能力值:
( LV9,RANK:410 )
2 楼
00505D8D . 8D85 6CFFFF>lea eax ,dword ptr ss :[ebp -94]
00505D93 . 8D8D 6CFFFF>lea ecx ,dword ptr ss :[ebp -94]
00505D99 . 50 push eax
00505D9A . 8D95 7CFFFF>lea edx ,dword ptr ss :[ebp -84]
00505DA0 . 51 push ecx
00505DA1 . 8D45 8C lea eax ,dword ptr ss :[ebp -74]
00505DA4 . 52 push edx
00505DA5 . 8D4D 9C lea ecx ,dword ptr ss :[ebp -64]
00505DA8 . 50 push eax
00505DA9 . 51 push ecx
00505DAA . 6A 05 push 5
00505DAC . FFD7 call edi
00505DAE . B8 01000000 mov eax ,1
00505DB3 . 83C4 18 add esp ,18
00505DB6 . 66:03C3 add ax ,bx ; 增加变量
00505DB9 . 0F80 960700>jo GtChrdHl.00506555
00505DBF . 8BD8 mov ebx ,eax
00505DC1 .^ E9 1EFFFFFF jmp GtChrdHl.00505CE4
00505DC6 > 8B55 08 mov edx ,dword ptr ss :[ebp +8]
00505DC9 . 8B02 mov eax ,dword ptr ds :[edx ] ; 机器码"w2CsM2O2Q2"
00505DCB . 50 push eax
00505DCC . FF15 241040>call dword ptr ds :[<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00505DD2 . 8BC8 mov ecx ,eax
00505DD4 . FF15 341140>call dword ptr ds :[<&MSVBVM60.__vbaI2I4>] ; MSVBVM60.__vbaI2I4
00505DDA > 8BD8 mov ebx ,eax
00505DDC . B8 01000000 mov eax ,1
00505DE1 . 66:3BD8 cmp bx ,ax
00505DE4 . 0F8C B30000>jl GtChrdHl.00505E9D
00505DEA . 8B4D 08 mov ecx ,dword ptr ss :[ebp +8]
00505DED . 8945 A4 mov dword ptr ss :[ebp -5C],eax
00505DF0 . 0FBFC3 movsx eax ,bx
00505DF3 . 8D55 9C lea edx ,dword ptr ss :[ebp -64]
00505DF6 . 898D 44FFFF>mov dword ptr ss :[ebp -BC],ecx
00505DFC . 52 push edx
00505DFD . 8D8D 3CFFFF>lea ecx ,dword ptr ss :[ebp -C4]
00505E03 . 50 push eax
00505E04 . 8D55 8C lea edx ,dword ptr ss :[ebp -74]
00505E07 . 51 push ecx
00505E08 . 52 push edx
00505E09 . C745 9C 020>mov dword ptr ss :[ebp -64],2
00505E10 . C785 3CFFFF>mov dword ptr ss :[ebp -C4],4008 ; 逆序取一次
00505E1A . FF15 0C1140>call dword ptr ds :[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
00505E20 . 8B45 D8 mov eax ,dword ptr ss :[ebp -28] ; mid("机器码",len-i,1)
00505E23 . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
00505E26 . 50 push eax
00505E27 . 8D55 C4 lea edx ,dword ptr ss :[ebp -3C]
00505E2A . 51 push ecx
00505E2B . 52 push edx
00505E2C . FF15 C41140>call dword ptr ds :[<&MSVBVM60.__vbaStrVarVal>>; MSVBVM60.__vbaStrVarVal
00505E32 . 50 push eax ; 2
00505E33 . FF15 481040>call dword ptr ds :[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00505E39 . 8BC8 mov ecx ,eax ; asc("2")->32
00505E3B . FF15 601040>call dword ptr ds :[<&MSVBVM60.__vbaI2Abs>] ; MSVBVM60.__vbaI2Abs
00505E41 . 0FBF4D D0 movsx ecx ,word ptr ss :[ebp -30] ; 26
00505E45 . 0FBFC0 movsx eax ,ax ;
00505E48 . 0FAFC1 imul eax ,ecx ; 0x32*0x26
00505E4B . 0F80 040700>jo GtChrdHl.00506555
00505E51 . 50 push eax
00505E52 . FF15 101040>call dword ptr ds :[<&MSVBVM60.__vbaStrI4>] ; MSVBVM60.__vbaStrI4
00505E58 . 8BD0 mov edx ,eax ; 1900
00505E5A . 8D4D C0 lea ecx ,dword ptr ss :[ebp -40]
00505E5D . FFD6 call esi
00505E5F . 50 push eax
00505E60 . FF15 641040>call dword ptr ds :[<&MSVBVM60.__vbaStrCat>] ; MSVBVM60.__vbaStrCat
00505E66 . 8BD0 mov edx ,eax
00505E68 . 8D4D D8 lea ecx ,dword ptr ss :[ebp -28]
00505E6B . FFD6 call esi
00505E6D . 8D55 C0 lea edx ,dword ptr ss :[ebp -40]
00505E70 . 8D45 C4 lea eax ,dword ptr ss :[ebp -3C]
00505E73 . 52 push edx
00505E74 . 50 push eax
00505E75 . 6A 02 push 2
00505E77 . FF15 1C1240>call dword ptr ds :[<&MSVBVM60.__vbaFreeStrLis>; MSVBVM60.__vbaFreeStrList
00505E7D . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
第三个循环,逆序取机器码,ascii码乘以上面的ascii右边一位的和j,然后组成新串str2
for i=len(mc) to 1 step -1
str2= str2 & cstr(asc(mid(mc,i,1)) *j)
next 00505E80 . 8D55 9C lea edx ,dword ptr ss :[ebp -64]
00505E83 . 51 push ecx
00505E84 . 52 push edx
00505E85 . 6A 02 push 2
00505E87 . FFD7 call edi
00505E89 . 83C8 FF or eax ,FFFFFFFF
00505E8C . 83C4 18 add esp ,18
00505E8F . 66:03C3 add ax ,bx
00505E92 . 0F80 BD0600>jo GtChrdHl.00506555
00505E98 .^ E9 3DFFFFFF jmp GtChrdHl.00505DDA
00505E9D > 8B45 D8 mov eax ,dword ptr ss :[ebp -28] ; "1900307819003002190029264370254619004522"
00505EA0 . 50 push eax
00505EA1 . FF15 241040>call dword ptr ds :[<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00505EA7 . 8B4D 0C mov ecx ,dword ptr ss :[ebp +C]
00505EAA . 66:8B11 mov dx ,word ptr ds :[ecx ]
00505EAD . 66:6BD2 02 imul dx ,dx ,2 ; 14*2
00505EB1 . 0F80 9E0600>jo GtChrdHl.00506555
00505EB7 . 0FBFCA movsx ecx ,dx
00505EBA . 3BC1 cmp eax ,ecx
00505EBC .^ 0F8C 04FFFF>jl GtChrdHl.00505DC6 ; 比较获得的串是否够40,不够继续
00505EC2 . 8B5D 0C mov ebx ,dword ptr ss :[ebp +C]
00505EC5 . 8D55 D8 lea edx ,dword ptr ss :[ebp -28]
00505EC8 . 8995 44FFFF>mov dword ptr ss :[ebp -BC],edx
00505ECE . 8D95 3CFFFF>lea edx ,dword ptr ss :[ebp -C4]
00505ED4 . 66:8B03 mov ax ,word ptr ds :[ebx ]
00505ED7 . C785 3CFFFF>mov dword ptr ss :[ebp -C4],4008
00505EE1 . 66:6BC0 02 imul ax ,ax ,2
00505EE5 . 0F80 6A0600>jo GtChrdHl.00506555
00505EEB . 0FBFC8 movsx ecx ,ax
00505EEE . 51 push ecx
00505EEF . 8D45 9C lea eax ,dword ptr ss :[ebp -64]
00505EF2 . 52 push edx
00505EF3 . 50 push eax ; left(str2,40)
00505EF4 . FF15 701240>call dword ptr ds :[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar
取串str2的左边40位:
str2=left(str2,40) 00505EFA . 8D4D 9C lea ecx ,dword ptr ss :[ebp -64]
00505EFD . 51 push ecx
00505EFE . FF15 201040>call dword ptr ds :[<&MSVBVM60.__vbaStrVarMove>; MSVBVM60.__vbaStrVarMove
00505F04 . 8BD0 mov edx ,eax ; UNICODE "1900307819003002190029264370254619004522"
00505F06 . 8D4D D8 lea ecx ,dword ptr ss :[ebp -28]
00505F09 . FFD6 call esi
00505F0B . 8D4D 9C lea ecx ,dword ptr ss :[ebp -64]
00505F0E . FF15 1C1040>call dword ptr ds :[<&MSVBVM60.__vbaFreeVar>] ; MSVBVM60.__vbaFreeVar
00505F14 . 66:8B0B mov cx ,word ptr ds :[ebx ]
00505F17 . B8 01000000 mov eax ,1
00505F1C . 66:6BC9 02 imul cx ,cx ,2
00505F20 . 0F80 2F0600>jo GtChrdHl.00506555
00505F26 . 898D C0FEFF>mov dword ptr ss :[ebp -140],ecx
00505F2C . 8945 E4 mov dword ptr ss :[ebp -1C],eax
00505F2F > 66:3BC1 cmp ax ,cx ; 循环,cx=40
00505F32 . 0F8F 360100>jg GtChrdHl.0050606E
00505F38 . 8B55 CC mov edx ,dword ptr ss :[ebp -34]
00505F3B . B9 02000000 mov ecx ,2
00505F40 . 8995 04FFFF>mov dword ptr ss :[ebp -FC],edx
00505F46 . 894D A4 mov dword ptr ss :[ebp -5C],ecx
00505F49 . 894D 9C mov dword ptr ss :[ebp -64],ecx
00505F4C . 8D4D D8 lea ecx ,dword ptr ss :[ebp -28]
00505F4F . 0FBFD8 movsx ebx ,ax
00505F52 . 8D55 9C lea edx ,dword ptr ss :[ebp -64]
00505F55 . 898D 44FFFF>mov dword ptr ss :[ebp -BC],ecx
00505F5B . 52 push edx
00505F5C . 8D85 3CFFFF>lea eax ,dword ptr ss :[ebp -C4]
00505F62 . 53 push ebx
00505F63 . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
00505F66 . 50 push eax
00505F67 . 51 push ecx
00505F68 . C785 FCFEFF>mov dword ptr ss :[ebp -104],8
00505F72 . C785 3CFFFF>mov dword ptr ss :[ebp -C4],4008
00505F7C . FF15 0C1140>call dword ptr ds :[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
00505F82 . B8 02000000 mov eax ,2 ; mid(str2,i,2)
00505F87 . 8D55 D4 lea edx ,dword ptr ss :[ebp -2C]
00505F8A . 8945 84 mov dword ptr ss :[ebp -7C],eax
00505F8D . 8985 7CFFFF>mov dword ptr ss :[ebp -84],eax
00505F93 . 8D85 7CFFFF>lea eax ,dword ptr ss :[ebp -84]
00505F99 . 8995 24FFFF>mov dword ptr ss :[ebp -DC],edx
00505F9F . 50 push eax
00505FA0 . 8D8D 1CFFFF>lea ecx ,dword ptr ss :[ebp -E4]
00505FA6 . 53 push ebx
00505FA7 . 8D95 6CFFFF>lea edx ,dword ptr ss :[ebp -94]
00505FAD . 51 push ecx
00505FAE . 52 push edx
00505FAF . C785 1CFFFF>mov dword ptr ss :[ebp -E4],4008 ; mid(str1,i,2)
00505FB9 . FF15 0C1140>call dword ptr ds :[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
00505FBF . 8B1D C41240>mov ebx ,dword ptr ds :[<&MSVBVM60.__vbaI4ErrVa>; MSVBVM60.__vbaI4ErrVar
00505FC5 . 8D85 6CFFFF>lea eax ,dword ptr ss :[ebp -94]
00505FCB . 50 push eax
00505FCC . FFD3 call ebx ; <&MSVBVM60.__vbaI4ErrVar>
00505FCE . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
00505FD1 . 8BD0 mov edx ,eax
00505FD3 . 51 push ecx
00505FD4 . 8995 ACFEFF>mov dword ptr ss :[ebp -154],edx
00505FDA . FFD3 call ebx
00505FDC . 8B95 ACFEFF>mov edx ,dword ptr ss :[ebp -154] ; 0x42
00505FE2 . 33D0 xor edx ,eax ; mid1 xor mid2
00505FE4 . 8D85 5CFFFF>lea eax ,dword ptr ss :[ebp -A4]
00505FEA . 52 push edx
00505FEB . 50 push eax ; 0x54->chr(84)
00505FEC . FF15 BC1140>call dword ptr ds :[<&MSVBVM60.#608>] ; MSVBVM60.rtcVarBstrFromAnsi
00505FF2 . 8D8D FCFEFF>lea ecx ,dword ptr ss :[ebp -104]
00505FF8 . 8D95 5CFFFF>lea edx ,dword ptr ss :[ebp -A4]
00505FFE . 51 push ecx
00505FFF . 8D85 4CFFFF>lea eax ,dword ptr ss :[ebp -B4]
00506005 . 52 push edx
00506006 . 50 push eax
00506007 . FF15 CC1140>call dword ptr ds :[<&MSVBVM60.__vbaVarCat>] ; MSVBVM60.__vbaVarCat
0050600D . 50 push eax ; T连接,得到str3
0050600E . FF15 201040>call dword ptr ds :[<&MSVBVM60.__vbaStrVarMove>; MSVBVM60.__vbaStrVarMove
00506014 . 8BD0 mov edx ,eax
00506016 . 8D4D CC lea ecx ,dword ptr ss :[ebp -34]
00506019 . FFD6 call esi
0050601B . 8D8D 4CFFFF>lea ecx ,dword ptr ss :[ebp -B4]
00506021 . 8D95 5CFFFF>lea edx ,dword ptr ss :[ebp -A4]
00506027 . 51 push ecx
00506028 . 8D85 6CFFFF>lea eax ,dword ptr ss :[ebp -94]
0050602E . 52 push edx
0050602F . 8D8D 6CFFFF>lea ecx ,dword ptr ss :[ebp -94]
00506035 . 50 push eax
00506036 . 8D95 7CFFFF>lea edx ,dword ptr ss :[ebp -84]
0050603C . 51 push ecx
0050603D . 8D45 8C lea eax ,dword ptr ss :[ebp -74]
00506040 . 52 push edx
00506041 . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
00506044 . 50 push eax
00506045 . 8D55 9C lea edx ,dword ptr ss :[ebp -64]
00506048 . 51 push ecx
00506049 . 52 push edx
0050604A . 6A 08 push 8
0050604C . FFD7 call edi
0050604E . B8 02000000 mov eax ,2 ; i=i+2
00506053 . 83C4 24 add esp ,24
00506056 . 66:0345 E4 add ax ,word ptr ss :[ebp -1C]
0050605A . 0F80 F50400>jo GtChrdHl.00506555
00506060 . 8B8D C0FEFF>mov ecx ,dword ptr ss :[ebp -140]
00506066 . 8945 E4 mov dword ptr ss :[ebp -1C],eax
00506069 .^ E9 C1FEFFFF jmp GtChrdHl.00505F2F
0050606E > 8B45 0C mov eax ,dword ptr ss :[ebp +C]
00506071 . 66:8B08 mov cx ,word ptr ds :[eax ]
00506074 . B8 01000000 mov eax ,1
00506079 . 66:898D B8F>mov word ptr ss :[ebp -148],cx
00506080 > 66:3B85 B8F>cmp ax ,word ptr ss :[ebp -148] ; 14
00506087 . 8945 E4 mov dword ptr ss :[ebp -1C],eax
0050608A . 0F8F 160400>jg GtChrdHl.005064A6
第四个循环,从第一位开始,逐两位取str1的ascii 跟str2的ascii码异或,组成新串str3
for i=1 to 40 step 2
str3=str3 & chr(cint(mid(str1,i,2)) xor cint(mid(str2,i,2)))
next
00506090 . 8D55 CC lea edx ,dword ptr ss :[ebp -34]
00506093 . 8D4D 9C lea ecx ,dword ptr ss :[ebp -64]
00506096 . 8995 44FFFF>mov dword ptr ss :[ebp -BC],edx
0050609C . 51 push ecx
0050609D . 0FBFD0 movsx edx ,ax
005060A0 . 8D85 3CFFFF>lea eax ,dword ptr ss :[ebp -C4]
005060A6 . 52 push edx
005060A7 . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
005060AA . 50 push eax
005060AB . 51 push ecx
005060AC . C745 A4 010>mov dword ptr ss :[ebp -5C],1
005060B3 . C745 9C 020>mov dword ptr ss :[ebp -64],2
005060BA . C785 3CFFFF>mov dword ptr ss :[ebp -C4],4008 ; mid(str3,i,1)
005060C4 . FF15 0C1140>call dword ptr ds :[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
005060CA . 8D55 8C lea edx ,dword ptr ss :[ebp -74]
005060CD . 8D45 C4 lea eax ,dword ptr ss :[ebp -3C]
005060D0 . 52 push edx
005060D1 . 50 push eax
005060D2 . FF15 C41140>call dword ptr ds :[<&MSVBVM60.__vbaStrVarVal>>; MSVBVM60.__vbaStrVarVal
005060D8 . 50 push eax
005060D9 . FF15 481040>call dword ptr ds :[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
005060DF . 8BC8 mov ecx ,eax ; asc()
005060E1 . FF15 741140>call dword ptr ds :[<&MSVBVM60.__vbaUI1I2>] ; MSVBVM60.__vbaUI1I2
005060E7 . 8D4D C4 lea ecx ,dword ptr ss :[ebp -3C]
005060EA . 8AD8 mov bl ,al
005060EC . FF15 CC1240>call dword ptr ds :[<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
005060F2 . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
005060F5 . 8D55 9C lea edx ,dword ptr ss :[ebp -64]
005060F8 . 51 push ecx
005060F9 . 52 push edx
005060FA . 6A 02 push 2
005060FC . FFD7 call edi
005060FE . 83C4 0C add esp ,0C
00506101 . 80FB 19 cmp bl ,19 ; >0x19
00506104 . 77 21 ja short GtChrdHl.00506127
00506106 . 8B45 DC mov eax ,dword ptr ss :[ebp -24]
00506109 . 66:33C9 xor cx ,cx
0050610C . 8ACB mov cl ,bl
0050610E . 8985 44FFFF>mov dword ptr ss :[ebp -BC],eax
00506114 . C785 3CFFFF>mov dword ptr ss :[ebp -C4],8
0050611E . 66:83C1 41 add cx ,41 ; +41
00506122 . E9 95000000 jmp GtChrdHl.005061BC
00506127 > 80FB 33 cmp bl ,33 ; >0x33 3
0050612A . 77 1E ja short GtChrdHl.0050614A
0050612C . 8B45 DC mov eax ,dword ptr ss :[ebp -24]
0050612F . 66:33C9 xor cx ,cx
00506132 . 8ACB mov cl ,bl
00506134 . 8985 44FFFF>mov dword ptr ss :[ebp -BC],eax
0050613A . C785 3CFFFF>mov dword ptr ss :[ebp -C4],8
00506144 . 66:83C1 47 add cx ,47 ; +47
00506148 . EB 72 jmp short GtChrdHl.005061BC
0050614A > 80FB 3D cmp bl ,3D ; >0x3d =
0050614D . 77 1E ja short GtChrdHl.0050616D
0050614F . 8B45 DC mov eax ,dword ptr ss :[ebp -24]
00506152 . 66:33C9 xor cx ,cx
00506155 . 8ACB mov cl ,bl
00506157 . 8985 44FFFF>mov dword ptr ss :[ebp -BC],eax
0050615D . C785 3CFFFF>mov dword ptr ss :[ebp -C4],8
00506167 . 66:83E9 04 sub cx ,4 ; -4
0050616B . EB 4F jmp short GtChrdHl.005061BC
0050616D > 80FB 47 cmp bl ,47 ; >0x47
00506170 . 77 1E ja short GtChrdHl.00506190
00506172 . 8B45 DC mov eax ,dword ptr ss :[ebp -24]
00506175 . 66:33C9 xor cx ,cx
00506178 . 8ACB mov cl ,bl
0050617A . 8985 44FFFF>mov dword ptr ss :[ebp -BC],eax
00506180 . C785 3CFFFF>mov dword ptr ss :[ebp -C4],8
0050618A . 66:83E9 0E sub cx ,0E ; -0xe
0050618E . EB 2C jmp short GtChrdHl.005061BC
00506190 > 8B45 DC mov eax ,dword ptr ss :[ebp -24]
00506193 . 80FB 60 cmp bl ,60 ; >0x60
00506196 . 8985 44FFFF>mov dword ptr ss :[ebp -BC],eax
0050619C . C785 3CFFFF>mov dword ptr ss :[ebp -C4],8
005061A6 . 77 0B ja short GtChrdHl.005061B3
005061A8 . 66:33C9 xor cx ,cx
005061AB . 8ACB mov cl ,bl
005061AD . 66:83E9 07 sub cx ,7 ; cx-7
005061B1 . EB 09 jmp short GtChrdHl.005061BC
005061B3 > 66:33C9 xor cx ,cx
005061B6 . 8ACB mov cl ,bl
005061B8 . 66:83C1 0A add cx ,0A ; +0xa
005061BC > 0F80 930300>jo GtChrdHl.00506555
005061C2 . 0FBFD1 movsx edx ,cx
005061C5 . 8D45 9C lea eax ,dword ptr ss :[ebp -64]
005061C8 . 52 push edx
005061C9 . 50 push eax
005061CA . FF15 BC1140>call dword ptr ds :[<&MSVBVM60.#608>] ; MSVBVM60.rtcVarBstrFromAnsi
005061D0 . 8D8D 3CFFFF>lea ecx ,dword ptr ss :[ebp -C4] ; chr(0x4d)
005061D6 . 8D55 9C lea edx ,dword ptr ss :[ebp -64]
005061D9 . 51 push ecx
005061DA . 8D45 8C lea eax ,dword ptr ss :[ebp -74]
005061DD . 52 push edx
005061DE . 50 push eax
005061DF . FF15 CC1140>call dword ptr ds :[<&MSVBVM60.__vbaVarCat>] ; MSVBVM60.__vbaVarCat
005061E5 . 50 push eax ; 0x4d
005061E6 . FF15 201040>call dword ptr ds :[<&MSVBVM60.__vbaStrVarMove>; MSVBVM60.__vbaStrVarMove
005061EC . 8BD0 mov edx ,eax
005061EE . 8D4D DC lea ecx ,dword ptr ss :[ebp -24]
对str3逐位判断,
For i = 1 To 40
tmp = Asc(mid(str3, i, 1))
If tmp <= &H19 Then
tmp = tmp + &H41
ElseIf tmp <= &H33 Then
tmp = tmp + &H47
ElseIf tmp <= &H3D Then
tmp = tmp - &H4
ElseIf tmp <= &H47 Then
tmp = tmp - &HE
ElseIf tmp <= &H60 Then
tmp = tmp - &H7
Else
tmp = tmp + &HA
End If
005061F1 . FFD6 call esi
005061F3 . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
005061F6 . 8D55 9C lea edx ,dword ptr ss :[ebp -64]
005061F9 . 51 push ecx
005061FA . 52 push edx
005061FB . 6A 02 push 2
005061FD . FFD7 call edi
005061FF . 8B3D 9C1240>mov edi ,dword ptr ds :[<&MSVBVM60.#619>] ; MSVBVM60.rtcRightCharVar
00506205 . 83C4 0C add esp ,0C
00506208 . 8D8D 3CFFFF>lea ecx ,dword ptr ss :[ebp -C4]
0050620E . 8D55 9C lea edx ,dword ptr ss :[ebp -64]
00506211 . 6A 01 push 1
00506213 . 8D45 DC lea eax ,dword ptr ss :[ebp -24]
00506216 . BB 08400000 mov ebx ,4008
0050621B . 51 push ecx
0050621C . 52 push edx
0050621D . 8985 44FFFF>mov dword ptr ss :[ebp -BC],eax
00506223 . 899D 3CFFFF>mov dword ptr ss :[ebp -C4],ebx
00506229 . FFD7 call edi ; <&MSVBVM60.#619>
0050622B . 8D8D 2CFFFF>lea ecx ,dword ptr ss :[ebp -D4]
00506231 . 6A 01 push 1
00506233 . 8D55 8C lea edx ,dword ptr ss :[ebp -74]
00506236 . 8D45 DC lea eax ,dword ptr ss :[ebp -24]
00506239 . 51 push ecx
0050623A . 52 push edx
0050623B . 8985 34FFFF>mov dword ptr ss :[ebp -CC],eax
00506241 . 899D 2CFFFF>mov dword ptr ss :[ebp -D4],ebx
00506247 . FFD7 call edi
00506249 . 8D8D 1CFFFF>lea ecx ,dword ptr ss :[ebp -E4]
0050624F . 6A 01 push 1
00506251 . 8D95 7CFFFF>lea edx ,dword ptr ss :[ebp -84]
00506257 . 8D45 DC lea eax ,dword ptr ss :[ebp -24]
0050625A . 51 push ecx
0050625B . 52 push edx
0050625C . 8985 24FFFF>mov dword ptr ss :[ebp -DC],eax
00506262 . 899D 1CFFFF>mov dword ptr ss :[ebp -E4],ebx
00506268 . FFD7 call edi
0050626A . 8D8D 0CFFFF>lea ecx ,dword ptr ss :[ebp -F4]
00506270 . 6A 01 push 1
00506272 . 8D95 6CFFFF>lea edx ,dword ptr ss :[ebp -94]
00506278 . 8D45 DC lea eax ,dword ptr ss :[ebp -24]
0050627B . 51 push ecx
0050627C . 52 push edx
0050627D . 8985 14FFFF>mov dword ptr ss :[ebp -EC],eax
00506283 . 899D 0CFFFF>mov dword ptr ss :[ebp -F4],ebx
00506289 . FFD7 call edi
0050628B . 8D8D FCFEFF>lea ecx ,dword ptr ss :[ebp -104]
00506291 . 6A 01 push 1
00506293 . 8D95 5CFFFF>lea edx ,dword ptr ss :[ebp -A4]
00506299 . 8D45 DC lea eax ,dword ptr ss :[ebp -24]
0050629C . 51 push ecx
0050629D . 52 push edx
0050629E . 8985 04FFFF>mov dword ptr ss :[ebp -FC],eax
005062A4 . 899D FCFEFF>mov dword ptr ss :[ebp -104],ebx
005062AA . FFD7 call edi
005062AC . 8D8D ECFEFF>lea ecx ,dword ptr ss :[ebp -114]
005062B2 . 6A 01 push 1
005062B4 . 8D95 4CFFFF>lea edx ,dword ptr ss :[ebp -B4]
005062BA . 8D45 DC lea eax ,dword ptr ss :[ebp -24]
005062BD . 51 push ecx
005062BE . 52 push edx
005062BF . 8985 F4FEFF>mov dword ptr ss :[ebp -10C],eax
005062C5 . 899D ECFEFF>mov dword ptr ss :[ebp -114],ebx
005062CB . FFD7 call edi
005062CD . 8B3D C41140>mov edi ,dword ptr ds :[<&MSVBVM60.__vbaStrVarV>; MSVBVM60.__vbaStrVarVal
005062D3 . 8D85 5CFFFF>lea eax ,dword ptr ss :[ebp -A4]
005062D9 . 8D4D B4 lea ecx ,dword ptr ss :[ebp -4C]
005062DC . 50 push eax
005062DD . 51 push ecx
005062DE . FFD7 call edi ; <&MSVBVM60.__vbaStrVarVal>
005062E0 . 50 push eax
005062E1 . FF15 481040>call dword ptr ds :[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
005062E7 . 33DB xor ebx ,ebx
005062E9 . 66:3D 6100 cmp ax ,61 ; 0x4d >60? `
005062ED . 8D95 6CFFFF>lea edx ,dword ptr ss :[ebp -94]
005062F3 . 8D45 B8 lea eax ,dword ptr ss :[ebp -48]
005062F6 . 0F9CC3 setl bl
005062F9 . 52 push edx
005062FA . 50 push eax
005062FB . F7DB neg ebx
005062FD . FFD7 call edi
005062FF . 50 push eax
00506300 . FF15 481040>call dword ptr ds :[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00506306 . 33C9 xor ecx ,ecx
00506308 . 66:3D 5A00 cmp ax ,5A ; >5a Z
0050630C . 0F9FC1 setg cl
0050630F . 8D95 7CFFFF>lea edx ,dword ptr ss :[ebp -84]
00506315 . 8D45 BC lea eax ,dword ptr ss :[ebp -44]
00506318 . F7D9 neg ecx
0050631A . 52 push edx
0050631B . 50 push eax
0050631C . 23D9 and ebx ,ecx
0050631E . FFD7 call edi
00506320 . 50 push eax
00506321 . FF15 481040>call dword ptr ds :[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00506327 . 899D A8FEFF>mov dword ptr ss :[ebp -158],ebx
0050632D . 33DB xor ebx ,ebx
0050632F . 66:3D 4100 cmp ax ,41 ; >41 A
00506333 . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
00506336 . 8D55 C0 lea edx ,dword ptr ss :[ebp -40]
00506339 . 51 push ecx
0050633A . 0F9CC3 setl bl
0050633D . 52 push edx
0050633E . F7DB neg ebx
00506340 . FFD7 call edi
00506342 . 50 push eax
00506343 . FF15 481040>call dword ptr ds :[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00506349 . 8B95 A8FEFF>mov edx ,dword ptr ss :[ebp -158]
0050634F . 33C9 xor ecx ,ecx
00506351 . 66:3D 3900 cmp ax ,39 ; >39 9
00506355 . 8D85 4CFFFF>lea eax ,dword ptr ss :[ebp -B4]
0050635B . 0F9FC1 setg cl
0050635E . F7D9 neg ecx
00506360 . 23D9 and ebx ,ecx
00506362 . 8D4D B0 lea ecx ,dword ptr ss :[ebp -50]
00506365 . 0BD3 or edx ,ebx ; or
00506367 . 50 push eax
00506368 . 51 push ecx
00506369 . 8BDA mov ebx ,edx
0050636B . FFD7 call edi
0050636D . 8B3D 481040>mov edi ,dword ptr ds :[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00506373 . 50 push eax
00506374 . FFD7 call edi ; <&MSVBVM60.#516>
00506376 . 33D2 xor edx ,edx
00506378 . 66:3D 7A00 cmp ax ,7A ; z
0050637C . 8D45 9C lea eax ,dword ptr ss :[ebp -64]
0050637F . 0F9FC2 setg dl
00506382 . 8D4D C4 lea ecx ,dword ptr ss :[ebp -3C]
00506385 . 50 push eax
00506386 . F7DA neg edx
00506388 . 51 push ecx
00506389 . 0BDA or ebx ,edx
0050638B . FF15 C41140>call dword ptr ds :[<&MSVBVM60.__vbaStrVarVal>>; MSVBVM60.__vbaStrVarVal
00506391 . 50 push eax
00506392 . FFD7 call edi
00506394 . 33D2 xor edx ,edx
00506396 . 66:3D 3000 cmp ax ,30 ; 0
0050639A . 0F9CC2 setl dl
0050639D . 8D45 B0 lea eax ,dword ptr ss :[ebp -50]
005063A0 . 8D4D B4 lea ecx ,dword ptr ss :[ebp -4C]
005063A3 . F7DA neg edx
005063A5 . 50 push eax
005063A6 . 0BDA or ebx ,edx
005063A8 . 51 push ecx
005063A9 . 8D55 B8 lea edx ,dword ptr ss :[ebp -48]
005063AC . 8D45 BC lea eax ,dword ptr ss :[ebp -44]
005063AF . 52 push edx
005063B0 . 8D4D C0 lea ecx ,dword ptr ss :[ebp -40]
005063B3 . 50 push eax
005063B4 . 8D55 C4 lea edx ,dword ptr ss :[ebp -3C]
005063B7 . 51 push ecx
005063B8 . 52 push edx
005063B9 . 6A 06 push 6
005063BB . FF15 1C1240>call dword ptr ds :[<&MSVBVM60.__vbaFreeStrLis>; MSVBVM60.__vbaFreeStrList
005063C1 . 8D85 4CFFFF>lea eax ,dword ptr ss :[ebp -B4]
005063C7 . 8B3D 301040>mov edi ,dword ptr ds :[<&MSVBVM60.__vbaFreeVar>; MSVBVM60.__vbaFreeVarList
005063CD . 8D8D 5CFFFF>lea ecx ,dword ptr ss :[ebp -A4]
005063D3 . 50 push eax
005063D4 . 8D95 6CFFFF>lea edx ,dword ptr ss :[ebp -94]
005063DA . 51 push ecx
判断特殊情况,如果出现特殊字符,用“2”代替
if tmp<&H30 or (tmp>&H39 and tmp<&H41) or (tmp>&H5a and tmp<&H60) or tmp>&H7a then tmp= &H32 005063DB . 8D85 7CFFFF>lea eax ,dword ptr ss :[ebp -84]
005063E1 . 52 push edx
005063E2 . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
005063E5 . 50 push eax
005063E6 . 8D55 9C lea edx ,dword ptr ss :[ebp -64]
005063E9 . 51 push ecx
005063EA . 52 push edx
005063EB . 6A 06 push 6
005063ED . FFD7 call edi ; <&MSVBVM60.__vbaFreeVarList>
005063EF . 83C4 38 add esp ,38
005063F2 . 66:85DB test bx ,bx
005063F5 . 0F84 970000>je GtChrdHl.00506492 ; 满足上面的条件 需要测试
005063FB . 8B45 DC mov eax ,dword ptr ss :[ebp -24]
005063FE . 50 push eax
005063FF . FF15 241040>call dword ptr ds :[<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00506405 . 83E8 01 sub eax ,1 ; len()-1
00506408 . 8D4D DC lea ecx ,dword ptr ss :[ebp -24]
0050640B . 0F80 440100>jo GtChrdHl.00506555
00506411 . 8D55 9C lea edx ,dword ptr ss :[ebp -64]
00506414 . 8945 A4 mov dword ptr ss :[ebp -5C],eax
00506417 . 898D 44FFFF>mov dword ptr ss :[ebp -BC],ecx
0050641D . 52 push edx
0050641E . 8D85 3CFFFF>lea eax ,dword ptr ss :[ebp -C4]
00506424 . 6A 01 push 1
00506426 . 8D4D 8C lea ecx ,dword ptr ss :[ebp -74]
00506429 . 50 push eax
0050642A . 51 push ecx
0050642B . C745 9C 030>mov dword ptr ss :[ebp -64],3
00506432 . C785 3CFFFF>mov dword ptr ss :[ebp -C4],4008
0050643C . FF15 0C1140>call dword ptr ds :[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
00506442 . 8D55 8C lea edx ,dword ptr ss :[ebp -74]
00506445 . 8D85 1CFFFF>lea eax ,dword ptr ss :[ebp -E4]
0050644B . 52 push edx
0050644C . 8D8D 7CFFFF>lea ecx ,dword ptr ss :[ebp -84]
00506452 . 50 push eax
00506453 . 51 push ecx
00506454 . C785 24FFFF>mov dword ptr ss :[ebp -DC],GtChrdHl.0044DEB8 ; 2
0050645E . C785 1CFFFF>mov dword ptr ss :[ebp -E4],8
00506468 . FF15 CC1140>call dword ptr ds :[<&MSVBVM60.__vbaVarCat>] ; MSVBVM60.__vbaVarCat
0050646E . 50 push eax ; 否则加2
0050646F . FF15 201040>call dword ptr ds :[<&MSVBVM60.__vbaStrVarMove>; MSVBVM60.__vbaStrVarMove
00506475 . 8BD0 mov edx ,eax
00506477 . 8D4D DC lea ecx ,dword ptr ss :[ebp -24]
0050647A . FFD6 call esi
0050647C . 8D95 7CFFFF>lea edx ,dword ptr ss :[ebp -84]
00506482 . 8D45 8C lea eax ,dword ptr ss :[ebp -74]
00506485 . 52 push edx
00506486 . 8D4D 9C lea ecx ,dword ptr ss :[ebp -64]
00506489 . 50 push eax
0050648A . 51 push ecx
0050648B . 6A 03 push 3
0050648D . FFD7 call edi
0050648F . 83C4 10 add esp ,10
00506492 > B8 01000000 mov eax ,1 ; 循环量加1
00506497 . 66:0345 E4 add ax ,word ptr ss :[ebp -1C]
0050649B . 0F80 B40000>jo GtChrdHl.00506555
005064A1 .^ E9 DAFBFFFF jmp GtChrdHl.00506080
005064A6 > 8B55 DC mov edx ,dword ptr ss :[ebp -24] ; "M4QuZ9cIgKXNCBueov1v"
005064A9 . 8D4D C8 lea ecx ,dword ptr ss :[ebp -38]
005064AC . FF15 101240>call dword ptr ds :[<&MSVBVM60.__vbaStrCopy>] ; MSVBVM60.__vbaStrCopy
005064B2 . 68 3F655000 push GtChrdHl.0050653F
005064B7 . EB 6B jmp short GtChrdHl.00506524
005064B9 . F645 FC 04 test byte ptr ss :[ebp -4],4
005064BD . 74 09 je short GtChrdHl.005064C8