答复
偶也偶的贴出来献丑一下，写的很烂
代码:
00406BB6 > \FF15 98B04000 CALL DWORD PTR DS:[<&user32.CreateMenu>]
00406BBC . 8BF0 MOV ESI,EAX
00406BBE . 68 AF6B4000 PUSH bithaha.00406BAF
00406BC3 . 68 00010000 PUSH 100
00406BC8 . 6A 00 PUSH 0
00406BCA . 50 PUSH EAX
00406BCB . FF15 9CB04000 CALL DWORD PTR DS:[<&user32.AppendMenuA>] 00406BD1 . FF15 98B04000 CALL DWORD PTR DS:[<&user32.CreateMenu>]
00406BD7 . 68 A96B4000 PUSH bithaha.00406BA9
00406BDC . 56 PUSH ESI
00406BDD . 8BF0 MOV ESI,EAX
00406BDF . 6A 10 PUSH 10
00406BE1 . 50 PUSH EAX
00406BE2 . FF15 9CB04000 CALL DWORD PTR DS:[<&user32.AppendMenuA>] 00406BE8 . 6A 00 PUSH 0
00406BEA . 53 PUSH EBX
00406BEB . 56 PUSH ESI
00406BEC . B8 00000080 MOV EAX,80000000
00406BF1 . 33F6 XOR ESI,ESI
00406BF3 .^ E9 79A6FFFF JMP bithaha.00401271//返回到createwindow前
00406BF8 > 3D 11010000 CMP EAX,111
00406BFD . 75 2D JNZ SHORT bithaha.00406C2C
00406BFF . 90 NOP
00406C00 . 90 NOP
00406C01 . 90 NOP
00406C02 . 90 NOP
00406C03 . 56 PUSH ESI
00406C04 . 8B75 10 MOV ESI,DWORD PTR SS:[EBP+10]
00406C07 . 81FE 00010000 CMP ESI,100
00406C0D . 5E POP ESI
00406C0E . 75 1C JNZ SHORT bithaha.00406C2C
00406C10 . 90 NOP
00406C11 . 90 NOP
00406C12 . 90 NOP
00406C13 . 6A 00 PUSH 0
00406C15 . 68 976B4000 PUSH bithaha.00406B97
00406C1A . 68 746B4000 PUSH bithaha.00406B74
00406C1F . 6A 00 PUSH 0
00406C21 . FF15 A0B04000 CALL DWORD PTR DS:[<&user32.MessageBoxA>]
00406C27 .^ E9 28A7FFFF JMP bithaha.00401354
00406C2C > 48 DEC EAX
00406C2D . 48 DEC EAX
00406C2E .^ 0F84 16A7FFFF JE bithaha.0040134A
00406C34 . 83E8 03 SUB EAX,3
00406C37 .^ E9 A9A6FFFF JMP bithaha.004012E5//返回到窗口回调函数