码迷,mamicode.com
首页 > 其他好文 > 详细

[反汇编练习] 160个CrackMe之017

时间:2014-06-25 00:46:12      阅读:379      评论:0      收藏:0      [点我收藏+]

标签:style   class   blog   code   http   ext   

[反汇编练习] 160个CrackMe之017.

本系列文章的目的是从一个没有任何经验的新手的角度(其实就是我自己),一步步尝试将160个CrackMe全部破解,如果可以,通过任何方式写出一个类似于注册机的东西。

其中,文章中按照如下逻辑编排(解决如下问题):

1、使用什么环境和工具

2、程序分析

3、思路分析和破解流程

4、注册机的探索

----------------------------------

提醒各位看客: 如果文章中的逻辑看不明白,那你一定是没有亲手操刀!OD中的跳转提示很强大,只要你跟踪了,不用怎么看代码就理解了!

----------------------------------

1、工具和环境:

WinXP SP3 + 52Pojie六周年纪念版OD + PEID + 汇编金手指。

160个CrackMe的打包文件。

下载地址: http://pan.baidu.com/s/1xUWOY 密码: jbnq

注:

1、Win7系统对于模块和程序开启了随机初始地址的功能,会给分析带来很大的负担,所以不建议使用Win7进行分析。

2、以上工具都是在52PoJie论坛下的原版程序,NOD32不报毒,个人承诺绝对不会进行任何和木马病毒相关内容。

bubuko.com,布布扣

2、程序分析:

想要破解一个程序,必须先了解这个程序。所以,在破解过程中,对最初程序的分析很重要,他可以帮助我们理解作者的目的和意图,特别是对于注册码的处理细节,从而方便我们反向跟踪和推导。

和上一节一样,打开CHM,选择第17个BJCM30A.exe,保存下来。运行程序,程序界面如下:

bubuko.com,布布扣

 

3、思路分析和破解流程

又见信息框,我很高兴啊!

PEID: Microsoft Visual Basic 5.0 / 6.0

和以前的一样,直接上步骤:

1、打开OD,将exe拖到OD窗口中,等程序暂停后,直接点击运行按钮(F9),不用理会。

2、在exe中输入Key:bbdxf。点击OK按钮,弹出错误信息框,不要关闭。

3、在OD中点击暂停按钮(Ctrl+F2),再点击堆栈K按钮(Ctrl+K),可以看到当前堆栈情况。

bubuko.com,布布扣

在反汇编窗口信息:

00404E30     /0F84 AD000000 je 00404EE3                              ;  // 关键跳转
00404E36   . |8B1D CC104000 mov ebx,dword ptr ds:[<&MSVBVM60.__vbaVa>;  msvbvm60.__vbaVarDup
00404E3C   . |B9 04000280   mov ecx,0x80020004
00404E41   . |898D 20FFFFFF mov dword ptr ss:[ebp-0xE0],ecx
00404E47   . |B8 0A000000   mov eax,0xA
00404E4C   . |898D 30FFFFFF mov dword ptr ss:[ebp-0xD0],ecx
00404E52   . |8D95 F8FEFFFF lea edx,dword ptr ss:[ebp-0x108]
00404E58   . |8D8D 38FFFFFF lea ecx,dword ptr ss:[ebp-0xC8]
00404E5E   . |8985 18FFFFFF mov dword ptr ss:[ebp-0xE8],eax
00404E64   . |8985 28FFFFFF mov dword ptr ss:[ebp-0xD8],eax
00404E6A   . |C785 00FFFFFF>mov dword ptr ss:[ebp-0x100],00402BB4    ;  UNICODE "Correct serial!"
00404E74   . |89B5 F8FEFFFF mov dword ptr ss:[ebp-0x108],esi
00404E7A   . |FFD3          call ebx                                 ;  <&MSVBVM60.__vbaVarDup>
00404E7C   . |8D95 08FFFFFF lea edx,dword ptr ss:[ebp-0xF8]
00404E82   . |8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-0xB8]
00404E88   . |C785 10FFFFFF>mov dword ptr ss:[ebp-0xF0],00402B68     ;  UNICODE "Good job, tell me how you do that!"
00404E92   . |89B5 08FFFFFF mov dword ptr ss:[ebp-0xF8],esi
00404E98   . |FFD3          call ebx
00404E9A   . |8D8D 18FFFFFF lea ecx,dword ptr ss:[ebp-0xE8]
00404EA0   . |8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]
00404EA6   . |51            push ecx
00404EA7   . |8D85 38FFFFFF lea eax,dword ptr ss:[ebp-0xC8]
00404EAD   . |52            push edx
00404EAE   . |50            push eax
00404EAF   . |8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-0xB8]
00404EB5   . |57            push edi
00404EB6   . |51            push ecx
00404EB7   . |FF15 3C104000 call dword ptr ds:[<&MSVBVM60.#595>]     ;  msvbvm60.rtcMsgBox
00404EBD   . |8D95 18FFFFFF lea edx,dword ptr ss:[ebp-0xE8]
00404EC3   . |8D85 28FFFFFF lea eax,dword ptr ss:[ebp-0xD8]
00404EC9   . |52            push edx
00404ECA   . |8D8D 38FFFFFF lea ecx,dword ptr ss:[ebp-0xC8]
00404ED0   . |50            push eax
00404ED1   . |8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]
00404ED7   . |51            push ecx
00404ED8   . |52            push edx
00404ED9   . |E9 A8000000   jmp 00404F86
00404EDE   > |BE 08000000   mov esi,0x8
00404EE3   > \8B1D CC104000 mov ebx,dword ptr ds:[<&MSVBVM60.__vbaVa>;  msvbvm60.__vbaVarDup
00404EE9   .  B9 04000280   mov ecx,0x80020004
00404EEE   .  898D 20FFFFFF mov dword ptr ss:[ebp-0xE0],ecx
00404EF4   .  B8 0A000000   mov eax,0xA
00404EF9   .  898D 30FFFFFF mov dword ptr ss:[ebp-0xD0],ecx
00404EFF   .  8D95 F8FEFFFF lea edx,dword ptr ss:[ebp-0x108]
00404F05   .  8D8D 38FFFFFF lea ecx,dword ptr ss:[ebp-0xC8]
00404F0B   .  8985 18FFFFFF mov dword ptr ss:[ebp-0xE8],eax
00404F11   .  8985 28FFFFFF mov dword ptr ss:[ebp-0xD8],eax
00404F17   .  C785 00FFFFFF>mov dword ptr ss:[ebp-0x100],00402A10    ;  UNICODE "Wrong serial!"
00404F21   .  89B5 F8FEFFFF mov dword ptr ss:[ebp-0x108],esi
00404F27   .  FFD3          call ebx                                 ;  <&MSVBVM60.__vbaVarDup>
00404F29   .  8D95 08FFFFFF lea edx,dword ptr ss:[ebp-0xF8]
00404F2F   .  8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-0xB8]
00404F35   .  C785 10FFFFFF>mov dword ptr ss:[ebp-0xF0],00402BD8     ;  UNICODE "Sorry, try again!"
00404F3F   .  89B5 08FFFFFF mov dword ptr ss:[ebp-0xF8],esi
00404F45   .  FFD3          call ebx
00404F47   .  8D85 18FFFFFF lea eax,dword ptr ss:[ebp-0xE8]
00404F4D   .  8D8D 28FFFFFF lea ecx,dword ptr ss:[ebp-0xD8]
00404F53   .  50            push eax
00404F54   .  8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
00404F5A   .  51            push ecx
00404F5B   .  52            push edx
00404F5C   .  8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
00404F62   .  57            push edi
00404F63   .  50            push eax
00404F64   .  FF15 3C104000 call dword ptr ds:[<&MSVBVM60.#595>]     ;  msvbvm60.rtcMsgBox

随意向上翻翻,就发现了不同含义的文本,寻找je跳转,哈哈,是不是又被找出来了!

直接选中je 00404EE3 ,右键->Binary->Fill with NOPs.再试试:

bubuko.com,布布扣

哈哈,是不是被爆破了!

4、注册机的探索

写得多了,写到这里就郁闷了!

由于是VB程序,所以注册码比较的关键一般都是那几个文本比较函数,__vbastrcomp,__vbavartsteq,__vbastrcmp等。我们从关键跳转向上浏览,不理解的地方F8跟随:

0040461C   .  51            push ecx                                 ;  // ecx ="123123"
0040461D   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBs>;  msvbvm60.__vbaLenBstr
00404623   .  8985 00FFFFFF mov dword ptr ss:[ebp-0x100],eax
00404629   .  8D95 08FFFFFF lea edx,dword ptr ss:[ebp-0xF8]
0040462F   .  8D85 F8FEFFFF lea eax,dword ptr ss:[ebp-0x108]
00404635   .  52            push edx
00404636   .  8D8D E8FEFFFF lea ecx,dword ptr ss:[ebp-0x118]
0040463C   .  50            push eax
0040463D   .  8D95 64FEFFFF lea edx,dword ptr ss:[ebp-0x19C]
00404643   .  51            push ecx
00404644   .  8D85 74FEFFFF lea eax,dword ptr ss:[ebp-0x18C]
0040464A   .  52            push edx
0040464B   .  8D4D 94       lea ecx,dword ptr ss:[ebp-0x6C]
0040464E   .  50            push eax
0040464F   .  51            push ecx
00404650   .  C785 F8FEFFFF>mov dword ptr ss:[ebp-0x108],0x3
0040465A   .  C785 F0FEFFFF>mov dword ptr ss:[ebp-0x110],0x1
00404664   .  C785 E8FEFFFF>mov dword ptr ss:[ebp-0x118],0x2         ;  // for 循环
0040466E   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaVarFo>;  msvbvm60.__vbaVarForInit
00404674   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
0040467A   .  8985 30FEFFFF mov dword ptr ss:[ebp-0x1D0],eax
00404680   .  FF15 F0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStr
00404686   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
0040468C   .  FF15 F4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj
00404692   .  8B1D DC104000 mov ebx,dword ptr ds:[<&MSVBVM60.__vbaSt>;  msvbvm60.__vbaStrMove
00404698   >  39BD 30FEFFFF cmp dword ptr ss:[ebp-0x1D0],edi         ;  1 0
0040469E   .  0F84 F5010000 je 00404899
004046A4   .  8B16          mov edx,dword ptr ds:[esi]
004046A6   .  56            push esi
004046A7   .  FF92 08030000 call dword ptr ds:[edx+0x308]
004046AD   .  50            push eax
004046AE   .  8D85 5CFFFFFF lea eax,dword ptr ss:[ebp-0xA4]
004046B4   .  50            push eax
004046B5   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet
004046BB   .  8B08          mov ecx,dword ptr ds:[eax]
004046BD   .  8D95 7CFFFFFF lea edx,dword ptr ss:[ebp-0x84]
004046C3   .  52            push edx
004046C4   .  50            push eax
004046C5   .  8985 D4FEFFFF mov dword ptr ss:[ebp-0x12C],eax
004046CB   .  FF91 A0000000 call dword ptr ds:[ecx+0xA0]
004046D1   .  3BC7          cmp eax,edi
004046D3   .  DBE2          fclex
004046D5   .  7D 18         jge short 004046EF
004046D7   .  8B8D D4FEFFFF mov ecx,dword ptr ss:[ebp-0x12C]
004046DD   .  68 A0000000   push 0xA0
004046E2   .  68 442B4000   push 00402B44
004046E7   .  51            push ecx
004046E8   .  50            push eax
004046E9   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
004046EF   >  8B16          mov edx,dword ptr ds:[esi]
004046F1   .  56            push esi
004046F2   .  FF92 08030000 call dword ptr ds:[edx+0x308]
004046F8   .  50            push eax
004046F9   .  8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]
004046FF   .  50            push eax
00404700   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet
00404706   .  8B08          mov ecx,dword ptr ds:[eax]
00404708   .  8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]
0040470E   .  52            push edx
0040470F   .  50            push eax
00404710   .  8985 CCFEFFFF mov dword ptr ss:[ebp-0x134],eax
00404716   .  FF91 A0000000 call dword ptr ds:[ecx+0xA0]
0040471C   .  3BC7          cmp eax,edi
0040471E   .  DBE2          fclex
00404720   .  7D 18         jge short 0040473A
00404722   .  8B8D CCFEFFFF mov ecx,dword ptr ss:[ebp-0x134]
00404728   .  68 A0000000   push 0xA0
0040472D   .  68 442B4000   push 00402B44
00404732   .  51            push ecx
00404733   .  50            push eax
00404734   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
0040473A   >  B8 01000000   mov eax,0x1
0040473F   .  8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]
00404745   .  8985 50FFFFFF mov dword ptr ss:[ebp-0xB0],eax
0040474B   .  8985 30FFFFFF mov dword ptr ss:[ebp-0xD0],eax
00404751   .  8985 00FFFFFF mov dword ptr ss:[ebp-0x100],eax
00404757   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
0040475A   .  B9 02000000   mov ecx,0x2
0040475F   .  52            push edx                                 ;  1
00404760   .  50            push eax                                 ;  1
00404761   .  898D 48FFFFFF mov dword ptr ss:[ebp-0xB8],ecx
00404767   .  898D 28FFFFFF mov dword ptr ss:[ebp-0xD8],ecx
0040476D   .  898D F8FEFFFF mov dword ptr ss:[ebp-0x108],ecx
00404773   .  FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>;  msvbvm60.__vbaI4Var
00404779   .  8B8D 7CFFFFFF mov ecx,dword ptr ss:[ebp-0x84]
0040477F   .  8B3D 54104000 mov edi,dword ptr ds:[<&MSVBVM60.#631>]  ;  msvbvm60.rtcMidCharBstr
00404785   .  50            push eax                                 ;  // eax = 1 2  3
00404786   .  51            push ecx                                 ;  // ecx ="123123"
00404787   .  FFD7          call edi                                 ;  msvbvm60.rtcMidCharBstr; <&MSVBVM60.#631>
00404789   .  8BD0          mov edx,eax                              ;  // eax = "1"  "2" "3"
0040478B   .  8D8D 74FFFFFF lea ecx,dword ptr ss:[ebp-0x8C]
00404791   .  FFD3          call ebx                                 ;  msvbvm60.__vbaStrMove
00404793   .  50            push eax                                 ;  // eax = "1"  "2"
00404794   .  8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]
0040479A   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
0040479D   .  52            push edx                                 ;  1
0040479E   .  8D8D F8FEFFFF lea ecx,dword ptr ss:[ebp-0x108]
004047A4   .  50            push eax                                 ;  1
004047A5   .  8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
004047AB   .  51            push ecx                                 ;  1
004047AC   .  52            push edx                                 ;  -1
004047AD   .  FF15 C8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarAd>;  msvbvm60.__vbaVarAdd
004047B3   .  50            push eax
004047B4   .  FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>;  msvbvm60.__vbaI4Var
004047BA   .  50            push eax                                 ;  // eax = 2  3   4
004047BB   .  8B85 78FFFFFF mov eax,dword ptr ss:[ebp-0x88]
004047C1   .  50            push eax                                 ;  // eax = "123123"
004047C2   .  FFD7          call edi                                 ;  msvbvm60.rtcMidCharBstr
004047C4   .  8BD0          mov edx,eax                              ;  // eax = "2"  "3" "1"
004047C6   .  8D8D 70FFFFFF lea ecx,dword ptr ss:[ebp-0x90]
004047CC   .  FFD3          call ebx                                 ;  msvbvm60.__vbaStrMove
004047CE   .  50            push eax
004047CF   .  FF15 68104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCm>;  msvbvm60.__vbaStrCmp
004047D5   .  8BF8          mov edi,eax                              ;  eax = -1
004047D7   .  8D8D 70FFFFFF lea ecx,dword ptr ss:[ebp-0x90]
004047DD   .  F7DF          neg edi
004047DF   .  8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C]
004047E5   .  51            push ecx
004047E6   .  8D85 78FFFFFF lea eax,dword ptr ss:[ebp-0x88]
004047EC   .  52            push edx
004047ED   .  1BFF          sbb edi,edi
004047EF   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
004047F5   .  50            push eax
004047F6   .  47            inc edi
004047F7   .  51            push ecx
004047F8   .  6A 04         push 0x4
004047FA   .  F7DF          neg edi
004047FC   .  FF15 B4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStrList
00404802   .  8D95 58FFFFFF lea edx,dword ptr ss:[ebp-0xA8]
00404808   .  8D85 5CFFFFFF lea eax,dword ptr ss:[ebp-0xA4]
0040480E   .  52            push edx
0040480F   .  50            push eax
00404810   .  6A 02         push 0x2
00404812   .  FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObjList
00404818   .  8D8D 28FFFFFF lea ecx,dword ptr ss:[ebp-0xD8]
0040481E   .  8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
00404824   .  51            push ecx
00404825   .  8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
0040482B   .  52            push edx
0040482C   .  50            push eax
0040482D   .  6A 03         push 0x3
0040482F   .  FF15 18104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeV>;  msvbvm60.__vbaFreeVarList
00404835   .  83C4 30       add esp,0x30
00404838   .  66:85FF       test di,di
0040483B   .  74 37         je short 00404874
0040483D   .  8D4D B8       lea ecx,dword ptr ss:[ebp-0x48]
00404840   .  8D95 08FFFFFF lea edx,dword ptr ss:[ebp-0xF8]
00404846   .  51            push ecx
00404847   .  8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
0040484D   .  52            push edx
0040484E   .  50            push eax
0040484F   .  C785 10FFFFFF>mov dword ptr ss:[ebp-0xF0],0x1
00404859   .  C785 08FFFFFF>mov dword ptr ss:[ebp-0xF8],0x2
00404863   .  FF15 C8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarAd>;  msvbvm60.__vbaVarAdd
00404869   .  8BD0          mov edx,eax
0040486B   .  8D4D B8       lea ecx,dword ptr ss:[ebp-0x48]
0040486E   .  FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMo>;  msvbvm60.__vbaVarMove
00404874   >  8D8D 64FEFFFF lea ecx,dword ptr ss:[ebp-0x19C]
0040487A   .  8D95 74FEFFFF lea edx,dword ptr ss:[ebp-0x18C]
00404880   .  51            push ecx
00404881   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00404884   .  52            push edx
00404885   .  50            push eax
00404886   .  FF15 E8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarFo>;  msvbvm60.__vbaVarForNext
0040488C   .  8985 30FEFFFF mov dword ptr ss:[ebp-0x1D0],eax
00404892   .  33FF          xor edi,edi
00404894   .^ E9 FFFDFFFF   jmp 00404698                             ;  // for 循环
00404899   >  8B0E          mov ecx,dword ptr ds:[esi]
0040489B   .  56            push esi
0040489C   .  FF91 08030000 call dword ptr ds:[ecx+0x308]
004048A2   .  8D95 5CFFFFFF lea edx,dword ptr ss:[ebp-0xA4]
004048A8   .  50            push eax
004048A9   .  52            push edx
004048AA   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet
004048B0   .  8B08          mov ecx,dword ptr ds:[eax]
004048B2   .  8D95 7CFFFFFF lea edx,dword ptr ss:[ebp-0x84]
004048B8   .  52            push edx
004048B9   .  50            push eax
004048BA   .  8985 D4FEFFFF mov dword ptr ss:[ebp-0x12C],eax
004048C0   .  FF91 A0000000 call dword ptr ds:[ecx+0xA0]
004048C6   .  3BC7          cmp eax,edi
004048C8   .  DBE2          fclex
004048CA   .  7D 18         jge short 004048E4
004048CC   .  8B8D D4FEFFFF mov ecx,dword ptr ss:[ebp-0x12C]
004048D2   .  68 A0000000   push 0xA0
004048D7   .  68 442B4000   push 00402B44
004048DC   .  51            push ecx
004048DD   .  50            push eax
004048DE   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
004048E4   >  8B95 7CFFFFFF mov edx,dword ptr ss:[ebp-0x84]
004048EA   .  52            push edx
004048EB   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBs>;  msvbvm60.__vbaLenBstr
004048F1   .  83E8 01       sub eax,0x1
004048F4   .  8D8D 08FFFFFF lea ecx,dword ptr ss:[ebp-0xF8]
004048FA   .  0F80 AA070000 jo 004050AA                              ;  // 溢出错误
00404900   .  8985 10FFFFFF mov dword ptr ss:[ebp-0xF0],eax
00404906   .  8D45 B8       lea eax,dword ptr ss:[ebp-0x48]
00404909   .  50            push eax
0040490A   .  51            push ecx
0040490B   .  C785 08FFFFFF>mov dword ptr ss:[ebp-0xF8],0x8003
00404915   .  FF15 6C104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTs>;  msvbvm60.__vbaVarTstEq
0040491B   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404921   .  66:8985 CCFEF>mov word ptr ss:[ebp-0x134],ax
00404928   .  FF15 F0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStr
0040492E   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
00404934   .  FF15 F4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj
0040493A   .  66:39BD CCFEF>cmp word ptr ss:[ebp-0x134],di
00404941   .  0F85 97050000 jnz 00404EDE                             ;  // 跳到错误提示
00404947   .  8B16          mov edx,dword ptr ds:[esi]
00404949   .  56            push esi
0040494A   .  C785 10FFFFFF>mov dword ptr ss:[ebp-0xF0],0x1
00404954   .  C785 08FFFFFF>mov dword ptr ss:[ebp-0xF8],0x2
0040495E   .  FF92 08030000 call dword ptr ds:[edx+0x308]
00404964   .  50            push eax
00404965   .  8D85 5CFFFFFF lea eax,dword ptr ss:[ebp-0xA4]
0040496B   .  50            push eax
0040496C   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet
00404972   .  8B08          mov ecx,dword ptr ds:[eax]
00404974   .  8D95 7CFFFFFF lea edx,dword ptr ss:[ebp-0x84]
0040497A   .  52            push edx
0040497B   .  50            push eax
0040497C   .  8985 D4FEFFFF mov dword ptr ss:[ebp-0x12C],eax
00404982   .  FF91 A0000000 call dword ptr ds:[ecx+0xA0]
00404988   .  3BC7          cmp eax,edi
0040498A   .  DBE2          fclex
0040498C   .  7D 18         jge short 004049A6
0040498E   .  8B8D D4FEFFFF mov ecx,dword ptr ss:[ebp-0x12C]
00404994   .  68 A0000000   push 0xA0
00404999   .  68 442B4000   push 00402B44
0040499E   .  51            push ecx
0040499F   .  50            push eax
004049A0   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
004049A6   >  8B95 7CFFFFFF mov edx,dword ptr ss:[ebp-0x84]
004049AC   .  52            push edx                                 ;  // edx = "123123"
004049AD   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBs>;  msvbvm60.__vbaLenBstr
004049B3   .  8985 00FFFFFF mov dword ptr ss:[ebp-0x100],eax         ;  // eax = 6
004049B9   .  8D85 08FFFFFF lea eax,dword ptr ss:[ebp-0xF8]
004049BF   .  8D8D F8FEFFFF lea ecx,dword ptr ss:[ebp-0x108]
004049C5   .  50            push eax
004049C6   .  8D95 E8FEFFFF lea edx,dword ptr ss:[ebp-0x118]
004049CC   .  51            push ecx
004049CD   .  8D85 44FEFFFF lea eax,dword ptr ss:[ebp-0x1BC]
004049D3   .  52            push edx
004049D4   .  8D8D 54FEFFFF lea ecx,dword ptr ss:[ebp-0x1AC]
004049DA   .  50            push eax
004049DB   .  8D55 94       lea edx,dword ptr ss:[ebp-0x6C]
004049DE   .  51            push ecx
004049DF   .  52            push edx
004049E0   .  C785 F8FEFFFF>mov dword ptr ss:[ebp-0x108],0x3
004049EA   .  C785 F0FEFFFF>mov dword ptr ss:[ebp-0x110],0x1
004049F4   .  C785 E8FEFFFF>mov dword ptr ss:[ebp-0x118],0x2         ;  // for 循环开始
004049FE   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaVarFo>;  msvbvm60.__vbaVarForInit
00404A04   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404A0A   .  8985 2CFEFFFF mov dword ptr ss:[ebp-0x1D4],eax
00404A10   .  FF15 F0104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStr
00404A16   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
00404A1C   .  FF15 F4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj
00404A22   >  39BD 2CFEFFFF cmp dword ptr ss:[ebp-0x1D4],edi         ;  // 循环条件判断
00404A28   .  0F84 1D030000 je 00404D4B
00404A2E   .  8B06          mov eax,dword ptr ds:[esi]
00404A30   .  56            push esi
00404A31   .  FF90 08030000 call dword ptr ds:[eax+0x308]
00404A37   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
00404A3D   .  50            push eax
00404A3E   .  51            push ecx
00404A3F   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet
00404A45   .  8B10          mov edx,dword ptr ds:[eax]
00404A47   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404A4D   .  51            push ecx
00404A4E   .  50            push eax
00404A4F   .  8985 D4FEFFFF mov dword ptr ss:[ebp-0x12C],eax
00404A55   .  FF92 A0000000 call dword ptr ds:[edx+0xA0]
00404A5B   .  3BC7          cmp eax,edi
00404A5D   .  DBE2          fclex
00404A5F   .  7D 18         jge short 00404A79
00404A61   .  8B95 D4FEFFFF mov edx,dword ptr ss:[ebp-0x12C]
00404A67   .  68 A0000000   push 0xA0
00404A6C   .  68 442B4000   push 00402B44
00404A71   .  52            push edx
00404A72   .  50            push eax
00404A73   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
00404A79   >  8B85 7CFFFFFF mov eax,dword ptr ss:[ebp-0x84]
00404A7F   .  50            push eax                                 ;  // eax = "123123"
00404A80   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaLenBs>;  msvbvm60.__vbaLenBstr
00404A86   .  8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-0xB8]          ;  // eax = 6
00404A8C   .  8985 50FFFFFF mov dword ptr ss:[ebp-0xB0],eax
00404A92   .  51            push ecx                                 ;  6
00404A93   .  C785 48FFFFFF>mov dword ptr ss:[ebp-0xB8],0x3
00404A9D   .  FF15 A8104000 call dword ptr ds:[<&MSVBVM60.#572>]     ;  msvbvm60.rtcHexBstrFromVar
00404AA3   .  8BD0          mov edx,eax                              ;  // eax = 6 ; 长度的16进制文本
00404AA5   .  8D8D 64FFFFFF lea ecx,dword ptr ss:[ebp-0x9C]
00404AAB   .  FFD3          call ebx                                 ;  msvbvm60.__vbaStrMove
00404AAD   .  8B16          mov edx,dword ptr ds:[esi]
00404AAF   .  56            push esi
00404AB0   .  FF92 08030000 call dword ptr ds:[edx+0x308]
00404AB6   .  50            push eax
00404AB7   .  8D85 58FFFFFF lea eax,dword ptr ss:[ebp-0xA8]
00404ABD   .  50            push eax
00404ABE   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet
00404AC4   .  8B85 58FFFFFF mov eax,dword ptr ss:[ebp-0xA8]
00404ACA   .  8D8D 38FFFFFF lea ecx,dword ptr ss:[ebp-0xC8]
00404AD0   .  6A 01         push 0x1                                 ;  1
00404AD2   .  8D95 28FFFFFF lea edx,dword ptr ss:[ebp-0xD8]
00404AD8   .  51            push ecx                                 ;  07
00404AD9   .  52            push edx                                 ;  1
00404ADA   .  89BD 58FFFFFF mov dword ptr ss:[ebp-0xA8],edi
00404AE0   .  8985 40FFFFFF mov dword ptr ss:[ebp-0xC0],eax
00404AE6   .  C785 38FFFFFF>mov dword ptr ss:[ebp-0xC8],0x9
00404AF0   .  FF15 D4104000 call dword ptr ds:[<&MSVBVM60.#617>]     ;  msvbvm60.rtcLeftCharVar
00404AF6   .  8D85 28FFFFFF lea eax,dword ptr ss:[ebp-0xD8]          ;  // eax = "1"
00404AFC   .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]
00404B02   .  50            push eax
00404B03   .  51            push ecx
00404B04   .  FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaStrVa>;  msvbvm60.__vbaStrVarVal
00404B0A   .  50            push eax                                 ;  // eax ="1"
00404B0B   .  FF15 28104000 call dword ptr ds:[<&MSVBVM60.#516>]     ;  msvbvm60.rtcAnsiValueBstr
00404B11   .  8D95 18FFFFFF lea edx,dword ptr ss:[ebp-0xE8]          ;  // eax = 0x31
00404B17   .  66:8985 20FFF>mov word ptr ss:[ebp-0xE0],ax
00404B1E   .  52            push edx                                 ;  0x31
00404B1F   .  C785 18FFFFFF>mov dword ptr ss:[ebp-0xE8],0x2
00404B29   .  FF15 A8104000 call dword ptr ds:[<&MSVBVM60.#572>]     ;  msvbvm60.rtcHexBstrFromVar
00404B2F   .  8BD0          mov edx,eax                              ;  // eax ="31"
00404B31   .  8D8D 60FFFFFF lea ecx,dword ptr ss:[ebp-0xA0]
00404B37   .  FFD3          call ebx                                 ;  msvbvm60.__vbaStrMove
00404B39   .  BA 6C294000   mov edx,0040296C                         ;  UNICODE "*"
00404B3E   .  8D8D 6CFFFFFF lea ecx,dword ptr ss:[ebp-0x94]
00404B44   .  FF15 B0104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCo>;  msvbvm60.__vbaStrCopy
00404B4A   .  8B95 60FFFFFF mov edx,dword ptr ss:[ebp-0xA0]          ;  // eax ="*", edx="31"
00404B50   .  8D8D 70FFFFFF lea ecx,dword ptr ss:[ebp-0x90]
00404B56   .  89BD 60FFFFFF mov dword ptr ss:[ebp-0xA0],edi
00404B5C   .  FFD3          call ebx                                 ;  msvbvm60.__vbaStrMove
00404B5E   .  8B95 64FFFFFF mov edx,dword ptr ss:[ebp-0x9C]          ;  // eax ="31"
00404B64   .  8D8D 74FFFFFF lea ecx,dword ptr ss:[ebp-0x8C]          ;  // ecx = "123123"
00404B6A   .  89BD 64FFFFFF mov dword ptr ss:[ebp-0x9C],edi          ;  0
00404B70   .  FFD3          call ebx                                 ;  msvbvm60.__vbaStrMove
00404B72   .  8B06          mov eax,dword ptr ds:[esi]
00404B74   .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-0x98]
00404B7A   .  8D95 6CFFFFFF lea edx,dword ptr ss:[ebp-0x94]
00404B80   .  51            push ecx
00404B81   .  52            push edx
00404B82   .  8D8D 70FFFFFF lea ecx,dword ptr ss:[ebp-0x90]
00404B88   .  8D95 74FFFFFF lea edx,dword ptr ss:[ebp-0x8C]
00404B8E   .  51            push ecx
00404B8F   .  52            push edx
00404B90   .  56            push esi
00404B91   .  FF90 F8060000 call dword ptr ds:[eax+0x6F8]            ;  BJCM30A.00401FE8
00404B97   .  3BC7          cmp eax,edi
00404B99   .  7D 12         jge short 00404BAD
00404B9B   .  68 F8060000   push 0x6F8
00404BA0   .  68 B4274000   push 004027B4
00404BA5   .  56            push esi
00404BA6   .  50            push eax
00404BA7   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
00404BAD   >  8B95 68FFFFFF mov edx,dword ptr ss:[ebp-0x98]
00404BB3   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
00404BB6   .  89BD 68FFFFFF mov dword ptr ss:[ebp-0x98],edi
00404BBC   .  FFD3          call ebx
00404BBE   .  8D85 60FFFFFF lea eax,dword ptr ss:[ebp-0xA0]
00404BC4   .  8D8D 64FFFFFF lea ecx,dword ptr ss:[ebp-0x9C]
00404BCA   .  50            push eax
00404BCB   .  8D95 6CFFFFFF lea edx,dword ptr ss:[ebp-0x94]
00404BD1   .  51            push ecx
00404BD2   .  8D85 70FFFFFF lea eax,dword ptr ss:[ebp-0x90]
00404BD8   .  52            push edx
00404BD9   .  8D8D 74FFFFFF lea ecx,dword ptr ss:[ebp-0x8C]
00404BDF   .  50            push eax
00404BE0   .  8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]
00404BE6   .  51            push ecx
00404BE7   .  8D85 7CFFFFFF lea eax,dword ptr ss:[ebp-0x84]
00404BED   .  52            push edx
00404BEE   .  50            push eax
00404BEF   .  6A 07         push 0x7
00404BF1   .  FF15 B4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStrList
00404BF7   .  8D8D 58FFFFFF lea ecx,dword ptr ss:[ebp-0xA8]
00404BFD   .  8D95 5CFFFFFF lea edx,dword ptr ss:[ebp-0xA4]
00404C03   .  51            push ecx
00404C04   .  52            push edx
00404C05   .  6A 02         push 0x2
00404C07   .  FF15 24104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObjList
00404C0D   .  8D85 18FFFFFF lea eax,dword ptr ss:[ebp-0xE8]
00404C13   .  8D8D 28FFFFFF lea ecx,dword ptr ss:[ebp-0xD8]
00404C19   .  50            push eax
00404C1A   .  8D95 38FFFFFF lea edx,dword ptr ss:[ebp-0xC8]
00404C20   .  51            push ecx
00404C21   .  8D85 48FFFFFF lea eax,dword ptr ss:[ebp-0xB8]
00404C27   .  52            push edx
00404C28   .  50            push eax
00404C29   .  6A 04         push 0x4
00404C2B   .  FF15 18104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeV>;  msvbvm60.__vbaFreeVarList
00404C31   .  8B0E          mov ecx,dword ptr ds:[esi]
00404C33   .  83C4 40       add esp,0x40
00404C36   .  56            push esi
00404C37   .  FF91 08030000 call dword ptr ds:[ecx+0x308]
00404C3D   .  8D95 5CFFFFFF lea edx,dword ptr ss:[ebp-0xA4]
00404C43   .  50            push eax
00404C44   .  52            push edx
00404C45   .  FF15 40104000 call dword ptr ds:[<&MSVBVM60.__vbaObjSe>;  msvbvm60.__vbaObjSet
00404C4B   .  8B08          mov ecx,dword ptr ds:[eax]
00404C4D   .  8D95 7CFFFFFF lea edx,dword ptr ss:[ebp-0x84]
00404C53   .  52            push edx
00404C54   .  50            push eax
00404C55   .  8985 D4FEFFFF mov dword ptr ss:[ebp-0x12C],eax
00404C5B   .  FF91 A0000000 call dword ptr ds:[ecx+0xA0]
00404C61   .  3BC7          cmp eax,edi
00404C63   .  DBE2          fclex
00404C65   .  7D 18         jge short 00404C7F
00404C67   .  8B8D D4FEFFFF mov ecx,dword ptr ss:[ebp-0x12C]
00404C6D   .  68 A0000000   push 0xA0
00404C72   .  68 442B4000   push 00402B44
00404C77   .  51            push ecx
00404C78   .  50            push eax
00404C79   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
00404C7F   >  8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]
00404C85   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00404C88   .  52            push edx                                 ;  1
00404C89   .  50            push eax                                 ;  1
00404C8A   .  C785 50FFFFFF>mov dword ptr ss:[ebp-0xB0],0x1
00404C94   .  C785 48FFFFFF>mov dword ptr ss:[ebp-0xB8],0x2
00404C9E   .  FF15 C4104000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>;  msvbvm60.__vbaI4Var
00404CA4   .  8B8D 7CFFFFFF mov ecx,dword ptr ss:[ebp-0x84]          ;  // eax = 1
00404CAA   .  50            push eax
00404CAB   .  51            push ecx                                 ;  // ecx ="123123"
00404CAC   .  FF15 54104000 call dword ptr ds:[<&MSVBVM60.#631>]     ;  msvbvm60.rtcMidCharBstr
00404CB2   .  8BD0          mov edx,eax                              ;  // eax ="1" "2"
00404CB4   .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]
00404CBA   .  FFD3          call ebx                                 ;  msvbvm60.__vbaStrMove
00404CBC   .  50            push eax
00404CBD   .  FF15 28104000 call dword ptr ds:[<&MSVBVM60.#516>]     ;  msvbvm60.rtcAnsiValueBstr
00404CC3   .  66:8985 00FFF>mov word ptr ss:[ebp-0x100],ax           ;  // eax =0x31 0x32
00404CCA   .  8D55 CC       lea edx,dword ptr ss:[ebp-0x34]
00404CCD   .  8D85 F8FEFFFF lea eax,dword ptr ss:[ebp-0x108]
00404CD3   .  52            push edx                                 ;  1
00404CD4   .  8D8D 38FFFFFF lea ecx,dword ptr ss:[ebp-0xC8]
00404CDA   .  50            push eax                                 ;  31
00404CDB   .  51            push ecx
00404CDC   .  C785 F8FEFFFF>mov dword ptr ss:[ebp-0x108],0x2
00404CE6   .  FF15 C8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarAd>;  msvbvm60.__vbaVarAdd
00404CEC   .  8BD0          mov edx,eax                              ;  // eax =31
00404CEE   .  8D4D CC       lea ecx,dword ptr ss:[ebp-0x34]
00404CF1   .  FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMo>;  msvbvm60.__vbaVarMove
00404CF7   .  8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]
00404CFD   .  8D85 7CFFFFFF lea eax,dword ptr ss:[ebp-0x84]
00404D03   .  52            push edx
00404D04   .  50            push eax
00404D05   .  6A 02         push 0x2
00404D07   .  FF15 B4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStrList
00404D0D   .  83C4 0C       add esp,0xC
00404D10   .  8D8D 5CFFFFFF lea ecx,dword ptr ss:[ebp-0xA4]
00404D16   .  FF15 F4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeO>;  msvbvm60.__vbaFreeObj
00404D1C   .  8D8D 48FFFFFF lea ecx,dword ptr ss:[ebp-0xB8]
00404D22   .  FF15 10104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeV>;  msvbvm60.__vbaFreeVar
00404D28   .  8D8D 44FEFFFF lea ecx,dword ptr ss:[ebp-0x1BC]
00404D2E   .  8D95 54FEFFFF lea edx,dword ptr ss:[ebp-0x1AC]
00404D34   .  51            push ecx
00404D35   .  8D45 94       lea eax,dword ptr ss:[ebp-0x6C]
00404D38   .  52            push edx
00404D39   .  50            push eax
00404D3A   .  FF15 E8104000 call dword ptr ds:[<&MSVBVM60.__vbaVarFo>;  msvbvm60.__vbaVarForNext
00404D40   .  8985 2CFEFFFF mov dword ptr ss:[ebp-0x1D4],eax
00404D46   .^ E9 D7FCFFFF   jmp 00404A22                             ;  // for 循环
00404D4B   >  8D4D CC       lea ecx,dword ptr ss:[ebp-0x34]
00404D4E   .  51            push ecx                                 ;  // ecx = 00D2012C
00404D4F   .  FF15 A8104000 call dword ptr ds:[<&MSVBVM60.#572>]     ;  msvbvm60.rtcHexBstrFromVar
00404D55   .  8BD0          mov edx,eax
00404D57   .  8D8D 70FFFFFF lea ecx,dword ptr ss:[ebp-0x90]
00404D5D   .  FFD3          call ebx
00404D5F   .  BA 0C294000   mov edx,0040290C                         ;  UNICODE "="
00404D64   .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]          ;  eax ="12C"
00404D6A   .  FF15 B0104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCo>;  msvbvm60.__vbaStrCopy
00404D70   .  8B95 70FFFFFF mov edx,dword ptr ss:[ebp-0x90]          ;  // eax = "="
00404D76   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404D7C   .  89BD 70FFFFFF mov dword ptr ss:[ebp-0x90],edi
00404D82   .  FFD3          call ebx                                 ;  msvbvm60.__vbaStrMove
00404D84   .  8B16          mov edx,dword ptr ds:[esi]
00404D86   .  8D85 74FFFFFF lea eax,dword ptr ss:[ebp-0x8C]
00404D8C   .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-0x88]
00404D92   .  50            push eax
00404D93   .  51            push ecx
00404D94   .  8D85 7CFFFFFF lea eax,dword ptr ss:[ebp-0x84]
00404D9A   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
00404D9D   .  50            push eax
00404D9E   .  51            push ecx
00404D9F   .  56            push esi
00404DA0   .  FF92 F8060000 call dword ptr ds:[edx+0x6F8]
00404DA6   .  3BC7          cmp eax,edi
00404DA8   .  7D 12         jge short 00404DBC
00404DAA   .  68 F8060000   push 0x6F8
00404DAF   .  68 B4274000   push 004027B4
00404DB4   .  56            push esi
00404DB5   .  50            push eax
00404DB6   .  FF15 30104000 call dword ptr ds:[<&MSVBVM60.__vbaHresu>;  msvbvm60.__vbaHresultCheckObj
00404DBC   >  8B85 74FFFFFF mov eax,dword ptr ss:[ebp-0x8C]
00404DC2   .  BE 08000000   mov esi,0x8
00404DC7   .  8D95 48FFFFFF lea edx,dword ptr ss:[ebp-0xB8]
00404DCD   .  8D4D CC       lea ecx,dword ptr ss:[ebp-0x34]
00404DD0   .  89BD 74FFFFFF mov dword ptr ss:[ebp-0x8C],edi
00404DD6   .  8985 50FFFFFF mov dword ptr ss:[ebp-0xB0],eax          ;  // eax="0"
00404DDC   .  89B5 48FFFFFF mov dword ptr ss:[ebp-0xB8],esi
00404DE2   .  FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMo>;  msvbvm60.__vbaVarMove
00404DE8   .  8D95 70FFFFFF lea edx,dword ptr ss:[ebp-0x90]          ;  // eax="0"
00404DEE   .  8D85 78FFFFFF lea eax,dword ptr ss:[ebp-0x88]
00404DF4   .  52            push edx
00404DF5   .  8D8D 7CFFFFFF lea ecx,dword ptr ss:[ebp-0x84]
00404DFB   .  50            push eax
00404DFC   .  51            push ecx
00404DFD   .  6A 03         push 0x3
00404DFF   .  FF15 B4104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeS>;  msvbvm60.__vbaFreeStrList
00404E05   .  83C4 10       add esp,0x10
00404E08   .  8D55 CC       lea edx,dword ptr ss:[ebp-0x34]
00404E0B   .  8D85 08FFFFFF lea eax,dword ptr ss:[ebp-0xF8]
00404E11   .  C785 10FFFFFF>mov dword ptr ss:[ebp-0xF0],00402B58     ;  UNICODE "FFFF"
00404E1B   .  52            push edx                                 ;  // edx = "0"
00404E1C   .  50            push eax                                 ;  // eax = "FFFF"
00404E1D   .  C785 08FFFFFF>mov dword ptr ss:[ebp-0xF8],0x8008
00404E27   .  FF15 6C104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTs>;  msvbvm60.__vbaVarTstEq
00404E2D   .  66:85C0       test ax,ax
00404E30      0F84 AD000000 je 00404EE3                              ;  // 关键跳转

对于上面的这一长段反汇编,我不想做什么详细解释了。前2/3部分都是For循环,并且没有做什么有用的东西,最后的msvbvm60.__vbaVarTstEq 附近才算了一些东西,但是我也没弄明白到底是怎么回事。所以,抱歉了!

 

由于使用OD没搞明白,使用VB Decoder反编译如下:

Private Sub Command1_Click() ‘404230
  Dim var_A4 As TextBox
  Dim var_A8 As TextBox
  loc_00404255: var_8 = &H401130
  loc_00404326: Var_Ret_1 = CLng(Timer)
  loc_0040432C: var_5C = Var_Ret_1
  loc_0040435B: var_F0 = 1
  loc_00404365: var_F8 = 2
  loc_0040436B: var_100 = &H3E8
  loc_00404375: var_108 = 2
  loc_0040437B: var_110 = 1
  loc_00404385: var_118 = 2
                For var_80 = 1 To 1000 Step 1
                If var_14C = 0 Then GoTo loc_00404461
  loc_004043A4: var_F0 = 1
  loc_004043AA: var_110 = 1
  loc_004043D1: var_F8 = 2
  loc_004043D7: var_100 = &HFA
  loc_004043E1: var_108 = 2
  loc_004043E7: var_118 = 2
                For var_58 = 1 To 250 Step 1
                If var_16C = 0 Then GoTo loc_00404444
                If (4205108 <> 4205108) <> 0 Then GoTo loc_0040442A
  loc_00404414: var_F0 = 1
  loc_0040441E: var_F8 = 2
  loc_00404424: var_24 = 1
  loc_0040442A: 
                Next var_58
  loc_00404442: GoTo loc_004043F3
  loc_00404444: 
                Next var_80
  loc_0040445C: GoTo loc_00404391
  loc_00404461: 
  loc_00404467: Var_Ret_2 = CLng(Timer)
  loc_0040446D: Var_Ret_2 = Var_Ret_2 - Var_Ret_1
                If Var_Ret_2 <= 0 Then GoTo loc_0040452C
  loc_0040448A: var_E0 = 80020004h
  loc_00404495: var_D0 = 80020004h
  loc_004044AC: var_E8 = 10
  loc_004044B2: var_D8 = 10
  loc_004044B8: var_100 = "Cheater!!!   CHEATER!!!   Cheater!!!   CHEATER!!!"
  loc_004044C2: var_108 = 8
  loc_004044D6: var_F0 = "You have SmartCheck loaded!...Close it and try again!!!"
  loc_004044E0: var_F8 = 8
  loc_004044E6: var_B8 = "You have SmartCheck loaded!...Close it and try again!!!"
  loc_00404505: MsgBox var_B8, 0, "Cheater!!!   CHEATER!!!   Cheater!!!   CHEATER!!!"
  loc_00404527: GoTo loc_00404F86
  loc_0040452C: 
  loc_0040453D: Set var_A4 = var_B8
  loc_0040457F: setl bl
                If ebx <> 0 Then GoTo loc_00404EDE
  loc_004045B9: var_F8 = 2
  loc_004045C8: var_F0 = 1
  loc_004045D2: var_F8 = 2
  loc_004045E6: Set var_A4 = 8
  loc_004045F8: var_84 = Text1.Text
  loc_00404623: var_100 = Len(var_84)
  loc_00404650: var_108 = 3
  loc_0040465A: var_110 = 1
  loc_00404664: var_118 = 2
                For var_6C = 1 To Len(var_84) Step 1
  loc_0040467A: var_1D0 = var_18C
                If var_18C = 0 Then GoTo loc_00404899
  loc_004046C5: var_12C = var_18C
  loc_004046CB: var_84 = Text1.Text
  loc_00404700: Set var_A8 = var_84
  loc_00404710: var_134 = var_A8
  loc_00404716: var_88 = Text1.Text
  loc_00404745: var_B0 = 1
  loc_0040474B: var_D0 = 1
  loc_00404751: var_100 = 1
  loc_00404767: var_D8 = 2
  loc_0040476D: var_108 = 2
  loc_00404773: Var_Ret_3 = CLng(var_6C)
  loc_00404791: var_8C = Mid$(var_84, Var_Ret_3, 2)
  loc_004047AD: Var_Ret_4 = var_6C + 1
  loc_004047B4: Var_Ret_5 = CLng(Var_Ret_4)
  loc_004047F6: edi = (var_8C = Mid$(var_88, Var_Ret_5, 1)) + 1
                If (var_8C = var_90) + 1 = 0 Then GoTo loc_00404874
  loc_0040484F: var_F0 = 1
  loc_00404859: var_F8 = 2
  loc_00404863: Var_Ret_6 = 0 + 1
  loc_0040486E: var_48 = Var_Ret_6
  loc_00404874: 
                Next var_6C
  loc_00404894: GoTo loc_00404698
  loc_00404899: 
  loc_004048BA: var_12C = Next var_6C
  loc_004048C0: var_84 = Text1.Text
  loc_004048F1: Len(var_84) = Len(var_84) - 00000001h
  loc_00404900: var_F0 = Len(var_84)
  loc_0040490B: var_F8 = &H8003
  loc_00404915: Var_Ret_7 = (var_48 = Len(var_84))
  loc_00404921: var_134 = Var_Ret_7
                If var_A8 <> 0 Then GoTo loc_00404EDE
  loc_0040494A: var_F0 = 1
  loc_00404954: var_F8 = 2
  loc_0040497C: var_12C = Var_Ret_7
  loc_00404982: var_84 = Text1.Text
  loc_004049B3: var_100 = Len(var_84)
  loc_004049E0: var_108 = 3
  loc_004049EA: var_110 = 1
  loc_004049F4: var_118 = 2
                For var_6C = 1 To Len(var_84) Step 1
  loc_00404A0A: var_1D4 = var_1BC
                If var_1BC = 0 Then GoTo loc_00404D4B
  loc_00404A4F: var_12C = 8
  loc_00404A55: var_84 = Text1.Text
  loc_00404A8C: var_B0 = Len(var_84)
  loc_00404A93: var_B8 = 3
  loc_00404AAB: var_9C = Hex$(Len(var_84))
  loc_00404AE0: var_C0 = var_9C
  loc_00404AE6: var_C8 = 9
  loc_00404AF0: var_D8 = Left(vbObject, 1)
  loc_00404B17: var_E0 = Asc(CStr(1))
  loc_00404B1F: var_E8 = 2
  loc_00404B44: var_94 = 0040296Ch
  loc_00404B5C: var_90 = Hex$(0)
  loc_00404B70: var_8C = var_9C
  loc_00404B91: Unknown_VTable_Call[eax+000006F8h]
  loc_00404BBC: var_38 = var_98
  loc_00404C55: var_12C = Len(var_84)
  loc_00404C5B: var_84 = Text1.Text
  loc_00404C8A: var_B0 = 1
  loc_00404C94: var_B8 = 2
  loc_00404C9E: Var_Ret_8 = CLng(var_6C)
  loc_00404CC3: var_100 = Asc(Mid$(var_84, Var_Ret_8, 1))
  loc_00404CDC: var_108 = 2
  loc_00404CE6: Var_Ret_9 = var_34 + 0
  loc_00404CF1: var_34 = Var_Ret_9
                Next var_6C
  loc_00404D46: GoTo loc_00404A22
  loc_00404D4B: 
  loc_00404D6A: var_88 = 0040290Ch
  loc_00404D82: var_84 = Hex$(var_34)
  loc_00404DA0: Unknown_VTable_Call[edx+000006F8h]
  loc_00404DD6: var_B0 = var_8C
  loc_00404DDC: var_B8 = 8
  loc_00404E11: var_F0 = "FFFF"
  loc_00404E1D: var_F8 = &H8008
  loc_00404E27: Var_Ret_A = (var_8C = "FFFF")
                If Var_Ret_A = 0 Then GoTo loc_00404EE3
  loc_00404E41: var_E0 = 80020004h
  loc_00404E4C: var_D0 = 80020004h
  loc_00404E5E: var_E8 = 10
  loc_00404E64: var_D8 = 10
  loc_00404E6A: var_100 = "Correct serial!"
  loc_00404E74: var_108 = 8
  loc_00404E88: var_F0 = "Good job, tell me how you do that!"
  loc_00404E92: var_F8 = 8
  loc_00404EB7: MsgBox "Good job, tell me how you do that!", 0, "Correct serial!"
  loc_00404ED9: GoTo loc_00404F86
  loc_00404EDE: 
  loc_00404EE3: 
  loc_00404EEE: var_E0 = 80020004h
  loc_00404EF9: var_D0 = 80020004h
  loc_00404F0B: var_E8 = 10
  loc_00404F11: var_D8 = 10
  loc_00404F17: var_100 = "Wrong serial!"
  loc_00404F21: var_108 = 8
  loc_00404F35: var_F0 = "Sorry, try again!"
  loc_00404F3F: var_F8 = 8
  loc_00404F64: MsgBox "Sorry, try again!", 0, "Wrong serial!"
  loc_00404F86: 
  loc_00404F9A: GoTo loc_00404F1A
  loc_00405019: Exit Sub
  loc_0040508A: Exit Sub
End Sub

不好意思,看的更迷糊了。

暂时只到这里,留待以后继续深挖!

 

BY   笨笨D幸福

[反汇编练习] 160个CrackMe之017,布布扣,bubuko.com

[反汇编练习] 160个CrackMe之017

标签:style   class   blog   code   http   ext   

原文地址:http://www.cnblogs.com/bbdxf/p/3806768.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!