反编译一个小软件,这是注册算法的后面部分,前面看懂了。但是这里有点看不懂。特别是几个函数,搞不清哪个是参数,哪个是反回值,请高手指教
<&MSVBVM60.__vbaVarAnd>
<&MSVBVM60.__vbaBoolVarNull>
<&MSVBVM60.__vbaVarCmpNe>
<&MSVBVM60.__vbaLenVar>
以上函数用OD调试时总是搞不明白参数和返回值。
部分代码如下:
007B70FF . FF15 7C104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultChec>; MSVBVM60.__vbaHresultCheckObj
007B7105 > 8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
007B710B . FF15 60124000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
007B7111 . 8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-B8]
007B7117 . FF15 5C124000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
007B711D . 8B35 80104000 mov esi,dword ptr ds:[<&MSVBVM60.__vbaLenVar>] ; MSVBVM60.__vbaLenVar
007B7123 . B8 02800000 mov eax,8002
007B7128 . 8985 E8FEFFFF mov dword ptr ss:[ebp-118],eax
007B712E . 8985 D8FEFFFF mov dword ptr ss:[ebp-128],eax
007B7134 . 8D55 AC lea edx,dword ptr ss:[ebp-54]
007B7137 . 8D85 38FFFFFF lea eax,dword ptr ss:[ebp-C8]
007B713D . 52 push edx
007B713E . 50 push eax
007B713F . C785 F0FEFFFF 170>mov dword ptr ss:[ebp-110],17
007B7149 . C785 E0FEFFFF 1D0>mov dword ptr ss:[ebp-120],1D
007B7153 . FFD6 call esi ; <&MSVBVM60.__vbaLenVar>
007B7155 . 8B3D 6C104000 mov edi,dword ptr ds:[<&MSVBVM60.__vbaVarCmpNe>; MSVBVM60.__vbaVarCmpNe
007B715B . 8D8D E8FEFFFF lea ecx,dword ptr ss:[ebp-118]
007B7161 . 50 push eax
007B7162 . 8D95 28FFFFFF lea edx,dword ptr ss:[ebp-D8]
007B7168 . 51 push ecx
007B7169 . 52 push edx
007B716A . FFD7 call edi ; <&MSVBVM60.__vbaVarCmpNe>
007B716C . 50 push eax
007B716D . 8D45 AC lea eax,dword ptr ss:[ebp-54]
007B7170 . 8D8D 18FFFFFF lea ecx,dword ptr ss:[ebp-E8]
007B7176 . 50 push eax
007B7177 . 51 push ecx
007B7178 . FFD6 call esi
007B717A . 50 push eax
007B717B . 8D95 D8FEFFFF lea edx,dword ptr ss:[ebp-128]
007B7181 . 8D85 08FFFFFF lea eax,dword ptr ss:[ebp-F8]
007B7187 . 52 push edx
007B7188 . 50 push eax
007B7189 . FFD7 call edi
007B718B . 8D8D F8FEFFFF lea ecx,dword ptr ss:[ebp-108]
007B7191 . 50 push eax
007B7192 . 51 push ecx
007B7193 . FF15 34114000 call dword ptr ds:[<&MSVBVM60.__vbaVarAnd>] ; MSVBVM60.__vbaVarAnd
007B7199 . 50 push eax
007B719A . FF15 C8104000 call dword ptr ds:[<&MSVBVM60.__vbaBoolVarNull>; MSVBVM60.__vbaBoolVarNull
007B71A0 . 66:85C0 test ax,ax
007B71A3 . 0F84 A4000000 je 计算机.007B724D
我是菜鸟,请高手指点下,最好能把这个代码写点注脚什么的,方便学习。
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课