找回密码
 立即注册
查看: 4372|回复: 2

[源码分享] 【类人猿】TC内联汇编库

[复制链接]

13

主题

21

回帖

320

积分

中级会员

积分
320
QQ
类人猿 发表于 2017-8-29 23:50:26 | 显示全部楼层 |阅读模式
本帖最后由 楚楚 于 2017-8-30 21:09 编辑

     TC可以直接内联汇编,这个库是本人初稿,新建个T文件辅助进去即可。此库给大家吃一颗定心丸。TC图色超强,内存一样无比强大。  学TC一起放手干吧!
     免费无私公开给大家拿去完善。
  1. function 远程注入数据(Hwnd,字节集)
  2.     字节集=字节集&" C3"
  3.     var size_Str=strlen(strreplace(字节集," ",""))+20
  4.     var addr= (申请指定窗口内存空间(Hwnd,size_Str))
  5.     //调试输出(strformat("%x", addr))
  6.     写data(Hwnd,addr,字节集)
  7.     var PID=根据窗口句柄获取进程pid(Hwnd)
  8.     var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)  
  9.     var RetValue=dllcall("kernel32.dll","long","CreateRemoteThread","DWROD",进程句柄,"int",0,"int",0,"DWROD",addr,"DWROD",0,"DWROD",0,"DWROD",0)
  10. end


  11. function 申请指定窗口内存空间(Hwnd,size)
  12.     var PID=根据窗口句柄获取进程pid(Hwnd)
  13.     var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
  14.     var Addr=dllcall("kernel32.dll","long","VirtualAllocEx","long",进程句柄,"int",0,"long",size,"long",4096,"int",64)
  15.     return Addr
  16. end

  17. function 写Unicode(Hwnd,addr,Str_Unicode)
  18.     var UnicodeStr=""
  19.     var len=strlen(Str_Unicode)
  20.     var StrValue
  21.     var AddValue=0
  22.     for(var i = 0; i < len; i++)
  23.         StrValue=strgetat(Str_Unicode,i)
  24.         写2byte(Hwnd,addr+AddValue,StrValue)
  25.         AddValue=AddValue+2     
  26.     end  
  27.    
  28.    
  29. end

  30. function 写Ascii(Hwnd,addr,Str_Ascii)
  31.     var AsciiCode=""
  32.     var len=strlen(Str_Ascii)
  33.     for(var i = 0; i < len; i++)
  34.         AsciiCode = AsciiCode &" "& strformat("%x",strgetat(Str_Ascii,i))
  35.         AsciiCode=strtrim(AsciiCode)//去掉两头空格
  36.         //        调试输出(AsciiCode)
  37.         写data(Hwnd,addr,AsciiCode)
  38.     end  
  39. end

  40. function 写data(Hwnd,addr,ByteArray)
  41.     var Ret=0
  42.     var RetArray
  43.     var n = strsplit(ByteArray," ",RetArray) //RetArray是返回数组
  44.     var VarValue
  45.     var PID=information(Hwnd,5)
  46.     var 进程句柄
  47.     for(var i=0;i <n;i++)
  48.         VarValue=进制_十六转十(RetArray[i])
  49.         进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
  50.         //        调试输出("进程句柄:"& 进程句柄)
  51.         Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr+i,"DWORD*",getvarpointer(VarValue)+8,"int",1,"int*",0)
  52.         //        调试输出("写入是否成功: "& Ret)
  53.     end
  54.     return Ret
  55.     //调试输出("坐标是的值是:"& Value)
  56. end



  57. function 写float(Hwnd,addr,value)
  58.     var Ret
  59.     var VarValue=floattohex(value)
  60.     if(value<=4294967295)
  61.         var PID=information(Hwnd,5)
  62.         var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
  63.         traceprint("进程句柄:"& 进程句柄)
  64.         Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",4,"int*",0)
  65.         traceprint("写入是否成功: "& Ret)
  66.         return Ret
  67.     else
  68.         return 0
  69.     end
  70. end



  71. function 写4byte(Hwnd,addr,value)
  72.     var Ret
  73.     if(value<=4294967295)
  74.         var VarValue=value
  75.         var PID=information(Hwnd,5)
  76.         var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
  77.         //        调试输出("进程句柄:"& 进程句柄)
  78.         Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",4,"int*",0)
  79.         //        调试输出("写入是否成功: "& Ret)
  80.         return Ret
  81.     else
  82.         return 0
  83.     end
  84.    
  85.     //调试输出("坐标是的值是:"& Value)
  86. end

  87. function 写2byte(Hwnd,addr,value)
  88.     var Ret
  89.     if(value<=65535)
  90.         var VarValue=value
  91.         var PID=information(Hwnd,5)
  92.         var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
  93.         //        调试输出("进程句柄:"& 进程句柄)
  94.         Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",2,"int*",0)
  95.         //        调试输出("写入是否成功: "& Ret)
  96.         return Ret
  97.     else
  98.         return 0
  99.     end
  100.    
  101.     //调试输出("坐标是的值是:"& Value)
  102. end


  103. function 写byte(Hwnd,addr,value)
  104.     var Ret
  105.     if(value<=255)
  106.         var VarValue=value
  107.         var PID=information(Hwnd,5)
  108.         var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
  109.         traceprint("进程句柄:"& 进程句柄)
  110.         Ret=dllcall("kernel32.dll","BOOL","WriteProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",1,"int*",0)
  111.         traceprint("写入是否成功: "& Ret)
  112.         return Ret
  113.     else
  114.         return 0
  115.     end
  116.    
  117.     //调试输出("坐标是的值是:"& Value)
  118. end

  119. function 读4dword(Hwnd,addr)
  120.     var VarValue=0//这个很重要哦,赋值表示他是一个整数型
  121.     var PID=information(Hwnd,5)
  122.     var 进程句柄=dllcall("kernel32.dll","long","OpenProcess","int",2035711,"int",0,"int",PID)
  123.     dllcall("kernel32.dll","BOOL","ReadProcessMemory","HANDLE",进程句柄,"DWORD*",addr,"DWORD*",getvarpointer(VarValue)+8,"int",4,"int*",0)
  124.     return VarValue
  125. end


  126. function 根据窗口句柄获取进程pid(窗口句柄)
  127.     var PID=information(窗口句柄,5)
  128.     return PID
  129. end

  130. function 申请本地内存空间(Size)
  131.     var 申请本地内存指针
  132.     申请本地内存指针=dllcall("kernel32.dll","DWROD","LocalAlloc","DWORD",0,"DWORD",Size)//第一个参数为0即可,第二个参数是4字节数
  133.     return 申请本地内存指针
  134. end

  135. function 获取本地内存指针大小(内存指针)
  136.     var Size
  137.     Size=dllcall("kernel32.dll","DWROD","LocalSize","DWORD",内存指针)//这个是读取内存空间的大小
  138.     return Size
  139. end

  140. function 释放本地内存指针(内存指针)//==============返回值是0的话就成功
  141.     var RetValue
  142.     RetValue=dllcall("kernel32.dll","DWROD","LocalFree","HLOCAL",内存指针)//第一个参数为0即可,第二个参数是4字节数
  143.     return RetValue
  144. end


  145. function 进制_十六转十(十六进制文本)//传进去的二进制必须为文本型
  146.     var i,数组文本,临时文本,计算结果
  147.     数组文本 = "0123456789ABCDEF"
  148.     临时文本 = struppercase(十六进制文本)
  149.     for(i = 0; i < strlen(十六进制文本); i++)
  150.         计算结果 = 计算结果 * 16 + strfind(数组文本,strsub(临时文本,i,i+1))
  151.     end
  152.     return 计算结果
  153. end

  154. function 进制_十转十六(十进制数值)
  155.     var 余数,计算结果
  156.     var 余数数组 = array("0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "A", "B", "C", "D", "E", "F")
  157.     while(十进制数值 >= 0)
  158.         余数 = 十进制数值 % 16
  159.         计算结果 = 余数数组[余数] & 计算结果
  160.         十进制数值 = (十进制数值 - 余数) / 16
  161.         if(十进制数值 <= 0)
  162.             break
  163.         end
  164.     end
  165.     return (计算结果)
  166. end

  167. function 进制_十转二(十进制数值)
  168.     var 余数,计算结果
  169.     while(十进制数值 > 1)
  170.         余数 = 十进制数值 % 2
  171.         十进制数值 = cint(十进制数值 / 2)
  172.         计算结果 = cstring(余数) & 计算结果
  173.     end
  174.     计算结果 = cstring(十进制数值) & 计算结果
  175.     return 计算结果
  176. end

  177. function 进制_二转十(二进制文本数据)//传进去的二进制必须为文本型
  178.     var i,计算结果
  179.     for(i = 0; i < strlen(二进制文本数据); i++)
  180.         if(cint(strsub(二进制文本数据,i,i+1)) < 10)
  181.             计算结果 = 计算结果 + cint(strsub(二进制文本数据,i,i+1)) * mpow(2,strlen(二进制文本数据) - i - 1)
  182.         end
  183.     end
  184.     return 计算结果
  185. end

  186. 功能 进制_双精度浮点转16(双精度数值)
  187.     变量 VarValue1=0 //初始化
  188.     变量 VarValue2=0 //初始化
  189.     变量 varrvalue=""
  190.     变量 双精度数值地址=获取变量地址(双精度数值)
  191.     //    消息框(字符串格式化( "%X",双精度数值地址))
  192.     动态库调用("kernel32.dll","VOID","RtlMoveMemory","DWORD*",获取变量指针(VarValue1)+8,"VOID*",双精度数值地址,"DWORD",4)
  193.     VarValue1=字符串格式化( "%X",VarValue1)
  194.     //    消息框(VarValue1)
  195.     动态库调用("kernel32.dll","VOID","RtlMoveMemory","DWORD*",获取变量指针(VarValue2)+8,"DWORD*",双精度数值地址+4 ,"DWORD",4)
  196.     VarValue2=字符串格式化( "%X",VarValue2)
  197.     //    消息框(VarValue2)
  198.     varrvalue=VarValue2 & VarValue1
  199.     //    消息框 (varrvalue)
  200.    
  201.     如果 (字符串长度(varrvalue)==9)
  202.         varrvalue=varrvalue & "00000000"
  203.         返回 varrvalue  
  204.     否则如果   (字符串长度(varrvalue)==16 )
  205.         返回 varrvalue
  206.     否则如果   (字符串长度(varrvalue)==2)
  207.         varrvalue="0"
  208.         返回 varrvalue
  209.     结束
  210. 结束

  211. function W_GetCode()
  212.     W_GetCode = PublicCode
  213. end

  214. function W_HighAndLow(Value , n) //高低位互换,n的值为2/4/8
  215.     var tmp1 , tmp2 , i,LenStr
  216.    
  217.     tmp1 = strright("0000000"& cstring(strformat("%x",Value)), n) //补位
  218.     LenStr=strlen(tmp1)
  219.     for(i = 0;  i< LenStr / 2 ;i++)  
  220.         tmp2 =  tmp2 &strsub(tmp1, LenStr - 2 - 2 * i, LenStr -2 * i) //逆向排序
  221.     end//=======================================这里出错
  222.     return  tmp2
  223. end


  224. function Leave()
  225.     PublicCode = PublicCode & "C9"
  226. end

  227. function Pushad()
  228.     PublicCode = PublicCode & "60"
  229. end

  230. function Popad()
  231.     PublicCode = PublicCode & "61"
  232. end

  233. function Nop()
  234.     PublicCode = PublicCode & "90"
  235. end

  236. function Ret()
  237.     PublicCode = PublicCode & "C3"
  238. end

  239. function Retn(i)  //这个是新加的
  240.     PublicCode = PublicCode & "C2"& W_HighAndLow(i, 4)
  241. end

  242. function RetA(i )
  243.     PublicCode = PublicCode & W_HighAndLow(i, 4)
  244. end

  245. function IN_AL_DX()
  246.     PublicCode = PublicCode & "EC"
  247. end

  248. function TEST_EAX_EAX()
  249.     PublicCode = PublicCode & "85C0"
  250. end

  251. //'Add
  252. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
  253. function Add_EAX_EDX()
  254.     PublicCode = PublicCode & "03C2"
  255. end

  256. function Add_EBX_EAX()
  257.     PublicCode = PublicCode & "03D8"
  258. end

  259. function Add_EAX_DWORD_Ptr(i )
  260.     PublicCode = PublicCode & "0305" & W_HighAndLow(i, 8)
  261. end

  262. function Add_EBX_DWORD_Ptr(i )
  263.     PublicCode = PublicCode & "031D" & W_HighAndLow(i, 8)
  264. end

  265. function Add_EBP_DWORD_Ptr(i )
  266.     PublicCode = PublicCode & "032D" & W_HighAndLow(i, 8)
  267. end

  268. function Add_EAX(i )
  269.     PublicCode = PublicCode & "05" & W_HighAndLow(i, 8)
  270. end

  271. function Add_EBX(i )
  272.     PublicCode = PublicCode & "83C3" & W_HighAndLow(i, 8)
  273. end

  274. function Add_ECX(i )
  275.     PublicCode = PublicCode & "83C1" & W_HighAndLow(i, 8)
  276. end

  277. function Add_EDX(i )
  278.     PublicCode = PublicCode & "83C2" & W_HighAndLow(i, 8)
  279. end

  280. function Add_ESI(i )
  281.     PublicCode = PublicCode & "83C6" & W_HighAndLow(i, 8)
  282. end

  283. function Add_ESP(i )
  284.     PublicCode = PublicCode & "83C4" & W_HighAndLow(i, 8)
  285. end

  286. //'Call
  287. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
  288. function Call_EAX()
  289.     PublicCode = PublicCode & "FFD0"
  290. end

  291. function Call_EBX()
  292.     PublicCode = PublicCode & "FFD3"
  293. end

  294. function Call_ECX()
  295.     PublicCode = PublicCode & "FFD1"
  296. end

  297. function Call_EDX()
  298.     PublicCode = PublicCode & "FFD2"
  299. end

  300. function Call_ESI()
  301.     PublicCode = PublicCode & "FFD6"
  302. end

  303. function Call_ESP()
  304.     PublicCode = PublicCode & "FFD4"
  305. end

  306. function Call_EBP()
  307.     PublicCode = PublicCode & "FFD5"
  308. end

  309. function Call_EDI()
  310.     PublicCode = PublicCode & "FFD7"
  311. end

  312. function Call_DWORD_Ptr_Addr(i )
  313.     PublicCode = PublicCode & "FF15" & W_HighAndLow(i, 8)
  314. end

  315. //function Call_DWORD_Ptr_Value(i ) //这个是新加进去的,这个时候错误的
  316. //PublicCode = PublicCode & "E8" & W_HighAndLow(i, 8)
  317. //end

  318. function Call_DWORD_Ptr_EAX()
  319.     PublicCode = PublicCode & "FF10"
  320. end

  321. function Call_DWORD_Ptr_EBX()
  322.     PublicCode = PublicCode & "FF13"
  323. end

  324. //'Cmp
  325. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
  326. function Cmp_EAX(i)
  327.     if  ((i<= 255) && (i >= 0))
  328.         PublicCode = PublicCode & "83F8" & W_HighAndLow(i, 2)
  329.     else
  330.         PublicCode = PublicCode & "3D" & W_HighAndLow(i, 8)
  331.     end
  332. end

  333. function Cmp_EAX_EDX()
  334.     PublicCode = PublicCode & "3BC2"
  335. end

  336. function Cmp_EAX_DWORD_Ptr(i )
  337.     PublicCode = PublicCode & "3B05" & W_HighAndLow(i, 8)
  338. end

  339. function Cmp_DWORD_Ptr_EAX(i )
  340.     PublicCode = PublicCode & "3905" & W_HighAndLow(i, 8)
  341. end

  342. //'DEC
  343. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
  344. function Dec_EAX()
  345.     PublicCode = PublicCode & "48"
  346. end

  347. function Dec_EBX()
  348.     PublicCode = PublicCode & "4B"
  349. end

  350. function Dec_ECX()
  351.     PublicCode = PublicCode & "49"
  352. end

  353. function Dec_EDX()
  354.     PublicCode = PublicCode & "4A"
  355. end

  356. //'Idiv
  357. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
  358. function Idiv_EAX()
  359.     PublicCode = PublicCode & "F7F8"
  360. end

  361. function Idiv_EBX()
  362.     PublicCode = PublicCode & "F7FB"
  363. end

  364. function Idiv_ECX()
  365.     PublicCode = PublicCode & "F7F9"
  366. end

  367. function Idiv_EDX()
  368.     PublicCode = PublicCode & "F7FA"
  369. end

  370. //'Imul
  371. //'&&&&&&&
  372. //&&&&&&&&&&&&&&&&&&&&&&&&&&&&
  373. function Imul_EAX_EDX()
  374.     PublicCode = PublicCode & "0FAFC2"
  375. end

  376. function Imul_EAX(i )
  377.     PublicCode = PublicCode & "6BC0" & W_HighAndLow(i, 2)
  378. end

  379. function ImulB_EAX(i )
  380.     PublicCode = PublicCode & "69C0" & W_HighAndLow(i, 8)
  381. end

  382. //'INC
  383. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
  384. function Inc_EAX()
  385.     PublicCode = PublicCode & "40"
  386. end

  387. function Inc_EBX()
  388.     PublicCode = PublicCode & "43"
  389. end

  390. function Inc_ECX()
  391.     PublicCode = PublicCode & "41"
  392. end

  393. function Inc_EDX()
  394.     PublicCode = PublicCode & "42"
  395. end

  396. function Inc_EDI()
  397.     PublicCode = PublicCode & "47"
  398. end

  399. function Inc_ESI()
  400.     PublicCode = PublicCode & "46"
  401. end

  402. function Inc_DWORD_Ptr_EAX()
  403.     PublicCode = PublicCode & "FF00"
  404. end

  405. function Inc_DWORD_Ptr_EBX()
  406.     PublicCode = PublicCode & "FF03"
  407. end

  408. function Inc_DWORD_Ptr_ECX()
  409.     PublicCode = PublicCode & "FF01"
  410. end

  411. function Inc_DWORD_Ptr_EDX()
  412.     PublicCode = PublicCode & "FF02"
  413. end

  414. //'JMP/JE/JNE
  415. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
  416. function JMP_EAX()
  417.     PublicCode = PublicCode & "FFE0"
  418. end

  419. //'Mov
  420. function Mov_DWORD_Ptr_Addr_EAX(i)      
  421.     PublicCode = PublicCode & "A3" & W_HighAndLow(i, 8)
  422. end

  423. function Mov_DWORD_Ptr_Addr_AL(i)      
  424.     PublicCode = PublicCode & "A2" & W_HighAndLow(i, 8)
  425. end

  426. function Mov_DWORD_Ptr_Addr_AH(i)      
  427.     PublicCode = PublicCode & "8825" & W_HighAndLow(i, 8)
  428. end

  429. function Mov_EAX_Value(i )
  430.     PublicCode = PublicCode & "B8" & W_HighAndLow(i, 8)
  431. end

  432. function Mov_EBX_Value(i )
  433.     PublicCode = PublicCode & "BB" & W_HighAndLow(i, 8)
  434. end

  435. function Mov_ECX_Value(i )
  436.     PublicCode = PublicCode & "B9" & W_HighAndLow(i, 8)
  437. end

  438. function Mov_EDX_Value(i )
  439.     PublicCode = PublicCode & "BA" & W_HighAndLow(i, 8)
  440. end

  441. function Mov_ESI_Value(i )
  442.     PublicCode = PublicCode & "BE" & W_HighAndLow(i, 8)
  443. end

  444. function Mov_ESP_Value(i )
  445.     PublicCode = PublicCode & "BC" & W_HighAndLow(i, 8)
  446. end

  447. function Mov_EBP_Value(i )
  448.     PublicCode = PublicCode & "BD" & W_HighAndLow(i, 8)
  449. end

  450. function Mov_EDI_Value(i )
  451.     PublicCode = PublicCode & "BF" & W_HighAndLow(i, 8)
  452. end

  453. function Mov_EBX_DWORD_Ptr(i )
  454.     PublicCode = PublicCode & "8B1D" & W_HighAndLow(i, 8)
  455. end

  456. function Mov_ECX_DWORD_Ptr_Addr(i )
  457.     PublicCode = PublicCode & "8B0D" & W_HighAndLow(i, 8)
  458. end

  459. function Mov_EAX_DWORD_Ptr_Addr(i )
  460.     PublicCode = PublicCode & "A1" & W_HighAndLow(i, 8)
  461. end

  462. function Mov_EDX_DWORD_Ptr_Addr(i )
  463.     PublicCode = PublicCode & "8B15" & W_HighAndLow(i, 8)
  464. end

  465. function Mov_ESI_DWORD_Ptr_Addr(i )
  466.     PublicCode = PublicCode & "8B35" & W_HighAndLow(i, 8)
  467. end

  468. function Mov_ESP_DWORD_Ptr_Addr(i )
  469.     PublicCode = PublicCode & "8B25" & W_HighAndLow(i, 8)
  470. end

  471. function Mov_EBP_DWORD_Ptr_Addr(i )
  472.     PublicCode = PublicCode & "8B2D" & W_HighAndLow(i, 8)
  473. end

  474. function Mov_EAX_DWORD_Ptr_EAX()
  475.     PublicCode = PublicCode & "8B00"
  476. end

  477. function Mov_EAX_DWORD_Ptr_EBP()
  478.     PublicCode = PublicCode & "8B4500"
  479. end

  480. function Mov_EAX_DWORD_Ptr_EBX()
  481.     PublicCode = PublicCode & "8B03"
  482. end

  483. function Mov_EAX_DWORD_Ptr_ECX()
  484.     PublicCode = PublicCode & "8B01"
  485. end

  486. function Mov_EAX_DWORD_Ptr_EDX()
  487.     PublicCode = PublicCode & "8B02"
  488. end

  489. function Mov_EAX_DWORD_Ptr_EDI()
  490.     PublicCode = PublicCode & "8B07"
  491. end

  492. function Mov_EAX_DWORD_Ptr_ESP()
  493.     PublicCode = PublicCode & "8B0424"
  494. end

  495. function Mov_EAX_DWORD_Ptr_ESI()
  496.     PublicCode = PublicCode & "8B06"
  497. end

  498. function Mov_EAX_DWORD_Ptr_EAX_Add(i )
  499.     if ((i<= 255) && (i>= 0))
  500.         PublicCode = PublicCode & "8B40" & W_HighAndLow(i, 2)
  501.     else
  502.         PublicCode = PublicCode & "8B80" & W_HighAndLow(i, 8)
  503.     end
  504. end

  505. function Mov_EAX_DWORD_Ptr_ESP_Add(i )
  506.     if ((i<= 255) && (i>= 0))
  507.         PublicCode = PublicCode & "8B4424" & W_HighAndLow(i, 2)
  508.     else
  509.         PublicCode = PublicCode & "8B8424" & W_HighAndLow(i, 8)
  510.     end
  511. end

  512. function Mov_EAX_DWORD_Ptr_EBX_Add(i )
  513.     if ((i<= 255) && (i>= 0))
  514.         PublicCode = PublicCode & "8B43" & W_HighAndLow(i, 2)
  515.     else
  516.         PublicCode = PublicCode & "8B83" & W_HighAndLow(i, 8)
  517.     end
  518. end

  519. function Mov_EAX_DWORD_Ptr_ECX_Add(i )
  520.     if ((i<= 255) && (i>= 0))
  521.         PublicCode = PublicCode & "8B41" & W_HighAndLow(i, 2)
  522.     else
  523.         PublicCode = PublicCode & "8B81" & W_HighAndLow(i, 8)
  524.     end
  525. end

  526. function Mov_EAX_DWORD_Ptr_EDX_Add(i )
  527.     if ((i<= 255) && (i>= 0))
  528.         PublicCode = PublicCode & "8B42" & W_HighAndLow(i, 2)
  529.     else
  530.         PublicCode = PublicCode & "8B82" & W_HighAndLow(i, 8)
  531.     end
  532. end

  533. function Mov_EAX_DWORD_Ptr_EDI_Add(i )
  534.     if ((i<= 255) && (i>= 0))
  535.         PublicCode = PublicCode & "8B47" & W_HighAndLow(i, 2)
  536.     else
  537.         PublicCode = PublicCode & "8B87" & W_HighAndLow(i, 8)
  538.     end
  539. end

  540. function Mov_EAX_DWORD_Ptr_EBP_Add(i )
  541.     if ((i<= 255) && (i>= 0))
  542.         PublicCode = PublicCode & "8B45" & W_HighAndLow(i, 2)
  543.     else
  544.         PublicCode = PublicCode & "8B85" & W_HighAndLow(i, 8)
  545.     end
  546. end

  547. function Mov_EAX_DWORD_Ptr_ESI_Add(i )
  548.     if ((i<= 255) && (i>= 0))
  549.         PublicCode = PublicCode & "8B46" & W_HighAndLow(i, 2)
  550.     else
  551.         PublicCode = PublicCode & "8B86" & W_HighAndLow(i, 8)
  552.     end
  553. end

  554. function Mov_EBX_DWORD_Ptr_EAX_Add(i )
  555.     if ((i<= 255) && (i>= 0))
  556.         PublicCode = PublicCode & "8B58" & W_HighAndLow(i, 2)
  557.     else
  558.         PublicCode = PublicCode & "8B98" & W_HighAndLow(i, 8)
  559.     end
  560. end

  561. function Mov_EBX_DWORD_Ptr_ESP_Add(i )
  562.     if ((i<= 255) && (i>= 0))
  563.         PublicCode = PublicCode & "8B5C24" & W_HighAndLow(i, 2)
  564.     else
  565.         PublicCode = PublicCode & "8B9C24" & W_HighAndLow(i, 8)
  566.     end
  567. end

  568. function Mov_EBX_DWORD_Ptr_EBX_Add(i )
  569.     if ((i<= 255) && (i>= 0))
  570.         PublicCode = PublicCode & "8B5B" & W_HighAndLow(i, 2)
  571.     else
  572.         PublicCode = PublicCode & "8B9B" & W_HighAndLow(i, 8)
  573.     end
  574. end

  575. function Mov_EBX_DWORD_Ptr_ECX_Add(i )
  576.     if ((i<= 255) && (i>= 0))
  577.         PublicCode = PublicCode & "8B59" & W_HighAndLow(i, 2)
  578.     else
  579.         PublicCode = PublicCode & "8B99" & W_HighAndLow(i, 8)
  580.     end
  581. end

  582. function Mov_EBX_DWORD_Ptr_EDX_Add(i )
  583.     if ((i<= 255) && (i>= 0))
  584.         PublicCode = PublicCode & "8B5A" & W_HighAndLow(i, 2)
  585.     else
  586.         PublicCode = PublicCode & "8B9A" & W_HighAndLow(i, 8)
  587.     end
  588. end

  589. function Mov_EBX_DWORD_Ptr_EDI_Add(i )
  590.     if ((i<= 255) && (i>= 0))
  591.         PublicCode = PublicCode & "8B5F" & W_HighAndLow(i, 2)
  592.     else
  593.         PublicCode = PublicCode & "8B9F" & W_HighAndLow(i, 8)
  594.     end
  595. end

  596. function Mov_EBX_DWORD_Ptr_EBP_Add(i )
  597.     if ((i<= 255) && (i>= 0))
  598.         PublicCode = PublicCode & "8B5D" & W_HighAndLow(i, 2)
  599.     else
  600.         PublicCode = PublicCode & "8B9D" & W_HighAndLow(i, 8)
  601.     end
  602. end

  603. function Mov_EBX_DWORD_Ptr_ESI_Add(i )
  604.     if ((i<= 255) && (i>= 0))
  605.         PublicCode = PublicCode & "8B5E" & W_HighAndLow(i, 2)
  606.     else
  607.         PublicCode = PublicCode & "8B9E" & W_HighAndLow(i, 8)
  608.     end
  609. end

  610. function Mov_ECX_DWORD_Ptr_EAX_Add(i)  //这里出错过
  611.     if ((i<= 255) && (i>= 0))
  612.         PublicCode = PublicCode & "8B48" & W_HighAndLow(i, 2)
  613.     else
  614.         PublicCode = PublicCode & "8B88" & W_HighAndLow(i, 8)
  615.     end
  616. end

  617. function Mov_ECX_DWORD_Ptr_ESP_Add(i )
  618.     if ((i<= 255) && (i>= 0))
  619.         PublicCode = PublicCode & "8B4C24" & W_HighAndLow(i, 2)
  620.     else
  621.         PublicCode = PublicCode & "8B8C24" & W_HighAndLow(i, 8)
  622.     end
  623. end

  624. function Mov_ECX_DWORD_Ptr_EBX_Add(i )
  625.     if ((i<= 255) && (i>= 0))
  626.         PublicCode = PublicCode & "8B4B" & W_HighAndLow(i, 2)
  627.     else
  628.         PublicCode = PublicCode & "8B8B" & W_HighAndLow(i, 8)
  629.     end
  630. end

  631. function Mov_ECX_DWORD_Ptr_ECX_Add(i )
  632.     if ((i<= 255) && (i>= 0))
  633.         PublicCode = PublicCode & "8B49" & W_HighAndLow(i, 2)
  634.     else
  635.         PublicCode = PublicCode & "8B89" & W_HighAndLow(i, 8)
  636.     end
  637. end

  638. function Mov_ECX_DWORD_Ptr_EDX_Add(i )
  639.     if ((i<= 255) && (i>= 0))
  640.         PublicCode = PublicCode & "8B4A" & W_HighAndLow(i, 2)
  641.     else
  642.         PublicCode = PublicCode & "8B8A" & W_HighAndLow(i, 8)
  643.     end
  644. end

  645. function Mov_ECX_DWORD_Ptr_EDI_Add(i )
  646.     if ((i<= 255) && (i>= 0))
  647.         PublicCode = PublicCode & "8B4F" & W_HighAndLow(i, 2)
  648.     else
  649.         PublicCode = PublicCode & "8B8F" & W_HighAndLow(i, 8)
  650.     end
  651. end

  652. function Mov_ECX_DWORD_Ptr_EBP_Add(i )
  653.     if ((i<= 255) && (i>= 0))
  654.         PublicCode = PublicCode & "8B4D" & W_HighAndLow(i, 2)
  655.     else
  656.         PublicCode = PublicCode & "8B8D" & W_HighAndLow(i, 8)
  657.     end
  658. end

  659. function Mov_ECX_DWORD_Ptr_ESI_Add(i )
  660.     if ((i<= 255) && (i>= 0))
  661.         PublicCode = PublicCode & "8B4E" & W_HighAndLow(i, 2)
  662.     else
  663.         PublicCode = PublicCode & "8B8E" & W_HighAndLow(i, 8)
  664.     end
  665. end

  666. function Mov_EDX_DWORD_Ptr_EAX_Add(i )
  667.     if ((i<= 255) && (i>= 0))
  668.         PublicCode = PublicCode & "8B50" & W_HighAndLow(i, 2)
  669.     else
  670.         PublicCode = PublicCode & "8B90" & W_HighAndLow(i, 8)
  671.     end
  672. end

  673. function Mov_EDX_DWORD_Ptr_ESP_Add(i )
  674.     if ((i<= 255) && (i>= 0))
  675.         PublicCode = PublicCode & "8B5424" & W_HighAndLow(i, 2)
  676.     else
  677.         PublicCode = PublicCode & "8B9424" & W_HighAndLow(i, 8)
  678.     end
  679. end

  680. function Mov_EDX_DWORD_Ptr_EBX_Add(i)
  681.     if ((i<= 255) && (i>= 0))
  682.         PublicCode = PublicCode & "8B53" & W_HighAndLow(i, 2)
  683.     else
  684.         PublicCode = PublicCode & "8B93" & W_HighAndLow(i, 8 ) //这里出错过
  685.     end
  686. end

  687. function Mov_EDX_DWORD_Ptr_ECX_Add(i )
  688.     if ((i<= 255) && (i>= 0))
  689.         PublicCode = PublicCode & "8B51" & W_HighAndLow(i, 2)
  690.     else
  691.         PublicCode = PublicCode & "8B91" & W_HighAndLow(i, 8)
  692.     end
  693. end

  694. function Mov_EDX_DWORD_Ptr_EDX_Add(i )
  695.     if ((i<= 255) && (i>= 0))
  696.         PublicCode = PublicCode & "8B52" & W_HighAndLow(i, 2)
  697.     else
  698.         PublicCode = PublicCode & "8B92" & W_HighAndLow(i, 8)
  699.     end
  700. end

  701. function Mov_EDX_DWORD_Ptr_EDI_Add(i )
  702.     if ((i<= 255) && (i>= 0))
  703.         PublicCode = PublicCode & "8B57" & W_HighAndLow(i, 2)
  704.     else
  705.         PublicCode = PublicCode & "8B97" & W_HighAndLow(i, 8)
  706.     end
  707. end

  708. function Mov_EDX_DWORD_Ptr_EBP_Add(i )
  709.     if ((i<= 255) && (i>= 0))
  710.         PublicCode = PublicCode & "8B55" & W_HighAndLow(i, 2)
  711.     else
  712.         PublicCode = PublicCode & "8B95" & W_HighAndLow(i, 8)
  713.     end
  714. end

  715. function Mov_EDX_DWORD_Ptr_ESI_Add(i )
  716.     if ((i<= 255) && (i>= 0))
  717.         PublicCode = PublicCode & "8B56" & W_HighAndLow(i, 2)
  718.     else
  719.         PublicCode = PublicCode & "8B96" & W_HighAndLow(i, 8)
  720.     end
  721. end

  722. function Mov_EBX_DWORD_Ptr_EAX()
  723.     PublicCode = PublicCode & "8B18"
  724. end

  725. function Mov_EBX_DWORD_Ptr_EBP()
  726.     PublicCode = PublicCode & "8B5D00"
  727. end

  728. function Mov_EBX_DWORD_Ptr_EBX()
  729.     PublicCode = PublicCode & "8B1B"
  730. end

  731. function Mov_EBX_DWORD_Ptr_ECX()
  732.     PublicCode = PublicCode & "8B19"
  733. end

  734. function Mov_EBX_DWORD_Ptr_EDX()
  735.     PublicCode = PublicCode & "8B1A"
  736. end

  737. function Mov_EBX_DWORD_Ptr_EDI()
  738.     PublicCode = PublicCode & "8B1F"
  739. end

  740. function Mov_EBX_DWORD_Ptr_ESP()
  741.     PublicCode = PublicCode & "8B1C24"
  742. end

  743. function Mov_EBX_DWORD_Ptr_ESI()
  744.     PublicCode = PublicCode & "8B1E"
  745. end
  746. function Mov_ECX_DWORD_Ptr_EAX()
  747.     PublicCode = PublicCode & "8B08"
  748. end

  749. function Mov_ECX_DWORD_Ptr_EBP()
  750.     PublicCode = PublicCode & "8B4D00"
  751. end

  752. function Mov_ECX_DWORD_Ptr_EBX()
  753.     PublicCode = PublicCode & "8B0B"
  754. end

  755. function Mov_ECX_DWORD_Ptr_ECX()
  756.     PublicCode = PublicCode & "8B09"
  757. end

  758. function Mov_ECX_DWORD_Ptr_EDX()
  759.     PublicCode = PublicCode & "8B0A"
  760. end

  761. function Mov_ECX_DWORD_Ptr_EDI()
  762.     PublicCode = PublicCode & "8B0F"
  763. end

  764. function Mov_ECX_DWORD_Ptr_ESP()
  765.     PublicCode = PublicCode & "8B0C24"
  766. end

  767. function Mov_ECX_DWORD_Ptr_ESI()
  768.     PublicCode = PublicCode & "8B0E"
  769. end

  770. function Mov_EDX_DWORD_Ptr_EAX()
  771.     PublicCode = PublicCode & "8B10"
  772. end

  773. function Mov_EDX_DWORD_Ptr_EBP()
  774.     PublicCode = PublicCode & "8B5500"
  775. end

  776. function Mov_EDX_DWORD_Ptr_EBX()
  777.     PublicCode = PublicCode & "8B13"
  778. end

  779. function Mov_EDX_DWORD_Ptr_ECX()
  780.     PublicCode = PublicCode & "8B11"
  781. end

  782. function Mov_EDX_DWORD_Ptr_EDX()
  783.     PublicCode = PublicCode & "8B12"
  784. end

  785. function Mov_EDX_DWORD_Ptr_EDI()
  786.     PublicCode = PublicCode & "8B17"
  787. end

  788. function Mov_EDX_DWORD_Ptr_ESI()
  789.     PublicCode = PublicCode & "8B16"
  790. end

  791. function Mov_EDX_DWORD_Ptr_ESP()
  792.     PublicCode = PublicCode & "8B1424"
  793. end

  794. function Mov_EAX_EBP()
  795.     PublicCode = PublicCode & "8BC5"
  796. end

  797. function Mov_EAX_EBX()
  798.     PublicCode = PublicCode & "8BC3"
  799. end

  800. function Mov_EAX_ECX()
  801.     PublicCode = PublicCode & "8BC1"
  802. end

  803. function Mov_EAX_EDI()
  804.     PublicCode = PublicCode & "8BC7"
  805. end

  806. function Mov_EAX_EDX()
  807.     PublicCode = PublicCode & "8BC2"
  808. end

  809. function Mov_EAX_ESI()
  810.     PublicCode = PublicCode & "8BC6"
  811. end

  812. function Mov_EAX_ESP()
  813.     PublicCode = PublicCode & "8BC4"
  814. end

  815. function Mov_EBX_EBP()
  816.     PublicCode = PublicCode & "8BDD"
  817. end

  818. function Mov_EBX_EAX()
  819.     PublicCode = PublicCode & "8BD8"
  820. end

  821. function Mov_EBX_ECX()
  822.     PublicCode = PublicCode & "8BD9"
  823. end

  824. function Mov_EBX_EDI()
  825.     PublicCode = PublicCode & "8BDF"
  826. end

  827. function Mov_EBX_EDX()
  828.     PublicCode = PublicCode & "8BDA"
  829. end

  830. function Mov_EBX_ESI()
  831.     PublicCode = PublicCode & "8BDE"
  832. end

  833. function Mov_EBX_ESP()
  834.     PublicCode = PublicCode & "8BDC"
  835. end

  836. function Mov_ECX_EBP()
  837.     PublicCode = PublicCode & "8BCD"
  838. end

  839. function Mov_ECX_EAX()
  840.     PublicCode = PublicCode & "8BC8"
  841. end

  842. function Mov_ECX_EBX()
  843.     PublicCode = PublicCode & "8BCB"
  844. end

  845. function Mov_ECX_EDI()
  846.     PublicCode = PublicCode & "8BCF"
  847. end

  848. function Mov_ECX_EDX()
  849.     PublicCode = PublicCode & "8BCA"
  850. end

  851. function Mov_ECX_ESI()
  852.     PublicCode = PublicCode & "8BCE"
  853. end

  854. function Mov_ECX_ESP()
  855.     PublicCode = PublicCode & "8BCC"
  856. end

  857. function Mov_EDX_EBP()
  858.     PublicCode = PublicCode & "8BD5"
  859. end

  860. function Mov_EDX_EBX()
  861.     PublicCode = PublicCode & "8BD3"
  862. end

  863. function Mov_EDX_ECX()
  864.     PublicCode = PublicCode & "8BD1"
  865. end

  866. function Mov_EDX_EDI()
  867.     PublicCode = PublicCode & "8BD7"
  868. end

  869. function Mov_EDX_EAX()
  870.     PublicCode = PublicCode & "8BD0"
  871. end

  872. function Mov_EDX_ESI()
  873.     PublicCode = PublicCode & "8BD6"
  874. end

  875. function Mov_EDX_ESP()
  876.     PublicCode = PublicCode & "8BD4"
  877. end

  878. function Mov_ESI_EBP()
  879.     PublicCode = PublicCode & "8BF5"
  880. end

  881. function Mov_ESI_EBX()
  882.     PublicCode = PublicCode & "8BF3"
  883. end

  884. function Mov_ESI_ECX()
  885.     PublicCode = PublicCode & "8BF1"
  886. end

  887. function Mov_ESI_EDI()
  888.     PublicCode = PublicCode & "8BF7"
  889. end

  890. function Mov_ESI_EAX()
  891.     PublicCode = PublicCode & "8BF0"
  892. end

  893. function Mov_ESI_EDX()
  894.     PublicCode = PublicCode & "8BF2"
  895. end

  896. function Mov_ESI_ESP()
  897.     PublicCode = PublicCode & "8BF4"
  898. end

  899. function Mov_ESP_EBP()
  900.     PublicCode = PublicCode & "8BE5"
  901. end

  902. function Mov_ESP_EBX()
  903.     PublicCode = PublicCode & "8BE3"
  904. end

  905. function Mov_ESP_ECX()
  906.     PublicCode = PublicCode & "8BE1"
  907. end

  908. function Mov_ESP_EDI()
  909.     PublicCode = PublicCode & "8BE7"
  910. end

  911. function Mov_ESP_EAX()
  912.     PublicCode = PublicCode & "8BE0"
  913. end

  914. function Mov_ESP_EDX()
  915.     PublicCode = PublicCode & "8BE2"
  916. end

  917. function Mov_ESP_ESI()
  918.     PublicCode = PublicCode & "8BE6"
  919. end

  920. function Mov_EDI_EBP()
  921.     PublicCode = PublicCode & "8BFD"
  922. end

  923. function Mov_EDI_EAX()
  924.     PublicCode = PublicCode & "8BF8"
  925. end

  926. function Mov_EDI_EBX()
  927.     PublicCode = PublicCode & "8BFB"
  928. end

  929. function Mov_EDI_ECX()
  930.     PublicCode = PublicCode & "8BF9"
  931. end

  932. function Mov_EDI_EDX()
  933.     PublicCode = PublicCode & "8BFA"
  934. end

  935. function Mov_EDI_ESI()
  936.     PublicCode = PublicCode & "8BFE"
  937. end

  938. function Mov_EDI_ESP()
  939.     PublicCode = PublicCode & "8BFC"
  940. end
  941. function Mov_EBP_EDI()
  942.     PublicCode = PublicCode & "8BDF"
  943. end

  944. function Mov_EBP_EAX()
  945.     PublicCode = PublicCode & "8BE8"
  946. end

  947. function Mov_EBP_EBX()
  948.     PublicCode = PublicCode & "8BEB"
  949. end

  950. function Mov_EBP_ECX()
  951.     PublicCode = PublicCode & "8BE9"
  952. end

  953. function Mov_EBP_EDX()
  954.     PublicCode = PublicCode & "8BEA"
  955. end

  956. function Mov_EBP_ESI()
  957.     PublicCode = PublicCode & "8BEE"
  958. end

  959. function Mov_EBP_ESP()
  960.     PublicCode = PublicCode & "8BEC"
  961. end
  962. //'Push
  963. //'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
  964. function Push(i)
  965.     if ((i<= 255) && (i>= 0))
  966.         PublicCode = PublicCode & "6A" & W_HighAndLow(i, 2)
  967.     else
  968.         PublicCode = PublicCode & "68" & W_HighAndLow(i, 8)
  969.     end
  970. end

  971. function Push_DWORD_Ptr_Addr(i )
  972.     PublicCode = PublicCode & "FF35" & W_HighAndLow(i, 8)
  973. end

  974. function Push_EAX()
  975.     PublicCode = PublicCode & "50"
  976. end

  977. function Push_ECX()
  978.     PublicCode = PublicCode & "51"
  979. end

  980. function Push_EDX()
  981.     PublicCode = PublicCode & "52"
  982. end

  983. function Push_EBX()
  984.     PublicCode = PublicCode & "53"
  985. end
  986. function Push_ESP()
  987.     PublicCode = PublicCode & "54"
  988. end

  989. function Push_EBP()
  990.     PublicCode = PublicCode & "55"
  991. end

  992. function Push_ESI()
  993.     PublicCode = PublicCode & "56"
  994. end

  995. function Push_EDI()
  996.     PublicCode = PublicCode & "57"
  997. end
  998. //'LEA
  999. function Lea_EAX_DWORD_Ptr_EAX_Add(i )
  1000.     if ((i<= 255) && (i>= 0))
  1001.         PublicCode = PublicCode & "8D40" & W_HighAndLow(i, 2)
  1002.     else
  1003.         PublicCode = PublicCode & "8D80" & W_HighAndLow(i, 8)
  1004.     end
  1005. end

  1006. function Lea_EAX_DWORD_Ptr_EBX_Add(i )
  1007.     if ((i<= 255) && (i>= 0))
  1008.         PublicCode = PublicCode & "8D43" & W_HighAndLow(i, 2)
  1009.     else
  1010.         PublicCode = PublicCode & "8D83" & W_HighAndLow(i, 8)
  1011.     end
  1012. end

  1013. function Lea_EAX_DWORD_Ptr_ECX_Add(i )
  1014.     if ((i<= 255) && (i>= 0))
  1015.         PublicCode = PublicCode & "8D41" & W_HighAndLow(i, 2)
  1016.     else
  1017.         PublicCode = PublicCode & "8D81" & W_HighAndLow(i, 8)
  1018.     end
  1019. end

  1020. function Lea_EAX_DWORD_Ptr_EDX_Add(i )
  1021.     if ((i<= 255) && (i>= 0))
  1022.         PublicCode = PublicCode & "8D42" & W_HighAndLow(i, 2)
  1023.     else
  1024.         PublicCode = PublicCode & "8D82" & W_HighAndLow(i, 8)
  1025.     end
  1026. end

  1027. function Lea_EAX_DWORD_Ptr_ESI_Add(i )
  1028.     if ((i<= 255) && (i>= 0))
  1029.         PublicCode = PublicCode & "8D46" & W_HighAndLow(i, 2)
  1030.     else
  1031.         PublicCode = PublicCode & "8D86" & W_HighAndLow(i, 8)
  1032.     end
  1033. end

  1034. function Lea_EAX_DWORD_Ptr_ESP_Add(i )
  1035.     if ((i<= 255) && (i>= 0))
  1036.         PublicCode = PublicCode & "8D40" & W_HighAndLow(i, 2)
  1037.     else
  1038.         PublicCode = PublicCode & "8D80" & W_HighAndLow(i, 8)
  1039.     end
  1040. end

  1041. function Lea_EAX_DWORD_Ptr_EBP_Add(i )
  1042.     if ((i<= 255) && (i>= 0))
  1043.         PublicCode = PublicCode & "8D4424" & W_HighAndLow(i, 2)
  1044.     else
  1045.         PublicCode = PublicCode & "8D8424" & W_HighAndLow(i, 8)
  1046.     end
  1047. end

  1048. function Lea_EAX_DWORD_Ptr_EDI_Add(i )
  1049.     if ((i<= 255) && (i>= 0))
  1050.         PublicCode = PublicCode & "8D47" & W_HighAndLow(i, 2)
  1051.     else
  1052.         PublicCode = PublicCode & "8D87" & W_HighAndLow(i, 8)
  1053.     end
  1054. end

  1055. function Lea_EBX_DWORD_Ptr_EAX_Add(i )
  1056.     if ((i<= 255) && (i>= 0))
  1057.         PublicCode = PublicCode & "8D58" & W_HighAndLow(i, 2)
  1058.     else
  1059.         PublicCode = PublicCode & "8D98" & W_HighAndLow(i, 8)
  1060.     end
  1061. end

  1062. function Lea_EBX_DWORD_Ptr_ESP_Add(i )
  1063.     if ((i<= 255) && (i>= 0))
  1064.         PublicCode = PublicCode & "8D5C24" & W_HighAndLow(i, 2)
  1065.     else
  1066.         PublicCode = PublicCode & "8D9C24" & W_HighAndLow(i, 8)
  1067.     end
  1068. end

  1069. function Lea_EBX_DWORD_Ptr_EBX_Add(i )
  1070.     if ((i<= 255) && (i>= 0))
  1071.         PublicCode = PublicCode & "8D5B" & W_HighAndLow(i, 2)
  1072.     else
  1073.         PublicCode = PublicCode & "8D9B" & W_HighAndLow(i, 8)
  1074.     end
  1075. end

  1076. function Lea_EBX_DWORD_Ptr_ECX_Add(i )
  1077.     if ((i<= 255) && (i>= 0))
  1078.         PublicCode = PublicCode & "8D59" & W_HighAndLow(i, 2)
  1079.     else
  1080.         PublicCode = PublicCode & "8D99" & W_HighAndLow(i, 8)
  1081.     end
  1082. end

  1083. function Lea_EBX_DWORD_Ptr_EDX_Add(i )
  1084.     if ((i<= 255) && (i>= 0))
  1085.         PublicCode = PublicCode & "8D5A" & W_HighAndLow(i, 2)
  1086.     else
  1087.         PublicCode = PublicCode & "8D9A" & W_HighAndLow(i, 8)
  1088.     end
  1089. end

  1090. function Lea_EBX_DWORD_Ptr_EDI_Add(i )
  1091.     if ((i<= 255) && (i>= 0))
  1092.         PublicCode = PublicCode & "8D5F" & W_HighAndLow(i, 2)
  1093.     else
  1094.         PublicCode = PublicCode & "8D9F" & W_HighAndLow(i, 8)
  1095.     end
  1096. end

  1097. function Lea_EBX_DWORD_Ptr_EBP_Add(i )
  1098.     if ((i<= 255) && (i>= 0))
  1099.         PublicCode = PublicCode & "8D5D" & W_HighAndLow(i, 2)
  1100.     else
  1101.         PublicCode = PublicCode & "8D9D" & W_HighAndLow(i, 8)
  1102.     end
  1103. end

  1104. function Lea_EBX_DWORD_Ptr_ESI_Add(i )
  1105.     if ((i<= 255) && (i>= 0))
  1106.         PublicCode = PublicCode & "8D5E" & W_HighAndLow(i, 2)
  1107.     else
  1108.         PublicCode = PublicCode & "8D9E" & W_HighAndLow(i, 8)
  1109.     end
  1110. end

  1111. function Lea_ECX_DWORD_Ptr_EAX_Add(i )
  1112.     if ((i<= 255) && (i>= 0))
  1113.         PublicCode = PublicCode & "8D48" & W_HighAndLow(i, 2)
  1114.     else
  1115.         PublicCode = PublicCode & "8D88" & W_HighAndLow(i, 8)
  1116.     end
  1117. end

  1118. function Lea_ECX_DWORD_Ptr_ESP_Add(i )
  1119.     if ((i<= 255) && (i>= 0))
  1120.         PublicCode = PublicCode & "8D4C24" & W_HighAndLow(i, 2)
  1121.     else
  1122.         PublicCode = PublicCode & "8D8C24" & W_HighAndLow(i, 8)
  1123.     end
  1124. end

  1125. function Lea_ECX_DWORD_Ptr_EBX_Add(i )
  1126.     if ((i<= 255) && (i>= 0))
  1127.         PublicCode = PublicCode & "8D4B" & W_HighAndLow(i, 2)
  1128.     else
  1129.         PublicCode = PublicCode & "8D8B" & W_HighAndLow(i, 8)
  1130.     end
  1131. end

  1132. function Lea_ECX_DWORD_Ptr_ECX_Add(i )
  1133.     if ((i<= 255) && (i>= 0))
  1134.         PublicCode = PublicCode & "8D49" & W_HighAndLow(i, 2)
  1135.     else
  1136.         PublicCode = PublicCode & "8D89" & W_HighAndLow(i, 8)
  1137.     end
  1138. end

  1139. function Lea_ECX_DWORD_Ptr_EDX_Add(i )
  1140.     if ((i<= 255) && (i>= 0))
  1141.         PublicCode = PublicCode & "8D4A" & W_HighAndLow(i, 2)
  1142.     else
  1143.         PublicCode = PublicCode & "8D8A" & W_HighAndLow(i, 8)
  1144.     end
  1145. end

  1146. function Lea_ECX_DWORD_Ptr_EDI_Add(i )
  1147.     if ((i<= 255) && (i>= 0))
  1148.         PublicCode = PublicCode & "8D4F" & W_HighAndLow(i, 2)
  1149.     else
  1150.         PublicCode = PublicCode & "8D8F" & W_HighAndLow(i, 8)
  1151.     end
  1152. end

  1153. function Lea_ECX_DWORD_Ptr_EBP_Add(i )
  1154.     if ((i<= 255) && (i>= 0))
  1155.         PublicCode = PublicCode & "8D4D" & W_HighAndLow(i, 2)
  1156.     else
  1157.         PublicCode = PublicCode & "8D8D" & W_HighAndLow(i, 8)
  1158.     end
  1159. end

  1160. function Lea_ECX_DWORD_Ptr_ESI_Add(i )
  1161.     if ((i<= 255) && (i>= 0))
  1162.         PublicCode = PublicCode & "8D4E" & W_HighAndLow(i, 2)
  1163.     else
  1164.         PublicCode = PublicCode & "8D8E" & W_HighAndLow(i, 8)
  1165.     end
  1166. end

  1167. function Lea_EDX_DWORD_Ptr_EAX_Add(i )
  1168.     if ((i<= 255) && (i>= 0))
  1169.         PublicCode = PublicCode & "8D50" & W_HighAndLow(i, 2)
  1170.     else
  1171.         PublicCode = PublicCode & "8D90" & W_HighAndLow(i, 8)
  1172.     end
  1173. end

  1174. function Lea_EDX_DWORD_Ptr_ESP_Add(i )
  1175.     if ((i<= 255) && (i>= 0))
  1176.         PublicCode = PublicCode & "8D5424" & W_HighAndLow(i, 2)
  1177.     else
  1178.         PublicCode = PublicCode & "8D9424" & W_HighAndLow(i, 8)
  1179.     end
  1180. end

  1181. function Lea_EDX_DWORD_Ptr_EBX_Add(i )
  1182.     if ((i<= 255) && (i>= 0))
  1183.         PublicCode = PublicCode & "8D53" & W_HighAndLow(i, 2)
  1184.     else
  1185.         PublicCode = PublicCode & "8D93" & W_HighAndLow(i, 8)
  1186.     end
  1187. end

  1188. function Lea_EDX_DWORD_Ptr_ECX_Add(i )
  1189.     if ((i<= 255) && (i>= 0))
  1190.         PublicCode = PublicCode & "8D51" & W_HighAndLow(i, 2)
  1191.     else
  1192.         PublicCode = PublicCode & "8D91" & W_HighAndLow(i, 8)
  1193.     end
  1194. end

  1195. function Lea_EDX_DWORD_Ptr_EDX_Add(i )
  1196.     if ((i<= 255) && (i>= 0))
  1197.         PublicCode = PublicCode & "8D52" & W_HighAndLow(i, 2)
  1198.     else
  1199.         PublicCode = PublicCode & "8D92" & W_HighAndLow(i, 8)
  1200.     end
  1201. end

  1202. function Lea_EDX_DWORD_Ptr_EDI_Add(i )
  1203.     if ((i<= 255) && (i>= 0))
  1204.         PublicCode = PublicCode & "8D57" & W_HighAndLow(i, 2)
  1205.     else
  1206.         PublicCode = PublicCode & "8D97" & W_HighAndLow(i, 8)
  1207.     end
  1208. end

  1209. function Lea_EDX_DWORD_Ptr_EBP_Add(i )
  1210.     if ((i<= 255) && (i>= 0))
  1211.         PublicCode = PublicCode & "8D55" & W_HighAndLow(i, 2)
  1212.     else
  1213.         PublicCode = PublicCode & "8D95" & W_HighAndLow(i, 8)
  1214.     end
  1215. end

  1216. function Lea_EDX_DWORD_Ptr_ESI_Add(i )
  1217.     if ((i<= 255) && (i>= 0))
  1218.         PublicCode = PublicCode & "8D56" & W_HighAndLow(i, 2)
  1219.     else
  1220.         PublicCode = PublicCode & "8D96" & W_HighAndLow(i, 8)
  1221.     end
  1222. end


  1223. function Pop_EAX()
  1224.     PublicCode = PublicCode & "58"
  1225. end

  1226. function Pop_EBX()
  1227.     PublicCode = PublicCode & "5B"
  1228. end

  1229. function Pop_ECX()
  1230.     PublicCode = PublicCode & "59"
  1231. end

  1232. function Pop_EDX()
  1233.     PublicCode = PublicCode & "5A"
  1234. end

  1235. function Pop_ESI()
  1236.     PublicCode = PublicCode & "5E"
  1237. end

  1238. function Pop_ESP()
  1239.     PublicCode = PublicCode & "5C"
  1240. end

  1241. function Pop_EDI()
  1242.     PublicCode = PublicCode & "5F"
  1243. end

  1244. function Pop_EBP()
  1245.     PublicCode = PublicCode & "5D"
  1246. end
复制代码


3

主题

805

回帖

3409

积分

高级会员

积分
3409
莫离 发表于 2017-8-30 17:19:28 | 显示全部楼层
此帖仅作者可见

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

手机版|小黑屋|虫虫联盟 ( 备案号:蜀ICP备15018121号-1 )

GMT+8, 2026-4-12 16:28 , Processed in 2.468488 second(s), 27 queries .

Powered by Discuz! X5.0 Licensed

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表