在搞一个程序的加密算法时，碰到难题，该程序是VB写的，好多函数都搞不懂。
基本情况如下：字串str1 经过下面的循环代码加密 变成字串str2
其中有一个固定的字串str3为：ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz
请大侠指点一下这是什么个算法。

0048A18D push edx ;str3
0048A18E push 1
0048A190 call esi ;MSVBVM60.__vbaLenBstr
0048A192 mov dword ptr [ebp-E4], eax
0048A198 xor esi, esi
0048A19A cmp esi, dword ptr [ebp-E4] //esi 当前次数，[ebp-E4]待加密字符串长度
0048A1A0 jg 0048A4A3 //当esi>[ebp-E4] 跳走，说明加密完毕
0048A1A6 lea eax, dword ptr [ebp-4C]
0048A1A9 push eax
0048A1AA call dword ptr [401360] ; MSVBVM60.rtcGetTimeVar
0048A1B0 lea ecx, dword ptr [ebp-4C]
0048A1B3 push ecx
0048A1B4 call dword ptr [40110C] ; MSVBVM60.rtcRandomize
0048A1BA lea ecx, dword ptr [ebp-4C]
0048A1BD call ebx ;MSVBVM60.__vbaFreeVar
0048A1BF lea edx, dword ptr [ebp-4C]
0048A1C2 push edx
0048A1C3 mov dword ptr [ebp-44], 80020004
0048A1CA mov dword ptr [ebp-4C], 0A
0048A1D1 call dword ptr [4010FC] ; MSVBVM60.rtcRandomNext
0048A1D7 fstp dword ptr [ebp-D4]
0048A1DD fld dword ptr [ebp-D4]
0048A1E3 fmul dword ptr [401E50]
0048A1E9 fstsw ax
0048A1EB test al, 0D
( 0048A1ED jnz 0048A535 )
0048A1F3 call dword ptr [4011F4] ; MSVBVM60.__vbaFpUI1
0048A1F9 lea ecx, dword ptr [ebp-4C]
0048A1FC mov byte ptr [ebp-1C], al
0048A1FF call ebx ;MSVBVM60.__vbaFreeVar
0048A201 mov ecx, dword ptr [ebp-3C]
0048A204 cmp ecx, edi
( 0048A206 je short 0048A22D )
0048A208 cmp word ptr [ecx], 1
( 0048A20C jnz short 0048A22D )
0048A20E mov edx, dword ptr [ecx+14]
0048A211 mov eax, dword ptr [ecx+10]
0048A214 mov ebx, esi
0048A216 sub ebx, edx
0048A218 cmp ebx, eax
0048A21A jb short 0048A225

0048A225 mov dword ptr [ebp-F0], ebx
0048A22B jmp short 0048A23C
( 0048A22D call dword ptr [4011A4] ; MSVBVM60.__vbaGenerateBoundsError
0048A233 mov ecx, dword ptr [ebp-3C]
0048A236 mov dword ptr [ebp-F0], eax )

0048A23C cmp ecx, edi
0048A23E je short 0048A261
0048A240 cmp word ptr [ecx], 1
0048A244 jnz short 0048A261
0048A246 mov edx, dword ptr [ecx+14]
0048A249 mov eax, dword ptr [ecx+10]
0048A24C mov ebx, esi
0048A24E sub ebx, edx
0048A250 cmp ebx, eax
0048A252 jb short 0048A25D

( 0048A254 call dword ptr [4011A4] ; MSVBVM60.__vbaGenerateBoundsError
0048A25A mov ecx, dword ptr [ebp-3C] )

0048A25D mov edi, ebx
0048A25F jmp short 0048A26C
( 0048A261 call dword ptr [4011A4] ) ; MSVBVM60.__vbaGenerateBoundsError

0048A267 mov ecx, dword ptr [ebp-3C]
0048A26A mov edi, eax

0048A26C mov ecx, dword ptr [ecx+C]
0048A26F mov eax, dword ptr [ebp-F0]
0048A275 mov dl, byte ptr [ecx+eax]
0048A278 xor dl, byte ptr [ebp-1C]
0048A27B mov byte ptr [ecx+edi], dl
0048A27E mov eax, dword ptr [ebp-3C]
0048A281 test eax, eax
0048A283 je short 0048A2A1
0048A285 cmp word ptr [eax], 1
0048A289 jnz short 0048A2A1
0048A28B mov edx, dword ptr [eax+14]
0048A28E mov ecx, dword ptr [eax+10]
0048A291 mov ebx, esi
0048A293 sub ebx, edx
0048A295 cmp ebx, ecx
0048A297 jb short 0048A2A9

0048A299 call dword ptr [4011A4] ; MSVBVM60.__vbaGenerateBoundsError
0048A29F jmp short 0048A2A9
0048A2A1 call dword ptr [4011A4] ; MSVBVM60.__vbaGenerateBoundsError
0048A2A7 mov ebx, eax

0048A2A9 mov eax, dword ptr [ebp-2C]
0048A2AC push eax
0048A2AD call dword ptr [401040] ; MSVBVM60.__vbaLenBstr
0048A2B3 mov edx, dword ptr [ebp-3C]
0048A2B6 mov ecx, eax
0048A2B8 mov eax, dword ptr [edx+C]
0048A2BB xor edx, edx
0048A2BD mov dl, byte ptr [eax+ebx]
0048A2C0 mov edi, dword ptr [401250] ; MSVBVM60.__vbaUI1I4
0048A2C6 mov eax, edx
0048A2C8 cdq
0048A2C9 idiv ecx
0048A2CB mov ecx, edx
0048A2CD call edi
0048A2CF mov byte ptr [ebp-20], al
0048A2D2 mov eax, dword ptr [ebp-3C]
0048A2D5 test eax, eax
0048A2D7 je short 0048A2F5
0048A2D9 cmp word ptr [eax], 1
0048A2DD jnz short 0048A2F5
0048A2DF mov edx, dword ptr [eax+14]
0048A2E2 mov ecx, dword ptr [eax+10]
0048A2E5 mov ebx, esi
0048A2E7 sub ebx, edx
0048A2E9 cmp ebx, ecx
0048A2EB jb short 0048A2FD

0048A2ED call dword ptr [4011A4] ; MSVBVM60.__vbaGenerateBoundsError
0048A2F3 jmp short 0048A2FD
0048A2F5 call dword ptr [4011A4] ; MSVBVM60.__vbaGenerateBoundsError
0048A2FB mov ebx, eax

0048A2FD mov eax, dword ptr [ebp-2C]
0048A300 push eax
0048A301 call dword ptr [401040] ; MSVBVM60.__vbaLenBstr
0048A307 mov edx, dword ptr [ebp-3C]
0048A30A mov ecx, eax
0048A30C mov eax, dword ptr [edx+C]
0048A30F xor edx, edx
0048A311 mov dl, byte ptr [eax+ebx]
0048A314 mov eax, edx
0048A316 cdq
0048A317 idiv ecx
0048A319 mov ecx, eax
0048A31B call edi
0048A31D push 40080000
0048A322 push 0
0048A324 push 40000000
0048A329 push 0
0048A32B mov byte ptr [ebp-28], al
0048A32E call dword ptr [401324] ; MSVBVM60.__vbaPowerR8
0048A334 mov eax, dword ptr [ebp-28]
0048A337 mov ecx, dword ptr [ebp-1C]
0048A33A and eax, 0FF
0048A33F mov dword ptr [ebp-F4], eax
0048A345 fild dword ptr [ebp-F4]
0048A34B and ecx, 0FF
0048A351 mov dword ptr [ebp-100], ecx
0048A357 fstp qword ptr [ebp-FC]
0048A35D fmul qword ptr [ebp-FC]
0048A363 fild dword ptr [ebp-100]
0048A369 fstp qword ptr [ebp-108]
0048A36F qword ptr [ebp-108]
0048A375 fstsw ax
0048A377 test al, 0D
0048A379 jnz 0048A535
0048A37F call dword ptr [4011F4] ; MSVBVM60.__vbaFpUI1
0048A385 movzx cx, byte ptr [ebp-20]
0048A38A mov edi, dword ptr [401184] ; MSVBVM60.rtcMidCharVar
0048A390 add cx, 1
0048A394 lea edx, dword ptr [ebp-2C]
0048A397 mov bl, al
0048A399 jo 0048A53A
0048A39F mov dword ptr [ebp-98], edx
0048A3A5 movsx edx, cx
0048A3A8 lea eax, dword ptr [ebp-4C]
0048A3AB push eax
0048A3AC push edx
0048A3AD lea eax, dword ptr [ebp-A0]
0048A3B3 push eax
0048A3B4 lea ecx, dword ptr [ebp-5C]
0048A3B7 1 push ecx
0048A3B8 mov dword ptr [ebp-44], 1
0048A3BF mov dword ptr [ebp-4C], 2
0048A3C6 mov dword ptr [ebp-A0], 4008
0048A3D0 call edi
0048A3D2 xor cx, cx
0048A3D5 mov cl, bl
0048A3D7 lea edx, dword ptr [ebp-2C]
0048A3DA mov dword ptr [ebp-B8], edx
0048A3E0 lea eax, dword ptr [ebp-6C]
0048A3E3 push eax
0048A3E4 lea eax, dword ptr [ebp-C0]
0048A3EA mov dword ptr [ebp-64], 1
0048A3F1 add cx, 1
0048A3F5 jo 0048A53A
0048A3FB movsx edx, cx
0048A3FE push edx
0048A3FF push eax
0048A400 lea ecx, dword ptr [ebp-7C]
0048A403 push ecx
0048A404 mov dword ptr [ebp-6C], 2
0048A40B mov dword ptr [ebp-C0], 4008
0048A415 call edi
0048A417 lea edx, dword ptr [ebp-5C]
0048A41A push edx
0048A41B lea eax, dword ptr [ebp-7C]
0048A41E push eax
0048A41F lea ecx, dword ptr [ebp-8C]
0048A425 push ecx
0048A426 call dword ptr [401358] ; MSVBVM60.__vbaVarAdd
0048A42C 50 push eax
0048A42D call dword ptr [40103C] ; MSVBVM60.__vbaStrVarMove
0048A433 mov edx, eax
0048A435 lea ecx, dword ptr [ebp-38]
0048A438 call dword ptr [4013A8] ; MSVBVM60.__vbaStrMove
0048A43E lea edx, dword ptr [ebp-8C]
0048A444 push edx
0048A445 lea eax, dword ptr [ebp-7C]
0048A448 push eax
0048A449 lea ecx, dword ptr [ebp-5C]
0048A44C push ecx
0048A44D lea edx, dword ptr [ebp-6C]
0048A450 push edx
0048A451 lea eax, dword ptr [ebp-4C]
0048A454 push eax
0048A455 push 5
0048A457 call dword ptr [40105C] ; MSVBVM60.__vbaFreeVarList
0048A45D mov eax, dword ptr [ebp-38]
0048A460 add esp, 18
0048A463 mov edx, esi
0048A465 imul edx, edx, 2
0048A468 jo 0048A53A
0048A46E lea ecx, dword ptr [ebp-24]
0048A471 push ecx
0048A472 add edx, 1
0048A475 jo 0048A53A
0048A47B push edx
0048A47C push 2
0048A47E 5push eax
0048A47F push 0
0048A481 call dword ptr [4013EC] ; MSVBVM60.__vbaMidStmtBstr
0048A487 mov ebx, dword ptr [401034] ; MSVBVM60.__vbaFreeVar
0048A48D mov eax, 1
0048A492 add eax, esi
0048A494 jo 0048A53A
0048A49A mov esi, eax
0048A49C xor edi, edi
0048A49E jmp 0048A19A

[课程]Android-CTF解题方法汇总！