[原]ComFriendlyWaitMtaThreadProc

c++代码（大体逻辑没问题，细节需要确认）

1. DWORD __stdcall *ComFriendlyWaitMtaThreadProc(LPVOID lpThreadParameter)
2. {
3. CoInitializeEx(0,0);
5. ThreadParam* pParam =(ThreadParam*)lpThreadParameter;
7. ComFriendlyWaiter* pData =newComFriendlyWaiter(pParam->p2, pParam->p1);
9. hr =CoMarshalInterThreadInterfaceInStream(GUID_6d5140c1_7436_11ce_8034_00aa006009fa, pData,&pStream);
11. pData->Release();
13. SetEvent(pParam->hEvent);
15. WaitForSingleObject(pParam->hXXX);
16. CoUninitialize();
17. }

 

 

 

汇编码

1. uiautomationcore!ComFriendlyWaitMtaThreadProc:
2. 7303f5f18bff mov edi,edi
3. 7303f5f355 push ebp
4. 7303f5f48bec mov ebp,esp
5. 7303f5f656 push esi
6. 7303f5f757 push edi
7. 7303f5f86a00 push 0
8. 7303f5fa6a00 push 0
9. 7303f5fc ff1504130373 call dword ptr [uiautomationcore!_imp__CoInitializeEx (73031304)]
10. 7303f6026a18 push 18h
11. 7303f604 e80c34ffff call uiautomationcore!operatornew(73032a15)
12. 7303f6098b7d08 mov edi,dword ptr [ebp+8]
13. 7303f60c59 pop ecx
14. 7303f60d85c0 test eax,eax
15. 7303f60f7452 je uiautomationcore!ComFriendlyWaitMtaThreadProc+0x2e(7303f663)Branch
17. uiautomationcore!ComFriendlyWaitMtaThreadProc+0x20:
18. 7303f611 ff7704 push dword ptr [edi+4]
19. 7303f6148bc8 mov ecx,eax
20. 7303f616 ff37 push dword ptr [edi]
21. 7303f618 e84f000000 call uiautomationcore!ComFriendlyWaiter::ComFriendlyWaiter(7303f66c)
23. uiautomationcore!ComFriendlyWaitMtaThreadProc+0x30:
24. 7303f61d8bf0 mov esi,eax
25. 7303f61f83c008 add eax,8
26. 7303f622 f7de neg esi
27. 7303f6241bf6 sbb esi,esi
28. 7303f62623f0 and esi,eax
29. 7303f6288d470c lea eax,[edi+0Ch]
30. 7303f62b50 push eax
31. 7303f62c56 push esi
32. 7303f62d68e4230373 push offset uiautomationcore!_GUID_6d5140c1_7436_11ce_8034_00aa006009fa (730323e4)
33. 7303f632 ff150c130373 call dword ptr [uiautomationcore!_imp__CoMarshalInterThreadInterfaceInStream (7303130c)]
34. 7303f638894708 mov dword ptr [edi+8],eax
35. 7303f63b8b06 mov eax,dword ptr [esi]
36. 7303f63d56 push esi
37. 7303f63e ff5008 call dword ptr [eax+8]
38. 7303f641 ff7710 push dword ptr [edi+10h]
39. 7303f644 ff152c120373 call dword ptr [uiautomationcore!_imp__SetEvent (7303122c)]
40. 7303f64a6aff push 0FFFFFFFFh
41. 7303f64c ff7714 push dword ptr [edi+14h]
42. 7303f64f ff1528120373 call dword ptr [uiautomationcore!_imp__WaitForSingleObject (73031228)]
43. 7303f655 ff1508130373 call dword ptr [uiautomationcore!_imp__CoUninitialize (73031308)]
44. 7303f65b5f pop edi
45. 7303f65c33c0 xor eax,eax
46. 7303f65e5e pop esi
47. 7303f65f5d pop ebp
48. 7303f660 c20400 ret 4
50. uiautomationcore!ComFriendlyWaitMtaThreadProc+0x2e:
51. 7303f66333c0 xor eax,eax
52. 7303f665 ebb6 jmp uiautomationcore!ComFriendlyWaitMtaThreadProc+0x30(7303f61d)Branch

 

 

来自为知笔记(Wiz)