diff --git a/WeChatFerry/spy/rpc_server.cpp b/WeChatFerry/spy/rpc_server.cpp
index c074f37..56f2bd2 100644
--- a/WeChatFerry/spy/rpc_server.cpp
+++ b/WeChatFerry/spy/rpc_server.cpp
@@ -406,7 +406,6 @@ bool func_send_pat_msg(char *roomid, char *wxid, uint8_t *out, size_t *len)
     return true;
 }
 
-#if 0
 bool func_forward_msg(uint64_t id, char *receiver, uint8_t *out, size_t *len)
 {
     Response rsp  = Response_init_default;
@@ -429,7 +428,7 @@ bool func_forward_msg(uint64_t id, char *receiver, uint8_t *out, size_t *len)
 
     return true;
 }
-#endif
+
 static void PushMessage()
 {
     static uint8_t buffer[G_BUF_SIZE] = { 0 };
@@ -909,11 +908,11 @@ static bool dispatcher(uint8_t *in, size_t in_len, uint8_t *out, size_t *out_len
             ret = func_send_pat_msg(req.msg.pm.roomid, req.msg.pm.wxid, out, out_len);
             break;
         }
-#if 0
         case Functions_FUNC_FORWARD_MSG: {
             ret = func_forward_msg(req.msg.fm.id, req.msg.fm.receiver, out, out_len);
             break;
         }
+#if 0
         case Functions_FUNC_SEND_XML: {
             ret = func_send_xml(req.msg.xml, out, out_len);
             break;
diff --git a/WeChatFerry/spy/send_msg.cpp b/WeChatFerry/spy/send_msg.cpp
index c8cdec0..33ae4fc 100644
--- a/WeChatFerry/spy/send_msg.cpp
+++ b/WeChatFerry/spy/send_msg.cpp
@@ -24,6 +24,7 @@ typedef QWORD (*funcSendFileMsg_t)(QWORD, QWORD, QWORD, QWORD, QWORD, QWORD *, Q
                                    QWORD);
 typedef QWORD (*funcSendRichTextMsg_t)(QWORD, QWORD, QWORD);
 typedef QWORD (*funcSendPatMsg_t)(QWORD, QWORD);
+typedef QWORD (*funcForwardMsg_t)(QWORD, QWORD, QWORD, QWORD);
 
 void SendTextMessage(string wxid, string msg, string atWxids)
 {
@@ -195,6 +196,30 @@ int SendPatMessage(string roomid, string wxid)
     return (int)status;
 }
 
+int ForwardMessage(QWORD msgid, string receiver)
+{
+    int status     = -1;
+    uint32_t dbIdx = 0;
+    QWORD localId  = 0;
+
+    funcForwardMsg_t funcForwardMsg = (funcForwardMsg_t)(g_WeChatWinDllAddr + g_WxCalls.fm.call1);
+    if (GetLocalIdandDbidx(msgid, &localId, &dbIdx) != 0) {
+        LOG_ERROR("Failed to get localId, Please check id: {}", to_string(msgid));
+        return status;
+    }
+
+    wstring wsReceiver  = String2Wstring(receiver);
+    WxString *pReceiver = NewWxString(wsReceiver);
+
+    LARGE_INTEGER l;
+    l.HighPart = dbIdx;
+    l.LowPart  = (DWORD)localId;
+
+    status = (int)funcForwardMsg((QWORD)pReceiver, l.QuadPart, 0x4, 0x0);
+
+    return status;
+}
+
 #if 0
 void SendXmlMessage(string receiver, string xml, string path, int type)
 {
@@ -319,45 +344,4 @@ void SendEmotionMessage(string wxid, string path)
         popad;
     }
 }
-
-int ForwardMessage(QWORD msgid, string receiver)
-{
-    int status       = -1;
-    uint32_t dbIdx   = 0;
-    QWORD localId = 0;
-
-    if (GetLocalIdandDbidx(msgid, &localId, &dbIdx) != 0) {
-        LOG_ERROR("Failed to get localId, Please check id: {}", to_string(msgid));
-        return status;
-    }
-
-    wstring wsReceiver = String2Wstring(receiver);
-    WxString wxReceiver(wsReceiver);
-
-    DWORD fmCall1 = g_WeChatWinDllAddr + g_WxCalls.fm.call1;
-    DWORD fmCall2 = g_WeChatWinDllAddr + g_WxCalls.fm.call2;
-
-    __asm {
-        pushad;
-        pushfd;
-        mov        edx, dword ptr [dbIdx];
-        push       edx;
-        mov        eax, dword ptr [localId];
-        push       eax;
-        sub        esp, 0x14;
-        mov        ecx, esp;
-        lea        esi, wxReceiver;
-        push       esi;
-        call       fmCall1;
-        xor        ecx, ecx;
-        call       fmCall2;
-        movzx      eax, al;
-        mov        status, eax;
-        add        esp, 0x1c;
-        popfd;
-        popad;
-    }
-
-    return status;
-}
 #endif