WooYun.org

0:000> g
Breakpoint 2 hit
eax=03190748 ebx=00000002 ecx=00120000 edx=03190562 esi=00000060 edi=00a64670
eip=0047108b esp=001289d4 ebp=03190560 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
360zip+0x7108b:
0047108b 2bc2            sub     eax,edx

inline BOOL IsWordValid(WORD wd)
{return !(wd < 0x30 || wd > 0x39);}
inline ULONG Min(ULONG a, ULONG b)
{return a>b?b:a;}
ULONG ListItemValueProc(WCHAR* strFileName, WCHAR* strFullPath)
{
	if ( strFileName && strFullPath )    // strFileName 目录名字， strFullPath 上层目录名和当前层的文件名字组合在一起的内容
    {   
		ULONG nLenFileName = wcslen(strFileName);
		ULONG nLenFullPath = wcslen(strFullPath); 
		
		if(nLenFileName > 0)
		{
			ULONG nPos1  = 0;
			ULONG nPos2  = 0;
			
			ULONG nPosTemp = 0;
			
			WCHAR wTemp  = 0;
			
			while(1)
			{
				if(nPos2 > nLenFileName) goto some mark //break;
				if(!IsWordValid(pszStrFileName[pos]) || 
				   !IsWordValid(pszStrFullPath[pos2])) 
				   break;
								
				nPosTemp = nPos1;
				pos2++;
				
				if(nPos1 + 1 < nLenFullPath)
				{
					while(nPosTemp++ < nLenFullPath && IsWordValid(pszStrFileName[nPosTemp]));
				}
				
				//where's if
				while(nPos2++ < nLenFullPath && IsWordValid(pszStrFullPath[nPos2]));
				
				ULONG nCounter1 = 0;
				ULONG nCounter2 = 0;
				//WCHAR* szString1 = 0;
				WCHAR szSomeBuffer[MAX_PATH] = {0};
				swscanf(pszStrFileName[nPos1], L"%d%s", &nCounter1, szSomeBuffer); //szString1);
				swscanf(pszStrFullPath[nPos1], L"%d%s", &nCounter2, szSomeBuffer); //szString1); //szString1应该就是buffer。
				if ( nCounter1 > nCounter2 ) return 1;
				if ( nCounter1 < nCounter2 ) return -1; 
				 
				nPos1 = nPosTemp;
				
SOMELABELUNKNOWN:
				if ( nPos >= nLenFullPath) goto endOfScanning;
				
			} // end of while(1)
			
			ULONG nPosA = nPos1 + 1;
			ULONG nPosB = nPos2 + 1;
			if ( pos + 1 < nLenFileName )
			{
				while(nPosA++ < nLenFullPath && IsWordValid(pszStrFileName[nPosA])); //找到最后一个有效字符
			}
			//同上，一样的操作
			while(nPosB++ < nLenFullPath && IsWordValid(pszStrFullPath[nPosB]));
			
			
			ULONG nDiff = nPosA - nPos1;
			ULONG nDiff2= nPosB - nPos2;
			ULONG nDiff3= nLenFileName - nPos1;
			ULONG nDiff4= nLenFullPath - nPos2; 
			
			if(nDiff < nDiff2)
			{
				nDiff4 = Min(nDiff2, nDiff3);
			}
			else
			{
				if(nDiff4 > nDiff)
					nDiff4 = nDiff;
			}
			
			WCHAR szSomeBufferA[MAX_PATH] = {0};
			WCHAR szSomeBufferB[MAX_PATH] = {0};
			wcsncpy(szSomeBufferA, pszStrFileName[nPos1], nDiff4); //!!!WARNING!!!
			wcsncpy(szSomeBufferB, pszStrFullPath[nPos2], nDiff4); //!!!WARNING!!!
			
			ULONG nCompareResult = CompareStringW(LOCALE_USER_DEFAULT, NORM_IGNORECASE, szSomeBufferA, -1, szSomeBufferB, -1); 
			//-1: 字符串是Null Terminated
			
			if ( nCompareResult )
			{
				if ( nCompareResult == 2 )
				{
		LABEL_42:
				  pos += nDiff4;
				  pos2 += nDiff4;
				  goto SOMELABELUNKNOWN;
				}
				if(nCompareResult == 1) 
					result = -1;
				else
					result = 1;
				//2 * (nCompareResult != 1) - 1;
			}
			else
			{
				result = _wcsicmp(szSomeBufferA, szSomeBufferB);
			} 
			
			if(result) 
				return result;
			else
				goto LABEL_42;
					
		}
endOfScanning:
	result = 0;
    if ( nLenFileName != nLenFullPath )
    {
      if(nLenFileName > nLenFullPath)
	    result = 1;
	  else
		result = -1;
    }
	
	
  }
  else //if ( strFileName && strFullPath ) 的else部分
  {
	result = 0;
  }
  return result;
}