首页 > 代码库 > [反汇编练习] 160个CrackMe之022
[反汇编练习] 160个CrackMe之022
[反汇编练习] 160个CrackMe之022.
本系列文章的目的是从一个没有任何经验的新手的角度(其实就是我自己)，一步步尝试将160个CrackMe全部破解，如果可以，通过任何方式写出一个类似于注册机的东西。
其中，文章中按照如下逻辑编排（解决如下问题）：
1、使用什么环境和工具
2、程序分析
3、思路分析和破解流程
4、注册机的探索
----------------------------------
提醒各位看客: 如果文章中的逻辑看不明白,那你一定是没有亲手操刀!OD中的跳转提示很强大,只要你跟踪了,不用怎么看代码就理解了!
----------------------------------
1、工具和环境：
WinXP SP3 + 52Pojie六周年纪念版OD + PEID + 汇编金手指。
160个CrackMe的打包文件。
下载地址： http://pan.baidu.com/s/1xUWOY 密码: jbnq
注：
1、Win7系统对于模块和程序开启了随机初始地址的功能，会给分析带来很大的负担，所以不建议使用Win7进行分析。
2、以上工具都是在52PoJie论坛下的原版程序，NOD32不报毒，个人承诺绝对不会进行任何和木马病毒相关内容。
2、程序分析：
想要破解一个程序，必须先了解这个程序。所以，在破解过程中，对最初程序的分析很重要，他可以帮助我们理解作者的目的和意图，特别是对于注册码的处理细节，从而方便我们反向跟踪和推导。
和上一节一样，打开CHM，选择第22个CarLitoZ.1.EXE，保存下来。运行程序，程序界面如下：
又有信息框了，我很高兴啊！
PEID: Microsoft Visual Basic 5.0 / 6.0
3、思路分析和破解流程
步骤：
1、打开OD，将exe拖到OD窗口中，等程序暂停后，直接点击运行按钮(F9)，不用理会。
2、在exe中输入Key：123123。点击OK按钮，弹出错误信息框，不要关闭。
3、在OD中点击暂停按钮(Ctrl+F12)，再点击堆栈K按钮(Ctrl+K)，可以看到当前堆栈情况。
4、选中最后的rtcMsgBox，右键->Show call，返回到反汇编界面：
00402D86 . /7D 12 jge short 00402D9A00402D88 . |68 F8060000 push 0x6F800402D8D . |68 0C224000 push 0040220C00402D92 . |56 push esi00402D93 . |50 push eax00402D94 . |FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj00402D9A > \8D4E 34 lea ecx,dword ptr ds:[esi+0x34]00402D9D . 8D55 94 lea edx,dword ptr ss:[ebp-0x6C]00402DA0 . 51 push ecx00402DA1 . 52 push edx00402DA2 . C745 9C 01000>mov dword ptr ss:[ebp-0x64],0x100402DA9 . C745 94 02800>mov dword ptr ss:[ebp-0x6C],0x800200402DB0 . FF15 6C614000 call dword ptr ds:[<&MSVBVM50.__vbaVarTs>; msvbvm50.__vbaVarTstEq00402DB6 . 8B3D C4614000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>; msvbvm50.__vbaVarDup00402DBC . B9 04000280 mov ecx,0x8002000400402DC1 . 66:85C0 test ax,ax00402DC4 . B8 0A000000 mov eax,0xA00402DC9 . 894D AC mov dword ptr ss:[ebp-0x54],ecx00402DCC . 894D BC mov dword ptr ss:[ebp-0x44],ecx00402DCF . 8945 A4 mov dword ptr ss:[ebp-0x5C],eax00402DD2 . 8945 B4 mov dword ptr ss:[ebp-0x4C],eax00402DD5 . C745 8C 08234>mov dword ptr ss:[ebp-0x74],00402308 ; UNICODE "CrackMe v1.0"00402DDC . C745 84 08000>mov dword ptr ss:[ebp-0x7C],0x800402DE3 . 8D55 84 lea edx,dword ptr ss:[ebp-0x7C]00402DE6 . 8D4D C4 lea ecx,dword ptr ss:[ebp-0x3C]00402DE9 0F84 5A010000 je 00402F49 ; // 跳到失败00402DEF . FFD7 call edi ; <&MSVBVM50.__vbaVarDup>00402DF1 . 8D55 94 lea edx,dword ptr ss:[ebp-0x6C]00402DF4 . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C]00402DF7 . C745 9C D4224>mov dword ptr ss:[ebp-0x64],004022D4 ; UNICODE "Registration Successful"00402DFE . C745 94 08000>mov dword ptr ss:[ebp-0x6C],0x8 ; // 注册成功00402E05 . FFD7 call edi00402E07 . 8D45 A4 lea eax,dword ptr ss:[ebp-0x5C]00402E0A . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C]00402E0D . 50 push eax00402E0E . 8D55 C4 lea edx,dword ptr ss:[ebp-0x3C]00402E11 . 51 push ecx00402E12 . 52 push edx00402E13 . 8D45 D4 lea eax,dword ptr ss:[ebp-0x2C]00402E16 . 6A 30 push 0x3000402E18 . 50 push eax00402E19 . FF15 40614000 call dword ptr ds:[<&MSVBVM50.#595>] ; msvbvm50.rtcMsgBox00402E1F . 8D4D A4 lea ecx,dword ptr ss:[ebp-0x5C]00402E22 . 8D55 B4 lea edx,dword ptr ss:[ebp-0x4C]00402E25 . 51 push ecx00402E26 . 8D45 C4 lea eax,dword ptr ss:[ebp-0x3C]00402E29 . 52 push edx00402E2A . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C]00402E2D . 50 push eax00402E2E . 51 push ecx00402E2F . 6A 04 push 0x400402E31 . FF15 1C614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeV>; msvbvm50.__vbaFreeVarList00402E37 . 83C4 14 add esp,0x1400402E3A . 8D7E 44 lea edi,dword ptr ds:[esi+0x44]00402E3D . 68 40224000 push 00402240 ; UNICODE "c:\windows\MTR.dat"00402E42 . 57 push edi00402E43 . FF15 90614000 call dword ptr ds:[<&MSVBVM50.__vbaI2Var>; msvbvm50.__vbaI2Var00402E49 . 50 push eax00402E4A . 6A FF push -0x100402E4C . 6A 20 push 0x2000402E4E . FF15 98614000 call dword ptr ds:[<&MSVBVM50.__vbaFileO>; msvbvm50.__vbaFileOpen00402E54 . BA 6C224000 mov edx,0040226C ; UNICODE "trv2156j0e"00402E59 . 8D4D E8 lea ecx,dword ptr ss:[ebp-0x18]00402E5C . FF15 AC614000 call dword ptr ds:[<&MSVBVM50.__vbaStrCo>; msvbvm50.__vbaStrCopy00402E62 . 57 push edi00402E63 . FF15 90614000 call dword ptr ds:[<&MSVBVM50.__vbaI2Var>; msvbvm50.__vbaI2Var00402E69 . 50 push eax00402E6A . 8D55 E8 lea edx,dword ptr ss:[ebp-0x18]00402E6D . 6A 2D push 0x2D00402E6F . 52 push edx00402E70 . 6A 00 push 0x000402E72 . FF15 24614000 call dword ptr ds:[<&MSVBVM50.__vbaPut4>>; msvbvm50.__vbaPut400402E78 . 8D4D E8 lea ecx,dword ptr ss:[ebp-0x18]00402E7B . FF15 DC614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeS>; msvbvm50.__vbaFreeStr00402E81 . 57 push edi00402E82 . FF15 90614000 call dword ptr ds:[<&MSVBVM50.__vbaI2Var>; msvbvm50.__vbaI2Var00402E88 . 50 push eax00402E89 . FF15 60614000 call dword ptr ds:[<&MSVBVM50.__vbaFileC>; msvbvm50.__vbaFileClose00402E8F . 56 push esi00402E90 . FF93 0C030000 call dword ptr ds:[ebx+0x30C]00402E96 . 50 push eax00402E97 . 8D45 E4 lea eax,dword ptr ss:[ebp-0x1C]00402E9A . 50 push eax00402E9B . FF15 3C614000 call dword ptr ds:[<&MSVBVM50.__vbaObjSe>; msvbvm50.__vbaObjSet00402EA1 . 8BF8 mov edi,eax00402EA3 . 68 88224000 push 00402288 ; UNICODE "REGISTERED"00402EA8 . 57 push edi ; // ↑的文本说明验证成功了00402EA9 . 8B0F mov ecx,dword ptr ds:[edi]00402EAB . FF51 54 call dword ptr ds:[ecx+0x54]00402EAE . 85C0 test eax,eax00402EB0 . 7D 0F jge short 00402EC100402EB2 . 6A 54 push 0x5400402EB4 . 68 A0224000 push 004022A000402EB9 . 57 push edi00402EBA . 50 push eax00402EBB . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj00402EC1 > 8D4D E4 lea ecx,dword ptr ss:[ebp-0x1C]00402EC4 . FF15 E0614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>; msvbvm50.__vbaFreeObj00402ECA . 56 push esi00402ECB . FF93 04030000 call dword ptr ds:[ebx+0x304]00402ED1 . 8D55 E4 lea edx,dword ptr ss:[ebp-0x1C]00402ED4 . 50 push eax00402ED5 . 52 push edx00402ED6 . FF15 3C614000 call dword ptr ds:[<&MSVBVM50.__vbaObjSe>; msvbvm50.__vbaObjSet00402EDC . 8BF8 mov edi,eax00402EDE . 6A 00 push 0x000402EE0 . 57 push edi00402EE1 . 8B07 mov eax,dword ptr ds:[edi]00402EE3 . FF90 8C000000 call dword ptr ds:[eax+0x8C]00402EE9 . 85C0 test eax,eax00402EEB . 7D 12 jge short 00402EFF00402EED . 68 8C000000 push 0x8C00402EF2 . 68 B0224000 push 004022B000402EF7 . 57 push edi00402EF8 . 50 push eax00402EF9 . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj00402EFF > 8B3D E0614000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaFr>; msvbvm50.__vbaFreeObj00402F05 . 8D4D E4 lea ecx,dword ptr ss:[ebp-0x1C]00402F08 . FFD7 call edi ; <&MSVBVM50.__vbaFreeObj>00402F0A . 56 push esi00402F0B . FF93 08030000 call dword ptr ds:[ebx+0x308]00402F11 . 8D4D E4 lea ecx,dword ptr ss:[ebp-0x1C]00402F14 . 50 push eax00402F15 . 51 push ecx00402F16 . FF15 3C614000 call dword ptr ds:[<&MSVBVM50.__vbaObjSe>; msvbvm50.__vbaObjSet00402F1C . 8BF0 mov esi,eax00402F1E . 6A 00 push 0x000402F20 . 56 push esi00402F21 . 8B16 mov edx,dword ptr ds:[esi]00402F23 . FF92 8C000000 call dword ptr ds:[edx+0x8C]00402F29 . 85C0 test eax,eax00402F2B . 7D 12 jge short 00402F3F00402F2D . 68 8C000000 push 0x8C00402F32 . 68 C0224000 push 004022C000402F37 . 56 push esi00402F38 . 50 push eax00402F39 . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj00402F3F > 8D4D E4 lea ecx,dword ptr ss:[ebp-0x1C]00402F42 . FFD7 call edi00402F44 . E9 8C000000 jmp 00402FD500402F49 > FFD7 call edi00402F4B . 8D55 94 lea edx,dword ptr ss:[ebp-0x6C]00402F4E . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C]00402F51 . C745 9C 28234>mov dword ptr ss:[ebp-0x64],00402328 ; UNICODE " Wrong Code! Try Again"00402F58 . C745 94 08000>mov dword ptr ss:[ebp-0x6C],0x800402F5F . FFD7 call edi00402F61 . 8D45 A4 lea eax,dword ptr ss:[ebp-0x5C]00402F64 . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C]00402F67 . 50 push eax00402F68 . 8D55 C4 lea edx,dword ptr ss:[ebp-0x3C]00402F6B . 51 push ecx00402F6C . 52 push edx00402F6D . 8D45 D4 lea eax,dword ptr ss:[ebp-0x2C]00402F70 . 6A 10 push 0x1000402F72 . 50 push eax00402F73 . FF15 40614000 call dword ptr ds:[<&MSVBVM50.#595>] ; msvbvm50.rtcMsgBox
从当前位置向上查找，很容易地发现了好几处提示注册成功的文本，最后在头部发现了__vbaVarTstEq，并且他下面接着 je 00402F49 跳转，接着就是提示成功的文本。我们再去中间还发现了一个特殊的文件路径：c:\windows\MTR.dat，留心一下。
分析到这里，爆破很简单了，直接将关键跳转使用NOP填充就可以了。选中je 00402F49 ，右键->Binary->Fill with NOPs。试一试，哈哈，成功了！
考虑到刚才的那个文件路径，我们重启文件一下，看看是否可行：
4、注册机的探索
直接上VB Decompiler Pro, 分析了一下：
Private Sub reg_Click() ‘402D20 Dim var_5C As Me Dim var_1C As Variant loc_00402D52: var_8 = &H401020 loc_00402D7E: Call Crack.rgr loc_00402DA2: var_64 = 1 loc_00402DA9: var_6C = &H8002 loc_00402DB0: Var_Ret_1 = (Me.SaveProp = 1) loc_00402DC9: var_54 = 80020004h loc_00402DCC: var_44 = 80020004h loc_00402DCF: var_5C = 10 loc_00402DD2: var_4C = 10 loc_00402DD5: var_74 = "CrackMe v1.0" loc_00402DDC: var_7C = 8 If Var_Ret_1 = 0 Then GoTo loc_00402F49 loc_00402DEF: var_3C = "CrackMe v1.0" loc_00402DF7: var_64 = "Registration Successful" loc_00402DFE: var_6C = 8 loc_00402E05: var_2C = "Registration Successful" loc_00402E19: MsgBox var_2C, 48, var_3C loc_00402E43: Me = %x1 = CInt("c:\windows\MTR.dat") loc_00402E4E: Open Me For Random As #var_3C loc_00402E5C: var_18 = "trv2156j0e" loc_00402E63: Me = %x1 = CInt(4203020) loc_00402E72: Put #var_18, 45, var_18 loc_00402E82: Me = %x1 = CInt(1784) loc_00402E89: Close #Put #var_18, 45, var_18 loc_00402E9B: Set var_1C = Close #Put #var_18, 45, var_18 loc_00402EAB: Unknown_VTable_Call[ecx+54h] loc_00402ED6: Set var_1C = Unknown_VTable_Call[ecx+54h] loc_00402EE3: reg.Enabled = False loc_00402F23: Text.Enabled = False loc_00402F51: var_64 = "Wrong Code! Try Again" loc_00402F58: var_6C = 8 loc_00402F73: MsgBox var_2C, 16, var_3C loc_00402FB0: Text.Text = 4203356 loc_00402FE1: GoTo loc_00403011 loc_00403010: Exit Sub loc_00403011: Exit SubEnd Sub发现按钮点击事件调用了Call Crack.rgr进行验证,而他自身只进行判断：
ublic Sub rgr() ‘403230 Dim var_3C As TextBox loc_0040325C: var_8 = &H401040 loc_0040339E: Set var_40 = 404024h loc_004033A9: Unknown_VTable_Call[eax+50h] loc_004033D2: CreateObject(4200340, 4210724) loc_004033DD: loc_004033EB: Set var_44 = 404024h loc_004033F6: Unknown_VTable_Call[ecx+50h] loc_0040341F: CreateObject(4200340, 4210724) loc_0040342A: loc_00403438: Set var_48 = 404024h loc_00403443: Unknown_VTable_Call[eax+50h] loc_0040346C: CreateObject(4200340, 4210724) loc_00403477: loc_00403485: Set var_4C = 404024h loc_00403490: Unknown_VTable_Call[ecx+50h] loc_004034B9: CreateObject(4200340, 4210724) loc_004034C4: loc_004034D2: Set var_50 = 404024h loc_004034DD: Unknown_VTable_Call[eax+50h] loc_00403506: CreateObject(4200340, 4210724) loc_00403511: loc_0040351F: Set var_54 = 404024h loc_0040352A: Unknown_VTable_Call[ecx+50h] loc_00403553: CreateObject(4200340, 4210724) loc_0040355E: loc_0040356C: Set var_58 = 404024h loc_00403577: Unknown_VTable_Call[eax+50h] loc_004035A0: CreateObject(4200340, 4210724) loc_004035AB: loc_004035B9: Set var_5C = 404024h loc_004035C4: Unknown_VTable_Call[ecx+50h] loc_004035EF: Set var_3C = Me loc_004035FA: var_18 = Text.Text loc_0040361F: var_254 = var_18 loc_0040362B: var_64 = var_1C loc_00403644: var_25C = &H8008 loc_0040364E: var_74 = 1 loc_00403655: var_7C = 2 loc_0040365B: var_6C = 8 loc_0040366D: var_94 = var_20 loc_00403684: var_A4 = 1 loc_0040368E: var_AC = 2 loc_00403697: var_9C = 8 loc_004036AC: var_D4 = var_24 loc_004036C6: var_E4 = 1 loc_004036D0: var_EC = 2 loc_004036D9: var_DC = 8 loc_004036EE: var_114 = var_28 loc_00403705: var_124 = 1 loc_0040370F: var_12C = 2 loc_00403718: var_11C = 8 loc_0040372D: var_154 = var_2C loc_00403747: var_164 = 1 loc_00403751: var_16C = 2 loc_0040375A: var_15C = 8 loc_00403769: var_1A4 = 1 loc_00403773: var_1AC = 2 loc_0040377C: var_194 = var_30 loc_0040379C: var_19C = 8 loc_004037B1: var_1D4 = var_34 loc_004037CB: var_1E4 = 1 loc_004037D5: var_1EC = 2 loc_004037DE: var_1DC = 8 loc_004037F3: var_214 = var_38 loc_0040380D: var_224 = 1 loc_00403817: var_22C = 2 loc_00403820: var_21C = 8 loc_0040384E: Var_Ret_1 = Mid$(var_1C, 6, 1) + Mid$(var_20, 9, 1) loc_0040385F: Var_Ret_2 = Var_Ret_1 + Mid$(var_24, 143, 1) loc_00403870: Var_Ret_3 = Var_Ret_2 + Mid$(var_28, 16, 1) loc_00403881: Var_Ret_4 = Var_Ret_3 + Mid$(var_2C, 161, 1) loc_00403892: Var_Ret_5 = Var_Ret_4 + Mid$(var_30, 171, 1) loc_004038A3: Var_Ret_6 = Var_Ret_5 + Mid$(var_34, 166, 1) loc_004038B4: Var_Ret_7 = Var_Ret_6 + Mid$(var_38, 168, 1) loc_004038B7: Var_Ret_8 = (var_18 = Var_Ret_7) If Var_Ret_8 = 0 Then GoTo loc_004039FD loc_004039E4: var_274 = 1 loc_004039EE: var_27C = 2 loc_004039F7: ecx = 1 loc_004039FD: loc_00403A02: GoTo loc_00403B55 loc_00403B54: Exit Sub loc_00403B55: Exit SubEnd Sub
我们在OD中,Ctrl+G，输入 ublic Sub rgr() 的开头地址：403230，在OD中参照上述代码进行具体分析：
00403230 > \55 push ebp ; // 验证注册码的函数00403231 . 8BEC mov ebp,esp00403233 . 83EC 0C sub esp,0xC00403236 . 68 66104000 push <jmp.&MSVBVM50.__vbaExceptHandler> ; SE handler installation0040323B . 64:A1 0000000>mov eax,dword ptr fs:[0]00403241 . 50 push eax00403242 . 64:8925 00000>mov dword ptr fs:[0],esp00403249 . 81EC 54030000 sub esp,0x3540040324F . 8B45 08 mov eax,dword ptr ss:[ebp+0x8]00403252 . 53 push ebx00403253 . 56 push esi00403254 . 57 push edi00403255 . 8B08 mov ecx,dword ptr ds:[eax]00403257 . 8965 F4 mov dword ptr ss:[ebp-0xC],esp0040325A . 33F6 xor esi,esi0040325C . C745 F8 40104>mov dword ptr ss:[ebp-0x8],0040104000403263 . 50 push eax00403264 . 8975 FC mov dword ptr ss:[ebp-0x4],esi00403267 . 898D 98FCFFFF mov dword ptr ss:[ebp-0x368],ecx0040326D . FF51 04 call dword ptr ds:[ecx+0x4]00403270 . A1 24404000 mov eax,dword ptr ds:[0x404024]00403275 . 8975 E8 mov dword ptr ss:[ebp-0x18],esi00403278 . 3BC6 cmp eax,esi0040327A . 8975 E4 mov dword ptr ss:[ebp-0x1C],esi0040327D . 8975 E0 mov dword ptr ss:[ebp-0x20],esi00403280 . 8975 DC mov dword ptr ss:[ebp-0x24],esi00403283 . 8975 D8 mov dword ptr ss:[ebp-0x28],esi00403286 . 8975 D4 mov dword ptr ss:[ebp-0x2C],esi00403289 . 8975 D0 mov dword ptr ss:[ebp-0x30],esi0040328C . 8975 CC mov dword ptr ss:[ebp-0x34],esi0040328F . 8975 C8 mov dword ptr ss:[ebp-0x38],esi00403292 . 8975 C4 mov dword ptr ss:[ebp-0x3C],esi00403295 . 8975 C0 mov dword ptr ss:[ebp-0x40],esi00403298 . 8975 BC mov dword ptr ss:[ebp-0x44],esi0040329B . 8975 B8 mov dword ptr ss:[ebp-0x48],esi0040329E . 8975 B4 mov dword ptr ss:[ebp-0x4C],esi004032A1 . 8975 B0 mov dword ptr ss:[ebp-0x50],esi004032A4 . 8975 AC mov dword ptr ss:[ebp-0x54],esi004032A7 . 8975 A8 mov dword ptr ss:[ebp-0x58],esi004032AA . 8975 A4 mov dword ptr ss:[ebp-0x5C],esi004032AD . 8975 94 mov dword ptr ss:[ebp-0x6C],esi004032B0 . 8975 84 mov dword ptr ss:[ebp-0x7C],esi004032B3 . 89B5 74FFFFFF mov dword ptr ss:[ebp-0x8C],esi004032B9 . 89B5 64FFFFFF mov dword ptr ss:[ebp-0x9C],esi004032BF . 89B5 54FFFFFF mov dword ptr ss:[ebp-0xAC],esi004032C5 . 89B5 44FFFFFF mov dword ptr ss:[ebp-0xBC],esi004032CB . 89B5 34FFFFFF mov dword ptr ss:[ebp-0xCC],esi004032D1 . 89B5 24FFFFFF mov dword ptr ss:[ebp-0xDC],esi004032D7 . 89B5 14FFFFFF mov dword ptr ss:[ebp-0xEC],esi004032DD . 89B5 04FFFFFF mov dword ptr ss:[ebp-0xFC],esi004032E3 . 89B5 F4FEFFFF mov dword ptr ss:[ebp-0x10C],esi004032E9 . 89B5 E4FEFFFF mov dword ptr ss:[ebp-0x11C],esi004032EF . 89B5 D4FEFFFF mov dword ptr ss:[ebp-0x12C],esi004032F5 . 89B5 C4FEFFFF mov dword ptr ss:[ebp-0x13C],esi004032FB . 89B5 B4FEFFFF mov dword ptr ss:[ebp-0x14C],esi00403301 . 89B5 A4FEFFFF mov dword ptr ss:[ebp-0x15C],esi00403307 . 89B5 94FEFFFF mov dword ptr ss:[ebp-0x16C],esi0040330D . 89B5 84FEFFFF mov dword ptr ss:[ebp-0x17C],esi00403313 . 89B5 74FEFFFF mov dword ptr ss:[ebp-0x18C],esi00403319 . 89B5 64FEFFFF mov dword ptr ss:[ebp-0x19C],esi0040331F . 89B5 54FEFFFF mov dword ptr ss:[ebp-0x1AC],esi00403325 . 89B5 44FEFFFF mov dword ptr ss:[ebp-0x1BC],esi0040332B . 89B5 34FEFFFF mov dword ptr ss:[ebp-0x1CC],esi00403331 . 89B5 24FEFFFF mov dword ptr ss:[ebp-0x1DC],esi00403337 . 89B5 14FEFFFF mov dword ptr ss:[ebp-0x1EC],esi0040333D . 89B5 04FEFFFF mov dword ptr ss:[ebp-0x1FC],esi00403343 . 89B5 F4FDFFFF mov dword ptr ss:[ebp-0x20C],esi00403349 . 89B5 E4FDFFFF mov dword ptr ss:[ebp-0x21C],esi0040334F . 89B5 D4FDFFFF mov dword ptr ss:[ebp-0x22C],esi00403355 . 89B5 C4FDFFFF mov dword ptr ss:[ebp-0x23C],esi0040335B . 89B5 B4FDFFFF mov dword ptr ss:[ebp-0x24C],esi00403361 . 89B5 A4FDFFFF mov dword ptr ss:[ebp-0x25C],esi00403367 . 89B5 94FDFFFF mov dword ptr ss:[ebp-0x26C],esi0040336D . 89B5 84FDFFFF mov dword ptr ss:[ebp-0x27C],esi00403373 . 75 15 jnz short 0040338A00403375 . 68 24404000 push 004040240040337A . 68 94174000 push 004017940040337F . FF15 9C614000 call dword ptr ds:[<&MSVBVM50.__vbaNew2>>; msvbvm50.__vbaNew200403385 . A1 24404000 mov eax,dword ptr ds:[0x404024]0040338A > 8B08 mov ecx,dword ptr ds:[eax]0040338C . 50 push eax0040338D . FF91 00030000 call dword ptr ds:[ecx+0x300]00403393 . 8B1D 3C614000 mov ebx,dword ptr ds:[<&MSVBVM50.__vbaOb>; msvbvm50.__vbaObjSet00403399 . 8D55 C0 lea edx,dword ptr ss:[ebp-0x40]0040339C . 50 push eax0040339D . 52 push edx0040339E . FFD3 call ebx ; <&MSVBVM50.__vbaObjSet>004033A0 . 8BF8 mov edi,eax004033A2 . 8D4D E4 lea ecx,dword ptr ss:[ebp-0x1C]004033A5 . 51 push ecx004033A6 . 57 push edi004033A7 . 8B07 mov eax,dword ptr ds:[edi]004033A9 . FF50 50 call dword ptr ds:[eax+0x50]004033AC . 3BC6 cmp eax,esi004033AE . 7D 0F jge short 004033BF004033B0 . 6A 50 push 0x50004033B2 . 68 A0224000 push 004022A0004033B7 . 57 push edi004033B8 . 50 push eax004033B9 . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj004033BF > A1 24404000 mov eax,dword ptr ds:[0x404024]004033C4 . 3BC6 cmp eax,esi004033C6 . 75 15 jnz short 004033DD004033C8 . 68 24404000 push 00404024004033CD . 68 94174000 push 00401794004033D2 . FF15 9C614000 call dword ptr ds:[<&MSVBVM50.__vbaNew2>>; msvbvm50.__vbaNew2004033D8 . A1 24404000 mov eax,dword ptr ds:[0x404024]004033DD > 8B10 mov edx,dword ptr ds:[eax]004033DF . 50 push eax004033E0 . FF92 00030000 call dword ptr ds:[edx+0x300]004033E6 . 50 push eax004033E7 . 8D45 BC lea eax,dword ptr ss:[ebp-0x44]004033EA . 50 push eax004033EB . FFD3 call ebx004033ED . 8BF8 mov edi,eax004033EF . 8D55 E0 lea edx,dword ptr ss:[ebp-0x20]004033F2 . 52 push edx004033F3 . 57 push edi004033F4 . 8B0F mov ecx,dword ptr ds:[edi]004033F6 . FF51 50 call dword ptr ds:[ecx+0x50]004033F9 . 3BC6 cmp eax,esi004033FB . 7D 0F jge short 0040340C004033FD . 6A 50 push 0x50004033FF . 68 A0224000 push 004022A000403404 . 57 push edi00403405 . 50 push eax00403406 . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj0040340C > A1 24404000 mov eax,dword ptr ds:[0x404024]00403411 . 3BC6 cmp eax,esi00403413 . 75 15 jnz short 0040342A00403415 . 68 24404000 push 004040240040341A . 68 94174000 push 004017940040341F . FF15 9C614000 call dword ptr ds:[<&MSVBVM50.__vbaNew2>>; msvbvm50.__vbaNew200403425 . A1 24404000 mov eax,dword ptr ds:[0x404024]0040342A > 8B08 mov ecx,dword ptr ds:[eax]0040342C . 50 push eax0040342D . FF91 00030000 call dword ptr ds:[ecx+0x300]00403433 . 8D55 B8 lea edx,dword ptr ss:[ebp-0x48]00403436 . 50 push eax00403437 . 52 push edx00403438 . FFD3 call ebx0040343A . 8BF8 mov edi,eax0040343C . 8D4D DC lea ecx,dword ptr ss:[ebp-0x24]0040343F . 51 push ecx00403440 . 57 push edi00403441 . 8B07 mov eax,dword ptr ds:[edi]00403443 . FF50 50 call dword ptr ds:[eax+0x50]00403446 . 3BC6 cmp eax,esi00403448 . 7D 0F jge short 004034590040344A . 6A 50 push 0x500040344C . 68 A0224000 push 004022A000403451 . 57 push edi00403452 . 50 push eax00403453 . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj00403459 > A1 24404000 mov eax,dword ptr ds:[0x404024]0040345E . 3BC6 cmp eax,esi00403460 . 75 15 jnz short 0040347700403462 . 68 24404000 push 0040402400403467 . 68 94174000 push 004017940040346C . FF15 9C614000 call dword ptr ds:[<&MSVBVM50.__vbaNew2>>; msvbvm50.__vbaNew200403472 . A1 24404000 mov eax,dword ptr ds:[0x404024]00403477 > 8B10 mov edx,dword ptr ds:[eax]00403479 . 50 push eax0040347A . FF92 00030000 call dword ptr ds:[edx+0x300]00403480 . 50 push eax00403481 . 8D45 B4 lea eax,dword ptr ss:[ebp-0x4C]00403484 . 50 push eax00403485 . FFD3 call ebx00403487 . 8BF8 mov edi,eax00403489 . 8D55 D8 lea edx,dword ptr ss:[ebp-0x28]0040348C . 52 push edx0040348D . 57 push edi0040348E . 8B0F mov ecx,dword ptr ds:[edi]00403490 . FF51 50 call dword ptr ds:[ecx+0x50]00403493 . 3BC6 cmp eax,esi00403495 . 7D 0F jge short 004034A600403497 . 6A 50 push 0x5000403499 . 68 A0224000 push 004022A00040349E . 57 push edi0040349F . 50 push eax004034A0 . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj004034A6 > A1 24404000 mov eax,dword ptr ds:[0x404024]004034AB . 3BC6 cmp eax,esi004034AD . 75 15 jnz short 004034C4004034AF . 68 24404000 push 00404024004034B4 . 68 94174000 push 00401794004034B9 . FF15 9C614000 call dword ptr ds:[<&MSVBVM50.__vbaNew2>>; msvbvm50.__vbaNew2004034BF . A1 24404000 mov eax,dword ptr ds:[0x404024]004034C4 > 8B08 mov ecx,dword ptr ds:[eax]004034C6 . 50 push eax004034C7 . FF91 00030000 call dword ptr ds:[ecx+0x300]004034CD . 8D55 B0 lea edx,dword ptr ss:[ebp-0x50]004034D0 . 50 push eax004034D1 . 52 push edx004034D2 . FFD3 call ebx004034D4 . 8BF8 mov edi,eax004034D6 . 8D4D D4 lea ecx,dword ptr ss:[ebp-0x2C]004034D9 . 51 push ecx004034DA . 57 push edi004034DB . 8B07 mov eax,dword ptr ds:[edi]004034DD . FF50 50 call dword ptr ds:[eax+0x50]004034E0 . 3BC6 cmp eax,esi004034E2 . 7D 0F jge short 004034F3004034E4 . 6A 50 push 0x50004034E6 . 68 A0224000 push 004022A0004034EB . 57 push edi004034EC . 50 push eax004034ED . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj004034F3 > A1 24404000 mov eax,dword ptr ds:[0x404024]004034F8 . 3BC6 cmp eax,esi004034FA . 75 15 jnz short 00403511004034FC . 68 24404000 push 0040402400403501 . 68 94174000 push 0040179400403506 . FF15 9C614000 call dword ptr ds:[<&MSVBVM50.__vbaNew2>>; msvbvm50.__vbaNew20040350C . A1 24404000 mov eax,dword ptr ds:[0x404024]00403511 > 8B10 mov edx,dword ptr ds:[eax]00403513 . 50 push eax00403514 . FF92 00030000 call dword ptr ds:[edx+0x300]0040351A . 50 push eax0040351B . 8D45 AC lea eax,dword ptr ss:[ebp-0x54]0040351E . 50 push eax0040351F . FFD3 call ebx00403521 . 8BF8 mov edi,eax00403523 . 8D55 D0 lea edx,dword ptr ss:[ebp-0x30]00403526 . 52 push edx00403527 . 57 push edi00403528 . 8B0F mov ecx,dword ptr ds:[edi]0040352A . FF51 50 call dword ptr ds:[ecx+0x50]0040352D . 3BC6 cmp eax,esi0040352F . 7D 0F jge short 0040354000403531 . 6A 50 push 0x5000403533 . 68 A0224000 push 004022A000403538 . 57 push edi00403539 . 50 push eax0040353A . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj00403540 > A1 24404000 mov eax,dword ptr ds:[0x404024]00403545 . 3BC6 cmp eax,esi00403547 . 75 15 jnz short 0040355E00403549 . 68 24404000 push 004040240040354E . 68 94174000 push 0040179400403553 . FF15 9C614000 call dword ptr ds:[<&MSVBVM50.__vbaNew2>>; msvbvm50.__vbaNew200403559 . A1 24404000 mov eax,dword ptr ds:[0x404024]0040355E > 8B08 mov ecx,dword ptr ds:[eax]00403560 . 50 push eax00403561 . FF91 00030000 call dword ptr ds:[ecx+0x300]00403567 . 8D55 A8 lea edx,dword ptr ss:[ebp-0x58]0040356A . 50 push eax0040356B . 52 push edx0040356C . FFD3 call ebx0040356E . 8BF8 mov edi,eax00403570 . 8D4D CC lea ecx,dword ptr ss:[ebp-0x34]00403573 . 51 push ecx00403574 . 57 push edi00403575 . 8B07 mov eax,dword ptr ds:[edi]00403577 . FF50 50 call dword ptr ds:[eax+0x50]0040357A . 3BC6 cmp eax,esi0040357C . 7D 0F jge short 0040358D0040357E . 6A 50 push 0x5000403580 . 68 A0224000 push 004022A000403585 . 57 push edi00403586 . 50 push eax00403587 . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj0040358D > A1 24404000 mov eax,dword ptr ds:[0x404024]00403592 . 3BC6 cmp eax,esi00403594 . 75 15 jnz short 004035AB00403596 . 68 24404000 push 004040240040359B . 68 94174000 push 00401794004035A0 . FF15 9C614000 call dword ptr ds:[<&MSVBVM50.__vbaNew2>>; msvbvm50.__vbaNew2004035A6 . A1 24404000 mov eax,dword ptr ds:[0x404024]004035AB > 8B10 mov edx,dword ptr ds:[eax]004035AD . 50 push eax004035AE . FF92 00030000 call dword ptr ds:[edx+0x300]004035B4 . 50 push eax004035B5 . 8D45 A4 lea eax,dword ptr ss:[ebp-0x5C]004035B8 . 50 push eax004035B9 . FFD3 call ebx004035BB . 8BF8 mov edi,eax004035BD . 8D55 C8 lea edx,dword ptr ss:[ebp-0x38]004035C0 . 52 push edx004035C1 . 57 push edi004035C2 . 8B0F mov ecx,dword ptr ds:[edi]004035C4 . FF51 50 call dword ptr ds:[ecx+0x50]004035C7 . 3BC6 cmp eax,esi004035C9 . 7D 0F jge short 004035DA004035CB . 6A 50 push 0x50004035CD . 68 A0224000 push 004022A0004035D2 . 57 push edi004035D3 . 50 push eax004035D4 . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj004035DA > 8B45 08 mov eax,dword ptr ss:[ebp+0x8]004035DD . 8B8D 98FCFFFF mov ecx,dword ptr ss:[ebp-0x368]004035E3 . 50 push eax004035E4 . FF91 08030000 call dword ptr ds:[ecx+0x308]004035EA . 8D55 C4 lea edx,dword ptr ss:[ebp-0x3C]004035ED . 50 push eax004035EE . 52 push edx004035EF . FFD3 call ebx004035F1 . 8BF8 mov edi,eax004035F3 . 8D4D E8 lea ecx,dword ptr ss:[ebp-0x18]004035F6 . 51 push ecx004035F7 . 57 push edi004035F8 . 8B07 mov eax,dword ptr ds:[edi]004035FA . FF90 A0000000 call dword ptr ds:[eax+0xA0]00403600 . 3BC6 cmp eax,esi00403602 . 7D 12 jge short 0040361600403604 . 68 A0000000 push 0xA000403609 . 68 C0224000 push 004022C00040360E . 57 push edi0040360F . 50 push eax00403610 . FF15 34614000 call dword ptr ds:[<&MSVBVM50.__vbaHresu>; msvbvm50.__vbaHresultCheckObj00403616 > 8B45 E8 mov eax,dword ptr ss:[ebp-0x18]00403619 . 8B3D 58614000 mov edi,dword ptr ds:[<&MSVBVM50.#632>] ; msvbvm50.rtcMidCharVar0040361F . 8985 ACFDFFFF mov dword ptr ss:[ebp-0x254],eax00403625 . 8B45 E4 mov eax,dword ptr ss:[ebp-0x1C]00403628 . 8D55 84 lea edx,dword ptr ss:[ebp-0x7C]0040362B . 8945 9C mov dword ptr ss:[ebp-0x64],eax0040362E . 52 push edx0040362F . 8D45 94 lea eax,dword ptr ss:[ebp-0x6C]00403632 . 6A 06 push 0x600403634 . 8D8D 74FFFFFF lea ecx,dword ptr ss:[ebp-0x8C]0040363A . BB 02000000 mov ebx,0x20040363F . 50 push eax ; UNICODE "bPe CrackMe v1.0 "00403640 . 51 push ecx00403641 . 8975 E8 mov dword ptr ss:[ebp-0x18],esi00403644 . C785 A4FDFFFF>mov dword ptr ss:[ebp-0x25C],0x80080040364E . C745 8C 01000>mov dword ptr ss:[ebp-0x74],0x100403655 . 895D 84 mov dword ptr ss:[ebp-0x7C],ebx00403658 . 8975 E4 mov dword ptr ss:[ebp-0x1C],esi0040365B . C745 94 08000>mov dword ptr ss:[ebp-0x6C],0x800403662 . FFD7 call edi ; msvbvm50.rtcMidCharVar; <&MSVBVM50.#632>00403664 . 8B45 E0 mov eax,dword ptr ss:[ebp-0x20]00403667 . 8D95 54FFFFFF lea edx,dword ptr ss:[ebp-0xAC]0040366D . 8985 6CFFFFFF mov dword ptr ss:[ebp-0x94],eax00403673 . 52 push edx00403674 . 8D85 64FFFFFF lea eax,dword ptr ss:[ebp-0x9C]0040367A . 6A 09 push 0x90040367C . 8D8D 44FFFFFF lea ecx,dword ptr ss:[ebp-0xBC]00403682 . 50 push eax ; UNICODE "bPe CrackMe v1.0 "00403683 . 51 push ecx00403684 . C785 5CFFFFFF>mov dword ptr ss:[ebp-0xA4],0x10040368E . 899D 54FFFFFF mov dword ptr ss:[ebp-0xAC],ebx00403694 . 8975 E0 mov dword ptr ss:[ebp-0x20],esi00403697 . C785 64FFFFFF>mov dword ptr ss:[ebp-0x9C],0x8004036A1 . FFD7 call edi ; msvbvm50.rtcMidCharVar004036A3 . 8B45 DC mov eax,dword ptr ss:[ebp-0x24]004036A6 . 8D95 14FFFFFF lea edx,dword ptr ss:[ebp-0xEC]004036AC . 8985 2CFFFFFF mov dword ptr ss:[ebp-0xD4],eax004036B2 . 52 push edx004036B3 . 8D85 24FFFFFF lea eax,dword ptr ss:[ebp-0xDC]004036B9 . 68 8F000000 push 0x8F004036BE . 8D8D 04FFFFFF lea ecx,dword ptr ss:[ebp-0xFC]004036C4 . 50 push eax ; UNICODE "bPe CrackMe v1.0 "004036C5 . 51 push ecx004036C6 . C785 1CFFFFFF>mov dword ptr ss:[ebp-0xE4],0x1004036D0 . 899D 14FFFFFF mov dword ptr ss:[ebp-0xEC],ebx004036D6 . 8975 DC mov dword ptr ss:[ebp-0x24],esi004036D9 . C785 24FFFFFF>mov dword ptr ss:[ebp-0xDC],0x8004036E3 . FFD7 call edi ; msvbvm50.rtcMidCharVar004036E5 . 8B45 D8 mov eax,dword ptr ss:[ebp-0x28]004036E8 . 8D95 D4FEFFFF lea edx,dword ptr ss:[ebp-0x12C]004036EE . 8985 ECFEFFFF mov dword ptr ss:[ebp-0x114],eax004036F4 . 52 push edx004036F5 . 8D85 E4FEFFFF lea eax,dword ptr ss:[ebp-0x11C]004036FB . 6A 10 push 0x10004036FD . 8D8D C4FEFFFF lea ecx,dword ptr ss:[ebp-0x13C]00403703 . 50 push eax00403704 . 51 push ecx00403705 . C785 DCFEFFFF>mov dword ptr ss:[ebp-0x124],0x10040370F . 899D D4FEFFFF mov dword ptr ss:[ebp-0x12C],ebx00403715 . 8975 D8 mov dword ptr ss:[ebp-0x28],esi00403718 . C785 E4FEFFFF>mov dword ptr ss:[ebp-0x11C],0x800403722 . FFD7 call edi ; msvbvm50.rtcMidCharVar00403724 . 8B45 D4 mov eax,dword ptr ss:[ebp-0x2C]00403727 . 8D95 94FEFFFF lea edx,dword ptr ss:[ebp-0x16C]0040372D . 8985 ACFEFFFF mov dword ptr ss:[ebp-0x154],eax00403733 . 52 push edx00403734 . 8D85 A4FEFFFF lea eax,dword ptr ss:[ebp-0x15C]0040373A . 68 A1000000 push 0xA10040373F . 8D8D 84FEFFFF lea ecx,dword ptr ss:[ebp-0x17C]00403745 . 50 push eax00403746 . 51 push ecx00403747 . C785 9CFEFFFF>mov dword ptr ss:[ebp-0x164],0x100403751 . 899D 94FEFFFF mov dword ptr ss:[ebp-0x16C],ebx00403757 . 8975 D4 mov dword ptr ss:[ebp-0x2C],esi0040375A . C785 A4FEFFFF>mov dword ptr ss:[ebp-0x15C],0x800403764 . FFD7 call edi ; msvbvm50.rtcMidCharVar00403766 . 8B45 D0 mov eax,dword ptr ss:[ebp-0x30]00403769 . C785 5CFEFFFF>mov dword ptr ss:[ebp-0x1A4],0x100403773 . 899D 54FEFFFF mov dword ptr ss:[ebp-0x1AC],ebx00403779 . 8975 D0 mov dword ptr ss:[ebp-0x30],esi0040377C . 8985 6CFEFFFF mov dword ptr ss:[ebp-0x194],eax00403782 . 8D95 54FEFFFF lea edx,dword ptr ss:[ebp-0x1AC]00403788 . 8D85 64FEFFFF lea eax,dword ptr ss:[ebp-0x19C]0040378E . 52 push edx0040378F . 68 AB000000 push 0xAB00403794 . 8D8D 44FEFFFF lea ecx,dword ptr ss:[ebp-0x1BC]0040379A . 50 push eax0040379B . 51 push ecx0040379C . C785 64FEFFFF>mov dword ptr ss:[ebp-0x19C],0x8004037A6 . FFD7 call edi ; msvbvm50.rtcMidCharVar004037A8 . 8B45 CC mov eax,dword ptr ss:[ebp-0x34]004037AB . 8D95 14FEFFFF lea edx,dword ptr ss:[ebp-0x1EC]004037B1 . 8985 2CFEFFFF mov dword ptr ss:[ebp-0x1D4],eax004037B7 . 52 push edx004037B8 . 8D85 24FEFFFF lea eax,dword ptr ss:[ebp-0x1DC]004037BE . 68 A6000000 push 0xA6004037C3 . 8D8D 04FEFFFF lea ecx,dword ptr ss:[ebp-0x1FC]004037C9 . 50 push eax004037CA . 51 push ecx004037CB . C785 1CFEFFFF>mov dword ptr ss:[ebp-0x1E4],0x1004037D5 . 899D 14FEFFFF mov dword ptr ss:[ebp-0x1EC],ebx004037DB . 8975 CC mov dword ptr ss:[ebp-0x34],esi004037DE . C785 24FEFFFF>mov dword ptr ss:[ebp-0x1DC],0x8004037E8 . FFD7 call edi ; msvbvm50.rtcMidCharVar004037EA . 8B45 C8 mov eax,dword ptr ss:[ebp-0x38]004037ED . 8D95 D4FDFFFF lea edx,dword ptr ss:[ebp-0x22C]004037F3 . 8985 ECFDFFFF mov dword ptr ss:[ebp-0x214],eax004037F9 . 52 push edx004037FA . 8D85 E4FDFFFF lea eax,dword ptr ss:[ebp-0x21C]00403800 . 68 A8000000 push 0xA800403805 . 8D8D C4FDFFFF lea ecx,dword ptr ss:[ebp-0x23C]0040380B . 50 push eax0040380C . 51 push ecx0040380D . C785 DCFDFFFF>mov dword ptr ss:[ebp-0x224],0x100403817 . 899D D4FDFFFF mov dword ptr ss:[ebp-0x22C],ebx0040381D . 8975 C8 mov dword ptr ss:[ebp-0x38],esi00403820 . C785 E4FDFFFF>mov dword ptr ss:[ebp-0x21C],0x80040382A . FFD7 call edi ; msvbvm50.rtcMidCharVar0040382C . 8B3D C0614000 mov edi,dword ptr ds:[<&MSVBVM50.__vbaVa>; msvbvm50.__vbaVarAdd00403832 . 8D95 A4FDFFFF lea edx,dword ptr ss:[ebp-0x25C]00403838 . 8D85 74FFFFFF lea eax,dword ptr ss:[ebp-0x8C]0040383E . 52 push edx ; // "123123"0040383F . 8D8D 44FFFFFF lea ecx,dword ptr ss:[ebp-0xBC]00403845 . 50 push eax ; // eax ="r"00403846 . 8D95 34FFFFFF lea edx,dword ptr ss:[ebp-0xCC]0040384C . 51 push ecx ; // ecx ="k"0040384D . 52 push edx0040384E . FFD7 call edi ; msvbvm50.__vbaVarAdd; <&MSVBVM50.__vbaVarAdd>00403850 . 50 push eax ; // eax = "rk"00403851 . 8D85 04FFFFFF lea eax,dword ptr ss:[ebp-0xFC]00403857 . 8D8D F4FEFFFF lea ecx,dword ptr ss:[ebp-0x10C]0040385D . 50 push eax ; // rax ="h"0040385E . 51 push ecx0040385F . FFD7 call edi ; msvbvm50.__vbaVarAdd00403861 . 50 push eax ; // eax = "rkh"00403862 . 8D95 C4FEFFFF lea edx,dword ptr ss:[ebp-0x13C]00403868 . 8D85 B4FEFFFF lea eax,dword ptr ss:[ebp-0x14C]0040386E . 52 push edx ; // edx = "1"0040386F . 50 push eax00403870 . FFD7 call edi ; msvbvm50.__vbaVarAdd00403872 . 8D8D 84FEFFFF lea ecx,dword ptr ss:[ebp-0x17C] ; // eax = "rkh1"00403878 . 50 push eax00403879 . 8D95 74FEFFFF lea edx,dword ptr ss:[ebp-0x18C]0040387F . 51 push ecx ; // ecx ="o"00403880 . 52 push edx00403881 . FFD7 call edi ; msvbvm50.__vbaVarAdd00403883 . 50 push eax00403884 . 8D85 44FEFFFF lea eax,dword ptr ss:[ebp-0x1BC]0040388A . 8D8D 34FEFFFF lea ecx,dword ptr ss:[ebp-0x1CC]00403890 . 50 push eax ; // "y"00403891 . 51 push ecx00403892 . FFD7 call edi ; msvbvm50.__vbaVarAdd00403894 . 50 push eax ; // eax = "rkh1oy"00403895 . 8D95 04FEFFFF lea edx,dword ptr ss:[ebp-0x1FC]0040389B . 8D85 F4FDFFFF lea eax,dword ptr ss:[ebp-0x20C]004038A1 . 52 push edx ; // "i"004038A2 . 50 push eax004038A3 . FFD7 call edi ; msvbvm50.__vbaVarAdd004038A5 . 8D8D C4FDFFFF lea ecx,dword ptr ss:[ebp-0x23C]004038AB . 50 push eax004038AC . 51 push ecx ; // "e"004038AD . 8D95 B4FDFFFF lea edx,dword ptr ss:[ebp-0x24C]004038B3 . 52 push edx004038B4 . FFD7 call edi ; msvbvm50.__vbaVarAdd004038B6 . 50 push eax ; // Arg1 = eax ="rkh1oyie", Arg2="123123"004038B7 . FF15 6C614000 call dword ptr ds:[<&MSVBVM50.__vbaVarTs>; msvbvm50.__vbaVarTstEq004038BD . 8BF8 mov edi,eax ; // eax = 结果004038BF . 8D45 A4 lea eax,dword ptr ss:[ebp-0x5C]004038C2 . 8D4D A8 lea ecx,dword ptr ss:[ebp-0x58]004038C5 . 50 push eax004038C6 . 8D55 AC lea edx,dword ptr ss:[ebp-0x54]004038C9 . 51 push ecx004038CA . 8D45 B0 lea eax,dword ptr ss:[ebp-0x50]004038CD . 52 push edx004038CE . 8D4D B4 lea ecx,dword ptr ss:[ebp-0x4C]004038D1 . 50 push eax004038D2 . 8D55 B8 lea edx,dword ptr ss:[ebp-0x48]004038D5 . 51 push ecx004038D6 . 8D45 BC lea eax,dword ptr ss:[ebp-0x44]004038D9 . 52 push edx004038DA . 8D4D C0 lea ecx,dword ptr ss:[ebp-0x40]004038DD . 50 push eax004038DE . 8D55 C4 lea edx,dword ptr ss:[ebp-0x3C]004038E1 . 51 push ecx004038E2 . 52 push edx004038E3 . 6A 09 push 0x9004038E5 . FF15 28614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeO>; msvbvm50.__vbaFreeObjList004038EB . 83C4 28 add esp,0x28004038EE . 8D85 C4FDFFFF lea eax,dword ptr ss:[ebp-0x23C]004038F4 . 8D8D F4FDFFFF lea ecx,dword ptr ss:[ebp-0x20C]004038FA . 8D95 D4FDFFFF lea edx,dword ptr ss:[ebp-0x22C]00403900 . 50 push eax00403901 . 51 push ecx00403902 . 8D85 E4FDFFFF lea eax,dword ptr ss:[ebp-0x21C]00403908 . 52 push edx00403909 . 8D8D 04FEFFFF lea ecx,dword ptr ss:[ebp-0x1FC]0040390F . 50 push eax00403910 . 8D95 34FEFFFF lea edx,dword ptr ss:[ebp-0x1CC]00403916 . 51 push ecx00403917 . 8D85 14FEFFFF lea eax,dword ptr ss:[ebp-0x1EC]0040391D . 52 push edx0040391E . 8D8D 24FEFFFF lea ecx,dword ptr ss:[ebp-0x1DC]00403924 . 50 push eax00403925 . 8D95 44FEFFFF lea edx,dword ptr ss:[ebp-0x1BC]0040392B . 51 push ecx0040392C . 8D85 74FEFFFF lea eax,dword ptr ss:[ebp-0x18C]00403932 . 52 push edx00403933 . 8D8D 54FEFFFF lea ecx,dword ptr ss:[ebp-0x1AC]00403939 . 50 push eax0040393A . 8D95 64FEFFFF lea edx,dword ptr ss:[ebp-0x19C]00403940 . 51 push ecx00403941 . 8D85 84FEFFFF lea eax,dword ptr ss:[ebp-0x17C]00403947 . 52 push edx00403948 . 8D8D B4FEFFFF lea ecx,dword ptr ss:[ebp-0x14C]0040394E . 50 push eax0040394F . 8D95 94FEFFFF lea edx,dword ptr ss:[ebp-0x16C]00403955 . 51 push ecx00403956 . 8D85 A4FEFFFF lea eax,dword ptr ss:[ebp-0x15C]0040395C . 52 push edx0040395D . 8D8D C4FEFFFF lea ecx,dword ptr ss:[ebp-0x13C]00403963 . 50 push eax00403964 . 8D95 F4FEFFFF lea edx,dword ptr ss:[ebp-0x10C]0040396A . 51 push ecx0040396B . 8D85 D4FEFFFF lea eax,dword ptr ss:[ebp-0x12C]00403971 . 52 push edx00403972 . 8D8D E4FEFFFF lea ecx,dword ptr ss:[ebp-0x11C]00403978 . 50 push eax00403979 . 8D95 04FFFFFF lea edx,dword ptr ss:[ebp-0xFC]0040397F . 51 push ecx00403980 . 8D85 34FFFFFF lea eax,dword ptr ss:[ebp-0xCC]00403986 . 52 push edx00403987 . 8D8D 14FFFFFF lea ecx,dword ptr ss:[ebp-0xEC]0040398D . 50 push eax0040398E . 8D95 24FFFFFF lea edx,dword ptr ss:[ebp-0xDC]00403994 . 51 push ecx00403995 . 8D85 44FFFFFF lea eax,dword ptr ss:[ebp-0xBC]0040399B . 52 push edx0040399C . 8D8D 74FFFFFF lea ecx,dword ptr ss:[ebp-0x8C]004039A2 . 50 push eax004039A3 . 8D95 54FFFFFF lea edx,dword ptr ss:[ebp-0xAC]004039A9 . 51 push ecx004039AA . 52 push edx004039AB . 8D85 64FFFFFF lea eax,dword ptr ss:[ebp-0x9C]004039B1 . 8D4D 84 lea ecx,dword ptr ss:[ebp-0x7C]004039B4 . 50 push eax004039B5 . 8D55 94 lea edx,dword ptr ss:[ebp-0x6C]004039B8 . 51 push ecx004039B9 . 8D85 B4FDFFFF lea eax,dword ptr ss:[ebp-0x24C]004039BF . 52 push edx004039C0 . 8D8D A4FDFFFF lea ecx,dword ptr ss:[ebp-0x25C]004039C6 . 50 push eax004039C7 . 51 push ecx004039C8 . 6A 20 push 0x20004039CA . FF15 1C614000 call dword ptr ds:[<&MSVBVM50.__vbaFreeV>; msvbvm50.__vbaFreeVarList004039D0 . 81C4 84000000 add esp,0x84004039D6 . 66:3BFE cmp di,si004039D9 74 22 je short 004039FD ; // 如果正确，将结果给另一个变量赋值004039DB . 8B45 08 mov eax,dword ptr ss:[ebp+0x8]004039DE . 8D95 84FDFFFF lea edx,dword ptr ss:[ebp-0x27C]004039E4 . C785 8CFDFFFF>mov dword ptr ss:[ebp-0x274],0x1004039EE . 899D 84FDFFFF mov dword ptr ss:[ebp-0x27C],ebx004039F4 . 8D48 34 lea ecx,dword ptr ds:[eax+0x34]004039F7 . FF15 10614000 call dword ptr ds:[<&MSVBVM50.__vbaVarMo>; msvbvm50.__vbaVarMove004039FD > 68 563B4000 push 00403B5600403A02 . E9 4E010000 jmp 00403B55
上半部分 msvbvm50.rtcMidCharVar 都是对 UNICODE "bPe CrackMe v1.0 " 进行处理，并且结果未发现进行了什么处理，似乎都没什么用处。只有最后的部分才是真正的处理比较。
虽然具体内容分析了出来，但是还是不是很明白为什么有这么多的加法和比较，最后得到的文本还是一个固定的：rkh1oyie。
BY 笨笨D幸福
声明：以上内容来自用户投稿及互联网公开渠道收集整理发布，本网站不拥有所有权，未作人工编辑处理，也不承担相关法律责任，若内容有误或涉及侵权可进行投诉： 投诉/举报 工作人员会在5个工作日内联系你，一经查实，本站将立刻删除涉嫌侵权内容。