CPU Disasm
地址 十六进制 命令 注释
02641FE0 55 PUSH EBP ; 开始计算
02641FE1 8BEC MOV EBP,ESP
02641FE3 83EC 0C SUB ESP,0C
02641FE6 68 76116402 PUSH <JMP.&MSVBVM60.__vbaExceptHandler> ; 转存 到 MSVBVM60.__vbaExceptHandler
02641FEB 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
02641FF1 50 PUSH EAX
02641FF2 64:8925 0000000 MOV DWORD PTR FS:[0],ESP
02641FF9 83EC 2C SUB ESP,2C
02641FFC 53 PUSH EBX
02641FFD 56 PUSH ESI
02641FFE 57 PUSH EDI
02641FFF 8965 F4 MOV DWORD PTR SS:[EBP-0C],ESP
02642002 C745 F8 1811640 MOV DWORD PTR SS:[EBP-8],dllPJ.02641118
02642009 8B45 14 MOV EAX,DWORD PTR SS:[EBP+14]
0264200C 33DB XOR EBX,EBX
0264200E BA 84196402 MOV EDX,dllPJ.02641984
02642013 8D4D E4 LEA ECX,[EBP-1C]
02642016 895D E4 MOV DWORD PTR SS:[EBP-1C],EBX
02642019 895D E0 MOV DWORD PTR SS:[EBP-20],EBX
0264201C 895D DC MOV DWORD PTR SS:[EBP-24],EBX
0264201F 895D D8 MOV DWORD PTR SS:[EBP-28],EBX
02642022 8918 MOV DWORD PTR DS:[EAX],EBX
02642024 FF15 B0106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCo
0264202A 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+0C]
0264202D 8B0F MOV ECX,DWORD PTR DS:[EDI]
0264202F 51 PUSH ECX
02642030 6A 01 PUSH 1
02642032 FF15 98106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaUboun
02642038 8945 C8 MOV DWORD PTR SS:[EBP-38],EAX
0264203B BE 01000000 MOV ESI,1
02642040 3B75 C8 CMP ESI,DWORD PTR SS:[EBP-38]
02642043 0F8F C1000000 JG 0264210A
02642049 8B07 MOV EAX,DWORD PTR DS:[EDI]
0264204B 3BC3 CMP EAX,EBX
0264204D 74 1F JE SHORT 0264206E
0264204F 66:8338 01 CMP WORD PTR DS:[EAX],1
02642053 75 19 JNE SHORT 0264206E
02642055 8B50 14 MOV EDX,DWORD PTR DS:[EAX+14]
02642058 8B48 10 MOV ECX,DWORD PTR DS:[EAX+10]
0264205B 8BFE MOV EDI,ESI
0264205D 2BFA SUB EDI,EDX
0264205F 3BF9 CMP EDI,ECX
02642061 72 06 JB SHORT 02642069
02642063 FF15 54106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaGener
02642069 8D1C3F LEA EBX,[EDI+EDI]
0264206C EB 08 JMP SHORT 02642076
0264206E FF15 54106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaGener
02642074 8BD8 MOV EBX,EAX
02642076 8B55 10 MOV EDX,DWORD PTR SS:[EBP+10]
02642079 8B02 MOV EAX,DWORD PTR DS:[EDX]
0264207B 85C0 TEST EAX,EAX
0264207D 74 1F JE SHORT 0264209E
0264207F 66:8338 01 CMP WORD PTR DS:[EAX],1
02642083 75 19 JNE SHORT 0264209E
02642085 8B50 14 MOV EDX,DWORD PTR DS:[EAX+14]
02642088 8B48 10 MOV ECX,DWORD PTR DS:[EAX+10]
0264208B 8BFE MOV EDI,ESI
0264208D 2BFA SUB EDI,EDX
0264208F 3BF9 CMP EDI,ECX
02642091 72 06 JB SHORT 02642099
02642093 FF15 54106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaGener
02642099 8D043F LEA EAX,[EDI+EDI]
0264209C EB 06 JMP SHORT 026420A4
0264209E FF15 54106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaGener
026420A4 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+0C]
026420A7 8B0F MOV ECX,DWORD PTR DS:[EDI]
026420A9 8B51 0C MOV EDX,DWORD PTR DS:[ECX+0C]
026420AC 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]
026420AF 8B09 MOV ECX,DWORD PTR DS:[ECX]
026420B1 66:8B141A MOV DX,WORD PTR DS:[EBX+EDX]
026420B5 8B49 0C MOV ECX,DWORD PTR DS:[ECX+0C]
026420B8 66:031401 ADD DX,WORD PTR DS:[EAX+ECX]
026420BC 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
026420BF 8B08 MOV ECX,DWORD PTR DS:[EAX]
026420C1 0F80 96000000 JO 0264215D
026420C7 8955 D8 MOV DWORD PTR SS:[EBP-28],EDX
026420CA 8D55 DC LEA EDX,[EBP-24]
026420CD 52 PUSH EDX
026420CE 8D55 D8 LEA EDX,[EBP-28]
026420D1 52 PUSH EDX
026420D2 50 PUSH EAX
026420D3 FF51 30 CALL DWORD PTR DS:[ECX+30]
026420D6 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
026420D9 8B4D DC MOV ECX,DWORD PTR SS:[EBP-24]
026420DC 50 PUSH EAX
026420DD 51 PUSH ECX
026420DE FF15 28106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCa
026420E4 8BD0 MOV EDX,EAX
026420E6 8D4D E4 LEA ECX,[EBP-1C]
026420E9 FF15 DC106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo
026420EF 8D4D DC LEA ECX,[EBP-24]
026420F2 FF15 F0106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS
026420F8 B8 01000000 MOV EAX,1
026420FD 03C6 ADD EAX,ESI
026420FF 70 5C JO SHORT 0264215D
02642101 8BF0 MOV ESI,EAX
02642103 33DB XOR EBX,EBX
02642105 ^ E9 36FFFFFF JMP 02642040
0264210A 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
0264210D 8D4D E0 LEA ECX,[EBP-20]
02642110 FF15 B0106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCo
02642116 68 40216402 PUSH dllPJ.02642140
0264211B EB 19 JMP SHORT 02642136
0264211D F645 FC 04 TEST BYTE PTR SS:[EBP-4],04
02642121 74 09 JE SHORT 0264212C
02642123 8D4D E0 LEA ECX,[EBP-20]
02642126 FF15 F0106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS
0264212C 8D4D DC LEA ECX,[EBP-24]
0264212F FF15 F0106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS
02642135 C3 RETN
02642136 8D4D E4 LEA ECX,[EBP-1C]
02642139 FF15 F0106402 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS
0264213F C3 RETN
02642140 8B55 14 MOV EDX,DWORD PTR SS:[EBP+14]
02642143 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
02642146 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
02642149 5F POP EDI
0264214A 8902 MOV DWORD PTR DS:[EDX],EAX
0264214C 5E POP ESI
0264214D 33C0 XOR EAX,EAX
0264214F 64:890D 0000000 MOV DWORD PTR FS:[0],ECX
02642156 5B POP EBX
02642157 8BE5 MOV ESP,EBP
02642159 5D POP EBP
0264215A C2 1000 RETN 10 ; 跳出去
[课程]FART 脱壳王！加量不加价！FART作者讲授！
