    161.         if(十进制数值 <= 0)
    162.             break
    163.         end
    164.     end
    165.     return (计算结果)
    166. end

    167. function 进制_十转二(十进制数值)
    168.     var 余数,计算结果
    169.     while(十进制数值 > 1)
    170.         余数 = 十进制数值 % 2
    171.         十进制数值 = cint(十进制数值 / 2)
    172.         计算结果 = cstring(余数) & 计算结果
    173.     end
    174.     计算结果 = cstring(十进制数值) & 计算结果
    175.     return 计算结果
    176. end

    177. function 进制_二转十(二进制文本数据)//传进去的二进制必须为文本型
    178.     var i,计算结果
    179.     for(i = 0; i < strlen(二进制文本数据); i++)
    180.         if(cint(strsub(二进制文本数据,i,i+1)) < 10)
    181.             计算结果 = 计算结果 + cint(strsub(二进制文本数据,i,i+1)) * mpow(2,strlen(二进制文本数据) - i - 1)
    182.         end
    183.     end
    184.     return 计算结果
    185. end

    186. 功能 进制_双精度浮点转16(双精度数值)
    187.     变量 VarValue1=0 //初始化
    188.     变量 VarValue2=0 //初始化
    189.     变量 varrvalue=""
    190.     变量 双精度数值地址=获取变量地址(双精度数值)
    191.     //    消息框(字符串格式化( "%X",双精度数值地址))
    192.     动态库调用("kernel32.dll","VOID","RtlMoveMemory","DWORD*",获取变量指针(VarValue1)+8,"VOID*",双精度数值地址,"DWORD",4)
    193.     VarValue1=字符串格式化( "%X",VarValue1)
    194.     //    消息框(VarValue1)
    195.     动态库调用("kernel32.dll","VOID","RtlMoveMemory","DWORD*",获取变量指针(VarValue2)+8,"DWORD*",双精度数值地址+4 ,"DWORD",4)
    196.     VarValue2=字符串格式化( "%X",VarValue2)
    197.     //    消息框(VarValue2)
    198.     varrvalue=VarValue2 & VarValue1
    199.     //    消息框 (varrvalue)
    200.    
    201.     如果 (字符串长度(varrvalue)==9)
    202.         varrvalue=varrvalue & "00000000"
    203.         返回 varrvalue  
    204.     否则如果   (字符串长度(varrvalue)==16 )
    205.         返回 varrvalue
    206.     否则如果   (字符串长度(varrvalue)==2)
    207.         varrvalue="0"
    208.         返回 varrvalue
    209.     结束
    210. 结束

    211. function W_GetCode()
    212.     W_GetCode = PublicCode
    213. end

    214. function W_HighAndLow(Value , n) //高低位互换,n的值为2/4/8
    215.     var tmp1 , tmp2 , i,LenStr
    216.    
    217.     tmp1 = strright("0000000"& cstring(strformat("%x",Value)), n) //补位
    218.     LenStr=strlen(tmp1)
    219.     for(i = 0;  i< LenStr / 2 ;i++)  
    220.         tmp2 =  tmp2 &strsub(tmp1, LenStr - 2 - 2 * i, LenStr -2 * i) //逆向排序
    221.     end//=======================================这里出错
    222.     return  tmp2
    223. end


    224. function Leave()
    225.     PublicCode = PublicCode & "C9"
    226. end

    227. function Pushad()
    228.     PublicCode = PublicCode & "60"
    229. end

    230. function Popad()
    231.     PublicCode = PublicCode & "61"
    232. end

    233. function Nop()
    234.     PublicCode = PublicCode & "90"
    235. end

    236. function Ret()
    237.     PublicCode = PublicCode & "C3"
    238. end

    239. function Retn(i)  //这个是新加的
    240.     PublicCode = PublicCode & "C2"& W_HighAndLow(i, 4)
    241. end

    242. function RetA(i )
    243.     PublicCode = PublicCode & W_HighAndLow(i, 4)
    244. end

    245. function IN_AL_DX()
    246.     PublicCode = PublicCode & "EC"
    247. end

    248. function TEST_EAX_EAX()
    249.     PublicCode = PublicCode & "85C0"
    250. end

    251. //'Add
    252. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
    253. function Add_EAX_EDX()
    254.     PublicCode = PublicCode & "03C2"
    255. end

    256. function Add_EBX_EAX()
    257.     PublicCode = PublicCode & "03D8"
    258. end

    259. function Add_EAX_DWORD_Ptr(i )
    260.     PublicCode = PublicCode & "0305" & W_HighAndLow(i, 8)
    261. end

    262. function Add_EBX_DWORD_Ptr(i )
    263.     PublicCode = PublicCode & "031D" & W_HighAndLow(i, 8)
    264. end

    265. function Add_EBP_DWORD_Ptr(i )
    266.     PublicCode = PublicCode & "032D" & W_HighAndLow(i, 8)
    267. end

    268. function Add_EAX(i )
    269.     PublicCode = PublicCode & "05" & W_HighAndLow(i, 8)
    270. end

    271. function Add_EBX(i )
    272.     PublicCode = PublicCode & "83C3" & W_HighAndLow(i, 8)
    273. end

    274. function Add_ECX(i )
    275.     PublicCode = PublicCode & "83C1" & W_HighAndLow(i, 8)
    276. end

    277. function Add_EDX(i )
    278.     PublicCode = PublicCode & "83C2" & W_HighAndLow(i, 8)
    279. end

    280. function Add_ESI(i )
    281.     PublicCode = PublicCode & "83C6" & W_HighAndLow(i, 8)
    282. end

    283. function Add_ESP(i )
    284.     PublicCode = PublicCode & "83C4" & W_HighAndLow(i, 8)
    285. end

    286. //'Call
    287. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
    288. function Call_EAX()
    289.     PublicCode = PublicCode & "FFD0"
    290. end

    291. function Call_EBX()
    292.     PublicCode = PublicCode & "FFD3"
    293. end

    294. function Call_ECX()
    295.     PublicCode = PublicCode & "FFD1"
    296. end

    297. function Call_EDX()
    298.     PublicCode = PublicCode & "FFD2"
    299. end

    300. function Call_ESI()
    301.     PublicCode = PublicCode & "FFD6"
    302. end

    303. function Call_ESP()
    304.     PublicCode = PublicCode & "FFD4"
    305. end

    306. function Call_EBP()
    307.     PublicCode = PublicCode & "FFD5"
    308. end

    309. function Call_EDI()
    310.     PublicCode = PublicCode & "FFD7"
    311. end

    312. function Call_DWORD_Ptr_Addr(i )
    313.     PublicCode = PublicCode & "FF15" & W_HighAndLow(i, 8)
    314. end

    315. //function Call_DWORD_Ptr_Value(i ) //这个是新加进去的,这个时候错误的
    316. //PublicCode = PublicCode & "E8" & W_HighAndLow(i, 8)
    317. //end

    318. function Call_DWORD_Ptr_EAX()
    319.     PublicCode = PublicCode & "FF10"
    320. end

    321. function Call_DWORD_Ptr_EBX()
    322.     PublicCode = PublicCode & "FF13"
    323. end

    324. //'Cmp
    325. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
    326. function Cmp_EAX(i)
    327.     if  ((i<= 255) && (i >= 0))
    328.         PublicCode = PublicCode & "83F8" & W_HighAndLow(i, 2)
    329.     else
    330.         PublicCode = PublicCode & "3D" & W_HighAndLow(i, 8)
    331.     end
    332. end

    333. function Cmp_EAX_EDX()
    334.     PublicCode = PublicCode & "3BC2"
    335. end

    336. function Cmp_EAX_DWORD_Ptr(i )
    337.     PublicCode = PublicCode & "3B05" & W_HighAndLow(i, 8)
    338. end

    339. function Cmp_DWORD_Ptr_EAX(i )
    340.     PublicCode = PublicCode & "3905" & W_HighAndLow(i, 8)
    341. end

    342. //'DEC
    343. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
    344. function Dec_EAX()
    345.     PublicCode = PublicCode & "48"
    346. end

    347. function Dec_EBX()
    348.     PublicCode = PublicCode & "4B"
    349. end

    350. function Dec_ECX()
    351.     PublicCode = PublicCode & "49"
    352. end

    353. function Dec_EDX()
    354.     PublicCode = PublicCode & "4A"
    355. end

    356. //'Idiv
    357. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
    358. function Idiv_EAX()
    359.     PublicCode = PublicCode & "F7F8"
    360. end

    361. function Idiv_EBX()
    362.     PublicCode = PublicCode & "F7FB"
    363. end

    364. function Idiv_ECX()
    365.     PublicCode = PublicCode & "F7F9"
    366. end

    367. function Idiv_EDX()
    368.     PublicCode = PublicCode & "F7FA"
    369. end

    370. //'Imul
    371. //'&&&&&&&
    372. //&&&&&&&&&&&&&&&&&&&&&&&&&&&&
    373. function Imul_EAX_EDX()
    374.     PublicCode = PublicCode & "0FAFC2"
    375. end

    376. function Imul_EAX(i )
    377.     PublicCode = PublicCode & "6BC0" & W_HighAndLow(i, 2)
    378. end

    379. function ImulB_EAX(i )
    380.     PublicCode = PublicCode & "69C0" & W_HighAndLow(i, 8)
    381. end

    382. //'INC
    383. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
    384. function Inc_EAX()
    385.     PublicCode = PublicCode & "40"
    386. end

    387. function Inc_EBX()
    388.     PublicCode = PublicCode & "43"
    389. end

    390. function Inc_ECX()
    391.     PublicCode = PublicCode & "41"
    392. end

    393. function Inc_EDX()
    394.     PublicCode = PublicCode & "42"
    395. end

    396. function Inc_EDI()
    397.     PublicCode = PublicCode & "47"
    398. end

    399. function Inc_ESI()
    400.     PublicCode = PublicCode & "46"
    401. end

    402. function Inc_DWORD_Ptr_EAX()
    403.     PublicCode = PublicCode & "FF00"
    404. end

    405. function Inc_DWORD_Ptr_EBX()
    406.     PublicCode = PublicCode & "FF03"
    407. end

    408. function Inc_DWORD_Ptr_ECX()
    409.     PublicCode = PublicCode & "FF01"
    410. end

    411. function Inc_DWORD_Ptr_EDX()
    412.     PublicCode = PublicCode & "FF02"
    413. end

    414. //'JMP/JE/JNE
    415. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
    416. function JMP_EAX()
    417.     PublicCode = PublicCode & "FFE0"
    418. end

    419. //'Mov
    420. function Mov_DWORD_Ptr_Addr_EAX(i)      
    421.     PublicCode = PublicCode & "A3" & W_HighAndLow(i, 8)
    422. end

    423. function Mov_DWORD_Ptr_Addr_AL(i)      
    424.     PublicCode = PublicCode & "A2" & W_HighAndLow(i, 8)
    425. end

    426. function Mov_DWORD_Ptr_Addr_AH(i)      
    427.     PublicCode = PublicCode & "8825" & W_HighAndLow(i, 8)
    428. end

    429. function Mov_EAX_Value(i )
    430.     PublicCode = PublicCode & "B8" & W_HighAndLow(i, 8)
    431. end

    432. function Mov_EBX_Value(i )
    433.     PublicCode = PublicCode & "BB" & W_HighAndLow(i, 8)
    434. end

    435. function Mov_ECX_Value(i )
    436.     PublicCode = PublicCode & "B9" & W_HighAndLow(i, 8)
    437. end

    438. function Mov_EDX_Value(i )
    439.     PublicCode = PublicCode & "BA" & W_HighAndLow(i, 8)
    440. end

    441. function Mov_ESI_Value(i )
    442.     PublicCode = PublicCode & "BE" & W_HighAndLow(i, 8)
    443. end

    444. function Mov_ESP_Value(i )
    445.     PublicCode = PublicCode & "BC" & W_HighAndLow(i, 8)
    446. end

    447. function Mov_EBP_Value(i )
    448.     PublicCode = PublicCode & "BD" & W_HighAndLow(i, 8)
    449. end

    450. function Mov_EDI_Value(i )
    451.     PublicCode = PublicCode & "BF" & W_HighAndLow(i, 8)
    452. end

    453. function Mov_EBX_DWORD_Ptr(i )
    454.     PublicCode = PublicCode & "8B1D" & W_HighAndLow(i, 8)
    455. end

    456. function Mov_ECX_DWORD_Ptr_Addr(i )
    457.     PublicCode = PublicCode & "8B0D" & W_HighAndLow(i, 8)
    458. end

    459. function Mov_EAX_DWORD_Ptr_Addr(i )
    460.     PublicCode = PublicCode & "A1" & W_HighAndLow(i, 8)
    461. end

    462. function Mov_EDX_DWORD_Ptr_Addr(i )
    463.     PublicCode = PublicCode & "8B15" & W_HighAndLow(i, 8)
    464. end

    465. function Mov_ESI_DWORD_Ptr_Addr(i )
    466.     PublicCode = PublicCode & "8B35" & W_HighAndLow(i, 8)
    467. end

    468. function Mov_ESP_DWORD_Ptr_Addr(i )
    469.     PublicCode = PublicCode & "8B25" & W_HighAndLow(i, 8)
    470. end

    471. function Mov_EBP_DWORD_Ptr_Addr(i )
    472.     PublicCode = PublicCode & "8B2D" & W_HighAndLow(i, 8)
    473. end

    474. function Mov_EAX_DWORD_Ptr_EAX()
    475.     PublicCode = PublicCode & "8B00"
    476. end

    477. function Mov_EAX_DWORD_Ptr_EBP()
    478.     PublicCode = PublicCode & "8B4500"
    479. end

    480. function Mov_EAX_DWORD_Ptr_EBX()
    481.     PublicCode = PublicCode & "8B03"
    482. end

    483. function Mov_EAX_DWORD_Ptr_ECX()
    484.     PublicCode = PublicCode & "8B01"
    485. end

    486. function Mov_EAX_DWORD_Ptr_EDX()
    487.     PublicCode = PublicCode & "8B02"
    488. end

    489. function Mov_EAX_DWORD_Ptr_EDI()
    490.     PublicCode = PublicCode & "8B07"
    491. end

    492. function Mov_EAX_DWORD_Ptr_ESP()
    493.     PublicCode = PublicCode & "8B0424"
    494. end

    495. function Mov_EAX_DWORD_Ptr_ESI()
    496.     PublicCode = PublicCode & "8B06"
    497. end

    498. function Mov_EAX_DWORD_Ptr_EAX_Add(i )
    499.     if ((i<= 255) && (i>= 0))
    500.         PublicCode = PublicCode & "8B40" & W_HighAndLow(i, 2)
    501.     else
    502.         PublicCode = PublicCode & "8B80" & W_HighAndLow(i, 8)
    503.     end
    504. end

    505. function Mov_EAX_DWORD_Ptr_ESP_Add(i )
    506.     if ((i<= 255) && (i>= 0))
    507.         PublicCode = PublicCode & "8B4424" & W_HighAndLow(i, 2)
    508.     else
    509.         PublicCode = PublicCode & "8B8424" & W_HighAndLow(i, 8)
    510.     end
    511. end

    512. function Mov_EAX_DWORD_Ptr_EBX_Add(i )
    513.     if ((i<= 255) && (i>= 0))
    514.         PublicCode = PublicCode & "8B43" & W_HighAndLow(i, 2)
    515.     else
    516.         PublicCode = PublicCode & "8B83" & W_HighAndLow(i, 8)
    517.     end
    518. end

    519. function Mov_EAX_DWORD_Ptr_ECX_Add(i )
    520.     if ((i<= 255) && (i>= 0))
    521.         PublicCode = PublicCode & "8B41" & W_HighAndLow(i, 2)
    522.     else
    523.         PublicCode = PublicCode & "8B81" & W_HighAndLow(i, 8)
    524.     end
    525. end

    526. function Mov_EAX_DWORD_Ptr_EDX_Add(i )
    527.     if ((i<= 255) && (i>= 0))
    528.         PublicCode = PublicCode & "8B42" & W_HighAndLow(i, 2)
    529.     else
    530.         PublicCode = PublicCode & "8B82" & W_HighAndLow(i, 8)
    531.     end
    532. end

    533. function Mov_EAX_DWORD_Ptr_EDI_Add(i )
    534.     if ((i<= 255) && (i>= 0))
    535.         PublicCode = PublicCode & "8B47" & W_HighAndLow(i, 2)
    536.     else
    537.         PublicCode = PublicCode & "8B87" & W_HighAndLow(i, 8)
    538.     end
    539. end

    540. function Mov_EAX_DWORD_Ptr_EBP_Add(i )
    541.     if ((i<= 255) && (i>= 0))
    542.         PublicCode = PublicCode & "8B45" & W_HighAndLow(i, 2)
    543.     else
    544.         PublicCode = PublicCode & "8B85" & W_HighAndLow(i, 8)
    545.     end
    546. end

    547. function Mov_EAX_DWORD_Ptr_ESI_Add(i )
    548.     if ((i<= 255) && (i>= 0))
    549.         PublicCode = PublicCode & "8B46" & W_HighAndLow(i, 2)
    550.     else
    551.         PublicCode = PublicCode & "8B86" & W_HighAndLow(i, 8)
    552.     end
    553. end

    554. function Mov_EBX_DWORD_Ptr_EAX_Add(i )
    555.     if ((i<= 255) && (i>= 0))
    556.         PublicCode = PublicCode & "8B58" & W_HighAndLow(i, 2)
    557.     else
    558.         PublicCode = PublicCode & "8B98" & W_HighAndLow(i, 8)
    559.     end
    560. end

    561. function Mov_EBX_DWORD_Ptr_ESP_Add(i )
    562.     if ((i<= 255) && (i>= 0))
    563.         PublicCode = PublicCode & "8B5C24" & W_HighAndLow(i, 2)
    564.     else
    565.         PublicCode = PublicCode & "8B9C24" & W_HighAndLow(i, 8)
    566.     end
    567. end

    568. function Mov_EBX_DWORD_Ptr_EBX_Add(i )
    569.     if ((i<= 255) && (i>= 0))
    570.         PublicCode = PublicCode & "8B5B" & W_HighAndLow(i, 2)
    571.     else
    572.         PublicCode = PublicCode & "8B9B" & W_HighAndLow(i, 8)
    573.     end
    574. end

    575. function Mov_EBX_DWORD_Ptr_ECX_Add(i )
    576.     if ((i<= 255) && (i>= 0))
    577.         PublicCode = PublicCode & "8B59" & W_HighAndLow(i, 2)
    578.     else
    579.         PublicCode = PublicCode & "8B99" & W_HighAndLow(i, 8)
    580.     end
    581. end

    582. function Mov_EBX_DWORD_Ptr_EDX_Add(i )
    583.     if ((i<= 255) && (i>= 0))
    584.         PublicCode = PublicCode & "8B5A" & W_HighAndLow(i, 2)
    585.     else
    586.         PublicCode = PublicCode & "8B9A" & W_HighAndLow(i, 8)
    587.     end
    588. end

    589. function Mov_EBX_DWORD_Ptr_EDI_Add(i )
    590.     if ((i<= 255) && (i>= 0))
    591.         PublicCode = PublicCode & "8B5F" & W_HighAndLow(i, 2)
    592.     else
    593.         PublicCode = PublicCode & "8B9F" & W_HighAndLow(i, 8)
    594.     end
    595. end

    596. function Mov_EBX_DWORD_Ptr_EBP_Add(i )
    597.     if ((i<= 255) && (i>= 0))
    598.         PublicCode = PublicCode & "8B5D" & W_HighAndLow(i, 2)
    599.     else
    600.         PublicCode = PublicCode & "8B9D" & W_HighAndLow(i, 8)
    601.     end
    602. end

    603. function Mov_EBX_DWORD_Ptr_ESI_Add(i )
    604.     if ((i<= 255) && (i>= 0))
    605.         PublicCode = PublicCode & "8B5E" & W_HighAndLow(i, 2)
    606.     else
    607.         PublicCode = PublicCode & "8B9E" & W_HighAndLow(i, 8)
    608.     end
    609. end

    610. function Mov_ECX_DWORD_Ptr_EAX_Add(i)  //这里出错过
    611.     if ((i<= 255) && (i>= 0))
    612.         PublicCode = PublicCode & "8B48" & W_HighAndLow(i, 2)
    613.     else
    614.         PublicCode = PublicCode & "8B88" & W_HighAndLow(i, 8)
    615.     end
    616. end

    617. function Mov_ECX_DWORD_Ptr_ESP_Add(i )
    618.     if ((i<= 255) && (i>= 0))
    619.         PublicCode = PublicCode & "8B4C24" & W_HighAndLow(i, 2)
    620.     else
    621.         PublicCode = PublicCode & "8B8C24" & W_HighAndLow(i, 8)
    622.     end
    623. end

    624. function Mov_ECX_DWORD_Ptr_EBX_Add(i )
    625.     if ((i<= 255) && (i>= 0))
    626.         PublicCode = PublicCode & "8B4B" & W_HighAndLow(i, 2)
    627.     else
    628.         PublicCode = PublicCode & "8B8B" & W_HighAndLow(i, 8)
    629.     end
    630. end

    631. function Mov_ECX_DWORD_Ptr_ECX_Add(i )
    632.     if ((i<= 255) && (i>= 0))
    633.         PublicCode = PublicCode & "8B49" & W_HighAndLow(i, 2)
    634.     else
    635.         PublicCode = PublicCode & "8B89" & W_HighAndLow(i, 8)
    636.     end
    637. end

    638. function Mov_ECX_DWORD_Ptr_EDX_Add(i )
    639.     if ((i<= 255) && (i>= 0))
    640.         PublicCode = PublicCode & "8B4A" & W_HighAndLow(i, 2)
    641.     else
    642.         PublicCode = PublicCode & "8B8A" & W_HighAndLow(i, 8)
    643.     end
    644. end

    645. function Mov_ECX_DWORD_Ptr_EDI_Add(i )
    646.     if ((i<= 255) && (i>= 0))
    647.         PublicCode = PublicCode & "8B4F" & W_HighAndLow(i, 2)
    648.     else
    649.         PublicCode = PublicCode & "8B8F" & W_HighAndLow(i, 8)
    650.     end
    651. end

    652. function Mov_ECX_DWORD_Ptr_EBP_Add(i )
    653.     if ((i<= 255) && (i>= 0))
    654.         PublicCode = PublicCode & "8B4D" & W_HighAndLow(i, 2)
    655.     else
    656.         PublicCode = PublicCode & "8B8D" & W_HighAndLow(i, 8)
    657.     end
    658. end

    659. function Mov_ECX_DWORD_Ptr_ESI_Add(i )
    660.     if ((i<= 255) && (i>= 0))
    661.         PublicCode = PublicCode & "8B4E" & W_HighAndLow(i, 2)
    662.     else
    663.         PublicCode = PublicCode & "8B8E" & W_HighAndLow(i, 8)
    664.     end
    665. end

    666. function Mov_EDX_DWORD_Ptr_EAX_Add(i )
    667.     if ((i<= 255) && (i>= 0))
    668.         PublicCode = PublicCode & "8B50" & W_HighAndLow(i, 2)
    669.     else
    670.         PublicCode = PublicCode & "8B90" & W_HighAndLow(i, 8)
    671.     end
    672. end

    673. function Mov_EDX_DWORD_Ptr_ESP_Add(i )
    674.     if ((i<= 255) && (i>= 0))
    675.         PublicCode = PublicCode & "8B5424" & W_HighAndLow(i, 2)
    676.     else
    677.         PublicCode = PublicCode & "8B9424" & W_HighAndLow(i, 8)
    678.     end
    679. end

    680. function Mov_EDX_DWORD_Ptr_EBX_Add(i)
    681.     if ((i<= 255) && (i>= 0))
    682.         PublicCode = PublicCode & "8B53" & W_HighAndLow(i, 2)
    683.     else
    684.         PublicCode = PublicCode & "8B93" & W_HighAndLow(i, 8 ) //这里出错过
    685.     end
    686. end

    687. function Mov_EDX_DWORD_Ptr_ECX_Add(i )
    688.     if ((i<= 255) && (i>= 0))
    689.         PublicCode = PublicCode & "8B51" & W_HighAndLow(i, 2)
    690.     else
    691.         PublicCode = PublicCode & "8B91" & W_HighAndLow(i, 8)
    692.     end
    693. end

    694. function Mov_EDX_DWORD_Ptr_EDX_Add(i )
    695.     if ((i<= 255) && (i>= 0))
    696.         PublicCode = PublicCode & "8B52" & W_HighAndLow(i, 2)
    697.     else
    698.         PublicCode = PublicCode & "8B92" & W_HighAndLow(i, 8)
    699.     end
    700. end

    701. function Mov_EDX_DWORD_Ptr_EDI_Add(i )
    702.     if ((i<= 255) && (i>= 0))
    703.         PublicCode = PublicCode & "8B57" & W_HighAndLow(i, 2)
    704.     else
    705.         PublicCode = PublicCode & "8B97" & W_HighAndLow(i, 8)
    706.     end
    707. end

    708. function Mov_EDX_DWORD_Ptr_EBP_Add(i )
    709.     if ((i<= 255) && (i>= 0))
    710.         PublicCode = PublicCode & "8B55" & W_HighAndLow(i, 2)
    711.     else
    712.         PublicCode = PublicCode & "8B95" & W_HighAndLow(i, 8)
    713.     end
    714. end

    715. function Mov_EDX_DWORD_Ptr_ESI_Add(i )
    716.     if ((i<= 255) && (i>= 0))
    717.         PublicCode = PublicCode & "8B56" & W_HighAndLow(i, 2)
    718.     else
    719.         PublicCode = PublicCode & "8B96" & W_HighAndLow(i, 8)
    720.     end
    721. end

    722. function Mov_EBX_DWORD_Ptr_EAX()
    723.     PublicCode = PublicCode & "8B18"
    724. end

    725. function Mov_EBX_DWORD_Ptr_EBP()
    726.     PublicCode = PublicCode & "8B5D00"
    727. end

    728. function Mov_EBX_DWORD_Ptr_EBX()
    729.     PublicCode = PublicCode & "8B1B"
    730. end

    731. function Mov_EBX_DWORD_Ptr_ECX()
    732.     PublicCode = PublicCode & "8B19"
    733. end

    734. function Mov_EBX_DWORD_Ptr_EDX()
    735.     PublicCode = PublicCode & "8B1A"
    736. end

    737. function Mov_EBX_DWORD_Ptr_EDI()
    738.     PublicCode = PublicCode & "8B1F"
    739. end

    740. function Mov_EBX_DWORD_Ptr_ESP()
    741.     PublicCode = PublicCode & "8B1C24"
    742. end

    743. function Mov_EBX_DWORD_Ptr_ESI()
    744.     PublicCode = PublicCode & "8B1E"
    745. end
    746. function Mov_ECX_DWORD_Ptr_EAX()
    747.     PublicCode = PublicCode & "8B08"
    748. end

    749. function Mov_ECX_DWORD_Ptr_EBP()
    750.     PublicCode = PublicCode & "8B4D00"
    751. end

    752. function Mov_ECX_DWORD_Ptr_EBX()
    753.     PublicCode = PublicCode & "8B0B"
    754. end

    755. function Mov_ECX_DWORD_Ptr_ECX()
    756.     PublicCode = PublicCode & "8B09"
    757. end

    758. function Mov_ECX_DWORD_Ptr_EDX()
    759.     PublicCode = PublicCode & "8B0A"
    760. end

    761. function Mov_ECX_DWORD_Ptr_EDI()
    762.     PublicCode = PublicCode & "8B0F"
    763. end

    764. function Mov_ECX_DWORD_Ptr_ESP()
    765.     PublicCode = PublicCode & "8B0C24"
    766. end

    767. function Mov_ECX_DWORD_Ptr_ESI()
    768.     PublicCode = PublicCode & "8B0E"
    769. end

    770. function Mov_EDX_DWORD_Ptr_EAX()
    771.     PublicCode = PublicCode & "8B10"
    772. end

    773. function Mov_EDX_DWORD_Ptr_EBP()
    774.     PublicCode = PublicCode & "8B5500"
    775. end

    776. function Mov_EDX_DWORD_Ptr_EBX()
    777.     PublicCode = PublicCode & "8B13"
    778. end

    779. function Mov_EDX_DWORD_Ptr_ECX()
    780.     PublicCode = PublicCode & "8B11"
    781. end

    782. function Mov_EDX_DWORD_Ptr_EDX()
    783.     PublicCode = PublicCode & "8B12"
    784. end

    785. function Mov_EDX_DWORD_Ptr_EDI()
    786.     PublicCode = PublicCode & "8B17"
    787. end

    788. function Mov_EDX_DWORD_Ptr_ESI()
    789.     PublicCode = PublicCode & "8B16"
    790. end

    791. function Mov_EDX_DWORD_Ptr_ESP()
    792.     PublicCode = PublicCode & "8B1424"
    793. end

    794. function Mov_EAX_EBP()
    795.     PublicCode = PublicCode & "8BC5"
    796. end

    797. function Mov_EAX_EBX()
    798.     PublicCode = PublicCode & "8BC3"
    799. end

    800. function Mov_EAX_ECX()
    801.     PublicCode = PublicCode & "8BC1"
    802. end

    803. function Mov_EAX_EDI()
    804.     PublicCode = PublicCode & "8BC7"
    805. end

    806. function Mov_EAX_EDX()
    807.     PublicCode = PublicCode & "8BC2"
    808. end

    809. function Mov_EAX_ESI()
    810.     PublicCode = PublicCode & "8BC6"
    811. end

    812. function Mov_EAX_ESP()
    813.     PublicCode = PublicCode & "8BC4"
    814. end

    815. function Mov_EBX_EBP()
    816.     PublicCode = PublicCode & "8BDD"
    817. end

    818. function Mov_EBX_EAX()
    819.     PublicCode = PublicCode & "8BD8"
    820. end

    821. function Mov_EBX_ECX()
    822.     PublicCode = PublicCode & "8BD9"
    823. end

    824. function Mov_EBX_EDI()
    825.     PublicCode = PublicCode & "8BDF"
    826. end

    827. function Mov_EBX_EDX()
    828.     PublicCode = PublicCode & "8BDA"
    829. end

    830. function Mov_EBX_ESI()
    831.     PublicCode = PublicCode & "8BDE"
    832. end

    833. function Mov_EBX_ESP()
    834.     PublicCode = PublicCode & "8BDC"
    835. end

    836. function Mov_ECX_EBP()
    837.     PublicCode = PublicCode & "8BCD"
    838. end

    839. function Mov_ECX_EAX()
    840.     PublicCode = PublicCode & "8BC8"
    841. end

    842. function Mov_ECX_EBX()
    843.     PublicCode = PublicCode & "8BCB"
    844. end

    845. function Mov_ECX_EDI()
    846.     PublicCode = PublicCode & "8BCF"
    847. end

    848. function Mov_ECX_EDX()
    849.     PublicCode = PublicCode & "8BCA"
    850. end

    851. function Mov_ECX_ESI()
    852.     PublicCode = PublicCode & "8BCE"
    853. end

    854. function Mov_ECX_ESP()
    855.     PublicCode = PublicCode & "8BCC"
    856. end

    857. function Mov_EDX_EBP()
    858.     PublicCode = PublicCode & "8BD5"
    859. end

    860. function Mov_EDX_EBX()
    861.     PublicCode = PublicCode & "8BD3"
    862. end

    863. function Mov_EDX_ECX()
    864.     PublicCode = PublicCode & "8BD1"
    865. end

    866. function Mov_EDX_EDI()
    867.     PublicCode = PublicCode & "8BD7"
    868. end

    869. function Mov_EDX_EAX()
    870.     PublicCode = PublicCode & "8BD0"
    871. end

    872. function Mov_EDX_ESI()
    873.     PublicCode = PublicCode & "8BD6"
    874. end

    875. function Mov_EDX_ESP()
    876.     PublicCode = PublicCode & "8BD4"
    877. end

    878. function Mov_ESI_EBP()
    879.     PublicCode = PublicCode & "8BF5"
    880. end

    881. function Mov_ESI_EBX()
    882.     PublicCode = PublicCode & "8BF3"
    883. end

    884. function Mov_ESI_ECX()
    885.     PublicCode = PublicCode & "8BF1"
    886. end

    887. function Mov_ESI_EDI()
    888.     PublicCode = PublicCode & "8BF7"
    889. end

    890. function Mov_ESI_EAX()
    891.     PublicCode = PublicCode & "8BF0"
    892. end

    893. function Mov_ESI_EDX()
    894.     PublicCode = PublicCode & "8BF2"
    895. end

    896. function Mov_ESI_ESP()
    897.     PublicCode = PublicCode & "8BF4"
    898. end

    899. function Mov_ESP_EBP()
    900.     PublicCode = PublicCode & "8BE5"
    901. end

    902. function Mov_ESP_EBX()
    903.     PublicCode = PublicCode & "8BE3"
    904. end

    905. function Mov_ESP_ECX()
    906.     PublicCode = PublicCode & "8BE1"
    907. end

    908. function Mov_ESP_EDI()
    909.     PublicCode = PublicCode & "8BE7"
    910. end

    911. function Mov_ESP_EAX()
    912.     PublicCode = PublicCode & "8BE0"
    913. end

    914. function Mov_ESP_EDX()
    915.     PublicCode = PublicCode & "8BE2"
    916. end

    917. function Mov_ESP_ESI()
    918.     PublicCode = PublicCode & "8BE6"
    919. end

    920. function Mov_EDI_EBP()
    921.     PublicCode = PublicCode & "8BFD"
    922. end

    923. function Mov_EDI_EAX()
    924.     PublicCode = PublicCode & "8BF8"
    925. end

    926. function Mov_EDI_EBX()
    927.     PublicCode = PublicCode & "8BFB"
    928. end

    929. function Mov_EDI_ECX()
    930.     PublicCode = PublicCode & "8BF9"
    931. end

    932. function Mov_EDI_EDX()
    933.     PublicCode = PublicCode & "8BFA"
    934. end

    935. function Mov_EDI_ESI()
    936.     PublicCode = PublicCode & "8BFE"
    937. end

    938. function Mov_EDI_ESP()
    939.     PublicCode = PublicCode & "8BFC"
    940. end
    941. function Mov_EBP_EDI()
    942.     PublicCode = PublicCode & "8BDF"
    943. end

    944. function Mov_EBP_EAX()
    945.     PublicCode = PublicCode & "8BE8"
    946. end

    947. function Mov_EBP_EBX()
    948.     PublicCode = PublicCode & "8BEB"
    949. end

    950. function Mov_EBP_ECX()
    951.     PublicCode = PublicCode & "8BE9"
    952. end

    953. function Mov_EBP_EDX()
    954.     PublicCode = PublicCode & "8BEA"
    955. end

    956. function Mov_EBP_ESI()
    957.     PublicCode = PublicCode & "8BEE"
    958. end

    959. function Mov_EBP_ESP()
    960.     PublicCode = PublicCode & "8BEC"
    961. end
    962. //'Push
    963. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
    964. function Push(i)
    965.     if ((i<= 255) && (i>= 0))
    966.         PublicCode = PublicCode & "6A" & W_HighAndLow(i, 2)
    967.     else
    968.         PublicCode = PublicCode & "68" & W_HighAndLow(i, 8)
    969.     end
    970. end

    971. function Push_DWORD_Ptr_Addr(i )
    972.     PublicCode = PublicCode & "FF35" & W_HighAndLow(i, 8)
    973. end

    974. function Push_EAX()
    975.     PublicCode = PublicCode & "50"
    976. end

    977. function Push_ECX()
    978.     PublicCode = PublicCode & "51"
    979. end

    980. function Push_EDX()
    981.     PublicCode = PublicCode & "52"
    982. end

    983. function Push_EBX()
    984.     PublicCode = PublicCode & "53"
    985. end
    986. function Push_ESP()
    987.     PublicCode = PublicCode & "54"
    988. end

    989. function Push_EBP()
    990.     PublicCode = PublicCode & "55"
    991. end

    992. function Push_ESI()
    993.     PublicCode = PublicCode & "56"
    994. end

    995. function Push_EDI()
    996.     PublicCode = PublicCode & "57"
    997. end
    998. //'LEA
    999. function Lea_EAX_DWORD_Ptr_EAX_Add(i )
    1000.     if ((i<= 255) && (i>= 0))
    1001.         PublicCode = PublicCode & "8D40" & W_HighAndLow(i, 2)
    1002.     else
    1003.         PublicCode = PublicCode & "8D80" & W_HighAndLow(i, 8)
    1004.     end
    1005. end

    1006. function Lea_EAX_DWORD_Ptr_EBX_Add(i )
    1007.     if ((i<= 255) && (i>= 0))
    1008.         PublicCode = PublicCode & "8D43" & W_HighAndLow(i, 2)
    1009.     else
    1010.         PublicCode = PublicCode & "8D83" & W_HighAndLow(i, 8)
    1011.     end
    1012. end

    1013. function Lea_EAX_DWORD_Ptr_ECX_Add(i )
    1014.     if ((i<= 255) && (i>= 0))
    1015.         PublicCode = PublicCode & "8D41" & W_HighAndLow(i, 2)
    1016.     else
    1017.         PublicCode = PublicCode & "8D81" & W_HighAndLow(i, 8)
    1018.     end
    1019. end

    1020. function Lea_EAX_DWORD_Ptr_EDX_Add(i )
    1021.     if ((i<= 255) && (i>= 0))
    1022.         PublicCode = PublicCode & "8D42" & W_HighAndLow(i, 2)
    1023.     else
    1024.         PublicCode = PublicCode & "8D82" & W_HighAndLow(i, 8)
    1025.     end
    1026. end

    1027. function Lea_EAX_DWORD_Ptr_ESI_Add(i )
    1028.     if ((i<= 255) && (i>= 0))
    1029.         PublicCode = PublicCode & "8D46" & W_HighAndLow(i, 2)
    1030.     else
    1031.         PublicCode = PublicCode & "8D86" & W_HighAndLow(i, 8)
    1032.     end
    1033. end

    1034. function Lea_EAX_DWORD_Ptr_ESP_Add(i )
    1035.     if ((i<= 255) && (i>= 0))
    1036.         PublicCode = PublicCode & "8D40" & W_HighAndLow(i, 2)
    1037.     else
    1038.         PublicCode = PublicCode & "8D80" & W_HighAndLow(i, 8)
    1039.     end
    1040. end

    1041. function Lea_EAX_DWORD_Ptr_EBP_Add(i )
    1042.     if ((i<= 255) && (i>= 0))
    1043.         PublicCode = PublicCode & "8D4424" & W_HighAndLow(i, 2)
    1044.     else
    1045.         PublicCode = PublicCode & "8D8424" & W_HighAndLow(i, 8)
    1046.     end
    1047. end

    1048. function Lea_EAX_DWORD_Ptr_EDI_Add(i )
    1049.     if ((i<= 255) && (i>= 0))
    1050.         PublicCode = PublicCode & "8D47" & W_HighAndLow(i, 2)
    1051.     else
    1052.         PublicCode = PublicCode & "8D87" & W_HighAndLow(i, 8)
    1053.     end
    1054. end

    1055. function Lea_EBX_DWORD_Ptr_EAX_Add(i )
    1056.     if ((i<= 255) && (i>= 0))
    1057.         PublicCode = PublicCode & "8D58" & W_HighAndLow(i, 2)
    1058.     else
    1059.         PublicCode = PublicCode & "8D98" & W_HighAndLow(i, 8)
    1060.     end
    1061. end

    1062. function Lea_EBX_DWORD_Ptr_ESP_Add(i )
    1063.     if ((i<= 255) && (i>= 0))
    1064.         PublicCode = PublicCode & "8D5C24" & W_HighAndLow(i, 2)
    1065.     else
    1066.         PublicCode = PublicCode & "8D9C24" & W_HighAndLow(i, 8)
    1067.     end
    1068. end

    1069. function Lea_EBX_DWORD_Ptr_EBX_Add(i )
    1070.     if ((i<= 255) && (i>= 0))
    1071.         PublicCode = PublicCode & "8D5B" & W_HighAndLow(i, 2)
    1072.     else
    1073.         PublicCode = PublicCode & "8D9B" & W_HighAndLow(i, 8)
    1074.     end
    1075. end

    1076. function Lea_EBX_DWORD_Ptr_ECX_Add(i )
    1077.     if ((i<= 255) && (i>= 0))
    1078.         PublicCode = PublicCode & "8D59" & W_HighAndLow(i, 2)
    1079.     else
    1080.         PublicCode = PublicCode & "8D99" & W_HighAndLow(i, 8)
    1081.     end
    1082. end

    1083. function Lea_EBX_DWORD_Ptr_EDX_Add(i )
    1084.     if ((i<= 255) && (i>= 0))
    1085.         PublicCode = PublicCode & "8D5A" & W_HighAndLow(i, 2)
    1086.     else
    1087.         PublicCode = PublicCode & "8D9A" & W_HighAndLow(i, 8)
    1088.     end
    1089. end

    1090. function Lea_EBX_DWORD_Ptr_EDI_Add(i )
    1091.     if ((i<= 255) && (i>= 0))
    1092.         PublicCode = PublicCode & "8D5F" & W_HighAndLow(i, 2)
    1093.     else
    1094.         PublicCode = PublicCode & "8D9F" & W_HighAndLow(i, 8)
    1095.     end
    1096. end

    1097. function Lea_EBX_DWORD_Ptr_EBP_Add(i )
    1098.     if ((i<= 255) && (i>= 0))
    1099.         PublicCode = PublicCode & "8D5D" & W_HighAndLow(i, 2)
    1100.     else
    1101.         PublicCode = PublicCode & "8D9D" & W_HighAndLow(i, 8)
    1102.     end
    1103. end

    1104. function Lea_EBX_DWORD_Ptr_ESI_Add(i )
    1105.     if ((i<= 255) && (i>= 0))
    1106.         PublicCode = PublicCode & "8D5E" & W_HighAndLow(i, 2)
    1107.     else
    1108.         PublicCode = PublicCode & "8D9E" & W_HighAndLow(i, 8)
    1109.     end
    1110. end

    1111. function Lea_ECX_DWORD_Ptr_EAX_Add(i )
    1112.     if ((i<= 255) && (i>= 0))
    1113.         PublicCode = PublicCode & "8D48" & W_HighAndLow(i, 2)
    1114.     else
    1115.         PublicCode = PublicCode & "8D88" & W_HighAndLow(i, 8)
    1116.     end
    1117. end

    1118. function Lea_ECX_DWORD_Ptr_ESP_Add(i )
    1119.     if ((i<= 255) && (i>= 0))
    1120.         PublicCode = PublicCode & "8D4C24" & W_HighAndLow(i, 2)
    1121.     else
    1122.         PublicCode = PublicCode & "8D8C24" & W_HighAndLow(i, 8)
    1123.     end
    1124. end

    1125. function Lea_ECX_DWORD_Ptr_EBX_Add(i )
    1126.     if ((i<= 255) && (i>= 0))
    1127.         PublicCode = PublicCode & "8D4B" & W_HighAndLow(i, 2)
    1128.     else
    1129.         PublicCode = PublicCode & "8D8B" & W_HighAndLow(i, 8)
    1130.     end
    1131. end

    1132. function Lea_ECX_DWORD_Ptr_ECX_Add(i )
    1133.     if ((i<= 255) && (i>= 0))
    1134.         PublicCode = PublicCode & "8D49" & W_HighAndLow(i, 2)
    1135.     else
    1136.         PublicCode = PublicCode & "8D89" & W_HighAndLow(i, 8)
    1137.     end
    1138. end

    1139. function Lea_ECX_DWORD_Ptr_EDX_Add(i )
    1140.     if ((i<= 255) && (i>= 0))
    1141.         PublicCode = PublicCode & "8D4A" & W_HighAndLow(i, 2)
    1142.     else
    1143.         PublicCode = PublicCode & "8D8A" & W_HighAndLow(i, 8)
    1144.     end
    1145. end

    1146. function Lea_ECX_DWORD_Ptr_EDI_Add(i )
    1147.     if ((i<= 255) && (i>= 0))
    1148.         PublicCode = PublicCode & "8D4F" & W_HighAndLow(i, 2)
    1149.     else
    1150.         PublicCode = PublicCode & "8D8F" & W_HighAndLow(i, 8)
    1151.     end
    1152. end

    1153. function Lea_ECX_DWORD_Ptr_EBP_Add(i )
    1154.     if ((i<= 255) && (i>= 0))
    1155.         PublicCode = PublicCode & "8D4D" & W_HighAndLow(i, 2)
    1156.     else
    1157.         PublicCode = PublicCode & "8D8D" & W_HighAndLow(i, 8)
    1158.     end
    1159. end

    1160. function Lea_ECX_DWORD_Ptr_ESI_Add(i )
    1161.     if ((i<= 255) && (i>= 0))
    1162.         PublicCode = PublicCode & "8D4E" & W_HighAndLow(i, 2)
    1163.     else
    1164.         PublicCode = PublicCode & "8D8E" & W_HighAndLow(i, 8)
    1165.     end
    1166. end

    1167. function Lea_EDX_DWORD_Ptr_EAX_Add(i )
    1168.     if ((i<= 255) && (i>= 0))
    1169.         PublicCode = PublicCode & "8D50" & W_HighAndLow(i, 2)
    1170.     else
    1171.         PublicCode = PublicCode & "8D90" & W_HighAndLow(i, 8)
    1172.     end
    1173. end

    1174. function Lea_EDX_DWORD_Ptr_ESP_Add(i )
    1175.     if ((i<= 255) && (i>= 0))
    1176.         PublicCode = PublicCode & "8D5424" & W_HighAndLow(i, 2)
    1177.     else
    1178.         PublicCode = PublicCode & "8D9424" & W_HighAndLow(i, 8)
    1179.     end
    1180. end

    1181. function Lea_EDX_DWORD_Ptr_EBX_Add(i )
    1182.     if ((i<= 255) && (i>= 0))
    1183.         PublicCode = PublicCode & "8D53" & W_HighAndLow(i, 2)
    1184.     else
    1185.         PublicCode = PublicCode & "8D93" & W_HighAndLow(i, 8)
    1186.     end
    1187. end

    1188. function Lea_EDX_DWORD_Ptr_ECX_Add(i )
    1189.     if ((i<= 255) && (i>= 0))
    1190.         PublicCode = PublicCode & "8D51" & W_HighAndLow(i, 2)
    1191.     else
    1192.         PublicCode = PublicCode & "8D91" & W_HighAndLow(i, 8)
    1193.     end
    1194. end

    1195. function Lea_EDX_DWORD_Ptr_EDX_Add(i )
    1196.     if ((i<= 255) && (i>= 0))
    1197.         PublicCode = PublicCode & "8D52" & W_HighAndLow(i, 2)
    1198.     else
    1199.         PublicCode = PublicCode & "8D92" & W_HighAndLow(i, 8)
    1200.     end
    1201. end

    1202. function Lea_EDX_DWORD_Ptr_EDI_Add(i )
    1203.     if ((i<= 255) && (i>= 0))
    1204.         PublicCode = PublicCode & "8D57" & W_HighAndLow(i, 2)
    1205.     else
    1206.         PublicCode = PublicCode & "8D97" & W_HighAndLow(i, 8)
    1207.     end
    1208. end

    1209. function Lea_EDX_DWORD_Ptr_EBP_Add(i )
    1210.     if ((i<= 255) && (i>= 0))
    1211.         PublicCode = PublicCode & "8D55" & W_HighAndLow(i, 2)
    1212.     else
    1213.         PublicCode = PublicCode & "8D95" & W_HighAndLow(i, 8)
    1214.     end
    1215. end

    1216. function Lea_EDX_DWORD_Ptr_ESI_Add(i )
    1217.     if ((i<= 255) && (i>= 0))
    1218.         PublicCode = PublicCode & "8D56" & W_HighAndLow(i, 2)
    1219.     else
    1220.         PublicCode = PublicCode & "8D96" & W_HighAndLow(i, 8)
    1221.     end
    1222. end


    1223. function Pop_EAX()
    1224.     PublicCode = PublicCode & "58"
    1225. end

    1226. function Pop_EBX()
    1227.     PublicCode = PublicCode & "5B"
    1228. end

    1229. function Pop_ECX()
    1230.     PublicCode = PublicCode & "59"
    1231. end

    1232. function Pop_EDX()
    1233.     PublicCode = PublicCode & "5A"
    1234. end

    1235. function Pop_ESI()
    1236.     PublicCode = PublicCode & "5E"
    1237. end

    1238. function Pop_ESP()
    1239.     PublicCode = PublicCode & "5C"
    1240. end

    1241. function Pop_EDI()
    1242.     PublicCode = PublicCode & "5F"
    1243. end

    1244. function Pop_EBP()
    1245.     PublicCode = PublicCode & "5D"
    1246. end
    复制代码


  • TA的每日心情

    2018-10-6 10:54
  • 签到天数: 659 天

    [LV.9]以坛为家II

    3

    主题

    805

    帖子

    3451

    积分

    高级会员

    Rank: 4

    积分
    3451
    莫离 发表于 2017-8-30 17:19:28 | 显示全部楼层
    此帖仅作者可见

    使用道具 举报

    您需要登录后才可以回帖 登录 | 立即注册 新浪微博登陆

    本版积分规则

    QQ|手机版|小黑屋|虫虫联盟 ( 备案号:蜀ICP备15018121号-1 )

    GMT+8, 2020-9-29 15:06 , Processed in 0.549287 second(s), 35 queries .

    Powered by Discuz! X3.4 Licensed

    © 2001-2017 Comsenz Inc.

    快速回复 返回顶部 返回列表