----------------------------
009F3A8A E8 1E78F2FF call E4A.0091B2AD
009F3A8F 8945 F8 mov dword ptr ss:[ebp-0x8],eax ; eax 置1
009F3A92 8B5D FC mov ebx,dword ptr ss:[ebp-0x4]
009F3A95 85DB test ebx,ebx
009F3A97 74 09 je short E4A.009F3AA2
009F3A99 53 push ebx
009F3A9A E8 B2DE0200 call E4A.00A21951
009F3A9F 83C4 04 add esp,0x4
009F3AA2 837D F8 00 cmp dword ptr ss:[ebp-0x8],0x0
009F3AA6 0F84 B9020000 je E4A.009F3D65
/---------------------
0091B3CF /EB 13 jmp short E4A.0091B3E4 关键一跳
堆栈 [0018EF24]=00000000 需要 1
eax=00000001
0091B69A BC 20EF1800 mov esp,0x18EF20
0091B69F 6A 01 push 0x1
0091B6A1 90 nop
0091B6A2 90 nop
0091B6A3 90 nop ; 最后校验
0091B6A4 90 nop
0091B6A5 90 nop
0091B6A6 90 nop
0091B6A7 90 nop
0091B6A8 90 nop
0091B6A9 90 nop
0091B6AA 90 nop
0091B6AB 58 pop eax
//----------------------------------------------
这样就可以了