【求助】麻烦大家,哪位能帮忙分析,找出函数sqlite3.initSqlite和sqlite3.uninitSqlite两个函数的参数个数和参数类型,谢谢!以下是使用W32Dasm反汇编的函数对应的代码
Exported fn(): initSqlite - Ord:0001h
:10001000 56 push esi
:10001001 6868890810 push 10088968
* Reference To: KERNEL32.LoadLibraryA, Ord:02F1h
|
:10001006 FF1508700810 Call dword ptr [10087008]
:1000100C 8BF0 mov esi, eax
:1000100E 85F6 test esi, esi
:10001010 7453 je 10001065
:10001012 57 push edi
* Reference To: KERNEL32.GetProcAddress, Ord:0220h
|
:10001013 8B3D04700810 mov edi, dword ptr [10087004]
:10001019 6874890810 push 10088974
:1000101E 56 push esi
:1000101F FFD7 call edi
:10001021 6880890810 push 10088980
:10001026 56 push esi
:10001027 A3208A0A10 mov dword ptr [100A8A20], eax
:1000102C FFD7 call edi
:1000102E 688C890810 push 1008898C
:10001033 56 push esi
:10001034 A3248A0A10 mov dword ptr [100A8A24], eax
:10001039 FFD7 call edi
:1000103B 6898890810 push 10088998
:10001040 56 push esi
:10001041 A3288A0A10 mov dword ptr [100A8A28], eax
:10001046 FFD7 call edi
:10001048 A32C8A0A10 mov dword ptr [100A8A2C], eax
:1000104D 8B44240C mov eax, dword ptr [esp+0C]
:10001051 50 push eax
:10001052 FF15208A0A10 call dword ptr [100A8A20]
:10001058 C705308A0A1001000000 mov dword ptr [100A8A30], 00000001
:10001062 8BC6 mov eax, esi
:10001064 5F pop edi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001010(C)
|
:10001065 5E pop esi
:10001066 C20400 ret 0004
:10001069 CC int 03
:1000106A CC int 03
:1000106B CC int 03
:1000106C CC int 03
:1000106D CC int 03
:1000106E CC int 03
:1000106F CC int 03
Exported fn(): uninitSqlite - Ord:00D7h
:10001070 8B442404 mov eax, dword ptr [esp+04]
:10001074 C705308A0A1000000000 mov dword ptr [100A8A30], 00000000
:1000107E 85C0 test eax, eax
:10001080 7407 je 10001089
:10001082 50 push eax
* Reference To: KERNEL32.FreeLibrary, Ord:014Ch
|
:10001083 FF1500700810 Call dword ptr [10087000]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001080(C)
|
:10001089 33C0 xor eax, eax
:1000108B C20400 ret 0004
:1000108E CC int 03
:1000108F CC int 03
* Referenced by a CALL at Address:
|:1003F996
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
