vb程序, 用VBExplorer找出按钮处理事件
.text:00404022 Reg_Click proc near
004040F9 . 51 push ecx
004040FA . 57 push edi
004040FB . 8B07 mov eax,dword ptr ds:[edi]
004040FD . FF90 A0000000 call dword ptr ds:[eax+A0] ; get sn
0040413E . 8D4D CC lea ecx,dword ptr ss:[ebp-34]
00404141 . 51 push ecx
00404142 . 8D4D E8 lea ecx,dword ptr ss:[ebp-18]
00404145 . 51 push ecx
00404146 . 53 push ebx
00404147 . FF90 F8060000 call dword ptr ds:[eax+6F8] ; check, 00402334
00403D21 . 8D85 4CFFFFFF lea eax,dword ptr ss:[ebp-B4]
00403D27 . 50 push eax
00403D28 . 8D45 CC lea eax,dword ptr ss:[ebp-34]
00403D2B . 50 push eax
00403D2C . 89B5 1CFFFFFF mov dword ptr ss:[ebp-E4],esi
00403D32 . 89B5 3CFFFFFF mov dword ptr ss:[ebp-C4],esi
00403D38 . 898D 54FFFFFF mov dword ptr ss:[ebp-AC],ecx
00403D3E . C785 4CFFFFFF>mov dword ptr ss:[ebp-B4],4008
00403D48 . E8 15410000 call <CrMe.xmd5>
00403D4D . 8D85 3CFFFFFF lea eax,dword ptr ss:[ebp-C4]
00403D53 . C785 34FFFFFF>mov dword ptr ss:[ebp-CC],CrMe.0040279C ; UNICODE "7878787878787878787878787878787878787878"
00403D5D . 50 push eax
00403D5E . 8D45 CC lea eax,dword ptr ss:[ebp-34]
00403D61 . 50 push eax
00403D62 . 8D45 BC lea eax,dword ptr ss:[ebp-44]
00403D65 . 50 push eax
00403D66 . 89B5 2CFFFFFF mov dword ptr ss:[ebp-D4],esi
00403D6C . E8 3FD9FFFF call <jmp.&MSVBVM60.__vbaVarCat>
00403D71 . 50 push eax
00403D72 . 8D85 2CFFFFFF lea eax,dword ptr ss:[ebp-D4]
00403D78 . 50 push eax
00403D79 . 8D45 AC lea eax,dword ptr ss:[ebp-54]
00403D7C . 50 push eax
00403D7D . E8 2ED9FFFF call <jmp.&MSVBVM60.__vbaVarCat>
00403D82 . 50 push eax
00403D83 . 8D45 9C lea eax,dword ptr ss:[ebp-64]
00403D86 . 50 push eax
00403D87 . E8 D6400000 call <CrMe.xmd5>
00403D8C . 8D85 1CFFFFFF lea eax,dword ptr ss:[ebp-E4]
00403D92 . C785 14FFFFFF>mov dword ptr ss:[ebp-EC],CrMe.004027F4 ; UNICODE "2222222222222222222222222222222222222222"
00403D9C . 50 push eax
00403D9D . 8D45 9C lea eax,dword ptr ss:[ebp-64]
00403DA0 . 50 push eax
00403DA1 . 8D45 8C lea eax,dword ptr ss:[ebp-74]
00403DA4 . 50 push eax
00403DA5 . 89B5 0CFFFFFF mov dword ptr ss:[ebp-F4],esi
00403DAB . E8 00D9FFFF call <jmp.&MSVBVM60.__vbaVarCat>
00403DB0 . 50 push eax
00403DB1 . 8D85 0CFFFFFF lea eax,dword ptr ss:[ebp-F4]
00403DB7 . 50 push eax
00403DB8 . 8D85 7CFFFFFF lea eax,dword ptr ss:[ebp-84]
00403DBE . 50 push eax
00403DBF . E8 ECD8FFFF call <jmp.&MSVBVM60.__vbaVarCat>
00403DC4 . 50 push eax
00403DC5 . 8D85 6CFFFFFF lea eax,dword ptr ss:[ebp-94]
00403DCB . 50 push eax
00403DCC . E8 91400000 call <CrMe.xmd5>
00403DD1 . 8D85 6CFFFFFF lea eax,dword ptr ss:[ebp-94]
00403DD7 . C785 04FFFFFF>mov dword ptr ss:[ebp-FC],CrMe.0040284C ; UNICODE "033788636d9acb22"
00403DE1 . 50 push eax
00403DE2 . 8D85 FCFEFFFF lea eax,dword ptr ss:[ebp-104]
00403DE8 . 50 push eax
00403DE9 . 8D85 5CFFFFFF lea eax,dword ptr ss:[ebp-A4]
00403DEF . C785 FCFEFFFF>mov dword ptr ss:[ebp-104],8008
00403DF9 . 50 push eax
00403DFA . E8 B7D8FFFF call <jmp.&MSVBVM60.__vbaVarCmpEq>
.text:0040532D Form_Load proc near
.text:0040536B mov g_sn_len, 38h
BYTE data[53] = {
0x78, 0xFE, 0x63, 0xA7, 0xAB, 0x63, 0x6E, 0x4E, 0x6A, 0x61, 0xD6, 0xF3, 0x5A, 0xC6, 0x8C, 0xFB,
0xE0, 0x99, 0xE9, 0x02, 0x20, 0x6C, 0x4C, 0xFB, 0x4A, 0x8C, 0x17, 0x50, 0x36, 0x05, 0xF1, 0x21,
0xFD, 0xB2, 0x0A, 0x3C, 0xD1, 0xDB, 0x19, 0xA9, 0x49, 0x47, 0xA1, 0xC5, 0xF0, 0x8D, 0x9A, 0x5B,
0xA1, 0xCD, 0x2F, 0xAA, 0xA5
};
.text:00405399 txtInit_Change proc near
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
