VB程序逆向常用的函数
@轉(zhuǎn)自: http://www.cnblogs.com/bbdxf/p/3780187.html
# 參數(shù)壓棧從右往左，多的參數(shù)是返回值的 buffer 待會(huì)寫(xiě)文
程序逆向常用的函數(shù)
1) 數(shù)據(jù)類型轉(zhuǎn)換:
a) __vbaI2Str??? 將一個(gè)字符串轉(zhuǎn)為8 位（1個(gè)字節(jié)）的數(shù)值形式(范圍在 0 至 255 之間) 或2 個(gè)字節(jié)的數(shù)值形式(范圍在 -32,768 到 32,767 之間)。
b)__vbaI4Str?? 將一個(gè)字符串轉(zhuǎn)為長(zhǎng)整型(4個(gè)字節(jié))的數(shù)值形式(范圍從-2,147,483,6482,147,483,647)
c)__vbar4Str? 將一個(gè)字符串轉(zhuǎn)為單精度單精度浮點(diǎn)型(4個(gè)字節(jié))的數(shù)值形式
d)__vbar8Str?? 將一個(gè)字符串轉(zhuǎn)為雙精度單精度浮點(diǎn)型(8個(gè)字節(jié))的數(shù)值形式
e) VarCyFromStr??? (僅VB6庫(kù). 要調(diào)試，則在WINICE.DAT里必須有 OLEAUT32.DLL)字符串到變比型數(shù)據(jù)類型
f) VarBstrFromI2? (僅VB6庫(kù). 要調(diào)試，則在WINICE.DAT里必須有 OLEAUT32.DLL)整型數(shù)據(jù)到字符串:
2) 數(shù)據(jù)移動(dòng)：
a) __vbaStrCopy????? 將一個(gè)字符串拷貝到內(nèi)存，類似于 Windows API HMEMCPY
b) __vbaVarCopy???? 將一個(gè)變量值串拷貝到內(nèi)存
c) __vbaVarMove??? 變量在內(nèi)存中移動(dòng)，或?qū)⒁粋€(gè)變量值串拷貝到內(nèi)存
3) 數(shù)學(xué)運(yùn)算：
a)? __vbavaradd????? 兩個(gè)變量值相加
b) __vbavarsub????? 第一個(gè)變量減去第二個(gè)變量
c) __vbavarmul???? 兩個(gè)變量值相乘
d) __vbavaridiv???? 第一個(gè)變量除以第二個(gè)變量，得到一個(gè)整數(shù)商
e) __vbavarxor?????? 兩個(gè)變量值做異或運(yùn)算
4) 程序設(shè)計(jì)雜項(xiàng)：
a) __vbavarfornext? 這是VB程序里的循環(huán)結(jié)構(gòu)， For... Next...? (Loop)
b) __vbafreestr??? 釋放出字符串所占的內(nèi)存，也就是把內(nèi)存某個(gè)位置的字符串給抹掉
c) __vbafreeobj?? 釋放出VB一個(gè)對(duì)象(一個(gè)窗口，一個(gè)對(duì)話框)所占的內(nèi)存，也就是把內(nèi)存某個(gè)位置的一個(gè)窗口，一個(gè)對(duì)話框抹掉
d) __vbastrvarval? 從字符串特點(diǎn)位置上獲取其值
e) multibytetowidechar? 將數(shù)據(jù)轉(zhuǎn)換為寬字符格式，VB在處理數(shù)據(jù)之都要這樣做，在TRW2000顯示為7.8.7.8.7.8.7.8
f) rtcMsgBox?? 調(diào)用一個(gè)消息框，類似于WINDOWS里的messagebox/a/exa,此之前一定有個(gè)PUSH命令將要在消息框中顯示的數(shù)據(jù)壓入椎棧
g) __vbavarcat??? 將兩個(gè)變量值相連，如果是兩個(gè)字符串，就連在一起
h) __vbafreevar? 釋放出變量所占的內(nèi)存，也就是把內(nèi)存某個(gè)位置的變量給抹掉
i) __vbaobjset
j)? __vbaLenBstr?? 獲得一個(gè)字符串的長(zhǎng)度，注：VB中一個(gè)漢字的長(zhǎng)度也為1
k) rtcInputBox??? 顯示一個(gè)VB標(biāo)準(zhǔn)的輸入窗口，類似window's API getwindowtext/a, GetDlgItemtext/a
l) __vbaNew????? 調(diào)用顯示一個(gè)對(duì)話框，類似 Windows' API Dialogbox
m) __vbaNew2??? 調(diào)用顯示一個(gè)對(duì)話框，類似 Windows' API Dialogboxparam/a
n) rtcTrimBstr?? 將字串左右兩邊的空格去掉
5) 比較函數(shù)
a)? __vbastrcomp?? 比較兩個(gè)字符串，類似于 Window's API lstrcmp
b)? __vbastrcmp?? 比較兩個(gè)字符串，類似于 Window's API lstrcmp
c) __vbavartsteq? 比較兩個(gè)變量值是否相等
d)__vbaFpCmpCy????????????????? - Compares Floating point to currency. sp;??????????? Compares Floating point to currency
6) 在動(dòng)態(tài)跟蹤，分析算法時(shí)，尤其要注意的函數(shù)：
rtcMidCharVar? 從字符串中取相應(yīng)字符，VB中的MID函數(shù)，用法MID("字符串","開(kāi)始的位置","取幾個(gè)字符")
rtcLeftCharVar 從字符串左邊取相應(yīng)字符，VB中的用法：left("字符串","從左邊開(kāi)始取幾個(gè)字符")
rtcRightCharVar 從字符串右邊取相應(yīng)字符，VB中的用法：Right("字符串","從右邊開(kāi)始取幾個(gè)字符")
__vbaStrCat? 用字符串的操作，就是將兩個(gè)字符串合起來(lái)，在VB中只有一個(gè)&或+
__vbaStrCmp? 字符串比較，在VB中只有一個(gè)=或<>
ASC()函數(shù)??? 取一個(gè)字符的ASC值，在反匯編時(shí)，還是有的movsx 操作數(shù)
7) 在函數(shù)中的縮寫(xiě)：
bool 布爾型數(shù)據(jù)(TRUE 或? FALSE)
str? 字符串型數(shù)據(jù) STRING
i2?? 字節(jié)型數(shù)據(jù)或雙字節(jié)整型數(shù)據(jù)? BYTE or Integer
ui2? 無(wú)符號(hào)雙字節(jié)整型數(shù)據(jù)?
i4?? 長(zhǎng)整型數(shù)據(jù)(4字節(jié))? Long
r4?? 單精度浮點(diǎn)型數(shù)據(jù)(4字節(jié))? Single
r8?? 雙精度浮點(diǎn)型數(shù)據(jù)(8字節(jié))? Double
cy （8 個(gè)字節(jié)）整型的數(shù)值形式 Currency
var? 變量???? Variant
fp 浮點(diǎn)數(shù)據(jù)類型? Float Point
cmp? 比較?? compare
comp 比較?? compare
?
Btw：
__vbavartsteq系列的還有__vbavartstne 不等于
__vbavartstGe,__vbavartstGt,__vbavartstLe,__vbavartstLt等，比較大于或小于
--------------
Variant 變量的內(nèi)部表示:
_______________________________________________________________
符號(hào)常量 值 內(nèi)部表示 字節(jié)數(shù)
V_EMPTY 0 Empty
V_NULL 1 Null
V_INTEGER 2 Interger 2
V_LONG 3 Long 4
V_SINGLE 4 Single 4
V_DOUBLE 5 Double 8
V_CURRENCY 6 Currency 8
V_DATE 7 Date 8
V_STRING 8 String
V_OLE 9 OLE Automation Object
V_ERROR 10 Error
V_BOOLEAN 11 Boolean 2
V_VARIANT 12 Variant(僅用于變體數(shù)組) 16(22)
V_OBJECT 13 Object(非OLE自動(dòng)化對(duì)象) 4
V_BYTE 17 Byte 1
V_ARRAY 8192 Array
________________________________________________________________
__vbaVarMove ;變體變量賦值(一般用于數(shù)值變量)
lea edx,var1 ;變量1的地址放到edx
lea ecx,var2 ;變量2的地址放到ecx
call __vbaVarMove ;把變量1賦值給變量2
;-------------------------------------------------
__vbaVarCopy ;變體變量賦值(一般用于字符串變量)
lea edx,var1 ;變量1的地址放到edx
lea ecx,var2 ;變量2的地址放到ecx
call __vbaVarMove ;把變量1賦值給變量2
;-------------------------------------------------
__vbaVarAdd ;變體變量相加 +
lea eax,var1
push eax ;加數(shù)1
lea ecx,var2
push ecx ;加數(shù)2
lea edx,var3
push edx ;結(jié)果
call __vbaVarAdd ;變量相加，在eax中返回
;-------------------------------------------------
__vbaVarSub ;變體變量相減 -
lea eax,var1
push eax ;被減數(shù)
lea ecx,var2
push ecx ;減數(shù)
lea edx,var3
push edx ;結(jié)果
call __vbaVarSub ;變量相減，在eax中返回
;-------------------------------------------------
__vbaVarMul ;變體變量相乘 *
lea eax,var1
push eax ;被乘數(shù)
lea ecx,var2
push ecx ;乘數(shù)
lea edx,var3
push edx ;結(jié)果
call __vbaVarMul ;變量相乘，在eax中返回
;-------------------------------------------------
__vbaVarDiv ;變體變量相除（浮點(diǎn)除法）/
lea eax,var1
push eax ;被除數(shù)
lea ecx,var2
push ecx ;除數(shù)
lea edx,var3
push edx ;結(jié)果
call __vbaVarDiv ;變量相除，在eax中返回
;------------------------------------------------
__vbaVarIdiv ;變體變量相除（整數(shù)除法）\
lea eax,var1
push eax ;被除數(shù)
lea ecx,var2
push ecx ;除數(shù)
lea edx,var3
push edx ;結(jié)果
call __vbaVarIdiv ;變量相除，在eax中返回
;------------------------------------------------
__vbaVarMod ;變體變量取模運(yùn)算 Mod
lea eax,var1
push eax ;被除數(shù)
lea ecx,var2
push ecx ;除數(shù)
lea edx,var3
push edx ;結(jié)果
call __vbaVarMod ;變量去模，在eax中返回
;------------------------------------------------
__vbaVarNeg ;變體變量前加負(fù)號(hào) -
lea eax,var1
push eax ;變量
lea ecx,var2
push ecx ;結(jié)果
call __vbaVarNeg ;對(duì)變量取補(bǔ)
;------------------------------------------------
__vbaVarPow ;變體變量求冪 ^
lea eax,var1
push eax ;底數(shù)
lea ecx,var2
push ecx ;指數(shù)
lea edx,var3
push edx ;結(jié)果
call __vbaVarPow ;求冪，在eax中返回
;------------------------------------------------
__vbaVarTstGt ;關(guān)系運(yùn)算 >
lea eax,var1
push eax ;變量1
lea eax,var2
push eax ;變量2
call __vbaVarTstGt ;if var1 > var2 then ax = &Hffff
;else ax = 0
;end if
;------------------------------------------------
__vbaVarTstGe ;關(guān)系運(yùn)算 >=
lea eax,var1
push eax ;變量1
lea eax,var2
push eax ;變量2
call __vbaVarTstGe ;if var1 >= var2 then ax = &Hffff
;else ax = 0
;end if
;------------------------------------------------
__vbaVarTstEq ;關(guān)系運(yùn)算 =
lea eax,var1
push eax ;變量1
lea eax,var2
push eax ;變量2
call __vbaVarTstEq ;if var1 = var2 then ax = &Hffff
;else ax = 0
;end if
;------------------------------------------------
__vbaVarTstNe ;關(guān)系運(yùn)算 <>
lea eax,var1
push eax ;變量1
lea eax,var2
push eax ;變量2
call __vbaVarTstNe ;if var1 <> var2 then ax = &Hffff
;else ax = 0
;end if
;------------------------------------------------
__vbaVarTstLt ;關(guān)系運(yùn)算 <
lea eax,var1
push eax ;變量1
lea eax,var2
push eax ;變量2
call __vbaVarTstLt ;if var1 < var2 then ax = &Hffff
;else ax = 0
;end if
;------------------------------------------------
__vbaVarTstLe ;關(guān)系運(yùn)算 <=
lea eax,var1
push eax ;變量1
lea eax,var2
push eax ;變量2
call __vbaVarTstLe ;if var1 <= var2 then ax = &Hffff
;else ax = 0
;end if
;------------------------------------------------
__vbaVarAnd ;邏輯運(yùn)算 And
lea eax,var1
push eax ;變量1
lea ecx,var2
push ecx ;變量2
lea edx,var3
push edx ;結(jié)果
call __vbaVarAnd ;邏輯運(yùn)算,在eax中返回
;------------------------------------------------
__vbaVarOr ;邏輯運(yùn)算 Or
lea eax,var1
push eax ;變量1
lea ecx,var2
push ecx ;變量2
lea edx,var3
push edx ;結(jié)果
call __vbaVarOr ;邏輯運(yùn)算,在eax中返回
;------------------------------------------------
__vbaVarXor ;邏輯運(yùn)算 Xor
lea eax,var1
push eax ;變量1
lea ecx,var2
push ecx ;變量2
lea edx,var3
push edx ;結(jié)果
call __vbaVarXor ;邏輯運(yùn)算,在eax中返回
;------------------------------------------------
__vbaVarEqv ;邏輯運(yùn)算 Eqv
lea eax,var1
push eax ;變量1
lea ecx,var2
push ecx ;變量2
lea edx,var3
push edx ;結(jié)果
call __vbaVarEqv ;邏輯運(yùn)算,在eax中返回
;------------------------------------------------
__vbaVarImp ;邏輯運(yùn)算 Imp
lea eax,var1
push eax ;變量1
lea ecx,var2
push ecx ;變量2
lea edx,var3
push edx ;結(jié)果
call __vbaVarImp ;邏輯運(yùn)算,在eax中返回
;------------------------------------------------
__vbaVarNot ;邏輯運(yùn)算 Not
lea eax,var1
push eax ;變量1
lea ecx,var2
push ecx ;結(jié)果
call __vbaVarNot ;邏輯運(yùn)算,在eax中返回
;------------------------------------------------
;------------------------------------------------下面是函數(shù)
lea eax,var1 ;函數(shù) Abs(num)
push eax ;參數(shù)1 數(shù)值型
lea ecx,var2
push ecx ;結(jié)果
call __vbaVarAbs ;在eax中返回 結(jié)果
;------------------------------------------------
rtcAnsiValueBstr ;函數(shù) Asc(string)
lea eax,var1
push eax ;參數(shù)1 字符串型
call rtcAnsiValueBstr ;結(jié)果在eax中返回 interger
;------------------------------------------------
MSVBVM60.#585 ;函數(shù) Atn(num)
push ecx ;參數(shù) 浮點(diǎn)數(shù),用8個(gè)字節(jié)
push ecx
CALL MSVBVM60.#585 ;結(jié)果在浮點(diǎn)棧中返回
;------------------------------------------------
rtcVarBstrFromAnsi ;函數(shù) Chr(interger)
push eax ;參數(shù)1 整型
call rtcVarBstrFromAnsi ;結(jié)果在eax中返回 string
;------------------------------------------------
rtcCommandVar ;函數(shù) Command() #670
push eax ;參數(shù)1 字符串
call rtcCommandVar ;結(jié)果在eax中返回 string
;------------------------------------------------
rtcCos ;函數(shù) Cos(num) #583
call rtcCos ;輸入?yún)?shù)在當(dāng)前棧頂,8個(gè)字節(jié),注意是浮點(diǎn)型
fstp st ;結(jié)果在浮點(diǎn)棧頂
;------------------------------------------------
rtcCurrentDir ;函數(shù) curdir(string) #647
lea eax,var1 ;參數(shù)1 字符串
push eax
lea edx,var2 ;結(jié)果
push edx
call rtcCurrentDir ;結(jié)果在eax中返回
;-------------------------------------------------
rtcGetDateVar ;函數(shù) Date #610
lea edx,var1 ;結(jié)果
push edx
call rtcGetDateVar ;結(jié)果在eax中返回,日期型(Date)
;-------------------------------------------------
rtcDateAdd ;函數(shù) DateAdd(string,double,date) #661
push date ;8字節(jié)日期date
push double ;8字節(jié)浮點(diǎn)數(shù)double
push string ;1字節(jié)字符的ASCII碼,這里是地址
push var1 ;結(jié)果,日期型(date)
call rtcDateAdd ;結(jié)果在eax中返回,日期型(Date)
;--------------------------------------------------
rtcDateDiff ;函數(shù) DateDiff(string,date1,date2,...,...) #662
push 1 ;默認(rèn)值
push 1 ;默認(rèn)值
lea eax,var1 ;日期2
push eax
lea ecx,var2 ;日期1
push ecx
lea edx,var3 ;字符串
push edx
lea eax,var4 ;結(jié)果
push eax
call rtcDateDiff ;結(jié)果在eax中返回,長(zhǎng)整型(long)
;---------------------------------------------------
rtcDatePart ;函數(shù) DatePart(string,date,...,...) #663
push 1 ;默認(rèn)值
push 1 ;默認(rèn)值
lea eax,var1 ;日期
push eax
lea ecx,var2 ;字符串
push ecx
lea edx,var3 ;結(jié)果
push edx
call rtcDatePart ;結(jié)果在eax中返回
;----------------------------------------------------
rtcPackDate ;函數(shù) DateSerial(integer,integer,integer) #538
lea eax,var1 ;日
push eax
lea ecx,var2 ;月
push ecx
lea edx,var3 ;年
push edx
lea eax,var4 ;結(jié)果
push eax
call rtcPackDate ;結(jié)果在eax中返回,日期型(Date)
;-----------------------------------------------------
rtcGetDateValue ;函數(shù) DateValue(string)
lea eax,var1 ;字符串
push eax
lea edx,var2 ;結(jié)果
push edx
call rtcGetDateValue ;結(jié)果在eax中返回,日期型(Date)
;-----------------------------------------------------
rtcGetDayOfMonth ;函數(shù) Day(date) #542
lea eax,var1 ;日期
push eax
lea ecx,var2 ;結(jié)果
push ecx
call rtcGetDayOfMonth ;結(jié)果在eax中返回,整型
;-----------------------------------------------------
rtcDir ;函數(shù) Dir #645
lea eax, var1 ;屬性
push eax
lea ecx,var2 ;路徑
push ecx
call rtcDir ;結(jié)果在eax中返回,字符串型(string)
;-----------------------------------------------------
rtcExp ;函數(shù) exp #586
LEA EDX,DWORD PTR SS:[EBP-24] ;參數(shù)
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.__vbaR8Var>] ;轉(zhuǎn)換成浮點(diǎn)數(shù),結(jié)果在浮點(diǎn)寄存器里
SUB ESP,8
FSTP QWORD PTR SS:[ESP] ;壓入堆棧
CALL DWORD PTR DS:[<&MSVBVM60.#586>] ;rtcExp
FSTP QWORD PTR SS:[EBP-2C] ;結(jié)果存入堆棧
;-----------------------------------------------------
rtcFileDateTime ;函數(shù) FileDateTime #577
LEA EDX,DWORD PTR SS:[EBP-34]
PUSH 工程1.004016B0 ;文件名
PUSH EDX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#577>] ;rtcFileDateTime
;調(diào)用后結(jié)果同時(shí)在eax中
;------------------------------------------------------
rtcFileLen ;函數(shù) FileLen #578
PUSH 工程1.004016B0 ;文件名
CALL DWORD PTR DS:[<&MSVBVM60.#578>] ;rtcFileLen
;結(jié)果在eax中
;------------------------------------------------------
__vbaVarFix ;函數(shù)Fix(參數(shù)1)
LEA EDX,DWORD PTR SS:[EBP-24]
LEA EAX,DWORD PTR SS:[EBP-54]
PUSH EDX ;參數(shù)1
PUSH EAX ;返回的結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarFix>]
MOV EDX,EAX
;------------------------------------------------------
rtcHexVarFromVar ;函數(shù) Hex(num)
lea eax,var1
push eax ;參數(shù)1 數(shù)值型
lea ecx,var2
push ecx ;存放結(jié)果的參數(shù)
call rtcHexVarFromVar ;在eax中返回string
;------------------------------------------------------
rtcGetHourOfDay ;函數(shù) Hour #543
LEA EAX,DWORD PTR SS:[EBP-34] ;時(shí)間日期型參數(shù)
LEA ECX,DWORD PTR SS:[EBP-44] ;存放結(jié)果的參數(shù)
PUSH EAX
PUSH ECX
CALL DWORD PTR DS:[<&MSVBVM60.#543>] ;Hour
;結(jié)果同時(shí)在eax中返回
;------------------------------------------------------
rtcImmediateIf iif(參數(shù)1,參數(shù)2,參數(shù)3)
LEA EDX,DWORD PTR SS:[EBP-54] ;參數(shù)3
LEA EAX,DWORD PTR SS:[EBP-44] ;參數(shù)2
PUSH EDX
LEA ECX,DWORD PTR SS:[EBP-34] ;參數(shù)1,即表達(dá)式
PUSH EAX
LEA EDX,DWORD PTR SS:[EBP-64] ;存放結(jié)果的參數(shù)
PUSH ECX
PUSH EDX
MOV DWORD PTR SS:[EBP-2C],-1
MOV DWORD PTR SS:[EBP-34],0B
CALL DWORD PTR DS:[<&MSVBVM60.#681>] ;iif
;結(jié)果同時(shí)在eax中返回
;------------------------------------------------------
__vbaInStrVar ;函數(shù) InStr(起始位置,源字符串,目標(biāo)字符串,比較方式)
LEA EDX,DWORD PTR SS:[EBP-24]
PUSH 1 ;起始位置,從1開(kāi)始
LEA EAX,DWORD PTR SS:[EBP-34]
PUSH EDX ;被搜索的字符串
PUSH EAX ;要搜的字符串
LEA ECX,DWORD PTR SS:[EBP-54]
PUSH 1 ;比較方式
PUSH ECX ;返回的結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.__vbaInStrVar>]
MOV EDX,EAX ;結(jié)果同時(shí)在eax中返回
;------------------------------------------------------
rtcInStrRev ;函數(shù) InStrRev(源字符串,目標(biāo)字符串,起始位置,比較方式) #709
XOR ESI,ESI
PUSH ESI ;比較方式
PUSH -1 ;起始位置
LEA EAX,DWORD PTR SS:[EBP-4C]
LEA ECX,DWORD PTR SS:[EBP-24]
PUSH EAX ;目標(biāo)字符串
LEA EDX,DWORD PTR SS:[EBP-48]
PUSH ECX ;源字符串
PUSH EDX ;返回的結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#709>] ;rtcInStrRev
;結(jié)果同時(shí)在eax中返回
;結(jié)果同時(shí)在eax中返回
;------------------------------------------------------
__vbaVarInt ;函數(shù) Int(參數(shù)1)
LEA ECX,DWORD PTR SS:[EBP-24]
LEA EDX,DWORD PTR SS:[EBP-54]
PUSH ECX ;參數(shù)1
PUSH EDX ;返回的結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarInt>]
MOV EDX,EAX ;結(jié)果同時(shí)在eax中返回
;------------------------------------------------------
rtcIsArray ;函數(shù) IsArray #556
LEA EAX,DWORD PTR SS:[EBP-2C] ;參數(shù)1 **這是指針
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#556>] ; MSVBVM60.rtcIsArray
;結(jié)果在eax中返回
;------------------------------------------------------
rtcIsDate ;函數(shù) IsDate #557
LEA EAX,DWORD PTR SS:[EBP-2C] ;參數(shù)1 **這是指針
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#557>]; MSVBVM60.rtcIsDate
;結(jié)果在eax中返回
;------------------------------------------------------
rtcIsEmpty ;函數(shù) IsEmpty #558
LEA EAX,DWORD PTR SS:[EBP-2C] ;參數(shù)1 **這是指針
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#558>] ; MSVBVM60.rtcIsEmpty
;結(jié)果在eax中返回
;------------------------------------------------------
rtcIsError ;函數(shù) IsError #559
LEA EAX,DWORD PTR SS:[EBP-2C] ;參數(shù)1 **這是指針
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#559>] ; MSVBVM60.rtcIsError
;結(jié)果在eax中返回
;------------------------------------------------------
rtcIsMissing ;函數(shù) IsMissing #592
LEA EAX,DWORD PTR SS:[EBP-2C] ;參數(shù)1 **這是指針
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#592>] ; MSVBVM60.rtcIsMissing
;結(jié)果在eax中返回
;------------------------------------------------------
rtcIsNull ;函數(shù) IsNull #560
LEA EAX,DWORD PTR SS:[EBP-2C] ;參數(shù)1 **這是指針
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#560>] ;MSVBVM60.rtcIsNull
;結(jié)果在eax中返回
;------------------------------------------------------
rtcIsNumeric ;函數(shù) IsNumeric #561
LEA EAX,DWORD PTR SS:[EBP-2C] ;參數(shù)1 **這里指針
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#561>];MSVBVM60.rtcIsNumeric
;結(jié)果在eax中返回
;------------------------------------------------------
rtcIsObject ;函數(shù) IsObject #562
LEA EAX,DWORD PTR SS:[EBP-2C]
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#562>] ;MSVBVM60.rtcIsObject
;結(jié)果在eax中返回
;------------------------------------------------------
__vbaLbound ;函數(shù) Lbound
LEA EAX,DWORD PTR SS:[EBP-2C] ;參數(shù)1,數(shù)組
PUSH EAX
PUSH 1 ;參數(shù)2,數(shù)組維數(shù)
CALL DWORD PTR DS:[<&MSVBVM60.__vbaLboun>; MSVBVM60.__vbaLbound
;結(jié)果在eax中返回
;------------------------------------------------------
rtcLowerCaseVar ;函數(shù) Lcase #518
LEA EDX,DWORD PTR SS:[EBP-24] ;參數(shù)1
LEA EAX,DWORD PTR SS:[EBP-48] ;結(jié)果
PUSH EDX
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#518>] ;MSVBVM60.rtcLowerCaseVar
;結(jié)果在eax中返回
;------------------------------------------------------
rtcLeftCharVar ;函數(shù) Left #617
LEA EDX,DWORD PTR SS:[EBP-24] ;參數(shù)1
PUSH 3 ;參數(shù)2
LEA EAX,DWORD PTR SS:[EBP-48] ;結(jié)果
PUSH EDX
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#617>];MSVBVM60.rtcLeftCharVar
;結(jié)果在eax中返回
;------------------------------------------------------
__vbaLenBstr ;函數(shù) Len
MOV EDX,DWORD PTR SS:[EBP-18] ;參數(shù)1
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.__vbaLenBs>; MSVBVM60.__vbaLenBstr
;結(jié)果在eax中返回
;------------------------------------------------------
__vbaLenBstrB ;函數(shù) LenB
MOV EAX,DWORD PTR SS:[EBP-18] ;參數(shù)1
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.__vbaLenBs>; MSVBVM60.__vbaLenBstrB
;結(jié)果在eax中返回
;------------------------------------------------------
rtcLog ;函數(shù) Log #587
LEA EDX,DWORD PTR SS:[EBP-38] ;要作為參數(shù)的變量
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.__vbaR8Var> ;轉(zhuǎn)換成實(shí)數(shù),結(jié)果在浮點(diǎn)棧中
SUB ESP,8
FSTP QWORD PTR SS:[ESP] ;參數(shù)入棧
CALL DWORD PTR DS:[<&MSVBVM60.#587>] ; MSVBVM60.rtcLog
;結(jié)果在浮點(diǎn)棧中
;------------------------------------------------------
rtcLeftTrimVar ;函數(shù) Ltrim #522
LEA ECX,DWORD PTR SS:[EBP-68] ;參數(shù)1
LEA EDX,DWORD PTR SS:[EBP-58] ;結(jié)果
PUSH ECX
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.#522>] ; MSVBVM60.rtcLeftTrimVar
;結(jié)果在eax中返回
;------------------------------------------------------
rtcMidCharVar ;函數(shù) Mid
PUSH EAX ;參數(shù)3
LEA ECX,DWORD PTR SS:[EBP-58]
PUSH 3 ;參數(shù)2
LEA EDX,DWORD PTR SS:[EBP-48]
PUSH ECX ;參數(shù)1
PUSH EDX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#632>];MSVBVM60.rtcMidCharVar
;結(jié)果在eax中返回
;------------------------------------------------------
rtcGetMinuteOfHour ;函數(shù) Minute #544
LEA EAX,DWORD PTR SS:[EBP-24] ;參數(shù)1
LEA ECX,DWORD PTR SS:[EBP-64] ;結(jié)果
PUSH EAX
PUSH ECX
CALL DWORD PTR DS:[<&MSVBVM60.#544>] ;MSVBVM60.rtcGetMinuteOfHour
;結(jié)果在eax中返回
;------------------------------------------------------
rtcGetMonthOfYear ;函數(shù) Month #545
LEA EDX,DWORD PTR SS:[EBP-24] ;參數(shù)1
LEA EAX,DWORD PTR SS:[EBP-64] ;結(jié)果
PUSH EDX
PUSH EAX
CALL DWORD PTR DS:[<&MSVBVM60.#545>] ;MSVBVM60.rtcGetMonthOfYear
;結(jié)果在eax中返回
;------------------------------------------------------
rtcMonthName ;函數(shù) MonthName #707
PUSH EAX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#707>] ;MSVBVM60.rtcMonthName
;結(jié)果在eax中返回
;------------------------------------------------------
rtcMsgBox ;函數(shù) MsgBox
LEA EAX,DWORD PTR SS:[EBP-64]
LEA ECX,DWORD PTR SS:[EBP-54]
PUSH EAX ;參數(shù)5
LEA EDX,DWORD PTR SS:[EBP-34]
PUSH ECX ;參數(shù)4
PUSH EDX ;參數(shù)3
LEA EAX,DWORD PTR SS:[EBP-24]
PUSH ESI ;參數(shù)2
PUSH EAX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#595>]; MSVBVM60.rtcMsgBox
;結(jié)果在eax中返回
;------------------------------------------------------
rtcGetPresentDate ;函數(shù) Now #546
LEA EDX,DWORD PTR SS:[EBP-34] ;存放結(jié)果的參數(shù)
PUSH EDX ;
CALL DWORD PTR DS:[<&MSVBVM60.#546>] ;Now
;結(jié)果同時(shí)在eax中返回
;------------------------------------------------------
rtcOctVarFromVar ;函數(shù) Oct(num)
lea eax,var1
push eax ;參數(shù)1 數(shù)值型
lea ecx,var2
push ecx ;結(jié)果
call rtcOctVarFromVar ;在eax中返回string
;------------------------------------------------------
rtcReplace ;函數(shù) Replace #712
PUSH ESI ;參數(shù)6
PUSH -1 ;參數(shù)5
PUSH 1 ;參數(shù)4
LEA EAX,DWORD PTR SS:[EBP-60]
PUSH EAX ;參數(shù)3
LEA EDX,DWORD PTR SS:[EBP-5C]
PUSH EDX ;參數(shù)2
LEA EAX,DWORD PTR SS:[EBP-24]
PUSH EAX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#712>]; MSVBVM60.rtcReplace
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcRgb ;函數(shù) #588
PUSH 28 ;參數(shù)3
PUSH 1E ;參數(shù)2
PUSH 14 ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#588>]; MSVBVM60.rtcRgb
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcRightCharVar ;函數(shù)Right #619
LEA EDX,DWORD PTR SS:[EBP-24]
PUSH 3 ;參數(shù)2
LEA EAX,DWORD PTR SS:[EBP-44]
PUSH EDX ;參數(shù)1
PUSH EAX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#619>];MSVBVM60.rtcRightCharVar
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcRound ;函數(shù) Round #714
LEA EDX,DWORD PTR SS:[EBP-24]
PUSH EDI ;參數(shù)2
LEA EAX,DWORD PTR SS:[EBP-44]
PUSH EDX ;參數(shù)1
PUSH EAX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#714>] ;MSVBVM60.rtcRound
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcRandomize ;函數(shù) Randomize #594
LEA EDX,DWORD PTR SS:[EBP-34]
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.#594>] ; MSVBVM60.rtcRandomize
;-----------------------------------------------------
rtcRandomNext ;函數(shù) Rnd #593
LEA EAX,DWORD PTR SS:[EBP-34]
PUSH EAX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#593>] ; MSVBVM60.rtcRandomNext
;結(jié)果在浮點(diǎn)棧中
;-----------------------------------------------------
rtcRightTrimVar ;函數(shù) Rtrim #524
LEA ECX,DWORD PTR SS:[EBP-68] ;參數(shù)1
LEA EDX,DWORD PTR SS:[EBP-58] ;結(jié)果
PUSH ECX
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.#524>] ; MSVBVM60.rtcRightTrimVar
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcGetSecondOfMinute ;函數(shù) Sound #547
LEA EAX,DWORD PTR SS:[EBP-24] ;參數(shù)1
LEA ECX,DWORD PTR SS:[EBP-44] ;結(jié)果
PUSH EAX
PUSH ECX
CALL DWORD PTR DS:[<&MSVBVM60.#547>];MSVBVM60.rtcGetSecondOfMinute
;結(jié)果在eax中返回
;-----------------------------------------------------
__vbaR8Sgn ;函數(shù) Sgn
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.__vbaR8Var>;MSVBVM60.__vbaR8Var
SUB ESP,8
FSTP QWORD PTR SS:[ESP] ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaR8Sgn>;MSVBVM60.__vbaR8Sgn
;結(jié)果在ax中返回
;-----------------------------------------------------
rtcShell ;函數(shù) Shell #600
PUSH 1 ;參數(shù)2
PUSH EDX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#600>];MSVBVM60.rtcShell
;結(jié)果在浮點(diǎn)棧中
;-----------------------------------------------------
rtcSin ;函數(shù) Sin #582
LEA EDX,DWORD PTR SS:[EBP-24]
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.__vbaR8Var>;MSVBVM60.__vbaR8Var
SUB ESP,8
FSTP QWORD PTR SS:[ESP] ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#582>] ;MSVBVM60.rtcSin
;結(jié)果在浮點(diǎn)棧中
;-----------------------------------------------------
rtcSpaceVar ;函數(shù) Space #526
PUSH 5 ;參數(shù)1
LEA EDX,DWORD PTR SS:[EBP-34]
PUSH EDX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#526>]; MSVBVM60.rtcSpaceVar
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcSplit ;函數(shù) Split #711
PUSH ESI ;參數(shù)4
LEA EDX,DWORD PTR SS:[EBP-48]
PUSH -1 ;參數(shù)3
LEA EAX,DWORD PTR SS:[EBP-24]
PUSH EDX ;參數(shù)2
LEA ECX,DWORD PTR SS:[EBP-38]
LEA EDX,DWORD PTR SS:[EBP-58]
PUSH EAX ;參數(shù)1
PUSH EDX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#711>] ;MSVBVM60.rtcSplit
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcSqr ;函數(shù) rtcSqr #614
LEA EDX,DWORD PTR SS:[EBP-24]
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.__vbaR8Var>;MSVBVM60.__vbaR8Var
SUB ESP,8
FSTP QWORD PTR SS:[ESP] ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#614>] ;MSVBVM60.rtcSqr
;結(jié)果在浮點(diǎn)棧中
;-----------------------------------------------------
rtcVarStrFromVar ;函數(shù) Str #613
LEA EDX,DWORD PTR SS:[EBP-24]
LEA EAX,DWORD PTR SS:[EBP-44]
PUSH EDX ;參數(shù)1
PUSH EAX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#613>] ;MSVBVM60.rtcVarStrFromVar
;結(jié)果在eax中返回
;-----------------------------------------------------
__vbaStrCompVar ;函數(shù) StrComp
LEA EDX,DWORD PTR SS:[EBP-24]
LEA EAX,DWORD PTR SS:[EBP-34]
PUSH EDX ;參數(shù)1
PUSH EAX ;參數(shù)2
LEA ECX,DWORD PTR SS:[EBP-54]
PUSH EDI ;參數(shù)3
PUSH ECX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCo>;MSVBVM60.__vbaStrCompVar
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcStrConvVar2 ;函數(shù) Strconv #717
PUSH EDI ;參數(shù)3
LEA EDX,DWORD PTR SS:[EBP-24]
PUSH 1 ;參數(shù)2
LEA EAX,DWORD PTR SS:[EBP-44]
PUSH EDX ;參數(shù)1
PUSH EAX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#717>]; MSVBVM60.rtcStrConvVar2
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcStringVar ;函數(shù) String
LEA EDX,DWORD PTR SS:[EBP-24]
LEA EAX,DWORD PTR SS:[EBP-44]
PUSH EDX ;參數(shù)2
PUSH 5 ;參數(shù)1
PUSH EAX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#607>];MSVBVM60.rtcStringVar
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcStrReverse ;函數(shù) StrReverse #713
LEA EAX,DWORD PTR SS:[EBP-38]
PUSH EAX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#713>] ;MSVBVM60.rtcStrReverse
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcTan ;函數(shù) Tan #584
LEA EDX,DWORD PTR SS:[EBP-24]
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.__vbaR8Var>;MSVBVM60.__vbaR8Var
SUB ESP,8
FSTP QWORD PTR SS:[ESP] ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#584>] ;MSVBVM60.rtcTan
;結(jié)果在浮點(diǎn)棧中返回
;-----------------------------------------------------
rtcGetTimeVar ;函數(shù) Time #612
LEA EDX,DWORD PTR SS:[EBP-34]
PUSH EDX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#612>];MSVBVM60.rtcGetTimeVar
;結(jié)果在eax中返回
-------------------------------------------------------
rtcGetTimer ;函數(shù) Timer #535
CALL DWORD PTR DS:[<&MSVBVM60.#535>] ; MSVBVM60.rtcGetTimer
;結(jié)果在浮點(diǎn)棧中返回
;-----------------------------------------------------
rtcPackTime ;函數(shù) TimeSerial #539
LEA EDX,DWORD PTR SS:[EBP-44]
PUSH EDX ;參數(shù)3
LEA EAX,DWORD PTR SS:[EBP-34]
PUSH EAX ;參數(shù)2
LEA ECX,DWORD PTR SS:[EBP-24]
PUSH ECX ;參數(shù)1
LEA EDX,DWORD PTR SS:[EBP-64]
PUSH EDX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#539>] ;MSVBVM60.rtcPackTime
;結(jié)果在eax中返回
-------------------------------------------------------
rtcGetTimeValue ;函數(shù) TimeValue #541
LEA EAX,DWORD PTR SS:[EBP-38]
LEA ECX,DWORD PTR SS:[EBP-48]
PUSH EAX ;參數(shù)1
PUSH ECX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#541>] ;MSVBVM60.rtcGetTimeValue
;結(jié)果在eax中返回
-------------------------------------------------------
rtcTrimVar ;函數(shù) Trim #520
LEA ECX,DWORD PTR SS:[EBP-68] ;參數(shù)1
LEA EDX,DWORD PTR SS:[EBP-58] ;結(jié)果
PUSH ECX
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
;結(jié)果在eax中返回
-------------------------------------------------------
rtcTypeName ;函數(shù) TypeName #591
LEA EDX,DWORD PTR SS:[EBP-24]
PUSH EDX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#591>];MSVBVM60.rtcTypeName
;結(jié)果在eax中返回
-------------------------------------------------------
__vbaUbound ;函數(shù) Ubound
LEA ECX,DWORD PTR SS:[EBP-2C] ;參數(shù)1,數(shù)組
PUSH ECX
PUSH 1 ;參數(shù)2,數(shù)組維數(shù)
CALL DWORD PTR DS:[<&MSVBVM60.__vbaUboun>;MSVBVM60.__vbaUbound
;結(jié)果在eax中返回
;------------------------------------------------------
rtcUpperCaseVar ;函數(shù) Ucase
LEA ECX,DWORD PTR SS:[EBP-24] ;參數(shù)1
LEA EDX,DWORD PTR SS:[EBP-48] ;結(jié)果
PUSH ECX
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.#528>] ;MSVBVM60.rtcUpperCaseVar
;結(jié)果在eax中返回
;------------------------------------------------------
rtcR8ValFromBstr ;函數(shù) Val #581
LEA EAX,DWORD PTR SS:[EBP-38]
PUSH EAX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#581>];MSVBVM60.rtcR8ValFromBstr
;結(jié)果在浮點(diǎn)棧中
;-----------------------------------------------------
rtcVarType ;函數(shù) VarType #563
LEA EDX,DWORD PTR SS:[EBP-24]
PUSH EDX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.#563>];MSVBVM60.rtcVarType
;結(jié)果在eax中
;-----------------------------------------------------
rtcWeekdayName ;函數(shù) WeekdayName #706
PUSH EDI
LEA EDX,DWORD PTR SS:[EBP-24]
PUSH EDI
PUSH EDX
CALL DWORD PTR DS:[<&MSVBVM60.#706>];MSVBVM60.rtcWeekdayName
;結(jié)果在eax中
;-----------------------------------------------------
rtcGetYear ;函數(shù) Year #553
LEA EAX,DWORD PTR SS:[EBP-24]
LEA ECX,DWORD PTR SS:[EBP-44]
PUSH EAX ;參數(shù)1
PUSH ECX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#553>];MSVBVM60.rtcGetYear
;結(jié)果在eax中
;-----------------------------------------------------
__vbaBoolErrVar ;函數(shù) CBool
LEA EDX,DWORD PTR SS:[EBP-74]
PUSH EDX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaBoolE>; MSVBVM60.__vbaBoolErrVar
;結(jié)果在ax中
;-----------------------------------------------------
__vbaUI1ErrVar ;函數(shù) Cbyte
LEA EAX,DWORD PTR SS:[EBP-74]
PUSH EAX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaUI1Er>; MSVBVM60.__vbaUI1ErrVar
;結(jié)果在al中
;-----------------------------------------------------
__vbaCyErrVar ;函數(shù) Ccur
LEA ECX,DWORD PTR SS:[EBP-74]
PUSH ECX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaCyErr>; MSVBVM60.__vbaCyErrVar
;結(jié)果在eax中
;-----------------------------------------------------
__vbaDateVar ;函數(shù) Cdate
LEA EDX,DWORD PTR SS:[EBP-74]
PUSH EDX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaDateV>; MSVBVM60.__vbaDateVar
SUB ESP,8
FSTP QWORD PTR SS:[ESP]
CALL DWORD PTR DS:[<&MSVBVM60.__vbaDateR>; MSVBVM60.__vbaDateR8
;結(jié)果在浮點(diǎn)棧中
;-----------------------------------------------------
__vbaR8ErrVar ;函數(shù) Cdbl
LEA EAX,DWORD PTR SS:[EBP-74]
PUSH EAX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaR8Err>; MSVBVM60.__vbaR8ErrVar
;結(jié)果在浮點(diǎn)棧中
;-----------------------------------------------------
rtDecFromVar ;函數(shù) Cdec #564
LEA ECX,DWORD PTR SS:[EBP-F4]
LEA EDX,DWORD PTR SS:[EBP-74]
PUSH ECX ;參數(shù)1
PUSH EDX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#564>] ; MSVBVM60.rtDecFromVar
;結(jié)果在eax中
;-----------------------------------------------------
__vbaI2ErrVar ;函數(shù) Cint
LEA EAX,DWORD PTR SS:[EBP-74]
PUSH EAX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaI2Err>; MSVBVM60.__vbaI2ErrVar
;結(jié)果在ax中
;-----------------------------------------------------
__vbaI4ErrVar ;函數(shù) Clng
LEA ECX,DWORD PTR SS:[EBP-74]
PUSH ECX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaI4Err>; MSVBVM60.__vbaI4ErrVar
;結(jié)果在eax中
;-----------------------------------------------------
__vbaR4ErrVar ;函數(shù) Csng
LEA EDX,DWORD PTR SS:[EBP-74]
PUSH EDX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaR4Err>; MSVBVM60.__vbaR4ErrVar
;結(jié)果在浮點(diǎn)棧中
;-----------------------------------------------------
__vbaStrErrVarCopy ;函數(shù) Cstr
LEA EAX,DWORD PTR SS:[EBP-74]
PUSH EAX ;參數(shù)1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrEr>; MSVBVM60.__vbaStrErrVarCopy
;結(jié)果在eax中
;-----------------------------------------------------
__vbaVarCopy ;函數(shù) Cvar
LEA EDX,DWORD PTR SS:[EBP-74] ;參數(shù)1
LEA ECX,DWORD PTR SS:[EBP-54] ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarCo>; MSVBVM60.__vbaVarCopy
;結(jié)果在eax中
;-----------------------------------------------------
__vbaFileOpen ;Open語(yǔ)句
PUSH 工程1.004014C0 ;文件名
PUSH 1 ;文件號(hào)
PUSH 1 ;len
PUSH 320 ;for,access,lock
CALL DWORD PTR DS:[<&MSVBVM60.__vbaFileO>; MSVBVM60.__vbaFileOpen
;------------------------------------------------------
__vbaFileClose ;Close語(yǔ)句
PUSH 1 ;文件號(hào)
CALL DWORD PTR DS:[<&MSVBVM60.__vbaFileC>; MSVBVM60.__vbaFileClose
;------------------------------------------------------
rtcFreeFile ;函數(shù) FreeFile
LEA EAX,DWORD PTR SS:[EBP-34]
PUSH EAX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#648>]; MSVBVM60.rtcFreeFile
;結(jié)果在ax中
;------------------------------------------------------
rtcFileLength ;函數(shù) LOF #570
LEA EDX,DWORD PTR SS:[EBP-34]
PUSH EDX ;文件號(hào)
CALL DWORD PTR DS:[<&MSVBVM60.#570>]; MSVBVM60.rtcFileLength
;結(jié)果在eax中
;------------------------------------------------------
rtcFileLocation ;函數(shù) loc #569
LEA EAX,DWORD PTR SS:[EBP-34]
PUSH EAX ;文件號(hào)
CALL DWORD PTR DS:[<&MSVBVM60.#569>]; MSVBVM60.rtcFileLocation
;結(jié)果在eax中
;------------------------------------------------------
rtcFileAttributes ;函數(shù) FileAttr #555
LEA ECX,DWORD PTR SS:[EBP-34]
PUSH 1 ;屬性
PUSH ECX ;文件號(hào)
CALL DWORD PTR DS:[<&MSVBVM60.#555>]; MSVBVM60.rtcFileAttributes
;結(jié)果在eax中
;------------------------------------------------------
__vbaPrintFile ;Print #文件號(hào),變量 (順序文件操作)
LEA EAX,DWORD PTR SS:[EBP-24]
LEA ECX,DWORD PTR SS:[EBP-34]
PUSH ECX ;變量
PUSH EAX ;文件號(hào)
PUSH 工程1.00401948
CALL DWORD PTR DS:[<&MSVBVM60.__vbaPrint>;MSVBVM60.__vbaPrintFile
;-----------------------------------------------------
__vbaWriteFile ;write #文件號(hào),變量 (順序文件操作)
LEA EDX,DWORD PTR SS:[EBP-24]
LEA EAX,DWORD PTR SS:[EBP-34]
PUSH EDX ;變量
PUSH EAX ;文件號(hào)
PUSH 工程1.00401948
CALL DWORD PTR DS:[<&MSVBVM60.__vbaWrite>;MSVBVM60.__vbaWriteFile
;-----------------------------------------------------
__vbaInputFile ;input #文件號(hào),變量 (順序文件操作)
LEA EAX,DWORD PTR SS:[EBP-24]
LEA ECX,DWORD PTR SS:[EBP-34]
PUSH EAX ;變量
PUSH ECX ;文件號(hào)
PUSH 工程1.00401938
CALL DWORD PTR DS:[<&MSVBVM60.__vbaInput>; MSVBVM60.__vbaInputFile
;-----------------------------------------------------
__vbaLineInputVar ;line input #文件號(hào),變量 (順序文件操作)
LEA EDX,DWORD PTR SS:[EBP-34]
PUSH EDX ;文件號(hào)
LEA EAX,DWORD PTR SS:[EBP-44]
PUSH EAX ;變量
CALL DWORD PTR DS:[<&MSVBVM60.__vbaLineI>; MSVBVM60.__vbaLineInputVar
;結(jié)果在eax中返回
;-----------------------------------------------------
rtcInputCharCountVar ;函數(shù) input(#文件號(hào),長(zhǎng)度) #621 (順序文件操作)
LEA ECX,DWORD PTR SS:[EBP-34]
PUSH ECX ;文件號(hào)
LEA EDX,DWORD PTR SS:[EBP-64]
PUSH 2 ;長(zhǎng)度
PUSH EDX ;結(jié)果
CALL DWORD PTR DS:[<&MSVBVM60.#621>]; MSVBVM60.rtcInputCharCountVar
;結(jié)果在eax中返回
;-----------------------------------------------------
__vbaPut4 ;語(yǔ)句 Put 文件號(hào),位置,變量 (binary文件操作)
LEA EAX,DWORD PTR SS:[EBP-34]
PUSH EAX ;文件號(hào)
LEA ECX,DWORD PTR SS:[EBP-24]
PUSH 2 ;位置
PUSH ECX ;變量
PUSH -1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaPut4>>;MSVBVM60.__vbaPut4
;-----------------------------------------------------
__vbaFileSeek ;語(yǔ)句 Seek 文件號(hào),位置 (binary文件操作)
LEA EDX,DWORD PTR SS:[EBP-34]
PUSH EDX ;文件號(hào)
PUSH 2 ;位置
CALL DWORD PTR DS:[<&MSVBVM60.__vbaFileS>;MSVBVM60.__vbaFileSeek
;-----------------------------------------------------
__vbaGet4 ;語(yǔ)句 Get 文件號(hào),位置,變量 (binary文件操作)
LEA EAX,DWORD PTR SS:[EBP-34]
PUSH EAX ;文件號(hào)
LEA ECX,DWORD PTR SS:[EBP-44]
PUSH 2 ;位置
PUSH ECX ;變量
PUSH -1
CALL DWORD PTR DS:[<&MSVBVM60.__vbaGet4>>;MSVBVM60.__vbaGet4
--------------------
variant結(jié)構(gòu), 和vartype enum
vb中如果不顯示的定義數(shù)據(jù)類型, 并且沒(méi)有加
Option Explicit的話, 那么定義的變量為variant.
variant的結(jié)構(gòu)的前2個(gè)字節(jié)描述了類型, 后面有3個(gè)word的保留.
接著為值.
enum VARENUM
??? {? VT_EMPTY? = 0,
? VT_NULL? = 1,
? VT_I2? = 2,
? VT_I4? = 3,
? VT_R4? = 4,
? VT_R8? = 5,
? VT_CY? = 6,
? VT_DATE? = 7,
? VT_BSTR? = 8,
? VT_DISPATCH? = 9,
? VT_ERROR? = 10,
? VT_BOOL? = 11,
? VT_VARIANT? = 12,
? VT_UNKNOWN? = 13,
? VT_DECIMAL? = 14,
? VT_I1? = 16,
? VT_UI1? = 17,
? VT_UI2? = 18,
? VT_UI4? = 19,
? VT_I8? = 20,
? VT_UI8? = 21,
? VT_INT? = 22,
? VT_UINT? = 23,
? VT_VOID? = 24,
? VT_HRESULT? = 25,
? VT_PTR? = 26,
? VT_SAFEARRAY? = 27,
? VT_CARRAY? = 28,
? VT_USERDEFINED? = 29,
? VT_LPSTR? = 30,
? VT_LPWSTR? = 31,
? VT_RECORD? = 36,
? VT_INT_PTR? = 37,
? VT_UINT_PTR? = 38,
? VT_FILETIME? = 64,
? VT_BLOB? = 65,
? VT_STREAM? = 66,
? VT_STORAGE? = 67,
? VT_STREAMED_OBJECT? = 68,
? VT_STORED_OBJECT? = 69,
? VT_BLOB_OBJECT? = 70,
? VT_CF? = 71,
? VT_CLSID? = 72,
? VT_VERSIONED_STREAM? = 73,
? VT_BSTR_BLOB? = 0xfff,
? VT_VECTOR? = 0x1000,
? VT_ARRAY? = 0x2000,
? VT_BYREF? = 0x4000,
? VT_RESERVED? = 0x8000,
? VT_ILLEGAL? = 0xffff,
? VT_ILLEGALMASKED? = 0xfff,
? VT_TYPEMASK? = 0xfff
??? } ;
struct tagVARIANT
??? {
??? union
??????? {
??????? struct __tagVARIANT
??????????? {
??????????? VARTYPE vt;
??????????? WORD wReserved1;
??????????? WORD wReserved2;
??????????? WORD wReserved3;
??????????? union
??????????????? {
??????????????? LONGLONG llVal;
??????????????? LONG lVal;
??????????????? BYTE bVal;
??????????????? SHORT iVal;
??????????????? FLOAT fltVal;
??????????????? DOUBLE dblVal;
??????????????? VARIANT_BOOL boolVal;
??????????????? _VARIANT_BOOL bool;
??????????????? SCODE scode;
??????????????? CY cyVal;
??????????????? DATE date;
??????????????? BSTR bstrVal;
??????????????? IUnknown *punkVal;
??????????????? IDispatch *pdispVal;
??????????????? SAFEARRAY *parray;
??????????????? BYTE *pbVal;
??????????????? SHORT *piVal;
??????????????? LONG *plVal;
??????????????? LONGLONG *pllVal;
??????????????? FLOAT *pfltVal;
??????????????? DOUBLE *pdblVal;
??????????????? VARIANT_BOOL *pboolVal;
??????????????? _VARIANT_BOOL *pbool;
??????????????? SCODE *pscode;
??????????????? CY *pcyVal;
??????????????? DATE *pdate;
??????????????? BSTR *pbstrVal;
??????????????? IUnknown **ppunkVal;
??????????????? IDispatch **ppdispVal;
??????????????? SAFEARRAY **pparray;
??????????????? VARIANT *pvarVal;
??????????????? PVOID byref;
??????????????? CHAR cVal;
??????????????? USHORT uiVal;
??????????????? ULONG ulVal;
??????????????? ULONGLONG ullVal;
??????????????? INT intVal;
??????????????? UINT uintVal;
??????????????? DECIMAL *pdecVal;
??????????????? CHAR *pcVal;
??????????????? USHORT *puiVal;
??????????????? ULONG *pulVal;
??????????????? ULONGLONG *pullVal;
??????????????? INT *pintVal;
??????????????? UINT *puintVal;
??????????????? struct __tagBRECORD
??????????????????? {
??????????????????? PVOID pvRecord;
??????????????????? IRecordInfo *pRecInfo;
??????????????????? }?? __VARIANT_NAME_4;
??????????????? }?? __VARIANT_NAME_3;
??????????? }?? __VARIANT_NAME_2;
??????? DECIMAL decVal;
??????? }?? __VARIANT_NAME_1;
??? } ;
總結(jié)
以上是生活随笔為你收集整理的VB程序逆向常用的函数的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。
- 上一篇： 逆向入门--代码段的介绍
- 下一篇： 逆向入门--简单win32CK逆向手记