function type +winapi+ function name (for example, inline DWORD static WINAPI Recordtokeys (const drwt& thedrwt,wtsbh* pkey,dword dwmaxnum)

The WINAPI identifier is defined in WINDEF.H, with the following statement:

#define WINAPI __stdcall

Let's talk about this __stdcall.

StdCall calling convention
StdCall is often called the Pascal calling convention, because Pascal is a very common teaching computer programming language, its syntax is rigorous, and the function calling convention used is stdcall. In the Microsoft C + + series, the C + + compiler often uses Pascal macros to declare this calling convention, and similar macros have WINAPI and callback.

The syntax for the stdcall calling convention declaration is (for example, that function in the previous article):

int __ stdcall function (int a,int b)

The calling convention of the stdcall means: 1) The parameters are pressed from right to left into the stack, 2) The function itself modifies the stack 3) the functions are automatically preceded by a leading underscore, followed by an @ symbol followed by the size of the parameter

Taking this function as an example, the parameter B is first compressed, then the parameter a, the function call functions (at the end of the call) is translated into assembly language will be:

Push 2 The second parameter into the stack push 1 the first parameter into the stack call function invocation parameter, note that at this time automatically put Cs:eip into the stack
For the function itself, it can be translated as: Push EBP holds the EBP register, the register will be used to save the stack top pointer, can be restored on the function exit MOV ebp,esp save stack pointer mov eax,[ebp + 8H] Stack in the stacks before EBP points to the location of the EBP, CS:EIP,A,B,EBP +8 points to a add EAX,[EBP + 0CH] Stack in EBP + 12 saved B mov esp,ebp recovery esp POP EBP RET 8

And at compile time, the name of this function is translated into [email protected]

Note that different compilers insert their own assembly code to provide the commonality of compilation, but the general code does so. Where the function is kept at the beginning of the ESP into EBP, at the end of the function recovery is a common method of the compiler.

From a function call, 2 and 1 are then push into the stack in turn, and in the function, the parameters are accessed by an offset relative to the EBP (that is, the stack pointer when the function is just entered). After the function ends, ret 8 cleans up the 8-byte stack, and the function recovers the stack itself.

Common calling conventions include the following:
Cdecl
Fastcall
ThisCall
Naked Call

Where the cdecl calling convention is the same as stdcall, but the function itself does not clean up the stack, and the caller is responsible for cleaning up the stack. Because of this change, the C calling convention allows the number of parameters of the function is not fixed, which is a major feature of C language.

Function type +winapi+ function name (for example, inline DWORD static WINAPI Recordtokeys (const drwt& thedrwt,wtsbh* pkey,dword dwmaxnum)