00440A00 > \55 PUSH EBP ;子程序开始部分
00440A01 . 8BEC MOV EBP,ESP
00440A03 . 83EC 0C SUB ESP,0C ; (初始 cpu 选择)
00440A06 . 68 C6104000 PUSH <JMP.&MSVBVM60.__vbaExceptHandler> ; SE 处理程序安装
00440A0B . 64:A1 0000000>MOV EAX,DWORD PTR FS:[0]
00440A11 . 50 PUSH EAX
00440A12 . 64:8925 00000>MOV DWORD PTR FS:[0],ESP
00440A19 . 81EC B8000000 SUB ESP,0B8
00440A1F . 53 PUSH EBX
00440A20 . 56 PUSH ESI
00440A21 . 57 PUSH EDI
00440A22 . 8965 F4 MOV DWORD PTR SS:[EBP-C],ESP
00440A25 . C745 F8 A8104>MOV DWORD PTR SS:[EBP-8],极限篮球.004010A8
00440A2C . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00440A2F . 8BC8 MOV ECX,EAX
00440A31 . 83E1 01 AND ECX,1
00440A34 . 894D FC MOV DWORD PTR SS:[EBP-4],ECX
00440A37 . 24 FE AND AL,0FE
00440A39 . 50 PUSH EAX
00440A3A . 8945 08 MOV DWORD PTR SS:[EBP+8],EAX
00440A3D . 8B10 MOV EDX,DWORD PTR DS:[EAX]
00440A3F . FF52 04 CALL DWORD PTR DS:[EDX+4]
00440A42 . 33F6 XOR ESI,ESI
00440A44 . 8B3D 78104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaVa>; MSVBVM60.__vbaVarCmpEq
00440A4A . B8 08800000 MOV EAX,8008
00440A4F . 89B5 6CFFFFFF MOV DWORD PTR SS:[EBP-94],ESI
00440A55 . 89B5 5CFFFFFF MOV DWORD PTR SS:[EBP-A4],ESI
00440A5B . B9 10014400 MOV ECX,极限篮球.00440110 ; user(Unicode)
00440A60 . 8985 6CFFFFFF MOV DWORD PTR SS:[EBP-94],EAX
00440A66 . 8985 5CFFFFFF MOV DWORD PTR SS:[EBP-A4],EAX
00440A6C . 898D 74FFFFFF MOV DWORD PTR SS:[EBP-8C],ECX
00440A72 . 898D 64FFFFFF MOV DWORD PTR SS:[EBP-9C],ECX
00440A78 . 8D45 BC LEA EAX,DWORD PTR SS:[EBP-44]
00440A7B . 8D8D 6CFFFFFF LEA ECX,DWORD PTR SS:[EBP-94]
00440A81 . 50 PUSH EAX
00440A82 . 8D55 AC LEA EDX,DWORD PTR SS:[EBP-54]
00440A85 . 51 PUSH ECX
00440A86 . 52 PUSH EDX
00440A87 . 8975 DC MOV DWORD PTR SS:[EBP-24],ESI
00440A8A . 8975 CC MOV DWORD PTR SS:[EBP-34],ESI
00440A8D . 8975 BC MOV DWORD PTR SS:[EBP-44],ESI
00440A90 . 8975 AC MOV DWORD PTR SS:[EBP-54],ESI
00440A93 . 8975 9C MOV DWORD PTR SS:[EBP-64],ESI
00440A96 . 8975 8C MOV DWORD PTR SS:[EBP-74],ESI
00440A99 . 89B5 7CFFFFFF MOV DWORD PTR SS:[EBP-84],ESI
00440A9F . FFD7 CALL EDI ; (初始 cpu 选择) ; <&MSVBVM60.__vbaVarCmpEq>
00440AA1 . 50 PUSH EAX
00440AA2 . 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
00440AA5 . 8D8D 5CFFFFFF LEA ECX,DWORD PTR SS:[EBP-A4]
00440AAB . 50 PUSH EAX
00440AAC . 8D55 9C LEA EDX,DWORD PTR SS:[EBP-64]
00440AAF . 51 PUSH ECX
00440AB0 . 52 PUSH EDX
00440AB1 . FFD7 CALL EDI
00440AB3 . 50 PUSH EAX
00440AB4 . 8D45 8C LEA EAX,DWORD PTR SS:[EBP-74]
00440AB7 . 50 PUSH EAX
00440AB8 . FF15 48104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarAn>; MSVBVM60.__vbaVarAnd
00440ABE . 50 PUSH EAX
00440ABF . FF15 28104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaBoolV>; MSVBVM60.__vbaBoolVarNull
00440AC5 . 66:85C0 TEST AX,AX
00440AC8 74 1C JE SHORT 极限篮球.00440AE6
00440ACA . 56 PUSH ESI
00440ACB . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
00440ACE . 68 1C014400 PUSH 极限篮球.0044011C ; show(Unicode)
00440AD3 . 51 PUSH ECX
00440AD4 . FF15 38104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjVa>; MSVBVM60.__vbaObjVar
00440ADA . 50 PUSH EAX
00440ADB . FF15 7C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaLateM>; MSVBVM60.__vbaLateMemCall
00440AE1 . 83C4 0C ADD ESP,0C
00440AE4 . EB 7A JMP SHORT 极限篮球.00440B60
00440AE6 > B9 04000280 MOV ECX,80020004
00440AEB . B8 0A000000 MOV EAX,0A
00440AF0 . 894D 84 MOV DWORD PTR SS:[EBP-7C],ECX
00440AF3 . 894D 94 MOV DWORD PTR SS:[EBP-6C],ECX
00440AF6 . 894D A4 MOV DWORD PTR SS:[EBP-5C],ECX
00440AF9 . 8D95 6CFFFFFF LEA EDX,DWORD PTR SS:[EBP-94]
00440AFF . 8D4D AC LEA ECX,DWORD PTR SS:[EBP-54]
00440B02 . 8985 7CFFFFFF MOV DWORD PTR SS:[EBP-84],EAX
00440B08 . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
00440B0B . 8945 9C MOV DWORD PTR SS:[EBP-64],EAX
00440B0E . C785 74FFFFFF>MOV DWORD PTR SS:[EBP-8C],极限篮球.004401E4
00440B18 . C785 6CFFFFFF>MOV DWORD PTR SS:[EBP-94],8
00440B22 . FF15 80104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarDu>; MSVBVM60.__vbaVarDup
00440B28 . 8D95 7CFFFFFF LEA EDX,DWORD PTR SS:[EBP-84]
00440B2E . 8D45 8C LEA EAX,DWORD PTR SS:[EBP-74]
00440B31 . 52 PUSH EDX
00440B32 . 8D4D 9C LEA ECX,DWORD PTR SS:[EBP-64]
00440B35 . 50 PUSH EAX
00440B36 . 51 PUSH ECX
00440B37 . 8D55 AC LEA EDX,DWORD PTR SS:[EBP-54]
00440B3A . 56 PUSH ESI
00440B3B . 52 PUSH EDX
00440B3C . FF15 1C104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox ; 调用API提示注册正确与否
[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
