[分享]反汇编notepad.exe重新编译运行
; int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
_WinMain: ; CODE XREF: .text:01007522p
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
push esi
push edi
call [GetCommandLineW] ; GetCommandLineW()
push offset ProcName ; "RegisterPenApp"
push 29h ; nIndex
mov edi, eax
call [GetSystemMetrics] ; GetSystemMetrics(x)
push eax ; hModule
call [GetProcAddress] ; GetProcAddress(x,x)
xor esi, esi
cmp eax, esi
mov [ebp-4], eax
jz short loc_100298B
push 1
push 1
call eax
loc_100298B: ; CODE XREF: .text:01002983j
push dword ptr [ebp+14h] ; nCmdShow
push edi ; lpsz
call _SkipProgramName ; SkipProgramName(x)
push eax ; int
push dword ptr [ebp+0Ch] ; int
push dword ptr [ebp+8] ; hInstance
call _NPInit ; NPInit(x,x,x,x)
test eax, eax
jnz short loc_10029AC
mov [ebp-18h], esi
jmp loc_1002A5C
; ---------------------------------------------------------------------------
loc_10029AC: ; CODE XREF: .text:010029A2j
push ebx
push esi ; dwFlags
push esi ; idThread
call [GetCurrentProcessId] ; GetCurrentProcessId()
push eax ; idProcess
push offset _WinEventFunc ; pfnWinEventProc
push esi ; hmodWinEventProc
mov eax, 800Bh
push eax ; eventMax
push eax ; eventMin
call [SetWinEventHook] ; SetWinEventHook(x,x,x,x,x,x,x)
mov edi, [GetMessageW] ; GetMessageW(x,x,x,x)
mov ebx, eax
jmp short loc_1002A32
; ---------------------------------------------------------------------------
loc_10029D3: ; CODE XREF: .text:01002A3Dj
cmp dword ptr [ebp-1Ch], 50h
jnz short loc_10029EC
push esi ; lParam
push esi ; wParam
push 8001h ; Msg
push [g_hwndNP] ; hWnd
call [PostMessageW] ; PostMessageW(x,x,x,x)
loc_10029EC: ; CODE XREF: .text:010029D7j
mov eax, [g_hDlgFind]
cmp eax, esi
jz short loc_1002A04
lea ecx, [ebp-20h]
push ecx ; lpMsg
push eax ; hDlg
call [IsDialogMessageW] ; IsDialogMessageW(x,x)
test eax, eax
jnz short loc_1002A32
loc_1002A04: ; CODE XREF: .text:010029F3j
lea eax, [ebp-20h]
push eax ; lpMsg
push [g_hAccel] ; hAccTable
push [g_hwndNP] ; hWnd
call [TranslateAcceleratorW] ; TranslateAcceleratorW(x,x,x)
test eax, eax
jnz short loc_1002A32
lea eax, [ebp-20h]
push eax ; lpMsg
call [TranslateMessage] ; TranslateMessage(x)
lea eax, [ebp-20h]
push eax ; lpMsg
call [DispatchMessageW] ; DispatchMessageW(x)
loc_1002A32: ; CODE XREF: .text:010029D1j
; .text:01002A02j ...
push esi ; wMsgFilterMax
push esi ; wMsgFilterMin
lea eax, [ebp-20h]
push esi ; hWnd
push eax ; lpMsg
call edi ; GetMessageW(x,x,x,x) ; GetMessageW(x,x,x,x)
test eax, eax
jnz short loc_10029D3
call _FreeGlobal ; FreeGlobal()
push [g_hEdit] ; hMem
call [LocalFree] ; LocalFree(x)
cmp ebx, esi
jz short loc_1002A5B
push ebx ; hWinEventHook
call [UnhookWinEvent] ; UnhookWinEvent(x)
loc_1002A5B: ; CODE XREF: .text:01002A52j
pop ebx
loc_1002A5C: ; CODE XREF: .text:010029A7j
cmp [ebp-4], esi
jz short loc_1002A67
push esi
push 1
call dword ptr [ebp-4]
loc_1002A67: ; CODE XREF: .text:01002A5Fj
mov eax, [ebp-18h]
pop edi
pop esi
leave
retn 10h
