无任何提示的软件~算法分析

xuhw · 发表于 2018-6-11 00:38

本帖最后由 xuhw 于 2018-6-13 04:00 编辑

解压后请执行auto.exe，软件是繁体的，
打开软件需要用apploc，以繁体模式运行，
才能打开待网路连线下载资料完成，再点选66，此时载入od方可运行
这软件爆破非常简单，主要是讨论算法的思路  值得大家讨论研究。

软件1个月试用
可以直接更动系统日期，使软件过期，挑战17位注册码高难度算法。
软体1个月试用期破解序号及方法
9位注册码算法
123456789
(10进制第2+3+4+5+7+8+9位+31(1F)=1,6的和
3,9位=程式代码(如66)
------------------------------------------------
试用期过后序号是17位
17位注册码算法总结
第1+2+3+5+6+7+8+9+10+11+12+13+14+16+17位+25---T3
取1个月试用期间的真序号---设T4
取假码第12.10.16.2.6.7.9.14.3位合并----设为T2

1.T3/64(100->10进制)余数与第4,15位相等
2.假码3,16位数相反与程式代号66(Luck66)相等
3-4的验证分析就要麻烦先进了
5.T4与T2字串比较
軟件大小 15MB
https://pan.baidu.com/s/1YGBkrjBHqW9KjV4ZX3qq5g 密码: wu6u
［mw_shl_code=asm,true]
代码简略
00513AA3 .  53          push ebx                                        ; F2
00513AA4 .  56          push esi
00513AA5 .  57          push edi
00513AA6 .  8965 E8    mov dword ptr ss:[ebp-18],esp
00513AA9 .  C745 EC 405A4>mov dword ptr ss:[ebp-14],00405A40
00513AB0 .  8B45 08    mov eax,dword ptr ss:[ebp+8]
00513AB3 .  83E0 01    and eax,1
00513AB6 .  8945 F0    mov dword ptr ss:[ebp-10],eax
00513AB9 .  8B4D 08    mov ecx,dword ptr ss:[ebp+8]
00513ABC .  83E1 FE    and ecx,FFFFFFFE
00513ABF .  894D 08    mov dword ptr ss:[ebp+8],ecx
00513AC2 .  C745 F4 00000>mov dword ptr ss:[ebp-C],0
00513AC9 .  8B55 08    mov edx,dword ptr ss:[ebp+8]
00513ACC .  8B02       mov eax,dword ptr ds:[edx]
00513ACE .  8B4D 08    mov ecx,dword ptr ss:[ebp+8]
00513AD1 .  51          push ecx
//
//
略
//
算法代码
0051558A .  52          push edx
0051558B .  6A 1A       push 1A
0051558D .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
00515593 .  83C4 6C    add esp,6C
00515596 .  C745 FC 20000>mov dword ptr ss:[ebp-4],20
0051559D .  B8 01000000 mov eax,1
005155A2 .  83E8 01    sub eax,1
005155A5 .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
005155AB .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
005155B2 .  73 0C       jnb short 005155C0
005155B4 .  C785 B4FAFFFF>mov dword ptr ss:[ebp-54C],0
005155BE .  EB 0C       jmp short 005155CC
005155C0 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005155C6 .  8985 B4FAFFFF mov dword ptr ss:[ebp-54C],eax
005155CC >  B9 02000000 mov ecx,2
005155D1 .  83E9 01    sub ecx,1
005155D4 .  898D 30FCFFFF mov dword ptr ss:[ebp-3D0],ecx
005155DA .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
005155E1 .  73 0C       jnb short 005155EF
005155E3 .  C785 B0FAFFFF>mov dword ptr ss:[ebp-550],0
005155ED .  EB 0C       jmp short 005155FB
005155EF >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005155F5 .  8985 B0FAFFFF mov dword ptr ss:[ebp-550],eax
005155FB >  BA 03000000 mov edx,3
00515600 .  83EA 01    sub edx,1
00515603 .  8995 2CFCFFFF mov dword ptr ss:[ebp-3D4],edx
00515609 .  83BD 2CFCFFFF>cmp dword ptr ss:[ebp-3D4],64
00515610 .  73 0C       jnb short 0051561E
00515612 .  C785 ACFAFFFF>mov dword ptr ss:[ebp-554],0
0051561C .  EB 0C       jmp short 0051562A
0051561E >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515624 .  8985 ACFAFFFF mov dword ptr ss:[ebp-554],eax
0051562A >  B8 05000000 mov eax,5
0051562F .  83E8 01    sub eax,1
00515632 .  8985 28FCFFFF mov dword ptr ss:[ebp-3D8],eax
00515638 .  83BD 28FCFFFF>cmp dword ptr ss:[ebp-3D8],64
0051563F .  73 0C       jnb short 0051564D
00515641 .  C785 A8FAFFFF>mov dword ptr ss:[ebp-558],0
0051564B .  EB 0C       jmp short 00515659
0051564D >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515653 .  8985 A8FAFFFF mov dword ptr ss:[ebp-558],eax
00515659 >  B9 06000000 mov ecx,6
0051565E .  83E9 01    sub ecx,1
00515661 .  898D 24FCFFFF mov dword ptr ss:[ebp-3DC],ecx
00515667 .  83BD 24FCFFFF>cmp dword ptr ss:[ebp-3DC],64
0051566E .  73 0C       jnb short 0051567C
00515670 .  C785 A4FAFFFF>mov dword ptr ss:[ebp-55C],0
0051567A .  EB 0C       jmp short 00515688
0051567C >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515682 .  8985 A4FAFFFF mov dword ptr ss:[ebp-55C],eax
00515688 >  BA 07000000 mov edx,7
0051568D .  83EA 01    sub edx,1
00515690 .  8995 20FCFFFF mov dword ptr ss:[ebp-3E0],edx
00515696 .  83BD 20FCFFFF>cmp dword ptr ss:[ebp-3E0],64
0051569D .  73 0C       jnb short 005156AB
0051569F .  C785 A0FAFFFF>mov dword ptr ss:[ebp-560],0
005156A9 .  EB 0C       jmp short 005156B7
005156AB >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005156B1 .  8985 A0FAFFFF mov dword ptr ss:[ebp-560],eax
005156B7 >  B8 08000000 mov eax,8
005156BC .  83E8 01    sub eax,1
005156BF .  8985 1CFCFFFF mov dword ptr ss:[ebp-3E4],eax
005156C5 .  83BD 1CFCFFFF>cmp dword ptr ss:[ebp-3E4],64
005156CC .  73 0C       jnb short 005156DA
005156CE .  C785 9CFAFFFF>mov dword ptr ss:[ebp-564],0
005156D8 .  EB 0C       jmp short 005156E6
005156DA >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005156E0 .  8985 9CFAFFFF mov dword ptr ss:[ebp-564],eax
005156E6 >  B9 09000000 mov ecx,9
005156EB .  83E9 01    sub ecx,1
005156EE .  898D 18FCFFFF mov dword ptr ss:[ebp-3E8],ecx
005156F4 .  83BD 18FCFFFF>cmp dword ptr ss:[ebp-3E8],64
005156FB .  73 0C       jnb short 00515709
005156FD .  C785 98FAFFFF>mov dword ptr ss:[ebp-568],0
00515707 .  EB 0C       jmp short 00515715
00515709 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051570F .  8985 98FAFFFF mov dword ptr ss:[ebp-568],eax
00515715 >  BA 0A000000 mov edx,0A
0051571A .  83EA 01    sub edx,1
0051571D .  8995 14FCFFFF mov dword ptr ss:[ebp-3EC],edx
00515723 .  83BD 14FCFFFF>cmp dword ptr ss:[ebp-3EC],64
0051572A .  73 0C       jnb short 00515738
0051572C .  C785 94FAFFFF>mov dword ptr ss:[ebp-56C],0
00515736 .  EB 0C       jmp short 00515744
00515738 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051573E .  8985 94FAFFFF mov dword ptr ss:[ebp-56C],eax
00515744 >  B8 0B000000 mov eax,0B
00515749 .  83E8 01    sub eax,1
0051574C .  8985 10FCFFFF mov dword ptr ss:[ebp-3F0],eax
00515752 .  83BD 10FCFFFF>cmp dword ptr ss:[ebp-3F0],64
00515759 .  73 0C       jnb short 00515767
0051575B .  C785 90FAFFFF>mov dword ptr ss:[ebp-570],0
00515765 .  EB 0C       jmp short 00515773
00515767 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051576D .  8985 90FAFFFF mov dword ptr ss:[ebp-570],eax
00515773 >  B9 0C000000 mov ecx,0C
00515778 .  83E9 01    sub ecx,1
0051577B .  898D 0CFCFFFF mov dword ptr ss:[ebp-3F4],ecx
00515781 .  83BD 0CFCFFFF>cmp dword ptr ss:[ebp-3F4],64
00515788 .  73 0C       jnb short 00515796
0051578A .  C785 8CFAFFFF>mov dword ptr ss:[ebp-574],0
00515794 .  EB 0C       jmp short 005157A2
00515796 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051579C .  8985 8CFAFFFF mov dword ptr ss:[ebp-574],eax
005157A2 >  BA 0D000000 mov edx,0D
005157A7 .  83EA 01    sub edx,1
005157AA .  8995 08FCFFFF mov dword ptr ss:[ebp-3F8],edx
005157B0 .  83BD 08FCFFFF>cmp dword ptr ss:[ebp-3F8],64
005157B7 .  73 0C       jnb short 005157C5
005157B9 .  C785 88FAFFFF>mov dword ptr ss:[ebp-578],0
005157C3 .  EB 0C       jmp short 005157D1
005157C5 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005157CB .  8985 88FAFFFF mov dword ptr ss:[ebp-578],eax
005157D1 >  B8 0E000000 mov eax,0E
005157D6 .  83E8 01    sub eax,1
005157D9 .  8985 04FCFFFF mov dword ptr ss:[ebp-3FC],eax
005157DF .  83BD 04FCFFFF>cmp dword ptr ss:[ebp-3FC],64
005157E6 .  73 0C       jnb short 005157F4
005157E8 .  C785 84FAFFFF>mov dword ptr ss:[ebp-57C],0
005157F2 .  EB 0C       jmp short 00515800
005157F4 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005157FA .  8985 84FAFFFF mov dword ptr ss:[ebp-57C],eax
00515800 >  B9 10000000 mov ecx,10
00515805 .  83E9 01    sub ecx,1
00515808 .  898D 00FCFFFF mov dword ptr ss:[ebp-400],ecx
0051580E .  83BD 00FCFFFF>cmp dword ptr ss:[ebp-400],64
00515815 .  73 0C       jnb short 00515823
00515817 .  C785 80FAFFFF>mov dword ptr ss:[ebp-580],0
00515821 .  EB 0C       jmp short 0051582F
00515823 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515829 .  8985 80FAFFFF mov dword ptr ss:[ebp-580],eax
0051582F >  BA 11000000 mov edx,11
00515834 .  83EA 01    sub edx,1
00515837 .  8995 FCFBFFFF mov dword ptr ss:[ebp-404],edx
0051583D .  83BD FCFBFFFF>cmp dword ptr ss:[ebp-404],64
00515844 .  73 0C       jnb short 00515852
00515846 .  C785 7CFAFFFF>mov dword ptr ss:[ebp-584],0
00515850 .  EB 0C       jmp short 0051585E
00515852 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515858 .  8985 7CFAFFFF mov dword ptr ss:[ebp-584],eax <---------------------->算法
0051585E >  8B85 34FCFFFF mov eax,dword ptr ss:[ebp-3CC]
00515864 .  8B8D 30FCFFFF mov ecx,dword ptr ss:[ebp-3D0]
0051586A .  8A90 64E15300 mov dl,byte ptr ds:[eax+53E164]
00515870 .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
00515876 .  0F82 22130000 jb 00516B9E
0051587C .  8B85 2CFCFFFF mov eax,dword ptr ss:[ebp-3D4]
00515882 .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
00515888 .  0F82 10130000 jb 00516B9E
0051588E .  8B8D 28FCFFFF mov ecx,dword ptr ss:[ebp-3D8]
00515894 .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
0051589A .  0F82 FE120000 jb 00516B9E
005158A0 .  8B85 24FCFFFF mov eax,dword ptr ss:[ebp-3DC]
005158A6 .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
005158AC .  0F82 EC120000 jb 00516B9E
005158B2 .  8B8D 20FCFFFF mov ecx,dword ptr ss:[ebp-3E0]
005158B8 .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
005158BE .  0F82 DA120000 jb 00516B9E
005158C4 .  8B85 1CFCFFFF mov eax,dword ptr ss:[ebp-3E4]
005158CA .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
005158D0 .  0F82 C8120000 jb 00516B9E
005158D6 .  8B8D 18FCFFFF mov ecx,dword ptr ss:[ebp-3E8]
005158DC .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
005158E2 .  0F82 B6120000 jb 00516B9E
005158E8 .  8B85 14FCFFFF mov eax,dword ptr ss:[ebp-3EC]
005158EE .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
005158F4 .  0F82 A4120000 jb 00516B9E
005158FA .  8B8D 10FCFFFF mov ecx,dword ptr ss:[ebp-3F0]
00515900 .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
00515906 .  0F82 92120000 jb 00516B9E
0051590C .  8B85 0CFCFFFF mov eax,dword ptr ss:[ebp-3F4]
00515912 .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
00515918 .  0F82 80120000 jb 00516B9E
0051591E .  8B8D 08FCFFFF mov ecx,dword ptr ss:[ebp-3F8]
00515924 .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
0051592A .  0F82 6E120000 jb 00516B9E
00515930 .  8B85 04FCFFFF mov eax,dword ptr ss:[ebp-3FC]
00515936 .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
0051593C .  0F82 5C120000 jb 00516B9E
00515942 .  8B8D 00FCFFFF mov ecx,dword ptr ss:[ebp-400]
00515948 .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
0051594E .  0F82 4A120000 jb 00516B9E
00515954 .  8B85 FCFBFFFF mov eax,dword ptr ss:[ebp-404]
0051595A .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
00515960 .  0F82 38120000 jb 00516B9E
00515966 .  66:33C0    xor ax,ax
00515969 .  8AC2       mov al,dl
0051596B .  8B4D 08    mov ecx,dword ptr ss:[ebp+8]
0051596E .  66:0341 34 add ax,word ptr ds:[ecx+34]
00515972 .  0F80 26120000 jo 00516B9E
00515978 .  66:99       cwd
0051597A .  66:B9 6400 mov cx,64                         ->第1+2+3+5+6+7+8+9+10+11+12+13+14+16+17位+41/100---T3
0051597E .  66:F7F9    idiv cx
00515981 .  66:8995 58FDF>mov word ptr ss:[ebp-2A8],dx
00515988 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],8002
00515992 .  8D95 78FFFFFF lea edx,dword ptr ss:[ebp-88]
00515998 .  52          push edx                                        ; /Arg2
00515999 .  8D85 50FDFFFF lea eax,dword ptr ss:[ebp-2B0]                ; |
0051599F .  50          push eax                                        ; |Arg1
005159A0 .  FF15 18114000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>] ; \比较4,15位余数 --------------1
005159A6 .  0FBFC8       movsx ecx,ax
005159A9 .  85C9       test ecx,ecx
005159AB .  0F84 FF0F0000 je 005169B0 -------------------------------------跳走就完
005159B1 .  C745 FC 21000>mov dword ptr ss:[ebp-4],21
005159B8 .  8D95 58FFFFFF lea edx,dword ptr ss:[ebp-A8]
005159BE .  52          push edx                                        ; /Arg2
005159BF .  8D45 A0    lea eax,dword ptr ss:[ebp-60]                   ; |
005159C2 .  50          push eax                                        ; |Arg1
005159C3 .  FF15 18114000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>] ; \比较程式代码与第3,16位相等---2
005159C9 .  0FBFC8       movsx ecx,ax
005159CC .  85C9       test ecx,ecx
005159CE .  0F84 DC0F0000 je 005169B0  ------------------------------------跳走就完
005159D4 .  C745 FC 22000>mov dword ptr ss:[ebp-4],22
005159DB .  8D55 88    lea edx,dword ptr ss:[ebp-78]
005159DE .  52          push edx                                        ; /Arg3
005159DF .  8D85 44FFFFFF lea eax,dword ptr ss:[ebp-BC]                   ; |
005159E5 .  50          push eax                                        ; |Arg2
005159E6 .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]                ; |
005159EC .  51          push ecx                                        ; |Arg1
005159ED .  FF15 84104000 call dword ptr ds:[<&MSVBVM60.__vbaVarCmpGe>] ; \__vbaVarCmpGe  ---不知验证什么----3
005159F3 .  50          push eax                                        ; /Arg3
005159F4 .  8D55 88    lea edx,dword ptr ss:[ebp-78]                   ; |
005159F7 .  52          push edx                                        ; |/Arg3
005159F8 .  8D85 10FFFFFF lea eax,dword ptr ss:[ebp-F0]                   ; ||
005159FE .  50          push eax                                        ; ||Arg2
005159FF .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]                ; ||
00515A05 .  51          push ecx                                        ; ||Arg1
00515A06 .  FF15 9C114000 call dword ptr ds:[<&MSVBVM60.__vbaVarCmpLe>] ; |\__vbaVarCmpLe ---不知验证什么----4
00515A0C .  50          push eax                                        ; |Arg2
00515A0D .  8D95 D0FEFFFF lea edx,dword ptr ss:[ebp-130]                ; |
00515A13 .  52          push edx                                        ; |Arg1
00515A14 .  FF15 64114000 call dword ptr ds:[<&MSVBVM60.__vbaVarAnd>]    ; \__vbaVarAnd
00515A1A .  50          push eax                                        ; /Arg1
00515A1B .  FF15 DC104000 call dword ptr ds:[<&MSVBVM60.__vbaBoolVarNull>] ; \__vbaBoolVarNull
00515A21 .  0FBFC0       movsx eax,ax
00515A24 .  85C0       test eax,eax
00515A26 .  0F84 840F0000 je 005169B0  ------------------------------------跳走就完
00515A2C .  C745 FC 23000>mov dword ptr ss:[ebp-4],23
00515A33 .  C785 F8FEFFFF>mov dword ptr ss:[ebp-108],80020004
00515A3D .  C785 F0FEFFFF>mov dword ptr ss:[ebp-110],0A
00515A47 .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00515A4D .  51          push ecx                                        ; /Arg1
00515A4E .  FF15 D0114000 call dword ptr ds:[<&MSVBVM60.#648>]          ; \rtcFreeFile
00515A54 .  66:8985 48FDF>mov word ptr ss:[ebp-2B8],ax
00515A5B .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00515A65 .  8D95 40FDFFFF lea edx,dword ptr ss:[ebp-2C0]
00515A6B .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
00515A71 .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMove>]    ;  MSVBVM60.__vbaVarMove
00515A77 .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00515A7D .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00515A83 .  C745 FC 24000>mov dword ptr ss:[ebp-4],24
00515A8A .  8B15 58E05300 mov edx,dword ptr ds:[53E058]
00515A90 .  52          push edx                                        ; /Arg2 => 0019FAFC
00515A91 .  68 F0FC4000 push 0040FCF0                                  ; |Arg1 = 0040FCF0
00515A96 .  FF15 5C104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCat>]    ; \__vbaStrCat
00515A9C .  8BD0       mov edx,eax
00515A9E .  8D8D 0CFFFFFF lea ecx,dword ptr ss:[ebp-F4]
00515AA4 .  FF15 58124000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]    ;  MSVBVM60.__vbaStrMove
00515AAA .  50          push eax                                        ; /Arg2
00515AAB .  A1 34E25300 mov eax,dword ptr ds:[53E234]                   ; |
00515AB0 .  50          push eax                                        ; |Arg1 => 0019FAC4
00515AB1 .  FF15 5C104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCat>]    ; \__vbaStrCat
00515AB7 .  8BD0       mov edx,eax
00515AB9 .  8D8D 08FFFFFF lea ecx,dword ptr ss:[ebp-F8]
00515ABF .  FF15 58124000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]    ;  MSVBVM60.__vbaStrMove
00515AC5 .  50          push eax                                        ; /Arg2
00515AC6 .  68 0CFD4000 push 0040FD0C                                  ; |Arg1 = 0040FD0C
00515ACB .  FF15 5C104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCat>]    ; \__vbaStrCat
00515AD1 .  8BD0       mov edx,eax
00515AD3 .  8D8D 04FFFFFF lea ecx,dword ptr ss:[ebp-FC]
00515AD9 .  FF15 58124000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]    ;  MSVBVM60.__vbaStrMove
00515ADF .  50          push eax
00515AE0 .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
00515AE6 .  51          push ecx
00515AE7 .  FF15 B8114000 call dword ptr ds:[<&MSVBVM60.__vbaI2Var>]    ;  MSVBVM60.__vbaI2Var
00515AED .  50          push eax                                        ; |Arg3
00515AEE .  6A FF       push -1                                        ; |Arg2 = FFFFFFFF
00515AF0 .  6A 20       push 20                                        ; |Arg1 = 00000020
00515AF2 .  FF15 C8114000 call dword ptr ds:[<&MSVBVM60.__vbaFileOpen>] ; \__vbaFileOpen
00515AF8 .  8D95 04FFFFFF lea edx,dword ptr ss:[ebp-FC]
00515AFE .  52          push edx
00515AFF .  8D85 08FFFFFF lea eax,dword ptr ss:[ebp-F8]
00515B05 .  50          push eax
00515B06 .  8D8D 0CFFFFFF lea ecx,dword ptr ss:[ebp-F4]
00515B0C .  51          push ecx
00515B0D .  6A 03       push 3
00515B0F .  FF15 F4114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>] ;  MSVBVM60.__vbaFreeStrList
00515B15 .  83C4 10    add esp,10
00515B18 .  C745 FC 25000>mov dword ptr ss:[ebp-4],25
00515B1F .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],64
00515B29 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00515B33 .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],64
00515B3D .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00515B47 .  8D95 68FFFFFF lea edx,dword ptr ss:[ebp-98]
00515B4D .  52          push edx
00515B4E .  FF15 B8114000 call dword ptr ds:[<&MSVBVM60.__vbaI2Var>]    ;  MSVBVM60.__vbaI2Var
00515B54 .  50          push eax
00515B55 .  8D45 A0    lea eax,dword ptr ss:[ebp-60]
00515B58 .  50          push eax                                        ; /Arg3
00515B59 .  8D8D 50FDFFFF lea ecx,dword ptr ss:[ebp-2B0]                ; |
00515B5F .  51          push ecx                                        ; |Arg2
00515B60 .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]                ; |
00515B66 .  52          push edx                                        ; |Arg1
00515B67 .  FF15 70114000 call dword ptr ds:[<&MSVBVM60.__vbaVarMul>]    ; \__vbaVarMul
00515B6D .  50          push eax                                        ; /Arg3
00515B6E .  8D85 40FDFFFF lea eax,dword ptr ss:[ebp-2C0]                ; |
00515B74 .  50          push eax                                        ; |Arg2
00515B75 .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]                ; |
00515B7B .  51          push ecx                                        ; |Arg1
00515B7C .  FF15 2C124000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]    ; \__vbaVarAdd
00515B82 .  50          push eax
00515B83 .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]    ;  MSVBVM60.__vbaI4Var
00515B89 .  50          push eax                                        ; |Arg3
00515B8A .  68 C8E15300 push 0053E1C8                                  ; |Arg2 = 0053E1C8
00515B8F .  6A 64       push 64                                        ; |Arg1 = 00000064
00515B91 .  FF15 14114000 call dword ptr ds:[<&MSVBVM60.__vbaGet4>]       ; \__vbaGet4
00515B97 .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]
00515B9D .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00515BA3 .  C745 FC 26000>mov dword ptr ss:[ebp-4],26
00515BAA .  BA 3CE44000 mov edx,0040E43C
00515BAF .  8D4D 98    lea ecx,dword ptr ss:[ebp-68]
00515BB2 .  FF15 F0114000 call dword ptr ds:[<&MSVBVM60.__vbaStrCopy>]    ;  MSVBVM60.__vbaStrCopy
00515BB8 .  C745 FC 27000>mov dword ptr ss:[ebp-4],27
00515BBF .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],1
00515BC9 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00515BD3 .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],27
00515BDD .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00515BE7 .  C785 38FDFFFF>mov dword ptr ss:[ebp-2C8],1F
00515BF1 .  C785 30FDFFFF>mov dword ptr ss:[ebp-2D0],2
00515BFB .  8D95 50FDFFFF lea edx,dword ptr ss:[ebp-2B0]
00515C01 .  52          push edx
00515C02 .  8D85 40FDFFFF lea eax,dword ptr ss:[ebp-2C0]
00515C08 .  50          push eax
00515C09 .  8D8D 30FDFFFF lea ecx,dword ptr ss:[ebp-2D0]
00515C0F .  51          push ecx
00515C10 .  8D95 BCFBFFFF lea edx,dword ptr ss:[ebp-444]
00515C16 .  52          push edx
00515C17 .  8D85 CCFBFFFF lea eax,dword ptr ss:[ebp-434]
00515C1D .  50          push eax
00515C1E .  8D4D B0    lea ecx,dword ptr ss:[ebp-50]
00515C21 .  51          push ecx
00515C22 .  FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>]  ;  MSVBVM60.__vbaVarForInit
00515C28 .  8985 38FBFFFF mov dword ptr ss:[ebp-4C8],eax
00515C2E .  E9 A8010000 jmp 00515DDB
00515C33 >  C745 FC 28000>mov dword ptr ss:[ebp-4],28
00515C3A .  8B55 98    mov edx,dword ptr ss:[ebp-68]
00515C3D .  8995 38FDFFFF mov dword ptr ss:[ebp-2C8],edx
00515C43 .  C785 30FDFFFF>mov dword ptr ss:[ebp-2D0],8
00515C4D .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],0040E348             ;  UNICODE "0"
00515C57 .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],8
00515C61 .  8D95 40FDFFFF lea edx,dword ptr ss:[ebp-2C0]
00515C67 .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00515C6D .  FF15 34124000 call dword ptr ds:[<&MSVBVM60.__vbaVarDup>]    ;  MSVBVM60.__vbaVarDup
00515C73 .  8D45 B0    lea eax,dword ptr ss:[ebp-50]
00515C76 .  50          push eax
00515C77 .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]    ;  MSVBVM60.__vbaI4Var
00515C7D .  83E8 01    sub eax,1
00515C80 .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00515C86 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00515C8D .  73 0C       jnb short 00515C9B
00515C8F .  C785 78FAFFFF>mov dword ptr ss:[ebp-588],0
00515C99 .  EB 0C       jmp short 00515CA7
00515C9B >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515CA1 .  8985 78FAFFFF mov dword ptr ss:[ebp-588],eax
00515CA7 >  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00515CAD .  81C1 C8E15300 add ecx,0053E1C8
00515CB3 .  898D 58FDFFFF mov dword ptr ss:[ebp-2A8],ecx
00515CB9 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],4011
00515CC3 .  6A 01       push 1                                        ; /Arg5 = 00000001
00515CC5 .  6A 01       push 1                                        ; |Arg4 = 00000001
00515CC7 .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]                ; |
00515CCD .  52          push edx                                        ; |Arg3
00515CCE .  8D85 50FDFFFF lea eax,dword ptr ss:[ebp-2B0]                ; |
00515CD4 .  50          push eax                                        ; |Arg2
00515CD5 .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]                ; |
00515CDB .  51          push ecx                                        ; |Arg1
00515CDC .  FF15 64104000 call dword ptr ds:[<&MSVBVM60.#660>]          ; \rtcVarFromFormatVar
00515CE2 .  8D95 30FDFFFF lea edx,dword ptr ss:[ebp-2D0]
00515CE8 .  52          push edx                                        ; /Arg3
00515CE9 .  8D85 E0FEFFFF lea eax,dword ptr ss:[ebp-120]                ; |
00515CEF .  50          push eax                                        ; |Arg2
00515CF0 .  8D8D D0FEFFFF lea ecx,dword ptr ss:[ebp-130]                ; |
00515CF6 .  51          push ecx                                        ; |Arg1
00515CF7 .  FF15 2C124000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]    ; \__vbaVarAdd
00515CFD .  50          push eax                                        ; /Arg1
00515CFE .  FF15 28104000 call dword ptr ds:[<&MSVBVM60.__vbaStrVarMove>]  ; \__vbaStrVarMove
00515D04 .  8BD0       mov edx,eax
00515D06 .  8D4D 98    lea ecx,dword ptr ss:[ebp-68]
00515D09 .  FF15 58124000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]    ;  MSVBVM60.__vbaStrMove
00515D0F .  8D95 D0FEFFFF lea edx,dword ptr ss:[ebp-130]
00515D15 .  52          push edx
00515D16 .  8D85 E0FEFFFF lea eax,dword ptr ss:[ebp-120]
00515D1C .  50          push eax
00515D1D .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00515D23 .  51          push ecx
00515D24 .  6A 03       push 3
00515D26 .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
00515D2C .  83C4 10    add esp,10
00515D2F .  C745 FC 29000>mov dword ptr ss:[ebp-4],29
00515D36 .  8D55 B0    lea edx,dword ptr ss:[ebp-50]
00515D39 .  52          push edx
00515D3A .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]    ;  MSVBVM60.__vbaI4Var
00515D40 .  83E8 01    sub eax,1
00515D43 .  8985 30FCFFFF mov dword ptr ss:[ebp-3D0],eax
00515D49 .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
00515D50 .  73 0C       jnb short 00515D5E
00515D52 .  C785 74FAFFFF>mov dword ptr ss:[ebp-58C],0
00515D5C .  EB 0C       jmp short 00515D6A
00515D5E >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515D64 .  8985 74FAFFFF mov dword ptr ss:[ebp-58C],eax
00515D6A >  8D45 B0    lea eax,dword ptr ss:[ebp-50]
00515D6D .  50          push eax
00515D6E .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]    ;  MSVBVM60.__vbaI4Var
00515D74 .  83E8 01    sub eax,1
00515D77 .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00515D7D .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00515D84 .  73 0C       jnb short 00515D92
00515D86 .  C785 70FAFFFF>mov dword ptr ss:[ebp-590],0
00515D90 .  EB 0C       jmp short 00515D9E
00515D92 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515D98 .  8985 70FAFFFF mov dword ptr ss:[ebp-590],eax
00515D9E >  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00515DA4 .  8B95 30FCFFFF mov edx,dword ptr ss:[ebp-3D0]
00515DAA .  8A82 C8E15300 mov al,byte ptr ds:[edx+53E1C8]
00515DB0 .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00515DB6 .  C745 FC 2A000>mov dword ptr ss:[ebp-4],2A
00515DBD .  8D8D BCFBFFFF lea ecx,dword ptr ss:[ebp-444]
00515DC3 .  51          push ecx                                        ; /Arg3
00515DC4 .  8D95 CCFBFFFF lea edx,dword ptr ss:[ebp-434]                ; |
00515DCA .  52          push edx                                        ; |Arg2
00515DCB .  8D45 B0    lea eax,dword ptr ss:[ebp-50]                   ; |
00515DCE .  50          push eax                                        ; |Arg1
00515DCF .  FF15 88124000 call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>]  ; \__vbaVarForNext
00515DD5 .  8985 38FBFFFF mov dword ptr ss:[ebp-4C8],eax
00515DDB >  83BD 38FBFFFF>cmp dword ptr ss:[ebp-4C8],0
00515DE2 .^ 0F85 4BFEFFFF jnz 00515C33
00515DE8 .  C745 FC 2B000>mov dword ptr ss:[ebp-4],2B
00515DEF .  8B8D 40FFFFFF mov ecx,dword ptr ss:[ebp-C0]
00515DF5 .  51          push ecx                                        ; /Arg2
00515DF6 .  8B55 98    mov edx,dword ptr ss:[ebp-68]                   ; |
00515DF9 .  52          push edx                                        ; |Arg1
00515DFA .  FF15 10114000 call dword ptr ds:[<&MSVBVM60.__vbaStrCmp>]    ; \__vbaStrCmp ------...5
00515E00 .  85C0       test eax,eax
00515E02 .  0F85 9B0B0000 jnz 005169A3 ------------------------------------跳走就完
00515E08 .  C745 FC 2C000>mov dword ptr ss:[ebp-4],2C
00515E0F .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],1
00515E19 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00515E23 .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],14
00515E2D .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00515E37 .  C785 38FDFFFF>mov dword ptr ss:[ebp-2C8],1
00515E41 .  C785 30FDFFFF>mov dword ptr ss:[ebp-2D0],2
00515E4B .  8D85 50FDFFFF lea eax,dword ptr ss:[ebp-2B0]
00515E51 .  50          push eax
00515E52 .  8D8D 40FDFFFF lea ecx,dword ptr ss:[ebp-2C0]
00515E58 .  51          push ecx
00515E59 .  8D95 30FDFFFF lea edx,dword ptr ss:[ebp-2D0]
00515E5F .  52          push edx
00515E60 .  8D85 9CFBFFFF lea eax,dword ptr ss:[ebp-464]
00515E66 .  50          push eax
00515E67 .  8D8D ACFBFFFF lea ecx,dword ptr ss:[ebp-454]
00515E6D .  51          push ecx
00515E6E .  8D55 B0    lea edx,dword ptr ss:[ebp-50]
00515E71 .  52          push edx
00515E72 .  FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>]  ;  MSVBVM60.__vbaVarForInit
00515E78 .  8985 34FBFFFF mov dword ptr ss:[ebp-4CC],eax
00515E7E .  E9 24010000 jmp 00515FA7
00515E83 >  C745 FC 2D000>mov dword ptr ss:[ebp-4],2D
00515E8A .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],32
00515E94 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00515E9E .  8D45 B0    lea eax,dword ptr ss:[ebp-50]
00515EA1 .  50          push eax                                        ; /Arg3
00515EA2 .  8D8D 50FDFFFF lea ecx,dword ptr ss:[ebp-2B0]                ; |
00515EA8 .  51          push ecx                                        ; |Arg2
00515EA9 .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]                ; |
00515EAF .  52          push edx                                        ; |Arg1
00515EB0 .  FF15 2C124000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]    ; \__vbaVarAdd
00515EB6 .  50          push eax
00515EB7 .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]    ;  MSVBVM60.__vbaI4Var
00515EBD .  83E8 01    sub eax,1
00515EC0 .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00515EC6 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00515ECD .  73 0C       jnb short 00515EDB
00515ECF .  C785 6CFAFFFF>mov dword ptr ss:[ebp-594],0
00515ED9 .  EB 0C       jmp short 00515EE7
00515EDB >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515EE1 .  8985 6CFAFFFF mov dword ptr ss:[ebp-594],eax
00515EE7 >  8D45 B0    lea eax,dword ptr ss:[ebp-50]
00515EEA .  50          push eax
00515EEB .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]    ;  MSVBVM60.__vbaI4Var
00515EF1 .  83E8 01    sub eax,1
00515EF4 .  8985 30FCFFFF mov dword ptr ss:[ebp-3D0],eax
00515EFA .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
00515F01 .  73 0C       jnb short 00515F0F
00515F03 .  C785 68FAFFFF>mov dword ptr ss:[ebp-598],0
00515F0D .  EB 0C       jmp short 00515F1B
00515F0F >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515F15 .  8985 68FAFFFF mov dword ptr ss:[ebp-598],eax
00515F1B >  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00515F21 .  8B95 30FCFFFF mov edx,dword ptr ss:[ebp-3D0]
00515F27 .  8A81 C8E15300 mov al,byte ptr ds:[ecx+53E1C8]
00515F2D .  33C9       xor ecx,ecx
00515F2F .  3A82 64E15300 cmp al,byte ptr ds:[edx+53E164]
00515F35 .  0F95C1       setne cl
00515F38 .  F7D9       neg ecx
00515F3A .  66:898D 2CFCF>mov word ptr ss:[ebp-3D4],cx
00515F41 .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00515F47 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00515F4D .  0FBF95 2CFCFF>movsx edx,word ptr ss:[ebp-3D4]
00515F54 .  85D2       test edx,edx
00515F56 .  74 2A       je short 00515F82
00515F58 .  C745 FC 2E000>mov dword ptr ss:[ebp-4],2E
00515F5F .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],63
00515F69 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00515F73 .  8D95 50FDFFFF lea edx,dword ptr ss:[ebp-2B0]
00515F79 .  8D4D B0    lea ecx,dword ptr ss:[ebp-50]
00515F7C .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMove>]    ;  MSVBVM60.__vbaVarMove
00515F82 >  C745 FC 30000>mov dword ptr ss:[ebp-4],30
00515F89 .  8D85 9CFBFFFF lea eax,dword ptr ss:[ebp-464]
00515F8F .  50          push eax                                        ; /Arg3
00515F90 .  8D8D ACFBFFFF lea ecx,dword ptr ss:[ebp-454]                ; |
00515F96 .  51          push ecx                                        ; |Arg2
00515F97 .  8D55 B0    lea edx,dword ptr ss:[ebp-50]                   ; |
00515F9A .  52          push edx                                        ; |Arg1
00515F9B .  FF15 88124000 call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>]  ; \__vbaVarForNext
00515FA1 .  8985 34FBFFFF mov dword ptr ss:[ebp-4CC],eax
00515FA7 >  83BD 34FBFFFF>cmp dword ptr ss:[ebp-4CC],0
00515FAE .^ 0F85 CFFEFFFF jnz 00515E83
00515FB4 .  C745 FC 31000>mov dword ptr ss:[ebp-4],31
00515FBB .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],5A
00515FC5 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],8002
00515FCF .  8D45 B0    lea eax,dword ptr ss:[ebp-50]
00515FD2 .  50          push eax
00515FD3 .  8D8D 50FDFFFF lea ecx,dword ptr ss:[ebp-2B0]
00515FD9 .  51          push ecx
00515FDA .  FF15 00104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstGt>] ;  MSVBVM60.__vbaVarTstGt
00515FE0 .  0FBFD0       movsx edx,ax
00515FE3 .  85D2       test edx,edx
00515FE5 .  0F84 05060000 je 005165F0
00515FEB .  C745 FC 32000>mov dword ptr ss:[ebp-4],32
00515FF2 .  B8 15000000 mov eax,15
00515FF7 .  83E8 01    sub eax,1
00515FFA .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00516000 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516007 .  73 0C       jnb short 00516015
00516009 .  C785 64FAFFFF>mov dword ptr ss:[ebp-59C],0
00516013 .  EB 0C       jmp short 00516021
00516015 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051601B .  8985 64FAFFFF mov dword ptr ss:[ebp-59C],eax
00516021 >  66:8B0D 2EE25>mov cx,word ptr ds:[53E22E]
00516028 .  FF15 5C114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I2>]    ;  MSVBVM60.__vbaUI1I2
0051602E .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00516034 .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
0051603A .  C745 FC 33000>mov dword ptr ss:[ebp-4],33
00516041 .  BA 16000000 mov edx,16
00516046 .  83EA 01    sub edx,1
00516049 .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
0051604F .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516056 .  73 0C       jnb short 00516064
00516058 .  C785 60FAFFFF>mov dword ptr ss:[ebp-5A0],0
00516062 .  EB 0C       jmp short 00516070
00516064 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051606A .  8985 60FAFFFF mov dword ptr ss:[ebp-5A0],eax
00516070 >  66:8B0D 30E25>mov cx,word ptr ds:[53E230]
00516077 .  FF15 5C114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I2>]    ;  MSVBVM60.__vbaUI1I2
0051607D .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00516083 .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00516089 .  C745 FC 34000>mov dword ptr ss:[ebp-4],34
00516090 .  BA 17000000 mov edx,17
00516095 .  83EA 01    sub edx,1
00516098 .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
0051609E .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
005160A5 .  73 0C       jnb short 005160B3
005160A7 .  C785 5CFAFFFF>mov dword ptr ss:[ebp-5A4],0
005160B1 .  EB 0C       jmp short 005160BF
005160B3 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005160B9 .  8985 5CFAFFFF mov dword ptr ss:[ebp-5A4],eax
005160BF >  66:8B0D 32E25>mov cx,word ptr ds:[53E232]
005160C6 .  FF15 5C114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I2>]    ;  MSVBVM60.__vbaUI1I2
005160CC .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
005160D2 .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
005160D8 .  C745 FC 35000>mov dword ptr ss:[ebp-4],35
005160DF .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]
005160E5 .  52          push edx                                        ; /Arg1
005160E6 .  FF15 7C124000 call dword ptr ds:[<&MSVBVM60.#546>]          ; \rtcGetPresentDate
005160EC .  8D85 F0FEFFFF lea eax,dword ptr ss:[ebp-110]
005160F2 .  50          push eax                                        ; /Arg2
005160F3 .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]                ; |
005160F9 .  51          push ecx                                        ; |Arg1
005160FA .  FF15 E0114000 call dword ptr ds:[<&MSVBVM60.__vbaVarInt>]    ; \__vbaVarInt
00516100 .  50          push eax
00516101 .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]    ;  MSVBVM60.__vbaI4Var
00516107 .  8985 54FFFFFF mov dword ptr ss:[ebp-AC],eax
0051610D .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00516113 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516119 .  C745 FC 36000>mov dword ptr ss:[ebp-4],36
00516120 .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]
00516126 .  52          push edx                                        ; /Arg1
00516127 .  FF15 7C124000 call dword ptr ds:[<&MSVBVM60.#546>]          ; \rtcGetPresentDate
0051612D .  8D85 E0FEFFFF lea eax,dword ptr ss:[ebp-120]
00516133 .  50          push eax                                        ; /Arg1
00516134 .  FF15 7C124000 call dword ptr ds:[<&MSVBVM60.#546>]          ; \rtcGetPresentDate
0051613A .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],100
00516144 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
0051614E .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],100
00516158 .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00516162 .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00516168 .  51          push ecx                                        ; /Arg3
00516169 .  8D95 E0FEFFFF lea edx,dword ptr ss:[ebp-120]                ; |
0051616F .  52          push edx                                        ; |/Arg2
00516170 .  8D85 D0FEFFFF lea eax,dword ptr ss:[ebp-130]                ; ||
00516176 .  50          push eax                                        ; ||Arg1
00516177 .  FF15 E0114000 call dword ptr ds:[<&MSVBVM60.__vbaVarInt>]    ; |\__vbaVarInt
0051617D .  50          push eax                                        ; |Arg2
0051617E .  8D8D C0FEFFFF lea ecx,dword ptr ss:[ebp-140]                ; |
00516184 .  51          push ecx                                        ; |Arg1
00516185 .  FF15 04104000 call dword ptr ds:[<&MSVBVM60.__vbaVarSub>]    ; \__vbaVarSub
0051618B .  50          push eax                                        ; /Arg3
0051618C .  8D95 50FDFFFF lea edx,dword ptr ss:[ebp-2B0]                ; |
00516192 .  52          push edx                                        ; |Arg2
00516193 .  8D85 B0FEFFFF lea eax,dword ptr ss:[ebp-150]                ; |
00516199 .  50          push eax                                        ; |Arg1
0051619A .  FF15 70114000 call dword ptr ds:[<&MSVBVM60.__vbaVarMul>]    ; \__vbaVarMul
005161A0 .  50          push eax                                        ; /Arg3
005161A1 .  8D8D 40FDFFFF lea ecx,dword ptr ss:[ebp-2C0]                ; |
005161A7 .  51          push ecx                                        ; |Arg2
005161A8 .  8D95 A0FEFFFF lea edx,dword ptr ss:[ebp-160]                ; |
005161AE .  52          push edx                                        ; |Arg1
005161AF .  FF15 70114000 call dword ptr ds:[<&MSVBVM60.__vbaVarMul>]    ; \__vbaVarMul
005161B5 .  50          push eax                                        ; /Arg2
005161B6 .  8D85 90FEFFFF lea eax,dword ptr ss:[ebp-170]                ; |
005161BC .  50          push eax                                        ; |Arg1
005161BD .  FF15 E0114000 call dword ptr ds:[<&MSVBVM60.__vbaVarInt>]    ; \__vbaVarInt
005161C3 .  50          push eax
005161C4 .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]    ;  MSVBVM60.__vbaI4Var
005161CA .  8945 9C    mov dword ptr ss:[ebp-64],eax
005161CD .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
005161D3 .  51          push ecx
005161D4 .  8D95 E0FEFFFF lea edx,dword ptr ss:[ebp-120]
005161DA .  52          push edx
005161DB .  6A 02       push 2
005161DD .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
005161E3 .  83C4 0C    add esp,0C
005161E6 .  C745 FC 37000>mov dword ptr ss:[ebp-4],37
005161ED .  B8 29000000 mov eax,29
005161F2 .  83E8 01    sub eax,1
005161F5 .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
005161FB .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516202 .  73 0C       jnb short 00516210
00516204 .  C785 58FAFFFF>mov dword ptr ss:[ebp-5A8],0
0051620E .  EB 0C       jmp short 0051621C
00516210 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516216 .  8985 58FAFFFF mov dword ptr ss:[ebp-5A8],eax
0051621C >  8B85 54FFFFFF mov eax,dword ptr ss:[ebp-AC]
00516222 .  99          cdq
00516223 .  81E2 FF000000 and edx,0FF
00516229 .  03C2       add eax,edx
0051622B .  8BC8       mov ecx,eax
0051622D .  C1F9 08    sar ecx,8
00516230 .  FF15 74114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I4>]    ;  MSVBVM60.__vbaUI1I4
00516236 .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
0051623C .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00516242 .  C745 FC 38000>mov dword ptr ss:[ebp-4],38
00516249 .  BA 2A000000 mov edx,2A
0051624E .  83EA 01    sub edx,1
00516251 .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
00516257 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
0051625E .  73 0C       jnb short 0051626C
00516260 .  C785 54FAFFFF>mov dword ptr ss:[ebp-5AC],0
0051626A .  EB 0C       jmp short 00516278
0051626C >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516272 .  8985 54FAFFFF mov dword ptr ss:[ebp-5AC],eax
00516278 >  8B8D 54FFFFFF mov ecx,dword ptr ss:[ebp-AC]
0051627E .  81E1 FF000080 and ecx,800000FF
00516284 .  79 08       jns short 0051628E
00516286 .  49          dec ecx
00516287 .  81C9 00FFFFFF or ecx,FFFFFF00
0051628D .  41          inc ecx
0051628E >  FF15 74114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I4>]    ;  MSVBVM60.__vbaUI1I4
00516294 .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
0051629A .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
005162A0 .  C745 FC 39000>mov dword ptr ss:[ebp-4],39
005162A7 .  BA 2B000000 mov edx,2B
005162AC .  83EA 01    sub edx,1
005162AF .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
005162B5 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
005162BC .  73 0C       jnb short 005162CA
005162BE .  C785 50FAFFFF>mov dword ptr ss:[ebp-5B0],0
005162C8 .  EB 0C       jmp short 005162D6
005162CA >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005162D0 .  8985 50FAFFFF mov dword ptr ss:[ebp-5B0],eax
005162D6 >  8B45 9C    mov eax,dword ptr ss:[ebp-64]
005162D9 .  99          cdq
005162DA .  81E2 FF000000 and edx,0FF
005162E0 .  03C2       add eax,edx
005162E2 .  8BC8       mov ecx,eax
005162E4 .  C1F9 08    sar ecx,8
005162E7 .  FF15 74114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I4>]    ;  MSVBVM60.__vbaUI1I4
005162ED .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
005162F3 .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
005162F9 .  C745 FC 3A000>mov dword ptr ss:[ebp-4],3A
00516300 .  BA 2C000000 mov edx,2C
00516305 .  83EA 01    sub edx,1
00516308 .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
0051630E .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516315 .  73 0C       jnb short 00516323
00516317 .  C785 4CFAFFFF>mov dword ptr ss:[ebp-5B4],0
00516321 .  EB 0C       jmp short 0051632F
00516323 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516329 .  8985 4CFAFFFF mov dword ptr ss:[ebp-5B4],eax
0051632F >  8B4D 9C    mov ecx,dword ptr ss:[ebp-64]
00516332 .  81E1 FF000080 and ecx,800000FF
00516338 .  79 08       jns short 00516342
0051633A .  49          dec ecx
0051633B .  81C9 00FFFFFF or ecx,FFFFFF00
00516341 .  41          inc ecx
00516342 >  FF15 74114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I4>]    ;  MSVBVM60.__vbaUI1I4
00516348 .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
0051634E .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00516354 .  C745 FC 3B000>mov dword ptr ss:[ebp-4],3B
0051635B .  BA 2D000000 mov edx,2D
00516360 .  83EA 01    sub edx,1
00516363 .  8995 30FCFFFF mov dword ptr ss:[ebp-3D0],edx
00516369 .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
00516370 .  73 0C       jnb short 0051637E
00516372 .  C785 48FAFFFF>mov dword ptr ss:[ebp-5B8],0
0051637C .  EB 0C       jmp short 0051638A
0051637E >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516384 .  8985 48FAFFFF mov dword ptr ss:[ebp-5B8],eax
0051638A >  B8 2D000000 mov eax,2D
0051638F .  83E8 01    sub eax,1
00516392 .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00516398 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
0051639F .  73 0C       jnb short 005163AD
005163A1 .  C785 44FAFFFF>mov dword ptr ss:[ebp-5BC],0
005163AB .  EB 0C       jmp short 005163B9
005163AD >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005163B3 .  8985 44FAFFFF mov dword ptr ss:[ebp-5BC],eax
005163B9 >  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
005163BF .  8B95 30FCFFFF mov edx,dword ptr ss:[ebp-3D0]
005163C5 .  8A82 C8E15300 mov al,byte ptr ds:[edx+53E1C8]
005163CB .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
005163D1 .  C745 FC 3C000>mov dword ptr ss:[ebp-4],3C
005163D8 .  B9 2E000000 mov ecx,2E
005163DD .  83E9 01    sub ecx,1
005163E0 .  898D 30FCFFFF mov dword ptr ss:[ebp-3D0],ecx
005163E6 .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
005163ED .  73 0C       jnb short 005163FB
005163EF .  C785 40FAFFFF>mov dword ptr ss:[ebp-5C0],0
005163F9 .  EB 0C       jmp short 00516407
005163FB >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516401 .  8985 40FAFFFF mov dword ptr ss:[ebp-5C0],eax
00516407 >  BA 2E000000 mov edx,2E
0051640C .  83EA 01    sub edx,1
0051640F .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
00516415 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
0051641C .  73 0C       jnb short 0051642A
0051641E .  C785 3CFAFFFF>mov dword ptr ss:[ebp-5C4],0
00516428 .  EB 0C       jmp short 00516436
0051642A >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516430 .  8985 3CFAFFFF mov dword ptr ss:[ebp-5C4],eax
00516436 >  8B85 34FCFFFF mov eax,dword ptr ss:[ebp-3CC]
0051643C .  8B8D 30FCFFFF mov ecx,dword ptr ss:[ebp-3D0]
00516442 .  8A91 C8E15300 mov dl,byte ptr ds:[ecx+53E1C8]
00516448 .  8890 64E15300 mov byte ptr ds:[eax+53E164],dl
0051644E .  C745 FC 3D000>mov dword ptr ss:[ebp-4],3D
00516455 .  B8 2F000000 mov eax,2F
0051645A .  83E8 01    sub eax,1
0051645D .  8985 30FCFFFF mov dword ptr ss:[ebp-3D0],eax
00516463 .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
0051646A .  73 0C       jnb short 00516478
0051646C .  C785 38FAFFFF>mov dword ptr ss:[ebp-5C8],0
00516476 .  EB 0C       jmp short 00516484
00516478 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051647E .  8985 38FAFFFF mov dword ptr ss:[ebp-5C8],eax
00516484 >  B9 2F000000 mov ecx,2F
00516489 .  83E9 01    sub ecx,1
0051648C .  898D 34FCFFFF mov dword ptr ss:[ebp-3CC],ecx
00516492 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516499 .  73 0C       jnb short 005164A7
0051649B .  C785 34FAFFFF>mov dword ptr ss:[ebp-5CC],0
005164A5 .  EB 0C       jmp short 005164B3
005164A7 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005164AD .  8985 34FAFFFF mov dword ptr ss:[ebp-5CC],eax
005164B3 >  8B95 34FCFFFF mov edx,dword ptr ss:[ebp-3CC]
005164B9 .  8B85 30FCFFFF mov eax,dword ptr ss:[ebp-3D0]
005164BF .  8A88 C8E15300 mov cl,byte ptr ds:[eax+53E1C8]
005164C5 .  888A 64E15300 mov byte ptr ds:[edx+53E164],cl
005164CB .  C745 FC 3E000>mov dword ptr ss:[ebp-4],3E
005164D2 .  BA 30000000 mov edx,30
005164D7 .  83EA 01    sub edx,1
005164DA .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
005164E0 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
005164E7 .  73 0C       jnb short 005164F5
005164E9 .  C785 30FAFFFF>mov dword ptr ss:[ebp-5D0],0
005164F3 .  EB 0C       jmp short 00516501
005164F5 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005164FB .  8985 30FAFFFF mov dword ptr ss:[ebp-5D0],eax
00516501 >  B9 01000000 mov ecx,1
00516506 .  FF15 5C114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I2>]    ;  MSVBVM60.__vbaUI1I2
0051650C .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00516512 .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00516518 .  C745 FC 3F000>mov dword ptr ss:[ebp-4],3F
0051651F .  BA 31000000 mov edx,31
00516524 .  83EA 01    sub edx,1
00516527 .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
0051652D .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516534 .  73 0C       jnb short 00516542
00516536 .  C785 2CFAFFFF>mov dword ptr ss:[ebp-5D4],0
00516540 .  EB 0C       jmp short 0051654E
00516542 >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516548 .  8985 2CFAFFFF mov dword ptr ss:[ebp-5D4],eax
0051654E >  B9 01000000 mov ecx,1
00516553 .  FF15 5C114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I2>]    ;  MSVBVM60.__vbaUI1I2
00516559 .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
0051655F .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00516565 .  C745 FC 40000>mov dword ptr ss:[ebp-4],40
0051656C .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],64
00516576 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00516580 .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],64
0051658A .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00516594 .  8D95 68FFFFFF lea edx,dword ptr ss:[ebp-98]
0051659A .  52          push edx
0051659B .  FF15 B8114000 call dword ptr ds:[<&MSVBVM60.__vbaI2Var>]    ;  MSVBVM60.__vbaI2Var
005165A1 .  50          push eax
005165A2 .  8D45 A0    lea eax,dword ptr ss:[ebp-60]
005165A5 .  50          push eax                                        ; /Arg3
005165A6 .  8D8D 50FDFFFF lea ecx,dword ptr ss:[ebp-2B0]                ; |
005165AC .  51          push ecx                                        ; |Arg2
005165AD .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]                ; |
005165B3 .  52          push edx                                        ; |Arg1
005165B4 .  FF15 70114000 call dword ptr ds:[<&MSVBVM60.__vbaVarMul>]    ; \__vbaVarMul
005165BA .  50          push eax                                        ; /Arg3
005165BB .  8D85 40FDFFFF lea eax,dword ptr ss:[ebp-2C0]                ; |
005165C1 .  50          push eax                                        ; |Arg2
005165C2 .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]                ; |
005165C8 .  51          push ecx                                        ; |Arg1
005165C9 .  FF15 2C124000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]    ; \__vbaVarAdd
005165CF .  50          push eax
005165D0 .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]    ;  MSVBVM60.__vbaI4Var
005165D6 .  50          push eax                                        ; |Arg3
005165D7 .  68 64E15300 push 0053E164                                  ; |Arg2 = 0053E164
005165DC .  6A 64       push 64                                        ; |Arg1 = 00000064
005165DE .  FF15 44104000 call dword ptr ds:[<&MSVBVM60.__vbaPut4>]       ; \__vbaPut4
005165E4 .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]
005165EA .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
005165F0 >  C745 FC 42000>mov dword ptr ss:[ebp-4],42
005165F7 .  FF15 A0104000 call dword ptr ds:[<&MSVBVM60.__vbaFileCloseAll>>;  MSVBVM60.__vbaFileCloseAll
005165FD .  C745 FC 43000>mov dword ptr ss:[ebp-4],43
00516604 .  8B55 08    mov edx,dword ptr ss:[ebp+8]
00516607 .  8B02       mov eax,dword ptr ds:[edx]
00516609 .  8B4D 08    mov ecx,dword ptr ss:[ebp+8]
0051660C .  51          push ecx
0051660D .  FF90 F8060000 call dword ptr ds:[eax+6F8]
00516613 .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00516619 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],0
00516620 .  7D 23       jge short 00516645
00516622 .  68 F8060000 push 6F8                                        ; /Arg4 = 000006F8
00516627 .  68 A8CA4000 push 0040CAA8                                  ; |Arg3 = 0040CAA8
0051662C .  8B55 08    mov edx,dword ptr ss:[ebp+8]                   ; |
0051662F .  52          push edx                                        ; |Arg2
00516630 .  8B85 34FCFFFF mov eax,dword ptr ss:[ebp-3CC]                ; |
00516636 .  50          push eax                                        ; |Arg1
00516637 .  FF15 74104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>; \__vbaHresultCheckObj
0051663D .  8985 28FAFFFF mov dword ptr ss:[ebp-5D8],eax
00516643 .  EB 0A       jmp short 0051664F
00516645 >  C785 28FAFFFF>mov dword ptr ss:[ebp-5D8],0
0051664F >  C745 FC 44000>mov dword ptr ss:[ebp-4],44
00516656 .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],5A
00516660 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],8002
0051666A .  8D4D B0    lea ecx,dword ptr ss:[ebp-50]
0051666D .  51          push ecx
0051666E .  8D95 50FDFFFF lea edx,dword ptr ss:[ebp-2B0]
00516674 .  52          push edx
00516675 .  FF15 00104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstGt>] ;  MSVBVM60.__vbaVarTstGt
0051667B .  0FBFC0       movsx eax,ax
0051667E .  85C0       test eax,eax
00516680 .  0F84 1B030000 je 005169A1
00516686 .  C745 FC 45000>mov dword ptr ss:[ebp-4],45
0051668D .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00516693 .  51          push ecx                                        ; /Arg1
00516694 .  FF15 7C124000 call dword ptr ds:[<&MSVBVM60.#546>]          ; \rtcGetPresentDate
0051669A .  6A 01       push 1                                        ; /Arg4 = 00000001
0051669C .  6A 03       push 3                                        ; |Arg3 = 00000003
0051669E .  68 E0070000 push 7E0                                        ; |Arg2 = 000007E0
005166A3 .  8D95 E0FEFFFF lea edx,dword ptr ss:[ebp-120]                ; |
005166A9 .  52          push edx                                        ; |Arg1
005166AA .  FF15 BC114000 call dword ptr ds:[<&MSVBVM60.#538>]          ; \rtcPackDate
005166B0 .  8D85 C0FEFFFF lea eax,dword ptr ss:[ebp-140]
005166B6 .  50          push eax                                        ; /Arg1
005166B7 .  FF15 7C124000 call dword ptr ds:[<&MSVBVM60.#546>]          ; \rtcGetPresentDate
005166BD .  68 B5000000 push 0B5                                        ; /Arg4 = 000000B5
005166C2 .  68 B7000000 push 0B7                                        ; |Arg3 = 000000B7
005166C7 .  68 94080000 push 894                                        ; |Arg2 = 00000894
005166CC .  8D8D B0FEFFFF lea ecx,dword ptr ss:[ebp-150]                ; |
005166D2 .  51          push ecx                                        ; |Arg1
005166D3 .  FF15 BC114000 call dword ptr ds:[<&MSVBVM60.#538>]          ; \rtcPackDate
005166D9 .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]
005166DF .  52          push edx                                        ; /Arg3
005166E0 .  8D85 E0FEFFFF lea eax,dword ptr ss:[ebp-120]                ; |
005166E6 .  50          push eax                                        ; |Arg2
005166E7 .  8D8D D0FEFFFF lea ecx,dword ptr ss:[ebp-130]                ; |
005166ED .  51          push ecx                                        ; |Arg1
005166EE .  FF15 F8114000 call dword ptr ds:[<&MSVBVM60.__vbaVarCmpLt>] ; \__vbaVarCmpLt
005166F4 .  50          push eax                                        ; /Arg3
005166F5 .  8D95 C0FEFFFF lea edx,dword ptr ss:[ebp-140]                ; |
005166FB .  52          push edx                                        ; |/Arg3
005166FC .  8D85 B0FEFFFF lea eax,dword ptr ss:[ebp-150]                ; ||
00516702 .  50          push eax                                        ; ||Arg2
00516703 .  8D8D A0FEFFFF lea ecx,dword ptr ss:[ebp-160]                ; ||
00516709 .  51          push ecx                                        ; ||Arg1
0051670A .  FF15 EC104000 call dword ptr ds:[<&MSVBVM60.__vbaVarCmpGt>] ; |\__vbaVarCmpGt
00516710 .  50          push eax                                        ; |Arg2
00516711 .  8D95 90FEFFFF lea edx,dword ptr ss:[ebp-170]                ; |
00516717 .  52          push edx                                        ; |Arg1
00516718 .  FF15 34114000 call dword ptr ds:[<&MSVBVM60.__vbaVarOr>]    ; \__vbaVarOr
0051671E .  50          push eax                                        ; /Arg1
0051671F .  FF15 DC104000 call dword ptr ds:[<&MSVBVM60.__vbaBoolVarNull>] ; \__vbaBoolVarNull
00516725 .  66:8985 34FCF>mov word ptr ss:[ebp-3CC],ax
0051672C .  8D85 B0FEFFFF lea eax,dword ptr ss:[ebp-150]
00516732 .  50          push eax
00516733 .  8D8D C0FEFFFF lea ecx,dword ptr ss:[ebp-140]
00516739 .  51          push ecx
0051673A .  8D95 E0FEFFFF lea edx,dword ptr ss:[ebp-120]
00516740 .  52          push edx
00516741 .  8D85 F0FEFFFF lea eax,dword ptr ss:[ebp-110]
00516747 .  50          push eax
00516748 .  6A 04       push 4
0051674A .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
00516750 .  83C4 14    add esp,14
00516753 .  0FBF8D 34FCFF>movsx ecx,word ptr ss:[ebp-3CC]
0051675A .  85C9       test ecx,ecx
0051675C .  74 05       je short 00516763
0051675E .  E9 4D020000 jmp 005169B0
00516763 >  C745 FC 48000>mov dword ptr ss:[ebp-4],48
0051676A .  6A 09       push 9                                        ; /Arg1 = 00000009
0051676C .  FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaStrI2>]    ; \__vbaStrI2
00516772 .  8BD0       mov edx,eax
00516774 .  8D8D 0CFFFFFF lea ecx,dword ptr ss:[ebp-F4]
0051677A .  FF15 58124000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]    ;  MSVBVM60.__vbaStrMove
00516780 .  50          push eax
00516781 .  8B55 08    mov edx,dword ptr ss:[ebp+8]
00516784 .  8B02       mov eax,dword ptr ds:[edx]
00516786 .  8B4D 08    mov ecx,dword ptr ss:[ebp+8]
00516789 .  51          push ecx
0051678A .  FF90 C4010000 call dword ptr ds:[eax+1C4]
00516790 .  DBE2       fclex
00516792 .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00516798 .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],0
0051679F .  7D 23       jge short 005167C4
005167A1 .  68 C4010000 push 1C4                                        ; /Arg4 = 000001C4
005167A6 .  68 78CA4000 push 0040CA78                                  ; |Arg3 = 0040CA78
005167AB .  8B55 08    mov edx,dword ptr ss:[ebp+8]                   ; |
005167AE .  52          push edx                                        ; |Arg2
005167AF .  8B85 34FCFFFF mov eax,dword ptr ss:[ebp-3CC]                ; |
005167B5 .  50          push eax                                        ; |Arg1
005167B6 .  FF15 74104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>; \__vbaHresultCheckObj
005167BC .  8985 24FAFFFF mov dword ptr ss:[ebp-5DC],eax
005167C2 .  EB 0A       jmp short 005167CE
005167C4 >  C785 24FAFFFF>mov dword ptr ss:[ebp-5DC],0
005167CE >  8D8D 0CFFFFFF lea ecx,dword ptr ss:[ebp-F4]
005167D4 .  FF15 9C124000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]    ;  MSVBVM60.__vbaFreeStr
005167DA .  C745 FC 49000>mov dword ptr ss:[ebp-4],49
005167E1 .  68 804FC347 push 47C34F80
005167E6 .  8B4D 08    mov ecx,dword ptr ss:[ebp+8]
005167E9 .  8B11       mov edx,dword ptr ds:[ecx]
005167EB .  8B45 08    mov eax,dword ptr ss:[ebp+8]
005167EE .  50          push eax
005167EF .  FF52 7C    call dword ptr ds:[edx+7C]
005167F2 .  DBE2       fclex
005167F4 .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
005167FA .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],0
00516801 .  7D 20       jge short 00516823
00516803 .  6A 7C       push 7C                                        ; /Arg4 = 0000007C
00516805 .  68 78CA4000 push 0040CA78                                  ; |Arg3 = 0040CA78
0051680A .  8B4D 08    mov ecx,dword ptr ss:[ebp+8]                   ; |
0051680D .  51          push ecx                                        ; |Arg2
0051680E .  8B95 34FCFFFF mov edx,dword ptr ss:[ebp-3CC]                ; |
00516814 .  52          push edx                                        ; |Arg1
00516815 .  FF15 74104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>; \__vbaHresultCheckObj
0051681B .  8985 20FAFFFF mov dword ptr ss:[ebp-5E0],eax
00516821 .  EB 0A       jmp short 0051682D
00516823 >  C785 20FAFFFF>mov dword ptr ss:[ebp-5E0],0
0051682D >  C745 FC 4A000>mov dword ptr ss:[ebp-4],4A
00516834 .  8B45 08    mov eax,dword ptr ss:[ebp+8]
00516837 .  8B08       mov ecx,dword ptr ds:[eax]
00516839 .  8B55 08    mov edx,dword ptr ss:[ebp+8]
0051683C .  52          push edx
0051683D .  FF91 B4020000 call dword ptr ds:[ecx+2B4]
00516843 .  DBE2       fclex
00516845 .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
0051684B .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],0
00516852 .  7D 23       jge short 00516877
00516854 .  68 B4020000 push 2B4                                        ; /Arg4 = 000002B4
00516859 .  68 78CA4000 push 0040CA78                                  ; |Arg3 = 0040CA78
0051685E .  8B45 08    mov eax,dword ptr ss:[ebp+8]                   ; |
00516861 .  50          push eax                                        ; |Arg2
00516862 .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]                ; |
00516868 .  51          push ecx                                        ; |Arg1
00516869 .  FF15 74104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>; \__vbaHresultCheckObj
0051686F .  8985 1CFAFFFF mov dword ptr ss:[ebp-5E4],eax
00516875 .  EB 0A       jmp short 00516881
00516877 >  C785 1CFAFFFF>mov dword ptr ss:[ebp-5E4],0
00516881 >  C745 FC 4B000>mov dword ptr ss:[ebp-4],4B
00516888 .  833D 10E05300>cmp dword ptr ds:[53E010],0
0051688F .  75 1C       jnz short 005168AD
00516891 .  68 10E05300 push 0053E010                                  ; /Arg2 = 0053E010
00516896 .  68 94B94000 push 0040B994                                  ; |Arg1 = 0040B994
0051689B .  FF15 D4114000 call dword ptr ds:[<&MSVBVM60.__vbaNew2>]       ; \__vbaNew2
005168A1 .  C785 18FAFFFF>mov dword ptr ss:[ebp-5E8],0053E010
005168AB .  EB 0A       jmp short 005168B7
005168AD >  C785 18FAFFFF>mov dword ptr ss:[ebp-5E8],0053E010
005168B7 >  8B95 18FAFFFF mov edx,dword ptr ss:[ebp-5E8]
005168BD .  8B02       mov eax,dword ptr ds:[edx]
005168BF .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
005168C5 .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],80020004
005168CF .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],0A
005168D9 .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],80020004
005168E3 .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],0A
005168ED .  B8 10000000 mov eax,10
005168F2 .  E8 A908EFFF call <jmp.&MSVBVM60.__vbaChkstk>
005168F7 .  8BCC       mov ecx,esp
005168F9 .  8B95 40FDFFFF mov edx,dword ptr ss:[ebp-2C0]
005168FF .  8911       mov dword ptr ds:[ecx],edx
00516901 .  8B85 44FDFFFF mov eax,dword ptr ss:[ebp-2BC]
00516907 .  8941 04    mov dword ptr ds:[ecx+4],eax
0051690A .  8B95 48FDFFFF mov edx,dword ptr ss:[ebp-2B8]
00516910 .  8951 08    mov dword ptr ds:[ecx+8],edx
00516913 .  8B85 4CFDFFFF mov eax,dword ptr ss:[ebp-2B4]
00516919 .  8941 0C    mov dword ptr ds:[ecx+C],eax
0051691C .  B8 10000000 mov eax,10
00516921 .  E8 7A08EFFF call <jmp.&MSVBVM60.__vbaChkstk>
00516926 .  8BCC       mov ecx,esp
00516928 .  8B95 50FDFFFF mov edx,dword ptr ss:[ebp-2B0]
0051692E .  8911       mov dword ptr ds:[ecx],edx
00516930 .  8B85 54FDFFFF mov eax,dword ptr ss:[ebp-2AC]
00516936 .  8941 04    mov dword ptr ds:[ecx+4],eax
00516939 .  8B95 58FDFFFF mov edx,dword ptr ss:[ebp-2A8]
0051693F .  8951 08    mov dword ptr ds:[ecx+8],edx
00516942 .  8B85 5CFDFFFF mov eax,dword ptr ss:[ebp-2A4]
00516948 .  8941 0C    mov dword ptr ds:[ecx+C],eax
0051694B .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00516951 .  8B11       mov edx,dword ptr ds:[ecx]
00516953 .  8B85 34FCFFFF mov eax,dword ptr ss:[ebp-3CC]
00516959 .  50          push eax
0051695A .  FF92 B0020000 call dword ptr ds:[edx+2B0]
00516960 .  DBE2       fclex
00516962 .  8985 30FCFFFF mov dword ptr ss:[ebp-3D0],eax
00516968 .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],0
0051696F .  7D 26       jge short 00516997
00516971 .  68 B0020000 push 2B0                                        ; /Arg4 = 000002B0
00516976 .  68 88C74000 push 0040C788                                  ; |Arg3 = 0040C788
0051697B .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]                ; |
00516981 .  51          push ecx                                        ; |Arg2
00516982 .  8B95 30FCFFFF mov edx,dword ptr ss:[ebp-3D0]                ; |
00516988 .  52          push edx                                        ; |Arg1
00516989 .  FF15 74104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>; \__vbaHresultCheckObj
0051698F .  8985 14FAFFFF mov dword ptr ss:[ebp-5EC],eax
00516995 .  EB 0A       jmp short 005169A1
00516997 >  C785 14FAFFFF>mov dword ptr ss:[ebp-5EC],0
005169A1 >  EB 0D       jmp short 005169B0
005169A3 >  C745 FC 4E000>mov dword ptr ss:[ebp-4],4E
005169AA .  FF15 A0104000 call dword ptr ds:[<&MSVBVM60.__vbaFileCloseAll>>;  MSVBVM60.__vbaFileCloseAll
005169B0 >  C745 F0 00000>mov dword ptr ss:[ebp-10],0
005169B7 .  9B          wait
005169B8 .  68 7C6B5100 push 00516B7C
005169BD .  E9 EE000000 jmp 00516AB0
005169C2 .  8D85 04FFFFFF lea eax,dword ptr ss:[ebp-FC]
005169C8 .  50          push eax
005169C9 .  8D8D 08FFFFFF lea ecx,dword ptr ss:[ebp-F8]
005169CF .  51          push ecx
005169D0 .  8D95 0CFFFFFF lea edx,dword ptr ss:[ebp-F4]
005169D6 .  52          push edx
005169D7 .  6A 03       push 3
005169D9 .  FF15 F4114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>] ;  MSVBVM60.__vbaFreeStrList
005169DF .  83C4 10    add esp,10
005169E2 .  8D8D 00FFFFFF lea ecx,dword ptr ss:[ebp-100]
005169E8 .  FF15 98124000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>]    ;  MSVBVM60.__vbaFreeObj
005169EE .  8D85 60FDFFFF lea eax,dword ptr ss:[ebp-2A0]
005169F4 .  50          push eax
005169F5 .  8D8D 70FDFFFF lea ecx,dword ptr ss:[ebp-290]
005169FB .  51          push ecx
005169FC .  8D95 80FDFFFF lea edx,dword ptr ss:[ebp-280]
00516A02 .  52          push edx
00516A03 .  8D85 90FDFFFF lea eax,dword ptr ss:[ebp-270]
00516A09 .  50          push eax
00516A0A .  8D8D A0FDFFFF lea ecx,dword ptr ss:[ebp-260]
00516A10 .  51          push ecx
00516A11 .  8D95 B0FDFFFF lea edx,dword ptr ss:[ebp-250]
00516A17 .  52          push edx
00516A18 .  8D85 C0FDFFFF lea eax,dword ptr ss:[ebp-240]
00516A1E .  50          push eax
00516A1F .  8D8D D0FDFFFF lea ecx,dword ptr ss:[ebp-230]
00516A25 .  51          push ecx
00516A26 .  8D95 E0FDFFFF lea edx,dword ptr ss:[ebp-220]
00516A2C .  52          push edx
00516A2D .  8D85 F0FDFFFF lea eax,dword ptr ss:[ebp-210]
00516A33 .  50          push eax
00516A34 .  8D8D 00FEFFFF lea ecx,dword ptr ss:[ebp-200]
00516A3A .  51          push ecx
00516A3B .  8D95 10FEFFFF lea edx,dword ptr ss:[ebp-1F0]
00516A41 .  52          push edx
00516A42 .  8D85 20FEFFFF lea eax,dword ptr ss:[ebp-1E0]
00516A48 .  50          push eax
00516A49 .  8D8D 30FEFFFF lea ecx,dword ptr ss:[ebp-1D0]
00516A4F .  51          push ecx
00516A50 .  8D95 40FEFFFF lea edx,dword ptr ss:[ebp-1C0]
00516A56 .  52          push edx
00516A57 .  8D85 50FEFFFF lea eax,dword ptr ss:[ebp-1B0]
00516A5D .  50          push eax
00516A5E .  8D8D 60FEFFFF lea ecx,dword ptr ss:[ebp-1A0]
00516A64 .  51          push ecx
00516A65 .  8D95 70FEFFFF lea edx,dword ptr ss:[ebp-190]
00516A6B .  52          push edx
00516A6C .  8D85 80FEFFFF lea eax,dword ptr ss:[ebp-180]
00516A72 .  50          push eax
00516A73 .  8D8D 90FEFFFF lea ecx,dword ptr ss:[ebp-170]
00516A79 .  51          push ecx
00516A7A .  8D95 A0FEFFFF lea edx,dword ptr ss:[ebp-160]
00516A80 .  52          push edx
00516A81 .  8D85 B0FEFFFF lea eax,dword ptr ss:[ebp-150]
00516A87 .  50          push eax
00516A88 .  8D8D C0FEFFFF lea ecx,dword ptr ss:[ebp-140]
00516A8E .  51          push ecx
00516A8F .  8D95 D0FEFFFF lea edx,dword ptr ss:[ebp-130]
00516A95 .  52          push edx
00516A96 .  8D85 E0FEFFFF lea eax,dword ptr ss:[ebp-120]
00516A9C .  50          push eax
00516A9D .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00516AA3 .  51          push ecx
00516AA4 .  6A 1A       push 1A
00516AA6 .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
00516AAC .  83C4 6C    add esp,6C
00516AAF .  C3          retn
00516AB0 >  8D95 9CFBFFFF lea edx,dword ptr ss:[ebp-464]
00516AB6 .  52          push edx
00516AB7 .  8D85 ACFBFFFF lea eax,dword ptr ss:[ebp-454]
00516ABD .  50          push eax
00516ABE .  8D8D BCFBFFFF lea ecx,dword ptr ss:[ebp-444]
00516AC4 .  51          push ecx
00516AC5 .  8D95 CCFBFFFF lea edx,dword ptr ss:[ebp-434]
00516ACB .  52          push edx
00516ACC .  8D85 DCFBFFFF lea eax,dword ptr ss:[ebp-424]
00516AD2 .  50          push eax
00516AD3 .  8D8D ECFBFFFF lea ecx,dword ptr ss:[ebp-414]
00516AD9 .  51          push ecx
00516ADA .  6A 06       push 6
00516ADC .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
00516AE2 .  83C4 1C    add esp,1C
00516AE5 .  8D4D D0    lea ecx,dword ptr ss:[ebp-30]
00516AE8 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516AEE .  8D4D C0    lea ecx,dword ptr ss:[ebp-40]
00516AF1 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516AF7 .  8D4D B0    lea ecx,dword ptr ss:[ebp-50]
00516AFA .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516B00 .  8D4D A0    lea ecx,dword ptr ss:[ebp-60]
00516B03 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516B09 .  8D4D 98    lea ecx,dword ptr ss:[ebp-68]
00516B0C .  FF15 9C124000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]    ;  MSVBVM60.__vbaFreeStr
00516B12 .  8D4D 88    lea ecx,dword ptr ss:[ebp-78]
00516B15 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516B1B .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-88]
00516B21 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516B27 .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
00516B2D .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516B33 .  8D8D 58FFFFFF lea ecx,dword ptr ss:[ebp-A8]
00516B39 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516B3F .  8D8D 44FFFFFF lea ecx,dword ptr ss:[ebp-BC]
00516B45 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516B4B .  8D8D 40FFFFFF lea ecx,dword ptr ss:[ebp-C0]
00516B51 .  FF15 9C124000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]    ;  MSVBVM60.__vbaFreeStr
00516B57 .  8D8D 30FFFFFF lea ecx,dword ptr ss:[ebp-D0]
00516B5D .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516B63 .  8D8D 20FFFFFF lea ecx,dword ptr ss:[ebp-E0]
00516B69 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516B6F .  8D8D 10FFFFFF lea ecx,dword ptr ss:[ebp-F0]
00516B75 .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]    ;  MSVBVM60.__vbaFreeVar
00516B7B .  C3          retn
00516B7C .  8B55 08    mov edx,dword ptr ss:[ebp+8]
00516B7F .  8B02       mov eax,dword ptr ds:[edx]
00516B81 .  8B4D 08    mov ecx,dword ptr ss:[ebp+8]
00516B84 .  51          push ecx
00516B85 .  FF50 08    call dword ptr ds:[eax+8]
00516B88 .  8B45 F0    mov eax,dword ptr ss:[ebp-10]
00516B8B .  8B4D E0    mov ecx,dword ptr ss:[ebp-20]
00516B8E .  64:890D 00000>mov dword ptr fs:[0],ecx
00516B95 .  5F          pop edi
00516B96 .  5E          pop esi
00516B97 .  5B          pop ebx
00516B98 .  8BE5       mov esp,ebp
00516B9A .  5D          pop ebp
［/mw_shl_code］

ジ秋水 · 发表于 2018-6-11 11:47

再测试一下

00401000   $  C701 C049C400 MOV DWORD PTR DS:[ECX],ElementC.00C449C0
00401006   .  E9 55367B00   JMP ElementC.00BB4660
0040100B      90            NOP
0040100C      90            NOP
0040100D      90            NOP
0040100E      90            NOP
0040100F      90            NOP
00401010   .  56            PUSH ESI
00401011   .  8BF1          MOV ESI,ECX
00401013   .  E8 E8FFFFFF   CALL ElementC.00401000
00401018   .  F64424 08 01  TEST BYTE PTR SS:[ESP+8],1
0040101D   .  74 09         JE SHORT ElementC.00401028
0040101F   .  56            PUSH ESI
00401020   .  E8 0B9C6200   CALL ElementC.00A2AC30
00401025   .  83C4 04       ADD ESP,4
00401028   >  8BC6          MOV EAX,ESI
0040102A   .  5E            POP ESI
0040102B   .  C2 0400       RETN 4
0040102E      90            NOP
0040102F      90            NOP
00401030   .  8B4424 10     MOV EAX,DWORD PTR SS:[ESP+10]
00401034   .  8B4C24 08     MOV ECX,DWORD PTR SS:[ESP+8]
00401038   .  8B5424 1C     MOV EDX,DWORD PTR SS:[ESP+1C]
0040103C   .  8908          MOV DWORD PTR DS:[EAX],ECX
0040103E   .  8B4424 14     MOV EAX,DWORD PTR SS:[ESP+14]
00401042   .  8902          MOV DWORD PTR DS:[EDX],EAX
00401044   .  B8 03000000   MOV EAX,3
00401049   .  C2 1C00       RETN 1C
0040104C      90            NOP
0040104D      90            NOP
0040104E      90            NOP
0040104F      90            NOP

xuhw · 发表于 2018-6-12 16:21

本帖最后由 xuhw 于 2018-6-12 16:41 编辑

005159ED .  FF15 84104000 call dword ptr ds:[<&MSVBVM60.__vbaVarCmpGe>] ; \__vbaVarCmpGe  ---不知验证什么----3
例如
7xxx0xx7xx6x0xxx6
经调示得知取第8 位，第5,11位相反与常数10706比较
也就说第8位要等于7，第5位6，第11位=0
但是第8位为7，会变成 7+5A(常数)X100+第5，11位  ，7+90(5A)x100=9700  //=> //=>与10706(常数)比较不相等
00515A06 .  FF15 9C114000 call dword ptr ds:[<&MSVBVM60.__vbaVarCmpLe>] ; |\__vbaVarCmpLe ---不知验证什么----4

例如
7xxx0xx7xx6x0xxx6
取第1 位，第13,17位常数10706比较
也就说第1位=7，13位要等于0，第17位=6，
但是第1位为7，会变成 7+5A(常数)X100 +13，17位，  7+90(5A)x100=9700  //=>与10706(常数)比较不相等

这两处验证一直无法搞定，高手们进来分析看看，指导迷津

笑口 · 发表于 2018-6-11 08:05

之时高深，学习了

kvcyril · 发表于 2018-6-11 08:39

有点深，看不太懂，但是这种是不是就连闪都不闪直接运行的

lsb1304 · 发表于 2018-6-11 09:16

学习学，学习学习

xiaoxue58178 · 发表于 2018-6-11 09:30

楼主还没说是款什么软件呢？

gunxsword · 发表于 2018-6-11 09:31

代码好长....项一下!

aerofsm · 发表于 2018-6-11 09:52

这种是不是就连闪都不闪直接运行的

冰布 · 发表于 2018-6-11 09:55

学习了大佬

老张有大梦想 · 发表于 2018-6-11 10:53

之时高深，学习了

gfjykldd · 发表于 2018-6-11 11:25

此文着很辛苦。。希望楼主可以重新编辑一下。

帐号		自动登录	找回密码
密码			注册[Register]

[分享] 无任何提示的软件~算法分析

免费评分