静态判断pe文件位数
.text:FFFFF802560B274B mov ecx, 8664h //64位一般是这个,32位一般是0x14C
.text:FFFFF802560B2750 cmp cx, [rax+_IMAGE_NT_HEADERS64.FileHeader.Machine]
.text:FFFFF802560B2754 jz short loc_FFFFF802560B2767
.text:FFFFF802560B2756 mov ecx, 200h
.text:FFFFF802560B275B cmp cx, [rax+_IMAGE_NT_HEADERS64.FileHeader.Machine]
.text:FFFFF802560B275F jz short loc_FFFFF802560B2767
.text:FFFFF802560B2761 add rax, 78h ; 'x'
.text:FFFFF802560B2765 jmp short loc_FFFFF802560B276D
.text:FFFFF802560B2767 ; ---------------------------------------------------------------------------
.text:FFFFF802560B2767
.text:FFFFF802560B2767 loc_FFFFF802560B2767: ; CODE XREF: sub_FFFFF802560B270C+48↑j
.text:FFFFF802560B2767 ; sub_FFFFF802560B270C+53↑j
.text:FFFFF802560B2767 add rax, 88h