[求助]大家帮我看看,这是什么意思?谢谢!-软件逆向-看雪-安全社区|安全招聘|kanxue.com

[求助]大家帮我看看,这是什么意思?谢谢!

2004-12-20 21:36 3833

[求助]大家帮我看看,这是什么意思?谢谢!

FROG_007

2004-12-20 21:36

3833

* Reference To: MSVBVM60.rtcInputBox, Ord:0254h
                              |
:00425C0A FF15A0104000          Call dword ptr [004010A0]
:00425C10 8BD0                   mov edx, eax
:00425C12 8D4DE8                lea ecx, dword ptr [ebp-18]

* Reference To: MSVBVM60.__vbaStrMove, Ord:0000h
                              |
:00425C15 FF150C124000          Call dword ptr [0040120C]
:00425C1B 8D4DE0                lea ecx, dword ptr [ebp-20]

* Reference To: MSVBVM60.__vbaFreeStr, Ord:0000h
                              |
:00425C1E FF153C124000          Call dword ptr [0040123C]
:00425C24 8D8538FFFFFF          lea eax, dword ptr [ebp+FFFFFF38]
:00425C2A 8D8D48FFFFFF          lea ecx, dword ptr [ebp+FFFFFF48]
:00425C30 50                   push eax
:00425C31 8D9558FFFFFF          lea edx, dword ptr [ebp+FFFFFF58]
:00425C37 51                   push ecx
:00425C38 8D8568FFFFFF          lea eax, dword ptr [ebp+FFFFFF68]
:00425C3E 52                   push edx
:00425C3F 8D8D78FFFFFF          lea ecx, dword ptr [ebp+FFFFFF78]
:00425C45 50                   push eax
:00425C46 8D5588                lea edx, dword ptr [ebp-78]
:00425C49 51                   push ecx
:00425C4A 8D4598                lea eax, dword ptr [ebp-68]
:00425C4D 52                   push edx
:00425C4E 8D4DA8                lea ecx, dword ptr [ebp-58]
:00425C51 50                   push eax
:00425C52 8D55C8                lea edx, dword ptr [ebp-38]
:00425C55 51                   push ecx
:00425C56 8D45B8                lea eax, dword ptr [ebp-48]
:00425C59 52                   push edx
:00425C5A 50                   push eax
:00425C5B 53                   push ebx

* Reference To: MSVBVM60.__vbaFreeVarList, Ord:0000h
                              |
:00425C5C FF1540104000          Call dword ptr [00401040]
:00425C62 8B4DE8                mov ecx, dword ptr [ebp-18]
:00425C65 83C42C                add esp, 0000002C
:00425C68 51                   push ecx
:00425C69 68905A4000             push 00405A90

* Reference To: MSVBVM60.__vbaStrCmp, Ord:0000h
                              |
:00425C6E FF15E4104000          Call dword ptr [004010E4]
:00425C74 85C0                   test eax, eax
:00425C76 757F                   jne 00425CF7

* Reference To: MSVBVM60.__vbaVarDup, Ord:0000h
                              |
:00425C78 8B3DE4114000          mov edi, dword ptr [004011E4]
:00425C7E 895D98                mov dword ptr [ebp-68], ebx
:00425C81 895DA8                mov dword ptr [ebp-58], ebx
:00425C84 B804000280             mov eax, 80020004
:00425C89 BB08000000             mov ebx, 00000008
:00425C8E 8D9518FFFFFF          lea edx, dword ptr [ebp+FFFFFF18]
:00425C94 8D4DB8                lea ecx, dword ptr [ebp-48]
:00425C97 8945A0                mov dword ptr [ebp-60], eax
:00425C9A 8945B0                mov dword ptr [ebp-50], eax

* Possible StringData Ref from Data Obj ->"Yc6R\Of[`N?唼"
                              |
:00425C9D C78520FFFFFF5C6A4000 mov dword ptr [ebp+FFFFFF20], 00406A5C
:00425CA7 899D18FFFFFF          mov dword ptr [ebp+FFFFFF18], ebx
:00425CAD FFD7                   call edi
:00425CAF 8D9528FFFFFF          lea edx, dword ptr [ebp+FFFFFF28]
:00425CB5 8D4DC8                lea ecx, dword ptr [ebp-38]

* Possible StringData Ref from Data Obj ->"桁?xzz"
                              |
:00425CB8 C78530FFFFFF70754000 mov dword ptr [ebp+FFFFFF30], 00407570
:00425CC2 899D28FFFFFF          mov dword ptr [ebp+FFFFFF28], ebx
:00425CC8 FFD7                   call edi
:00425CCA 8D5598                lea edx, dword ptr [ebp-68]
:00425CCD 8D45A8                lea eax, dword ptr [ebp-58]
:00425CD0 52                   push edx
:00425CD1 8D4DB8                lea ecx, dword ptr [ebp-48]
:00425CD4 50                   push eax
:00425CD5 51                   push ecx
:00425CD6 8D55C8                lea edx, dword ptr [ebp-38]
:00425CD9 6A40                   push 00000040
:00425CDB 52                   push edx

* Reference To: MSVBVM60.rtcMsgBox, Ord:0253h
                              |
:00425CDC FF159C104000          Call dword ptr [0040109C]
:00425CE2 8D4598                lea eax, dword ptr [ebp-68]
:00425CE5 8D4DA8                lea ecx, dword ptr [ebp-58]
:00425CE8 50                   push eax
:00425CE9 8D55B8                lea edx, dword ptr [ebp-48]
:00425CEC 51                   push ecx
:00425CED 8D45C8                lea eax, dword ptr [ebp-38]
:00425CF0 52                   push edx
:00425CF1 50                   push eax
:00425CF2 E9FC020000             jmp 00425FF3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425C76(C)
|
:00425CF7 8B0F                   mov ecx, dword ptr [edi]
:00425CF9 57                   push edi
:00425CFA FF91FC020000          call dword ptr [ecx+000002FC]
:00425D00 8D55DC                lea edx, dword ptr [ebp-24]
:00425D03 50                   push eax
:00425D04 52                   push edx

* Reference To: MSVBVM60.__vbaObjSet, Ord:0000h
                              |
:00425D05 FF1598104000          Call dword ptr [00401098]
:00425D0B 8B08                   mov ecx, dword ptr [eax]
:00425D0D 50                   push eax
:00425D0E 8985C0FEFFFF          mov dword ptr [ebp+FFFFFEC0], eax
:00425D14 FF9178020000          call dword ptr [ecx+00000278]
:00425D1A 3BC6                   cmp eax, esi
:00425D1C DBE2                   fclex
:00425D1E 7D18                   jge 00425D38
:00425D20 8B95C0FEFFFF          mov edx, dword ptr [ebp+FFFFFEC0]
:00425D26 6878020000             push 00000278

* Possible StringData Ref from Data Obj ->"盐????"
                              |
:00425D2B 68F8674000             push 004067F8
:00425D30 52                   push edx
:00425D31 50                   push eax

* Reference To: MSVBVM60.__vbaHresultCheckObj, Ord:0000h
                              |
:00425D32 FF156C104000          Call dword ptr [0040106C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425D1E(C)
|
:00425D38 8D4DDC                lea ecx, dword ptr [ebp-24]

* Reference To: MSVBVM60.__vbaFreeObj, Ord:0000h
                              |
:00425D3B FF1538124000          Call dword ptr [00401238]
:00425D41 8B07                   mov eax, dword ptr [edi]
:00425D43 57                   push edi
:00425D44 FF90FC020000          call dword ptr [eax+000002FC]
:00425D4A 8D4DDC                lea ecx, dword ptr [ebp-24]
:00425D4D 50                   push eax
:00425D4E 51                   push ecx

* Reference To: MSVBVM60.__vbaObjSet, Ord:0000h
                              |
:00425D4F FF1598104000          Call dword ptr [00401098]
:00425D55 8B10                   mov edx, dword ptr [eax]
:00425D57 56                   push esi
:00425D58 50                   push eax
:00425D59 8985C0FEFFFF          mov dword ptr [ebp+FFFFFEC0], eax
:00425D5F FF526C                call [edx+6C]
:00425D62 3BC6                   cmp eax, esi
:00425D64 DBE2                   fclex
:00425D66 7D15                   jge 00425D7D
:00425D68 8B8DC0FEFFFF          mov ecx, dword ptr [ebp+FFFFFEC0]
:00425D6E 6A6C                   push 0000006C

* Possible StringData Ref from Data Obj ->"盐????"
                              |
:00425D70 68F8674000             push 004067F8
:00425D75 51                   push ecx
:00425D76 50                   push eax

* Reference To: MSVBVM60.__vbaHresultCheckObj, Ord:0000h
                              |
:00425D77 FF156C104000          Call dword ptr [0040106C]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00425D66(C)
|
:00425D7D 8D4DDC                lea ecx, dword ptr [ebp-24]

* Reference To: MSVBVM60.__vbaFreeObj, Ord:0000h
                              |
:00425D80 FF1538124000          Call dword ptr [00401238]
:00425D86 8B17                   mov edx, dword ptr [edi]
:00425D88 57                   push edi
:00425D89 FF92FC020000          call dword ptr [edx+000002FC]
:00425D8F 50                   push eax
:00425D90 8D45D8                lea eax, dword ptr [ebp-28]
:00425D93 50                   push eax

* Reference To: MSVBVM60.__vbaObjSet, Ord:0000h
                              |
:00425D94 FF1598104000          Call dword ptr [00401098]
:00425D9A 8B4DE8                mov ecx, dword ptr [ebp-18]
:00425D9D 8B45D8                mov eax, dword ptr [ebp-28]
:00425DA0 51                   push ecx
:00425DA1 8D55DC                lea edx, dword ptr [ebp-24]
:00425DA4 50                   push eax
:00425DA5 52                   push edx
:00425DA6 8975D8                mov dword ptr [ebp-28], esi

* Reference To: MSVBVM60.__vbaObjSet, Ord:0000h
                              |
:00425DA9 FF1598104000          Call dword ptr [00401098]
:00425DAF 50                   push eax

* Possible StringData Ref from Data Obj ->""
                              |
:00425DB0 688C744000             push 0040748C

* Reference To: MSVBVM60.__vbaPrintObj, Ord:0000h
                              |
:00425DB5 FF15F8104000          Call dword ptr [004010F8]
:00425DBB 8D45D8                lea eax, dword ptr [ebp-28]
:00425DBE 8D4DDC                lea ecx, dword ptr [ebp-24]
:00425DC1 50                   push eax
:00425DC2 51                   push ecx
:00425DC3 6A02                   push 00000002

* Reference To: MSVBVM60.__vbaFreeObjList, Ord:0000h
                              |
:00425DC5 FF154C104000          Call dword ptr [0040104C]
:00425DCB 83C418                add esp, 00000018

* Possible StringData Ref from Data Obj ->"CC"
                              |
:00425DCE 6854754000             push 00407554
:00425DD3 E818080000             call 004265F0
:00425DD8 50                   push eax

* Reference To: MSVBVM60.__vbaStrI4, Ord:0000h
                              |
:00425DD9 FF1520104000          Call dword ptr [00401020]
:00425DDF 8BD0                   mov edx, eax
:00425DE1 8D4DE0                lea ecx, dword ptr [ebp-20]

* Reference To: MSVBVM60.__vbaStrMove, Ord:0000h
                              |
:00425DE4 FF150C124000          Call dword ptr [0040120C]
:00425DEA 50                   push eax
:00425DEB E8100D0000             call 00426B00
:00425DF0 8BD0                   mov edx, eax
:00425DF2 8D4DE4                lea ecx, dword ptr [ebp-1C]

* Reference To: MSVBVM60.__vbaStrMove, Ord:0000h
                              |
:00425DF5 FF150C124000          Call dword ptr [0040120C]
:00425DFB 8D4DE0                lea ecx, dword ptr [ebp-20]

* Reference To: MSVBVM60.__vbaFreeStr, Ord:0000h
                              |
:00425DFE FF153C124000          Call dword ptr [0040123C]
:00425E04 8B55E8                mov edx, dword ptr [ebp-18]
:00425E07 8B45E4                mov eax, dword ptr [ebp-1C]
:00425E0A 52                   push edx
:00425E0B 50                   push eax

* Reference To: MSVBVM60.__vbaStrCmp, Ord:0000h
                              |
:00425E0C FF15E4104000          Call dword ptr [004010E4]
:00425E12 85C0                   test eax, eax
:00425E14 0F855F010000          jne 00425F79
:00425E1A 8B4DE8                mov ecx, dword ptr [ebp-18]
:00425E1D 51                   push ecx

* Possible StringData Ref from Data Obj ->"ccode"
                              |
:00425E1E 68BC694000             push 004069BC

* Possible StringData Ref from Data Obj ->"wwgjx"
                              |
:00425E23 68AC694000             push 004069AC

* Possible StringData Ref from Data Obj ->"wwgjx"
                              |
:00425E28 68AC694000             push 004069AC

* Reference To: MSVBVM60.rtcSaveSetting, Ord:02B2h
                              |
:00425E2D FF1504104000          Call dword ptr [00401004]
:00425E33 B804000280             mov eax, 80020004
:00425E38 895D98                mov dword ptr [ebp-68], ebx
:00425E3B 895DA8                mov dword ptr [ebp-58], ebx

* Reference To: MSVBVM60.__vbaVarDup, Ord:0000h
                              |
:00425E3E 8B1DE4114000          mov ebx, dword ptr [004011E4]
:00425E44 8D9518FFFFFF          lea edx, dword ptr [ebp+FFFFFF18]
:00425E4A 8D4DB8                lea ecx, dword ptr [ebp-48]
:00425E4D 8945A0                mov dword ptr [ebp-60], eax
:00425E50 8945B0                mov dword ptr [ebp-50], eax

* Possible StringData Ref from Data Obj ->"Yc6R\Of[`N?唼"
                              |
:00425E53 C78520FFFFFF5C6A4000 mov dword ptr [ebp+FFFFFF20], 00406A5C
:00425E5D C78518FFFFFF08000000 mov dword ptr [ebp+FFFFFF18], 00000008
:00425E67 FFD3                   call ebx
:00425E69 8D9528FFFFFF          lea edx, dword ptr [ebp+FFFFFF28]
:00425E6F 8D4DC8                lea ecx, dword ptr [ebp-38]

* Possible StringData Ref from Data Obj ->"`O蜉b?桁??a"?`O(u,go?N?^gㄠ(Wf[`N?"
                                    ->"?z-N a脒??
                              |
:00425E72 C78530FFFFFF80754000 mov dword ptr [ebp+FFFFFF30], 00407580
:00425E7C C78528FFFFFF08000000 mov dword ptr [ebp+FFFFFF28], 00000008
:00425E86 FFD3                   call ebx
:00425E88 8D5598                lea edx, dword ptr [ebp-68]
:00425E8B 8D45A8                lea eax, dword ptr [ebp-58]
:00425E8E 52                   push edx
:00425E8F 8D4DB8                lea ecx, dword ptr [ebp-48]
:00425E92 50                   push eax
:00425E93 51                   push ecx
:00425E94 8D55C8                lea edx, dword ptr [ebp-38]
:00425E97 6A40                   push 00000040
:00425E99 52                   push edx

* Reference To: MSVBVM60.rtcMsgBox, Ord:0253h
                              |
:00425E9A FF159C104000          Call dword ptr [0040109C]
:00425EA0 8D4598                lea eax, dword ptr [ebp-68]
:00425EA3 8D4DA8                lea ecx, dword ptr [ebp-58]
:00425EA6 50                   push eax
:00425EA7 8D55B8                lea edx, dword ptr [ebp-48]
:00425EAA 51                   push ecx
:00425EAB 8D45C8                lea eax, dword ptr [ebp-38]
:00425EAE 52                   push edx
:00425EAF 50                   push eax
:00425EB0 6A04                   push 00000004
为什么有的"vbaFreeStr,"我在API里找不到,这是什么啊?
VB里也没有.
那儿能找到参考资料啊?

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法

收藏・0

点赞・1

打赏

最新回复 (2)
great1234 雪币： 16 能力值： (RANK：10 ) 在线值：发帖 18 回帖 523 粉丝 1 关注私信	great1234 2004-12-21 12:12 2 楼 0 抱歉,我看不懂~~~~~~~~~
hb1125 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 11 粉丝 0 关注私信	hb1125 2004-12-21 12:18 3 楼 0 无头无绪，太难了，看不懂啊帮你顶啊！！
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复

FROG_007

发帖

回帖

RANK

关注

私信

他的文章

OD怎么附加源码体调试?

VB问题，怎么用OD怎么拦截这个API？

在VISITA里，原来API会变吗？

[求助]Redasm里怎么设置用masm611进行编译？

[求助]大家帮我看看,这是什么意思?谢谢!

关于我们

联系我们

企业服务

看雪公众号

最新回复 (2)
great1234 雪币： 16 能力值： (RANK：10 ) 在线值：发帖 18 回帖 523 粉丝 1 关注私信	great1234 2004-12-21 12:12 2 楼 0 抱歉,我看不懂~~~~~~~~~
hb1125 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 11 粉丝 0 关注私信	hb1125 2004-12-21 12:18 3 楼 0 无头无绪，太难了，看不懂啊帮你顶啊！！
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复