http://securegamers.com/shadowfrench/W3XPassGrabber12201.exe Есь программа пассворд граббер для WarCraft3 (моралисты могу тоже помочь т.к. собсно мне нужно получать только имя а в пасворде нет необходимости) необходимо узнать как она собственно это делает, но появилась проблеммка та вб ( +ко всему там еще и натив код т.е. декомпиль не прокатит, ида зубы ломает об эту чушь, короче все плохо ) вот сама ф/я корая собсно чтото делает ) Первая что мне хотелось бы узнать что значит loc_004053B2: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_004053B7: call edi что значит call edi после каждой api как я понял это проверки вб на то что все ок работает ) значит на всякий случай приведу листинг который надо иследовать http://nopaste.com/p/aaVioGXVE http://code.hash.su/136 http://paste.org.ru/?sb2xik Код (Text): Private Sub t2_Timer() '405260 loc_00405260: push ebp loc_00405261: mov ebp, esp loc_00405263: sub esp, 0000000Ch loc_00405266: push 00401196h ; MSVBVM60.DLL.__vbaExceptHandler loc_0040526B: mov eax, fs:[00h] loc_00405271: push eax loc_00405272: mov fs:[00000000h], esp loc_00405279: sub esp, 00000090h loc_0040527F: push ebx loc_00405280: push esi loc_00405281: push edi loc_00405282: mov var_C, esp loc_00405285: mov var_8, 004010F0h loc_0040528C: mov eax, arg_8 loc_0040528F: mov ecx, eax loc_00405291: and ecx, 00000001h loc_00405294: mov var_4, ecx loc_00405297: and al, FEh loc_00405299: push eax loc_0040529A: mov arg_8, eax loc_0040529D: mov edx, [eax] loc_0040529F: call [edx+04h] loc_004052A2: lea eax, var_48 loc_004052A5: xor ebx, ebx loc_004052A7: push 00403684h ; "Warcraft III" loc_004052AC: push eax loc_004052AD: mov byte ptr var_1C, 00h loc_004052B1: mov var_2C, ebx loc_004052B4: mov var_30, ebx loc_004052B7: mov var_38, ebx loc_004052BA: mov var_3C, ebx loc_004052BD: mov var_48, ebx loc_004052C0: mov var_4C, ebx loc_004052C3: mov var_50, ebx loc_004052C6: mov var_54, ebx loc_004052C9: mov var_64, ebx loc_004052CC: mov var_74, ebx loc_004052CF: mov var_84, ebx loc_004052D5: mov var_88, ebx loc_004052DB: call MSVBVM60.DLL.__vbaStrToAnsi loc_004052E1: push eax loc_004052E2: push ebx loc_004052E3: FindWindow(%x1, %x2) loc_004052E8: mov edi, MSVBVM60.DLL.__vbaSetSystemError loc_004052EE: mov var_88, eax loc_004052F4: call edi loc_004052F6: mov esi, var_88 loc_004052FC: lea ecx, var_48 loc_004052FF: call MSVBVM60.DLL.__vbaFreeStr loc_00405305: cmp esi, ebx loc_00405307: jz 00406500h loc_0040530D: lea ecx, var_38 loc_00405310: push ecx loc_00405311: push esi loc_00405312: GetWindowThreadProcessId(%x1, %x2) loc_00405317: call edi loc_00405319: mov edx, var_38 loc_0040531C: push edx loc_0040531D: push ebx loc_0040531E: push 001F0FFFh loc_00405323: OpenProcess(%x1, %x2, %x3) loc_00405328: mov var_88, eax loc_0040532E: call edi loc_00405330: mov esi, var_88 loc_00405336: cmp esi, ebx loc_00405338: jz 00406500h loc_0040533E: mov ebx, 00100075h loc_00405343: lea eax, var_88 loc_00405349: add ebx, 00010000h loc_0040534F: push eax loc_00405350: lea ecx, var_30 loc_00405353: push 00000004h loc_00405355: push ecx loc_00405356: jo 00406570h loc_0040535C: push ebx loc_0040535D: push esi loc_0040535E: mov var_88, 00000000h loc_00405368: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_0040536D: call edi loc_0040536F: cmp var_30, 68437465h loc_00405376: jz 405380h loc_00405378: cmp ebx, 6FFF0075h loc_0040537E: jnz 405343h loc_00405380: cmp ebx, 6FFF0075h loc_00405386: jnz 4053DBh loc_00405388: mov ebx, 001000A5h loc_0040538D: lea edx, var_88 loc_00405393: add ebx, 00010000h loc_00405399: push edx loc_0040539A: lea eax, var_30 loc_0040539D: push 00000004h loc_0040539F: push eax loc_004053A0: jo 00406570h loc_004053A6: push ebx loc_004053A7: push esi loc_004053A8: mov var_88, 00000000h loc_004053B2: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_004053B7: call edi loc_004053B9: cmp var_30, 68437465h loc_004053C0: jz 4053CAh loc_004053C2: cmp ebx, 6FFF00A5h loc_004053C8: jnz 40538Dh loc_004053CA: cmp ebx, 6FFF00A5h loc_004053D0: jnz 4053DBh loc_004053D2: lea ecx, var_2C loc_004053D5: push ecx loc_004053D6: jmp 004064F0h loc_004053DB: lea edx, var_88 loc_004053E1: add ebx, 000003FFh loc_004053E7: push edx loc_004053E8: lea eax, var_1C loc_004053EB: push 00000001h loc_004053ED: push eax loc_004053EE: jo 00406570h loc_004053F4: push ebx loc_004053F5: push esi loc_004053F6: mov var_18, ebx loc_004053F9: mov var_88, 00000000h loc_00405403: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405408: call edi loc_0040540A: mov ecx, var_1C loc_0040540D: mov ebx, [0040108Ch] ; arg_1 = arg_3 & Chr(arg_2) loc_00405413: and ecx, 000000FFh loc_00405419: lea edx, var_64 loc_0040541C: push ecx loc_0040541D: push edx loc_0040541E: call ebx loc_00405420: lea eax, var_64 loc_00405423: push eax loc_00405424: call MSVBVM60.DLL.__vbaStrVarMove loc_0040542A: mov edx, eax loc_0040542C: lea ecx, var_3C loc_0040542F: call MSVBVM60.DLL.__vbaStrMove loc_00405435: lea ecx, var_64 loc_00405438: call MSVBVM60.DLL.__vbaFreeVar loc_0040543E: mov eax, var_18 loc_00405441: lea ecx, var_88 loc_00405447: push ecx loc_00405448: lea edx, var_1C loc_0040544B: add eax, 00000001h loc_0040544E: push 00000001h loc_00405450: push edx loc_00405451: mov var_88, 00000000h loc_0040545B: jo 00406570h loc_00405461: push eax loc_00405462: push esi loc_00405463: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405468: call edi loc_0040546A: mov edx, var_1C loc_0040546D: mov ecx, var_3C loc_00405470: and edx, 000000FFh loc_00405476: lea eax, var_64 loc_00405479: push edx loc_0040547A: push eax loc_0040547B: mov var_7C, ecx loc_0040547E: mov var_84, 00000008h loc_00405488: call ebx loc_0040548A: lea ecx, var_84 loc_00405490: lea edx, var_64 loc_00405493: push ecx loc_00405494: lea eax, var_74 loc_00405497: push edx loc_00405498: push eax loc_00405499: call MSVBVM60.DLL.__vbaVarAdd loc_0040549F: push eax loc_004054A0: call MSVBVM60.DLL.__vbaStrVarMove loc_004054A6: mov edx, eax loc_004054A8: lea ecx, var_3C loc_004054AB: call MSVBVM60.DLL.__vbaStrMove loc_004054B1: lea ecx, var_74 loc_004054B4: lea edx, var_64 loc_004054B7: push ecx loc_004054B8: push edx loc_004054B9: push 00000002h loc_004054BB: call MSVBVM60.DLL.__vbaFreeVarList loc_004054C1: mov edx, var_18 loc_004054C4: add esp, 0000000Ch loc_004054C7: lea eax, var_88 loc_004054CD: lea ecx, var_1C loc_004054D0: push eax loc_004054D1: add edx, 00000002h loc_004054D4: push 00000001h loc_004054D6: push ecx loc_004054D7: jo 00406570h loc_004054DD: push edx loc_004054DE: push esi loc_004054DF: mov var_88, 00000000h loc_004054E9: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_004054EE: call edi loc_004054F0: mov ecx, var_1C loc_004054F3: mov eax, var_3C loc_004054F6: and ecx, 000000FFh loc_004054FC: lea edx, var_64 loc_004054FF: push ecx loc_00405500: push edx loc_00405501: mov var_7C, eax loc_00405504: mov var_84, 00000008h loc_0040550E: call ebx loc_00405510: lea eax, var_84 loc_00405516: lea ecx, var_64 loc_00405519: push eax loc_0040551A: lea edx, var_74 loc_0040551D: push ecx loc_0040551E: push edx loc_0040551F: call MSVBVM60.DLL.__vbaVarAdd loc_00405525: push eax loc_00405526: call MSVBVM60.DLL.__vbaStrVarMove loc_0040552C: mov edx, eax loc_0040552E: lea ecx, var_3C loc_00405531: call MSVBVM60.DLL.__vbaStrMove loc_00405537: lea eax, var_74 loc_0040553A: lea ecx, var_64 loc_0040553D: push eax loc_0040553E: push ecx loc_0040553F: push 00000002h loc_00405541: call MSVBVM60.DLL.__vbaFreeVarList loc_00405547: mov ecx, var_18 loc_0040554A: add esp, 0000000Ch loc_0040554D: lea edx, var_88 loc_00405553: lea eax, var_1C loc_00405556: push edx loc_00405557: add ecx, 00000003h loc_0040555A: push 00000001h loc_0040555C: push eax loc_0040555D: jo 00406570h loc_00405563: push ecx loc_00405564: push esi loc_00405565: mov var_88, 00000000h loc_0040556F: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405574: call edi loc_00405576: mov eax, var_1C loc_00405579: mov edx, var_3C loc_0040557C: and eax, 000000FFh loc_00405581: lea ecx, var_64 loc_00405584: push eax loc_00405585: push ecx loc_00405586: mov var_7C, edx loc_00405589: mov var_84, 00000008h loc_00405593: call ebx loc_00405595: lea edx, var_84 loc_0040559B: lea eax, var_64 loc_0040559E: push edx loc_0040559F: lea ecx, var_74 loc_004055A2: push eax loc_004055A3: push ecx loc_004055A4: call MSVBVM60.DLL.__vbaVarAdd loc_004055AA: push eax loc_004055AB: call MSVBVM60.DLL.__vbaStrVarMove loc_004055B1: mov edx, eax loc_004055B3: lea ecx, var_3C loc_004055B6: call MSVBVM60.DLL.__vbaStrMove loc_004055BC: lea edx, var_74 loc_004055BF: lea eax, var_64 loc_004055C2: push edx loc_004055C3: push eax loc_004055C4: push 00000002h loc_004055C6: call MSVBVM60.DLL.__vbaFreeVarList loc_004055CC: mov eax, var_18 loc_004055CF: add esp, 0000000Ch loc_004055D2: lea ecx, var_88 loc_004055D8: lea edx, var_1C loc_004055DB: push ecx loc_004055DC: add eax, 00000004h loc_004055DF: push 00000001h loc_004055E1: push edx loc_004055E2: jo 00406570h loc_004055E8: push eax loc_004055E9: mov var_88, 00000000h loc_004055F3: push esi loc_004055F4: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_004055F9: call edi loc_004055FB: mov edx, var_1C loc_004055FE: mov ecx, var_3C loc_00405601: and edx, 000000FFh loc_00405607: lea eax, var_64 loc_0040560A: push edx loc_0040560B: push eax loc_0040560C: mov var_7C, ecx loc_0040560F: mov var_84, 00000008h loc_00405619: call ebx loc_0040561B: lea ecx, var_84 loc_00405621: lea edx, var_64 loc_00405624: push ecx loc_00405625: lea eax, var_74 loc_00405628: push edx loc_00405629: push eax loc_0040562A: call MSVBVM60.DLL.__vbaVarAdd loc_00405630: push eax loc_00405631: call MSVBVM60.DLL.__vbaStrVarMove loc_00405637: mov edx, eax loc_00405639: lea ecx, var_3C loc_0040563C: call MSVBVM60.DLL.__vbaStrMove loc_00405642: lea ecx, var_74 loc_00405645: lea edx, var_64 loc_00405648: push ecx loc_00405649: push edx loc_0040564A: push 00000002h loc_0040564C: call MSVBVM60.DLL.__vbaFreeVarList loc_00405652: mov edx, var_18 loc_00405655: add esp, 0000000Ch loc_00405658: lea eax, var_88 loc_0040565E: lea ecx, var_1C loc_00405661: push eax loc_00405662: add edx, 00000005h loc_00405665: push 00000001h loc_00405667: push ecx loc_00405668: jo 00406570h loc_0040566E: push edx loc_0040566F: push esi loc_00405670: mov var_88, 00000000h loc_0040567A: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_0040567F: call edi loc_00405681: mov ecx, var_1C loc_00405684: mov eax, var_3C loc_00405687: and ecx, 000000FFh loc_0040568D: lea edx, var_64 loc_00405690: push ecx loc_00405691: push edx loc_00405692: mov var_7C, eax loc_00405695: mov var_84, 00000008h loc_0040569F: call ebx loc_004056A1: lea eax, var_84 loc_004056A7: lea ecx, var_64 loc_004056AA: push eax loc_004056AB: lea edx, var_74 loc_004056AE: push ecx loc_004056AF: push edx loc_004056B0: call MSVBVM60.DLL.__vbaVarAdd loc_004056B6: push eax loc_004056B7: call MSVBVM60.DLL.__vbaStrVarMove loc_004056BD: mov edx, eax loc_004056BF: lea ecx, var_3C loc_004056C2: call MSVBVM60.DLL.__vbaStrMove loc_004056C8: lea eax, var_74 loc_004056CB: lea ecx, var_64 loc_004056CE: push eax loc_004056CF: push ecx loc_004056D0: push 00000002h loc_004056D2: call MSVBVM60.DLL.__vbaFreeVarList loc_004056D8: mov ecx, var_18 loc_004056DB: add esp, 0000000Ch loc_004056DE: lea edx, var_88 loc_004056E4: lea eax, var_1C loc_004056E7: push edx loc_004056E8: add ecx, 00000006h loc_004056EB: push 00000001h loc_004056ED: push eax loc_004056EE: jo 00406570h loc_004056F4: mov var_88, 00000000h loc_004056FE: push ecx loc_004056FF: push esi loc_00405700: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405705: call edi loc_00405707: mov eax, var_1C loc_0040570A: mov edx, var_3C loc_0040570D: and eax, 000000FFh loc_00405712: lea ecx, var_64 loc_00405715: push eax loc_00405716: push ecx loc_00405717: mov var_7C, edx loc_0040571A: mov var_84, 00000008h loc_00405724: call ebx loc_00405726: lea edx, var_84 loc_0040572C: lea eax, var_64 loc_0040572F: push edx loc_00405730: lea ecx, var_74 loc_00405733: push eax loc_00405734: push ecx loc_00405735: call MSVBVM60.DLL.__vbaVarAdd loc_0040573B: push eax loc_0040573C: call MSVBVM60.DLL.__vbaStrVarMove loc_00405742: mov edx, eax loc_00405744: lea ecx, var_3C loc_00405747: call MSVBVM60.DLL.__vbaStrMove loc_0040574D: lea edx, var_74 loc_00405750: lea eax, var_64 loc_00405753: push edx loc_00405754: push eax loc_00405755: push 00000002h loc_00405757: call MSVBVM60.DLL.__vbaFreeVarList loc_0040575D: mov eax, var_18 loc_00405760: add esp, 0000000Ch loc_00405763: lea ecx, var_88 loc_00405769: lea edx, var_1C loc_0040576C: push ecx loc_0040576D: add eax, 00000007h loc_00405770: push 00000001h loc_00405772: push edx loc_00405773: jo 00406570h loc_00405779: push eax loc_0040577A: push esi loc_0040577B: mov var_88, 00000000h loc_00405785: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_0040578A: call edi loc_0040578C: mov edx, var_1C loc_0040578F: mov ecx, var_3C loc_00405792: and edx, 000000FFh loc_00405798: lea eax, var_64 loc_0040579B: push edx loc_0040579C: push eax loc_0040579D: mov var_7C, ecx loc_004057A0: mov var_84, 00000008h loc_004057AA: call ebx loc_004057AC: lea ecx, var_84 loc_004057B2: lea edx, var_64 loc_004057B5: push ecx loc_004057B6: lea eax, var_74 loc_004057B9: push edx loc_004057BA: push eax loc_004057BB: call MSVBVM60.DLL.__vbaVarAdd loc_004057C1: push eax loc_004057C2: call MSVBVM60.DLL.__vbaStrVarMove loc_004057C8: mov edx, eax loc_004057CA: lea ecx, var_3C loc_004057CD: call MSVBVM60.DLL.__vbaStrMove loc_004057D3: lea ecx, var_74 loc_004057D6: lea edx, var_64 loc_004057D9: push ecx loc_004057DA: push edx loc_004057DB: push 00000002h loc_004057DD: call MSVBVM60.DLL.__vbaFreeVarList loc_004057E3: mov edx, var_18 loc_004057E6: add esp, 0000000Ch loc_004057E9: lea eax, var_88 loc_004057EF: lea ecx, var_1C loc_004057F2: push eax loc_004057F3: add edx, 00000008h loc_004057F6: push 00000001h loc_004057F8: mov var_88, 00000000h loc_00405802: push ecx loc_00405803: jo 00406570h loc_00405809: push edx loc_0040580A: push esi loc_0040580B: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405810: call edi loc_00405812: mov ecx, var_1C loc_00405815: mov eax, var_3C loc_00405818: and ecx, 000000FFh loc_0040581E: lea edx, var_64 loc_00405821: push ecx loc_00405822: push edx loc_00405823: mov var_7C, eax loc_00405826: mov var_84, 00000008h loc_00405830: call ebx loc_00405832: lea eax, var_84 loc_00405838: lea ecx, var_64 loc_0040583B: push eax loc_0040583C: lea edx, var_74 loc_0040583F: push ecx loc_00405840: push edx loc_00405841: call MSVBVM60.DLL.__vbaVarAdd loc_00405847: push eax loc_00405848: call MSVBVM60.DLL.__vbaStrVarMove loc_0040584E: mov edx, eax loc_00405850: lea ecx, var_3C loc_00405853: call MSVBVM60.DLL.__vbaStrMove loc_00405859: lea eax, var_74 loc_0040585C: lea ecx, var_64 loc_0040585F: push eax loc_00405860: push ecx loc_00405861: push 00000002h loc_00405863: call MSVBVM60.DLL.__vbaFreeVarList loc_00405869: mov ecx, var_18 loc_0040586C: add esp, 0000000Ch loc_0040586F: lea edx, var_88 loc_00405875: lea eax, var_1C loc_00405878: push edx loc_00405879: add ecx, 00000009h loc_0040587C: push 00000001h loc_0040587E: push eax loc_0040587F: jo 00406570h loc_00405885: push ecx loc_00405886: push esi loc_00405887: mov var_88, 00000000h loc_00405891: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405896: call edi loc_00405898: mov eax, var_1C loc_0040589B: mov edx, var_3C loc_0040589E: and eax, 000000FFh loc_004058A3: lea ecx, var_64 loc_004058A6: push eax loc_004058A7: push ecx loc_004058A8: mov var_7C, edx loc_004058AB: mov var_84, 00000008h loc_004058B5: call ebx loc_004058B7: lea edx, var_84 loc_004058BD: lea eax, var_64 loc_004058C0: push edx loc_004058C1: lea ecx, var_74 loc_004058C4: push eax loc_004058C5: push ecx loc_004058C6: call MSVBVM60.DLL.__vbaVarAdd loc_004058CC: push eax loc_004058CD: call MSVBVM60.DLL.__vbaStrVarMove loc_004058D3: mov edx, eax loc_004058D5: lea ecx, var_3C loc_004058D8: call MSVBVM60.DLL.__vbaStrMove loc_004058DE: lea edx, var_74 loc_004058E1: lea eax, var_64 loc_004058E4: push edx loc_004058E5: push eax loc_004058E6: push 00000002h loc_004058E8: call MSVBVM60.DLL.__vbaFreeVarList loc_004058EE: mov eax, var_18 loc_004058F1: add esp, 0000000Ch loc_004058F4: lea ecx, var_88 loc_004058FA: lea edx, var_1C loc_004058FD: push ecx loc_004058FE: push 00000001h loc_00405900: mov var_88, 00000000h loc_0040590A: push edx loc_0040590B: add eax, 0000000Ah loc_0040590E: jo 00406570h loc_00405914: push eax loc_00405915: push esi loc_00405916: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_0040591B: call edi loc_0040591D: mov edx, var_1C loc_00405920: mov ecx, var_3C loc_00405923: and edx, 000000FFh loc_00405929: lea eax, var_64 loc_0040592C: push edx loc_0040592D: push eax loc_0040592E: mov var_7C, ecx loc_00405931: mov var_84, 00000008h loc_0040593B: call ebx loc_0040593D: lea ecx, var_84 loc_00405943: lea edx, var_64 loc_00405946: push ecx loc_00405947: lea eax, var_74 loc_0040594A: push edx loc_0040594B: push eax loc_0040594C: call MSVBVM60.DLL.__vbaVarAdd loc_00405952: push eax loc_00405953: call MSVBVM60.DLL.__vbaStrVarMove loc_00405959: mov edx, eax loc_0040595B: lea ecx, var_3C loc_0040595E: call MSVBVM60.DLL.__vbaStrMove loc_00405964: lea ecx, var_74 loc_00405967: lea edx, var_64 loc_0040596A: push ecx loc_0040596B: push edx loc_0040596C: push 00000002h loc_0040596E: call MSVBVM60.DLL.__vbaFreeVarList loc_00405974: mov edx, var_18 loc_00405977: add esp, 0000000Ch loc_0040597A: lea eax, var_88 loc_00405980: lea ecx, var_1C loc_00405983: push eax loc_00405984: add edx, 0000000Bh loc_00405987: push 00000001h loc_00405989: push ecx loc_0040598A: jo 00406570h loc_00405990: push edx loc_00405991: push esi loc_00405992: mov var_88, 00000000h loc_0040599C: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_004059A1: call edi loc_004059A3: mov ecx, var_1C loc_004059A6: mov eax, var_3C loc_004059A9: and ecx, 000000FFh loc_004059AF: lea edx, var_64 loc_004059B2: push ecx loc_004059B3: push edx loc_004059B4: mov var_7C, eax loc_004059B7: mov var_84, 00000008h loc_004059C1: call ebx loc_004059C3: lea eax, var_84 loc_004059C9: lea ecx, var_64 loc_004059CC: push eax loc_004059CD: lea edx, var_74 loc_004059D0: push ecx loc_004059D1: push edx loc_004059D2: call MSVBVM60.DLL.__vbaVarAdd loc_004059D8: push eax loc_004059D9: call MSVBVM60.DLL.__vbaStrVarMove loc_004059DF: mov edx, eax loc_004059E1: lea ecx, var_3C loc_004059E4: call MSVBVM60.DLL.__vbaStrMove loc_004059EA: lea eax, var_74 loc_004059ED: lea ecx, var_64 loc_004059F0: push eax loc_004059F1: push ecx loc_004059F2: push 00000002h loc_004059F4: call MSVBVM60.DLL.__vbaFreeVarList loc_004059FA: mov ecx, var_18 loc_004059FD: add esp, 0000000Ch loc_00405A00: lea edx, var_88 loc_00405A06: lea eax, var_1C loc_00405A09: push edx loc_00405A0A: push 00000001h loc_00405A0C: mov var_88, 00000000h loc_00405A16: push eax loc_00405A17: add ecx, 0000000Ch loc_00405A1A: jo 00406570h loc_00405A20: push ecx loc_00405A21: push esi loc_00405A22: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405A27: call edi loc_00405A29: mov eax, var_1C loc_00405A2C: mov edx, var_3C loc_00405A2F: and eax, 000000FFh loc_00405A34: lea ecx, var_64 loc_00405A37: push eax loc_00405A38: push ecx loc_00405A39: mov var_7C, edx loc_00405A3C: mov var_84, 00000008h loc_00405A46: call ebx loc_00405A48: lea edx, var_84 loc_00405A4E: lea eax, var_64 loc_00405A51: push edx loc_00405A52: lea ecx, var_74 loc_00405A55: push eax loc_00405A56: push ecx loc_00405A57: call MSVBVM60.DLL.__vbaVarAdd loc_00405A5D: push eax loc_00405A5E: call MSVBVM60.DLL.__vbaStrVarMove loc_00405A64: mov edx, eax loc_00405A66: lea ecx, var_3C loc_00405A69: call MSVBVM60.DLL.__vbaStrMove loc_00405A6F: lea edx, var_74 loc_00405A72: lea eax, var_64 loc_00405A75: push edx loc_00405A76: push eax loc_00405A77: push 00000002h loc_00405A79: call MSVBVM60.DLL.__vbaFreeVarList loc_00405A7F: mov eax, var_18 loc_00405A82: add esp, 0000000Ch loc_00405A85: lea ecx, var_88 loc_00405A8B: lea edx, var_1C loc_00405A8E: push ecx loc_00405A8F: add eax, 0000000Dh loc_00405A92: push 00000001h loc_00405A94: push edx loc_00405A95: jo 00406570h loc_00405A9B: push eax loc_00405A9C: push esi loc_00405A9D: mov var_88, 00000000h loc_00405AA7: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405AAC: call edi loc_00405AAE: mov edx, var_1C loc_00405AB1: mov ecx, var_3C loc_00405AB4: and edx, 000000FFh loc_00405ABA: lea eax, var_64 loc_00405ABD: push edx loc_00405ABE: push eax loc_00405ABF: mov var_7C, ecx loc_00405AC2: mov var_84, 00000008h loc_00405ACC: call ebx loc_00405ACE: lea ecx, var_84 loc_00405AD4: lea edx, var_64 loc_00405AD7: push ecx loc_00405AD8: lea eax, var_74 loc_00405ADB: push edx loc_00405ADC: push eax loc_00405ADD: call MSVBVM60.DLL.__vbaVarAdd loc_00405AE3: push eax loc_00405AE4: call MSVBVM60.DLL.__vbaStrVarMove loc_00405AEA: mov edx, eax loc_00405AEC: lea ecx, var_3C loc_00405AEF: call MSVBVM60.DLL.__vbaStrMove loc_00405AF5: lea ecx, var_74 loc_00405AF8: lea edx, var_64 loc_00405AFB: push ecx loc_00405AFC: push edx loc_00405AFD: push 00000002h loc_00405AFF: call MSVBVM60.DLL.__vbaFreeVarList loc_00405B05: add esp, 0000000Ch loc_00405B08: lea eax, var_88 loc_00405B0E: lea ecx, var_1C loc_00405B11: mov var_88, 00000000h loc_00405B1B: push eax loc_00405B1C: push 00000001h loc_00405B1E: push ecx loc_00405B1F: mov edx, var_18 loc_00405B22: add edx, 0000000Eh loc_00405B25: jo 00406570h loc_00405B2B: push edx loc_00405B2C: push esi loc_00405B2D: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405B32: call edi loc_00405B34: mov ecx, var_1C loc_00405B37: mov eax, var_3C loc_00405B3A: and ecx, 000000FFh loc_00405B40: lea edx, var_64 loc_00405B43: push ecx loc_00405B44: push edx loc_00405B45: mov var_7C, eax loc_00405B48: mov var_84, 00000008h loc_00405B52: call ebx loc_00405B54: lea eax, var_84 loc_00405B5A: lea ecx, var_64 loc_00405B5D: push eax loc_00405B5E: lea edx, var_74 loc_00405B61: push ecx loc_00405B62: push edx loc_00405B63: call MSVBVM60.DLL.__vbaVarAdd loc_00405B69: push eax loc_00405B6A: call MSVBVM60.DLL.__vbaStrVarMove loc_00405B70: mov edx, eax loc_00405B72: lea ecx, var_3C loc_00405B75: call MSVBVM60.DLL.__vbaStrMove loc_00405B7B: lea eax, var_74 loc_00405B7E: lea ecx, var_64 loc_00405B81: push eax loc_00405B82: push ecx loc_00405B83: push 00000002h loc_00405B85: call MSVBVM60.DLL.__vbaFreeVarList loc_00405B8B: mov eax, arg_8 loc_00405B8E: add esp, 0000000Ch loc_00405B91: mov edx, [eax] loc_00405B93: push eax loc_00405B94: call [edx+00000338h] loc_00405B9A: push eax loc_00405B9B: lea eax, var_50 loc_00405B9E: push eax loc_00405B9F: call [0040103Ch] ; Set (object) loc_00405BA5: mov edx, var_3C loc_00405BA8: mov ecx, [eax] loc_00405BAA: push edx loc_00405BAB: push eax loc_00405BAC: mov var_8C, eax loc_00405BB2: call [ecx+000000A4h] loc_00405BB8: test eax, eax loc_00405BBA: fclex loc_00405BBC: jnl 405BD6h loc_00405BBE: mov ecx, var_8C loc_00405BC4: push 000000A4h loc_00405BC9: push 004036A0h loc_00405BCE: push ecx loc_00405BCF: push eax loc_00405BD0: call MSVBVM60.DLL.__vbaHresultCheckObj loc_00405BD6: lea ecx, var_50 loc_00405BD9: call MSVBVM60.DLL.__vbaFreeObj loc_00405BDF: mov edx, 004036B4h loc_00405BE4: lea ecx, var_3C loc_00405BE7: call MSVBVM60.DLL.__vbaStrCopy loc_00405BED: mov eax, var_18 loc_00405BF0: lea edx, var_88 loc_00405BF6: add eax, 00000020h loc_00405BF9: push edx loc_00405BFA: lea ecx, var_1C loc_00405BFD: push 00000001h loc_00405BFF: jo 00406570h loc_00405C05: push ecx loc_00405C06: push eax loc_00405C07: push esi loc_00405C08: mov var_18, eax loc_00405C0B: mov var_88, 00000000h loc_00405C15: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405C1A: call edi loc_00405C1C: mov edx, var_1C loc_00405C1F: lea eax, var_64 loc_00405C22: and edx, 000000FFh loc_00405C28: push edx loc_00405C29: push eax loc_00405C2A: call ebx loc_00405C2C: lea ecx, var_64 loc_00405C2F: push ecx loc_00405C30: call MSVBVM60.DLL.__vbaStrVarMove loc_00405C36: mov edx, eax loc_00405C38: lea ecx, var_3C loc_00405C3B: call MSVBVM60.DLL.__vbaStrMove loc_00405C41: lea ecx, var_64 loc_00405C44: call MSVBVM60.DLL.__vbaFreeVar loc_00405C4A: mov ecx, var_18 loc_00405C4D: lea edx, var_88 loc_00405C53: push edx loc_00405C54: lea eax, var_1C loc_00405C57: add ecx, 00000001h loc_00405C5A: push 00000001h loc_00405C5C: push eax loc_00405C5D: mov var_88, 00000000h loc_00405C67: jo 00406570h loc_00405C6D: push ecx loc_00405C6E: push esi loc_00405C6F: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405C74: call edi loc_00405C76: mov eax, var_1C loc_00405C79: mov edx, var_3C loc_00405C7C: and eax, 000000FFh loc_00405C81: lea ecx, var_64 loc_00405C84: push eax loc_00405C85: push ecx loc_00405C86: mov var_7C, edx loc_00405C89: mov var_84, 00000008h loc_00405C93: call ebx loc_00405C95: lea edx, var_84 loc_00405C9B: lea eax, var_64 loc_00405C9E: push edx loc_00405C9F: lea ecx, var_74 loc_00405CA2: push eax loc_00405CA3: push ecx loc_00405CA4: call MSVBVM60.DLL.__vbaVarAdd loc_00405CAA: push eax loc_00405CAB: call MSVBVM60.DLL.__vbaStrVarMove loc_00405CB1: mov edx, eax loc_00405CB3: lea ecx, var_3C loc_00405CB6: call MSVBVM60.DLL.__vbaStrMove loc_00405CBC: lea edx, var_74 loc_00405CBF: lea eax, var_64 loc_00405CC2: push edx loc_00405CC3: push eax loc_00405CC4: push 00000002h loc_00405CC6: call MSVBVM60.DLL.__vbaFreeVarList loc_00405CCC: mov eax, var_18 loc_00405CCF: add esp, 0000000Ch loc_00405CD2: lea ecx, var_88 loc_00405CD8: lea edx, var_1C loc_00405CDB: push ecx loc_00405CDC: push 00000001h loc_00405CDE: mov var_88, 00000000h loc_00405CE8: push edx loc_00405CE9: add eax, 00000002h loc_00405CEC: jo 00406570h loc_00405CF2: push eax loc_00405CF3: push esi loc_00405CF4: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405CF9: call edi loc_00405CFB: mov edx, var_1C loc_00405CFE: mov ecx, var_3C loc_00405D01: and edx, 000000FFh loc_00405D07: lea eax, var_64 loc_00405D0A: push edx loc_00405D0B: push eax loc_00405D0C: mov var_7C, ecx loc_00405D0F: mov var_84, 00000008h loc_00405D19: call ebx loc_00405D1B: lea ecx, var_84 loc_00405D21: lea edx, var_64 loc_00405D24: push ecx loc_00405D25: lea eax, var_74 loc_00405D28: push edx loc_00405D29: push eax loc_00405D2A: call MSVBVM60.DLL.__vbaVarAdd loc_00405D30: push eax loc_00405D31: call MSVBVM60.DLL.__vbaStrVarMove loc_00405D37: mov edx, eax loc_00405D39: lea ecx, var_3C loc_00405D3C: call MSVBVM60.DLL.__vbaStrMove loc_00405D42: lea ecx, var_74 loc_00405D45: lea edx, var_64 loc_00405D48: push ecx loc_00405D49: push edx loc_00405D4A: push 00000002h loc_00405D4C: call MSVBVM60.DLL.__vbaFreeVarList loc_00405D52: mov edx, var_18 loc_00405D55: add esp, 0000000Ch loc_00405D58: lea eax, var_88 loc_00405D5E: lea ecx, var_1C loc_00405D61: push eax loc_00405D62: add edx, 00000003h loc_00405D65: push 00000001h loc_00405D67: push ecx loc_00405D68: jo 00406570h loc_00405D6E: push edx loc_00405D6F: push esi loc_00405D70: mov var_88, 00000000h loc_00405D7A: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405D7F: call edi loc_00405D81: mov ecx, var_1C loc_00405D84: mov eax, var_3C loc_00405D87: and ecx, 000000FFh loc_00405D8D: lea edx, var_64 loc_00405D90: push ecx loc_00405D91: push edx loc_00405D92: mov var_7C, eax loc_00405D95: mov var_84, 00000008h loc_00405D9F: call ebx loc_00405DA1: lea eax, var_84 loc_00405DA7: lea ecx, var_64 loc_00405DAA: push eax loc_00405DAB: lea edx, var_74 loc_00405DAE: push ecx loc_00405DAF: push edx loc_00405DB0: call MSVBVM60.DLL.__vbaVarAdd loc_00405DB6: push eax loc_00405DB7: call MSVBVM60.DLL.__vbaStrVarMove loc_00405DBD: mov edx, eax loc_00405DBF: lea ecx, var_3C loc_00405DC2: call MSVBVM60.DLL.__vbaStrMove loc_00405DC8: lea eax, var_74 loc_00405DCB: lea ecx, var_64 loc_00405DCE: push eax loc_00405DCF: push ecx loc_00405DD0: push 00000002h loc_00405DD2: call MSVBVM60.DLL.__vbaFreeVarList loc_00405DD8: add esp, 0000000Ch loc_00405DDB: lea edx, var_88 loc_00405DE1: lea eax, var_1C loc_00405DE4: mov var_88, 00000000h loc_00405DEE: push edx loc_00405DEF: push 00000001h loc_00405DF1: push eax loc_00405DF2: mov ecx, var_18 loc_00405DF5: add ecx, 00000004h loc_00405DF8: jo 00406570h loc_00405DFE: push ecx loc_00405DFF: push esi loc_00405E00: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405E05: call edi loc_00405E07: mov eax, var_1C loc_00405E0A: mov edx, var_3C loc_00405E0D: and eax, 000000FFh loc_00405E12: lea ecx, var_64 loc_00405E15: push eax loc_00405E16: push ecx loc_00405E17: mov var_7C, edx loc_00405E1A: mov var_84, 00000008h loc_00405E24: call ebx loc_00405E26: lea edx, var_84 loc_00405E2C: lea eax, var_64 loc_00405E2F: push edx loc_00405E30: lea ecx, var_74 loc_00405E33: push eax loc_00405E34: push ecx loc_00405E35: call MSVBVM60.DLL.__vbaVarAdd loc_00405E3B: push eax loc_00405E3C: call MSVBVM60.DLL.__vbaStrVarMove loc_00405E42: mov edx, eax loc_00405E44: lea ecx, var_3C loc_00405E47: call MSVBVM60.DLL.__vbaStrMove loc_00405E4D: lea edx, var_74 loc_00405E50: lea eax, var_64 loc_00405E53: push edx loc_00405E54: push eax loc_00405E55: push 00000002h loc_00405E57: call MSVBVM60.DLL.__vbaFreeVarList loc_00405E5D: mov eax, var_18 loc_00405E60: add esp, 0000000Ch loc_00405E63: lea ecx, var_88 loc_00405E69: lea edx, var_1C loc_00405E6C: push ecx loc_00405E6D: add eax, 00000005h loc_00405E70: push 00000001h loc_00405E72: push edx loc_00405E73: jo 00406570h loc_00405E79: push eax loc_00405E7A: push esi loc_00405E7B: mov var_88, 00000000h loc_00405E85: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405E8A: call edi loc_00405E8C: mov edx, var_1C loc_00405E8F: mov ecx, var_3C loc_00405E92: and edx, 000000FFh loc_00405E98: lea eax, var_64 loc_00405E9B: push edx loc_00405E9C: push eax loc_00405E9D: mov var_7C, ecx loc_00405EA0: mov var_84, 00000008h loc_00405EAA: call ebx loc_00405EAC: lea ecx, var_84 loc_00405EB2: lea edx, var_64 loc_00405EB5: push ecx loc_00405EB6: lea eax, var_74 loc_00405EB9: push edx loc_00405EBA: push eax loc_00405EBB: call MSVBVM60.DLL.__vbaVarAdd loc_00405EC1: push eax loc_00405EC2: call MSVBVM60.DLL.__vbaStrVarMove loc_00405EC8: mov edx, eax loc_00405ECA: lea ecx, var_3C loc_00405ECD: call MSVBVM60.DLL.__vbaStrMove loc_00405ED3: lea ecx, var_74 loc_00405ED6: lea edx, var_64 loc_00405ED9: push ecx loc_00405EDA: push edx loc_00405EDB: push 00000002h loc_00405EDD: call MSVBVM60.DLL.__vbaFreeVarList loc_00405EE3: add esp, 0000000Ch loc_00405EE6: lea eax, var_88 loc_00405EEC: mov var_88, 00000000h loc_00405EF6: lea ecx, var_1C loc_00405EF9: push eax loc_00405EFA: push 00000001h loc_00405EFC: mov edx, var_18 loc_00405EFF: push ecx loc_00405F00: add edx, 00000006h loc_00405F03: jo 00406570h loc_00405F09: push edx loc_00405F0A: push esi loc_00405F0B: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405F10: call edi loc_00405F12: mov ecx, var_1C loc_00405F15: mov eax, var_3C loc_00405F18: and ecx, 000000FFh loc_00405F1E: lea edx, var_64 loc_00405F21: push ecx loc_00405F22: push edx loc_00405F23: mov var_7C, eax loc_00405F26: mov var_84, 00000008h loc_00405F30: call ebx loc_00405F32: lea eax, var_84 loc_00405F38: lea ecx, var_64 loc_00405F3B: push eax loc_00405F3C: lea edx, var_74 loc_00405F3F: push ecx loc_00405F40: push edx loc_00405F41: call MSVBVM60.DLL.__vbaVarAdd loc_00405F47: push eax loc_00405F48: call MSVBVM60.DLL.__vbaStrVarMove loc_00405F4E: mov edx, eax loc_00405F50: lea ecx, var_3C loc_00405F53: call MSVBVM60.DLL.__vbaStrMove loc_00405F59: lea eax, var_74 loc_00405F5C: lea ecx, var_64 loc_00405F5F: push eax loc_00405F60: push ecx loc_00405F61: push 00000002h loc_00405F63: call MSVBVM60.DLL.__vbaFreeVarList loc_00405F69: mov ecx, var_18 loc_00405F6C: add esp, 0000000Ch loc_00405F6F: lea edx, var_88 loc_00405F75: lea eax, var_1C loc_00405F78: push edx loc_00405F79: add ecx, 00000007h loc_00405F7C: push 00000001h loc_00405F7E: push eax loc_00405F7F: jo 00406570h loc_00405F85: push ecx loc_00405F86: push esi loc_00405F87: mov var_88, 00000000h loc_00405F91: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00405F96: call edi loc_00405F98: mov eax, var_1C loc_00405F9B: mov edx, var_3C loc_00405F9E: and eax, 000000FFh loc_00405FA3: lea ecx, var_64 loc_00405FA6: push eax loc_00405FA7: push ecx loc_00405FA8: mov var_7C, edx loc_00405FAB: mov var_84, 00000008h loc_00405FB5: call ebx loc_00405FB7: lea edx, var_84 loc_00405FBD: lea eax, var_64 loc_00405FC0: push edx loc_00405FC1: lea ecx, var_74 loc_00405FC4: push eax loc_00405FC5: push ecx loc_00405FC6: call MSVBVM60.DLL.__vbaVarAdd loc_00405FCC: push eax loc_00405FCD: call MSVBVM60.DLL.__vbaStrVarMove loc_00405FD3: mov edx, eax loc_00405FD5: lea ecx, var_3C loc_00405FD8: call MSVBVM60.DLL.__vbaStrMove loc_00405FDE: lea edx, var_74 loc_00405FE1: lea eax, var_64 loc_00405FE4: push edx loc_00405FE5: push eax loc_00405FE6: push 00000002h loc_00405FE8: call MSVBVM60.DLL.__vbaFreeVarList loc_00405FEE: add esp, 0000000Ch loc_00405FF1: lea ecx, var_88 loc_00405FF7: mov var_88, 00000000h loc_00406001: push ecx loc_00406002: push 00000001h loc_00406004: mov eax, var_18 loc_00406007: lea edx, var_1C loc_0040600A: add eax, 00000008h loc_0040600D: push edx loc_0040600E: jo 00406570h loc_00406014: push eax loc_00406015: push esi loc_00406016: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_0040601B: call edi loc_0040601D: mov edx, var_1C loc_00406020: mov ecx, var_3C loc_00406023: and edx, 000000FFh loc_00406029: lea eax, var_64 loc_0040602C: push edx loc_0040602D: push eax loc_0040602E: mov var_7C, ecx loc_00406031: mov var_84, 00000008h loc_0040603B: call ebx loc_0040603D: lea ecx, var_84 loc_00406043: lea edx, var_64 loc_00406046: push ecx loc_00406047: lea eax, var_74 loc_0040604A: push edx loc_0040604B: push eax loc_0040604C: call MSVBVM60.DLL.__vbaVarAdd loc_00406052: push eax loc_00406053: call MSVBVM60.DLL.__vbaStrVarMove loc_00406059: mov edx, eax loc_0040605B: lea ecx, var_3C loc_0040605E: call MSVBVM60.DLL.__vbaStrMove loc_00406064: lea ecx, var_74 loc_00406067: lea edx, var_64 loc_0040606A: push ecx loc_0040606B: push edx loc_0040606C: push 00000002h loc_0040606E: call MSVBVM60.DLL.__vbaFreeVarList loc_00406074: mov edx, var_18 loc_00406077: add esp, 0000000Ch loc_0040607A: lea eax, var_88 loc_00406080: lea ecx, var_1C loc_00406083: push eax loc_00406084: add edx, 00000009h loc_00406087: push 00000001h loc_00406089: push ecx loc_0040608A: jo 00406570h loc_00406090: push edx loc_00406091: push esi loc_00406092: mov var_88, 00000000h loc_0040609C: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_004060A1: call edi loc_004060A3: mov ecx, var_1C loc_004060A6: mov eax, var_3C loc_004060A9: and ecx, 000000FFh loc_004060AF: lea edx, var_64 loc_004060B2: push ecx loc_004060B3: push edx loc_004060B4: mov var_7C, eax loc_004060B7: mov var_84, 00000008h loc_004060C1: call ebx loc_004060C3: lea eax, var_84 loc_004060C9: lea ecx, var_64 loc_004060CC: push eax loc_004060CD: lea edx, var_74 loc_004060D0: push ecx loc_004060D1: push edx loc_004060D2: call MSVBVM60.DLL.__vbaVarAdd loc_004060D8: push eax loc_004060D9: call MSVBVM60.DLL.__vbaStrVarMove loc_004060DF: mov edx, eax loc_004060E1: lea ecx, var_3C loc_004060E4: call MSVBVM60.DLL.__vbaStrMove loc_004060EA: lea eax, var_74 loc_004060ED: lea ecx, var_64 loc_004060F0: push eax loc_004060F1: push ecx loc_004060F2: push 00000002h loc_004060F4: call MSVBVM60.DLL.__vbaFreeVarList loc_004060FA: add esp, 0000000Ch loc_004060FD: lea edx, var_88 loc_00406103: mov var_88, 00000000h loc_0040610D: push edx loc_0040610E: mov ecx, var_18 loc_00406111: lea eax, var_1C loc_00406114: add ecx, 0000000Ah loc_00406117: push 00000001h loc_00406119: push eax loc_0040611A: jo 00406570h loc_00406120: push ecx loc_00406121: push esi loc_00406122: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00406127: call edi loc_00406129: mov eax, var_1C loc_0040612C: mov edx, var_3C loc_0040612F: and eax, 000000FFh loc_00406134: lea ecx, var_64 loc_00406137: push eax loc_00406138: push ecx loc_00406139: mov var_7C, edx loc_0040613C: mov var_84, 00000008h loc_00406146: call ebx loc_00406148: lea edx, var_84 loc_0040614E: lea eax, var_64 loc_00406151: push edx loc_00406152: lea ecx, var_74 loc_00406155: push eax loc_00406156: push ecx loc_00406157: call MSVBVM60.DLL.__vbaVarAdd loc_0040615D: push eax loc_0040615E: call MSVBVM60.DLL.__vbaStrVarMove loc_00406164: mov edx, eax loc_00406166: lea ecx, var_3C loc_00406169: call MSVBVM60.DLL.__vbaStrMove loc_0040616F: lea edx, var_74 loc_00406172: lea eax, var_64 loc_00406175: push edx loc_00406176: push eax loc_00406177: push 00000002h loc_00406179: call MSVBVM60.DLL.__vbaFreeVarList loc_0040617F: mov eax, var_18 loc_00406182: add esp, 0000000Ch loc_00406185: lea ecx, var_88 loc_0040618B: lea edx, var_1C loc_0040618E: push ecx loc_0040618F: add eax, 0000000Bh loc_00406192: push 00000001h loc_00406194: push edx loc_00406195: jo 00406570h loc_0040619B: push eax loc_0040619C: push esi loc_0040619D: mov var_88, 00000000h loc_004061A7: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_004061AC: call edi loc_004061AE: mov edx, var_1C loc_004061B1: mov ecx, var_3C loc_004061B4: and edx, 000000FFh loc_004061BA: lea eax, var_64 loc_004061BD: push edx loc_004061BE: push eax loc_004061BF: mov var_7C, ecx loc_004061C2: mov var_84, 00000008h loc_004061CC: call ebx loc_004061CE: lea ecx, var_84 loc_004061D4: lea edx, var_64 loc_004061D7: push ecx loc_004061D8: lea eax, var_74 loc_004061DB: push edx loc_004061DC: push eax loc_004061DD: call MSVBVM60.DLL.__vbaVarAdd loc_004061E3: push eax loc_004061E4: call MSVBVM60.DLL.__vbaStrVarMove loc_004061EA: mov edx, eax loc_004061EC: lea ecx, var_3C loc_004061EF: call MSVBVM60.DLL.__vbaStrMove loc_004061F5: lea ecx, var_74 loc_004061F8: lea edx, var_64 loc_004061FB: push ecx loc_004061FC: push edx loc_004061FD: push 00000002h loc_004061FF: call MSVBVM60.DLL.__vbaFreeVarList loc_00406205: add esp, 0000000Ch loc_00406208: mov var_88, 00000000h loc_00406212: lea eax, var_88 loc_00406218: mov edx, var_18 loc_0040621B: push eax loc_0040621C: lea ecx, var_1C loc_0040621F: add edx, 0000000Ch loc_00406222: push 00000001h loc_00406224: push ecx loc_00406225: jo 00406570h loc_0040622B: push edx loc_0040622C: push esi loc_0040622D: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_00406232: call edi loc_00406234: mov ecx, var_1C loc_00406237: mov eax, var_3C loc_0040623A: and ecx, 000000FFh loc_00406240: lea edx, var_64 loc_00406243: push ecx loc_00406244: push edx loc_00406245: mov var_7C, eax loc_00406248: mov var_84, 00000008h loc_00406252: call ebx loc_00406254: lea eax, var_84 loc_0040625A: lea ecx, var_64 loc_0040625D: push eax loc_0040625E: lea edx, var_74 loc_00406261: push ecx loc_00406262: push edx loc_00406263: call MSVBVM60.DLL.__vbaVarAdd loc_00406269: push eax loc_0040626A: call MSVBVM60.DLL.__vbaStrVarMove loc_00406270: mov edx, eax loc_00406272: lea ecx, var_3C loc_00406275: call MSVBVM60.DLL.__vbaStrMove loc_0040627B: lea eax, var_74 loc_0040627E: lea ecx, var_64 loc_00406281: push eax loc_00406282: push ecx loc_00406283: push 00000002h loc_00406285: call MSVBVM60.DLL.__vbaFreeVarList loc_0040628B: mov ecx, var_18 loc_0040628E: add esp, 0000000Ch loc_00406291: lea edx, var_88 loc_00406297: lea eax, var_1C loc_0040629A: push edx loc_0040629B: add ecx, 0000000Dh loc_0040629E: push 00000001h loc_004062A0: push eax loc_004062A1: jo 00406570h loc_004062A7: push ecx loc_004062A8: push esi loc_004062A9: mov var_88, 00000000h loc_004062B3: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_004062B8: call edi loc_004062BA: mov eax, var_1C loc_004062BD: mov edx, var_3C loc_004062C0: and eax, 000000FFh loc_004062C5: lea ecx, var_64 loc_004062C8: push eax loc_004062C9: push ecx loc_004062CA: mov var_7C, edx loc_004062CD: mov var_84, 00000008h loc_004062D7: call ebx loc_004062D9: lea edx, var_84 loc_004062DF: lea eax, var_64 loc_004062E2: push edx loc_004062E3: lea ecx, var_74 loc_004062E6: push eax loc_004062E7: push ecx loc_004062E8: call MSVBVM60.DLL.__vbaVarAdd loc_004062EE: push eax loc_004062EF: call MSVBVM60.DLL.__vbaStrVarMove loc_004062F5: mov edx, eax loc_004062F7: lea ecx, var_3C loc_004062FA: call MSVBVM60.DLL.__vbaStrMove loc_00406300: lea edx, var_74 loc_00406303: lea eax, var_64 loc_00406306: push edx loc_00406307: push eax loc_00406308: push 00000002h loc_0040630A: call MSVBVM60.DLL.__vbaFreeVarList loc_00406310: add esp, 0000000Ch loc_00406313: mov var_88, 00000000h loc_0040631D: mov eax, var_18 loc_00406320: lea ecx, var_88 loc_00406326: push ecx loc_00406327: lea edx, var_1C loc_0040632A: add eax, 0000000Eh loc_0040632D: push 00000001h loc_0040632F: push edx loc_00406330: jo 00406570h loc_00406336: push eax loc_00406337: push esi loc_00406338: ReadProcessMemory(%x1, %x2, %x3, %x4, %x5) loc_0040633D: call edi loc_0040633F: mov ecx, var_1C loc_00406342: mov eax, var_3C loc_00406345: and ecx, 000000FFh loc_0040634B: lea edx, var_64 loc_0040634E: push ecx loc_0040634F: push edx loc_00406350: mov var_7C, eax loc_00406353: mov var_84, 00000008h loc_0040635D: call ebx loc_0040635F: lea eax, var_84 loc_00406365: lea ecx, var_64 loc_00406368: push eax loc_00406369: lea edx, var_74 loc_0040636C: push ecx loc_0040636D: push edx loc_0040636E: call MSVBVM60.DLL.__vbaVarAdd loc_00406374: push eax loc_00406375: call MSVBVM60.DLL.__vbaStrVarMove loc_0040637B: mov edx, eax loc_0040637D: lea ecx, var_3C loc_00406380: call MSVBVM60.DLL.__vbaStrMove loc_00406386: lea eax, var_74 loc_00406389: lea ecx, var_64 loc_0040638C: push eax loc_0040638D: push ecx loc_0040638E: push 00000002h loc_00406390: call MSVBVM60.DLL.__vbaFreeVarList loc_00406396: mov ebx, arg_8 loc_00406399: add esp, 0000000Ch loc_0040639C: mov edx, [ebx] loc_0040639E: push ebx loc_0040639F: call [edx+00000334h] loc_004063A5: push eax loc_004063A6: lea eax, var_50 loc_004063A9: push eax loc_004063AA: call [0040103Ch] ; Set (object) loc_004063B0: mov edx, var_3C loc_004063B3: mov esi, eax loc_004063B5: push edx loc_004063B6: push esi loc_004063B7: mov ecx, [esi] loc_004063B9: call [ecx+000000A4h] loc_004063BF: test eax, eax loc_004063C1: fclex loc_004063C3: jnl 4063D7h loc_004063C5: push 000000A4h loc_004063CA: push 004036A0h loc_004063CF: push esi loc_004063D0: push eax loc_004063D1: call MSVBVM60.DLL.__vbaHresultCheckObj loc_004063D7: lea ecx, var_50 loc_004063DA: call MSVBVM60.DLL.__vbaFreeObj loc_004063E0: mov eax, [ebx] loc_004063E2: push ebx loc_004063E3: call [eax+00000338h] loc_004063E9: lea ecx, var_50 loc_004063EC: push eax loc_004063ED: push ecx loc_004063EE: call [0040103Ch] ; Set (object) loc_004063F4: mov esi, eax loc_004063F6: lea eax, var_48 loc_004063F9: push eax loc_004063FA: push esi loc_004063FB: mov edx, [esi] loc_004063FD: call [edx+000000A0h] loc_00406403: test eax, eax loc_00406405: fclex loc_00406407: jnl 40641Bh loc_00406409: push 000000A0h loc_0040640E: push 004036A0h loc_00406413: push esi loc_00406414: push eax loc_00406415: call MSVBVM60.DLL.__vbaHresultCheckObj loc_0040641B: mov ecx, [ebx] loc_0040641D: push ebx loc_0040641E: call [ecx+00000334h] loc_00406424: lea edx, var_54 loc_00406427: push eax loc_00406428: push edx loc_00406429: call [0040103Ch] ; Set (object) loc_0040642F: mov esi, eax loc_00406431: lea ecx, var_4C loc_00406434: push ecx loc_00406435: push esi loc_00406436: mov eax, [esi] loc_00406438: call [eax+000000A0h] loc_0040643E: test eax, eax loc_00406440: fclex loc_00406442: jnl 406456h loc_00406444: push 000000A0h loc_00406449: push 004036A0h loc_0040644E: push esi loc_0040644F: push eax loc_00406450: call MSVBVM60.DLL.__vbaHresultCheckObj loc_00406456: mov edx, var_4C loc_00406459: push edx loc_0040645A: push 004036B4h loc_0040645F: call MSVBVM60.DLL.__vbaStrCmp loc_00406465: mov esi, eax loc_00406467: mov eax, var_48 loc_0040646A: neg esi loc_0040646C: sbb esi, esi loc_0040646E: push eax loc_0040646F: neg esi loc_00406471: push 004036B4h loc_00406476: neg esi loc_00406478: call MSVBVM60.DLL.__vbaStrCmp loc_0040647E: neg eax loc_00406480: sbb eax, eax loc_00406482: lea ecx, var_4C loc_00406485: neg eax loc_00406487: lea edx, var_48 loc_0040648A: push ecx loc_0040648B: neg eax loc_0040648D: push edx loc_0040648E: push 00000002h loc_00406490: and esi, eax loc_00406492: call MSVBVM60.DLL.__vbaFreeStrList loc_00406498: lea eax, var_54 loc_0040649B: lea ecx, var_50 loc_0040649E: push eax loc_0040649F: push ecx loc_004064A0: push 00000002h loc_004064A2: call MSVBVM60.DLL.__vbaFreeObjList loc_004064A8: add esp, 00000018h loc_004064AB: test si, si loc_004064AE: jz 4064ECh loc_004064B0: mov edx, [ebx] loc_004064B2: push ebx loc_004064B3: call [edx+0000032Ch] loc_004064B9: push eax loc_004064BA: lea eax, var_50 loc_004064BD: push eax loc_004064BE: call [0040103Ch] ; Set (object) loc_004064C4: mov esi, eax loc_004064C6: push 00000000h loc_004064C8: push esi loc_004064C9: mov ecx, [esi] loc_004064CB: call [ecx+5Ch] loc_004064CE: test eax, eax loc_004064D0: fclex loc_004064D2: jnl 4064E3h loc_004064D4: push 0000005Ch loc_004064D6: push 004036B8h loc_004064DB: push esi loc_004064DC: push eax loc_004064DD: call MSVBVM60.DLL.__vbaHresultCheckObj loc_004064E3: lea ecx, var_50 loc_004064E6: call MSVBVM60.DLL.__vbaFreeObj loc_004064EC: lea edx, var_2C loc_004064EF: push edx loc_004064F0: call MSVBVM60.DLL.__vbaI4Var loc_004064F6: push eax loc_004064F7: CloseHandle(%x1) loc_004064FC: call edi loc_004064FE: xor ebx, ebx loc_00406500: mov var_4, ebx loc_00406503: push 00406551h loc_00406508: jmp 40653Eh loc_0040650A: lea eax, var_4C loc_0040650D: lea ecx, var_48 loc_00406510: push eax loc_00406511: push ecx loc_00406512: push 00000002h loc_00406514: call MSVBVM60.DLL.__vbaFreeStrList loc_0040651A: lea edx, var_54 loc_0040651D: lea eax, var_50 loc_00406520: push edx loc_00406521: push eax loc_00406522: push 00000002h loc_00406524: call MSVBVM60.DLL.__vbaFreeObjList loc_0040652A: lea ecx, var_74 loc_0040652D: lea edx, var_64 loc_00406530: push ecx loc_00406531: push edx loc_00406532: push 00000002h loc_00406534: call MSVBVM60.DLL.__vbaFreeVarList loc_0040653A: add esp, 00000024h loc_0040653D: ret End Sub или самивб декомпилер лайт ) еще добавлю что апи шпионом выяснилось тот есть гдето цикл с реад процесс мемори где эта зараза ищет некий адресс PS запостил на кряклабе подумал и запостил еще тут )))
