Hello, I've just started working with strings and I have build a sample log file and I have loaded and parsed it the best I can.  The code below works, but I'm wondering if there's anyway that I can improve it?
My log file looks like this:

TheUser,00,thePass,01,TheUser2,00,ThePass2,01

I'm setting AL to 01 so scan the string for the end of the next password, checking, also, ecx if the end of file is reached.  Each User is allowed only one entry (one password) so if it's dected we will set eax and return.  (Update user will be implemented next)

Local SavedECX:DWord
Invoke ReadFile, hFile, pMemory, FileSize, Addr SizeRead, NULL
Mov Ecx, FileSize ;Set the counter
Mov Esi, pMemory ;set the source
Mov Edi, Esi ;set the destination for first lstrcmpi
FindLoop:
Mov , Ecx ;save ECX
Invoke lstrcmpi, Edi, TheUser
Mov Ecx,
.If Eax == 0 ;the are equal!
Inc Eax
Jmp EndLoop
.EndIf
Xor Eax, Eax
Inc Al ; Mov Al, 01 ;terminating byte after password
Cld ;Clear direction
Repne Scasb ;scan string for the terminating byte
Test Ecx, Ecx ;end of file?
Jnz FindLoop
Xor Eax, Eax
EndLoop:
Ret
Posted on 2009-04-07 16:22:11 by GoldStar611
Not sure what you are looking for but you can:

Change

Mov , Ecx ;save ECX
      Invoke lstrcmpi, Edi, TheUser
      Mov Ecx,
      .If Eax == 0 ;the are equal!
        Inc Eax
        Jmp EndLoop
      .EndIf


to

    push ecx
    Invoke lstrcmpi, Edi, TheUser
    pop ecx
    cmp eax,0
    jne NextLoop
    inc eax
    jmp EndLoop
NextLoop:
Posted on 2009-04-08 19:35:03 by green
Thanks :) I actually had the push/pop ecx before I used a local variable.  I switched to a variable because it's a little easier to follow what's going on in the code  I'll take a look at how the .if eax ==0 bracket gets compiled, but may not change it to make it easier to read.  I was looking for improve upon my scasb part maybe using scasw or scasd but then I'd have to check the length of the string see if it is multiple of 4 or 2, etc.  I'll probably leave it as scasb though.
Posted on 2009-04-08 20:32:57 by GoldStar611
After reading a few sources I found that the zero flag is already set if ecx is zero so the
Test Ecx, Ecx ;end of file?
line is not needed
Posted on 2009-04-08 21:12:00 by GoldStar611