0040484D . FF91 F8060000 call dword ptr [ecx+6F8] 一个算法call
算法部分:
004048C4 . FF15 08114000 call dword ptr [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
004048CA . 8B16 mov edx, dword ptr [esi]
004048CC . 56 push esi
004048CD . DD9D 44FFFFFF fstp qword ptr [ebp-BC]
004048D3 . FF92 00030000 call dword ptr [edx+300]
004048D9 . 50 push eax
004048DA . 8D45 D4 lea eax, dword ptr [ebp-2C]
004048DD . 50 push eax
004048DE . FF15 4C104000 call dword ptr [<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
004048E4 . 8BF0 mov esi, eax
004048E6 . 8D55 E0 lea edx, dword ptr [ebp-20]
004048E9 . 52 push edx
004048EA . 56 push esi
004048EB . 8B0E mov ecx, dword ptr [esi]
004048ED . FF91 A0000000 call dword ptr [ecx+A0]
004048F3 . 85C0 test eax, eax
004048F5 . DBE2 fclex
004048F7 . 7D 0E jge short 00404907
004048F9 . 68 A0000000 push 0A0
004048FE . 68 6C214000 push 0040216C
00404903 . 56 push esi
00404904 . 50 push eax
00404905 . FFD7 call edi
00404907 > 8B45 E0 mov eax, dword ptr [ebp-20]
0040490A . 68 00000040 push 40000000
0040490F . 6A 00 push 0
00404911 . 50 push eax
00404912 . FF15 08114000 call dword ptr [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
00404918 . DCA5 44FFFFFF fsub qword ptr [ebp-BC] ★serial和machine code 做减法
0040491E . 83EC 08 sub esp, 8
00404921 . DFE0 fstsw ax
00404923 . A8 0D test al, 0D
00404925 . 0F85 5C010000 jnz 00404A87
0040492B . DD1C24 fstp qword ptr [esp]
0040492E . FF15 C8104000 call dword ptr [<&MSVBVM60.__vbaPower>; MSVBVM60.__vbaPowerR8
00404934 . DC65 E4 fsub qword ptr [ebp-1C] ★减去第一个算法call的结果,结果要等于0
00404937 . DFE0 fstsw ax
00404939 . A8 0D test al, 0D
0040493B . 0F85 46010000 jnz 00404A87
00404941 . FF15 60104000 call dword ptr [<&MSVBVM60.__vbaFpR8>>; MSVBVM60.__vbaFpR8
00404947 . DC1D 40114000 fcomp qword ptr [401140]
0040494D . DFE0 fstsw ax
0040494F . F6C4 40 test ah, 40
00404952 . 74 07 je short 0040495B ★关键跳
00404954 . B8 01000000 mov eax, 1
00404959 . EB 02 jmp short 0040495D
大概看了下,不知道对不对,第一个算法call的内容实在是。。。