0:000> p
eax=00a1e420 ebx=00a1e358 ecx=00a1da80 edx=00a1e3e8 esi=00a1d8b8 edi=003b3bc8
eip=00b54ecc esp=0012fad8 ebp=00a1e2e0 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
php_tidy!get_module+0x3ecc:
00b54ecc 51 push ecx
0:000> p
eax=00a1e420 ebx=00a1e358 ecx=00a1da80 edx=00a1e3e8 esi=00a1d8b8 edi=003b3bc8
eip=00b54ecd esp=0012fad4 ebp=00a1e2e0 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
php_tidy!get_module+0x3ecd:
00b54ecd 50 push eax
0:000> p
eax=00a1e420 ebx=00a1e358 ecx=00a1da80 edx=00a1e3e8 esi=00a1d8b8 edi=003b3bc8
eip=00b54ece esp=0012fad0 ebp=00a1e2e0 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
php_tidy!get_module+0x3ece:
00b54ece e85d5d0000 call php_tidy!get_module+0x9c30 (00b5ac30)
0:000> dd esp
0012fad0 00a1e420 00a1da80 00b52884 00a1e420
0:000> dc 00a1da80
00a1da80 41414141 41414141 41414141 41414141 AAAAAAAAAAAAAAAA
00a1da90 41414141 41414141 41414141 41414141 AAAAAAAAAAAAAAAA
00a1daa0 41414141 41414141 41414141 41414141 AAAAAAAAAAAAAAAA
这里会进入if语句，直接调用sub_1000AC30函数，参数也继续传递，跟入这个函数。
int __cdecl sub_1000AC30(int a1, int a2) { return sub_1000AC50(a1, (char *)a2, (int)aAscii); }
这个也很简单，继续跟入。
signed int __cdecl sub_1000AC50(int a1, char *a2, int a3) { v3 = a1; v20 = *(_DWORD *)(a1 + 1168); v4 = (const char *)sub_1000AB80((int)a2); v5 = (char *)v4; v21 = v4; v6 = a1 + 72; v7 = fopen(v4, Mode); v8 = v7; v19 = v7; v9 = sub_1000BBA0(a3); if ( !v8 || v9 < 0 ) { sub_10013E80(a1, (int)v5, 2); return -1; }
在内部函数中，会执行一处fopen操作，打开的对象是v4，v4又是直接从a2获取的，a2就是刚才直接传递的畸形字符串，很显然，打开畸形字符串肯定是失败的。
0:000> p
eax=00000001 ebx=00a1e420 ecx=00000000 edx=00b796a0 esi=00000000 edi=00a1da80
eip=00b5aca7 esp=0012da5c ebp=00a1e468 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
php_tidy!get_module+0x9ca7:
00b5aca7 85f6 test esi,esi
0:000> p
eax=00000001 ebx=00a1e420 ecx=00000000 edx=00b796a0 esi=00000000 edi=00a1da80
eip=00b5aca9 esp=0012da5c ebp=00a1e468 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
php_tidy!get_module+0x9ca9:
00b5aca9 0f8410020000 je php_tidy!get_module+0x9ebf (00b5aebf) [br=1]
0:000> p
eax=00000001 ebx=00a1e420 ecx=00000000 edx=00b796a0 esi=00000000 edi=00a1da80
eip=00b5aebf esp=0012da5c ebp=00a1e468 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
php_tidy!get_module+0x9ebf:
00b5aebf 6a02 push 2
也就是会进入上述伪代码中的if语句中的分支，调用sub_10013E80函数。