能力值:
( LV8,RANK:130 )
|
-
-
8 楼
我来注释:
name:ccbszhxd
sn:0010020030040050060070081234
004083F0 PUSH EBP
004083F1 MOV EBP,ESP ; EBP=0x12F508;//EBP=ESP
004083F3 SUB ESP,0C ; 在栈中增加空间,大小为0C字节(如EAX为双字,4字节)
004083F6 PUSH 4010F6 ; 0x4010F6进栈; SE 处理程序安装
004083FB MOV EAX,DWORD PTR FS:[0] ; SEH异常处理
00408401 PUSH EAX ; 0x12FA34进栈;//EAX
00408402 MOV DWORD PTR FS:[0],ESP ; FS段[0]=0x12F4F4;
00408409 SUB ESP,12C ; 在栈中增加空间,大小为12C字节(如EAX为双字,4字节)
0040840F PUSH EBX ; 0x1进栈;//EBX
00408410 PUSH ESI ; 0x12F5E4进栈;//ESI
00408411 PUSH EDI ; 0x12F514进栈;//EDI
00408412 MOV DWORD PTR SS:[EBP-C],ESP ; SS段[12F4FC]=0x12F3BC;
00408415 MOV DWORD PTR SS:[EBP-8],4010D0 ; SS段[12F500]=0x4010D0;
0040841C MOV EBX,DWORD PTR SS:[EBP+8] ; EBX=0x14A971;//SS段[12F510];
0040841F MOV EAX,EBX ; EAX=0x14A971;//EAX=EBX
00408421 AND EAX,1 ; EAX=0x1;//EAX=EAX&0x1
00408424 MOV DWORD PTR SS:[EBP-4],EAX ; SS段[12F504]=0x1;
00408427 AND EBX,FFFFFFFE ; EBX=0x14A970;//EBX=EBX&0xFFFFFFFE
0040842A PUSH EBX ; 0x14A970进栈;//EBX
0040842B MOV DWORD PTR SS:[EBP+8],EBX ; SS段[12F510]=0x14A970;
0040842E MOV ECX,DWORD PTR DS:[EBX] ; ECX=0x4092F0;//DS段[14A970];
00408430 CALL DWORD PTR DS:[ECX+4]
00408433 MOV ESI,DWORD PTR DS:[401008] ; ESI=0x7349986E;//DS段[401008];
00408439 XOR EDI,EDI ; EDI=0,CF=0;//自身xor运算结果为0,CF=0
0040843B MOV DWORD PTR SS:[EBP-CC],EDI ; SS段[12F43C]=0x0;
00408441 LEA EDX,DWORD PTR SS:[EBP-CC] ; EDX=0x12F43C;//EDX=EBP-CC
00408447 LEA ECX,DWORD PTR SS:[EBP-44] ; ECX=0x12F4C4;//ECX=EBP-44
0040844A MOV DWORD PTR SS:[EBP-24],EDI ; SS段[12F4E4]=0x0;
0040844D MOV DWORD PTR SS:[EBP-34],EDI ; SS段[12F4D4]=0x0;
00408450 MOV DWORD PTR SS:[EBP-44],EDI ; SS段[12F4C4]=0x0;
00408453 MOV DWORD PTR SS:[EBP-54],EDI ; SS段[12F4B4]=0x0;
00408456 MOV DWORD PTR SS:[EBP-64],EDI ; SS段[12F4A4]=0x0;
00408459 MOV DWORD PTR SS:[EBP-74],EDI ; SS段[12F494]=0x0;
0040845C MOV DWORD PTR SS:[EBP-78],EDI ; SS段[12F490]=0x0;
0040845F MOV DWORD PTR SS:[EBP-7C],EDI ; SS段[12F48C]=0x0;
00408462 MOV DWORD PTR SS:[EBP-8C],EDI ; SS段[12F47C]=0x0;
00408468 MOV DWORD PTR SS:[EBP-9C],EDI ; SS段[12F46C]=0x0;
0040846E MOV DWORD PTR SS:[EBP-AC],EDI ; SS段[12F45C]=0x0;
00408474 MOV DWORD PTR SS:[EBP-BC],EDI ; SS段[12F44C]=0x0;
0040847A MOV DWORD PTR SS:[EBP-DC],EDI ; SS段[12F42C]=0x0;
00408480 MOV DWORD PTR SS:[EBP-118],EDI ; SS段[12F3F0]=0x0;
00408486 MOV DWORD PTR SS:[EBP-128],EDI ; SS段[12F3E0]=0x0;
0040848C MOV DWORD PTR SS:[EBP-C4],EDI ; SS段[12F444]=0x0;
00408492 MOV DWORD PTR SS:[EBP-CC],2 ; SS段[12F43C]=0x2;
0040849C CALL ESI ; <&MSVBVM60.__vbaVarMove>
0040849E MOV EDX,DWORD PTR DS:[EBX] ; EDX=0x4092F0;//DS段[14A970];
004084A0 PUSH EBX ; 0x14A970进栈;//EBX
004084A1 CALL DWORD PTR DS:[EDX+2FC]
004084A7 PUSH EAX ; 0xE11684进栈;//EAX
004084A8 LEA EAX,DWORD PTR SS:[EBP-7C] ; EAX=0x12F48C;//EAX=EBP-7C
004084AB PUSH EAX ; 0x12F48C进栈;//EAX
004084AC CALL DWORD PTR DS:[401038] ; MSVBVM60.__vbaObjSet
004084B2 MOV ECX,DWORD PTR DS:[EAX] ; ECX=0xE04CE0;//DS段[E11684];
004084B4 LEA EDX,DWORD PTR SS:[EBP-78] ; EDX=0x12F490;//EDX=EBP-78
004084B7 PUSH EDX ; 0x12F490进栈;//EDX
004084B8 PUSH EAX ; 0xE11684进栈;//EAX
004084B9 MOV DWORD PTR SS:[EBP-100],EAX ; SS段[12F408]=0xE11684;
004084BF CALL DWORD PTR DS:[ECX+A0]
004084C5 CMP EAX,EDI ; ZF=1;//EAX=0x0,EDI=0x0
004084C7 FCLEX ; 清除异常//浮点指令
004084C9 JGE SHORT 004084E3 ; 跳到004084E3 //ZF=1,SF=OF
004084CB MOV ECX,DWORD PTR SS:[EBP-100]
004084D1 PUSH 0A0
004084D6 PUSH 407BFC
004084DB PUSH ECX
004084DC PUSH EAX
004084DD CALL DWORD PTR DS:[401024] ; MSVBVM60.__vbaHresultCheckObj
004084E3 MOV EAX,DWORD PTR SS:[EBP-78] ; EAX=0x150804;//SS段[12F490]; (字符串:"0010020030040050060070081234")
004084E6 LEA EDX,DWORD PTR SS:[EBP-8C] ; EDX=0x12F47C;//EDX=EBP-8C
004084EC LEA ECX,DWORD PTR SS:[EBP-54] ; ECX=0x12F4B4;//ECX=EBP-54
004084EF MOV DWORD PTR SS:[EBP-78],EDI ; SS段[12F490]=0x0;
004084F2 MOV DWORD PTR SS:[EBP-84],EAX ; SS段[12F484]=0x150804; (字符串:"0010020030040050060070081234")
004084F8 MOV DWORD PTR SS:[EBP-8C],8 ; SS段[12F47C]=0x8;
00408502 CALL ESI
00408504 LEA ECX,DWORD PTR SS:[EBP-7C] ; ECX=0x12F48C;//ECX=EBP-7C
00408507 CALL DWORD PTR DS:[4010C0] ; MSVBVM60.__vbaFreeObj
0040850D MOV EDX,DWORD PTR DS:[EBX] ; EDX=0x4092F0;//DS段[14A970];
0040850F PUSH EBX ; 0x14A970进栈;//EBX
00408510 CALL DWORD PTR DS:[EDX+30C]
00408516 PUSH EAX ; 0xE1121C进栈;//EAX
00408517 LEA EAX,DWORD PTR SS:[EBP-7C] ; EAX=0x12F48C;//EAX=EBP-7C
0040851A PUSH EAX ; 0x12F48C进栈;//EAX
0040851B CALL DWORD PTR DS:[401038] ; MSVBVM60.__vbaObjSet
00408521 MOV ECX,DWORD PTR DS:[EAX] ; ECX=0xE04CE0;//DS段[E1121C];
00408523 LEA EDX,DWORD PTR SS:[EBP-78] ; EDX=0x12F490;//EDX=EBP-78
00408526 PUSH EDX ; 0x12F490进栈;//EDX
00408527 PUSH EAX ; 0xE1121C进栈;//EAX
00408528 MOV DWORD PTR SS:[EBP-100],EAX ; SS段[12F408]=0xE1121C;
0040852E CALL DWORD PTR DS:[ECX+A0]
00408534 CMP EAX,EDI ; ZF=1;//EAX=0x0,EDI=0x0
00408536 FCLEX ; 清除异常//浮点指令
00408538 JGE SHORT 00408552 ; 跳到00408552 //ZF=1,SF=OF
0040853A MOV ECX,DWORD PTR SS:[EBP-100]
00408540 PUSH 0A0
00408545 PUSH 407BFC
0040854A PUSH ECX
0040854B PUSH EAX
0040854C CALL DWORD PTR DS:[401024] ; MSVBVM60.__vbaHresultCheckObj
00408552 MOV EAX,DWORD PTR SS:[EBP-78] ; EAX=0x15085C;//SS段[12F490]; (字符串:"ccbszhxd")
00408555 LEA EDX,DWORD PTR SS:[EBP-8C] ; EDX=0x12F47C;//EDX=EBP-8C
0040855B LEA ECX,DWORD PTR SS:[EBP-64] ; ECX=0x12F4A4;//ECX=EBP-64
0040855E MOV DWORD PTR SS:[EBP-78],EDI ; SS段[12F490]=0x0;
00408561 MOV DWORD PTR SS:[EBP-84],EAX ; SS段[12F484]=0x15085C; (字符串:"ccbszhxd")
00408567 MOV DWORD PTR SS:[EBP-8C],8 ; SS段[12F47C]=0x8;
00408571 CALL ESI
00408573 LEA ECX,DWORD PTR SS:[EBP-7C] ; ECX=0x12F48C;//ECX=EBP-7C
00408576 CALL DWORD PTR DS:[4010C0] ; MSVBVM60.__vbaFreeObj
0040857C MOV EAX,2 ; EAX=0x2
00408581 MOV ECX,1 ; ECX=0x1
00408586 MOV DWORD PTR SS:[EBP-CC],EAX ; SS段[12F43C]=0x2;
0040858C MOV DWORD PTR SS:[EBP-DC],EAX ; SS段[12F42C]=0x2;
00408592 LEA EDX,DWORD PTR SS:[EBP-CC] ; EDX=0x12F43C;//EDX=EBP-CC (vb整型:0)
00408598 MOV DWORD PTR SS:[EBP-C4],ECX ; SS段[12F444]=0x1;
0040859E MOV DWORD PTR SS:[EBP-D4],ECX ; SS段[12F434]=0x1;
004085A4 LEA EAX,DWORD PTR SS:[EBP-64] ; EAX=0x12F4A4;//EAX=EBP-64 (vb字符串:"ccbszhxd")
004085A7 PUSH EDX ; 0x12F43C进栈;//EDX (vb整型:1)
004085A8 LEA ECX,DWORD PTR SS:[EBP-8C] ; ECX=0x12F47C;//ECX=EBP-8C
004085AE PUSH EAX ; 0x12F4A4进栈;//EAX (vb字符串:"ccbszhxd")
004085AF PUSH ECX ; 0x12F47C进栈;//ECX
004085B0 CALL DWORD PTR DS:[401028] ; MSVBVM60.__vbaLenVar
004085B6 PUSH EAX ; 0x12F47C进栈;//EAX (vb长整型:8)
004085B7 LEA EDX,DWORD PTR SS:[EBP-DC] ; EDX=0x12F42C;//EDX=EBP-DC (vb整型:1)
004085BD LEA EAX,DWORD PTR SS:[EBP-128] ; EAX=0x12F3E0;//EAX=EBP-128
004085C3 PUSH EDX ; 0x12F42C进栈;//EDX (vb整型:1)
004085C4 LEA ECX,DWORD PTR SS:[EBP-118] ; ECX=0x12F3F0;//ECX=EBP-118
004085CA PUSH EAX ; 0x12F3E0进栈;//EAX
004085CB LEA EDX,DWORD PTR SS:[EBP-24] ; EDX=0x12F4E4;//EDX=EBP-24
004085CE PUSH ECX ; 0x12F3F0进栈;//ECX
004085CF PUSH EDX ; 0x12F4E4进栈;//EDX
004085D0 CALL DWORD PTR DS:[401034] ; MSVBVM60.__vbaVarForInit
004085D6 CMP EAX,EDI ; ZF=1;//EAX=0x0,EDI=0x0
004085D8 JE 0040868E ; 跳到0040868E //ZF=1,结果相等
004085DE LEA EAX,DWORD PTR SS:[EBP-8C] ; EAX=0x12F47C;//EAX=EBP-8C
004085E4 LEA ECX,DWORD PTR SS:[EBP-64] ; ECX=0x12F4A4;//ECX=EBP-64 (vb字符串:"ccbszhxd")
004085E7 PUSH EAX ; 0x12F47C进栈;//EAX
004085E8 PUSH 1 ; 0x1进栈
004085EA LEA EDX,DWORD PTR SS:[EBP-9C] ; EDX=0x12F46C;//EDX=EBP-9C
004085F0 PUSH ECX ; 0x12F4A4进栈;//ECX (vb字符串:"ccbszhxd")
004085F1 PUSH EDX ; 0x12F46C进栈;//EDX
004085F2 MOV DWORD PTR SS:[EBP-84],80020004 ; SS段[12F484]=0x80020004;
004085FC MOV DWORD PTR SS:[EBP-8C],0A ; SS段[12F47C]=0x0A;
00408606 CALL DWORD PTR DS:[40104C] ; MSVBVM60.rtcMidCharVar
0040860C LEA EDX,DWORD PTR SS:[EBP-9C] ; EDX=0x12F46C;//EDX=EBP-9C (vb字符串:"ccbszhxd")
00408612 LEA ECX,DWORD PTR SS:[EBP-74] ; ECX=0x12F494;//ECX=EBP-74 (vb字符串:"ccbszhxd")
00408615 CALL ESI
00408617 LEA ECX,DWORD PTR SS:[EBP-8C] ; ECX=0x12F47C;//ECX=EBP-8C
0040861D CALL DWORD PTR DS:[40100C] ; MSVBVM60.__vbaFreeVar
00408623 LEA EAX,DWORD PTR SS:[EBP-74] ; EAX=0x12F494;//EAX=EBP-74 (vb字符串:"ccbszhxd")
00408626 LEA ECX,DWORD PTR SS:[EBP-78] ; ECX=0x12F490;//ECX=EBP-78
00408629 PUSH EAX ; 0x12F494进栈;//EAX (vb字符串:"ccbszhxd")
0040862A PUSH ECX ; 0x12F490进栈;//ECX
0040862B CALL DWORD PTR DS:[401080] ; MSVBVM60.__vbaStrVarVal
00408631 PUSH EAX ; 0x1508CC进栈;//EAX (字符串:"ccbszhxd")
00408632 CALL DWORD PTR DS:[40101C] ; MSVBVM60.rtcAnsiValueBstr
00408638 MOV WORD PTR SS:[EBP-C4],AX ; SS段[12F444]=0x63;
0040863F LEA EDX,DWORD PTR SS:[EBP-44] ; EDX=0x12F4C4;//EDX=EBP-44 (vb整型:693)
00408642 LEA EAX,DWORD PTR SS:[EBP-CC] ; EAX=0x12F43C;//EAX=EBP-CC (vb整型:99)
00408648 PUSH EDX ; 0x12F4C4进栈;//EDX (vb整型:693)
00408649 LEA ECX,DWORD PTR SS:[EBP-8C] ; ECX=0x12F47C;//ECX=EBP-8C
0040864F PUSH EAX ; 0x12F43C进栈;//EAX (vb整型:99)
00408650 PUSH ECX ; 0x12F47C进栈;//ECX
00408651 MOV DWORD PTR SS:[EBP-CC],2 ; SS段[12F43C]=0x2;
0040865B CALL DWORD PTR DS:[4010A4] ; MSVBVM60.__vbaVarAdd
00408661 MOV EDX,EAX ; EDX=0x12F47C;//EDX=EAX (vb整型:792)
00408663 LEA ECX,DWORD PTR SS:[EBP-44] ; ECX=0x12F4C4;//ECX=EBP-44 (vb整型:693)
00408666 CALL ESI
00408668 LEA ECX,DWORD PTR SS:[EBP-78] ; ECX=0x12F490;//ECX=EBP-78
0040866B CALL DWORD PTR DS:[4010C4] ; MSVBVM60.__vbaFreeStr
00408671 LEA EDX,DWORD PTR SS:[EBP-128] ; EDX=0x12F3E0;//EDX=EBP-128 (vb长整型:8)
00408677 LEA EAX,DWORD PTR SS:[EBP-118] ; EAX=0x12F3F0;//EAX=EBP-118 (vb长整型:1)
0040867D PUSH EDX ; 0x12F3E0进栈;//EDX (vb长整型:8)
0040867E LEA ECX,DWORD PTR SS:[EBP-24] ; ECX=0x12F4E4;//ECX=EBP-24 (vb长整型:8)
00408681 PUSH EAX ; 0x12F3F0进栈;//EAX (vb长整型:1)
00408682 PUSH ECX ; 0x12F4E4进栈;//ECX (vb长整型:8)
00408683 CALL DWORD PTR DS:[4010B8] ; MSVBVM60.__vbaVarForNext
00408689 JMP 004085D6 ; 跳转到004085D6
0040868E LEA EDX,DWORD PTR SS:[EBP-44] ; EDX=0x12F4C4;//EDX=EBP-44 (vb整型:792)
00408691 LEA EAX,DWORD PTR SS:[EBP-CC] ; EAX=0x12F43C;//EAX=EBP-CC (vb整型:99)
00408697 PUSH EDX ; 0x12F4C4进栈;//EDX (vb整型:792)
00408698 LEA ECX,DWORD PTR SS:[EBP-8C] ; ECX=0x12F47C;//ECX=EBP-8C
0040869E PUSH EAX ; 0x12F43C进栈;//EAX (vb整型:99)
0040869F PUSH ECX ; 0x12F47C进栈;//ECX
004086A0 MOV DWORD PTR SS:[EBP-C4],-0DCB ; SS段[12F444]=-0xDCB
004086AA MOV DWORD PTR SS:[EBP-CC],2 ; SS段[12F43C]=0x2;
004086B4 CALL DWORD PTR DS:[401030] ; MSVBVM60.__vbaVarXor
004086BA MOV EDX,EAX ; EDX=0x12F47C;//EDX=EAX (vb整型:61741)
004086BC LEA ECX,DWORD PTR SS:[EBP-34] ; ECX=0x12F4D4;//ECX=EBP-34
004086BF CALL ESI
004086C1 LEA EDX,DWORD PTR SS:[EBP-34] ; EDX=0x12F4D4;//EDX=EBP-34 (vb整型:61741)
004086C4 LEA EAX,DWORD PTR SS:[EBP-34] ; EAX=0x12F4D4;//EAX=EBP-34 (vb整型:61741)
004086C7 PUSH EDX ; 0x12F4D4进栈;//EDX (vb整型:61741)
004086C8 LEA ECX,DWORD PTR SS:[EBP-8C] ; ECX=0x12F47C;//ECX=EBP-8C
004086CE PUSH EAX ; 0x12F4D4进栈;//EAX (vb整型:61741)
004086CF PUSH ECX ; 0x12F47C进栈;//ECX
004086D0 CALL DWORD PTR DS:[40106C] ; MSVBVM60.__vbaVarMul
004086D6 MOV EDX,EAX ; EDX=0x12F47C;//EDX=EAX (vb长整型:14402025)
004086D8 LEA ECX,DWORD PTR SS:[EBP-34] ; ECX=0x12F4D4;//ECX=EBP-34 (vb整型:61741)
004086DB CALL ESI
004086DD LEA EDX,DWORD PTR SS:[EBP-34] ; EDX=0x12F4D4;//EDX=EBP-34 (vb长整型:14402025)
004086E0 LEA EAX,DWORD PTR SS:[EBP-CC] ; EAX=0x12F43C;//EAX=EBP-CC (vb整型:62005)
004086E6 PUSH EDX ; 0x12F4D4进栈;//EDX (vb长整型:14402025)
004086E7 LEA ECX,DWORD PTR SS:[EBP-8C] ; ECX=0x12F47C;//ECX=EBP-8C
004086ED PUSH EAX ; 0x12F43C进栈;//EAX (vb整型:62005)
004086EE PUSH ECX ; 0x12F47C进栈;//ECX
004086EF MOV DWORD PTR SS:[EBP-C4],0C9 ; SS段[12F444]=0x0C9;
004086F9 MOV DWORD PTR SS:[EBP-CC],2 ; SS段[12F43C]=0x2;
00408703 CALL DWORD PTR DS:[4010A4] ; MSVBVM60.__vbaVarAdd
00408709 MOV EDX,EAX ; EDX=0x12F47C;//EDX=EAX (vb长整型:14402226)
0040870B LEA ECX,DWORD PTR SS:[EBP-34] ; ECX=0x12F4D4;//ECX=EBP-34 (vb长整型:14402025)
0040870E CALL ESI
00408710 LEA EDX,DWORD PTR SS:[EBP-34] ; EDX=0x12F4D4;//EDX=EBP-34 (vb长整型:14402226)
00408713 LEA EAX,DWORD PTR SS:[EBP-8C] ; EAX=0x12F47C;//EAX=EBP-8C
00408719 PUSH EDX ; 0x12F4D4进栈;//EDX (vb长整型:14402226)
0040871A PUSH EAX ; 0x12F47C进栈;//EAX
0040871B CALL DWORD PTR DS:[401094] ; MSVBVM60.rtcHexVarFromVar
00408721 LEA EDX,DWORD PTR SS:[EBP-8C] ; EDX=0x12F47C;//EDX=EBP-8C (vb字符串:"DBC2B2")
00408727 LEA ECX,DWORD PTR SS:[EBP-34] ; ECX=0x12F4D4;//ECX=EBP-34 (vb长整型:14402226)
0040872A CALL ESI
0040872C MOV EAX,8 ; EAX=0x8
00408731 LEA ECX,DWORD PTR SS:[EBP-CC] ; ECX=0x12F43C;//ECX=EBP-CC (vb整型:201)
00408737 MOV DWORD PTR SS:[EBP-CC],EAX ; SS段[12F43C]=0x8;
0040873D MOV DWORD PTR SS:[EBP-DC],EAX ; SS段[12F42C]=0x8;
00408743 LEA EDX,DWORD PTR SS:[EBP-34] ; EDX=0x12F4D4;//EDX=EBP-34 (vb字符串:"DBC2B2")
00408746 PUSH ECX ; 0x12F43C进栈;//ECX
00408747 LEA EAX,DWORD PTR SS:[EBP-8C] ; EAX=0x12F47C;//EAX=EBP-8C
0040874D PUSH EDX ; 0x12F4D4进栈;//EDX (vb字符串:"DBC2B2")
0040874E PUSH EAX ; 0x12F47C进栈;//EAX
0040874F MOV DWORD PTR SS:[EBP-C4],407C10 ; UNICODE "MKC"
00408759 MOV DWORD PTR SS:[EBP-D4],407C1C ; UNICODE "CAR"
00408763 CALL DWORD PTR DS:[401084] ; MSVBVM60.__vbaVarCat
00408769 LEA ECX,DWORD PTR SS:[EBP-DC] ; ECX=0x12F42C;//ECX=EBP-DC (vb字符串:"CAR")
0040876F PUSH EAX ; 0x12F47C进栈;//EAX (vb字符串:"MKCDBC2B2")
00408770 LEA EDX,DWORD PTR SS:[EBP-9C] ; EDX=0x12F46C;//EDX=EBP-9C
00408776 PUSH ECX ; 0x12F42C进栈;//ECX (vb字符串:"CAR")
00408777 PUSH EDX ; 0x12F46C进栈;//EDX
00408778 CALL DWORD PTR DS:[401084] ; MSVBVM60.__vbaVarCat
0040877E MOV EDX,EAX ; EDX=0x12F46C;//EDX=EAX (vb字符串:"MKCDBC2B2CAR")
00408780 LEA ECX,DWORD PTR SS:[EBP-34] ; ECX=0x12F4D4;//ECX=EBP-34 (vb字符串:"DBC2B2")
00408783 CALL ESI
00408785 MOV ESI,DWORD PTR DS:[40100C] ; ESI=0x7349109E;//DS段[40100C];
0040878B LEA ECX,DWORD PTR SS:[EBP-8C] ; ECX=0x12F47C;//ECX=EBP-8C (vb字符串:"MKCDBC2B2")
00408791 CALL ESI ; <&MSVBVM60.__vbaFreeVar>
00408793 MOV EAX,DWORD PTR DS:[EBX] ; EAX=0x4092F0;//DS段[14A970];
00408795 PUSH EBX ; 0x14A970进栈;//EBX
00408796 CALL DWORD PTR DS:[EAX+2FC]
0040879C LEA ECX,DWORD PTR SS:[EBP-7C] ; ECX=0x12F48C;//ECX=EBP-7C
0040879F PUSH EAX ; 0xE11684进栈;//EAX
004087A0 PUSH ECX ; 0x12F48C进栈;//ECX
004087A1 CALL DWORD PTR DS:[401038] ; MSVBVM60.__vbaObjSet
004087A7 MOV EBX,EAX ; EBX=0xE11684;//EBX=EAX
004087A9 LEA EAX,DWORD PTR SS:[EBP-78] ; EAX=0x12F490;//EAX=EBP-78
004087AC PUSH EAX ; 0x12F490进栈;//EAX
004087AD PUSH EBX ; 0xE11684进栈;//EBX
004087AE MOV EDX,DWORD PTR DS:[EBX] ; EDX=0xE04CE0;//DS段[E11684];
004087B0 CALL DWORD PTR DS:[EDX+A0]
004087B6 FCLEX ; 清除异常//浮点指令
004087B8 CMP EAX,EDI ; ZF=1;//EAX=0x0,EDI=0x0
004087BA JGE SHORT 004087CE ; 跳到004087CE //ZF=1,SF=OF
004087BC PUSH 0A0
004087C1 PUSH 407BFC
004087C6 PUSH EBX
004087C7 PUSH EAX
004087C8 CALL DWORD PTR DS:[401024] ; MSVBVM60.__vbaHresultCheckObj
004087CE MOV EAX,DWORD PTR SS:[EBP-78] ; EAX=0x150974;//SS段[12F490]; (字符串:"0010020030040050060070081234")
004087D1 LEA ECX,DWORD PTR SS:[EBP-8C] ; ECX=0x12F47C;//ECX=EBP-8C
004087D7 LEA EDX,DWORD PTR SS:[EBP-34] ; EDX=0x12F4D4;//EDX=EBP-34 (vb字符串:"MKCDBC2B2CAR")
004087DA PUSH ECX ; 0x12F47C进栈;//ECX
004087DB PUSH EDX ; 0x12F4D4进栈;//EDX (vb字符串:"MKCDBC2B2CAR")
004087DC MOV DWORD PTR SS:[EBP-78],EDI ; SS段[12F490]=0x0;
004087DF MOV DWORD PTR SS:[EBP-84],EAX ; SS段[12F484]=0x150974; (字符串:"0010020030040050060070081234")
004087E5 MOV DWORD PTR SS:[EBP-8C],8008 ; SS段[12F47C]=0x8008;
004087EF CALL DWORD PTR DS:[401058] ; MSVBVM60.__vbaVarTstEq
004087F5 LEA ECX,DWORD PTR SS:[EBP-7C] ; ECX=0x12F48C;//ECX=EBP-7C
004087F8 MOV EBX,EAX ; EBX=0x0;//EBX=EAX
004087FA CALL DWORD PTR DS:[4010C0] ; MSVBVM60.__vbaFreeObj
00408800 LEA ECX,DWORD PTR SS:[EBP-8C] ; ECX=0x12F47C;//ECX=EBP-8C (vb字符串:"0010020030040050060070081234")
00408806 CALL ESI
00408808 MOV ECX,80020004 ; ECX=0x80020004
0040880D MOV EAX,0A ; EAX=0xA
00408812 CMP BX,DI ; ZF=1;//BX=0x0,DI=0x0
00408815 MOV DWORD PTR SS:[EBP-B4],ECX ; SS段[12F454]=0x80020004;
0040881B MOV DWORD PTR SS:[EBP-BC],EAX ; SS段[12F44C]=0xA;
00408821 MOV DWORD PTR SS:[EBP-A4],ECX ; SS段[12F464]=0x80020004;
00408827 MOV DWORD PTR SS:[EBP-AC],EAX ; SS段[12F45C]=0xA;
0040882D MOV DWORD PTR SS:[EBP-94],ECX ; SS段[12F474]=0x80020004;
00408833 MOV DWORD PTR SS:[EBP-9C],EAX ; SS段[12F46C]=0xA;
00408839 JE SHORT 004088A2 ; 跳到004088A2 //ZF=1,结果相等
0040883B LEA EDX,DWORD PTR SS:[EBP-CC]
00408841 LEA ECX,DWORD PTR SS:[EBP-8C]
00408847 MOV DWORD PTR SS:[EBP-C4],407C28
00408851 MOV DWORD PTR SS:[EBP-CC],8
0040885B CALL DWORD PTR DS:[4010A8] ; MSVBVM60.__vbaVarDup
00408861 LEA EAX,DWORD PTR SS:[EBP-BC]
00408867 LEA ECX,DWORD PTR SS:[EBP-AC]
0040886D PUSH EAX
0040886E LEA EDX,DWORD PTR SS:[EBP-9C]
00408874 PUSH ECX
00408875 PUSH EDX
00408876 LEA EAX,DWORD PTR SS:[EBP-8C]
0040887C PUSH EDI
0040887D PUSH EAX
0040887E CALL DWORD PTR DS:[40103C] ; MSVBVM60.rtcMsgBox
00408884 LEA ECX,DWORD PTR SS:[EBP-BC]
0040888A LEA EDX,DWORD PTR SS:[EBP-AC]
00408890 PUSH ECX
00408891 LEA EAX,DWORD PTR SS:[EBP-9C]
00408897 PUSH EDX
00408898 LEA ECX,DWORD PTR SS:[EBP-8C]
0040889E PUSH EAX
0040889F PUSH ECX
004088A0 JMP SHORT 00408907 ; 00408907
004088A2 LEA EDX,DWORD PTR SS:[EBP-CC] ; EDX=0x12F43C;//EDX=EBP-CC (vb字符串:"MKC")
004088A8 LEA ECX,DWORD PTR SS:[EBP-8C] ; ECX=0x12F47C;//ECX=EBP-8C
004088AE MOV DWORD PTR SS:[EBP-C4],407C3C ; SS段[12F444]=0x407C3C;
004088B8 MOV DWORD PTR SS:[EBP-CC],8 ; SS段[12F43C]=0x8;
004088C2 CALL DWORD PTR DS:[4010A8] ; MSVBVM60.__vbaVarDup
004088C8 LEA EDX,DWORD PTR SS:[EBP-BC] ; EDX=0x12F44C;//EDX=EBP-BC
004088CE LEA EAX,DWORD PTR SS:[EBP-AC] ; EAX=0x12F45C;//EAX=EBP-AC
004088D4 PUSH EDX ; 0x12F44C进栈;//EDX
004088D5 LEA ECX,DWORD PTR SS:[EBP-9C] ; ECX=0x12F46C;//ECX=EBP-9C
004088DB PUSH EAX ; 0x12F45C进栈;//EAX
004088DC PUSH ECX ; 0x12F46C进栈;//ECX
004088DD LEA EDX,DWORD PTR SS:[EBP-8C] ; EDX=0x12F47C;//EDX=EBP-8C (vb字符串:"火星人?地球是很危险地~~")
004088E3 PUSH EDI ; 0x0进栈;//EDI
004088E4 PUSH EDX ; 0x12F47C进栈;//EDX (vb字符串:"火星人?地球是很危险地~~")
004088E5 CALL DWORD PTR DS:[40103C] ; MSVBVM60.rtcMsgBox
|