.  字节
;  短整型
#  长整型
$  字符串
*  变量
~  已加密的变量
@  移动指针
复制代码

CAPI Put [~][变量名] [标识][数据] [标识][数据]...
复制代码

rem 将var变量的第一个字节覆盖为65
CAPI Put var .65
rem 将var变量的前两个字节覆盖为25105
CAPI Put var ;25105
rem 将var变量的前四个字节覆盖为4325441
CAPI Put var #4325441
rem 将var变量的值覆盖为ab
CAPI Put var $ab
rem 将var变量的值覆盖为var2变量的值
CAPI Put var *var2
rem 将var变量的值覆盖为被加密变量var2的原值
CAPI Put var ~var2
rem 可以同时执行多个参数，如将var变量的前两个字节覆盖为25105，再将第3个字节覆盖为65
CAPI Put var ;25105 .65
rem 将var变量的第一个字节覆盖为65，指针后移1位，将第3个字节覆盖为66
CAPI Put var .65 @1 .66
复制代码

CAPI Get [~][变量名] [标识][长度] [标识][长度]...
复制代码

rem 将var变量中的前两个字节输出
CAPI Get var .2
复制代码

CAPI Call [Dll名] [API名] [标识][数据] [标识][数据]...
复制代码

@echo off
CAPI Call kernel32 GetConsoleWindow
echo %errorlevel%
pause
复制代码

@echo off
CAPI Call kernel32 GetConsoleWindow
set hCMD=%errorlevel%
CAPI Call user32 FlashWindow #%hCMD% #1
pause
复制代码

@echo off
set str=Defanive
CAPI Call kernel32 lstrlenW $%str%
echo %errorlevel%
pause
复制代码

@echo off
set str=Defanive
CAPI Call kernel32 lstrlenW *str
echo %errorlevel%
pause
复制代码

@echo off
set pos=xxxxyyyy
CAPI Call user32 GetCursorPos ~pos
CAPI Get ~pos #2
pause
复制代码

@echo off
setlocal enabledelayedexpansion
set Pos=00000000
echo 3秒后获得鼠标所指的窗口标题
CAPI Call kernel32 Sleep #3000
CAPI Call user32 GetCursorPos ~Pos
for /f "tokens=1,2" %%a in ('CAPI Get "~Pos" "#2"') do set /a "X=%%a","Y=%%b"
CAPI Call user32 WindowFromPoint #%X% #%Y%
set hWnd=%errorlevel%
echo 窗口句柄：%hWnd%
CAPI Call user32 SendMessageW #%hWnd% #14 #0 #0
set Length=%errorlevel%
echo 标题长度：%Length%
if "%Length%"=="0" echo 该窗口没有标题&pause&goto :eof
for /l %%a in (1,1,%Length%) do set "Title=!Title! "
set /a Length+=1
CAPI Call user32 SendMessageW #%hWnd% #13 #%Length% *Title
echo 窗口标题：!Title!
pause
复制代码