【求助】请问此段汇编代码如何解读?
某程序在显示文字的界面限制了鼠标功能,只能用键盘的UP和DOWN键显示,可以用CTRL+C键复制界面的文字,而且随着界面的大小改变,复制出的文字字数也可以改变。按CTRL+C,用ollyice跟进,运行的代码如下,发现不论界面及显示字数怎么改变,运行代码的提示内容都不会变,可粘贴出的文字却在变,请各位高手帮帮我,以下的代码怎么解读呀!00417FAC E8 ABE90C00 call <jmp.&USER32.SetClipboardData>
'提示:004e695c=<jmp.&user32.setclipboarddata>
00417FB1 |. 8B45 D0 mov eax, dword ptr [ebp-30]
'提示:ss:[0022fba8]=0b157d44 eax=00f5006c
00417FB4 |. FF80 90060000 inc dword ptr [eax+690]
'提示:ds:[0b1583d4]=0000000a /0000000b
00417FBA |> FF4D F0 dec dword ptr [ebp-10]
'提示:堆栈 ss:[0022fbc8]=00000001 跳转来自 httextview::copytoclipboard+19f
00417FBD |. 8D45 F8 lea eax, dword ptr [ebp-8]
'提示:堆栈地址=0022fbd0 eax=0b157d44
00417FC0 |. BA 02000000 mov edx, 2
'提示:edx=77d703c0(user32.77d703c0)
00417FC5 |. E8 DADC0C00 call 004E5CA4
'提示:004e5ca4=004e5ca4
00417FCA |. 66:C745 E4 2C>mov word ptr [ebp-1C], 2C
'提示:堆栈 ss:[0022fbbc]=0044
00417FD0 |. 66:C745 E4 20>mov word ptr [ebp-1C], 20
'提示:堆栈 ss:[0022fbbc]=002c
00417FD6 |. FF75 C8 push dword ptr [ebp-38] ; /hMem
'提示:堆栈 ss:[0022fba0]=00f5006c
00417FD9 |. E8 3CE20C00 call <jmp.&KERNEL32.GlobalUnlock> ; \GlobalUnlock
'提示:004e621a=<jmp.&kernel32.globalunlock>
00417FDE |. 66:837D E6 00 cmp word ptr [ebp-1A], 0
'提示:ss:[0022fbbe]=000
00417FE3 |. 74 01 je short 00417FE6
'提示:跳转已实现 00417fe6=00417fe6
00417FE5 |. C3 retn
'提示:此代码未执行,被跳过了
00417FE6 |> 66:C745 E4 00>mov word ptr [ebp-1C], 0
'提示:堆栈 ss:[0022fbbc]=0020 跳转来自00417fe3
00417FEC |. E8 3B240800 call 0049A42C
'提示:0049a42c=0049a42c
00417FF1 |. 8945 B0 mov dword ptr [ebp-50], eax
'提示:eax=0b15a8fc 堆栈 ss:[0022fb88]=002e0001
00417FF4 |. 8B45 B0 mov eax, dword ptr [ebp-50]
'提示:堆栈 ss:[0022fb88]=0b15a8fc eax=0b15a8fc
00417FF7 |. 8B10 mov edx, dword ptr [eax]
'提示:ds:[0b15a8fc]=00499ee8(程序进程的英文缩写.00499ee8) edx:00240608
00417FF9 |. FF52 14 call dword ptr [edx+14]
'提示:ds:[00499efc]=00499f94(程序进程的英文缩写.00499f94)
......................................................
F7跟进上述的call后,运行以下代码
00499F94 . 53 push ebx
'提示:ebx=0b157d01
00499F95 . 8BD8 mov ebx, eax
'提示:eax=0b15a8fc ebx=0b157d01
00499F97 . 837B 04 00 cmp dword ptr [ebx+4], 0
'提示:ds:[0b15a900]=00000001
00499F9B . 74 21 je short 00499FBE
'提示:跳转未实现 00499fbe=00499fbe
00499F9D . FF4B 04 dec dword ptr [ebx+4]
'提示:ds:[0b15a900]=00000001
00499FA0 . 837B 04 00 cmp dword ptr [ebx+4], 0
'提示:ds:[0b15a900]=00000000
00499FA4 . 75 18 jnz short 00499FBE
'提示:跳转未实现 00499fbe=00499fbe
00499FA6 . E8 B7C60400 call <jmp.&USER32.CloseClipboard> ; [CloseClipboard
'提示:004e6662=<jmp.&user32.closeclipboard>
.......................................................................................
F7跟进上述的call后,运行以下代码
004E6662 $- FF25 68CB4F00 jmp dword ptr [<&USER32.CloseClipboa>; USER32.CloseClipboard
'提示:ds:[004fcb68]=77d1eee5(user32.closeclipboard) 本地调用来自004779a0,00499fa6
77D1EEE5 > B8 4B110000 mov eax, 114B
'提示:eax=0b15a8fc
77D1EEEA BA 0003FE7F mov edx, 7FFE0300
'提示:edx=00499ee8(程序进程的英文缩写.00499ee8)
77D1EEEF FF12 call dword ptr [edx]
'提示:ds:[7ffe0300]=7c92e510(ntdll.kifastsystemcall
77D1EEF1 C3 retn
'提示:返回到00499fab(程序进程的英文缩写.00499fab)
00499FAB . 807B 0C 00 cmp byte ptr [ebx+C], 0
'提示:ds:[0b15a908]=00
程序运行到此处后,就可粘贴出文字了。