-
-
[原创]laomms的crackme2-lx分析
-
2006-4-27 13:08
-
相关链接：
http://bbs.pediy.com/showthread.php?s=&threadid=24723
呵呵，我的爆破点好像跟你的不大一样。
0040595C . FF15 A4104000 call [<&MSVBVM60.__vbaVarTstEq>] ; 比对结果是否一致
00405962 . 66:8BD8 mov bx, ax
00405965 . 8D85 5CFFFFFF lea eax, [ebp-A4]
0040596B . 8D8D 60FFFFFF lea ecx, [ebp-A0]
00405971 . 50 push eax
00405972 . 8D95 64FFFFFF lea edx, [ebp-9C]
00405978 . 51 push ecx
00405979 . 52 push edx
0040597A . 6A 03 push 3
0040597C . FF15 38114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
00405982 . 83C4 10 add esp, 10
00405985 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
0040598B . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00405991 66:85DB test bx, bx ; 如上面比对结果不一致则OVER
00405994 0F84 99000000 je 00405A33 ; 爆破点，跳走就OVER
00404D30 > \55 push ebp ; 点击注册
00404D31 . 8BEC mov ebp, esp
00404D33 . 83EC 0C sub esp, 0C
00404D36 . 68 F6124000 push <jmp.&MSVBVM60.__vbaExceptHandle>; SE 处理程序安装
00404D3B . 64:A1 0000000>mov eax, fs:[0]
00404D41 . 50 push eax
00404D42 . 64:8925 00000>mov fs:[0], esp
00404D49 . 81EC 08020000 sub esp, 208
00404D4F . 53 push ebx
00404D50 . 56 push esi
00404D51 . 57 push edi
00404D52 . 8965 F4 mov [ebp-C], esp
00404D55 . C745 F8 A8114>mov dword ptr [ebp-8], 004011A8
00404D5C . 8B75 08 mov esi, [ebp+8]
00404D5F . 8BC6 mov eax, esi
00404D61 . 83E0 01 and eax, 1
00404D64 . 8945 FC mov [ebp-4], eax
00404D67 . 83E6 FE and esi, FFFFFFFE
00404D6A . 56 push esi
00404D6B . 8975 08 mov [ebp+8], esi
00404D6E . 8B0E mov ecx, [esi]
00404D70 . FF51 04 call [ecx+4]
00404D73 . 8B16 mov edx, [esi]
00404D75 . 33FF xor edi, edi
00404D77 . 56 push esi
00404D78 . 897D DC mov [ebp-24], edi
00404D7B . 897D CC mov [ebp-34], edi
00404D7E . 897D BC mov [ebp-44], edi
00404D81 . 897D B8 mov [ebp-48], edi
00404D84 . 897D B4 mov [ebp-4C], edi
00404D87 . 897D A4 mov [ebp-5C], edi
00404D8A . 897D A0 mov [ebp-60], edi
00404D8D . 897D 90 mov [ebp-70], edi
00404D90 . 897D 80 mov [ebp-80], edi
00404D93 . 89BD 68FFFFFF mov [ebp-98], edi
00404D99 . 89BD 64FFFFFF mov [ebp-9C], edi
00404D9F . 89BD 60FFFFFF mov [ebp-A0], edi
00404DA5 . 89BD 5CFFFFFF mov [ebp-A4], edi
00404DAB . 89BD 58FFFFFF mov [ebp-A8], edi
00404DB1 . 89BD 54FFFFFF mov [ebp-AC], edi
00404DB7 . 89BD 50FFFFFF mov [ebp-B0], edi
00404DBD . 89BD 40FFFFFF mov [ebp-C0], edi
00404DC3 . 89BD 30FFFFFF mov [ebp-D0], edi
00404DC9 . 89BD 20FFFFFF mov [ebp-E0], edi
00404DCF . 89BD 10FFFFFF mov [ebp-F0], edi
00404DD5 . 89BD 00FFFFFF mov [ebp-100], edi
00404DDB . 89BD F0FEFFFF mov [ebp-110], edi
00404DE1 . 89BD E0FEFFFF mov [ebp-120], edi
00404DE7 . 89BD D0FEFFFF mov [ebp-130], edi
00404DED . 89BD C0FEFFFF mov [ebp-140], edi
00404DF3 . 89BD B0FEFFFF mov [ebp-150], edi
00404DF9 . 89BD 90FEFFFF mov [ebp-170], edi
00404DFF . 89BD 8CFEFFFF mov [ebp-174], edi
00404E05 . 89BD 68FEFFFF mov [ebp-198], edi
00404E0B . 89BD 58FEFFFF mov [ebp-1A8], edi
00404E11 . 89BD 48FEFFFF mov [ebp-1B8], edi
00404E17 . 89BD 38FEFFFF mov [ebp-1C8], edi
00404E1D . FF92 14030000 call [edx+314]
00404E23 . 50 push eax
00404E24 . 8D85 54FFFFFF lea eax, [ebp-AC]
00404E2A . 50 push eax
00404E2B . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00404E31 . 8BD8 mov ebx, eax
00404E33 . 8D95 64FFFFFF lea edx, [ebp-9C]
00404E39 . 52 push edx
00404E3A . 53 push ebx
00404E3B . 8B0B mov ecx, [ebx]
00404E3D . FF91 A0000000 call [ecx+A0]
00404E43 . 3BC7 cmp eax, edi
00404E45 . DBE2 fclex
00404E47 . 7D 12 jge short 00404E5B
00404E49 . 68 A0000000 push 0A0
00404E4E . 68 1C3E4000 push 00403E1C
00404E53 . 53 push ebx
00404E54 . 50 push eax
00404E55 . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00404E5B > 8B06 mov eax, [esi]
00404E5D . 56 push esi
00404E5E . FF90 14030000 call [eax+314]
00404E64 . 8D8D 50FFFFFF lea ecx, [ebp-B0]
00404E6A . 50 push eax
00404E6B . 51 push ecx
00404E6C . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00404E72 . 8BD8 mov ebx, eax
00404E74 . 8D85 60FFFFFF lea eax, [ebp-A0]
00404E7A . 50 push eax
00404E7B . 53 push ebx
00404E7C . 8B13 mov edx, [ebx]
00404E7E . FF92 A0000000 call [edx+A0]
00404E84 . 3BC7 cmp eax, edi
00404E86 . DBE2 fclex
00404E88 . 7D 12 jge short 00404E9C
00404E8A . 68 A0000000 push 0A0
00404E8F . 68 1C3E4000 push 00403E1C
00404E94 . 53 push ebx
00404E95 . 50 push eax
00404E96 . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00404E9C > 8B8D 60FFFFFF mov ecx, [ebp-A0]
00404EA2 . 51 push ecx ; 用户名入栈
00404EA3 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00404EA9 . 8B95 64FFFFFF mov edx, [ebp-9C]
00404EAF . 33DB xor ebx, ebx
00404EB1 . 83F8 10 cmp eax, 10 ; 用户名长度与10比较
00404EB4 . 52 push edx
00404EB5 . 0F9FC3 setg bl
00404EB8 . F7DB neg ebx
00404EBA . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00404EC0 . 33C9 xor ecx, ecx
00404EC2 . 83F8 06 cmp eax, 6 ; 用户名长度与6比较
00404EC5 . 8D95 60FFFFFF lea edx, [ebp-A0]
00404ECB . 8D85 64FFFFFF lea eax, [ebp-9C]
00404ED1 . 0F9CC1 setl cl
00404ED4 . 52 push edx
00404ED5 . 50 push eax
00404ED6 . F7D9 neg ecx
00404ED8 . 6A 02 push 2
00404EDA . 0BD9 or ebx, ecx
00404EDC . FF15 38114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
00404EE2 . 8D8D 50FFFFFF lea ecx, [ebp-B0]
00404EE8 . 8D95 54FFFFFF lea edx, [ebp-AC]
00404EEE . 51 push ecx
00404EEF . 52 push edx
00404EF0 . 6A 02 push 2
00404EF2 . FF15 2C104000 call [<&MSVBVM60.__vbaFreeObjList>] ; MSVBVM60.__vbaFreeObjList
00404EF8 . 83C4 18 add esp, 18
00404EFB . 66:3BDF cmp bx, di
00404EFE . 0F84 EE000000 je 00404FF2
00404F04 . B9 04000280 mov ecx, 80020004
00404F09 . B8 0A000000 mov eax, 0A
00404F0E . 898D 18FFFFFF mov [ebp-E8], ecx
00404F14 . 898D 28FFFFFF mov [ebp-D8], ecx
00404F1A . 898D 38FFFFFF mov [ebp-C8], ecx
00404F20 . 8D95 D0FEFFFF lea edx, [ebp-130]
00404F26 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00404F2C . 8985 10FFFFFF mov [ebp-F0], eax
00404F32 . 8985 20FFFFFF mov [ebp-E0], eax
00404F38 . 8985 30FFFFFF mov [ebp-D0], eax
00404F3E . C785 D8FEFFFF>mov dword ptr [ebp-128], 00403E30
00404F48 . C785 D0FEFFFF>mov dword ptr [ebp-130], 8
00404F52 . FF15 58114000 call [<&MSVBVM60.__vbaVarDup>] ; MSVBVM60.__vbaVarDup
00404F58 . 8D85 10FFFFFF lea eax, [ebp-F0]
00404F5E . 8D8D 20FFFFFF lea ecx, [ebp-E0]
00404F64 . 50 push eax
00404F65 . 8D95 30FFFFFF lea edx, [ebp-D0]
00404F6B . 51 push ecx
00404F6C . 52 push edx
00404F6D . 8D85 40FFFFFF lea eax, [ebp-C0]
00404F73 . 57 push edi
00404F74 . 50 push eax
00404F75 . FF15 64104000 call [<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox
00404F7B . 8D8D 10FFFFFF lea ecx, [ebp-F0]
00404F81 . 8D95 20FFFFFF lea edx, [ebp-E0]
00404F87 . 51 push ecx
00404F88 . 8D85 30FFFFFF lea eax, [ebp-D0]
00404F8E . 52 push edx
00404F8F . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00404F95 . 50 push eax
00404F96 . 51 push ecx
00404F97 . 6A 04 push 4
00404F99 . FF15 20104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
00404F9F . 8B16 mov edx, [esi]
00404FA1 . 83C4 14 add esp, 14
00404FA4 . 56 push esi
00404FA5 . FF92 10030000 call [edx+310]
00404FAB . 50 push eax
00404FAC . 8D85 54FFFFFF lea eax, [ebp-AC]
00404FB2 . 50 push eax
00404FB3 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00404FB9 . 8BF0 mov esi, eax
00404FBB . 68 483E4000 push 00403E48
00404FC0 . 56 push esi
00404FC1 . 8B0E mov ecx, [esi]
00404FC3 . FF91 A4000000 call [ecx+A4]
00404FC9 . 3BC7 cmp eax, edi
00404FCB . DBE2 fclex
00404FCD . 7D 12 jge short 00404FE1
00404FCF . 68 A4000000 push 0A4
00404FD4 . 68 1C3E4000 push 00403E1C
00404FD9 . 56 push esi
00404FDA . 50 push eax
00404FDB . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00404FE1 > 8D8D 54FFFFFF lea ecx, [ebp-AC]
00404FE7 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00404FED . E9 CD0C0000 jmp 00405CBF
00404FF2 > 8B16 mov edx, [esi]
00404FF4 . 56 push esi
00404FF5 . FF92 24030000 call [edx+324]
00404FFB . 50 push eax
00404FFC . 8D85 54FFFFFF lea eax, [ebp-AC]
00405002 . 50 push eax
00405003 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00405009 . 8BD8 mov ebx, eax
0040500B . 8D95 64FFFFFF lea edx, [ebp-9C]
00405011 . 52 push edx
00405012 . 53 push ebx
00405013 . 8B0B mov ecx, [ebx]
00405015 . FF91 A0000000 call [ecx+A0]
0040501B . 3BC7 cmp eax, edi
0040501D . DBE2 fclex
0040501F . 7D 12 jge short 00405033
00405021 . 68 A0000000 push 0A0
00405026 . 68 1C3E4000 push 00403E1C
0040502B . 53 push ebx
0040502C . 50 push eax
0040502D . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405033 > 8B85 64FFFFFF mov eax, [ebp-9C]
00405039 . 50 push eax ; 用户信箱入栈
0040503A . 68 483E4000 push 00403E48
0040503F . FF15 9C104000 call [<&MSVBVM60.__vbaStrCmp>] ; MSVBVM60.__vbaStrCmp
00405045 . 8BD8 mov ebx, eax
00405047 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
0040504D . F7DB neg ebx
0040504F . 1BDB sbb ebx, ebx
00405051 . 43 inc ebx
00405052 . F7DB neg ebx
00405054 . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0040505A . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405060 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00405066 . 66:3BDF cmp bx, di
00405069 . 0F84 A3000000 je 00405112
0040506F . B9 04000280 mov ecx, 80020004
00405074 . B8 0A000000 mov eax, 0A
00405079 . 898D 18FFFFFF mov [ebp-E8], ecx
0040507F . 8985 10FFFFFF mov [ebp-F0], eax
00405085 . 898D 28FFFFFF mov [ebp-D8], ecx
0040508B . 8985 20FFFFFF mov [ebp-E0], eax
00405091 . 898D 38FFFFFF mov [ebp-C8], ecx
00405097 . 8985 30FFFFFF mov [ebp-D0], eax
0040509D . C785 D8FEFFFF>mov dword ptr [ebp-128], 00403E50
004050A7 > 8D95 D0FEFFFF lea edx, [ebp-130]
004050AD . 8D8D 40FFFFFF lea ecx, [ebp-C0]
004050B3 . C785 D0FEFFFF>mov dword ptr [ebp-130], 8
004050BD . FF15 58114000 call [<&MSVBVM60.__vbaVarDup>] ; MSVBVM60.__vbaVarDup
004050C3 . 8D8D 10FFFFFF lea ecx, [ebp-F0]
004050C9 . 8D95 20FFFFFF lea edx, [ebp-E0]
004050CF . 51 push ecx
004050D0 . 8D85 30FFFFFF lea eax, [ebp-D0]
004050D6 . 52 push edx
004050D7 . 50 push eax
004050D8 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
004050DE . 57 push edi
004050DF . 51 push ecx
004050E0 . FF15 64104000 call [<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox
004050E6 . 8D95 10FFFFFF lea edx, [ebp-F0]
004050EC . 8D85 20FFFFFF lea eax, [ebp-E0]
004050F2 . 52 push edx
004050F3 . 8D8D 30FFFFFF lea ecx, [ebp-D0]
004050F9 . 50 push eax
004050FA . 8D95 40FFFFFF lea edx, [ebp-C0]
00405100 . 51 push ecx
00405101 . 52 push edx
00405102 . 6A 04 push 4
00405104 . FF15 20104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
0040510A . 83C4 14 add esp, 14
0040510D . E9 AD0B0000 jmp 00405CBF
00405112 > 8B06 mov eax, [esi]
00405114 . 56 push esi
00405115 . FF90 24030000 call [eax+324]
0040511B . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405121 . 50 push eax
00405122 . 51 push ecx
00405123 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00405129 . 8BD8 mov ebx, eax
0040512B . 8D85 64FFFFFF lea eax, [ebp-9C]
00405131 . 50 push eax
00405132 . 53 push ebx
00405133 . 8B13 mov edx, [ebx]
00405135 . FF92 A0000000 call [edx+A0]
0040513B . 3BC7 cmp eax, edi
0040513D . DBE2 fclex
0040513F . 7D 12 jge short 00405153
00405141 . 68 A0000000 push 0A0
00405146 . 68 1C3E4000 push 00403E1C
0040514B . 53 push ebx
0040514C . 50 push eax
0040514D . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405153 > 8B85 64FFFFFF mov eax, [ebp-9C]
00405159 . 8B0E mov ecx, [esi]
0040515B . 8D95 8CFEFFFF lea edx, [ebp-174]
00405161 . 52 push edx
00405162 . 50 push eax
00405163 . 56 push esi
00405164 . FF91 F8060000 call [ecx+6F8] ; 确认信箱是否符合常规
0040516A . 3BC7 cmp eax, edi
0040516C . 7D 12 jge short 00405180
0040516E . 68 F8060000 push 6F8
00405173 . 68 843C4000 push 00403C84
00405178 . 56 push esi
00405179 . 50 push eax
0040517A . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405180 > 33DB xor ebx, ebx
00405182 . 66:39BD 8CFEF>cmp [ebp-174], di
00405189 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
0040518F . 0F94C3 sete bl
00405192 . F7DB neg ebx
00405194 . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0040519A . 8D8D 54FFFFFF lea ecx, [ebp-AC]
004051A0 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
004051A6 . 66:3BDF cmp bx, di
004051A9 . 74 3D je short 004051E8
004051AB . B9 04000280 mov ecx, 80020004
004051B0 . B8 0A000000 mov eax, 0A
004051B5 . 898D 18FFFFFF mov [ebp-E8], ecx
004051BB . 8985 10FFFFFF mov [ebp-F0], eax
004051C1 . 898D 28FFFFFF mov [ebp-D8], ecx
004051C7 . 8985 20FFFFFF mov [ebp-E0], eax
004051CD . 898D 38FFFFFF mov [ebp-C8], ecx
004051D3 . 8985 30FFFFFF mov [ebp-D0], eax
004051D9 . C785 D8FEFFFF>mov dword ptr [ebp-128], 00403E68
004051E3 .^ E9 BFFEFFFF jmp 004050A7
004051E8 > 8B06 mov eax, [esi]
004051EA . 56 push esi
004051EB . FF90 24030000 call [eax+324]
004051F1 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
004051F7 . 50 push eax
004051F8 . 51 push ecx
004051F9 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
004051FF . 8BD8 mov ebx, eax
00405201 . 8D85 64FFFFFF lea eax, [ebp-9C]
00405207 . 50 push eax
00405208 . 53 push ebx
00405209 . 8B13 mov edx, [ebx]
0040520B . FF92 A0000000 call [edx+A0]
00405211 . 3BC7 cmp eax, edi
00405213 . DBE2 fclex
00405215 . 7D 12 jge short 00405229
00405217 . 68 A0000000 push 0A0
0040521C . 68 1C3E4000 push 00403E1C
00405221 . 53 push ebx
00405222 . 50 push eax
00405223 . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405229 > 8B8D 64FFFFFF mov ecx, [ebp-9C]
0040522F . 51 push ecx ; 信箱入栈
00405230 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00405236 . 8D95 D0FEFFFF lea edx, [ebp-130]
0040523C . 8D4D CC lea ecx, [ebp-34]
0040523F . 8985 D8FEFFFF mov [ebp-128], eax
00405245 . C785 D0FEFFFF>mov dword ptr [ebp-130], 3
0040524F . FF15 0C104000 call [<&MSVBVM60.__vbaVarMove>] ; MSVBVM60.__vbaVarMove
00405255 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
0040525B . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
00405261 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405267 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
0040526D . 8B1D 34114000 mov ebx, [<&MSVBVM60.__vbaStrCopy>] ; MSVBVM60.__vbaStrCopy
00405273 . BA 843E4000 mov edx, 00403E84 ; UNICODE "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
00405278 . 8D4D B4 lea ecx, [ebp-4C]
0040527B . FFD3 call ebx ; <&MSVBVM60.__vbaStrCopy>
0040527D . BA 1C3F4000 mov edx, 00403F1C ; UNICODE "dflgfgoOKOFVofgkOFlkLkKPkOKoPiRevHHklYtHJhjKLhyuYjkM"
00405282 . 8D4D A0 lea ecx, [ebp-60]
00405285 . FFD3 call ebx ; StrCopy
00405287 . 8B16 mov edx, [esi]
00405289 . 56 push esi
0040528A . C785 D8FEFFFF>mov dword ptr [ebp-128], 1
00405294 . C785 D0FEFFFF>mov dword ptr [ebp-130], 2
0040529E . FF92 14030000 call [edx+314]
004052A4 . 50 push eax
004052A5 . 8D85 54FFFFFF lea eax, [ebp-AC]
004052AB . 50 push eax
004052AC . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
004052B2 . 8BD8 mov ebx, eax
004052B4 . 8D95 64FFFFFF lea edx, [ebp-9C]
004052BA . 52 push edx
004052BB . 53 push ebx
004052BC . 8B0B mov ecx, [ebx]
004052BE . FF91 A0000000 call [ecx+A0]
004052C4 . 3BC7 cmp eax, edi
004052C6 . DBE2 fclex
004052C8 . 7D 12 jge short 004052DC
004052CA . 68 A0000000 push 0A0
004052CF . 68 1C3E4000 push 00403E1C
004052D4 . 53 push ebx
004052D5 . 50 push eax
004052D6 . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
004052DC > 8B85 64FFFFFF mov eax, [ebp-9C]
004052E2 . 50 push eax ; 用户名入栈
004052E3 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
004052E9 . 8D8D D0FEFFFF lea ecx, [ebp-130]
004052EF . 8985 C8FEFFFF mov [ebp-138], eax
004052F5 . 8D95 C0FEFFFF lea edx, [ebp-140]
004052FB . 51 push ecx
004052FC . 8D85 B0FEFFFF lea eax, [ebp-150]
00405302 . 52 push edx
00405303 . 8D8D 58FEFFFF lea ecx, [ebp-1A8]
00405309 . 50 push eax
0040530A . 8D95 68FEFFFF lea edx, [ebp-198]
00405310 . 51 push ecx
00405311 . 8D45 DC lea eax, [ebp-24]
00405314 . 52 push edx
00405315 . 50 push eax
00405316 . C785 C0FEFFFF>mov dword ptr [ebp-140], 3
00405320 . C785 B8FEFFFF>mov dword ptr [ebp-148], 1
0040532A . C785 B0FEFFFF>mov dword ptr [ebp-150], 2
00405334 . FF15 58104000 call [<&MSVBVM60.__vbaVarForInit>] ; MSVBVM60.__vbaVarForInit
0040533A . 8D8D 64FFFFFF lea ecx, [ebp-9C]
00405340 . 8BD8 mov ebx, eax
00405342 . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
00405348 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
0040534E . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00405354 . 8B3D 84104000 mov edi, [<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
0040535A > 85DB test ebx, ebx ; 大循环开始
0040535C . 0F84 39040000 je 0040579B
00405362 . 8B0E mov ecx, [esi]
00405364 . 56 push esi
00405365 . FF91 14030000 call [ecx+314]
0040536B . 8D95 54FFFFFF lea edx, [ebp-AC]
00405371 . 50 push eax
00405372 . 52 push edx
00405373 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00405379 . 8BD8 mov ebx, eax
0040537B . 8D8D 64FFFFFF lea ecx, [ebp-9C]
00405381 . 51 push ecx
00405382 . 53 push ebx
00405383 . 8B03 mov eax, [ebx]
00405385 . FF90 A0000000 call [eax+A0]
0040538B . 85C0 test eax, eax
0040538D . DBE2 fclex
0040538F . 7D 12 jge short 004053A3
00405391 . 68 A0000000 push 0A0
00405396 . 68 1C3E4000 push 00403E1C
0040539B . 53 push ebx
0040539C . 50 push eax
0040539D . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
004053A3 > 8B85 64FFFFFF mov eax, [ebp-9C] ; 用户名入eax
004053A9 . 8B1D 4C114000 mov ebx, [<&MSVBVM60.__vbaI4Var>] ; MSVBVM60.__vbaI4Var
004053AF . 8985 48FFFFFF mov [ebp-B8], eax
004053B5 . 8D95 30FFFFFF lea edx, [ebp-D0]
004053BB . 8D45 DC lea eax, [ebp-24]
004053BE . 52 push edx
004053BF . 50 push eax
004053C0 . C785 38FFFFFF>mov dword ptr [ebp-C8], 1
004053CA . C785 30FFFFFF>mov dword ptr [ebp-D0], 2
004053D4 . C785 64FFFFFF>mov dword ptr [ebp-9C], 0
004053DE . C785 40FFFFFF>mov dword ptr [ebp-C0], 8
004053E8 . FFD3 call ebx ; <&MSVBVM60.__vbaI4Var>
004053EA . 8D8D 40FFFFFF lea ecx, [ebp-C0]
004053F0 . 50 push eax
004053F1 . 8D95 20FFFFFF lea edx, [ebp-E0]
004053F7 . 51 push ecx
004053F8 . 52 push edx
004053F9 . FFD7 call edi
004053FB . 8B45 B8 mov eax, [ebp-48]
004053FE . 8B4D B4 mov ecx, [ebp-4C]
00405401 . 8985 98FEFFFF mov [ebp-168], eax
00405407 . B8 08000000 mov eax, 8
0040540C . 8985 90FEFFFF mov [ebp-170], eax
00405412 . 8985 C0FEFFFF mov [ebp-140], eax
00405418 . 8D55 A0 lea edx, [ebp-60]
0040541B . 8D85 00FFFFFF lea eax, [ebp-100]
00405421 . 898D C8FEFFFF mov [ebp-138], ecx
00405427 . 8995 B8FEFFFF mov [ebp-148], edx
0040542D . 50 push eax
0040542E . 8D8D C0FEFFFF lea ecx, [ebp-140]
00405434 . 6A 01 push 1
00405436 . 8D95 20FFFFFF lea edx, [ebp-E0]
0040543C . 51 push ecx ; 字符串1内存地址入栈
0040543D . 52 push edx ; 字符串2内存地址入栈
0040543E . 8D85 10FFFFFF lea eax, [ebp-F0]
00405444 . 6A 00 push 0
00405446 . 50 push eax
00405447 . C785 08FFFFFF>mov dword ptr [ebp-F8], 1
00405451 . C785 00FFFFFF>mov dword ptr [ebp-100], 2
0040545B . C785 B0FEFFFF>mov dword ptr [ebp-150], 4008
00405465 . FF15 F8104000 call [<&MSVBVM60.__vbaInStrVar>] ; 查表，得到结果InStr1Var
0040546B . 50 push eax
0040546C . FFD3 call ebx ; Mid（Str2，InStr1Var,1）
0040546E . 8D8D B0FEFFFF lea ecx, [ebp-150]
00405474 . 50 push eax
00405475 . 8D95 F0FEFFFF lea edx, [ebp-110]
0040547B . 51 push ecx
0040547C . 52 push edx
0040547D . FFD7 call edi
0040547F . 8D85 90FEFFFF lea eax, [ebp-170]
00405485 . 8D8D F0FEFFFF lea ecx, [ebp-110]
0040548B . 50 push eax
0040548C . 8D95 E0FEFFFF lea edx, [ebp-120]
00405492 . 51 push ecx
00405493 . 52 push edx
00405494 . FF15 04114000 call [<&MSVBVM60.__vbaVarCat>] ; MSVBVM60.__vbaVarCat
0040549A . 50 push eax
0040549B . FF15 1C104000 call [<&MSVBVM60.__vbaStrVarMove>] ; MSVBVM60.__vbaStrVarMove
004054A1 . 8BD0 mov edx, eax
004054A3 . 8D4D B8 lea ecx, [ebp-48]
004054A6 . FF15 64114000 call [<&MSVBVM60.__vbaStrMove>] ; MSVBVM60.__vbaStrMove
004054AC . 8D8D 54FFFFFF lea ecx, [ebp-AC]
004054B2 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
004054B8 . 8D85 E0FEFFFF lea eax, [ebp-120]
004054BE . 8D8D F0FEFFFF lea ecx, [ebp-110]
004054C4 . 50 push eax
004054C5 . 8D95 00FFFFFF lea edx, [ebp-100]
004054CB . 51 push ecx
004054CC . 8D85 10FFFFFF lea eax, [ebp-F0]
004054D2 . 52 push edx
004054D3 . 8D8D 20FFFFFF lea ecx, [ebp-E0]
004054D9 . 50 push eax
004054DA . 8D95 30FFFFFF lea edx, [ebp-D0]
004054E0 . 51 push ecx
004054E1 . 8D85 40FFFFFF lea eax, [ebp-C0]
004054E7 . 52 push edx
004054E8 . 50 push eax
004054E9 . 6A 07 push 7
004054EB . FF15 20104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
004054F1 . 8B4D B8 mov ecx, [ebp-48] ; 解码后字符串入ecx
004054F4 . 83C4 20 add esp, 20
004054F7 . 51 push ecx ; 解码后字符串入栈
004054F8 . FF15 30104000 call [<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
004054FE . 0FBFD0 movsx edx, ax
00405501 . 8B45 B8 mov eax, [ebp-48] ; 追加本次解码字符
00405504 . 8995 20FEFFFF mov [ebp-1E0], edx
0040550A . DB85 20FEFFFF fild dword ptr [ebp-1E0]
00405510 . 50 push eax
00405511 . DD9D 18FEFFFF fstp qword ptr [ebp-1E8]
00405517 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
0040551D . 8985 14FEFFFF mov [ebp-1EC], eax
00405523 . DB85 14FEFFFF fild dword ptr [ebp-1EC]
00405529 . DD9D 0CFEFFFF fstp qword ptr [ebp-1F4]
0040552F . DD85 18FEFFFF fld qword ptr [ebp-1E8]
00405535 . 833D 00A04000>cmp dword ptr [40A000], 0
0040553C . 75 08 jnz short 00405546
0040553E . DCB5 0CFEFFFF fdiv qword ptr [ebp-1F4] ; 首次解码字符dec/本解码字符串长度
00405544 . EB 11 jmp short 00405557
00405546 > FFB5 10FEFFFF push dword ptr [ebp-1F0]
0040554C . FFB5 0CFEFFFF push dword ptr [ebp-1F4]
00405552 . E8 BDBDFFFF call <jmp.&MSVBVM60._adj_fdiv_m64>
00405557 > DFE0 fstsw ax
00405559 . A8 0D test al, 0D
0040555B . 0F85 68080000 jnz 00405DC9
00405561 . FF15 28104000 call [<&MSVBVM60.__vbaFpCDblR8>] ; MSVBVM60.__vbaFpCDblR8
00405567 . 8B1D D8104000 mov ebx, [<&MSVBVM60.__vbaVarMul>] ; MSVBVM60.__vbaVarMul
0040556D . 8D8D C0FEFFFF lea ecx, [ebp-140]
00405573 . DD9D C8FEFFFF fstp qword ptr [ebp-138]
00405579 . 8D55 CC lea edx, [ebp-34]
0040557C . 51 push ecx
0040557D . 8D85 D0FEFFFF lea eax, [ebp-130]
00405583 . 52 push edx
00405584 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
0040558A . 50 push eax
0040558B . 51 push ecx
0040558C . C785 C0FEFFFF>mov dword ptr [ebp-140], 5
00405596 . C785 D8FEFFFF>mov dword ptr [ebp-128], 3
004055A0 . C785 D0FEFFFF>mov dword ptr [ebp-130], 2
004055AA . FFD3 call ebx ; 3*length（mail）; <&MSVBVM60.__vbaVarMul>
004055AC . 8D95 30FFFFFF lea edx, [ebp-D0]
004055B2 . 50 push eax
004055B3 . 52 push edx
004055B4 . FFD3 call ebx ; (首次解码字符dec/解码字符串长度)X(3*length(mail))
004055B6 . 50 push eax ; 本例中，最终结果＝(3*length（mail））*HEXTODEC(MID(STR,1,1))/Length（str）=210
004055B7 . 8D85 20FFFFFF lea eax, [ebp-E0]
004055BD . 50 push eax
004055BE . FF15 34104000 call [<&MSVBVM60.__vbaVarFix>] ; MSVBVM60.__vbaVarFix
004055C4 . 8BD0 mov edx, eax
004055C6 . 8D4D A4 lea ecx, [ebp-5C]
004055C9 . FF15 0C104000 call [<&MSVBVM60.__vbaVarMove>] ; MSVBVM60.__vbaVarMove
004055CF . 8B0E mov ecx, [esi]
004055D1 . 56 push esi
004055D2 . C785 D8FEFFFF>mov dword ptr [ebp-128], 1
004055DC . C785 D0FEFFFF>mov dword ptr [ebp-130], 2
004055E6 . FF91 14030000 call [ecx+314]
004055EC . 8D95 54FFFFFF lea edx, [ebp-AC]
004055F2 . 50 push eax
004055F3 . 52 push edx
004055F4 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
004055FA . 8BD8 mov ebx, eax
004055FC . 8D8D 64FFFFFF lea ecx, [ebp-9C]
00405602 . 51 push ecx
00405603 . 53 push ebx
00405604 . 8B03 mov eax, [ebx]
00405606 . FF90 A0000000 call [eax+A0]
0040560C . 85C0 test eax, eax
0040560E . DBE2 fclex
00405610 . 7D 12 jge short 00405624
00405612 . 68 A0000000 push 0A0
00405617 . 68 1C3E4000 push 00403E1C
0040561C . 53 push ebx
0040561D . 50 push eax
0040561E . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405624 > 8B95 64FFFFFF mov edx, [ebp-9C]
0040562A . 52 push edx ; 用户名入栈
0040562B . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; 取用户名长度入eax
00405631 . 8985 C8FEFFFF mov [ebp-138], eax
00405637 . 8D85 D0FEFFFF lea eax, [ebp-130]
0040563D . 8D8D C0FEFFFF lea ecx, [ebp-140]
00405643 . 50 push eax
00405644 . 8D95 B0FEFFFF lea edx, [ebp-150]
0040564A . 51 push ecx
0040564B . 8D85 38FEFFFF lea eax, [ebp-1C8]
00405651 . 52 push edx
00405652 . 8D8D 48FEFFFF lea ecx, [ebp-1B8]
00405658 . 50 push eax
00405659 . 8D55 BC lea edx, [ebp-44]
0040565C . 51 push ecx
0040565D . 52 push edx
0040565E . C785 C0FEFFFF>mov dword ptr [ebp-140], 3
00405668 . C785 B8FEFFFF>mov dword ptr [ebp-148], 1
00405672 . C785 B0FEFFFF>mov dword ptr [ebp-150], 2
0040567C . FF15 58104000 call [<&MSVBVM60.__vbaVarForInit>] ; MSVBVM60.__vbaVarForInit
00405682 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
00405688 . 8BD8 mov ebx, eax
0040568A . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
00405690 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405696 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
0040569C > 85DB test ebx, ebx ; 小循环开始
0040569E . 0F84 D8000000 je 0040577C
004056A4 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
004056AA . 8D55 DC lea edx, [ebp-24]
004056AD . BB 02000000 mov ebx, 2
004056B2 . 8D45 B8 lea eax, [ebp-48]
004056B5 . 51 push ecx
004056B6 . 52 push edx
004056B7 . C785 48FFFFFF>mov dword ptr [ebp-B8], 1
004056C1 . 899D 40FFFFFF mov [ebp-C0], ebx
004056C7 . 8985 D8FEFFFF mov [ebp-128], eax
004056CD . C785 D0FEFFFF>mov dword ptr [ebp-130], 4008
004056D7 . FF15 4C114000 call [<&MSVBVM60.__vbaI4Var>] ; MSVBVM60.__vbaI4Var
004056DD . 50 push eax
004056DE . 8D85 D0FEFFFF lea eax, [ebp-130]
004056E4 . 8D8D 30FFFFFF lea ecx, [ebp-D0]
004056EA . 50 push eax
004056EB . 51 push ecx
004056EC . FFD7 call edi
004056EE . 8D95 30FFFFFF lea edx, [ebp-D0]
004056F4 . 8D85 64FFFFFF lea eax, [ebp-9C]
004056FA . 52 push edx
004056FB . 50 push eax
004056FC . FF15 00114000 call [<&MSVBVM60.__vbaStrVarVal>] ; MSVBVM60.__vbaStrVarVal
00405702 . 50 push eax
00405703 . FF15 30104000 call [<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00405709 . 8D4D 90 lea ecx, [ebp-70]
0040570C . 66:8985 B8FEF>mov [ebp-148], ax
00405713 . 8D95 B0FEFFFF lea edx, [ebp-150]
00405719 . 51 push ecx
0040571A . 8D85 20FFFFFF lea eax, [ebp-E0]
00405720 . 52 push edx
00405721 . 50 push eax
00405722 . 899D B0FEFFFF mov [ebp-150], ebx
00405728 . FF15 50114000 call [<&MSVBVM60.__vbaVarAdd>] ; 将解码的单个字符自身相加，最后得到HEX值
0040572E . 8BD0 mov edx, eax
00405730 . 8D4D 90 lea ecx, [ebp-70]
00405733 . FF15 0C104000 call [<&MSVBVM60.__vbaVarMove>] ; MSVBVM60.__vbaVarMove
00405739 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
0040573F . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
00405745 . 8D8D 30FFFFFF lea ecx, [ebp-D0]
0040574B . 8D95 40FFFFFF lea edx, [ebp-C0]
00405751 . 51 push ecx
00405752 . 52 push edx
00405753 . 53 push ebx
00405754 . FF15 20104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
0040575A . 83C4 0C add esp, 0C
0040575D . 8D85 38FEFFFF lea eax, [ebp-1C8]
00405763 . 8D8D 48FEFFFF lea ecx, [ebp-1B8]
00405769 . 8D55 BC lea edx, [ebp-44]
0040576C . 50 push eax
0040576D . 51 push ecx
0040576E . 52 push edx
0040576F . FF15 74114000 call [<&MSVBVM60.__vbaVarForNext>] ; MSVBVM60.__vbaVarForNext
00405775 . 8BD8 mov ebx, eax
00405777 .^ E9 20FFFFFF jmp 0040569C ; 小循环，次数等于Length（用户名）
0040577C > 8D85 58FEFFFF lea eax, [ebp-1A8] ; 最后得到HEX为本次循环之解密码XLength（用户名）
00405782 . 8D8D 68FEFFFF lea ecx, [ebp-198]
00405788 . 50 push eax
00405789 . 8D55 DC lea edx, [ebp-24]
0040578C . 51 push ecx
0040578D . 52 push edx
0040578E . FF15 74114000 call [<&MSVBVM60.__vbaVarForNext>] ; MSVBVM60.__vbaVarForNext
00405794 . 8BD8 mov ebx, eax
00405796 .^ E9 BFFBFFFF jmp 0040535A ; 大循环
0040579B > 8B06 mov eax, [esi] ; 大循环结束后，HEX值为所有解码字符之HEX乘以Length（用户名）之总和
0040579D . 56 push esi
0040579E . FF90 10030000 call [eax+310]
004057A4 . 8B1D 60104000 mov ebx, [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
004057AA . 8D8D 54FFFFFF lea ecx, [ebp-AC]
004057B0 . 50 push eax
004057B1 . 51 push ecx
004057B2 . FFD3 call ebx ; <&MSVBVM60.__vbaObjSet>
004057B4 . 8BF8 mov edi, eax
004057B6 . 8D85 64FFFFFF lea eax, [ebp-9C]
004057BC . 50 push eax
004057BD . 57 push edi
004057BE . 8B17 mov edx, [edi]
004057C0 . FF92 A0000000 call [edx+A0]
004057C6 . 85C0 test eax, eax
004057C8 . DBE2 fclex
004057CA . 7D 12 jge short 004057DE
004057CC . 68 A0000000 push 0A0
004057D1 . 68 1C3E4000 push 00403E1C
004057D6 . 57 push edi
004057D7 . 50 push eax
004057D8 . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
004057DE > 8B8D 64FFFFFF mov ecx, [ebp-9C]
004057E4 . 51 push ecx ; 注册码入栈
004057E5 . FF15 84114000 call [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
004057EB . FF15 74104000 call [<&MSVBVM60.__vbaFPFix>] ; MSVBVM60.__vbaFPFix
004057F1 . 833D 00A04000>cmp dword ptr [40A000], 0
004057F8 . 75 08 jnz short 00405802
004057FA . DC35 A0114000 fdiv qword ptr [4011A0] ; 注册码/2
00405800 . EB 11 jmp short 00405813
00405802 > FF35 A4114000 push dword ptr [4011A4]
00405808 . FF35 A0114000 push dword ptr [4011A0]
0040580E . E8 01BBFFFF call <jmp.&MSVBVM60._adj_fdiv_m64>
00405813 > 8D95 D0FEFFFF lea edx, [ebp-130]
00405819 . 8D8D 68FFFFFF lea ecx, [ebp-98]
0040581F . C785 D0FEFFFF>mov dword ptr [ebp-130], 5
00405829 . DD9D D8FEFFFF fstp qword ptr [ebp-128]
0040582F . DFE0 fstsw ax
00405831 . A8 0D test al, 0D
00405833 . 0F85 90050000 jnz 00405DC9
00405839 . FF15 0C104000 call [<&MSVBVM60.__vbaVarMove>] ; MSVBVM60.__vbaVarMove
0040583F . 8D8D 64FFFFFF lea ecx, [ebp-9C]
00405845 . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0040584B . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405851 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00405857 . 8B16 mov edx, [esi]
00405859 . 56 push esi
0040585A . FF92 24030000 call [edx+324]
00405860 . 50 push eax
00405861 . 8D85 54FFFFFF lea eax, [ebp-AC]
00405867 . 50 push eax
00405868 . FFD3 call ebx
0040586A . 8BF8 mov edi, eax
0040586C . 8D95 5CFFFFFF lea edx, [ebp-A4]
00405872 . 52 push edx
00405873 . 57 push edi
00405874 . 8B0F mov ecx, [edi]
00405876 . FF91 A0000000 call [ecx+A0]
0040587C . 85C0 test eax, eax
0040587E . DBE2 fclex
00405880 . 7D 12 jge short 00405894
00405882 . 68 A0000000 push 0A0
00405887 . 68 1C3E4000 push 00403E1C
0040588C . 57 push edi
0040588D . 50 push eax
0040588E . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405894 > 8B3D 00114000 mov edi, [<&MSVBVM60.__vbaStrVarVal>>; MSVBVM60.__vbaStrVarVal
0040589A . 8D85 68FFFFFF lea eax, [ebp-98]
004058A0 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
004058A6 . 50 push eax
004058A7 . 51 push ecx
004058A8 . FFD7 call edi ; <&MSVBVM60.__vbaStrVarVal>
004058AA . 50 push eax ; 以上取注册码/2后的结果入eax
004058AB . FF15 84114000 call [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
004058B1 . DD9D D8FEFFFF fstp qword ptr [ebp-128]
004058B7 . 8D55 90 lea edx, [ebp-70]
004058BA . 8D85 60FFFFFF lea eax, [ebp-A0]
004058C0 . 52 push edx
004058C1 . 50 push eax
004058C2 . C785 D0FEFFFF>mov dword ptr [ebp-130], 5
004058CC . FFD7 call edi ; 大循环结束之HEXTODEC
004058CE . 50 push eax
004058CF . FF15 84114000 call [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
004058D5 . 8B8D 5CFFFFFF mov ecx, [ebp-A4] ; 信箱入ecx
004058DB . DD9D 04FEFFFF fstp qword ptr [ebp-1FC]
004058E1 . 51 push ecx
004058E2 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
004058E8 . 8985 00FEFFFF mov [ebp-200], eax
004058EE . 8D95 D0FEFFFF lea edx, [ebp-130]
004058F4 . DB85 00FEFFFF fild dword ptr [ebp-200]
004058FA . 52 push edx
004058FB . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00405901 . C785 C0FEFFFF>mov dword ptr [ebp-140], 8005
0040590B . DD9D F8FDFFFF fstp qword ptr [ebp-208]
00405911 . DD85 04FEFFFF fld qword ptr [ebp-1FC]
00405917 . 833D 00A04000>cmp dword ptr [40A000], 0
0040591E . 75 08 jnz short 00405928
00405920 . DCB5 F8FDFFFF fdiv qword ptr [ebp-208] ; HEXTODEC/信箱长度
00405926 . EB 11 jmp short 00405939
00405928 > FFB5 FCFDFFFF push dword ptr [ebp-204]
0040592E . FFB5 F8FDFFFF push dword ptr [ebp-208]
00405934 . E8 DBB9FFFF call <jmp.&MSVBVM60._adj_fdiv_m64>
00405939 > DD9D C8FEFFFF fstp qword ptr [ebp-138]
0040593F . DFE0 fstsw ax
00405941 . A8 0D test al, 0D
00405943 . 0F85 80040000 jnz 00405DC9
00405949 . 8D45 A4 lea eax, [ebp-5C]
0040594C . 50 push eax
0040594D . 51 push ecx
0040594E . FF15 EC104000 call [<&MSVBVM60.__vbaVarDiv>] ; 注册码/2的结果/（3*length(mail)*HEXTODEC(MID(加密码，1,1）/length（加密码））
00405954 . 8D95 C0FEFFFF lea edx, [ebp-140] ; 以上结果＝918
0040595A . 50 push eax
0040595B . 52 push edx
0040595C . FF15 A4104000 call [<&MSVBVM60.__vbaVarTstEq>] ; 比对结果是否一致
00405962 . 66:8BD8 mov bx, ax
00405965 . 8D85 5CFFFFFF lea eax, [ebp-A4]
0040596B . 8D8D 60FFFFFF lea ecx, [ebp-A0]
00405971 . 50 push eax
00405972 . 8D95 64FFFFFF lea edx, [ebp-9C]
00405978 . 51 push ecx
00405979 . 52 push edx
0040597A . 6A 03 push 3
0040597C . FF15 38114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
00405982 . 83C4 10 add esp, 10
00405985 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
0040598B . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00405991 66:85DB test bx, bx ; 如上面比对结果不一致则OVER
00405994 0F84 99000000 je 00405A33 ; 爆破点，跳走就OVER
0040599A . B9 04000280 mov ecx, 80020004
0040599F . B8 0A000000 mov eax, 0A
004059A4 . 898D 18FFFFFF mov [ebp-E8], ecx
004059AA . 898D 28FFFFFF mov [ebp-D8], ecx
004059B0 . 898D 38FFFFFF mov [ebp-C8], ecx
004059B6 . 8D95 D0FEFFFF lea edx, [ebp-130]
004059BC . 8D8D 40FFFFFF lea ecx, [ebp-C0]
004059C2 . 8985 10FFFFFF mov [ebp-F0], eax
004059C8 . 8985 20FFFFFF mov [ebp-E0], eax
004059CE . 8985 30FFFFFF mov [ebp-D0], eax
004059D4 . C785 D8FEFFFF>mov dword ptr [ebp-128], 00403F8C
004059DE . C785 D0FEFFFF>mov dword ptr [ebp-130], 8
004059E8 . FF15 58114000 call [<&MSVBVM60.__vbaVarDup>] ; MSVBVM60.__vbaVarDup
004059EE . 8D85 10FFFFFF lea eax, [ebp-F0]
004059F4 . 8D8D 20FFFFFF lea ecx, [ebp-E0]
004059FA . 50 push eax
004059FB . 8D95 30FFFFFF lea edx, [ebp-D0]
00405A01 . 51 push ecx
00405A02 . 52 push edx
00405A03 . 8D85 40FFFFFF lea eax, [ebp-C0]
00405A09 . 6A 00 push 0
00405A0B . 50 push eax
00405A0C . FF15 64104000 call [<&MSVBVM60.#595>] ; 弹出“恭喜，你成功了”
00405A12 . 8D8D 10FFFFFF lea ecx, [ebp-F0]
00405A18 . 8D95 20FFFFFF lea edx, [ebp-E0]
00405A1E . 51 push ecx
00405A1F . 8D85 30FFFFFF lea eax, [ebp-D0]
00405A25 . 52 push edx
00405A26 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00405A2C . 50 push eax
00405A2D . 51 push ecx
00405A2E . E9 7F020000 jmp 00405CB2
00405A33 > 8B16 mov edx, [esi]
00405A35 . 56 push esi
00405A36 . FF92 24030000 call [edx+324]
00405A3C . 50 push eax
00405A3D . 8D85 50FFFFFF lea eax, [ebp-B0]
00405A43 . 50 push eax
00405A44 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00405A4A . 8BD8 mov ebx, eax
00405A4C . 8D95 58FFFFFF lea edx, [ebp-A8]
00405A52 . 52 push edx
00405A53 . 53 push ebx
00405A54 . 8B0B mov ecx, [ebx]
00405A56 . FF91 A0000000 call [ecx+A0]
00405A5C . 85C0 test eax, eax
00405A5E . DBE2 fclex
00405A60 . 7D 12 jge short 00405A74
00405A62 . 68 A0000000 push 0A0
00405A67 . 68 1C3E4000 push 00403E1C
00405A6C . 53 push ebx
00405A6D . 50 push eax
00405A6E . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405A74 > 8B06 mov eax, [esi]
00405A76 . 56 push esi
00405A77 . FF90 10030000 call [eax+310]
00405A7D . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405A83 . 50 push eax
00405A84 . 51 push ecx
00405A85 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00405A8B . 8BF0 mov esi, eax
00405A8D . 8D85 64FFFFFF lea eax, [ebp-9C]
00405A93 . 50 push eax
00405A94 . 56 push esi
00405A95 . 8B16 mov edx, [esi]
00405A97 . FF92 A0000000 call [edx+A0]
00405A9D . 85C0 test eax, eax
00405A9F . DBE2 fclex
00405AA1 . 7D 12 jge short 00405AB5
00405AA3 . 68 A0000000 push 0A0
00405AA8 . 68 1C3E4000 push 00403E1C
00405AAD . 56 push esi
00405AAE . 50 push eax
00405AAF . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405AB5 > 8B8D 64FFFFFF mov ecx, [ebp-9C]
00405ABB . 51 push ecx
00405ABC . 68 483E4000 push 00403E48
00405AC1 . FF15 9C104000 call [<&MSVBVM60.__vbaStrCmp>] ; MSVBVM60.__vbaStrCmp
00405AC7 . F7D8 neg eax
00405AC9 . 1BC0 sbb eax, eax
00405ACB . 8D95 68FFFFFF lea edx, [ebp-98]
00405AD1 . 40 inc eax
00405AD2 . 52 push edx
00405AD3 . F7D8 neg eax
00405AD5 . 66:8985 B8FEF>mov [ebp-148], ax
00405ADC . 8D85 60FFFFFF lea eax, [ebp-A0]
00405AE2 . 50 push eax
00405AE3 . C785 B0FEFFFF>mov dword ptr [ebp-150], 0B
00405AED . FFD7 call edi ; 注册码/2
00405AEF . 50 push eax
00405AF0 . FF15 84114000 call [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
00405AF6 . DD9D D8FEFFFF fstp qword ptr [ebp-128]
00405AFC . 8D4D 90 lea ecx, [ebp-70]
00405AFF . 8D95 5CFFFFFF lea edx, [ebp-A4]
00405B05 . 51 push ecx
00405B06 . 52 push edx
00405B07 . C785 D0FEFFFF>mov dword ptr [ebp-130], 5
00405B11 . FFD7 call edi ; call后得到eax＝HEXTODEC
00405B13 . 50 push eax
00405B14 . FF15 84114000 call [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
00405B1A . 8B85 58FFFFFF mov eax, [ebp-A8]
00405B20 . DD9D F0FDFFFF fstp qword ptr [ebp-210]
00405B26 . 50 push eax
00405B27 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00405B2D . 8985 ECFDFFFF mov [ebp-214], eax
00405B33 . 8D8D B0FEFFFF lea ecx, [ebp-150]
00405B39 . DB85 ECFDFFFF fild dword ptr [ebp-214]
00405B3F . 8D95 D0FEFFFF lea edx, [ebp-130]
00405B45 . 51 push ecx
00405B46 . 52 push edx
00405B47 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00405B4D . DD9D E4FDFFFF fstp qword ptr [ebp-21C]
00405B53 . DD85 F0FDFFFF fld qword ptr [ebp-210]
00405B59 . 833D 00A04000>cmp dword ptr [40A000], 0
00405B60 . 75 08 jnz short 00405B6A
00405B62 . DCB5 E4FDFFFF fdiv qword ptr [ebp-21C] ; HEXTODEC/（信箱长度）
00405B68 . EB 11 jmp short 00405B7B
00405B6A > FFB5 E8FDFFFF push dword ptr [ebp-218]
00405B70 . FFB5 E4FDFFFF push dword ptr [ebp-21C]
00405B76 . E8 99B7FFFF call <jmp.&MSVBVM60._adj_fdiv_m64>
00405B7B > C785 C0FEFFFF>mov dword ptr [ebp-140], 8005
00405B85 . DD9D C8FEFFFF fstp qword ptr [ebp-138]
00405B8B . DFE0 fstsw ax
00405B8D . A8 0D test al, 0D
00405B8F . 0F85 34020000 jnz 00405DC9
00405B95 . 8D45 A4 lea eax, [ebp-5C]
00405B98 . 50 push eax
00405B99 . 51 push ecx
00405B9A . FF15 EC104000 call [<&MSVBVM60.__vbaVarDiv>] ; （注册码/2结果）/（HEXTODEC/信箱长度）
00405BA0 . 50 push eax
00405BA1 . 8D95 C0FEFFFF lea edx, [ebp-140]
00405BA7 . 8D85 30FFFFFF lea eax, [ebp-D0]
00405BAD . 52 push edx
00405BAE . 50 push eax
00405BAF . FF15 40104000 call [<&MSVBVM60.__vbaVarCmpNe>] ; MSVBVM60.__vbaVarCmpNe
00405BB5 . 8D8D 20FFFFFF lea ecx, [ebp-E0]
00405BBB . 50 push eax
00405BBC . 51 push ecx
00405BBD . FF15 B4104000 call [<&MSVBVM60.__vbaVarOr>] ; MSVBVM60.__vbaVarOr
00405BC3 . 50 push eax
00405BC4 . FF15 78104000 call [<&MSVBVM60.__vbaBoolVarNull>] ; MSVBVM60.__vbaBoolVarNull
00405BCA . 8BF0 mov esi, eax
00405BCC . 8D95 58FFFFFF lea edx, [ebp-A8]
00405BD2 . 8D85 5CFFFFFF lea eax, [ebp-A4]
00405BD8 . 52 push edx
00405BD9 . 8D8D 60FFFFFF lea ecx, [ebp-A0]
00405BDF . 50 push eax
00405BE0 . 8D95 64FFFFFF lea edx, [ebp-9C]
00405BE6 . 51 push ecx
00405BE7 . 52 push edx
00405BE8 . 6A 04 push 4
00405BEA . FF15 38114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
00405BF0 . 8D85 50FFFFFF lea eax, [ebp-B0]
00405BF6 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405BFC . 50 push eax
00405BFD . 51 push ecx
00405BFE . 6A 02 push 2
00405C00 . FF15 2C104000 call [<&MSVBVM60.__vbaFreeObjList>] ; MSVBVM60.__vbaFreeObjList
00405C06 . 83C4 20 add esp, 20
00405C09 . 8D8D B0FEFFFF lea ecx, [ebp-150]
00405C0F . FF15 14104000 call [<&MSVBVM60.__vbaFreeVar>] ; MSVBVM60.__vbaFreeVar
00405C15 . 66:85F6 test si, si ; 对比
00405C18 0F84 9F000000 je 00405CBD ; 强行跳走则程序无任何提示，正常为不跳，弹出失败窗口
00405C1E . B9 04000280 mov ecx, 80020004
00405C23 . B8 0A000000 mov eax, 0A
00405C28 . 898D 18FFFFFF mov [ebp-E8], ecx
00405C2E . 898D 28FFFFFF mov [ebp-D8], ecx
00405C34 . 898D 38FFFFFF mov [ebp-C8], ecx
00405C3A . 8D95 D0FEFFFF lea edx, [ebp-130]
00405C40 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00405C46 . 8985 10FFFFFF mov [ebp-F0], eax
00405C4C . 8985 20FFFFFF mov [ebp-E0], eax
00405C52 . 8985 30FFFFFF mov [ebp-D0], eax
00405C58 . C785 D8FEFFFF>mov dword ptr [ebp-128], 00403FA4
00405C62 . C785 D0FEFFFF>mov dword ptr [ebp-130], 8
00405C6C . FF15 58114000 call [<&MSVBVM60.__vbaVarDup>] ; MSVBVM60.__vbaVarDup
00405C72 . 8D95 10FFFFFF lea edx, [ebp-F0]
00405C78 . 8D85 20FFFFFF lea eax, [ebp-E0]
00405C7E . 52 push edx
00405C7F . 8D8D 30FFFFFF lea ecx, [ebp-D0]
00405C85 . 50 push eax
00405C86 . 51 push ecx
00405C87 . 8D95 40FFFFFF lea edx, [ebp-C0]
00405C8D . 6A 00 push 0
00405C8F . 52 push edx
00405C90 . FF15 64104000 call [<&MSVBVM60.#595>] ; 弹出失败窗口
00405C96 . 8D85 10FFFFFF lea eax, [ebp-F0]
00405C9C . 8D8D 20FFFFFF lea ecx, [ebp-E0]
00405CA2 . 50 push eax
00405CA3 . 8D95 30FFFFFF lea edx, [ebp-D0]
00405CA9 . 51 push ecx
00405CAA . 8D85 40FFFFFF lea eax, [ebp-C0]
00405CB0 . 52 push edx
00405CB1 . 50 push eax
00405CB2 > 6A 04 push 4
00405CB4 . FF15 20104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
00405CBA . 83C4 14 add esp, 14
00405CBD > 33FF xor edi, edi
00405CBF > 897D FC mov [ebp-4], edi
00405CC2 . 9B wait
综合：
因为计算过程涉及浮点数，所以为了避免出现小数而导致注册码成浮点数，特意将用户名长度，信箱长度取为10位。而且将用户名第1位查表以及MID后的DEC结果取为10的倍数。
用户名：Rbcdefghij，长度10
信箱：aaaa@a.com，长度10
注册码：385560
加密字符串1：Str1＝ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
加密字符串2：Str2＝dflgfgoOKOFVofgkOFlkLkKPkOKoPiRevHHklYtHJhjKLhyuYjkM
根据用户名在Str1中查表返回位置数InStr1Val，然后Mid(Str2,InStr1Val,1)
查表以MID完成后得到加密字符串KoPiRevHHklJh
对应HEX为
00153404 46 00 6F 00 50 00 69 00 52 00 65 00 76 00 48 00 F.o.P.i.R.e.v.H.
00153414 48 00 6B 00 H.k.
即46 6F 50 69 52 65 76 48 48 6B
以上每个HEX乘以用户名长度(HEX)，然后加总，得到23 DC（即加密字符串HEX加总后×用户名长度（此处为0xA＝10），（46+6F+50+69+52+65+76+48+48+6B)XA=396XA=23DC
大循环结束还得到一个数字，3*length(mail)*HEXTODEC(MID(加密码，1,1）/length（加密码＝用户名长度）＝210（如果有小数则最后取整）
HEXTODEC(23DC)=9180
假设A=HEXTODEC(23DC)/Length（mail）＝9180/10＝918
假设B=注册码/2/(3*length(mail)*HEXTODEC(MID(加密码，1,1）/length（加密码＝用户名长度）)＝918
A,B进行数值比较.不等则OVER
要比对一致，则：
HEXTODEC(23DC)/Length（mail）＝注册码/2/(3*length（mail）*HEXTODEC(MID(加密码，1,1）/length（加密码＝用户名长度）)
则注册码＝(HEXTODEC(23DC)/Length（mail）)X(3*length（mail）*HEXTODEC(MID(加密码，1,1）/length（加密码＝用户名长度）)X2＝9180/10*210*2=918*210*2＝385560
分析的有不对的地方，还请高手指教，以便改进思路，呵呵。
http://bbs.pediy.com/showthread.php?s=&threadid=24723
最初由 冷血书生 发布
00404EC5 66:83BD F4FDFFF>cmp word ptr ss:[ebp-20C],0 ; 计算结果最后与0比较,不相等就注册功
00404ECD 0F84 A1000000 je CRACKME2.00404F74 ; 爆破点
VB垃圾太多~跟算法是很烦的~ 五秒爆破~
呵呵，我的爆破点好像跟你的不大一样。
0040595C . FF15 A4104000 call [<&MSVBVM60.__vbaVarTstEq>] ; 比对结果是否一致
00405962 . 66:8BD8 mov bx, ax
00405965 . 8D85 5CFFFFFF lea eax, [ebp-A4]
0040596B . 8D8D 60FFFFFF lea ecx, [ebp-A0]
00405971 . 50 push eax
00405972 . 8D95 64FFFFFF lea edx, [ebp-9C]
00405978 . 51 push ecx
00405979 . 52 push edx
0040597A . 6A 03 push 3
0040597C . FF15 38114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
00405982 . 83C4 10 add esp, 10
00405985 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
0040598B . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00405991 66:85DB test bx, bx ; 如上面比对结果不一致则OVER
00405994 0F84 99000000 je 00405A33 ; 爆破点，跳走就OVER
00404D30 > \55 push ebp ; 点击注册
00404D31 . 8BEC mov ebp, esp
00404D33 . 83EC 0C sub esp, 0C
00404D36 . 68 F6124000 push <jmp.&MSVBVM60.__vbaExceptHandle>; SE 处理程序安装
00404D3B . 64:A1 0000000>mov eax, fs:[0]
00404D41 . 50 push eax
00404D42 . 64:8925 00000>mov fs:[0], esp
00404D49 . 81EC 08020000 sub esp, 208
00404D4F . 53 push ebx
00404D50 . 56 push esi
00404D51 . 57 push edi
00404D52 . 8965 F4 mov [ebp-C], esp
00404D55 . C745 F8 A8114>mov dword ptr [ebp-8], 004011A8
00404D5C . 8B75 08 mov esi, [ebp+8]
00404D5F . 8BC6 mov eax, esi
00404D61 . 83E0 01 and eax, 1
00404D64 . 8945 FC mov [ebp-4], eax
00404D67 . 83E6 FE and esi, FFFFFFFE
00404D6A . 56 push esi
00404D6B . 8975 08 mov [ebp+8], esi
00404D6E . 8B0E mov ecx, [esi]
00404D70 . FF51 04 call [ecx+4]
00404D73 . 8B16 mov edx, [esi]
00404D75 . 33FF xor edi, edi
00404D77 . 56 push esi
00404D78 . 897D DC mov [ebp-24], edi
00404D7B . 897D CC mov [ebp-34], edi
00404D7E . 897D BC mov [ebp-44], edi
00404D81 . 897D B8 mov [ebp-48], edi
00404D84 . 897D B4 mov [ebp-4C], edi
00404D87 . 897D A4 mov [ebp-5C], edi
00404D8A . 897D A0 mov [ebp-60], edi
00404D8D . 897D 90 mov [ebp-70], edi
00404D90 . 897D 80 mov [ebp-80], edi
00404D93 . 89BD 68FFFFFF mov [ebp-98], edi
00404D99 . 89BD 64FFFFFF mov [ebp-9C], edi
00404D9F . 89BD 60FFFFFF mov [ebp-A0], edi
00404DA5 . 89BD 5CFFFFFF mov [ebp-A4], edi
00404DAB . 89BD 58FFFFFF mov [ebp-A8], edi
00404DB1 . 89BD 54FFFFFF mov [ebp-AC], edi
00404DB7 . 89BD 50FFFFFF mov [ebp-B0], edi
00404DBD . 89BD 40FFFFFF mov [ebp-C0], edi
00404DC3 . 89BD 30FFFFFF mov [ebp-D0], edi
00404DC9 . 89BD 20FFFFFF mov [ebp-E0], edi
00404DCF . 89BD 10FFFFFF mov [ebp-F0], edi
00404DD5 . 89BD 00FFFFFF mov [ebp-100], edi
00404DDB . 89BD F0FEFFFF mov [ebp-110], edi
00404DE1 . 89BD E0FEFFFF mov [ebp-120], edi
00404DE7 . 89BD D0FEFFFF mov [ebp-130], edi
00404DED . 89BD C0FEFFFF mov [ebp-140], edi
00404DF3 . 89BD B0FEFFFF mov [ebp-150], edi
00404DF9 . 89BD 90FEFFFF mov [ebp-170], edi
00404DFF . 89BD 8CFEFFFF mov [ebp-174], edi
00404E05 . 89BD 68FEFFFF mov [ebp-198], edi
00404E0B . 89BD 58FEFFFF mov [ebp-1A8], edi
00404E11 . 89BD 48FEFFFF mov [ebp-1B8], edi
00404E17 . 89BD 38FEFFFF mov [ebp-1C8], edi
00404E1D . FF92 14030000 call [edx+314]
00404E23 . 50 push eax
00404E24 . 8D85 54FFFFFF lea eax, [ebp-AC]
00404E2A . 50 push eax
00404E2B . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00404E31 . 8BD8 mov ebx, eax
00404E33 . 8D95 64FFFFFF lea edx, [ebp-9C]
00404E39 . 52 push edx
00404E3A . 53 push ebx
00404E3B . 8B0B mov ecx, [ebx]
00404E3D . FF91 A0000000 call [ecx+A0]
00404E43 . 3BC7 cmp eax, edi
00404E45 . DBE2 fclex
00404E47 . 7D 12 jge short 00404E5B
00404E49 . 68 A0000000 push 0A0
00404E4E . 68 1C3E4000 push 00403E1C
00404E53 . 53 push ebx
00404E54 . 50 push eax
00404E55 . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00404E5B > 8B06 mov eax, [esi]
00404E5D . 56 push esi
00404E5E . FF90 14030000 call [eax+314]
00404E64 . 8D8D 50FFFFFF lea ecx, [ebp-B0]
00404E6A . 50 push eax
00404E6B . 51 push ecx
00404E6C . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00404E72 . 8BD8 mov ebx, eax
00404E74 . 8D85 60FFFFFF lea eax, [ebp-A0]
00404E7A . 50 push eax
00404E7B . 53 push ebx
00404E7C . 8B13 mov edx, [ebx]
00404E7E . FF92 A0000000 call [edx+A0]
00404E84 . 3BC7 cmp eax, edi
00404E86 . DBE2 fclex
00404E88 . 7D 12 jge short 00404E9C
00404E8A . 68 A0000000 push 0A0
00404E8F . 68 1C3E4000 push 00403E1C
00404E94 . 53 push ebx
00404E95 . 50 push eax
00404E96 . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00404E9C > 8B8D 60FFFFFF mov ecx, [ebp-A0]
00404EA2 . 51 push ecx ; 用户名入栈
00404EA3 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00404EA9 . 8B95 64FFFFFF mov edx, [ebp-9C]
00404EAF . 33DB xor ebx, ebx
00404EB1 . 83F8 10 cmp eax, 10 ; 用户名长度与10比较
00404EB4 . 52 push edx
00404EB5 . 0F9FC3 setg bl
00404EB8 . F7DB neg ebx
00404EBA . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00404EC0 . 33C9 xor ecx, ecx
00404EC2 . 83F8 06 cmp eax, 6 ; 用户名长度与6比较
00404EC5 . 8D95 60FFFFFF lea edx, [ebp-A0]
00404ECB . 8D85 64FFFFFF lea eax, [ebp-9C]
00404ED1 . 0F9CC1 setl cl
00404ED4 . 52 push edx
00404ED5 . 50 push eax
00404ED6 . F7D9 neg ecx
00404ED8 . 6A 02 push 2
00404EDA . 0BD9 or ebx, ecx
00404EDC . FF15 38114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
00404EE2 . 8D8D 50FFFFFF lea ecx, [ebp-B0]
00404EE8 . 8D95 54FFFFFF lea edx, [ebp-AC]
00404EEE . 51 push ecx
00404EEF . 52 push edx
00404EF0 . 6A 02 push 2
00404EF2 . FF15 2C104000 call [<&MSVBVM60.__vbaFreeObjList>] ; MSVBVM60.__vbaFreeObjList
00404EF8 . 83C4 18 add esp, 18
00404EFB . 66:3BDF cmp bx, di
00404EFE . 0F84 EE000000 je 00404FF2
00404F04 . B9 04000280 mov ecx, 80020004
00404F09 . B8 0A000000 mov eax, 0A
00404F0E . 898D 18FFFFFF mov [ebp-E8], ecx
00404F14 . 898D 28FFFFFF mov [ebp-D8], ecx
00404F1A . 898D 38FFFFFF mov [ebp-C8], ecx
00404F20 . 8D95 D0FEFFFF lea edx, [ebp-130]
00404F26 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00404F2C . 8985 10FFFFFF mov [ebp-F0], eax
00404F32 . 8985 20FFFFFF mov [ebp-E0], eax
00404F38 . 8985 30FFFFFF mov [ebp-D0], eax
00404F3E . C785 D8FEFFFF>mov dword ptr [ebp-128], 00403E30
00404F48 . C785 D0FEFFFF>mov dword ptr [ebp-130], 8
00404F52 . FF15 58114000 call [<&MSVBVM60.__vbaVarDup>] ; MSVBVM60.__vbaVarDup
00404F58 . 8D85 10FFFFFF lea eax, [ebp-F0]
00404F5E . 8D8D 20FFFFFF lea ecx, [ebp-E0]
00404F64 . 50 push eax
00404F65 . 8D95 30FFFFFF lea edx, [ebp-D0]
00404F6B . 51 push ecx
00404F6C . 52 push edx
00404F6D . 8D85 40FFFFFF lea eax, [ebp-C0]
00404F73 . 57 push edi
00404F74 . 50 push eax
00404F75 . FF15 64104000 call [<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox
00404F7B . 8D8D 10FFFFFF lea ecx, [ebp-F0]
00404F81 . 8D95 20FFFFFF lea edx, [ebp-E0]
00404F87 . 51 push ecx
00404F88 . 8D85 30FFFFFF lea eax, [ebp-D0]
00404F8E . 52 push edx
00404F8F . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00404F95 . 50 push eax
00404F96 . 51 push ecx
00404F97 . 6A 04 push 4
00404F99 . FF15 20104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
00404F9F . 8B16 mov edx, [esi]
00404FA1 . 83C4 14 add esp, 14
00404FA4 . 56 push esi
00404FA5 . FF92 10030000 call [edx+310]
00404FAB . 50 push eax
00404FAC . 8D85 54FFFFFF lea eax, [ebp-AC]
00404FB2 . 50 push eax
00404FB3 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00404FB9 . 8BF0 mov esi, eax
00404FBB . 68 483E4000 push 00403E48
00404FC0 . 56 push esi
00404FC1 . 8B0E mov ecx, [esi]
00404FC3 . FF91 A4000000 call [ecx+A4]
00404FC9 . 3BC7 cmp eax, edi
00404FCB . DBE2 fclex
00404FCD . 7D 12 jge short 00404FE1
00404FCF . 68 A4000000 push 0A4
00404FD4 . 68 1C3E4000 push 00403E1C
00404FD9 . 56 push esi
00404FDA . 50 push eax
00404FDB . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00404FE1 > 8D8D 54FFFFFF lea ecx, [ebp-AC]
00404FE7 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00404FED . E9 CD0C0000 jmp 00405CBF
00404FF2 > 8B16 mov edx, [esi]
00404FF4 . 56 push esi
00404FF5 . FF92 24030000 call [edx+324]
00404FFB . 50 push eax
00404FFC . 8D85 54FFFFFF lea eax, [ebp-AC]
00405002 . 50 push eax
00405003 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00405009 . 8BD8 mov ebx, eax
0040500B . 8D95 64FFFFFF lea edx, [ebp-9C]
00405011 . 52 push edx
00405012 . 53 push ebx
00405013 . 8B0B mov ecx, [ebx]
00405015 . FF91 A0000000 call [ecx+A0]
0040501B . 3BC7 cmp eax, edi
0040501D . DBE2 fclex
0040501F . 7D 12 jge short 00405033
00405021 . 68 A0000000 push 0A0
00405026 . 68 1C3E4000 push 00403E1C
0040502B . 53 push ebx
0040502C . 50 push eax
0040502D . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405033 > 8B85 64FFFFFF mov eax, [ebp-9C]
00405039 . 50 push eax ; 用户信箱入栈
0040503A . 68 483E4000 push 00403E48
0040503F . FF15 9C104000 call [<&MSVBVM60.__vbaStrCmp>] ; MSVBVM60.__vbaStrCmp
00405045 . 8BD8 mov ebx, eax
00405047 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
0040504D . F7DB neg ebx
0040504F . 1BDB sbb ebx, ebx
00405051 . 43 inc ebx
00405052 . F7DB neg ebx
00405054 . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0040505A . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405060 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00405066 . 66:3BDF cmp bx, di
00405069 . 0F84 A3000000 je 00405112
0040506F . B9 04000280 mov ecx, 80020004
00405074 . B8 0A000000 mov eax, 0A
00405079 . 898D 18FFFFFF mov [ebp-E8], ecx
0040507F . 8985 10FFFFFF mov [ebp-F0], eax
00405085 . 898D 28FFFFFF mov [ebp-D8], ecx
0040508B . 8985 20FFFFFF mov [ebp-E0], eax
00405091 . 898D 38FFFFFF mov [ebp-C8], ecx
00405097 . 8985 30FFFFFF mov [ebp-D0], eax
0040509D . C785 D8FEFFFF>mov dword ptr [ebp-128], 00403E50
004050A7 > 8D95 D0FEFFFF lea edx, [ebp-130]
004050AD . 8D8D 40FFFFFF lea ecx, [ebp-C0]
004050B3 . C785 D0FEFFFF>mov dword ptr [ebp-130], 8
004050BD . FF15 58114000 call [<&MSVBVM60.__vbaVarDup>] ; MSVBVM60.__vbaVarDup
004050C3 . 8D8D 10FFFFFF lea ecx, [ebp-F0]
004050C9 . 8D95 20FFFFFF lea edx, [ebp-E0]
004050CF . 51 push ecx
004050D0 . 8D85 30FFFFFF lea eax, [ebp-D0]
004050D6 . 52 push edx
004050D7 . 50 push eax
004050D8 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
004050DE . 57 push edi
004050DF . 51 push ecx
004050E0 . FF15 64104000 call [<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox
004050E6 . 8D95 10FFFFFF lea edx, [ebp-F0]
004050EC . 8D85 20FFFFFF lea eax, [ebp-E0]
004050F2 . 52 push edx
004050F3 . 8D8D 30FFFFFF lea ecx, [ebp-D0]
004050F9 . 50 push eax
004050FA . 8D95 40FFFFFF lea edx, [ebp-C0]
00405100 . 51 push ecx
00405101 . 52 push edx
00405102 . 6A 04 push 4
00405104 . FF15 20104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
0040510A . 83C4 14 add esp, 14
0040510D . E9 AD0B0000 jmp 00405CBF
00405112 > 8B06 mov eax, [esi]
00405114 . 56 push esi
00405115 . FF90 24030000 call [eax+324]
0040511B . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405121 . 50 push eax
00405122 . 51 push ecx
00405123 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00405129 . 8BD8 mov ebx, eax
0040512B . 8D85 64FFFFFF lea eax, [ebp-9C]
00405131 . 50 push eax
00405132 . 53 push ebx
00405133 . 8B13 mov edx, [ebx]
00405135 . FF92 A0000000 call [edx+A0]
0040513B . 3BC7 cmp eax, edi
0040513D . DBE2 fclex
0040513F . 7D 12 jge short 00405153
00405141 . 68 A0000000 push 0A0
00405146 . 68 1C3E4000 push 00403E1C
0040514B . 53 push ebx
0040514C . 50 push eax
0040514D . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405153 > 8B85 64FFFFFF mov eax, [ebp-9C]
00405159 . 8B0E mov ecx, [esi]
0040515B . 8D95 8CFEFFFF lea edx, [ebp-174]
00405161 . 52 push edx
00405162 . 50 push eax
00405163 . 56 push esi
00405164 . FF91 F8060000 call [ecx+6F8] ; 确认信箱是否符合常规
0040516A . 3BC7 cmp eax, edi
0040516C . 7D 12 jge short 00405180
0040516E . 68 F8060000 push 6F8
00405173 . 68 843C4000 push 00403C84
00405178 . 56 push esi
00405179 . 50 push eax
0040517A . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405180 > 33DB xor ebx, ebx
00405182 . 66:39BD 8CFEF>cmp [ebp-174], di
00405189 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
0040518F . 0F94C3 sete bl
00405192 . F7DB neg ebx
00405194 . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0040519A . 8D8D 54FFFFFF lea ecx, [ebp-AC]
004051A0 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
004051A6 . 66:3BDF cmp bx, di
004051A9 . 74 3D je short 004051E8
004051AB . B9 04000280 mov ecx, 80020004
004051B0 . B8 0A000000 mov eax, 0A
004051B5 . 898D 18FFFFFF mov [ebp-E8], ecx
004051BB . 8985 10FFFFFF mov [ebp-F0], eax
004051C1 . 898D 28FFFFFF mov [ebp-D8], ecx
004051C7 . 8985 20FFFFFF mov [ebp-E0], eax
004051CD . 898D 38FFFFFF mov [ebp-C8], ecx
004051D3 . 8985 30FFFFFF mov [ebp-D0], eax
004051D9 . C785 D8FEFFFF>mov dword ptr [ebp-128], 00403E68
004051E3 .^ E9 BFFEFFFF jmp 004050A7
004051E8 > 8B06 mov eax, [esi]
004051EA . 56 push esi
004051EB . FF90 24030000 call [eax+324]
004051F1 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
004051F7 . 50 push eax
004051F8 . 51 push ecx
004051F9 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
004051FF . 8BD8 mov ebx, eax
00405201 . 8D85 64FFFFFF lea eax, [ebp-9C]
00405207 . 50 push eax
00405208 . 53 push ebx
00405209 . 8B13 mov edx, [ebx]
0040520B . FF92 A0000000 call [edx+A0]
00405211 . 3BC7 cmp eax, edi
00405213 . DBE2 fclex
00405215 . 7D 12 jge short 00405229
00405217 . 68 A0000000 push 0A0
0040521C . 68 1C3E4000 push 00403E1C
00405221 . 53 push ebx
00405222 . 50 push eax
00405223 . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405229 > 8B8D 64FFFFFF mov ecx, [ebp-9C]
0040522F . 51 push ecx ; 信箱入栈
00405230 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00405236 . 8D95 D0FEFFFF lea edx, [ebp-130]
0040523C . 8D4D CC lea ecx, [ebp-34]
0040523F . 8985 D8FEFFFF mov [ebp-128], eax
00405245 . C785 D0FEFFFF>mov dword ptr [ebp-130], 3
0040524F . FF15 0C104000 call [<&MSVBVM60.__vbaVarMove>] ; MSVBVM60.__vbaVarMove
00405255 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
0040525B . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
00405261 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405267 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
0040526D . 8B1D 34114000 mov ebx, [<&MSVBVM60.__vbaStrCopy>] ; MSVBVM60.__vbaStrCopy
00405273 . BA 843E4000 mov edx, 00403E84 ; UNICODE "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
00405278 . 8D4D B4 lea ecx, [ebp-4C]
0040527B . FFD3 call ebx ; <&MSVBVM60.__vbaStrCopy>
0040527D . BA 1C3F4000 mov edx, 00403F1C ; UNICODE "dflgfgoOKOFVofgkOFlkLkKPkOKoPiRevHHklYtHJhjKLhyuYjkM"
00405282 . 8D4D A0 lea ecx, [ebp-60]
00405285 . FFD3 call ebx ; StrCopy
00405287 . 8B16 mov edx, [esi]
00405289 . 56 push esi
0040528A . C785 D8FEFFFF>mov dword ptr [ebp-128], 1
00405294 . C785 D0FEFFFF>mov dword ptr [ebp-130], 2
0040529E . FF92 14030000 call [edx+314]
004052A4 . 50 push eax
004052A5 . 8D85 54FFFFFF lea eax, [ebp-AC]
004052AB . 50 push eax
004052AC . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
004052B2 . 8BD8 mov ebx, eax
004052B4 . 8D95 64FFFFFF lea edx, [ebp-9C]
004052BA . 52 push edx
004052BB . 53 push ebx
004052BC . 8B0B mov ecx, [ebx]
004052BE . FF91 A0000000 call [ecx+A0]
004052C4 . 3BC7 cmp eax, edi
004052C6 . DBE2 fclex
004052C8 . 7D 12 jge short 004052DC
004052CA . 68 A0000000 push 0A0
004052CF . 68 1C3E4000 push 00403E1C
004052D4 . 53 push ebx
004052D5 . 50 push eax
004052D6 . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
004052DC > 8B85 64FFFFFF mov eax, [ebp-9C]
004052E2 . 50 push eax ; 用户名入栈
004052E3 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
004052E9 . 8D8D D0FEFFFF lea ecx, [ebp-130]
004052EF . 8985 C8FEFFFF mov [ebp-138], eax
004052F5 . 8D95 C0FEFFFF lea edx, [ebp-140]
004052FB . 51 push ecx
004052FC . 8D85 B0FEFFFF lea eax, [ebp-150]
00405302 . 52 push edx
00405303 . 8D8D 58FEFFFF lea ecx, [ebp-1A8]
00405309 . 50 push eax
0040530A . 8D95 68FEFFFF lea edx, [ebp-198]
00405310 . 51 push ecx
00405311 . 8D45 DC lea eax, [ebp-24]
00405314 . 52 push edx
00405315 . 50 push eax
00405316 . C785 C0FEFFFF>mov dword ptr [ebp-140], 3
00405320 . C785 B8FEFFFF>mov dword ptr [ebp-148], 1
0040532A . C785 B0FEFFFF>mov dword ptr [ebp-150], 2
00405334 . FF15 58104000 call [<&MSVBVM60.__vbaVarForInit>] ; MSVBVM60.__vbaVarForInit
0040533A . 8D8D 64FFFFFF lea ecx, [ebp-9C]
00405340 . 8BD8 mov ebx, eax
00405342 . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
00405348 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
0040534E . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00405354 . 8B3D 84104000 mov edi, [<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
0040535A > 85DB test ebx, ebx ; 大循环开始
0040535C . 0F84 39040000 je 0040579B
00405362 . 8B0E mov ecx, [esi]
00405364 . 56 push esi
00405365 . FF91 14030000 call [ecx+314]
0040536B . 8D95 54FFFFFF lea edx, [ebp-AC]
00405371 . 50 push eax
00405372 . 52 push edx
00405373 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00405379 . 8BD8 mov ebx, eax
0040537B . 8D8D 64FFFFFF lea ecx, [ebp-9C]
00405381 . 51 push ecx
00405382 . 53 push ebx
00405383 . 8B03 mov eax, [ebx]
00405385 . FF90 A0000000 call [eax+A0]
0040538B . 85C0 test eax, eax
0040538D . DBE2 fclex
0040538F . 7D 12 jge short 004053A3
00405391 . 68 A0000000 push 0A0
00405396 . 68 1C3E4000 push 00403E1C
0040539B . 53 push ebx
0040539C . 50 push eax
0040539D . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
004053A3 > 8B85 64FFFFFF mov eax, [ebp-9C] ; 用户名入eax
004053A9 . 8B1D 4C114000 mov ebx, [<&MSVBVM60.__vbaI4Var>] ; MSVBVM60.__vbaI4Var
004053AF . 8985 48FFFFFF mov [ebp-B8], eax
004053B5 . 8D95 30FFFFFF lea edx, [ebp-D0]
004053BB . 8D45 DC lea eax, [ebp-24]
004053BE . 52 push edx
004053BF . 50 push eax
004053C0 . C785 38FFFFFF>mov dword ptr [ebp-C8], 1
004053CA . C785 30FFFFFF>mov dword ptr [ebp-D0], 2
004053D4 . C785 64FFFFFF>mov dword ptr [ebp-9C], 0
004053DE . C785 40FFFFFF>mov dword ptr [ebp-C0], 8
004053E8 . FFD3 call ebx ; <&MSVBVM60.__vbaI4Var>
004053EA . 8D8D 40FFFFFF lea ecx, [ebp-C0]
004053F0 . 50 push eax
004053F1 . 8D95 20FFFFFF lea edx, [ebp-E0]
004053F7 . 51 push ecx
004053F8 . 52 push edx
004053F9 . FFD7 call edi
004053FB . 8B45 B8 mov eax, [ebp-48]
004053FE . 8B4D B4 mov ecx, [ebp-4C]
00405401 . 8985 98FEFFFF mov [ebp-168], eax
00405407 . B8 08000000 mov eax, 8
0040540C . 8985 90FEFFFF mov [ebp-170], eax
00405412 . 8985 C0FEFFFF mov [ebp-140], eax
00405418 . 8D55 A0 lea edx, [ebp-60]
0040541B . 8D85 00FFFFFF lea eax, [ebp-100]
00405421 . 898D C8FEFFFF mov [ebp-138], ecx
00405427 . 8995 B8FEFFFF mov [ebp-148], edx
0040542D . 50 push eax
0040542E . 8D8D C0FEFFFF lea ecx, [ebp-140]
00405434 . 6A 01 push 1
00405436 . 8D95 20FFFFFF lea edx, [ebp-E0]
0040543C . 51 push ecx ; 字符串1内存地址入栈
0040543D . 52 push edx ; 字符串2内存地址入栈
0040543E . 8D85 10FFFFFF lea eax, [ebp-F0]
00405444 . 6A 00 push 0
00405446 . 50 push eax
00405447 . C785 08FFFFFF>mov dword ptr [ebp-F8], 1
00405451 . C785 00FFFFFF>mov dword ptr [ebp-100], 2
0040545B . C785 B0FEFFFF>mov dword ptr [ebp-150], 4008
00405465 . FF15 F8104000 call [<&MSVBVM60.__vbaInStrVar>] ; 查表，得到结果InStr1Var
0040546B . 50 push eax
0040546C . FFD3 call ebx ; Mid（Str2，InStr1Var,1）
0040546E . 8D8D B0FEFFFF lea ecx, [ebp-150]
00405474 . 50 push eax
00405475 . 8D95 F0FEFFFF lea edx, [ebp-110]
0040547B . 51 push ecx
0040547C . 52 push edx
0040547D . FFD7 call edi
0040547F . 8D85 90FEFFFF lea eax, [ebp-170]
00405485 . 8D8D F0FEFFFF lea ecx, [ebp-110]
0040548B . 50 push eax
0040548C . 8D95 E0FEFFFF lea edx, [ebp-120]
00405492 . 51 push ecx
00405493 . 52 push edx
00405494 . FF15 04114000 call [<&MSVBVM60.__vbaVarCat>] ; MSVBVM60.__vbaVarCat
0040549A . 50 push eax
0040549B . FF15 1C104000 call [<&MSVBVM60.__vbaStrVarMove>] ; MSVBVM60.__vbaStrVarMove
004054A1 . 8BD0 mov edx, eax
004054A3 . 8D4D B8 lea ecx, [ebp-48]
004054A6 . FF15 64114000 call [<&MSVBVM60.__vbaStrMove>] ; MSVBVM60.__vbaStrMove
004054AC . 8D8D 54FFFFFF lea ecx, [ebp-AC]
004054B2 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
004054B8 . 8D85 E0FEFFFF lea eax, [ebp-120]
004054BE . 8D8D F0FEFFFF lea ecx, [ebp-110]
004054C4 . 50 push eax
004054C5 . 8D95 00FFFFFF lea edx, [ebp-100]
004054CB . 51 push ecx
004054CC . 8D85 10FFFFFF lea eax, [ebp-F0]
004054D2 . 52 push edx
004054D3 . 8D8D 20FFFFFF lea ecx, [ebp-E0]
004054D9 . 50 push eax
004054DA . 8D95 30FFFFFF lea edx, [ebp-D0]
004054E0 . 51 push ecx
004054E1 . 8D85 40FFFFFF lea eax, [ebp-C0]
004054E7 . 52 push edx
004054E8 . 50 push eax
004054E9 . 6A 07 push 7
004054EB . FF15 20104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
004054F1 . 8B4D B8 mov ecx, [ebp-48] ; 解码后字符串入ecx
004054F4 . 83C4 20 add esp, 20
004054F7 . 51 push ecx ; 解码后字符串入栈
004054F8 . FF15 30104000 call [<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
004054FE . 0FBFD0 movsx edx, ax
00405501 . 8B45 B8 mov eax, [ebp-48] ; 追加本次解码字符
00405504 . 8995 20FEFFFF mov [ebp-1E0], edx
0040550A . DB85 20FEFFFF fild dword ptr [ebp-1E0]
00405510 . 50 push eax
00405511 . DD9D 18FEFFFF fstp qword ptr [ebp-1E8]
00405517 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
0040551D . 8985 14FEFFFF mov [ebp-1EC], eax
00405523 . DB85 14FEFFFF fild dword ptr [ebp-1EC]
00405529 . DD9D 0CFEFFFF fstp qword ptr [ebp-1F4]
0040552F . DD85 18FEFFFF fld qword ptr [ebp-1E8]
00405535 . 833D 00A04000>cmp dword ptr [40A000], 0
0040553C . 75 08 jnz short 00405546
0040553E . DCB5 0CFEFFFF fdiv qword ptr [ebp-1F4] ; 首次解码字符dec/本解码字符串长度
00405544 . EB 11 jmp short 00405557
00405546 > FFB5 10FEFFFF push dword ptr [ebp-1F0]
0040554C . FFB5 0CFEFFFF push dword ptr [ebp-1F4]
00405552 . E8 BDBDFFFF call <jmp.&MSVBVM60._adj_fdiv_m64>
00405557 > DFE0 fstsw ax
00405559 . A8 0D test al, 0D
0040555B . 0F85 68080000 jnz 00405DC9
00405561 . FF15 28104000 call [<&MSVBVM60.__vbaFpCDblR8>] ; MSVBVM60.__vbaFpCDblR8
00405567 . 8B1D D8104000 mov ebx, [<&MSVBVM60.__vbaVarMul>] ; MSVBVM60.__vbaVarMul
0040556D . 8D8D C0FEFFFF lea ecx, [ebp-140]
00405573 . DD9D C8FEFFFF fstp qword ptr [ebp-138]
00405579 . 8D55 CC lea edx, [ebp-34]
0040557C . 51 push ecx
0040557D . 8D85 D0FEFFFF lea eax, [ebp-130]
00405583 . 52 push edx
00405584 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
0040558A . 50 push eax
0040558B . 51 push ecx
0040558C . C785 C0FEFFFF>mov dword ptr [ebp-140], 5
00405596 . C785 D8FEFFFF>mov dword ptr [ebp-128], 3
004055A0 . C785 D0FEFFFF>mov dword ptr [ebp-130], 2
004055AA . FFD3 call ebx ; 3*length（mail）; <&MSVBVM60.__vbaVarMul>
004055AC . 8D95 30FFFFFF lea edx, [ebp-D0]
004055B2 . 50 push eax
004055B3 . 52 push edx
004055B4 . FFD3 call ebx ; (首次解码字符dec/解码字符串长度)X(3*length(mail))
004055B6 . 50 push eax ; 本例中，最终结果＝(3*length（mail））*HEXTODEC(MID(STR,1,1))/Length（str）=210
004055B7 . 8D85 20FFFFFF lea eax, [ebp-E0]
004055BD . 50 push eax
004055BE . FF15 34104000 call [<&MSVBVM60.__vbaVarFix>] ; MSVBVM60.__vbaVarFix
004055C4 . 8BD0 mov edx, eax
004055C6 . 8D4D A4 lea ecx, [ebp-5C]
004055C9 . FF15 0C104000 call [<&MSVBVM60.__vbaVarMove>] ; MSVBVM60.__vbaVarMove
004055CF . 8B0E mov ecx, [esi]
004055D1 . 56 push esi
004055D2 . C785 D8FEFFFF>mov dword ptr [ebp-128], 1
004055DC . C785 D0FEFFFF>mov dword ptr [ebp-130], 2
004055E6 . FF91 14030000 call [ecx+314]
004055EC . 8D95 54FFFFFF lea edx, [ebp-AC]
004055F2 . 50 push eax
004055F3 . 52 push edx
004055F4 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
004055FA . 8BD8 mov ebx, eax
004055FC . 8D8D 64FFFFFF lea ecx, [ebp-9C]
00405602 . 51 push ecx
00405603 . 53 push ebx
00405604 . 8B03 mov eax, [ebx]
00405606 . FF90 A0000000 call [eax+A0]
0040560C . 85C0 test eax, eax
0040560E . DBE2 fclex
00405610 . 7D 12 jge short 00405624
00405612 . 68 A0000000 push 0A0
00405617 . 68 1C3E4000 push 00403E1C
0040561C . 53 push ebx
0040561D . 50 push eax
0040561E . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405624 > 8B95 64FFFFFF mov edx, [ebp-9C]
0040562A . 52 push edx ; 用户名入栈
0040562B . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; 取用户名长度入eax
00405631 . 8985 C8FEFFFF mov [ebp-138], eax
00405637 . 8D85 D0FEFFFF lea eax, [ebp-130]
0040563D . 8D8D C0FEFFFF lea ecx, [ebp-140]
00405643 . 50 push eax
00405644 . 8D95 B0FEFFFF lea edx, [ebp-150]
0040564A . 51 push ecx
0040564B . 8D85 38FEFFFF lea eax, [ebp-1C8]
00405651 . 52 push edx
00405652 . 8D8D 48FEFFFF lea ecx, [ebp-1B8]
00405658 . 50 push eax
00405659 . 8D55 BC lea edx, [ebp-44]
0040565C . 51 push ecx
0040565D . 52 push edx
0040565E . C785 C0FEFFFF>mov dword ptr [ebp-140], 3
00405668 . C785 B8FEFFFF>mov dword ptr [ebp-148], 1
00405672 . C785 B0FEFFFF>mov dword ptr [ebp-150], 2
0040567C . FF15 58104000 call [<&MSVBVM60.__vbaVarForInit>] ; MSVBVM60.__vbaVarForInit
00405682 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
00405688 . 8BD8 mov ebx, eax
0040568A . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
00405690 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405696 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
0040569C > 85DB test ebx, ebx ; 小循环开始
0040569E . 0F84 D8000000 je 0040577C
004056A4 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
004056AA . 8D55 DC lea edx, [ebp-24]
004056AD . BB 02000000 mov ebx, 2
004056B2 . 8D45 B8 lea eax, [ebp-48]
004056B5 . 51 push ecx
004056B6 . 52 push edx
004056B7 . C785 48FFFFFF>mov dword ptr [ebp-B8], 1
004056C1 . 899D 40FFFFFF mov [ebp-C0], ebx
004056C7 . 8985 D8FEFFFF mov [ebp-128], eax
004056CD . C785 D0FEFFFF>mov dword ptr [ebp-130], 4008
004056D7 . FF15 4C114000 call [<&MSVBVM60.__vbaI4Var>] ; MSVBVM60.__vbaI4Var
004056DD . 50 push eax
004056DE . 8D85 D0FEFFFF lea eax, [ebp-130]
004056E4 . 8D8D 30FFFFFF lea ecx, [ebp-D0]
004056EA . 50 push eax
004056EB . 51 push ecx
004056EC . FFD7 call edi
004056EE . 8D95 30FFFFFF lea edx, [ebp-D0]
004056F4 . 8D85 64FFFFFF lea eax, [ebp-9C]
004056FA . 52 push edx
004056FB . 50 push eax
004056FC . FF15 00114000 call [<&MSVBVM60.__vbaStrVarVal>] ; MSVBVM60.__vbaStrVarVal
00405702 . 50 push eax
00405703 . FF15 30104000 call [<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00405709 . 8D4D 90 lea ecx, [ebp-70]
0040570C . 66:8985 B8FEF>mov [ebp-148], ax
00405713 . 8D95 B0FEFFFF lea edx, [ebp-150]
00405719 . 51 push ecx
0040571A . 8D85 20FFFFFF lea eax, [ebp-E0]
00405720 . 52 push edx
00405721 . 50 push eax
00405722 . 899D B0FEFFFF mov [ebp-150], ebx
00405728 . FF15 50114000 call [<&MSVBVM60.__vbaVarAdd>] ; 将解码的单个字符自身相加，最后得到HEX值
0040572E . 8BD0 mov edx, eax
00405730 . 8D4D 90 lea ecx, [ebp-70]
00405733 . FF15 0C104000 call [<&MSVBVM60.__vbaVarMove>] ; MSVBVM60.__vbaVarMove
00405739 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
0040573F . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
00405745 . 8D8D 30FFFFFF lea ecx, [ebp-D0]
0040574B . 8D95 40FFFFFF lea edx, [ebp-C0]
00405751 . 51 push ecx
00405752 . 52 push edx
00405753 . 53 push ebx
00405754 . FF15 20104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
0040575A . 83C4 0C add esp, 0C
0040575D . 8D85 38FEFFFF lea eax, [ebp-1C8]
00405763 . 8D8D 48FEFFFF lea ecx, [ebp-1B8]
00405769 . 8D55 BC lea edx, [ebp-44]
0040576C . 50 push eax
0040576D . 51 push ecx
0040576E . 52 push edx
0040576F . FF15 74114000 call [<&MSVBVM60.__vbaVarForNext>] ; MSVBVM60.__vbaVarForNext
00405775 . 8BD8 mov ebx, eax
00405777 .^ E9 20FFFFFF jmp 0040569C ; 小循环，次数等于Length（用户名）
0040577C > 8D85 58FEFFFF lea eax, [ebp-1A8] ; 最后得到HEX为本次循环之解密码XLength（用户名）
00405782 . 8D8D 68FEFFFF lea ecx, [ebp-198]
00405788 . 50 push eax
00405789 . 8D55 DC lea edx, [ebp-24]
0040578C . 51 push ecx
0040578D . 52 push edx
0040578E . FF15 74114000 call [<&MSVBVM60.__vbaVarForNext>] ; MSVBVM60.__vbaVarForNext
00405794 . 8BD8 mov ebx, eax
00405796 .^ E9 BFFBFFFF jmp 0040535A ; 大循环
0040579B > 8B06 mov eax, [esi] ; 大循环结束后，HEX值为所有解码字符之HEX乘以Length（用户名）之总和
0040579D . 56 push esi
0040579E . FF90 10030000 call [eax+310]
004057A4 . 8B1D 60104000 mov ebx, [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
004057AA . 8D8D 54FFFFFF lea ecx, [ebp-AC]
004057B0 . 50 push eax
004057B1 . 51 push ecx
004057B2 . FFD3 call ebx ; <&MSVBVM60.__vbaObjSet>
004057B4 . 8BF8 mov edi, eax
004057B6 . 8D85 64FFFFFF lea eax, [ebp-9C]
004057BC . 50 push eax
004057BD . 57 push edi
004057BE . 8B17 mov edx, [edi]
004057C0 . FF92 A0000000 call [edx+A0]
004057C6 . 85C0 test eax, eax
004057C8 . DBE2 fclex
004057CA . 7D 12 jge short 004057DE
004057CC . 68 A0000000 push 0A0
004057D1 . 68 1C3E4000 push 00403E1C
004057D6 . 57 push edi
004057D7 . 50 push eax
004057D8 . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
004057DE > 8B8D 64FFFFFF mov ecx, [ebp-9C]
004057E4 . 51 push ecx ; 注册码入栈
004057E5 . FF15 84114000 call [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
004057EB . FF15 74104000 call [<&MSVBVM60.__vbaFPFix>] ; MSVBVM60.__vbaFPFix
004057F1 . 833D 00A04000>cmp dword ptr [40A000], 0
004057F8 . 75 08 jnz short 00405802
004057FA . DC35 A0114000 fdiv qword ptr [4011A0] ; 注册码/2
00405800 . EB 11 jmp short 00405813
00405802 > FF35 A4114000 push dword ptr [4011A4]
00405808 . FF35 A0114000 push dword ptr [4011A0]
0040580E . E8 01BBFFFF call <jmp.&MSVBVM60._adj_fdiv_m64>
00405813 > 8D95 D0FEFFFF lea edx, [ebp-130]
00405819 . 8D8D 68FFFFFF lea ecx, [ebp-98]
0040581F . C785 D0FEFFFF>mov dword ptr [ebp-130], 5
00405829 . DD9D D8FEFFFF fstp qword ptr [ebp-128]
0040582F . DFE0 fstsw ax
00405831 . A8 0D test al, 0D
00405833 . 0F85 90050000 jnz 00405DC9
00405839 . FF15 0C104000 call [<&MSVBVM60.__vbaVarMove>] ; MSVBVM60.__vbaVarMove
0040583F . 8D8D 64FFFFFF lea ecx, [ebp-9C]
00405845 . FF15 7C114000 call [<&MSVBVM60.__vbaFreeStr>] ; MSVBVM60.__vbaFreeStr
0040584B . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405851 . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00405857 . 8B16 mov edx, [esi]
00405859 . 56 push esi
0040585A . FF92 24030000 call [edx+324]
00405860 . 50 push eax
00405861 . 8D85 54FFFFFF lea eax, [ebp-AC]
00405867 . 50 push eax
00405868 . FFD3 call ebx
0040586A . 8BF8 mov edi, eax
0040586C . 8D95 5CFFFFFF lea edx, [ebp-A4]
00405872 . 52 push edx
00405873 . 57 push edi
00405874 . 8B0F mov ecx, [edi]
00405876 . FF91 A0000000 call [ecx+A0]
0040587C . 85C0 test eax, eax
0040587E . DBE2 fclex
00405880 . 7D 12 jge short 00405894
00405882 . 68 A0000000 push 0A0
00405887 . 68 1C3E4000 push 00403E1C
0040588C . 57 push edi
0040588D . 50 push eax
0040588E . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405894 > 8B3D 00114000 mov edi, [<&MSVBVM60.__vbaStrVarVal>>; MSVBVM60.__vbaStrVarVal
0040589A . 8D85 68FFFFFF lea eax, [ebp-98]
004058A0 . 8D8D 64FFFFFF lea ecx, [ebp-9C]
004058A6 . 50 push eax
004058A7 . 51 push ecx
004058A8 . FFD7 call edi ; <&MSVBVM60.__vbaStrVarVal>
004058AA . 50 push eax ; 以上取注册码/2后的结果入eax
004058AB . FF15 84114000 call [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
004058B1 . DD9D D8FEFFFF fstp qword ptr [ebp-128]
004058B7 . 8D55 90 lea edx, [ebp-70]
004058BA . 8D85 60FFFFFF lea eax, [ebp-A0]
004058C0 . 52 push edx
004058C1 . 50 push eax
004058C2 . C785 D0FEFFFF>mov dword ptr [ebp-130], 5
004058CC . FFD7 call edi ; 大循环结束之HEXTODEC
004058CE . 50 push eax
004058CF . FF15 84114000 call [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
004058D5 . 8B8D 5CFFFFFF mov ecx, [ebp-A4] ; 信箱入ecx
004058DB . DD9D 04FEFFFF fstp qword ptr [ebp-1FC]
004058E1 . 51 push ecx
004058E2 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
004058E8 . 8985 00FEFFFF mov [ebp-200], eax
004058EE . 8D95 D0FEFFFF lea edx, [ebp-130]
004058F4 . DB85 00FEFFFF fild dword ptr [ebp-200]
004058FA . 52 push edx
004058FB . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00405901 . C785 C0FEFFFF>mov dword ptr [ebp-140], 8005
0040590B . DD9D F8FDFFFF fstp qword ptr [ebp-208]
00405911 . DD85 04FEFFFF fld qword ptr [ebp-1FC]
00405917 . 833D 00A04000>cmp dword ptr [40A000], 0
0040591E . 75 08 jnz short 00405928
00405920 . DCB5 F8FDFFFF fdiv qword ptr [ebp-208] ; HEXTODEC/信箱长度
00405926 . EB 11 jmp short 00405939
00405928 > FFB5 FCFDFFFF push dword ptr [ebp-204]
0040592E . FFB5 F8FDFFFF push dword ptr [ebp-208]
00405934 . E8 DBB9FFFF call <jmp.&MSVBVM60._adj_fdiv_m64>
00405939 > DD9D C8FEFFFF fstp qword ptr [ebp-138]
0040593F . DFE0 fstsw ax
00405941 . A8 0D test al, 0D
00405943 . 0F85 80040000 jnz 00405DC9
00405949 . 8D45 A4 lea eax, [ebp-5C]
0040594C . 50 push eax
0040594D . 51 push ecx
0040594E . FF15 EC104000 call [<&MSVBVM60.__vbaVarDiv>] ; 注册码/2的结果/（3*length(mail)*HEXTODEC(MID(加密码，1,1）/length（加密码））
00405954 . 8D95 C0FEFFFF lea edx, [ebp-140] ; 以上结果＝918
0040595A . 50 push eax
0040595B . 52 push edx
0040595C . FF15 A4104000 call [<&MSVBVM60.__vbaVarTstEq>] ; 比对结果是否一致
00405962 . 66:8BD8 mov bx, ax
00405965 . 8D85 5CFFFFFF lea eax, [ebp-A4]
0040596B . 8D8D 60FFFFFF lea ecx, [ebp-A0]
00405971 . 50 push eax
00405972 . 8D95 64FFFFFF lea edx, [ebp-9C]
00405978 . 51 push ecx
00405979 . 52 push edx
0040597A . 6A 03 push 3
0040597C . FF15 38114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
00405982 . 83C4 10 add esp, 10
00405985 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
0040598B . FF15 80114000 call [<&MSVBVM60.__vbaFreeObj>] ; MSVBVM60.__vbaFreeObj
00405991 66:85DB test bx, bx ; 如上面比对结果不一致则OVER
00405994 0F84 99000000 je 00405A33 ; 爆破点，跳走就OVER
0040599A . B9 04000280 mov ecx, 80020004
0040599F . B8 0A000000 mov eax, 0A
004059A4 . 898D 18FFFFFF mov [ebp-E8], ecx
004059AA . 898D 28FFFFFF mov [ebp-D8], ecx
004059B0 . 898D 38FFFFFF mov [ebp-C8], ecx
004059B6 . 8D95 D0FEFFFF lea edx, [ebp-130]
004059BC . 8D8D 40FFFFFF lea ecx, [ebp-C0]
004059C2 . 8985 10FFFFFF mov [ebp-F0], eax
004059C8 . 8985 20FFFFFF mov [ebp-E0], eax
004059CE . 8985 30FFFFFF mov [ebp-D0], eax
004059D4 . C785 D8FEFFFF>mov dword ptr [ebp-128], 00403F8C
004059DE . C785 D0FEFFFF>mov dword ptr [ebp-130], 8
004059E8 . FF15 58114000 call [<&MSVBVM60.__vbaVarDup>] ; MSVBVM60.__vbaVarDup
004059EE . 8D85 10FFFFFF lea eax, [ebp-F0]
004059F4 . 8D8D 20FFFFFF lea ecx, [ebp-E0]
004059FA . 50 push eax
004059FB . 8D95 30FFFFFF lea edx, [ebp-D0]
00405A01 . 51 push ecx
00405A02 . 52 push edx
00405A03 . 8D85 40FFFFFF lea eax, [ebp-C0]
00405A09 . 6A 00 push 0
00405A0B . 50 push eax
00405A0C . FF15 64104000 call [<&MSVBVM60.#595>] ; 弹出“恭喜，你成功了”
00405A12 . 8D8D 10FFFFFF lea ecx, [ebp-F0]
00405A18 . 8D95 20FFFFFF lea edx, [ebp-E0]
00405A1E . 51 push ecx
00405A1F . 8D85 30FFFFFF lea eax, [ebp-D0]
00405A25 . 52 push edx
00405A26 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00405A2C . 50 push eax
00405A2D . 51 push ecx
00405A2E . E9 7F020000 jmp 00405CB2
00405A33 > 8B16 mov edx, [esi]
00405A35 . 56 push esi
00405A36 . FF92 24030000 call [edx+324]
00405A3C . 50 push eax
00405A3D . 8D85 50FFFFFF lea eax, [ebp-B0]
00405A43 . 50 push eax
00405A44 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00405A4A . 8BD8 mov ebx, eax
00405A4C . 8D95 58FFFFFF lea edx, [ebp-A8]
00405A52 . 52 push edx
00405A53 . 53 push ebx
00405A54 . 8B0B mov ecx, [ebx]
00405A56 . FF91 A0000000 call [ecx+A0]
00405A5C . 85C0 test eax, eax
00405A5E . DBE2 fclex
00405A60 . 7D 12 jge short 00405A74
00405A62 . 68 A0000000 push 0A0
00405A67 . 68 1C3E4000 push 00403E1C
00405A6C . 53 push ebx
00405A6D . 50 push eax
00405A6E . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405A74 > 8B06 mov eax, [esi]
00405A76 . 56 push esi
00405A77 . FF90 10030000 call [eax+310]
00405A7D . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405A83 . 50 push eax
00405A84 . 51 push ecx
00405A85 . FF15 60104000 call [<&MSVBVM60.__vbaObjSet>] ; MSVBVM60.__vbaObjSet
00405A8B . 8BF0 mov esi, eax
00405A8D . 8D85 64FFFFFF lea eax, [ebp-9C]
00405A93 . 50 push eax
00405A94 . 56 push esi
00405A95 . 8B16 mov edx, [esi]
00405A97 . FF92 A0000000 call [edx+A0]
00405A9D . 85C0 test eax, eax
00405A9F . DBE2 fclex
00405AA1 . 7D 12 jge short 00405AB5
00405AA3 . 68 A0000000 push 0A0
00405AA8 . 68 1C3E4000 push 00403E1C
00405AAD . 56 push esi
00405AAE . 50 push eax
00405AAF . FF15 4C104000 call [<&MSVBVM60.__vbaHresultCheckObj>; MSVBVM60.__vbaHresultCheckObj
00405AB5 > 8B8D 64FFFFFF mov ecx, [ebp-9C]
00405ABB . 51 push ecx
00405ABC . 68 483E4000 push 00403E48
00405AC1 . FF15 9C104000 call [<&MSVBVM60.__vbaStrCmp>] ; MSVBVM60.__vbaStrCmp
00405AC7 . F7D8 neg eax
00405AC9 . 1BC0 sbb eax, eax
00405ACB . 8D95 68FFFFFF lea edx, [ebp-98]
00405AD1 . 40 inc eax
00405AD2 . 52 push edx
00405AD3 . F7D8 neg eax
00405AD5 . 66:8985 B8FEF>mov [ebp-148], ax
00405ADC . 8D85 60FFFFFF lea eax, [ebp-A0]
00405AE2 . 50 push eax
00405AE3 . C785 B0FEFFFF>mov dword ptr [ebp-150], 0B
00405AED . FFD7 call edi ; 注册码/2
00405AEF . 50 push eax
00405AF0 . FF15 84114000 call [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
00405AF6 . DD9D D8FEFFFF fstp qword ptr [ebp-128]
00405AFC . 8D4D 90 lea ecx, [ebp-70]
00405AFF . 8D95 5CFFFFFF lea edx, [ebp-A4]
00405B05 . 51 push ecx
00405B06 . 52 push edx
00405B07 . C785 D0FEFFFF>mov dword ptr [ebp-130], 5
00405B11 . FFD7 call edi ; call后得到eax＝HEXTODEC
00405B13 . 50 push eax
00405B14 . FF15 84114000 call [<&MSVBVM60.#581>] ; MSVBVM60.rtcR8ValFromBstr
00405B1A . 8B85 58FFFFFF mov eax, [ebp-A8]
00405B20 . DD9D F0FDFFFF fstp qword ptr [ebp-210]
00405B26 . 50 push eax
00405B27 . FF15 18104000 call [<&MSVBVM60.__vbaLenBstr>] ; MSVBVM60.__vbaLenBstr
00405B2D . 8985 ECFDFFFF mov [ebp-214], eax
00405B33 . 8D8D B0FEFFFF lea ecx, [ebp-150]
00405B39 . DB85 ECFDFFFF fild dword ptr [ebp-214]
00405B3F . 8D95 D0FEFFFF lea edx, [ebp-130]
00405B45 . 51 push ecx
00405B46 . 52 push edx
00405B47 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00405B4D . DD9D E4FDFFFF fstp qword ptr [ebp-21C]
00405B53 . DD85 F0FDFFFF fld qword ptr [ebp-210]
00405B59 . 833D 00A04000>cmp dword ptr [40A000], 0
00405B60 . 75 08 jnz short 00405B6A
00405B62 . DCB5 E4FDFFFF fdiv qword ptr [ebp-21C] ; HEXTODEC/（信箱长度）
00405B68 . EB 11 jmp short 00405B7B
00405B6A > FFB5 E8FDFFFF push dword ptr [ebp-218]
00405B70 . FFB5 E4FDFFFF push dword ptr [ebp-21C]
00405B76 . E8 99B7FFFF call <jmp.&MSVBVM60._adj_fdiv_m64>
00405B7B > C785 C0FEFFFF>mov dword ptr [ebp-140], 8005
00405B85 . DD9D C8FEFFFF fstp qword ptr [ebp-138]
00405B8B . DFE0 fstsw ax
00405B8D . A8 0D test al, 0D
00405B8F . 0F85 34020000 jnz 00405DC9
00405B95 . 8D45 A4 lea eax, [ebp-5C]
00405B98 . 50 push eax
00405B99 . 51 push ecx
00405B9A . FF15 EC104000 call [<&MSVBVM60.__vbaVarDiv>] ; （注册码/2结果）/（HEXTODEC/信箱长度）
00405BA0 . 50 push eax
00405BA1 . 8D95 C0FEFFFF lea edx, [ebp-140]
00405BA7 . 8D85 30FFFFFF lea eax, [ebp-D0]
00405BAD . 52 push edx
00405BAE . 50 push eax
00405BAF . FF15 40104000 call [<&MSVBVM60.__vbaVarCmpNe>] ; MSVBVM60.__vbaVarCmpNe
00405BB5 . 8D8D 20FFFFFF lea ecx, [ebp-E0]
00405BBB . 50 push eax
00405BBC . 51 push ecx
00405BBD . FF15 B4104000 call [<&MSVBVM60.__vbaVarOr>] ; MSVBVM60.__vbaVarOr
00405BC3 . 50 push eax
00405BC4 . FF15 78104000 call [<&MSVBVM60.__vbaBoolVarNull>] ; MSVBVM60.__vbaBoolVarNull
00405BCA . 8BF0 mov esi, eax
00405BCC . 8D95 58FFFFFF lea edx, [ebp-A8]
00405BD2 . 8D85 5CFFFFFF lea eax, [ebp-A4]
00405BD8 . 52 push edx
00405BD9 . 8D8D 60FFFFFF lea ecx, [ebp-A0]
00405BDF . 50 push eax
00405BE0 . 8D95 64FFFFFF lea edx, [ebp-9C]
00405BE6 . 51 push ecx
00405BE7 . 52 push edx
00405BE8 . 6A 04 push 4
00405BEA . FF15 38114000 call [<&MSVBVM60.__vbaFreeStrList>] ; MSVBVM60.__vbaFreeStrList
00405BF0 . 8D85 50FFFFFF lea eax, [ebp-B0]
00405BF6 . 8D8D 54FFFFFF lea ecx, [ebp-AC]
00405BFC . 50 push eax
00405BFD . 51 push ecx
00405BFE . 6A 02 push 2
00405C00 . FF15 2C104000 call [<&MSVBVM60.__vbaFreeObjList>] ; MSVBVM60.__vbaFreeObjList
00405C06 . 83C4 20 add esp, 20
00405C09 . 8D8D B0FEFFFF lea ecx, [ebp-150]
00405C0F . FF15 14104000 call [<&MSVBVM60.__vbaFreeVar>] ; MSVBVM60.__vbaFreeVar
00405C15 . 66:85F6 test si, si ; 对比
00405C18 0F84 9F000000 je 00405CBD ; 强行跳走则程序无任何提示，正常为不跳，弹出失败窗口
00405C1E . B9 04000280 mov ecx, 80020004
00405C23 . B8 0A000000 mov eax, 0A
00405C28 . 898D 18FFFFFF mov [ebp-E8], ecx
00405C2E . 898D 28FFFFFF mov [ebp-D8], ecx
00405C34 . 898D 38FFFFFF mov [ebp-C8], ecx
00405C3A . 8D95 D0FEFFFF lea edx, [ebp-130]
00405C40 . 8D8D 40FFFFFF lea ecx, [ebp-C0]
00405C46 . 8985 10FFFFFF mov [ebp-F0], eax
00405C4C . 8985 20FFFFFF mov [ebp-E0], eax
00405C52 . 8985 30FFFFFF mov [ebp-D0], eax
00405C58 . C785 D8FEFFFF>mov dword ptr [ebp-128], 00403FA4
00405C62 . C785 D0FEFFFF>mov dword ptr [ebp-130], 8
00405C6C . FF15 58114000 call [<&MSVBVM60.__vbaVarDup>] ; MSVBVM60.__vbaVarDup
00405C72 . 8D95 10FFFFFF lea edx, [ebp-F0]
00405C78 . 8D85 20FFFFFF lea eax, [ebp-E0]
00405C7E . 52 push edx
00405C7F . 8D8D 30FFFFFF lea ecx, [ebp-D0]
00405C85 . 50 push eax
00405C86 . 51 push ecx
00405C87 . 8D95 40FFFFFF lea edx, [ebp-C0]
00405C8D . 6A 00 push 0
00405C8F . 52 push edx
00405C90 . FF15 64104000 call [<&MSVBVM60.#595>] ; 弹出失败窗口
00405C96 . 8D85 10FFFFFF lea eax, [ebp-F0]
00405C9C . 8D8D 20FFFFFF lea ecx, [ebp-E0]
00405CA2 . 50 push eax
00405CA3 . 8D95 30FFFFFF lea edx, [ebp-D0]
00405CA9 . 51 push ecx
00405CAA . 8D85 40FFFFFF lea eax, [ebp-C0]
00405CB0 . 52 push edx
00405CB1 . 50 push eax
00405CB2 > 6A 04 push 4
00405CB4 . FF15 20104000 call [<&MSVBVM60.__vbaFreeVarList>] ; MSVBVM60.__vbaFreeVarList
00405CBA . 83C4 14 add esp, 14
00405CBD > 33FF xor edi, edi
00405CBF > 897D FC mov [ebp-4], edi
00405CC2 . 9B wait
综合：
因为计算过程涉及浮点数，所以为了避免出现小数而导致注册码成浮点数，特意将用户名长度，信箱长度取为10位。而且将用户名第1位查表以及MID后的DEC结果取为10的倍数。
用户名：Rbcdefghij，长度10
信箱：aaaa@a.com，长度10
注册码：385560
加密字符串1：Str1＝ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
加密字符串2：Str2＝dflgfgoOKOFVofgkOFlkLkKPkOKoPiRevHHklYtHJhjKLhyuYjkM
根据用户名在Str1中查表返回位置数InStr1Val，然后Mid(Str2,InStr1Val,1)
查表以MID完成后得到加密字符串KoPiRevHHklJh
对应HEX为
00153404 46 00 6F 00 50 00 69 00 52 00 65 00 76 00 48 00 F.o.P.i.R.e.v.H.
00153414 48 00 6B 00 H.k.
即46 6F 50 69 52 65 76 48 48 6B
以上每个HEX乘以用户名长度(HEX)，然后加总，得到23 DC（即加密字符串HEX加总后×用户名长度（此处为0xA＝10），（46+6F+50+69+52+65+76+48+48+6B)XA=396XA=23DC
大循环结束还得到一个数字，3*length(mail)*HEXTODEC(MID(加密码，1,1）/length（加密码＝用户名长度）＝210（如果有小数则最后取整）
HEXTODEC(23DC)=9180
假设A=HEXTODEC(23DC)/Length（mail）＝9180/10＝918
假设B=注册码/2/(3*length(mail)*HEXTODEC(MID(加密码，1,1）/length（加密码＝用户名长度）)＝918
A,B进行数值比较.不等则OVER
要比对一致，则：
HEXTODEC(23DC)/Length（mail）＝注册码/2/(3*length（mail）*HEXTODEC(MID(加密码，1,1）/length（加密码＝用户名长度）)
则注册码＝(HEXTODEC(23DC)/Length（mail）)X(3*length（mail）*HEXTODEC(MID(加密码，1,1）/length（加密码＝用户名长度）)X2＝9180/10*210*2=918*210*2＝385560
分析的有不对的地方，还请高手指教，以便改进思路，呵呵。
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
