.text:0040343F
.text:0040343F loc_40343F: ; CODE XREF: .text:0040342Ej
.text:0040343F lea ecx, [ebp-0D0h]
.text:00403445 call ds:__vbaFreeObj
.text:0040344B mov edx, [ebx]
.text:0040344D push ebx
.text:0040344E call dword ptr [edx+318h]
.text:00403454 push eax
.text:00403455 lea eax, [ebp-0D0h]
.text:0040345B push eax
.text:0040345C call ds:__vbaObjSet
.text:00403462 mov edi, eax
.text:00403464 mov ecx, [edi]
.text:00403466 push offset dword_4027A0 ; //暴破点 改成 push 004028B8
.text:0040346B push edi
.text:0040346C call dword ptr [ecx+54h]
.text:0040346F fnclex
.text:00403471 cmp eax, esi
.text:00403473 jge short loc_403484
.text:00403475 push 54h
.text:00403477 push offset dword_40278C
.text:0040347C push edi
.text:0040347D push eax
.text:0040347E call ds:__vbaHresultCheckObj
.text:00403484
.text:00403484 loc_403484: ; CODE XREF: .text:00403473j
.text:00403484 lea ecx, [ebp-0D0h]
.text:0040348A call ds:__vbaFreeObj
.text:00403490 mov dword ptr [ebp-168h], offset a43225555456944 ; "432255554569444855345741161533518549271"...
.text:0040349A mov dword ptr [ebp-170h], 8
.text:004034A4 lea edx, [ebp-170h]
.text:004034AA lea ecx, [ebp-5Ch]
.text:004034AD mov edi, ds:__vbaVarCopy
.text:004034B3 call edi ; __vbaVarCopy
.text:004034B5 push offset aFef ; "fef"
.text:004034BA push offset aFef ; "fef"
.text:004034BF call ds:__vbaStrCmp
.text:004034C5 test eax, eax
.text:004034C7 jnz loc_404C26