小鬼当家财务通 0650注册算法分析
【破文标题】小鬼当家财务通 0650注册算法分析【软件名称】小鬼当家财务通 0650
------------------------------------------------------------------------
004A53C0 > \55 PUSH EBP
004A53C1 .8BEC MOV EBP,ESP
004A53C3 .83EC 0C SUB ESP,0C
004A53C6 .68 F6394000 PUSH <JMP.&MSVBVM60.__vbaExceptHandler>;SE 处理程序安装
004A53CB .64:A1 0000000>MOV EAX,DWORD PTR FS:
004A53D1 .50 PUSH EAX
004A53D2 .64:8925 00000>MOV DWORD PTR FS:,ESP
004A53D9 .81EC F0000000 SUB ESP,0F0
004A53DF .53 PUSH EBX
004A53E0 .56 PUSH ESI
004A53E1 .57 PUSH EDI
004A53E2 .8965 F4 MOV DWORD PTR SS:,ESP
004A53E5 .C745 F8 28274>MOV DWORD PTR SS:,Gremlin.0040272>
004A53EC .8B75 08 MOV ESI,DWORD PTR SS:
004A53EF .8BC6 MOV EAX,ESI
004A53F1 .83E0 01 AND EAX,1
004A53F4 .8945 FC MOV DWORD PTR SS:,EAX
004A53F7 .83E6 FE AND ESI,FFFFFFFE
004A53FA .56 PUSH ESI
004A53FB .8975 08 MOV DWORD PTR SS:,ESI
004A53FE .8B0E MOV ECX,DWORD PTR DS:
004A5400 .FF51 04 CALL DWORD PTR DS:
004A5403 .8B16 MOV EDX,DWORD PTR DS:
004A5405 .33DB XOR EBX,EBX
004A5407 .53 PUSH EBX
004A5408 .53 PUSH EBX
004A5409 .56 PUSH ESI
004A540A .895D E8 MOV DWORD PTR SS:,EBX
004A540D .895D E4 MOV DWORD PTR SS:,EBX
004A5410 .895D E0 MOV DWORD PTR SS:,EBX
004A5413 .895D DC MOV DWORD PTR SS:,EBX
004A5416 .895D D8 MOV DWORD PTR SS:,EBX
004A5419 .895D D4 MOV DWORD PTR SS:,EBX
004A541C .895D C4 MOV DWORD PTR SS:,EBX
004A541F .895D B4 MOV DWORD PTR SS:,EBX
004A5422 .895D A4 MOV DWORD PTR SS:,EBX
004A5425 .895D 94 MOV DWORD PTR SS:,EBX
004A5428 .895D 84 MOV DWORD PTR SS:,EBX
004A542B .899D 74FFFFFF MOV DWORD PTR SS:,EBX
004A5431 .899D 64FFFFFF MOV DWORD PTR SS:,EBX
004A5437 .899D 54FFFFFF MOV DWORD PTR SS:,EBX
004A543D .899D 44FFFFFF MOV DWORD PTR SS:,EBX
004A5443 .FF92 30030000 CALL DWORD PTR DS:
004A5449 .50 PUSH EAX
004A544A .8D45 D4 LEA EAX,DWORD PTR SS:
004A544D .50 PUSH EAX
004A544E .FF15 C0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004A5454 .8B3D 78114000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaLa>;MSVBVM60.__vbaLateIdCallLd
004A545A .8D4D C4 LEA ECX,DWORD PTR SS:
004A545D .50 PUSH EAX
004A545E .51 PUSH ECX
004A545F .FFD7 CALL EDI ;<&MSVBVM60.__vbaLateIdCallLd>
004A5461 .83C4 10 ADD ESP,10
004A5464 .50 PUSH EAX
004A5465 .FF15 30104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>;MSVBVM60.__vbaStrVarMove
004A546B .8945 BC MOV DWORD PTR SS:,EAX
004A546E .8D55 B4 LEA EDX,DWORD PTR SS:
004A5471 .8D45 A4 LEA EAX,DWORD PTR SS:
004A5474 .52 PUSH EDX
004A5475 .50 PUSH EAX
004A5476 .C745 B4 08000>MOV DWORD PTR SS:,8
004A547D .FF15 EC104000 CALL DWORD PTR DS:[<&MSVBVM60.#520>] ;MSVBVM60.rtcTrimVar
004A5483 .8D4D A4 LEA ECX,DWORD PTR SS:
004A5486 .8D95 64FFFFFF LEA EDX,DWORD PTR SS:
004A548C .51 PUSH ECX
004A548D .52 PUSH EDX
004A548E .C785 6CFFFFFF>MOV DWORD PTR SS:,Gremlin.004185>
004A5498 .C785 64FFFFFF>MOV DWORD PTR SS:,8008
004A54A2 .FF15 4C114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarTs>;MSVBVM60.__vbaVarTstEq
004A54A8 .8D4D D4 LEA ECX,DWORD PTR SS:
004A54AB .66:8985 40FFF>MOV WORD PTR SS:,AX
004A54B2 .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A54B8 .8D45 A4 LEA EAX,DWORD PTR SS:
004A54BB .8D4D B4 LEA ECX,DWORD PTR SS:
004A54BE .50 PUSH EAX
004A54BF .8D55 C4 LEA EDX,DWORD PTR SS:
004A54C2 .51 PUSH ECX
004A54C3 .52 PUSH EDX
004A54C4 .6A 03 PUSH 3
004A54C6 .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A54CC .83C4 10 ADD ESP,10
004A54CF .66:399D 40FFF>CMP WORD PTR SS:,BX
004A54D6 .0F84 BC000000 JE Gremlin.004A5598
004A54DC .68 00E64100 PUSH Gremlin.0041E600 ;UNICODE "Err057"
004A54E1 .E8 2A4CFDFF CALL Gremlin.0047A110
004A54E6 .8BD0 MOV EDX,EAX
004A54E8 .8D4D D8 LEA ECX,DWORD PTR SS:
004A54EB .FF15 E0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;MSVBVM60.__vbaStrMove
004A54F1 .8B06 MOV EAX,DWORD PTR DS:
004A54F3 .8D4D DC LEA ECX,DWORD PTR SS:
004A54F6 .51 PUSH ECX
004A54F7 .56 PUSH ESI
004A54F8 .FF50 50 CALL DWORD PTR DS:
004A54FB .3BC3 CMP EAX,EBX
004A54FD .DBE2 FCLEX
004A54FF .7D 0F JGE SHORT Gremlin.004A5510
004A5501 .6A 50 PUSH 50
004A5503 .68 E88D4100 PUSH Gremlin.00418DE8
004A5508 .56 PUSH ESI
004A5509 .50 PUSH EAX
004A550A .FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004A5510 >B8 04000280 MOV EAX,80020004
004A5515 .B9 0A000000 MOV ECX,0A
004A551A .8945 9C MOV DWORD PTR SS:,EAX
004A551D .8945 AC MOV DWORD PTR SS:,EAX
004A5520 .8B45 DC MOV EAX,DWORD PTR SS:
004A5523 .894D 94 MOV DWORD PTR SS:,ECX
004A5526 .8945 BC MOV DWORD PTR SS:,EAX
004A5529 .8B45 D8 MOV EAX,DWORD PTR SS:
004A552C .894D A4 MOV DWORD PTR SS:,ECX
004A552F .B9 08000000 MOV ECX,8
004A5534 .8945 CC MOV DWORD PTR SS:,EAX
004A5537 .8D55 94 LEA EDX,DWORD PTR SS:
004A553A .894D B4 MOV DWORD PTR SS:,ECX
004A553D .894D C4 MOV DWORD PTR SS:,ECX
004A5540 .8D45 A4 LEA EAX,DWORD PTR SS:
004A5543 .52 PUSH EDX
004A5544 .8D4D B4 LEA ECX,DWORD PTR SS:
004A5547 .50 PUSH EAX
004A5548 .51 PUSH ECX
004A5549 .8D55 C4 LEA EDX,DWORD PTR SS:
004A554C .6A 20 PUSH 20
004A554E .52 PUSH EDX
004A554F .895D DC MOV DWORD PTR SS:,EBX
004A5552 .895D D8 MOV DWORD PTR SS:,EBX
004A5555 .FF15 C4104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>] ;MSVBVM60.rtcMsgBox
004A555B .8D4D D8 LEA ECX,DWORD PTR SS:
004A555E .FF15 08134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
004A5564 .8D45 94 LEA EAX,DWORD PTR SS:
004A5567 .8D4D A4 LEA ECX,DWORD PTR SS:
004A556A .50 PUSH EAX
004A556B .8D55 B4 LEA EDX,DWORD PTR SS:
004A556E .51 PUSH ECX
004A556F .8D45 C4 LEA EAX,DWORD PTR SS:
004A5572 .52 PUSH EDX
004A5573 .50 PUSH EAX
004A5574 .6A 04 PUSH 4
004A5576 .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A557C .8B0E MOV ECX,DWORD PTR DS:
004A557E .83C4 14 ADD ESP,14
004A5581 .53 PUSH EBX
004A5582 .68 00100180 PUSH 80011000
004A5587 .56 PUSH ESI
004A5588 .FF91 30030000 CALL DWORD PTR DS:
004A558E .8D55 D4 LEA EDX,DWORD PTR SS:
004A5591 .50 PUSH EAX
004A5592 .52 PUSH EDX
004A5593 .E9 53060000 JMP Gremlin.004A5BEB
004A5598 >8B06 MOV EAX,DWORD PTR DS:
004A559A .53 PUSH EBX
004A559B .53 PUSH EBX
004A559C .56 PUSH ESI
004A559D .FF90 30030000 CALL DWORD PTR DS:
004A55A3 .8D4D D4 LEA ECX,DWORD PTR SS:
004A55A6 .50 PUSH EAX
004A55A7 .51 PUSH ECX
004A55A8 .FF15 C0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004A55AE .8D55 C4 LEA EDX,DWORD PTR SS:
004A55B1 .50 PUSH EAX
004A55B2 .52 PUSH EDX
004A55B3 .FFD7 CALL EDI
004A55B5 .83C4 10 ADD ESP,10
004A55B8 .50 PUSH EAX
004A55B9 .FF15 30104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>;MSVBVM60.__vbaStrVarMove
004A55BF .8945 BC MOV DWORD PTR SS:,EAX
004A55C2 .8D45 B4 LEA EAX,DWORD PTR SS:
004A55C5 .8D4D A4 LEA ECX,DWORD PTR SS:
004A55C8 .50 PUSH EAX
004A55C9 .51 PUSH ECX
004A55CA .C745 B4 08000>MOV DWORD PTR SS:,8
004A55D1 .FF15 EC104000 CALL DWORD PTR DS:[<&MSVBVM60.#520>] ;MSVBVM60.rtcTrimVar
004A55D7 .8D55 94 LEA EDX,DWORD PTR SS:
004A55DA .6A 0D PUSH 0D
004A55DC .52 PUSH EDX
004A55DD .FF15 E4114000 CALL DWORD PTR DS:[<&MSVBVM60.#608>] ;MSVBVM60.rtcVarBstrFromAnsi
004A55E3 .8B3D 0C124000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaSt>;MSVBVM60.__vbaStrVarVal
004A55E9 .53 PUSH EBX
004A55EA .6A FF PUSH -1
004A55EC .6A 01 PUSH 1
004A55EE .8D45 94 LEA EAX,DWORD PTR SS:
004A55F1 .68 30854100 PUSH Gremlin.00418530
004A55F6 .8D4D D8 LEA ECX,DWORD PTR SS:
004A55F9 .50 PUSH EAX
004A55FA .51 PUSH ECX
004A55FB .FFD7 CALL EDI ;<&MSVBVM60.__vbaStrVarVal>
004A55FD .50 PUSH EAX
004A55FE .8D55 A4 LEA EDX,DWORD PTR SS:
004A5601 .8D45 DC LEA EAX,DWORD PTR SS:
004A5604 .52 PUSH EDX
004A5605 .50 PUSH EAX
004A5606 .FFD7 CALL EDI
004A5608 .50 PUSH EAX
004A5609 .FF15 C4114000 CALL DWORD PTR DS:[<&MSVBVM60.#712>] ;MSVBVM60.rtcReplace
004A560F .8B3D E0124000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaSt>;MSVBVM60.__vbaStrMove
004A5615 .8BD0 MOV EDX,EAX
004A5617 .8D4D E8 LEA ECX,DWORD PTR SS:
004A561A .FFD7 CALL EDI ;<&MSVBVM60.__vbaStrMove>
004A561C .8D4D D8 LEA ECX,DWORD PTR SS:
004A561F .8D55 DC LEA EDX,DWORD PTR SS:
004A5622 .51 PUSH ECX
004A5623 .52 PUSH EDX
004A5624 .6A 02 PUSH 2
004A5626 .FF15 6C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
004A562C .83C4 0C ADD ESP,0C
004A562F .8D4D D4 LEA ECX,DWORD PTR SS:
004A5632 .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A5638 .8D45 94 LEA EAX,DWORD PTR SS:
004A563B .8D4D A4 LEA ECX,DWORD PTR SS:
004A563E .50 PUSH EAX
004A563F .8D55 B4 LEA EDX,DWORD PTR SS:
004A5642 .51 PUSH ECX
004A5643 .8D45 C4 LEA EAX,DWORD PTR SS:
004A5646 .52 PUSH EDX
004A5647 .50 PUSH EAX
004A5648 .6A 04 PUSH 4
004A564A .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A5650 .83C4 14 ADD ESP,14
004A5653 .8D4D C4 LEA ECX,DWORD PTR SS:
004A5656 .6A 0A PUSH 0A
004A5658 .51 PUSH ECX
004A5659 .FF15 E4114000 CALL DWORD PTR DS:[<&MSVBVM60.#608>] ;MSVBVM60.rtcVarBstrFromAnsi
004A565F .53 PUSH EBX
004A5660 .6A FF PUSH -1
004A5662 .6A 01 PUSH 1
004A5664 .8D55 C4 LEA EDX,DWORD PTR SS:
004A5667 .68 30854100 PUSH Gremlin.00418530
004A566C .8D45 DC LEA EAX,DWORD PTR SS:
004A566F .52 PUSH EDX
004A5670 .50 PUSH EAX
004A5671 .FF15 0C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>;MSVBVM60.__vbaStrVarVal
004A5677 .8B4D E8 MOV ECX,DWORD PTR SS:
004A567A .50 PUSH EAX
004A567B .51 PUSH ECX
004A567C .FF15 C4114000 CALL DWORD PTR DS:[<&MSVBVM60.#712>] ;MSVBVM60.rtcReplace
004A5682 .8945 BC MOV DWORD PTR SS:,EAX
004A5685 .8D55 B4 LEA EDX,DWORD PTR SS:
004A5688 .8D45 A4 LEA EAX,DWORD PTR SS:
004A568B .52 PUSH EDX
004A568C .50 PUSH EAX
004A568D .C745 B4 08000>MOV DWORD PTR SS:,8
004A5694 .FF15 34114000 CALL DWORD PTR DS:[<&MSVBVM60.#528>] ;MSVBVM60.rtcUpperCaseVar
004A569A .8D4D A4 LEA ECX,DWORD PTR SS:
004A569D .51 PUSH ECX
004A569E .FF15 30104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>;MSVBVM60.__vbaStrVarMove
004A56A4 .8BD0 MOV EDX,EAX
004A56A6 .8D4D E8 LEA ECX,DWORD PTR SS:
004A56A9 .FFD7 CALL EDI
004A56AB .8D4D DC LEA ECX,DWORD PTR SS:
004A56AE .FF15 08134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
004A56B4 .8D55 A4 LEA EDX,DWORD PTR SS:
004A56B7 .8D45 B4 LEA EAX,DWORD PTR SS:
004A56BA .52 PUSH EDX
004A56BB .8D4D C4 LEA ECX,DWORD PTR SS:
004A56BE .50 PUSH EAX
004A56BF .51 PUSH ECX
004A56C0 .6A 03 PUSH 3
004A56C2 .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A56C8 .8B55 E8 MOV EDX,DWORD PTR SS:
004A56CB .83C4 10 ADD ESP,10
004A56CE .52 PUSH EDX
004A56CF .FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaLenBs>;MSVBVM60.__vbaLenBstr
004A56D5 .83F8 0B CMP EAX,0B
004A56D8 .0F84 B1000000 JE Gremlin.004A578F
004A56DE .68 14E64100 PUSH Gremlin.0041E614 ;UNICODE "Err058"
004A56E3 .E8 284AFDFF CALL Gremlin.0047A110
004A56E8 .8BD0 MOV EDX,EAX
004A56EA .8D4D DC LEA ECX,DWORD PTR SS:
004A56ED .FFD7 CALL EDI
004A56EF .68 28E64100 PUSH Gremlin.0041E628 ;UNICODE "Err060"
004A56F4 .E8 174AFDFF CALL Gremlin.0047A110
004A56F9 .8BD0 MOV EDX,EAX
004A56FB .8D4D D8 LEA ECX,DWORD PTR SS:
004A56FE .FFD7 CALL EDI
004A5700 .B8 04000280 MOV EAX,80020004
004A5705 .B9 0A000000 MOV ECX,0A
004A570A .8945 9C MOV DWORD PTR SS:,EAX
004A570D .8945 AC MOV DWORD PTR SS:,EAX
004A5710 .8B45 D8 MOV EAX,DWORD PTR SS:
004A5713 .894D 94 MOV DWORD PTR SS:,ECX
004A5716 .8945 BC MOV DWORD PTR SS:,EAX
004A5719 .8B45 DC MOV EAX,DWORD PTR SS:
004A571C .894D A4 MOV DWORD PTR SS:,ECX
004A571F .B9 08000000 MOV ECX,8
004A5724 .8945 CC MOV DWORD PTR SS:,EAX
004A5727 .894D B4 MOV DWORD PTR SS:,ECX
004A572A .894D C4 MOV DWORD PTR SS:,ECX
004A572D .8D45 94 LEA EAX,DWORD PTR SS:
004A5730 .8D4D A4 LEA ECX,DWORD PTR SS:
004A5733 .50 PUSH EAX
004A5734 .8D55 B4 LEA EDX,DWORD PTR SS:
004A5737 .51 PUSH ECX
004A5738 .52 PUSH EDX
004A5739 .8D45 C4 LEA EAX,DWORD PTR SS:
004A573C .6A 30 PUSH 30
004A573E .50 PUSH EAX
004A573F .895D D8 MOV DWORD PTR SS:,EBX
004A5742 .895D DC MOV DWORD PTR SS:,EBX
004A5745 .FF15 C4104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>] ;MSVBVM60.rtcMsgBox
004A574B .8D4D D8 LEA ECX,DWORD PTR SS:
004A574E .8D55 DC LEA EDX,DWORD PTR SS:
004A5751 .51 PUSH ECX
004A5752 .52 PUSH EDX
004A5753 .6A 02 PUSH 2
004A5755 .FF15 6C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
004A575B .8D45 94 LEA EAX,DWORD PTR SS:
004A575E .8D4D A4 LEA ECX,DWORD PTR SS:
004A5761 .50 PUSH EAX
004A5762 .8D55 B4 LEA EDX,DWORD PTR SS:
004A5765 .51 PUSH ECX
004A5766 .8D45 C4 LEA EAX,DWORD PTR SS:
004A5769 .52 PUSH EDX
004A576A .50 PUSH EAX
004A576B .6A 04 PUSH 4
004A576D .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A5773 .8B0E MOV ECX,DWORD PTR DS:
004A5775 .83C4 20 ADD ESP,20
004A5778 .53 PUSH EBX
004A5779 .68 00100180 PUSH 80011000
004A577E .56 PUSH ESI
004A577F .FF91 30030000 CALL DWORD PTR DS:
004A5785 .8D55 D4 LEA EDX,DWORD PTR SS:
004A5788 .50 PUSH EAX
004A5789 .52 PUSH EDX
004A578A .E9 5C040000 JMP Gremlin.004A5BEB
004A578F >A0 6E604D00 MOV AL,BYTE PTR DS:
004A5794 .8B4D E8 MOV ECX,DWORD PTR SS:
004A5797 .3C 04 CMP AL,4
004A5799 .898D 5CFFFFFF MOV DWORD PTR SS:,ECX
004A579F .1BC0 SBB EAX,EAX
004A57A1 .8D95 64FFFFFF LEA EDX,DWORD PTR SS:
004A57A7 .F7D8 NEG EAX
004A57A9 .F7D8 NEG EAX
004A57AB .8D4D C4 LEA ECX,DWORD PTR SS:
004A57AE .66:8985 4CFFF>MOV WORD PTR SS:,AX
004A57B5 .C785 44FFFFFF>MOV DWORD PTR SS:,0B
004A57BF .C785 54FFFFFF>MOV DWORD PTR SS:,8008
004A57C9 .C785 6CFFFFFF>MOV DWORD PTR SS:,Gremlin.00418F>;UNICODE "FredGremlin"
004A57D3 .C785 64FFFFFF>MOV DWORD PTR SS:,8
004A57DD .FF15 B8124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarDu>;MSVBVM60.__vbaVarDup
004A57E3 .8D55 C4 LEA EDX,DWORD PTR SS:
004A57E6 .8D45 B4 LEA EAX,DWORD PTR SS:
004A57E9 .52 PUSH EDX
004A57EA .50 PUSH EAX
004A57EB .FF15 34114000 CALL DWORD PTR DS:[<&MSVBVM60.#528>] ;MSVBVM60.rtcUpperCaseVar
004A57F1 .8D8D 44FFFFFF LEA ECX,DWORD PTR SS:
004A57F7 .8D95 54FFFFFF LEA EDX,DWORD PTR SS:
004A57FD .51 PUSH ECX
004A57FE .8D45 B4 LEA EAX,DWORD PTR SS:
004A5801 .52 PUSH EDX
004A5802 .8D4D A4 LEA ECX,DWORD PTR SS:
004A5805 .50 PUSH EAX
004A5806 .51 PUSH ECX
004A5807 .FF15 98124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarCm>;MSVBVM60.__vbaVarCmpEq
004A580D .8D55 94 LEA EDX,DWORD PTR SS:
004A5810 .50 PUSH EAX
004A5811 .52 PUSH EDX
004A5812 .FF15 A4114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarAn>;MSVBVM60.__vbaVarAnd
004A5818 .50 PUSH EAX
004A5819 .FF15 F8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaBoolV>;MSVBVM60.__vbaBoolVarNull
004A581F .66:8985 40FFF>MOV WORD PTR SS:,AX
004A5826 .8D85 44FFFFFF LEA EAX,DWORD PTR SS:
004A582C .8D4D B4 LEA ECX,DWORD PTR SS:
004A582F .50 PUSH EAX
004A5830 .8D55 C4 LEA EDX,DWORD PTR SS:
004A5833 .51 PUSH ECX
004A5834 .52 PUSH EDX
004A5835 .6A 03 PUSH 3
004A5837 .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A583D .83C4 10 ADD ESP,10
004A5840 .66:399D 40FFF>CMP WORD PTR SS:,BX
004A5847 .0F84 91000000 JE Gremlin.004A58DE
004A584D .8B45 E8 MOV EAX,DWORD PTR SS:
004A5850 .50 PUSH EAX
004A5851 .68 488F4100 PUSH Gremlin.00418F48 ;UNICODE "RgeKey"
004A5856 .68 B8864100 PUSH Gremlin.004186B8 ;UNICODE "Login"
004A585B .68 A4864100 PUSH Gremlin.004186A4 ;UNICODE "MyAcct"
004A5860 .FF15 10104000 CALL DWORD PTR DS:[<&MSVBVM60.#690>] ;MSVBVM60.rtcSaveSetting
004A5866 .B9 03000000 MOV ECX,3
004A586B .FF15 98114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaUI1I2>;MSVBVM60.__vbaUI1I2
004A5871 .A2 6E604D00 MOV BYTE PTR DS:,AL
004A5876 .A1 14614D00 MOV EAX,DWORD PTR DS:
004A587B .3BC3 CMP EAX,EBX
004A587D .75 15 JNZ SHORT Gremlin.004A5894
004A587F .68 14614D00 PUSH Gremlin.004D6114
004A5884 .68 A8084100 PUSH Gremlin.004108A8
004A5889 .FF15 48124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaNew2>>;MSVBVM60.__vbaNew2
004A588F .A1 14614D00 MOV EAX,DWORD PTR DS:
004A5894 >8B08 MOV ECX,DWORD PTR DS:
004A5896 .50 PUSH EAX
004A5897 .FF91 60030000 CALL DWORD PTR DS:
004A589D .8D55 D4 LEA EDX,DWORD PTR SS:
004A58A0 .50 PUSH EAX
004A58A1 .52 PUSH EDX
004A58A2 .FF15 C0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004A58A8 .8B08 MOV ECX,DWORD PTR DS:
004A58AA .53 PUSH EBX
004A58AB .50 PUSH EAX
004A58AC .8985 40FFFFFF MOV DWORD PTR SS:,EAX
004A58B2 .FF51 5C CALL DWORD PTR DS:
004A58B5 .3BC3 CMP EAX,EBX
004A58B7 .DBE2 FCLEX
004A58B9 .7D 15 JGE SHORT Gremlin.004A58D0
004A58BB .8B95 40FFFFFF MOV EDX,DWORD PTR SS:
004A58C1 .6A 5C PUSH 5C
004A58C3 .68 F8D84100 PUSH Gremlin.0041D8F8
004A58C8 .52 PUSH EDX
004A58C9 .50 PUSH EAX
004A58CA .FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004A58D0 >8D4D D4 LEA ECX,DWORD PTR SS:
004A58D3 .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A58D9 .E9 B3010000 JMP Gremlin.004A5A91
004A58DE >8B55 E8 MOV EDX,DWORD PTR SS:
004A58E1 .6A 01 PUSH 1
004A58E3 .52 PUSH EDX
004A58E4 .68 D08F4100 PUSH Gremlin.00418FD0
004A58E9 .53 PUSH EBX
004A58EA .FF15 3C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaInStr>;MSVBVM60.__vbaInStr
004A58F0 .85C0 TEST EAX,EAX
004A58F2 .C785 6CFFFFFF>MOV DWORD PTR SS:,Gremlin.00417F>;UNICODE "0650"
004A58FC .C785 64FFFFFF>MOV DWORD PTR SS:,8
004A5906 .8D95 64FFFFFF LEA EDX,DWORD PTR SS:
004A590C .8D4D C4 LEA ECX,DWORD PTR SS:
004A590F .0F85 F4020000 JNZ Gremlin.004A5C09
004A5915 .FF15 B8124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarDu>;MSVBVM60.__vbaVarDup
004A591B .8D45 C4 LEA EAX,DWORD PTR SS:
004A591E .6A 03 PUSH 3
004A5920 .8D4D B4 LEA ECX,DWORD PTR SS:
004A5923 .50 PUSH EAX
004A5924 .51 PUSH ECX
004A5925 .FF15 D0124000 CALL DWORD PTR DS:[<&MSVBVM60.#617>] ;MSVBVM60.rtcLeftCharVar
004A592B .8B45 E4 MOV EAX,DWORD PTR SS:
004A592E .C785 5CFFFFFF>MOV DWORD PTR SS:,Gremlin.004182>;UNICODE "G-"
004A5938 .3BC3 CMP EAX,EBX
004A593A .C785 54FFFFFF>MOV DWORD PTR SS:,8
004A5944 .75 12 JNZ SHORT Gremlin.004A5958
004A5946 .8D55 E4 LEA EDX,DWORD PTR SS:
004A5949 .52 PUSH EDX
004A594A .68 58904100 PUSH Gremlin.00419058
004A594F .FF15 48124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaNew2>>;MSVBVM60.__vbaNew2
004A5955 .8B45 E4 MOV EAX,DWORD PTR SS:
004A5958 >8B08 MOV ECX,DWORD PTR DS:
004A595A .8D55 DC LEA EDX,DWORD PTR SS:
004A595D .52 PUSH EDX
004A595E .50 PUSH EAX
004A595F .8985 40FFFFFF MOV DWORD PTR SS:,EAX
004A5965 .FF51 24 CALL DWORD PTR DS:
004A5968 .3BC3 CMP EAX,EBX
004A596A .DBE2 FCLEX
004A596C .7D 15 JGE SHORT Gremlin.004A5983
004A596E .8B8D 40FFFFFF MOV ECX,DWORD PTR SS:
004A5974 .6A 24 PUSH 24
004A5976 .68 48904100 PUSH Gremlin.00419048
004A597B .51 PUSH ECX
004A597C .50 PUSH EAX
004A597D .FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004A5983 >8B45 DC MOV EAX,DWORD PTR SS:
004A5986 .8D55 B4 LEA EDX,DWORD PTR SS:
004A5989 .8945 9C MOV DWORD PTR SS:,EAX
004A598C .8D85 54FFFFFF LEA EAX,DWORD PTR SS:
004A5992 .52 PUSH EDX
004A5993 .8D4D A4 LEA ECX,DWORD PTR SS:
004A5996 .50 PUSH EAX
004A5997 .51 PUSH ECX
004A5998 .895D DC MOV DWORD PTR SS:,EBX
004A599B .C745 94 08000>MOV DWORD PTR SS:,8
004A59A2 .FF15 10124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarCa>;MSVBVM60.__vbaVarCat
004A59A8 .50 PUSH EAX
004A59A9 .8D55 94 LEA EDX,DWORD PTR SS:
004A59AC .8D45 84 LEA EAX,DWORD PTR SS:
004A59AF .52 PUSH EDX
004A59B0 .50 PUSH EAX
004A59B1 .FF15 10124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarCa>;MSVBVM60.__vbaVarCat
004A59B7 .8D8D 74FFFFFF LEA ECX,DWORD PTR SS:
004A59BD .50 PUSH EAX
004A59BE .51 PUSH ECX
004A59BF .FF15 34114000 CALL DWORD PTR DS:[<&MSVBVM60.#528>] ;MSVBVM60.rtcUpperCaseVar
004A59C5 .8D95 74FFFFFF LEA EDX,DWORD PTR SS:
004A59CB .8D45 D8 LEA EAX,DWORD PTR SS:
004A59CE .52 PUSH EDX
004A59CF .50 PUSH EAX
004A59D0 .FF15 0C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>;MSVBVM60.__vbaStrVarVal
004A59D6 .50 PUSH EAX
004A59D7 .E8 540B0000 CALL Gremlin.004A6530
004A59DC .8BD0 MOV EDX,EAX
004A59DE .8D4D E0 LEA ECX,DWORD PTR SS:
004A59E1 .FFD7 CALL EDI
004A59E3 .8D4D D8 LEA ECX,DWORD PTR SS:
004A59E6 .FF15 08134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
004A59EC .8D8D 74FFFFFF LEA ECX,DWORD PTR SS:
004A59F2 .8D55 84 LEA EDX,DWORD PTR SS:
004A59F5 .51 PUSH ECX
004A59F6 .8D45 94 LEA EAX,DWORD PTR SS:
004A59F9 .52 PUSH EDX
004A59FA .8D4D A4 LEA ECX,DWORD PTR SS:
004A59FD .50 PUSH EAX
004A59FE .8D55 B4 LEA EDX,DWORD PTR SS:
004A5A01 .51 PUSH ECX
004A5A02 .8D45 C4 LEA EAX,DWORD PTR SS:
004A5A05 .52 PUSH EDX
004A5A06 .50 PUSH EAX
004A5A07 .6A 06 PUSH 6
004A5A09 .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A5A0F .8B4D E0 MOV ECX,DWORD PTR SS:
004A5A12 .83C4 1C ADD ESP,1C
004A5A15 .51 PUSH ECX
004A5A16 .E8 E50C0000 CALL Gremlin.004A6700
004A5A1B .8BD0 MOV EDX,EAX
004A5A1D .8D4D DC LEA ECX,DWORD PTR SS:
004A5A20 .FFD7 CALL EDI
004A5A22 .8B55 E8 MOV EDX,DWORD PTR SS:
004A5A25 .50 PUSH EAX
004A5A26 .52 PUSH EDX
004A5A27 .E8 D40C0000 CALL Gremlin.004A6700
004A5A2C .8BD0 MOV EDX,EAX
004A5A2E .8D4D D8 LEA ECX,DWORD PTR SS:
004A5A31 .FFD7 CALL EDI
004A5A33 .50 PUSH EAX
004A5A34 .FF15 44114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>;MSVBVM60.__vbaStrCmp
004A5A3A .F7D8 NEG EAX
004A5A3C .1BC0 SBB EAX,EAX
004A5A3E .8D4D DC LEA ECX,DWORD PTR SS:
004A5A41 .40 INC EAX
004A5A42 .F7D8 NEG EAX
004A5A44 .66:8985 40FFF>MOV WORD PTR SS:,AX
004A5A4B .8D45 D8 LEA EAX,DWORD PTR SS:
004A5A4E .50 PUSH EAX
004A5A4F .51 PUSH ECX
004A5A50 .6A 02 PUSH 2
004A5A52 .FF15 6C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
004A5A58 .83C4 0C ADD ESP,0C
004A5A5B .66:399D 40FFF>CMP WORD PTR SS:,BX
004A5A62 .0F84 D7000000 JE Gremlin.004A5B3F
004A5A68 .8B55 E8 MOV EDX,DWORD PTR SS:
004A5A6B .52 PUSH EDX
004A5A6C .68 488F4100 PUSH Gremlin.00418F48 ;UNICODE "RgeKey"
004A5A71 .68 B8864100 PUSH Gremlin.004186B8 ;UNICODE "Login"
004A5A76 .68 A4864100 PUSH Gremlin.004186A4 ;UNICODE "MyAcct"
004A5A7B .FF15 10104000 CALL DWORD PTR DS:[<&MSVBVM60.#690>] ;MSVBVM60.rtcSaveSetting
004A5A81 .B9 06000000 MOV ECX,6
004A5A86 .FF15 98114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaUI1I2>;MSVBVM60.__vbaUI1I2
004A5A8C .A2 6E604D00 MOV BYTE PTR DS:,AL
004A5A91 >68 3CE64100 PUSH Gremlin.0041E63C ;UNICODE "Err059"
004A5A96 .E8 7546FDFF CALL Gremlin.0047A110
004A5A9B .8BD0 MOV EDX,EAX
004A5A9D .8D4D DC LEA ECX,DWORD PTR SS:
004A5AA0 .FFD7 CALL EDI
004A5AA2 .68 50E64100 PUSH Gremlin.0041E650 ;UNICODE "Err061"
004A5AA7 .E8 6446FDFF CALL Gremlin.0047A110
004A5AAC .8BD0 MOV EDX,EAX
004A5AAE .8D4D D8 LEA ECX,DWORD PTR SS:
004A5AB1 .FFD7 CALL EDI
004A5AB3 .B8 04000280 MOV EAX,80020004
004A5AB8 .B9 0A000000 MOV ECX,0A
004A5ABD .8945 9C MOV DWORD PTR SS:,EAX
004A5AC0 .8945 AC MOV DWORD PTR SS:,EAX
004A5AC3 .8B45 D8 MOV EAX,DWORD PTR SS:
004A5AC6 .894D 94 MOV DWORD PTR SS:,ECX
004A5AC9 .8945 BC MOV DWORD PTR SS:,EAX
004A5ACC .8B45 DC MOV EAX,DWORD PTR SS:
004A5ACF .894D A4 MOV DWORD PTR SS:,ECX
004A5AD2 .B9 08000000 MOV ECX,8
004A5AD7 .8945 CC MOV DWORD PTR SS:,EAX
004A5ADA .894D B4 MOV DWORD PTR SS:,ECX
004A5ADD .894D C4 MOV DWORD PTR SS:,ECX
004A5AE0 .8D45 94 LEA EAX,DWORD PTR SS:
004A5AE3 .8D4D A4 LEA ECX,DWORD PTR SS:
004A5AE6 .50 PUSH EAX
004A5AE7 .8D55 B4 LEA EDX,DWORD PTR SS:
004A5AEA .51 PUSH ECX
004A5AEB .52 PUSH EDX
004A5AEC .8D45 C4 LEA EAX,DWORD PTR SS:
004A5AEF .6A 20 PUSH 20
004A5AF1 .50 PUSH EAX
004A5AF2 .895D D8 MOV DWORD PTR SS:,EBX
004A5AF5 .895D DC MOV DWORD PTR SS:,EBX
004A5AF8 .FF15 C4104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>] ;MSVBVM60.rtcMsgBox
004A5AFE .8D4D D8 LEA ECX,DWORD PTR SS:
004A5B01 .8D55 DC LEA EDX,DWORD PTR SS:
004A5B04 .51 PUSH ECX
004A5B05 .52 PUSH EDX
004A5B06 .6A 02 PUSH 2
004A5B08 .FF15 6C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
004A5B0E .8D45 94 LEA EAX,DWORD PTR SS:
004A5B11 .8D4D A4 LEA ECX,DWORD PTR SS:
004A5B14 .50 PUSH EAX
004A5B15 .8D55 B4 LEA EDX,DWORD PTR SS:
004A5B18 .51 PUSH ECX
004A5B19 .8D45 C4 LEA EAX,DWORD PTR SS:
004A5B1C .52 PUSH EDX
004A5B1D .50 PUSH EAX
004A5B1E .6A 04 PUSH 4
004A5B20 .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A5B26 .8B0E MOV ECX,DWORD PTR DS:
004A5B28 .83C4 20 ADD ESP,20
004A5B2B .56 PUSH ESI
004A5B2C .FF91 00070000 CALL DWORD PTR DS:
004A5B32 .3BC3 CMP EAX,EBX
004A5B34 .0F8D 65030000 JGE Gremlin.004A5E9F
004A5B3A .E9 4E030000 JMP Gremlin.004A5E8D
004A5B3F >68 14E64100 PUSH Gremlin.0041E614 ;UNICODE "Err058"
004A5B44 .E8 C745FDFF CALL Gremlin.0047A110
004A5B49 .8BD0 MOV EDX,EAX
004A5B4B .8D4D DC LEA ECX,DWORD PTR SS:
004A5B4E .FFD7 CALL EDI
004A5B50 .68 28E64100 PUSH Gremlin.0041E628 ;UNICODE "Err060"
004A5B55 .E8 B645FDFF CALL Gremlin.0047A110
004A5B5A .8BD0 MOV EDX,EAX
004A5B5C .8D4D D8 LEA ECX,DWORD PTR SS:
004A5B5F .FFD7 CALL EDI
004A5B61 .B8 04000280 MOV EAX,80020004
004A5B66 .B9 0A000000 MOV ECX,0A
004A5B6B .8945 9C MOV DWORD PTR SS:,EAX
004A5B6E .8945 AC MOV DWORD PTR SS:,EAX
004A5B71 .8B45 D8 MOV EAX,DWORD PTR SS:
004A5B74 .894D 94 MOV DWORD PTR SS:,ECX
004A5B77 .8945 BC MOV DWORD PTR SS:,EAX
004A5B7A .8B45 DC MOV EAX,DWORD PTR SS:
004A5B7D .894D A4 MOV DWORD PTR SS:,ECX
004A5B80 .B9 08000000 MOV ECX,8
004A5B85 .8945 CC MOV DWORD PTR SS:,EAX
004A5B88 .8D55 94 LEA EDX,DWORD PTR SS:
004A5B8B .894D B4 MOV DWORD PTR SS:,ECX
004A5B8E .894D C4 MOV DWORD PTR SS:,ECX
004A5B91 .8D45 A4 LEA EAX,DWORD PTR SS:
004A5B94 .52 PUSH EDX
004A5B95 .8D4D B4 LEA ECX,DWORD PTR SS:
004A5B98 .50 PUSH EAX
004A5B99 .51 PUSH ECX
004A5B9A .8D55 C4 LEA EDX,DWORD PTR SS:
004A5B9D .6A 30 PUSH 30
004A5B9F .52 PUSH EDX
004A5BA0 .895D D8 MOV DWORD PTR SS:,EBX
004A5BA3 .895D DC MOV DWORD PTR SS:,EBX
004A5BA6 .FF15 C4104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>] ;MSVBVM60.rtcMsgBox
004A5BAC .8D45 D8 LEA EAX,DWORD PTR SS:
004A5BAF .8D4D DC LEA ECX,DWORD PTR SS:
004A5BB2 .50 PUSH EAX
004A5BB3 .51 PUSH ECX
004A5BB4 .6A 02 PUSH 2
004A5BB6 .FF15 6C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
004A5BBC .8D55 94 LEA EDX,DWORD PTR SS:
004A5BBF .8D45 A4 LEA EAX,DWORD PTR SS:
004A5BC2 .52 PUSH EDX
004A5BC3 .8D4D B4 LEA ECX,DWORD PTR SS:
004A5BC6 .50 PUSH EAX
004A5BC7 .8D55 C4 LEA EDX,DWORD PTR SS:
004A5BCA .51 PUSH ECX
004A5BCB .52 PUSH EDX
004A5BCC .6A 04 PUSH 4
004A5BCE .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A5BD4 .8B06 MOV EAX,DWORD PTR DS:
004A5BD6 .83C4 20 ADD ESP,20
004A5BD9 .53 PUSH EBX
004A5BDA .68 00100180 PUSH 80011000
004A5BDF .56 PUSH ESI
004A5BE0 .FF90 30030000 CALL DWORD PTR DS:
004A5BE6 .8D4D D4 LEA ECX,DWORD PTR SS:
004A5BE9 .50 PUSH EAX
004A5BEA .51 PUSH ECX
004A5BEB >FF15 C0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004A5BF1 .50 PUSH EAX
004A5BF2 .FF15 34104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaLateI>;MSVBVM60.__vbaLateIdCall
004A5BF8 .83C4 0C ADD ESP,0C
004A5BFB .8D4D D4 LEA ECX,DWORD PTR SS:
004A5BFE .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A5C04 .E9 96020000 JMP Gremlin.004A5E9F
004A5C09 >FF15 B8124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarDu>;MSVBVM60.__vbaVarDup
004A5C0F .8D55 C4 LEA EDX,DWORD PTR SS:
004A5C12 .6A 02 PUSH 2
004A5C14 .8D45 B4 LEA EAX,DWORD PTR SS:
004A5C17 .52 PUSH EDX
004A5C18 .50 PUSH EAX
004A5C19 .FF15 D0124000 CALL DWORD PTR DS:[<&MSVBVM60.#617>] ;MSVBVM60.rtcLeftCharVar
004A5C1F .8B45 E4 MOV EAX,DWORD PTR SS:
004A5C22 .C785 5CFFFFFF>MOV DWORD PTR SS:,Gremlin.004182>;UNICODE "G-"
004A5C2C .3BC3 CMP EAX,EBX
004A5C2E .C785 54FFFFFF>MOV DWORD PTR SS:,8
004A5C38 .75 12 JNZ SHORT Gremlin.004A5C4C
004A5C3A .8D4D E4 LEA ECX,DWORD PTR SS:
004A5C3D .51 PUSH ECX
004A5C3E .68 58904100 PUSH Gremlin.00419058
004A5C43 .FF15 48124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaNew2>>;MSVBVM60.__vbaNew2
004A5C49 .8B45 E4 MOV EAX,DWORD PTR SS:
004A5C4C >8B10 MOV EDX,DWORD PTR DS:
004A5C4E .8D4D DC LEA ECX,DWORD PTR SS:
004A5C51 .51 PUSH ECX
004A5C52 .50 PUSH EAX
004A5C53 .8985 40FFFFFF MOV DWORD PTR SS:,EAX
004A5C59 .FF52 24 CALL DWORD PTR DS:
004A5C5C .3BC3 CMP EAX,EBX
004A5C5E .DBE2 FCLEX
004A5C60 .7D 15 JGE SHORT Gremlin.004A5C77
004A5C62 .8B95 40FFFFFF MOV EDX,DWORD PTR SS:
004A5C68 .6A 24 PUSH 24
004A5C6A .68 48904100 PUSH Gremlin.00419048
004A5C6F .52 PUSH EDX
004A5C70 .50 PUSH EAX
004A5C71 .FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004A5C77 >8B45 DC MOV EAX,DWORD PTR SS:
004A5C7A .8D8D 54FFFFFF LEA ECX,DWORD PTR SS:
004A5C80 .8945 9C MOV DWORD PTR SS:,EAX
004A5C83 .8D45 B4 LEA EAX,DWORD PTR SS:
004A5C86 .50 PUSH EAX
004A5C87 .8D55 A4 LEA EDX,DWORD PTR SS:
004A5C8A .51 PUSH ECX
004A5C8B .52 PUSH EDX
004A5C8C .895D DC MOV DWORD PTR SS:,EBX
004A5C8F .C745 94 08000>MOV DWORD PTR SS:,8
004A5C96 .FF15 10124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarCa>;MSVBVM60.__vbaVarCat
004A5C9C .50 PUSH EAX
004A5C9D .8D45 94 LEA EAX,DWORD PTR SS:
004A5CA0 .8D4D 84 LEA ECX,DWORD PTR SS:
004A5CA3 .50 PUSH EAX
004A5CA4 .51 PUSH ECX
004A5CA5 .FF15 10124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarCa>;MSVBVM60.__vbaVarCat
004A5CAB .8D95 74FFFFFF LEA EDX,DWORD PTR SS:
004A5CB1 .50 PUSH EAX
004A5CB2 .52 PUSH EDX
004A5CB3 .FF15 34114000 CALL DWORD PTR DS:[<&MSVBVM60.#528>] ;MSVBVM60.rtcUpperCaseVar
004A5CB9 .8D85 74FFFFFF LEA EAX,DWORD PTR SS:
004A5CBF .8D4D D8 LEA ECX,DWORD PTR SS:
004A5CC2 .50 PUSH EAX
004A5CC3 .51 PUSH ECX
004A5CC4 .FF15 0C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>;MSVBVM60.__vbaStrVarVal
004A5CCA .50 PUSH EAX
004A5CCB .E8 60080000 CALL Gremlin.004A6530
004A5CD0 .8BD0 MOV EDX,EAX
004A5CD2 .8D4D E0 LEA ECX,DWORD PTR SS:
004A5CD5 .FFD7 CALL EDI
004A5CD7 .8D4D D8 LEA ECX,DWORD PTR SS:
004A5CDA .FF15 08134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
004A5CE0 .8D95 74FFFFFF LEA EDX,DWORD PTR SS:
004A5CE6 .8D45 84 LEA EAX,DWORD PTR SS:
004A5CE9 .52 PUSH EDX
004A5CEA .8D4D 94 LEA ECX,DWORD PTR SS:
004A5CED .50 PUSH EAX
004A5CEE .8D55 A4 LEA EDX,DWORD PTR SS:
004A5CF1 .51 PUSH ECX
004A5CF2 .8D45 B4 LEA EAX,DWORD PTR SS:
004A5CF5 .52 PUSH EDX
004A5CF6 .8D4D C4 LEA ECX,DWORD PTR SS:
004A5CF9 .50 PUSH EAX
004A5CFA .51 PUSH ECX
004A5CFB .6A 06 PUSH 6
004A5CFD .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A5D03 .8B55 E0 MOV EDX,DWORD PTR SS:
004A5D06 .83C4 1C ADD ESP,1C
004A5D09 .52 PUSH EDX
004A5D0A .E8 F1090000 CALL Gremlin.004A6700
004A5D0F .8BD0 MOV EDX,EAX
004A5D11 .8D4D DC LEA ECX,DWORD PTR SS:
004A5D14 .FFD7 CALL EDI
004A5D16 .50 PUSH EAX
004A5D17 .8B45 E8 MOV EAX,DWORD PTR SS:
004A5D1A .50 PUSH EAX
004A5D1B .E8 E0090000 CALL Gremlin.004A6700
004A5D20 .8BD0 MOV EDX,EAX
004A5D22 .8D4D D8 LEA ECX,DWORD PTR SS:
004A5D25 .FFD7 CALL EDI
004A5D27 .50 PUSH EAX
004A5D28 .FF15 44114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCm>;MSVBVM60.__vbaStrCmp
004A5D2E .F7D8 NEG EAX
004A5D30 .1BC0 SBB EAX,EAX
004A5D32 .8D4D D8 LEA ECX,DWORD PTR SS:
004A5D35 .40 INC EAX
004A5D36 .8D55 DC LEA EDX,DWORD PTR SS:
004A5D39 .51 PUSH ECX
004A5D3A .52 PUSH EDX
004A5D3B .F7D8 NEG EAX
004A5D3D .6A 02 PUSH 2
004A5D3F .66:8985 40FFF>MOV WORD PTR SS:,AX
004A5D46 .FF15 6C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
004A5D4C .83C4 0C ADD ESP,0C
004A5D4F .66:399D 40FFF>CMP WORD PTR SS:,BX
004A5D56 .0F84 43010000 JE Gremlin.004A5E9F
004A5D5C .8B45 E8 MOV EAX,DWORD PTR SS:
004A5D5F .50 PUSH EAX
004A5D60 .68 488F4100 PUSH Gremlin.00418F48 ;UNICODE "RgeKey"
004A5D65 .68 B8864100 PUSH Gremlin.004186B8 ;UNICODE "Login"
004A5D6A .68 A4864100 PUSH Gremlin.004186A4 ;UNICODE "MyAcct"
004A5D6F .FF15 10104000 CALL DWORD PTR DS:[<&MSVBVM60.#690>] ;MSVBVM60.rtcSaveSetting
004A5D75 .B9 93000000 MOV ECX,93
004A5D7A .FF15 98114000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaUI1I2>;MSVBVM60.__vbaUI1I2
004A5D80 .A2 6E604D00 MOV BYTE PTR DS:,AL
004A5D85 .A1 14614D00 MOV EAX,DWORD PTR DS:
004A5D8A .3BC3 CMP EAX,EBX
004A5D8C .75 15 JNZ SHORT Gremlin.004A5DA3
004A5D8E .68 14614D00 PUSH Gremlin.004D6114
004A5D93 .68 A8084100 PUSH Gremlin.004108A8
004A5D98 .FF15 48124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaNew2>>;MSVBVM60.__vbaNew2
004A5D9E .A1 14614D00 MOV EAX,DWORD PTR DS:
004A5DA3 >8B08 MOV ECX,DWORD PTR DS:
004A5DA5 .50 PUSH EAX
004A5DA6 .FF91 60030000 CALL DWORD PTR DS:
004A5DAC .8D55 D4 LEA EDX,DWORD PTR SS:
004A5DAF .50 PUSH EAX
004A5DB0 .52 PUSH EDX
004A5DB1 .FF15 C0104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004A5DB7 .8B08 MOV ECX,DWORD PTR DS:
004A5DB9 .53 PUSH EBX
004A5DBA .50 PUSH EAX
004A5DBB .8985 40FFFFFF MOV DWORD PTR SS:,EAX
004A5DC1 .FF51 5C CALL DWORD PTR DS:
004A5DC4 .3BC3 CMP EAX,EBX
004A5DC6 .DBE2 FCLEX
004A5DC8 .7D 15 JGE SHORT Gremlin.004A5DDF
004A5DCA .8B95 40FFFFFF MOV EDX,DWORD PTR SS:
004A5DD0 .6A 5C PUSH 5C
004A5DD2 .68 F8D84100 PUSH Gremlin.0041D8F8
004A5DD7 .52 PUSH EDX
004A5DD8 .50 PUSH EAX
004A5DD9 .FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004A5DDF >8D4D D4 LEA ECX,DWORD PTR SS:
004A5DE2 .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A5DE8 .68 3CE64100 PUSH Gremlin.0041E63C ;UNICODE "Err059"
004A5DED .E8 1E43FDFF CALL Gremlin.0047A110
004A5DF2 .8BD0 MOV EDX,EAX
004A5DF4 .8D4D DC LEA ECX,DWORD PTR SS:
004A5DF7 .FFD7 CALL EDI
004A5DF9 .68 50E64100 PUSH Gremlin.0041E650 ;UNICODE "Err061"
004A5DFE .E8 0D43FDFF CALL Gremlin.0047A110
004A5E03 .8BD0 MOV EDX,EAX
004A5E05 .8D4D D8 LEA ECX,DWORD PTR SS:
004A5E08 .FFD7 CALL EDI
004A5E0A .B8 04000280 MOV EAX,80020004
004A5E0F .B9 0A000000 MOV ECX,0A
004A5E14 .8945 9C MOV DWORD PTR SS:,EAX
004A5E17 .8945 AC MOV DWORD PTR SS:,EAX
004A5E1A .8B45 D8 MOV EAX,DWORD PTR SS:
004A5E1D .894D 94 MOV DWORD PTR SS:,ECX
004A5E20 .8945 BC MOV DWORD PTR SS:,EAX
004A5E23 .8B45 DC MOV EAX,DWORD PTR SS:
004A5E26 .894D A4 MOV DWORD PTR SS:,ECX
004A5E29 .B9 08000000 MOV ECX,8
004A5E2E .8945 CC MOV DWORD PTR SS:,EAX
004A5E31 .894D B4 MOV DWORD PTR SS:,ECX
004A5E34 .894D C4 MOV DWORD PTR SS:,ECX
004A5E37 .8D45 94 LEA EAX,DWORD PTR SS:
004A5E3A .8D4D A4 LEA ECX,DWORD PTR SS:
004A5E3D .50 PUSH EAX
004A5E3E .8D55 B4 LEA EDX,DWORD PTR SS:
004A5E41 .51 PUSH ECX
004A5E42 .52 PUSH EDX
004A5E43 .8D45 C4 LEA EAX,DWORD PTR SS:
004A5E46 .6A 20 PUSH 20
004A5E48 .50 PUSH EAX
004A5E49 .895D D8 MOV DWORD PTR SS:,EBX
004A5E4C .895D DC MOV DWORD PTR SS:,EBX
004A5E4F .FF15 C4104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>] ;MSVBVM60.rtcMsgBox
004A5E55 .8D4D D8 LEA ECX,DWORD PTR SS:
004A5E58 .8D55 DC LEA EDX,DWORD PTR SS:
004A5E5B .51 PUSH ECX
004A5E5C .52 PUSH EDX
004A5E5D .6A 02 PUSH 2
004A5E5F .FF15 6C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
004A5E65 .8D45 94 LEA EAX,DWORD PTR SS:
004A5E68 .8D4D A4 LEA ECX,DWORD PTR SS:
004A5E6B .50 PUSH EAX
004A5E6C .8D55 B4 LEA EDX,DWORD PTR SS:
004A5E6F .51 PUSH ECX
004A5E70 .8D45 C4 LEA EAX,DWORD PTR SS:
004A5E73 .52 PUSH EDX
004A5E74 .50 PUSH EAX
004A5E75 .6A 04 PUSH 4
004A5E77 .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A5E7D .8B0E MOV ECX,DWORD PTR DS:
004A5E7F .83C4 20 ADD ESP,20
004A5E82 .56 PUSH ESI
004A5E83 .FF91 00070000 CALL DWORD PTR DS:
004A5E89 .3BC3 CMP EAX,EBX
004A5E8B .7D 12 JGE SHORT Gremlin.004A5E9F
004A5E8D >68 00070000 PUSH 700
004A5E92 .68 188E4100 PUSH Gremlin.00418E18
004A5E97 .56 PUSH ESI
004A5E98 .50 PUSH EAX
004A5E99 .FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004A5E9F >895D FC MOV DWORD PTR SS:,EBX
004A5EA2 .68 065F4A00 PUSH Gremlin.004A5F06
004A5EA7 .EB 43 JMP SHORT Gremlin.004A5EEC
004A5EA9 .8D55 D8 LEA EDX,DWORD PTR SS:
004A5EAC .8D45 DC LEA EAX,DWORD PTR SS:
004A5EAF .52 PUSH EDX
004A5EB0 .50 PUSH EAX
004A5EB1 .6A 02 PUSH 2
004A5EB3 .FF15 6C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
004A5EB9 .83C4 0C ADD ESP,0C
004A5EBC .8D4D D4 LEA ECX,DWORD PTR SS:
004A5EBF .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A5EC5 .8D8D 74FFFFFF LEA ECX,DWORD PTR SS:
004A5ECB .8D55 84 LEA EDX,DWORD PTR SS:
004A5ECE .51 PUSH ECX
004A5ECF .8D45 94 LEA EAX,DWORD PTR SS:
004A5ED2 .52 PUSH EDX
004A5ED3 .8D4D A4 LEA ECX,DWORD PTR SS:
004A5ED6 .50 PUSH EAX
004A5ED7 .8D55 B4 LEA EDX,DWORD PTR SS:
004A5EDA .51 PUSH ECX
004A5EDB .8D45 C4 LEA EAX,DWORD PTR SS:
004A5EDE .52 PUSH EDX
004A5EDF .50 PUSH EAX
004A5EE0 .6A 06 PUSH 6
004A5EE2 .FF15 3C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004A5EE8 .83C4 1C ADD ESP,1C
004A5EEB .C3 RETN
004A5EEC >8B35 08134000 MOV ESI,DWORD PTR DS:[<&MSVBVM60.__vbaFr>;MSVBVM60.__vbaFreeStr
004A5EF2 .8D4D E8 LEA ECX,DWORD PTR SS:
004A5EF5 .FFD6 CALL ESI ;<&MSVBVM60.__vbaFreeStr>
004A5EF7 .8D4D E4 LEA ECX,DWORD PTR SS:
004A5EFA .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A5F00 .8D4D E0 LEA ECX,DWORD PTR SS:
004A5F03 .FFD6 CALL ESI
004A5F05 .C3 RETN
004A5F06 .8B45 08 MOV EAX,DWORD PTR SS:
004A5F09 .50 PUSH EAX
004A5F0A .8B08 MOV ECX,DWORD PTR DS:
004A5F0C .FF51 08 CALL DWORD PTR DS:
004A5F0F .8B45 FC MOV EAX,DWORD PTR SS:
004A5F12 .8B4D EC MOV ECX,DWORD PTR SS:
004A5F15 .5F POP EDI
004A5F16 .5E POP ESI
004A5F17 .64:890D 00000>MOV DWORD PTR FS:,ECX
004A5F1E .5B POP EBX
004A5F1F .8BE5 MOV ESP,EBP
004A5F21 .5D POP EBP
004A5F22 .C2 0400 RETN 4
004A5F25 90 NOP
004A5F26 90 NOP
004A5F27 90 NOP
004A5F28 90 NOP
004A5F29 90 NOP
004A5F2A 90 NOP
004A5F2B 90 NOP
004A5F2C 90 NOP
004A5F2D 90 NOP
004A5F2E 90 NOP
004A5F2F 90 NOP
004A5F30 >55 PUSH EBP
004A5F31 .8BEC MOV EBP,ESP
004A5F33 .83EC 0C SUB ESP,0C
004A5F36 .68 F6394000 PUSH <JMP.&MSVBVM60.__vbaExceptHandler>;SE 处理程序安装
004A5F3B .64:A1 0000000>MOV EAX,DWORD PTR FS:
004A5F41 .50 PUSH EAX
004A5F42 .64:8925 00000>MOV DWORD PTR FS:,ESP
004A5F49 .83EC 70 SUB ESP,70
004A5F4C .53 PUSH EBX
004A5F4D .56 PUSH ESI
004A5F4E .57 PUSH EDI
004A5F4F .8965 F4 MOV DWORD PTR SS:,ESP
004A5F52 .C745 F8 38274>MOV DWORD PTR SS:,Gremlin.0040273>
004A5F59 .8B75 08 MOV ESI,DWORD PTR SS:
004A5F5C .8BC6 MOV EAX,ESI
004A5F5E .83E0 01 AND EAX,1
004A5F61 .8945 FC MOV DWORD PTR SS:,EAX
004A5F64 .83E6 FE AND ESI,FFFFFFFE
004A5F67 .56 PUSH ESI
004A5F68 .8975 08 MOV DWORD PTR SS:,ESI
004A5F6B .8B0E MOV ECX,DWORD PTR DS:
004A5F6D .FF51 04 CALL DWORD PTR DS:
004A5F70 .8B1D E4124000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaCa>;MSVBVM60.__vbaCastObj
004A5F76 .33C0 XOR EAX,EAX
004A5F78 .68 6C8A4100 PUSH Gremlin.00418A6C
004A5F7D .56 PUSH ESI
004A5F7E .8945 E8 MOV DWORD PTR SS:,EAX
004A5F81 .8945 E4 MOV DWORD PTR SS:,EAX
004A5F84 .8945 E0 MOV DWORD PTR SS:,EAX
004A5F87 .8945 DC MOV DWORD PTR SS:,EAX
004A5F8A .8945 D8 MOV DWORD PTR SS:,EAX
004A5F8D .8945 D4 MOV DWORD PTR SS:,EAX
004A5F90 .8945 D0 MOV DWORD PTR SS:,EAX
004A5F93 .8945 C0 MOV DWORD PTR SS:,EAX
004A5F96 .8945 B0 MOV DWORD PTR SS:,EAX
004A5F99 .FFD3 CALL EBX ;<&MSVBVM60.__vbaCastObj>
004A5F9B .8B3D C0104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaOb>;MSVBVM60.__vbaObjSet
004A5FA1 .8D55 D0 LEA EDX,DWORD PTR SS:
004A5FA4 .50 PUSH EAX
004A5FA5 .52 PUSH EDX
004A5FA6 .FFD7 CALL EDI ;<&MSVBVM60.__vbaObjSet>
004A5FA8 .8D45 D0 LEA EAX,DWORD PTR SS:
004A5FAB .50 PUSH EAX
004A5FAC .E8 4FDEFCFF CALL Gremlin.00473E00
004A5FB1 .8D4D D0 LEA ECX,DWORD PTR SS:
004A5FB4 .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A5FBA .68 6C8A4100 PUSH Gremlin.00418A6C
004A5FBF .56 PUSH ESI
004A5FC0 .FFD3 CALL EBX
004A5FC2 .8D4D D0 LEA ECX,DWORD PTR SS:
004A5FC5 .50 PUSH EAX
004A5FC6 .51 PUSH ECX
004A5FC7 .FFD7 CALL EDI
004A5FC9 .8D55 D0 LEA EDX,DWORD PTR SS:
004A5FCC .52 PUSH EDX
004A5FCD .E8 6E40FDFF CALL Gremlin.0047A040
004A5FD2 .8D4D D0 LEA ECX,DWORD PTR SS:
004A5FD5 .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A5FDB .A0 6E604D00 MOV AL,BYTE PTR DS:
004A5FE0 .3C 03 CMP AL,3
004A5FE2 .0F83 CE000000 JNB Gremlin.004A60B6
004A5FE8 .8B06 MOV EAX,DWORD PTR DS:
004A5FEA .56 PUSH ESI
004A5FEB .FF90 2C030000 CALL DWORD PTR DS:
004A5FF1 .8D4D D0 LEA ECX,DWORD PTR SS:
004A5FF4 .50 PUSH EAX
004A5FF5 .51 PUSH ECX
004A5FF6 .FFD7 CALL EDI
004A5FF8 .8B18 MOV EBX,DWORD PTR DS:
004A5FFA .68 64E64100 PUSH Gremlin.0041E664 ;UNICODE "Err062"
004A5FFF .8945 9C MOV DWORD PTR SS:,EAX
004A6002 .E8 0941FDFF CALL Gremlin.0047A110
004A6007 .8BD0 MOV EDX,EAX
004A6009 .8D4D E4 LEA ECX,DWORD PTR SS:
004A600C .FF15 E0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;MSVBVM60.__vbaStrMove
004A6012 .66:8B15 70604>MOV DX,WORD PTR DS:
004A6019 .50 PUSH EAX
004A601A .52 PUSH EDX
004A601B .FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrI2>;MSVBVM60.__vbaStrI2
004A6021 .8BD0 MOV EDX,EAX
004A6023 .8D4D E0 LEA ECX,DWORD PTR SS:
004A6026 .FF15 E0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;MSVBVM60.__vbaStrMove
004A602C .50 PUSH EAX
004A602D .FF15 6C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCa>;MSVBVM60.__vbaStrCat
004A6033 .8BD0 MOV EDX,EAX
004A6035 .8D4D DC LEA ECX,DWORD PTR SS:
004A6038 .FF15 E0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;MSVBVM60.__vbaStrMove
004A603E .50 PUSH EAX
004A603F .68 78E64100 PUSH Gremlin.0041E678 ;UNICODE "Err063"
004A6044 .E8 C740FDFF CALL Gremlin.0047A110
004A6049 .8BD0 MOV EDX,EAX
004A604B .8D4D D8 LEA ECX,DWORD PTR SS:
004A604E .FF15 E0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;MSVBVM60.__vbaStrMove
004A6054 .50 PUSH EAX
004A6055 .FF15 6C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrCa>;MSVBVM60.__vbaStrCat
004A605B .8BD0 MOV EDX,EAX
004A605D .8D4D D4 LEA ECX,DWORD PTR SS:
004A6060 .FF15 E0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;MSVBVM60.__vbaStrMove
004A6066 .895D 88 MOV DWORD PTR SS:,EBX
004A6069 .8B5D 9C MOV EBX,DWORD PTR SS:
004A606C .50 PUSH EAX
004A606D .8B45 88 MOV EAX,DWORD PTR SS:
004A6070 .53 PUSH EBX
004A6071 .FF50 54 CALL DWORD PTR DS:
004A6074 .85C0 TEST EAX,EAX
004A6076 .DBE2 FCLEX
004A6078 .7D 0F JGE SHORT Gremlin.004A6089
004A607A .6A 54 PUSH 54
004A607C .68 D88D4100 PUSH Gremlin.00418DD8
004A6081 .53 PUSH EBX
004A6082 .50 PUSH EAX
004A6083 .FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004A6089 >8D4D D4 LEA ECX,DWORD PTR SS:
004A608C .8D55 D8 LEA EDX,DWORD PTR SS:
004A608F .51 PUSH ECX
004A6090 .8D45 DC LEA EAX,DWORD PTR SS:
004A6093 .52 PUSH EDX
004A6094 .8D4D E0 LEA ECX,DWORD PTR SS:
004A6097 .50 PUSH EAX
004A6098 .8D55 E4 LEA EDX,DWORD PTR SS:
004A609B .51 PUSH ECX
004A609C .52 PUSH EDX
004A609D .6A 05 PUSH 5
004A609F .FF15 6C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
004A60A5 .8B1D 04134000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaFr>;MSVBVM60.__vbaFreeObj
004A60AB .83C4 18 ADD ESP,18
004A60AE .8D4D D0 LEA ECX,DWORD PTR SS:
004A60B1 .E9 55010000 JMP Gremlin.004A620B
004A60B6 >75 3C JNZ SHORT Gremlin.004A60F4
004A60B8 .8B06 MOV EAX,DWORD PTR DS:
004A60BA .56 PUSH ESI
004A60BB .FF90 2C030000 CALL DWORD PTR DS:
004A60C1 .8D4D D0 LEA ECX,DWORD PTR SS:
004A60C4 .50 PUSH EAX
004A60C5 .51 PUSH ECX
004A60C6 .FFD7 CALL EDI
004A60C8 .8B18 MOV EBX,DWORD PTR DS:
004A60CA .68 8CE64100 PUSH Gremlin.0041E68C ;UNICODE "Err087"
004A60CF .8945 9C MOV DWORD PTR SS:,EAX
004A60D2 .E8 3940FDFF CALL Gremlin.0047A110
004A60D7 .8BD0 MOV EDX,EAX
004A60D9 .8D4D E4 LEA ECX,DWORD PTR SS:
004A60DC .FF15 E0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;MSVBVM60.__vbaStrMove
004A60E2 .8BD3 MOV EDX,EBX
004A60E4 .8B5D 9C MOV EBX,DWORD PTR SS:
004A60E7 .50 PUSH EAX
004A60E8 .53 PUSH EBX
004A60E9 .FF52 54 CALL DWORD PTR DS:
004A60EC .85C0 TEST EAX,EAX
004A60EE .DBE2 FCLEX
004A60F0 .7D 6C JGE SHORT Gremlin.004A615E
004A60F2 .EB 5B JMP SHORT Gremlin.004A614F
004A60F4 >33C9 XOR ECX,ECX
004A60F6 .3C 07 CMP AL,7
004A60F8 .0F95C1 SETNE CL
004A60FB .33D2 XOR EDX,EDX
004A60FD .3C 06 CMP AL,6
004A60FF .0F95C2 SETNE DL
004A6102 .23CA AND ECX,EDX
004A6104 .56 PUSH ESI
004A6105 .F7D9 NEG ECX
004A6107 .1BC9 SBB ECX,ECX
004A6109 .33D2 XOR EDX,EDX
004A610B .F7D9 NEG ECX
004A610D .3C 94 CMP AL,94
004A610F .8B06 MOV EAX,DWORD PTR DS:
004A6111 .0F95C2 SETNE DL
004A6114 .85CA TEST EDX,ECX
004A6116 .75 5D JNZ SHORT Gremlin.004A6175
004A6118 .FF90 2C030000 CALL DWORD PTR DS:
004A611E .8D4D D0 LEA ECX,DWORD PTR SS:
004A6121 .50 PUSH EAX
004A6122 .51 PUSH ECX
004A6123 .FFD7 CALL EDI
004A6125 .8B18 MOV EBX,DWORD PTR DS:
004A6127 .68 A0E64100 PUSH Gremlin.0041E6A0 ;UNICODE "Err113"
004A612C .8945 9C MOV DWORD PTR SS:,EAX
004A612F .E8 DC3FFDFF CALL Gremlin.0047A110
004A6134 .8BD0 MOV EDX,EAX
004A6136 .8D4D E4 LEA ECX,DWORD PTR SS:
004A6139 .FF15 E0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;MSVBVM60.__vbaStrMove
004A613F .8BD3 MOV EDX,EBX
004A6141 .8B5D 9C MOV EBX,DWORD PTR SS:
004A6144 .50 PUSH EAX
004A6145 .53 PUSH EBX
004A6146 .FF52 54 CALL DWORD PTR DS:
004A6149 .85C0 TEST EAX,EAX
004A614B .DBE2 FCLEX
004A614D .7D 0F JGE SHORT Gremlin.004A615E
004A614F >6A 54 PUSH 54
004A6151 .68 D88D4100 PUSH Gremlin.00418DD8
004A6156 .53 PUSH EBX
004A6157 .50 PUSH EAX
004A6158 .FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004A615E >8D4D E4 LEA ECX,DWORD PTR SS:
004A6161 .FF15 08134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
004A6167 .8B1D 04134000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaFr>;MSVBVM60.__vbaFreeObj
004A616D .8D4D D0 LEA ECX,DWORD PTR SS:
004A6170 .E9 96000000 JMP Gremlin.004A620B
004A6175 >FF90 2C030000 CALL DWORD PTR DS:
004A617B .8D4D D0 LEA ECX,DWORD PTR SS:
004A617E .50 PUSH EAX
004A617F .51 PUSH ECX
004A6180 .FFD7 CALL EDI
004A6182 .8B18 MOV EBX,DWORD PTR DS:
004A6184 .68 B4E64100 PUSH Gremlin.0041E6B4 ;UNICODE "Err064"
004A6189 .8945 9C MOV DWORD PTR SS:,EAX
004A618C .E8 7F3FFDFF CALL Gremlin.0047A110
004A6191 .8BD0 MOV EDX,EAX
004A6193 .8D4D E4 LEA ECX,DWORD PTR SS:
004A6196 .FF15 E0124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;MSVBVM60.__vbaStrMove
004A619C .8BD3 MOV EDX,EBX
004A619E .8B5D 9C MOV EBX,DWORD PTR SS:
004A61A1 .50 PUSH EAX
004A61A2 .53 PUSH EBX
004A61A3 .FF52 54 CALL DWORD PTR DS:
004A61A6 .85C0 TEST EAX,EAX
004A61A8 .DBE2 FCLEX
004A61AA .7D 0F JGE SHORT Gremlin.004A61BB
004A61AC .6A 54 PUSH 54
004A61AE .68 D88D4100 PUSH Gremlin.00418DD8
004A61B3 .53 PUSH EBX
004A61B4 .50 PUSH EAX
004A61B5 .FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004A61BB >8D4D E4 LEA ECX,DWORD PTR SS:
004A61BE .FF15 08134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
004A61C4 .8B1D 04134000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.__vbaFr>;MSVBVM60.__vbaFreeObj
004A61CA .8D4D D0 LEA ECX,DWORD PTR SS:
004A61CD .FFD3 CALL EBX ;<&MSVBVM60.__vbaFreeObj>
004A61CF .83EC 10 SUB ESP,10
004A61D2 .B9 0B000000 MOV ECX,0B
004A61D7 .8BD4 MOV EDX,ESP
004A61D9 .33C0 XOR EAX,EAX
004A61DB .68 0D000180 PUSH 8001000D
004A61E0 .56 PUSH ESI
004A61E1 .890A MOV DWORD PTR DS:,ECX
004A61E3 .8B4D B4 MOV ECX,DWORD PTR SS:
004A61E6 .894A 04 MOV DWORD PTR DS:,ECX
004A61E9 .8B0E MOV ECX,DWORD PTR DS:
004A61EB .8942 08 MOV DWORD PTR DS:,EAX
004A61EE .8B45 BC MOV EAX,DWORD PTR SS:
004A61F1 .8942 0C MOV DWORD PTR DS:,EAX
004A61F4 .FF91 3C030000 CALL DWORD PTR DS:
004A61FA .8D55 D0 LEA EDX,DWORD PTR SS:
004A61FD .50 PUSH EAX
004A61FE .52 PUSH EDX
004A61FF .FFD7 CALL EDI
004A6201 .50 PUSH EAX
004A6202 .FF15 F4124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaLateI>;MSVBVM60.__vbaLateIdSt
004A6208 .8D4D D0 LEA ECX,DWORD PTR SS:
004A620B >FFD3 CALL EBX
004A620D .8B45 E8 MOV EAX,DWORD PTR SS:
004A6210 .66:C746 36 FF>MOV WORD PTR DS:,0FFFF
004A6216 .85C0 TEST EAX,EAX
004A6218 .75 12 JNZ SHORT Gremlin.004A622C
004A621A .8D45 E8 LEA EAX,DWORD PTR SS:
004A621D .50 PUSH EAX
004A621E .68 58904100 PUSH Gremlin.00419058
004A6223 .FF15 48124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaNew2>>;MSVBVM60.__vbaNew2
004A6229 .8B45 E8 MOV EAX,DWORD PTR SS:
004A622C >8B08 MOV ECX,DWORD PTR DS:
004A622E .8D55 E4 LEA EDX,DWORD PTR SS:
004A6231 .52 PUSH EDX
004A6232 .50 PUSH EAX
004A6233 .8945 9C MOV DWORD PTR SS:,EAX
004A6236 .FF51 24 CALL DWORD PTR DS:
004A6239 .85C0 TEST EAX,EAX
004A623B .DBE2 FCLEX
004A623D .7D 12 JGE SHORT Gremlin.004A6251
004A623F .8B4D 9C MOV ECX,DWORD PTR SS:
004A6242 .6A 24 PUSH 24
004A6244 .68 48904100 PUSH Gremlin.00419048
004A6249 .51 PUSH ECX
004A624A .50 PUSH EAX
004A624B .FF15 94104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004A6251 >83EC 10 SUB ESP,10
004A6254 .8B45 E4 MOV EAX,DWORD PTR SS:
004A6257 .8BD4 MOV EDX,ESP
004A6259 .B9 08000000 MOV ECX,8
004A625E .894D C0 MOV DWORD PTR SS:,ECX
004A6261 .8945 C8 MOV DWORD PTR SS:,EAX
004A6264 .890A MOV DWORD PTR DS:,ECX
004A6266 .8B4D C4 MOV ECX,DWORD PTR SS:
004A6269 .6A 00 PUSH 0
004A626B .56 PUSH ESI
004A626C .894A 04 MOV DWORD PTR DS:,ECX
004A626F .8B0E MOV ECX,DWORD PTR DS:
004A6271 .C745 E4 00000>MOV DWORD PTR SS:,0
004A6278 .8942 08 MOV DWORD PTR DS:,EAX
004A627B .8B45 CC MOV EAX,DWORD PTR SS:
004A627E .8942 0C MOV DWORD PTR DS:,EAX
004A6281 .FF91 34030000 CALL DWORD PTR DS:
004A6287 .8D55 D0 LEA EDX,DWORD PTR SS:
004A628A .50 PUSH EAX
004A628B .52 PUSH EDX
004A628C .FFD7 CALL EDI
004A628E .50 PUSH EAX
004A628F .FF15 F4124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaLateI>;MSVBVM60.__vbaLateIdSt
004A6295 .8D4D D0 LEA ECX,DWORD PTR SS:
004A6298 .FFD3 CALL EBX
004A629A .8D4D C0 LEA ECX,DWORD PTR SS:
004A629D .FF15 28104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVar
004A62A3 .68 48904100 PUSH Gremlin.00419048
004A62A8 .6A 00 PUSH 0
004A62AA .FF15 E4124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaCastO>;MSVBVM60.__vbaCastObj
004A62B0 .50 PUSH EAX
004A62B1 .8D45 E8 LEA EAX,DWORD PTR SS:
004A62B4 .50 PUSH EAX
004A62B5 .FFD7 CALL EDI
004A62B7 .C745 FC 00000>MOV DWORD PTR SS:,0
004A62BE .68 01634A00 PUSH Gremlin.004A6301
004A62C3 .EB 32 JMP SHORT Gremlin.004A62F7
004A62C5 .8D4D D4 LEA ECX,DWORD PTR SS:
004A62C8 .8D55 D8 LEA EDX,DWORD PTR SS:
004A62CB .51 PUSH ECX
004A62CC .8D45 DC LEA EAX,DWORD PTR SS:
004A62CF .52 PUSH EDX
004A62D0 .8D4D E0 LEA ECX,DWORD PTR SS:
004A62D3 .50 PUSH EAX
004A62D4 .8D55 E4 LEA EDX,DWORD PTR SS:
004A62D7 .51 PUSH ECX
004A62D8 .52 PUSH EDX
004A62D9 .6A 05 PUSH 5
004A62DB .FF15 6C124000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
004A62E1 .83C4 18 ADD ESP,18
004A62E4 .8D4D D0 LEA ECX,DWORD PTR SS:
004A62E7 .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A62ED .8D4D C0 LEA ECX,DWORD PTR SS:
004A62F0 .FF15 28104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVar
004A62F6 .C3 RETN
004A62F7 >8D4D E8 LEA ECX,DWORD PTR SS:
004A62FA .FF15 04134000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004A6300 .C3 RETN
004A6301 .8B45 08 MOV EAX,DWORD PTR SS:
004A6304 .50 PUSH EAX
004A6305 .8B08 MOV ECX,DWORD PTR DS:
004A6307 .FF51 08 CALL DWORD PTR DS:
004A630A .8B45 FC MOV EAX,DWORD PTR SS:
004A630D .8B4D EC MOV ECX,DWORD PTR SS:
004A6310 .5F POP EDI
004A6311 .5E POP ESI
004A6312 .64:890D 00000>MOV DWORD PTR FS:,ECX
004A6319 .5B POP EBX
004A631A .8BE5 MOV ESP,EBP
004A631C .5D POP EBP
004A631D .C2 0400 RETN 4
注册码位数为11位数。
如果注册码为FREDGREMLIN, 注册成功后即为正式版。
如果通过机器码注册后，也只不过是免费版。
机器码：M00JJ10Y176798
在机器码前加上065G-即为065G-M00JJ10Y176798
MD5(065G-M00JJ10Y176798)=3196226AC4A2522EF0FC0433429CED77=SN1
取SN1前4位数，再取SN1后6位，最后在其后加上F－－－－－》31969CED77F－－－－－》即为注册码。
注册信息保存在注册表中：
"DbName"="C:\\GREMLIN\\AcctDB.mdb"
"SetupPath"="C:\\GREMLIN\\"
"UserId"="SA"
"RgeKey"="FREDGREMLIN"
【破解声明】 我是一只小菜鸟，偶得一点心得，愿与大家分享:)
【版权声明】 本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
----------------------------------------------------------------------------------------------
文章写于2006-03-07 21:30:20 不懂，支持！ 好长的VB代码啊,要是能加上点注释就更好了 原帖由 wan 于 2006-3-9 09:06 发表
好长的VB代码啊,要是能加上点注释就更好了
同意,MOUSE拉了很长的一段时间,期待精彩...
页:
[1]