吾爱汇编

 找回密码
 立即注册

QQ登录

绑定QQ避免忘记帐号

查看: 5718|回复: 29

[原创逆向图文] 无任何提示的软件~算法分析

  [复制链接]
chuan0326 发表于 2018-6-11 00:13 | 显示全部楼层 |阅读模式

解压后请执行auto.exe,软件是繁体的,打开软件需要用apploc,以繁体模式运行,才能打开待网路连线下载资料完成,再点选66,此时载入od方可运行
这软件爆破非常简单,主要是讨论算法的思路  值得大家讨论研究。
软件1个月试用
可以直接更动系统日期,使软件过期,挑战17位注册码高难度算法。


软体1个月试用期逆向序号及方法

9位注册码算法
123456789
(10进制第2+3+4+5+7+8+9位+31(1F)=1,6的和
3,9位=程式代码(如66)
------------------------------------------------
试用期过后序号是17位

17位注册码算法总结
第1+2+3+5+6+7+8+9+10+11+12+13+14+16+17位+25---T3
取1个月试用期间的真序号---设T4
取假码第12.10.16.2.6.7.9.14.3位合并----设为T2

1.T3/64(100->10进制)余数与第4,15位相等
2.假码3,16位数相反与程式代号66(Luck66)相等
5.T4与T2字串比较
3-4的验证分析就要麻烦先进了
軟件大小 15MB
游客,如果您要查看本帖隐藏内容请回复




代码简略

[Asm] 纯文本查看 复制代码
00513AA3   .  53            push ebx                                         ; F2
00513AA4   .  56            push esi
00513AA5   .  57            push edi
00513AA6   .  8965 E8       mov dword ptr ss:[ebp-18],esp
00513AA9   .  C745 EC 405A4>mov dword ptr ss:[ebp-14],00405A40
00513AB0   .  8B45 08       mov eax,dword ptr ss:[ebp+8]
00513AB3   .  83E0 01       and eax,1
00513AB6   .  8945 F0       mov dword ptr ss:[ebp-10],eax
00513AB9   .  8B4D 08       mov ecx,dword ptr ss:[ebp+8]
00513ABC   .  83E1 FE       and ecx,FFFFFFFE
00513ABF   .  894D 08       mov dword ptr ss:[ebp+8],ecx
00513AC2   .  C745 F4 00000>mov dword ptr ss:[ebp-C],0
00513AC9   .  8B55 08       mov edx,dword ptr ss:[ebp+8]
00513ACC   .  8B02          mov eax,dword ptr ds:[edx]
00513ACE   .  8B4D 08       mov ecx,dword ptr ss:[ebp+8]
00513AD1   .  51            push ecx
//
//
略


算法代码
0051558A   .  52            push edx
0051558B   .  6A 1A         push 1A
0051558D   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
00515593   .  83C4 6C       add esp,6C
00515596   .  C745 FC 20000>mov dword ptr ss:[ebp-4],20
0051559D   .  B8 01000000   mov eax,1
005155A2   .  83E8 01       sub eax,1
005155A5   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
005155AB   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
005155B2   .  73 0C         jnb short 005155C0
005155B4   .  C785 B4FAFFFF>mov dword ptr ss:[ebp-54C],0
005155BE   .  EB 0C         jmp short 005155CC
005155C0   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005155C6   .  8985 B4FAFFFF mov dword ptr ss:[ebp-54C],eax
005155CC   >  B9 02000000   mov ecx,2
005155D1   .  83E9 01       sub ecx,1
005155D4   .  898D 30FCFFFF mov dword ptr ss:[ebp-3D0],ecx
005155DA   .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
005155E1   .  73 0C         jnb short 005155EF
005155E3   .  C785 B0FAFFFF>mov dword ptr ss:[ebp-550],0
005155ED   .  EB 0C         jmp short 005155FB
005155EF   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005155F5   .  8985 B0FAFFFF mov dword ptr ss:[ebp-550],eax
005155FB   >  BA 03000000   mov edx,3
00515600   .  83EA 01       sub edx,1
00515603   .  8995 2CFCFFFF mov dword ptr ss:[ebp-3D4],edx
00515609   .  83BD 2CFCFFFF>cmp dword ptr ss:[ebp-3D4],64
00515610   .  73 0C         jnb short 0051561E
00515612   .  C785 ACFAFFFF>mov dword ptr ss:[ebp-554],0
0051561C   .  EB 0C         jmp short 0051562A
0051561E   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515624   .  8985 ACFAFFFF mov dword ptr ss:[ebp-554],eax
0051562A   >  B8 05000000   mov eax,5
0051562F   .  83E8 01       sub eax,1
00515632   .  8985 28FCFFFF mov dword ptr ss:[ebp-3D8],eax
00515638   .  83BD 28FCFFFF>cmp dword ptr ss:[ebp-3D8],64
0051563F   .  73 0C         jnb short 0051564D
00515641   .  C785 A8FAFFFF>mov dword ptr ss:[ebp-558],0
0051564B   .  EB 0C         jmp short 00515659
0051564D   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515653   .  8985 A8FAFFFF mov dword ptr ss:[ebp-558],eax
00515659   >  B9 06000000   mov ecx,6
0051565E   .  83E9 01       sub ecx,1
00515661   .  898D 24FCFFFF mov dword ptr ss:[ebp-3DC],ecx
00515667   .  83BD 24FCFFFF>cmp dword ptr ss:[ebp-3DC],64
0051566E   .  73 0C         jnb short 0051567C
00515670   .  C785 A4FAFFFF>mov dword ptr ss:[ebp-55C],0
0051567A   .  EB 0C         jmp short 00515688
0051567C   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515682   .  8985 A4FAFFFF mov dword ptr ss:[ebp-55C],eax
00515688   >  BA 07000000   mov edx,7
0051568D   .  83EA 01       sub edx,1
00515690   .  8995 20FCFFFF mov dword ptr ss:[ebp-3E0],edx
00515696   .  83BD 20FCFFFF>cmp dword ptr ss:[ebp-3E0],64
0051569D   .  73 0C         jnb short 005156AB
0051569F   .  C785 A0FAFFFF>mov dword ptr ss:[ebp-560],0
005156A9   .  EB 0C         jmp short 005156B7
005156AB   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005156B1   .  8985 A0FAFFFF mov dword ptr ss:[ebp-560],eax
005156B7   >  B8 08000000   mov eax,8
005156BC   .  83E8 01       sub eax,1
005156BF   .  8985 1CFCFFFF mov dword ptr ss:[ebp-3E4],eax
005156C5   .  83BD 1CFCFFFF>cmp dword ptr ss:[ebp-3E4],64
005156CC   .  73 0C         jnb short 005156DA
005156CE   .  C785 9CFAFFFF>mov dword ptr ss:[ebp-564],0
005156D8   .  EB 0C         jmp short 005156E6
005156DA   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005156E0   .  8985 9CFAFFFF mov dword ptr ss:[ebp-564],eax
005156E6   >  B9 09000000   mov ecx,9
005156EB   .  83E9 01       sub ecx,1
005156EE   .  898D 18FCFFFF mov dword ptr ss:[ebp-3E8],ecx
005156F4   .  83BD 18FCFFFF>cmp dword ptr ss:[ebp-3E8],64
005156FB   .  73 0C         jnb short 00515709
005156FD   .  C785 98FAFFFF>mov dword ptr ss:[ebp-568],0
00515707   .  EB 0C         jmp short 00515715
00515709   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051570F   .  8985 98FAFFFF mov dword ptr ss:[ebp-568],eax
00515715   >  BA 0A000000   mov edx,0A
0051571A   .  83EA 01       sub edx,1
0051571D   .  8995 14FCFFFF mov dword ptr ss:[ebp-3EC],edx
00515723   .  83BD 14FCFFFF>cmp dword ptr ss:[ebp-3EC],64
0051572A   .  73 0C         jnb short 00515738
0051572C   .  C785 94FAFFFF>mov dword ptr ss:[ebp-56C],0
00515736   .  EB 0C         jmp short 00515744
00515738   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051573E   .  8985 94FAFFFF mov dword ptr ss:[ebp-56C],eax
00515744   >  B8 0B000000   mov eax,0B
00515749   .  83E8 01       sub eax,1
0051574C   .  8985 10FCFFFF mov dword ptr ss:[ebp-3F0],eax
00515752   .  83BD 10FCFFFF>cmp dword ptr ss:[ebp-3F0],64
00515759   .  73 0C         jnb short 00515767
0051575B   .  C785 90FAFFFF>mov dword ptr ss:[ebp-570],0
00515765   .  EB 0C         jmp short 00515773
00515767   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051576D   .  8985 90FAFFFF mov dword ptr ss:[ebp-570],eax
00515773   >  B9 0C000000   mov ecx,0C
00515778   .  83E9 01       sub ecx,1
0051577B   .  898D 0CFCFFFF mov dword ptr ss:[ebp-3F4],ecx
00515781   .  83BD 0CFCFFFF>cmp dword ptr ss:[ebp-3F4],64
00515788   .  73 0C         jnb short 00515796
0051578A   .  C785 8CFAFFFF>mov dword ptr ss:[ebp-574],0
00515794   .  EB 0C         jmp short 005157A2
00515796   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051579C   .  8985 8CFAFFFF mov dword ptr ss:[ebp-574],eax
005157A2   >  BA 0D000000   mov edx,0D
005157A7   .  83EA 01       sub edx,1
005157AA   .  8995 08FCFFFF mov dword ptr ss:[ebp-3F8],edx
005157B0   .  83BD 08FCFFFF>cmp dword ptr ss:[ebp-3F8],64
005157B7   .  73 0C         jnb short 005157C5
005157B9   .  C785 88FAFFFF>mov dword ptr ss:[ebp-578],0
005157C3   .  EB 0C         jmp short 005157D1
005157C5   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005157CB   .  8985 88FAFFFF mov dword ptr ss:[ebp-578],eax
005157D1   >  B8 0E000000   mov eax,0E
005157D6   .  83E8 01       sub eax,1
005157D9   .  8985 04FCFFFF mov dword ptr ss:[ebp-3FC],eax
005157DF   .  83BD 04FCFFFF>cmp dword ptr ss:[ebp-3FC],64
005157E6   .  73 0C         jnb short 005157F4
005157E8   .  C785 84FAFFFF>mov dword ptr ss:[ebp-57C],0
005157F2   .  EB 0C         jmp short 00515800
005157F4   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005157FA   .  8985 84FAFFFF mov dword ptr ss:[ebp-57C],eax
00515800   >  B9 10000000   mov ecx,10
00515805   .  83E9 01       sub ecx,1
00515808   .  898D 00FCFFFF mov dword ptr ss:[ebp-400],ecx
0051580E   .  83BD 00FCFFFF>cmp dword ptr ss:[ebp-400],64
00515815   .  73 0C         jnb short 00515823
00515817   .  C785 80FAFFFF>mov dword ptr ss:[ebp-580],0
00515821   .  EB 0C         jmp short 0051582F
00515823   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515829   .  8985 80FAFFFF mov dword ptr ss:[ebp-580],eax
0051582F   >  BA 11000000   mov edx,11
00515834   .  83EA 01       sub edx,1
00515837   .  8995 FCFBFFFF mov dword ptr ss:[ebp-404],edx
0051583D   .  83BD FCFBFFFF>cmp dword ptr ss:[ebp-404],64
00515844   .  73 0C         jnb short 00515852
00515846   .  C785 7CFAFFFF>mov dword ptr ss:[ebp-584],0
00515850   .  EB 0C         jmp short 0051585E
00515852   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515858   .  8985 7CFAFFFF mov dword ptr ss:[ebp-584],eax    <---------------------->算法   
0051585E   >  8B85 34FCFFFF mov eax,dword ptr ss:[ebp-3CC]
00515864   .  8B8D 30FCFFFF mov ecx,dword ptr ss:[ebp-3D0]
0051586A   .  8A90 64E15300 mov dl,byte ptr ds:[eax+53E164]
00515870   .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
00515876   .  0F82 22130000 jb 00516B9E
0051587C   .  8B85 2CFCFFFF mov eax,dword ptr ss:[ebp-3D4]
00515882   .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
00515888   .  0F82 10130000 jb 00516B9E
0051588E   .  8B8D 28FCFFFF mov ecx,dword ptr ss:[ebp-3D8]
00515894   .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
0051589A   .  0F82 FE120000 jb 00516B9E
005158A0   .  8B85 24FCFFFF mov eax,dword ptr ss:[ebp-3DC]
005158A6   .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
005158AC   .  0F82 EC120000 jb 00516B9E
005158B2   .  8B8D 20FCFFFF mov ecx,dword ptr ss:[ebp-3E0]
005158B8   .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
005158BE   .  0F82 DA120000 jb 00516B9E
005158C4   .  8B85 1CFCFFFF mov eax,dword ptr ss:[ebp-3E4]
005158CA   .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
005158D0   .  0F82 C8120000 jb 00516B9E
005158D6   .  8B8D 18FCFFFF mov ecx,dword ptr ss:[ebp-3E8]
005158DC   .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
005158E2   .  0F82 B6120000 jb 00516B9E
005158E8   .  8B85 14FCFFFF mov eax,dword ptr ss:[ebp-3EC]
005158EE   .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
005158F4   .  0F82 A4120000 jb 00516B9E
005158FA   .  8B8D 10FCFFFF mov ecx,dword ptr ss:[ebp-3F0]
00515900   .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
00515906   .  0F82 92120000 jb 00516B9E
0051590C   .  8B85 0CFCFFFF mov eax,dword ptr ss:[ebp-3F4]
00515912   .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
00515918   .  0F82 80120000 jb 00516B9E
0051591E   .  8B8D 08FCFFFF mov ecx,dword ptr ss:[ebp-3F8]
00515924   .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
0051592A   .  0F82 6E120000 jb 00516B9E
00515930   .  8B85 04FCFFFF mov eax,dword ptr ss:[ebp-3FC]
00515936   .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
0051593C   .  0F82 5C120000 jb 00516B9E
00515942   .  8B8D 00FCFFFF mov ecx,dword ptr ss:[ebp-400]
00515948   .  0291 64E15300 add dl,byte ptr ds:[ecx+53E164]
0051594E   .  0F82 4A120000 jb 00516B9E
00515954   .  8B85 FCFBFFFF mov eax,dword ptr ss:[ebp-404]
0051595A   .  0290 64E15300 add dl,byte ptr ds:[eax+53E164]
00515960   .  0F82 38120000 jb 00516B9E
00515966   .  66:33C0       xor ax,ax
00515969   .  8AC2          mov al,dl
0051596B   .  8B4D 08       mov ecx,dword ptr ss:[ebp+8]
0051596E   .  66:0341 34    add ax,word ptr ds:[ecx+34]
00515972   .  0F80 26120000 jo 00516B9E
00515978   .  66:99         cwd
0051597A   .  66:B9 6400    mov cx,64                          ->第1+2+3+5+6+7+8+9+10+11+12+13+14+16+17位+41/100---T3
0051597E   .  66:F7F9       idiv cx
00515981   .  66:8995 58FDF>mov word ptr ss:[ebp-2A8],dx
00515988   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],8002
00515992   .  8D95 78FFFFFF lea edx,dword ptr ss:[ebp-88]
00515998   .  52            push edx                                         ; /Arg2
00515999   .  8D85 50FDFFFF lea eax,dword ptr ss:[ebp-2B0]                   ; |
0051599F   .  50            push eax                                         ; |Arg1
005159A0   .  FF15 18114000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>]    ; \比较4,15位余数 --------------1
005159A6   .  0FBFC8        movsx ecx,ax
005159A9   .  85C9          test ecx,ecx
005159AB   .  0F84 FF0F0000 je 005169B0 -------------------------------------跳走就完
005159B1   .  C745 FC 21000>mov dword ptr ss:[ebp-4],21
005159B8   .  8D95 58FFFFFF lea edx,dword ptr ss:[ebp-A8]
005159BE   .  52            push edx                                         ; /Arg2
005159BF   .  8D45 A0       lea eax,dword ptr ss:[ebp-60]                    ; |
005159C2   .  50            push eax                                         ; |Arg1
005159C3   .  FF15 18114000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstEq>]    ; \比较程式代码与第3,16位相等---2
005159C9   .  0FBFC8        movsx ecx,ax
005159CC   .  85C9          test ecx,ecx
005159CE   .  0F84 DC0F0000 je 005169B0  ------------------------------------跳走就完
005159D4   .  C745 FC 22000>mov dword ptr ss:[ebp-4],22
005159DB   .  8D55 88       lea edx,dword ptr ss:[ebp-78]
005159DE   .  52            push edx                                         ; /Arg3
005159DF   .  8D85 44FFFFFF lea eax,dword ptr ss:[ebp-BC]                    ; |
005159E5   .  50            push eax                                         ; |Arg2
005159E6   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]                   ; |
005159EC   .  51            push ecx                                         ; |Arg1
005159ED   .  FF15 84104000 call dword ptr ds:[<&MSVBVM60.__vbaVarCmpGe>]    ; \__vbaVarCmpGe  ---不知验证什么----3
005159F3   .  50            push eax                                         ; /Arg3
005159F4   .  8D55 88       lea edx,dword ptr ss:[ebp-78]                    ; |
005159F7   .  52            push edx                                         ; |/Arg3
005159F8   .  8D85 10FFFFFF lea eax,dword ptr ss:[ebp-F0]                    ; ||
005159FE   .  50            push eax                                         ; ||Arg2
005159FF   .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]                   ; ||
00515A05   .  51            push ecx                                         ; ||Arg1
00515A06   .  FF15 9C114000 call dword ptr ds:[<&MSVBVM60.__vbaVarCmpLe>]    ; |\__vbaVarCmpLe ---不知验证什么----4
00515A0C   .  50            push eax                                         ; |Arg2
00515A0D   .  8D95 D0FEFFFF lea edx,dword ptr ss:[ebp-130]                   ; |
00515A13   .  52            push edx                                         ; |Arg1
00515A14   .  FF15 64114000 call dword ptr ds:[<&MSVBVM60.__vbaVarAnd>]      ; \__vbaVarAnd
00515A1A   .  50            push eax                                         ; /Arg1
00515A1B   .  FF15 DC104000 call dword ptr ds:[<&MSVBVM60.__vbaBoolVarNull>] ; \__vbaBoolVarNull
00515A21   .  0FBFC0        movsx eax,ax
00515A24   .  85C0          test eax,eax
00515A26   .  0F84 840F0000 je 005169B0  ------------------------------------跳走就完
00515A2C   .  C745 FC 23000>mov dword ptr ss:[ebp-4],23
00515A33   .  C785 F8FEFFFF>mov dword ptr ss:[ebp-108],80020004
00515A3D   .  C785 F0FEFFFF>mov dword ptr ss:[ebp-110],0A
00515A47   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00515A4D   .  51            push ecx                                         ; /Arg1
00515A4E   .  FF15 D0114000 call dword ptr ds:[<&MSVBVM60.#648>]             ; \rtcFreeFile
00515A54   .  66:8985 48FDF>mov word ptr ss:[ebp-2B8],ax
00515A5B   .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00515A65   .  8D95 40FDFFFF lea edx,dword ptr ss:[ebp-2C0]
00515A6B   .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
00515A71   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMove>]     ;  MSVBVM60.__vbaVarMove
00515A77   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00515A7D   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00515A83   .  C745 FC 24000>mov dword ptr ss:[ebp-4],24
00515A8A   .  8B15 58E05300 mov edx,dword ptr ds:[53E058]
00515A90   .  52            push edx                                         ; /Arg2 => 0019FAFC
00515A91   .  68 F0FC4000   push 0040FCF0                                    ; |Arg1 = 0040FCF0
00515A96   .  FF15 5C104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCat>]      ; \__vbaStrCat
00515A9C   .  8BD0          mov edx,eax
00515A9E   .  8D8D 0CFFFFFF lea ecx,dword ptr ss:[ebp-F4]
00515AA4   .  FF15 58124000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]     ;  MSVBVM60.__vbaStrMove
00515AAA   .  50            push eax                                         ; /Arg2
00515AAB   .  A1 34E25300   mov eax,dword ptr ds:[53E234]                    ; |
00515AB0   .  50            push eax                                         ; |Arg1 => 0019FAC4
00515AB1   .  FF15 5C104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCat>]      ; \__vbaStrCat
00515AB7   .  8BD0          mov edx,eax
00515AB9   .  8D8D 08FFFFFF lea ecx,dword ptr ss:[ebp-F8]
00515ABF   .  FF15 58124000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]     ;  MSVBVM60.__vbaStrMove
00515AC5   .  50            push eax                                         ; /Arg2
00515AC6   .  68 0CFD4000   push 0040FD0C                                    ; |Arg1 = 0040FD0C
00515ACB   .  FF15 5C104000 call dword ptr ds:[<&MSVBVM60.__vbaStrCat>]      ; \__vbaStrCat
00515AD1   .  8BD0          mov edx,eax
00515AD3   .  8D8D 04FFFFFF lea ecx,dword ptr ss:[ebp-FC]
00515AD9   .  FF15 58124000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]     ;  MSVBVM60.__vbaStrMove
00515ADF   .  50            push eax
00515AE0   .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
00515AE6   .  51            push ecx
00515AE7   .  FF15 B8114000 call dword ptr ds:[<&MSVBVM60.__vbaI2Var>]       ;  MSVBVM60.__vbaI2Var
00515AED   .  50            push eax                                         ; |Arg3
00515AEE   .  6A FF         push -1                                          ; |Arg2 = FFFFFFFF
00515AF0   .  6A 20         push 20                                          ; |Arg1 = 00000020
00515AF2   .  FF15 C8114000 call dword ptr ds:[<&MSVBVM60.__vbaFileOpen>]    ; \__vbaFileOpen
00515AF8   .  8D95 04FFFFFF lea edx,dword ptr ss:[ebp-FC]
00515AFE   .  52            push edx
00515AFF   .  8D85 08FFFFFF lea eax,dword ptr ss:[ebp-F8]
00515B05   .  50            push eax
00515B06   .  8D8D 0CFFFFFF lea ecx,dword ptr ss:[ebp-F4]
00515B0C   .  51            push ecx
00515B0D   .  6A 03         push 3
00515B0F   .  FF15 F4114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>] ;  MSVBVM60.__vbaFreeStrList
00515B15   .  83C4 10       add esp,10
00515B18   .  C745 FC 25000>mov dword ptr ss:[ebp-4],25
00515B1F   .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],64
00515B29   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00515B33   .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],64
00515B3D   .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00515B47   .  8D95 68FFFFFF lea edx,dword ptr ss:[ebp-98]
00515B4D   .  52            push edx
00515B4E   .  FF15 B8114000 call dword ptr ds:[<&MSVBVM60.__vbaI2Var>]       ;  MSVBVM60.__vbaI2Var
00515B54   .  50            push eax
00515B55   .  8D45 A0       lea eax,dword ptr ss:[ebp-60]
00515B58   .  50            push eax                                         ; /Arg3
00515B59   .  8D8D 50FDFFFF lea ecx,dword ptr ss:[ebp-2B0]                   ; |
00515B5F   .  51            push ecx                                         ; |Arg2
00515B60   .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]                   ; |
00515B66   .  52            push edx                                         ; |Arg1
00515B67   .  FF15 70114000 call dword ptr ds:[<&MSVBVM60.__vbaVarMul>]      ; \__vbaVarMul
00515B6D   .  50            push eax                                         ; /Arg3
00515B6E   .  8D85 40FDFFFF lea eax,dword ptr ss:[ebp-2C0]                   ; |
00515B74   .  50            push eax                                         ; |Arg2
00515B75   .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]                   ; |
00515B7B   .  51            push ecx                                         ; |Arg1
00515B7C   .  FF15 2C124000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]      ; \__vbaVarAdd
00515B82   .  50            push eax
00515B83   .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]       ;  MSVBVM60.__vbaI4Var
00515B89   .  50            push eax                                         ; |Arg3
00515B8A   .  68 C8E15300   push 0053E1C8                                    ; |Arg2 = 0053E1C8
00515B8F   .  6A 64         push 64                                          ; |Arg1 = 00000064
00515B91   .  FF15 14114000 call dword ptr ds:[<&MSVBVM60.__vbaGet4>]        ; \__vbaGet4
00515B97   .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]
00515B9D   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00515BA3   .  C745 FC 26000>mov dword ptr ss:[ebp-4],26
00515BAA   .  BA 3CE44000   mov edx,0040E43C
00515BAF   .  8D4D 98       lea ecx,dword ptr ss:[ebp-68]
00515BB2   .  FF15 F0114000 call dword ptr ds:[<&MSVBVM60.__vbaStrCopy>]     ;  MSVBVM60.__vbaStrCopy
00515BB8   .  C745 FC 27000>mov dword ptr ss:[ebp-4],27
00515BBF   .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],1
00515BC9   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00515BD3   .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],27
00515BDD   .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00515BE7   .  C785 38FDFFFF>mov dword ptr ss:[ebp-2C8],1F
00515BF1   .  C785 30FDFFFF>mov dword ptr ss:[ebp-2D0],2
00515BFB   .  8D95 50FDFFFF lea edx,dword ptr ss:[ebp-2B0]
00515C01   .  52            push edx
00515C02   .  8D85 40FDFFFF lea eax,dword ptr ss:[ebp-2C0]
00515C08   .  50            push eax
00515C09   .  8D8D 30FDFFFF lea ecx,dword ptr ss:[ebp-2D0]
00515C0F   .  51            push ecx
00515C10   .  8D95 BCFBFFFF lea edx,dword ptr ss:[ebp-444]
00515C16   .  52            push edx
00515C17   .  8D85 CCFBFFFF lea eax,dword ptr ss:[ebp-434]
00515C1D   .  50            push eax
00515C1E   .  8D4D B0       lea ecx,dword ptr ss:[ebp-50]
00515C21   .  51            push ecx
00515C22   .  FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>]  ;  MSVBVM60.__vbaVarForInit
00515C28   .  8985 38FBFFFF mov dword ptr ss:[ebp-4C8],eax
00515C2E   .  E9 A8010000   jmp 00515DDB
00515C33   >  C745 FC 28000>mov dword ptr ss:[ebp-4],28
00515C3A   .  8B55 98       mov edx,dword ptr ss:[ebp-68]
00515C3D   .  8995 38FDFFFF mov dword ptr ss:[ebp-2C8],edx
00515C43   .  C785 30FDFFFF>mov dword ptr ss:[ebp-2D0],8
00515C4D   .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],0040E348              ;  UNICODE "0"
00515C57   .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],8
00515C61   .  8D95 40FDFFFF lea edx,dword ptr ss:[ebp-2C0]
00515C67   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00515C6D   .  FF15 34124000 call dword ptr ds:[<&MSVBVM60.__vbaVarDup>]      ;  MSVBVM60.__vbaVarDup
00515C73   .  8D45 B0       lea eax,dword ptr ss:[ebp-50]
00515C76   .  50            push eax
00515C77   .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]       ;  MSVBVM60.__vbaI4Var
00515C7D   .  83E8 01       sub eax,1
00515C80   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00515C86   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00515C8D   .  73 0C         jnb short 00515C9B
00515C8F   .  C785 78FAFFFF>mov dword ptr ss:[ebp-588],0
00515C99   .  EB 0C         jmp short 00515CA7
00515C9B   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515CA1   .  8985 78FAFFFF mov dword ptr ss:[ebp-588],eax
00515CA7   >  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00515CAD   .  81C1 C8E15300 add ecx,0053E1C8
00515CB3   .  898D 58FDFFFF mov dword ptr ss:[ebp-2A8],ecx
00515CB9   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],4011
00515CC3   .  6A 01         push 1                                           ; /Arg5 = 00000001
00515CC5   .  6A 01         push 1                                           ; |Arg4 = 00000001
00515CC7   .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]                   ; |
00515CCD   .  52            push edx                                         ; |Arg3
00515CCE   .  8D85 50FDFFFF lea eax,dword ptr ss:[ebp-2B0]                   ; |
00515CD4   .  50            push eax                                         ; |Arg2
00515CD5   .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]                   ; |
00515CDB   .  51            push ecx                                         ; |Arg1
00515CDC   .  FF15 64104000 call dword ptr ds:[<&MSVBVM60.#660>]             ; \rtcVarFromFormatVar
00515CE2   .  8D95 30FDFFFF lea edx,dword ptr ss:[ebp-2D0]
00515CE8   .  52            push edx                                         ; /Arg3
00515CE9   .  8D85 E0FEFFFF lea eax,dword ptr ss:[ebp-120]                   ; |
00515CEF   .  50            push eax                                         ; |Arg2
00515CF0   .  8D8D D0FEFFFF lea ecx,dword ptr ss:[ebp-130]                   ; |
00515CF6   .  51            push ecx                                         ; |Arg1
00515CF7   .  FF15 2C124000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]      ; \__vbaVarAdd
00515CFD   .  50            push eax                                         ; /Arg1
00515CFE   .  FF15 28104000 call dword ptr ds:[<&MSVBVM60.__vbaStrVarMove>]  ; \__vbaStrVarMove
00515D04   .  8BD0          mov edx,eax
00515D06   .  8D4D 98       lea ecx,dword ptr ss:[ebp-68]
00515D09   .  FF15 58124000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]     ;  MSVBVM60.__vbaStrMove
00515D0F   .  8D95 D0FEFFFF lea edx,dword ptr ss:[ebp-130]
00515D15   .  52            push edx
00515D16   .  8D85 E0FEFFFF lea eax,dword ptr ss:[ebp-120]
00515D1C   .  50            push eax
00515D1D   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00515D23   .  51            push ecx
00515D24   .  6A 03         push 3
00515D26   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
00515D2C   .  83C4 10       add esp,10
00515D2F   .  C745 FC 29000>mov dword ptr ss:[ebp-4],29
00515D36   .  8D55 B0       lea edx,dword ptr ss:[ebp-50]
00515D39   .  52            push edx
00515D3A   .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]       ;  MSVBVM60.__vbaI4Var
00515D40   .  83E8 01       sub eax,1
00515D43   .  8985 30FCFFFF mov dword ptr ss:[ebp-3D0],eax
00515D49   .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
00515D50   .  73 0C         jnb short 00515D5E
00515D52   .  C785 74FAFFFF>mov dword ptr ss:[ebp-58C],0
00515D5C   .  EB 0C         jmp short 00515D6A
00515D5E   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515D64   .  8985 74FAFFFF mov dword ptr ss:[ebp-58C],eax
00515D6A   >  8D45 B0       lea eax,dword ptr ss:[ebp-50]
00515D6D   .  50            push eax
00515D6E   .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]       ;  MSVBVM60.__vbaI4Var
00515D74   .  83E8 01       sub eax,1
00515D77   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00515D7D   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00515D84   .  73 0C         jnb short 00515D92
00515D86   .  C785 70FAFFFF>mov dword ptr ss:[ebp-590],0
00515D90   .  EB 0C         jmp short 00515D9E
00515D92   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515D98   .  8985 70FAFFFF mov dword ptr ss:[ebp-590],eax
00515D9E   >  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00515DA4   .  8B95 30FCFFFF mov edx,dword ptr ss:[ebp-3D0]
00515DAA   .  8A82 C8E15300 mov al,byte ptr ds:[edx+53E1C8]
00515DB0   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00515DB6   .  C745 FC 2A000>mov dword ptr ss:[ebp-4],2A
00515DBD   .  8D8D BCFBFFFF lea ecx,dword ptr ss:[ebp-444]
00515DC3   .  51            push ecx                                         ; /Arg3
00515DC4   .  8D95 CCFBFFFF lea edx,dword ptr ss:[ebp-434]                   ; |
00515DCA   .  52            push edx                                         ; |Arg2
00515DCB   .  8D45 B0       lea eax,dword ptr ss:[ebp-50]                    ; |
00515DCE   .  50            push eax                                         ; |Arg1
00515DCF   .  FF15 88124000 call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>]  ; \__vbaVarForNext
00515DD5   .  8985 38FBFFFF mov dword ptr ss:[ebp-4C8],eax
00515DDB   >  83BD 38FBFFFF>cmp dword ptr ss:[ebp-4C8],0
00515DE2   .^ 0F85 4BFEFFFF jnz 00515C33
00515DE8   .  C745 FC 2B000>mov dword ptr ss:[ebp-4],2B
00515DEF   .  8B8D 40FFFFFF mov ecx,dword ptr ss:[ebp-C0]
00515DF5   .  51            push ecx                                         ; /Arg2
00515DF6   .  8B55 98       mov edx,dword ptr ss:[ebp-68]                    ; |
00515DF9   .  52            push edx                                         ; |Arg1
00515DFA   .  FF15 10114000 call dword ptr ds:[<&MSVBVM60.__vbaStrCmp>]      ; \__vbaStrCmp ------...5
00515E00   .  85C0          test eax,eax
00515E02   .  0F85 9B0B0000 jnz 005169A3 ------------------------------------跳走就完
00515E08   .  C745 FC 2C000>mov dword ptr ss:[ebp-4],2C
00515E0F   .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],1
00515E19   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00515E23   .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],14
00515E2D   .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00515E37   .  C785 38FDFFFF>mov dword ptr ss:[ebp-2C8],1
00515E41   .  C785 30FDFFFF>mov dword ptr ss:[ebp-2D0],2
00515E4B   .  8D85 50FDFFFF lea eax,dword ptr ss:[ebp-2B0]
00515E51   .  50            push eax
00515E52   .  8D8D 40FDFFFF lea ecx,dword ptr ss:[ebp-2C0]
00515E58   .  51            push ecx
00515E59   .  8D95 30FDFFFF lea edx,dword ptr ss:[ebp-2D0]
00515E5F   .  52            push edx
00515E60   .  8D85 9CFBFFFF lea eax,dword ptr ss:[ebp-464]
00515E66   .  50            push eax
00515E67   .  8D8D ACFBFFFF lea ecx,dword ptr ss:[ebp-454]
00515E6D   .  51            push ecx
00515E6E   .  8D55 B0       lea edx,dword ptr ss:[ebp-50]
00515E71   .  52            push edx
00515E72   .  FF15 90104000 call dword ptr ds:[<&MSVBVM60.__vbaVarForInit>]  ;  MSVBVM60.__vbaVarForInit
00515E78   .  8985 34FBFFFF mov dword ptr ss:[ebp-4CC],eax
00515E7E   .  E9 24010000   jmp 00515FA7
00515E83   >  C745 FC 2D000>mov dword ptr ss:[ebp-4],2D
00515E8A   .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],32
00515E94   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00515E9E   .  8D45 B0       lea eax,dword ptr ss:[ebp-50]
00515EA1   .  50            push eax                                         ; /Arg3
00515EA2   .  8D8D 50FDFFFF lea ecx,dword ptr ss:[ebp-2B0]                   ; |
00515EA8   .  51            push ecx                                         ; |Arg2
00515EA9   .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]                   ; |
00515EAF   .  52            push edx                                         ; |Arg1
00515EB0   .  FF15 2C124000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]      ; \__vbaVarAdd
00515EB6   .  50            push eax
00515EB7   .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]       ;  MSVBVM60.__vbaI4Var
00515EBD   .  83E8 01       sub eax,1
00515EC0   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00515EC6   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00515ECD   .  73 0C         jnb short 00515EDB
00515ECF   .  C785 6CFAFFFF>mov dword ptr ss:[ebp-594],0
00515ED9   .  EB 0C         jmp short 00515EE7
00515EDB   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515EE1   .  8985 6CFAFFFF mov dword ptr ss:[ebp-594],eax
00515EE7   >  8D45 B0       lea eax,dword ptr ss:[ebp-50]
00515EEA   .  50            push eax
00515EEB   .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]       ;  MSVBVM60.__vbaI4Var
00515EF1   .  83E8 01       sub eax,1
00515EF4   .  8985 30FCFFFF mov dword ptr ss:[ebp-3D0],eax
00515EFA   .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
00515F01   .  73 0C         jnb short 00515F0F
00515F03   .  C785 68FAFFFF>mov dword ptr ss:[ebp-598],0
00515F0D   .  EB 0C         jmp short 00515F1B
00515F0F   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00515F15   .  8985 68FAFFFF mov dword ptr ss:[ebp-598],eax
00515F1B   >  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00515F21   .  8B95 30FCFFFF mov edx,dword ptr ss:[ebp-3D0]
00515F27   .  8A81 C8E15300 mov al,byte ptr ds:[ecx+53E1C8]
00515F2D   .  33C9          xor ecx,ecx
00515F2F   .  3A82 64E15300 cmp al,byte ptr ds:[edx+53E164]
00515F35   .  0F95C1        setne cl
00515F38   .  F7D9          neg ecx
00515F3A   .  66:898D 2CFCF>mov word ptr ss:[ebp-3D4],cx
00515F41   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00515F47   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00515F4D   .  0FBF95 2CFCFF>movsx edx,word ptr ss:[ebp-3D4]
00515F54   .  85D2          test edx,edx
00515F56   .  74 2A         je short 00515F82
00515F58   .  C745 FC 2E000>mov dword ptr ss:[ebp-4],2E
00515F5F   .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],63
00515F69   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00515F73   .  8D95 50FDFFFF lea edx,dword ptr ss:[ebp-2B0]
00515F79   .  8D4D B0       lea ecx,dword ptr ss:[ebp-50]
00515F7C   .  FF15 14104000 call dword ptr ds:[<&MSVBVM60.__vbaVarMove>]     ;  MSVBVM60.__vbaVarMove
00515F82   >  C745 FC 30000>mov dword ptr ss:[ebp-4],30
00515F89   .  8D85 9CFBFFFF lea eax,dword ptr ss:[ebp-464]
00515F8F   .  50            push eax                                         ; /Arg3
00515F90   .  8D8D ACFBFFFF lea ecx,dword ptr ss:[ebp-454]                   ; |
00515F96   .  51            push ecx                                         ; |Arg2
00515F97   .  8D55 B0       lea edx,dword ptr ss:[ebp-50]                    ; |
00515F9A   .  52            push edx                                         ; |Arg1
00515F9B   .  FF15 88124000 call dword ptr ds:[<&MSVBVM60.__vbaVarForNext>]  ; \__vbaVarForNext
00515FA1   .  8985 34FBFFFF mov dword ptr ss:[ebp-4CC],eax
00515FA7   >  83BD 34FBFFFF>cmp dword ptr ss:[ebp-4CC],0
00515FAE   .^ 0F85 CFFEFFFF jnz 00515E83
00515FB4   .  C745 FC 31000>mov dword ptr ss:[ebp-4],31
00515FBB   .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],5A
00515FC5   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],8002
00515FCF   .  8D45 B0       lea eax,dword ptr ss:[ebp-50]
00515FD2   .  50            push eax
00515FD3   .  8D8D 50FDFFFF lea ecx,dword ptr ss:[ebp-2B0]
00515FD9   .  51            push ecx
00515FDA   .  FF15 00104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstGt>]    ;  MSVBVM60.__vbaVarTstGt
00515FE0   .  0FBFD0        movsx edx,ax
00515FE3   .  85D2          test edx,edx
00515FE5   .  0F84 05060000 je 005165F0
00515FEB   .  C745 FC 32000>mov dword ptr ss:[ebp-4],32
00515FF2   .  B8 15000000   mov eax,15
00515FF7   .  83E8 01       sub eax,1
00515FFA   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00516000   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516007   .  73 0C         jnb short 00516015
00516009   .  C785 64FAFFFF>mov dword ptr ss:[ebp-59C],0
00516013   .  EB 0C         jmp short 00516021
00516015   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051601B   .  8985 64FAFFFF mov dword ptr ss:[ebp-59C],eax
00516021   >  66:8B0D 2EE25>mov cx,word ptr ds:[53E22E]
00516028   .  FF15 5C114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I2>]       ;  MSVBVM60.__vbaUI1I2
0051602E   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00516034   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
0051603A   .  C745 FC 33000>mov dword ptr ss:[ebp-4],33
00516041   .  BA 16000000   mov edx,16
00516046   .  83EA 01       sub edx,1
00516049   .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
0051604F   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516056   .  73 0C         jnb short 00516064
00516058   .  C785 60FAFFFF>mov dword ptr ss:[ebp-5A0],0
00516062   .  EB 0C         jmp short 00516070
00516064   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051606A   .  8985 60FAFFFF mov dword ptr ss:[ebp-5A0],eax
00516070   >  66:8B0D 30E25>mov cx,word ptr ds:[53E230]
00516077   .  FF15 5C114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I2>]       ;  MSVBVM60.__vbaUI1I2
0051607D   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00516083   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00516089   .  C745 FC 34000>mov dword ptr ss:[ebp-4],34
00516090   .  BA 17000000   mov edx,17
00516095   .  83EA 01       sub edx,1
00516098   .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
0051609E   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
005160A5   .  73 0C         jnb short 005160B3
005160A7   .  C785 5CFAFFFF>mov dword ptr ss:[ebp-5A4],0
005160B1   .  EB 0C         jmp short 005160BF
005160B3   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005160B9   .  8985 5CFAFFFF mov dword ptr ss:[ebp-5A4],eax
005160BF   >  66:8B0D 32E25>mov cx,word ptr ds:[53E232]
005160C6   .  FF15 5C114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I2>]       ;  MSVBVM60.__vbaUI1I2
005160CC   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
005160D2   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
005160D8   .  C745 FC 35000>mov dword ptr ss:[ebp-4],35
005160DF   .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]
005160E5   .  52            push edx                                         ; /Arg1
005160E6   .  FF15 7C124000 call dword ptr ds:[<&MSVBVM60.#546>]             ; \rtcGetPresentDate
005160EC   .  8D85 F0FEFFFF lea eax,dword ptr ss:[ebp-110]
005160F2   .  50            push eax                                         ; /Arg2
005160F3   .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]                   ; |
005160F9   .  51            push ecx                                         ; |Arg1
005160FA   .  FF15 E0114000 call dword ptr ds:[<&MSVBVM60.__vbaVarInt>]      ; \__vbaVarInt
00516100   .  50            push eax
00516101   .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]       ;  MSVBVM60.__vbaI4Var
00516107   .  8985 54FFFFFF mov dword ptr ss:[ebp-AC],eax
0051610D   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00516113   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516119   .  C745 FC 36000>mov dword ptr ss:[ebp-4],36
00516120   .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]
00516126   .  52            push edx                                         ; /Arg1
00516127   .  FF15 7C124000 call dword ptr ds:[<&MSVBVM60.#546>]             ; \rtcGetPresentDate
0051612D   .  8D85 E0FEFFFF lea eax,dword ptr ss:[ebp-120]
00516133   .  50            push eax                                         ; /Arg1
00516134   .  FF15 7C124000 call dword ptr ds:[<&MSVBVM60.#546>]             ; \rtcGetPresentDate
0051613A   .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],100
00516144   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
0051614E   .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],100
00516158   .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00516162   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00516168   .  51            push ecx                                         ; /Arg3
00516169   .  8D95 E0FEFFFF lea edx,dword ptr ss:[ebp-120]                   ; |
0051616F   .  52            push edx                                         ; |/Arg2
00516170   .  8D85 D0FEFFFF lea eax,dword ptr ss:[ebp-130]                   ; ||
00516176   .  50            push eax                                         ; ||Arg1
00516177   .  FF15 E0114000 call dword ptr ds:[<&MSVBVM60.__vbaVarInt>]      ; |\__vbaVarInt
0051617D   .  50            push eax                                         ; |Arg2
0051617E   .  8D8D C0FEFFFF lea ecx,dword ptr ss:[ebp-140]                   ; |
00516184   .  51            push ecx                                         ; |Arg1
00516185   .  FF15 04104000 call dword ptr ds:[<&MSVBVM60.__vbaVarSub>]      ; \__vbaVarSub
0051618B   .  50            push eax                                         ; /Arg3
0051618C   .  8D95 50FDFFFF lea edx,dword ptr ss:[ebp-2B0]                   ; |
00516192   .  52            push edx                                         ; |Arg2
00516193   .  8D85 B0FEFFFF lea eax,dword ptr ss:[ebp-150]                   ; |
00516199   .  50            push eax                                         ; |Arg1
0051619A   .  FF15 70114000 call dword ptr ds:[<&MSVBVM60.__vbaVarMul>]      ; \__vbaVarMul
005161A0   .  50            push eax                                         ; /Arg3
005161A1   .  8D8D 40FDFFFF lea ecx,dword ptr ss:[ebp-2C0]                   ; |
005161A7   .  51            push ecx                                         ; |Arg2
005161A8   .  8D95 A0FEFFFF lea edx,dword ptr ss:[ebp-160]                   ; |
005161AE   .  52            push edx                                         ; |Arg1
005161AF   .  FF15 70114000 call dword ptr ds:[<&MSVBVM60.__vbaVarMul>]      ; \__vbaVarMul
005161B5   .  50            push eax                                         ; /Arg2
005161B6   .  8D85 90FEFFFF lea eax,dword ptr ss:[ebp-170]                   ; |
005161BC   .  50            push eax                                         ; |Arg1
005161BD   .  FF15 E0114000 call dword ptr ds:[<&MSVBVM60.__vbaVarInt>]      ; \__vbaVarInt
005161C3   .  50            push eax
005161C4   .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]       ;  MSVBVM60.__vbaI4Var
005161CA   .  8945 9C       mov dword ptr ss:[ebp-64],eax
005161CD   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
005161D3   .  51            push ecx
005161D4   .  8D95 E0FEFFFF lea edx,dword ptr ss:[ebp-120]
005161DA   .  52            push edx
005161DB   .  6A 02         push 2
005161DD   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
005161E3   .  83C4 0C       add esp,0C
005161E6   .  C745 FC 37000>mov dword ptr ss:[ebp-4],37
005161ED   .  B8 29000000   mov eax,29
005161F2   .  83E8 01       sub eax,1
005161F5   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
005161FB   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516202   .  73 0C         jnb short 00516210
00516204   .  C785 58FAFFFF>mov dword ptr ss:[ebp-5A8],0
0051620E   .  EB 0C         jmp short 0051621C
00516210   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516216   .  8985 58FAFFFF mov dword ptr ss:[ebp-5A8],eax
0051621C   >  8B85 54FFFFFF mov eax,dword ptr ss:[ebp-AC]
00516222   .  99            cdq
00516223   .  81E2 FF000000 and edx,0FF
00516229   .  03C2          add eax,edx
0051622B   .  8BC8          mov ecx,eax
0051622D   .  C1F9 08       sar ecx,8
00516230   .  FF15 74114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I4>]       ;  MSVBVM60.__vbaUI1I4
00516236   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
0051623C   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00516242   .  C745 FC 38000>mov dword ptr ss:[ebp-4],38
00516249   .  BA 2A000000   mov edx,2A
0051624E   .  83EA 01       sub edx,1
00516251   .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
00516257   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
0051625E   .  73 0C         jnb short 0051626C
00516260   .  C785 54FAFFFF>mov dword ptr ss:[ebp-5AC],0
0051626A   .  EB 0C         jmp short 00516278
0051626C   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516272   .  8985 54FAFFFF mov dword ptr ss:[ebp-5AC],eax
00516278   >  8B8D 54FFFFFF mov ecx,dword ptr ss:[ebp-AC]
0051627E   .  81E1 FF000080 and ecx,800000FF
00516284   .  79 08         jns short 0051628E
00516286   .  49            dec ecx
00516287   .  81C9 00FFFFFF or ecx,FFFFFF00
0051628D   .  41            inc ecx
0051628E   >  FF15 74114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I4>]       ;  MSVBVM60.__vbaUI1I4
00516294   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
0051629A   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
005162A0   .  C745 FC 39000>mov dword ptr ss:[ebp-4],39
005162A7   .  BA 2B000000   mov edx,2B
005162AC   .  83EA 01       sub edx,1
005162AF   .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
005162B5   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
005162BC   .  73 0C         jnb short 005162CA
005162BE   .  C785 50FAFFFF>mov dword ptr ss:[ebp-5B0],0
005162C8   .  EB 0C         jmp short 005162D6
005162CA   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005162D0   .  8985 50FAFFFF mov dword ptr ss:[ebp-5B0],eax
005162D6   >  8B45 9C       mov eax,dword ptr ss:[ebp-64]
005162D9   .  99            cdq
005162DA   .  81E2 FF000000 and edx,0FF
005162E0   .  03C2          add eax,edx
005162E2   .  8BC8          mov ecx,eax
005162E4   .  C1F9 08       sar ecx,8
005162E7   .  FF15 74114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I4>]       ;  MSVBVM60.__vbaUI1I4
005162ED   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
005162F3   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
005162F9   .  C745 FC 3A000>mov dword ptr ss:[ebp-4],3A
00516300   .  BA 2C000000   mov edx,2C
00516305   .  83EA 01       sub edx,1
00516308   .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
0051630E   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516315   .  73 0C         jnb short 00516323
00516317   .  C785 4CFAFFFF>mov dword ptr ss:[ebp-5B4],0
00516321   .  EB 0C         jmp short 0051632F
00516323   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516329   .  8985 4CFAFFFF mov dword ptr ss:[ebp-5B4],eax
0051632F   >  8B4D 9C       mov ecx,dword ptr ss:[ebp-64]
00516332   .  81E1 FF000080 and ecx,800000FF
00516338   .  79 08         jns short 00516342
0051633A   .  49            dec ecx
0051633B   .  81C9 00FFFFFF or ecx,FFFFFF00
00516341   .  41            inc ecx
00516342   >  FF15 74114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I4>]       ;  MSVBVM60.__vbaUI1I4
00516348   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
0051634E   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00516354   .  C745 FC 3B000>mov dword ptr ss:[ebp-4],3B
0051635B   .  BA 2D000000   mov edx,2D
00516360   .  83EA 01       sub edx,1
00516363   .  8995 30FCFFFF mov dword ptr ss:[ebp-3D0],edx
00516369   .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
00516370   .  73 0C         jnb short 0051637E
00516372   .  C785 48FAFFFF>mov dword ptr ss:[ebp-5B8],0
0051637C   .  EB 0C         jmp short 0051638A
0051637E   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516384   .  8985 48FAFFFF mov dword ptr ss:[ebp-5B8],eax
0051638A   >  B8 2D000000   mov eax,2D
0051638F   .  83E8 01       sub eax,1
00516392   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00516398   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
0051639F   .  73 0C         jnb short 005163AD
005163A1   .  C785 44FAFFFF>mov dword ptr ss:[ebp-5BC],0
005163AB   .  EB 0C         jmp short 005163B9
005163AD   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005163B3   .  8985 44FAFFFF mov dword ptr ss:[ebp-5BC],eax
005163B9   >  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
005163BF   .  8B95 30FCFFFF mov edx,dword ptr ss:[ebp-3D0]
005163C5   .  8A82 C8E15300 mov al,byte ptr ds:[edx+53E1C8]
005163CB   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
005163D1   .  C745 FC 3C000>mov dword ptr ss:[ebp-4],3C
005163D8   .  B9 2E000000   mov ecx,2E
005163DD   .  83E9 01       sub ecx,1
005163E0   .  898D 30FCFFFF mov dword ptr ss:[ebp-3D0],ecx
005163E6   .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
005163ED   .  73 0C         jnb short 005163FB
005163EF   .  C785 40FAFFFF>mov dword ptr ss:[ebp-5C0],0
005163F9   .  EB 0C         jmp short 00516407
005163FB   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516401   .  8985 40FAFFFF mov dword ptr ss:[ebp-5C0],eax
00516407   >  BA 2E000000   mov edx,2E
0051640C   .  83EA 01       sub edx,1
0051640F   .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
00516415   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
0051641C   .  73 0C         jnb short 0051642A
0051641E   .  C785 3CFAFFFF>mov dword ptr ss:[ebp-5C4],0
00516428   .  EB 0C         jmp short 00516436
0051642A   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516430   .  8985 3CFAFFFF mov dword ptr ss:[ebp-5C4],eax
00516436   >  8B85 34FCFFFF mov eax,dword ptr ss:[ebp-3CC]
0051643C   .  8B8D 30FCFFFF mov ecx,dword ptr ss:[ebp-3D0]
00516442   .  8A91 C8E15300 mov dl,byte ptr ds:[ecx+53E1C8]
00516448   .  8890 64E15300 mov byte ptr ds:[eax+53E164],dl
0051644E   .  C745 FC 3D000>mov dword ptr ss:[ebp-4],3D
00516455   .  B8 2F000000   mov eax,2F
0051645A   .  83E8 01       sub eax,1
0051645D   .  8985 30FCFFFF mov dword ptr ss:[ebp-3D0],eax
00516463   .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],64
0051646A   .  73 0C         jnb short 00516478
0051646C   .  C785 38FAFFFF>mov dword ptr ss:[ebp-5C8],0
00516476   .  EB 0C         jmp short 00516484
00516478   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
0051647E   .  8985 38FAFFFF mov dword ptr ss:[ebp-5C8],eax
00516484   >  B9 2F000000   mov ecx,2F
00516489   .  83E9 01       sub ecx,1
0051648C   .  898D 34FCFFFF mov dword ptr ss:[ebp-3CC],ecx
00516492   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516499   .  73 0C         jnb short 005164A7
0051649B   .  C785 34FAFFFF>mov dword ptr ss:[ebp-5CC],0
005164A5   .  EB 0C         jmp short 005164B3
005164A7   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005164AD   .  8985 34FAFFFF mov dword ptr ss:[ebp-5CC],eax
005164B3   >  8B95 34FCFFFF mov edx,dword ptr ss:[ebp-3CC]
005164B9   .  8B85 30FCFFFF mov eax,dword ptr ss:[ebp-3D0]
005164BF   .  8A88 C8E15300 mov cl,byte ptr ds:[eax+53E1C8]
005164C5   .  888A 64E15300 mov byte ptr ds:[edx+53E164],cl
005164CB   .  C745 FC 3E000>mov dword ptr ss:[ebp-4],3E
005164D2   .  BA 30000000   mov edx,30
005164D7   .  83EA 01       sub edx,1
005164DA   .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
005164E0   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
005164E7   .  73 0C         jnb short 005164F5
005164E9   .  C785 30FAFFFF>mov dword ptr ss:[ebp-5D0],0
005164F3   .  EB 0C         jmp short 00516501
005164F5   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
005164FB   .  8985 30FAFFFF mov dword ptr ss:[ebp-5D0],eax
00516501   >  B9 01000000   mov ecx,1
00516506   .  FF15 5C114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I2>]       ;  MSVBVM60.__vbaUI1I2
0051650C   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00516512   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00516518   .  C745 FC 3F000>mov dword ptr ss:[ebp-4],3F
0051651F   .  BA 31000000   mov edx,31
00516524   .  83EA 01       sub edx,1
00516527   .  8995 34FCFFFF mov dword ptr ss:[ebp-3CC],edx
0051652D   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],64
00516534   .  73 0C         jnb short 00516542
00516536   .  C785 2CFAFFFF>mov dword ptr ss:[ebp-5D4],0
00516540   .  EB 0C         jmp short 0051654E
00516542   >  FF15 08114000 call dword ptr ds:[<&MSVBVM60.__vbaGenerateBound>; \__vbaGenerateBoundsError
00516548   .  8985 2CFAFFFF mov dword ptr ss:[ebp-5D4],eax
0051654E   >  B9 01000000   mov ecx,1
00516553   .  FF15 5C114000 call dword ptr ds:[<&MSVBVM60.__vbaUI1I2>]       ;  MSVBVM60.__vbaUI1I2
00516559   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
0051655F   .  8881 64E15300 mov byte ptr ds:[ecx+53E164],al
00516565   .  C745 FC 40000>mov dword ptr ss:[ebp-4],40
0051656C   .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],64
00516576   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],2
00516580   .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],64
0051658A   .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],2
00516594   .  8D95 68FFFFFF lea edx,dword ptr ss:[ebp-98]
0051659A   .  52            push edx
0051659B   .  FF15 B8114000 call dword ptr ds:[<&MSVBVM60.__vbaI2Var>]       ;  MSVBVM60.__vbaI2Var
005165A1   .  50            push eax
005165A2   .  8D45 A0       lea eax,dword ptr ss:[ebp-60]
005165A5   .  50            push eax                                         ; /Arg3
005165A6   .  8D8D 50FDFFFF lea ecx,dword ptr ss:[ebp-2B0]                   ; |
005165AC   .  51            push ecx                                         ; |Arg2
005165AD   .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]                   ; |
005165B3   .  52            push edx                                         ; |Arg1
005165B4   .  FF15 70114000 call dword ptr ds:[<&MSVBVM60.__vbaVarMul>]      ; \__vbaVarMul
005165BA   .  50            push eax                                         ; /Arg3
005165BB   .  8D85 40FDFFFF lea eax,dword ptr ss:[ebp-2C0]                   ; |
005165C1   .  50            push eax                                         ; |Arg2
005165C2   .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]                   ; |
005165C8   .  51            push ecx                                         ; |Arg1
005165C9   .  FF15 2C124000 call dword ptr ds:[<&MSVBVM60.__vbaVarAdd>]      ; \__vbaVarAdd
005165CF   .  50            push eax
005165D0   .  FF15 24124000 call dword ptr ds:[<&MSVBVM60.__vbaI4Var>]       ;  MSVBVM60.__vbaI4Var
005165D6   .  50            push eax                                         ; |Arg3
005165D7   .  68 64E15300   push 0053E164                                    ; |Arg2 = 0053E164
005165DC   .  6A 64         push 64                                          ; |Arg1 = 00000064
005165DE   .  FF15 44104000 call dword ptr ds:[<&MSVBVM60.__vbaPut4>]        ; \__vbaPut4
005165E4   .  8D8D E0FEFFFF lea ecx,dword ptr ss:[ebp-120]
005165EA   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
005165F0   >  C745 FC 42000>mov dword ptr ss:[ebp-4],42
005165F7   .  FF15 A0104000 call dword ptr ds:[<&MSVBVM60.__vbaFileCloseAll>>;  MSVBVM60.__vbaFileCloseAll
005165FD   .  C745 FC 43000>mov dword ptr ss:[ebp-4],43
00516604   .  8B55 08       mov edx,dword ptr ss:[ebp+8]
00516607   .  8B02          mov eax,dword ptr ds:[edx]
00516609   .  8B4D 08       mov ecx,dword ptr ss:[ebp+8]
0051660C   .  51            push ecx
0051660D   .  FF90 F8060000 call dword ptr ds:[eax+6F8]
00516613   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00516619   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],0
00516620   .  7D 23         jge short 00516645
00516622   .  68 F8060000   push 6F8                                         ; /Arg4 = 000006F8
00516627   .  68 A8CA4000   push 0040CAA8                                    ; |Arg3 = 0040CAA8
0051662C   .  8B55 08       mov edx,dword ptr ss:[ebp+8]                     ; |
0051662F   .  52            push edx                                         ; |Arg2
00516630   .  8B85 34FCFFFF mov eax,dword ptr ss:[ebp-3CC]                   ; |
00516636   .  50            push eax                                         ; |Arg1
00516637   .  FF15 74104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>; \__vbaHresultCheckObj
0051663D   .  8985 28FAFFFF mov dword ptr ss:[ebp-5D8],eax
00516643   .  EB 0A         jmp short 0051664F
00516645   >  C785 28FAFFFF>mov dword ptr ss:[ebp-5D8],0
0051664F   >  C745 FC 44000>mov dword ptr ss:[ebp-4],44
00516656   .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],5A
00516660   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],8002
0051666A   .  8D4D B0       lea ecx,dword ptr ss:[ebp-50]
0051666D   .  51            push ecx
0051666E   .  8D95 50FDFFFF lea edx,dword ptr ss:[ebp-2B0]
00516674   .  52            push edx
00516675   .  FF15 00104000 call dword ptr ds:[<&MSVBVM60.__vbaVarTstGt>]    ;  MSVBVM60.__vbaVarTstGt
0051667B   .  0FBFC0        movsx eax,ax
0051667E   .  85C0          test eax,eax
00516680   .  0F84 1B030000 je 005169A1
00516686   .  C745 FC 45000>mov dword ptr ss:[ebp-4],45
0051668D   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00516693   .  51            push ecx                                         ; /Arg1
00516694   .  FF15 7C124000 call dword ptr ds:[<&MSVBVM60.#546>]             ; \rtcGetPresentDate
0051669A   .  6A 01         push 1                                           ; /Arg4 = 00000001
0051669C   .  6A 03         push 3                                           ; |Arg3 = 00000003
0051669E   .  68 E0070000   push 7E0                                         ; |Arg2 = 000007E0
005166A3   .  8D95 E0FEFFFF lea edx,dword ptr ss:[ebp-120]                   ; |
005166A9   .  52            push edx                                         ; |Arg1
005166AA   .  FF15 BC114000 call dword ptr ds:[<&MSVBVM60.#538>]             ; \rtcPackDate
005166B0   .  8D85 C0FEFFFF lea eax,dword ptr ss:[ebp-140]
005166B6   .  50            push eax                                         ; /Arg1
005166B7   .  FF15 7C124000 call dword ptr ds:[<&MSVBVM60.#546>]             ; \rtcGetPresentDate
005166BD   .  68 B5000000   push 0B5                                         ; /Arg4 = 000000B5
005166C2   .  68 B7000000   push 0B7                                         ; |Arg3 = 000000B7
005166C7   .  68 94080000   push 894                                         ; |Arg2 = 00000894
005166CC   .  8D8D B0FEFFFF lea ecx,dword ptr ss:[ebp-150]                   ; |
005166D2   .  51            push ecx                                         ; |Arg1
005166D3   .  FF15 BC114000 call dword ptr ds:[<&MSVBVM60.#538>]             ; \rtcPackDate
005166D9   .  8D95 F0FEFFFF lea edx,dword ptr ss:[ebp-110]
005166DF   .  52            push edx                                         ; /Arg3
005166E0   .  8D85 E0FEFFFF lea eax,dword ptr ss:[ebp-120]                   ; |
005166E6   .  50            push eax                                         ; |Arg2
005166E7   .  8D8D D0FEFFFF lea ecx,dword ptr ss:[ebp-130]                   ; |
005166ED   .  51            push ecx                                         ; |Arg1
005166EE   .  FF15 F8114000 call dword ptr ds:[<&MSVBVM60.__vbaVarCmpLt>]    ; \__vbaVarCmpLt
005166F4   .  50            push eax                                         ; /Arg3
005166F5   .  8D95 C0FEFFFF lea edx,dword ptr ss:[ebp-140]                   ; |
005166FB   .  52            push edx                                         ; |/Arg3
005166FC   .  8D85 B0FEFFFF lea eax,dword ptr ss:[ebp-150]                   ; ||
00516702   .  50            push eax                                         ; ||Arg2
00516703   .  8D8D A0FEFFFF lea ecx,dword ptr ss:[ebp-160]                   ; ||
00516709   .  51            push ecx                                         ; ||Arg1
0051670A   .  FF15 EC104000 call dword ptr ds:[<&MSVBVM60.__vbaVarCmpGt>]    ; |\__vbaVarCmpGt
00516710   .  50            push eax                                         ; |Arg2
00516711   .  8D95 90FEFFFF lea edx,dword ptr ss:[ebp-170]                   ; |
00516717   .  52            push edx                                         ; |Arg1
00516718   .  FF15 34114000 call dword ptr ds:[<&MSVBVM60.__vbaVarOr>]       ; \__vbaVarOr
0051671E   .  50            push eax                                         ; /Arg1
0051671F   .  FF15 DC104000 call dword ptr ds:[<&MSVBVM60.__vbaBoolVarNull>] ; \__vbaBoolVarNull
00516725   .  66:8985 34FCF>mov word ptr ss:[ebp-3CC],ax
0051672C   .  8D85 B0FEFFFF lea eax,dword ptr ss:[ebp-150]
00516732   .  50            push eax
00516733   .  8D8D C0FEFFFF lea ecx,dword ptr ss:[ebp-140]
00516739   .  51            push ecx
0051673A   .  8D95 E0FEFFFF lea edx,dword ptr ss:[ebp-120]
00516740   .  52            push edx
00516741   .  8D85 F0FEFFFF lea eax,dword ptr ss:[ebp-110]
00516747   .  50            push eax
00516748   .  6A 04         push 4
0051674A   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
00516750   .  83C4 14       add esp,14
00516753   .  0FBF8D 34FCFF>movsx ecx,word ptr ss:[ebp-3CC]
0051675A   .  85C9          test ecx,ecx
0051675C   .  74 05         je short 00516763
0051675E   .  E9 4D020000   jmp 005169B0
00516763   >  C745 FC 48000>mov dword ptr ss:[ebp-4],48
0051676A   .  6A 09         push 9                                           ; /Arg1 = 00000009
0051676C   .  FF15 08104000 call dword ptr ds:[<&MSVBVM60.__vbaStrI2>]       ; \__vbaStrI2
00516772   .  8BD0          mov edx,eax
00516774   .  8D8D 0CFFFFFF lea ecx,dword ptr ss:[ebp-F4]
0051677A   .  FF15 58124000 call dword ptr ds:[<&MSVBVM60.__vbaStrMove>]     ;  MSVBVM60.__vbaStrMove
00516780   .  50            push eax
00516781   .  8B55 08       mov edx,dword ptr ss:[ebp+8]
00516784   .  8B02          mov eax,dword ptr ds:[edx]
00516786   .  8B4D 08       mov ecx,dword ptr ss:[ebp+8]
00516789   .  51            push ecx
0051678A   .  FF90 C4010000 call dword ptr ds:[eax+1C4]
00516790   .  DBE2          fclex
00516792   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
00516798   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],0
0051679F   .  7D 23         jge short 005167C4
005167A1   .  68 C4010000   push 1C4                                         ; /Arg4 = 000001C4
005167A6   .  68 78CA4000   push 0040CA78                                    ; |Arg3 = 0040CA78
005167AB   .  8B55 08       mov edx,dword ptr ss:[ebp+8]                     ; |
005167AE   .  52            push edx                                         ; |Arg2
005167AF   .  8B85 34FCFFFF mov eax,dword ptr ss:[ebp-3CC]                   ; |
005167B5   .  50            push eax                                         ; |Arg1
005167B6   .  FF15 74104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>; \__vbaHresultCheckObj
005167BC   .  8985 24FAFFFF mov dword ptr ss:[ebp-5DC],eax
005167C2   .  EB 0A         jmp short 005167CE
005167C4   >  C785 24FAFFFF>mov dword ptr ss:[ebp-5DC],0
005167CE   >  8D8D 0CFFFFFF lea ecx,dword ptr ss:[ebp-F4]
005167D4   .  FF15 9C124000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]     ;  MSVBVM60.__vbaFreeStr
005167DA   .  C745 FC 49000>mov dword ptr ss:[ebp-4],49
005167E1   .  68 804FC347   push 47C34F80
005167E6   .  8B4D 08       mov ecx,dword ptr ss:[ebp+8]
005167E9   .  8B11          mov edx,dword ptr ds:[ecx]
005167EB   .  8B45 08       mov eax,dword ptr ss:[ebp+8]
005167EE   .  50            push eax
005167EF   .  FF52 7C       call dword ptr ds:[edx+7C]
005167F2   .  DBE2          fclex
005167F4   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
005167FA   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],0
00516801   .  7D 20         jge short 00516823
00516803   .  6A 7C         push 7C                                          ; /Arg4 = 0000007C
00516805   .  68 78CA4000   push 0040CA78                                    ; |Arg3 = 0040CA78
0051680A   .  8B4D 08       mov ecx,dword ptr ss:[ebp+8]                     ; |
0051680D   .  51            push ecx                                         ; |Arg2
0051680E   .  8B95 34FCFFFF mov edx,dword ptr ss:[ebp-3CC]                   ; |
00516814   .  52            push edx                                         ; |Arg1
00516815   .  FF15 74104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>; \__vbaHresultCheckObj
0051681B   .  8985 20FAFFFF mov dword ptr ss:[ebp-5E0],eax
00516821   .  EB 0A         jmp short 0051682D
00516823   >  C785 20FAFFFF>mov dword ptr ss:[ebp-5E0],0
0051682D   >  C745 FC 4A000>mov dword ptr ss:[ebp-4],4A
00516834   .  8B45 08       mov eax,dword ptr ss:[ebp+8]
00516837   .  8B08          mov ecx,dword ptr ds:[eax]
00516839   .  8B55 08       mov edx,dword ptr ss:[ebp+8]
0051683C   .  52            push edx
0051683D   .  FF91 B4020000 call dword ptr ds:[ecx+2B4]
00516843   .  DBE2          fclex
00516845   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
0051684B   .  83BD 34FCFFFF>cmp dword ptr ss:[ebp-3CC],0
00516852   .  7D 23         jge short 00516877
00516854   .  68 B4020000   push 2B4                                         ; /Arg4 = 000002B4
00516859   .  68 78CA4000   push 0040CA78                                    ; |Arg3 = 0040CA78
0051685E   .  8B45 08       mov eax,dword ptr ss:[ebp+8]                     ; |
00516861   .  50            push eax                                         ; |Arg2
00516862   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]                   ; |
00516868   .  51            push ecx                                         ; |Arg1
00516869   .  FF15 74104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>; \__vbaHresultCheckObj
0051686F   .  8985 1CFAFFFF mov dword ptr ss:[ebp-5E4],eax
00516875   .  EB 0A         jmp short 00516881
00516877   >  C785 1CFAFFFF>mov dword ptr ss:[ebp-5E4],0
00516881   >  C745 FC 4B000>mov dword ptr ss:[ebp-4],4B
00516888   .  833D 10E05300>cmp dword ptr ds:[53E010],0
0051688F   .  75 1C         jnz short 005168AD
00516891   .  68 10E05300   push 0053E010                                    ; /Arg2 = 0053E010
00516896   .  68 94B94000   push 0040B994                                    ; |Arg1 = 0040B994
0051689B   .  FF15 D4114000 call dword ptr ds:[<&MSVBVM60.__vbaNew2>]        ; \__vbaNew2
005168A1   .  C785 18FAFFFF>mov dword ptr ss:[ebp-5E8],0053E010
005168AB   .  EB 0A         jmp short 005168B7
005168AD   >  C785 18FAFFFF>mov dword ptr ss:[ebp-5E8],0053E010
005168B7   >  8B95 18FAFFFF mov edx,dword ptr ss:[ebp-5E8]
005168BD   .  8B02          mov eax,dword ptr ds:[edx]
005168BF   .  8985 34FCFFFF mov dword ptr ss:[ebp-3CC],eax
005168C5   .  C785 48FDFFFF>mov dword ptr ss:[ebp-2B8],80020004
005168CF   .  C785 40FDFFFF>mov dword ptr ss:[ebp-2C0],0A
005168D9   .  C785 58FDFFFF>mov dword ptr ss:[ebp-2A8],80020004
005168E3   .  C785 50FDFFFF>mov dword ptr ss:[ebp-2B0],0A
005168ED   .  B8 10000000   mov eax,10
005168F2   .  E8 A908EFFF   call <jmp.&MSVBVM60.__vbaChkstk>
005168F7   .  8BCC          mov ecx,esp
005168F9   .  8B95 40FDFFFF mov edx,dword ptr ss:[ebp-2C0]
005168FF   .  8911          mov dword ptr ds:[ecx],edx
00516901   .  8B85 44FDFFFF mov eax,dword ptr ss:[ebp-2BC]
00516907   .  8941 04       mov dword ptr ds:[ecx+4],eax
0051690A   .  8B95 48FDFFFF mov edx,dword ptr ss:[ebp-2B8]
00516910   .  8951 08       mov dword ptr ds:[ecx+8],edx
00516913   .  8B85 4CFDFFFF mov eax,dword ptr ss:[ebp-2B4]
00516919   .  8941 0C       mov dword ptr ds:[ecx+C],eax
0051691C   .  B8 10000000   mov eax,10
00516921   .  E8 7A08EFFF   call <jmp.&MSVBVM60.__vbaChkstk>
00516926   .  8BCC          mov ecx,esp
00516928   .  8B95 50FDFFFF mov edx,dword ptr ss:[ebp-2B0]
0051692E   .  8911          mov dword ptr ds:[ecx],edx
00516930   .  8B85 54FDFFFF mov eax,dword ptr ss:[ebp-2AC]
00516936   .  8941 04       mov dword ptr ds:[ecx+4],eax
00516939   .  8B95 58FDFFFF mov edx,dword ptr ss:[ebp-2A8]
0051693F   .  8951 08       mov dword ptr ds:[ecx+8],edx
00516942   .  8B85 5CFDFFFF mov eax,dword ptr ss:[ebp-2A4]
00516948   .  8941 0C       mov dword ptr ds:[ecx+C],eax
0051694B   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]
00516951   .  8B11          mov edx,dword ptr ds:[ecx]
00516953   .  8B85 34FCFFFF mov eax,dword ptr ss:[ebp-3CC]
00516959   .  50            push eax
0051695A   .  FF92 B0020000 call dword ptr ds:[edx+2B0]
00516960   .  DBE2          fclex
00516962   .  8985 30FCFFFF mov dword ptr ss:[ebp-3D0],eax
00516968   .  83BD 30FCFFFF>cmp dword ptr ss:[ebp-3D0],0
0051696F   .  7D 26         jge short 00516997
00516971   .  68 B0020000   push 2B0                                         ; /Arg4 = 000002B0
00516976   .  68 88C74000   push 0040C788                                    ; |Arg3 = 0040C788
0051697B   .  8B8D 34FCFFFF mov ecx,dword ptr ss:[ebp-3CC]                   ; |
00516981   .  51            push ecx                                         ; |Arg2
00516982   .  8B95 30FCFFFF mov edx,dword ptr ss:[ebp-3D0]                   ; |
00516988   .  52            push edx                                         ; |Arg1
00516989   .  FF15 74104000 call dword ptr ds:[<&MSVBVM60.__vbaHresultCheckO>; \__vbaHresultCheckObj
0051698F   .  8985 14FAFFFF mov dword ptr ss:[ebp-5EC],eax
00516995   .  EB 0A         jmp short 005169A1
00516997   >  C785 14FAFFFF>mov dword ptr ss:[ebp-5EC],0
005169A1   >  EB 0D         jmp short 005169B0
005169A3   >  C745 FC 4E000>mov dword ptr ss:[ebp-4],4E
005169AA   .  FF15 A0104000 call dword ptr ds:[<&MSVBVM60.__vbaFileCloseAll>>;  MSVBVM60.__vbaFileCloseAll
005169B0   >  C745 F0 00000>mov dword ptr ss:[ebp-10],0
005169B7   .  9B            wait
005169B8   .  68 7C6B5100   push 00516B7C
005169BD   .  E9 EE000000   jmp 00516AB0
005169C2   .  8D85 04FFFFFF lea eax,dword ptr ss:[ebp-FC]
005169C8   .  50            push eax
005169C9   .  8D8D 08FFFFFF lea ecx,dword ptr ss:[ebp-F8]
005169CF   .  51            push ecx
005169D0   .  8D95 0CFFFFFF lea edx,dword ptr ss:[ebp-F4]
005169D6   .  52            push edx
005169D7   .  6A 03         push 3
005169D9   .  FF15 F4114000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStrList>] ;  MSVBVM60.__vbaFreeStrList
005169DF   .  83C4 10       add esp,10
005169E2   .  8D8D 00FFFFFF lea ecx,dword ptr ss:[ebp-100]
005169E8   .  FF15 98124000 call dword ptr ds:[<&MSVBVM60.__vbaFreeObj>]     ;  MSVBVM60.__vbaFreeObj
005169EE   .  8D85 60FDFFFF lea eax,dword ptr ss:[ebp-2A0]
005169F4   .  50            push eax
005169F5   .  8D8D 70FDFFFF lea ecx,dword ptr ss:[ebp-290]
005169FB   .  51            push ecx
005169FC   .  8D95 80FDFFFF lea edx,dword ptr ss:[ebp-280]
00516A02   .  52            push edx
00516A03   .  8D85 90FDFFFF lea eax,dword ptr ss:[ebp-270]
00516A09   .  50            push eax
00516A0A   .  8D8D A0FDFFFF lea ecx,dword ptr ss:[ebp-260]
00516A10   .  51            push ecx
00516A11   .  8D95 B0FDFFFF lea edx,dword ptr ss:[ebp-250]
00516A17   .  52            push edx
00516A18   .  8D85 C0FDFFFF lea eax,dword ptr ss:[ebp-240]
00516A1E   .  50            push eax
00516A1F   .  8D8D D0FDFFFF lea ecx,dword ptr ss:[ebp-230]
00516A25   .  51            push ecx
00516A26   .  8D95 E0FDFFFF lea edx,dword ptr ss:[ebp-220]
00516A2C   .  52            push edx
00516A2D   .  8D85 F0FDFFFF lea eax,dword ptr ss:[ebp-210]
00516A33   .  50            push eax
00516A34   .  8D8D 00FEFFFF lea ecx,dword ptr ss:[ebp-200]
00516A3A   .  51            push ecx
00516A3B   .  8D95 10FEFFFF lea edx,dword ptr ss:[ebp-1F0]
00516A41   .  52            push edx
00516A42   .  8D85 20FEFFFF lea eax,dword ptr ss:[ebp-1E0]
00516A48   .  50            push eax
00516A49   .  8D8D 30FEFFFF lea ecx,dword ptr ss:[ebp-1D0]
00516A4F   .  51            push ecx
00516A50   .  8D95 40FEFFFF lea edx,dword ptr ss:[ebp-1C0]
00516A56   .  52            push edx
00516A57   .  8D85 50FEFFFF lea eax,dword ptr ss:[ebp-1B0]
00516A5D   .  50            push eax
00516A5E   .  8D8D 60FEFFFF lea ecx,dword ptr ss:[ebp-1A0]
00516A64   .  51            push ecx
00516A65   .  8D95 70FEFFFF lea edx,dword ptr ss:[ebp-190]
00516A6B   .  52            push edx
00516A6C   .  8D85 80FEFFFF lea eax,dword ptr ss:[ebp-180]
00516A72   .  50            push eax
00516A73   .  8D8D 90FEFFFF lea ecx,dword ptr ss:[ebp-170]
00516A79   .  51            push ecx
00516A7A   .  8D95 A0FEFFFF lea edx,dword ptr ss:[ebp-160]
00516A80   .  52            push edx
00516A81   .  8D85 B0FEFFFF lea eax,dword ptr ss:[ebp-150]
00516A87   .  50            push eax
00516A88   .  8D8D C0FEFFFF lea ecx,dword ptr ss:[ebp-140]
00516A8E   .  51            push ecx
00516A8F   .  8D95 D0FEFFFF lea edx,dword ptr ss:[ebp-130]
00516A95   .  52            push edx
00516A96   .  8D85 E0FEFFFF lea eax,dword ptr ss:[ebp-120]
00516A9C   .  50            push eax
00516A9D   .  8D8D F0FEFFFF lea ecx,dword ptr ss:[ebp-110]
00516AA3   .  51            push ecx
00516AA4   .  6A 1A         push 1A
00516AA6   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
00516AAC   .  83C4 6C       add esp,6C
00516AAF   .  C3            retn
00516AB0   >  8D95 9CFBFFFF lea edx,dword ptr ss:[ebp-464]
00516AB6   .  52            push edx
00516AB7   .  8D85 ACFBFFFF lea eax,dword ptr ss:[ebp-454]
00516ABD   .  50            push eax
00516ABE   .  8D8D BCFBFFFF lea ecx,dword ptr ss:[ebp-444]
00516AC4   .  51            push ecx
00516AC5   .  8D95 CCFBFFFF lea edx,dword ptr ss:[ebp-434]
00516ACB   .  52            push edx
00516ACC   .  8D85 DCFBFFFF lea eax,dword ptr ss:[ebp-424]
00516AD2   .  50            push eax
00516AD3   .  8D8D ECFBFFFF lea ecx,dword ptr ss:[ebp-414]
00516AD9   .  51            push ecx
00516ADA   .  6A 06         push 6
00516ADC   .  FF15 38104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVarList>] ;  MSVBVM60.__vbaFreeVarList
00516AE2   .  83C4 1C       add esp,1C
00516AE5   .  8D4D D0       lea ecx,dword ptr ss:[ebp-30]
00516AE8   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516AEE   .  8D4D C0       lea ecx,dword ptr ss:[ebp-40]
00516AF1   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516AF7   .  8D4D B0       lea ecx,dword ptr ss:[ebp-50]
00516AFA   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516B00   .  8D4D A0       lea ecx,dword ptr ss:[ebp-60]
00516B03   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516B09   .  8D4D 98       lea ecx,dword ptr ss:[ebp-68]
00516B0C   .  FF15 9C124000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]     ;  MSVBVM60.__vbaFreeStr
00516B12   .  8D4D 88       lea ecx,dword ptr ss:[ebp-78]
00516B15   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516B1B   .  8D8D 78FFFFFF lea ecx,dword ptr ss:[ebp-88]
00516B21   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516B27   .  8D8D 68FFFFFF lea ecx,dword ptr ss:[ebp-98]
00516B2D   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516B33   .  8D8D 58FFFFFF lea ecx,dword ptr ss:[ebp-A8]
00516B39   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516B3F   .  8D8D 44FFFFFF lea ecx,dword ptr ss:[ebp-BC]
00516B45   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516B4B   .  8D8D 40FFFFFF lea ecx,dword ptr ss:[ebp-C0]
00516B51   .  FF15 9C124000 call dword ptr ds:[<&MSVBVM60.__vbaFreeStr>]     ;  MSVBVM60.__vbaFreeStr
00516B57   .  8D8D 30FFFFFF lea ecx,dword ptr ss:[ebp-D0]
00516B5D   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516B63   .  8D8D 20FFFFFF lea ecx,dword ptr ss:[ebp-E0]
00516B69   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516B6F   .  8D8D 10FFFFFF lea ecx,dword ptr ss:[ebp-F0]
00516B75   .  FF15 1C104000 call dword ptr ds:[<&MSVBVM60.__vbaFreeVar>]     ;  MSVBVM60.__vbaFreeVar
00516B7B   .  C3            retn
00516B7C   .  8B55 08       mov edx,dword ptr ss:[ebp+8]
00516B7F   .  8B02          mov eax,dword ptr ds:[edx]
00516B81   .  8B4D 08       mov ecx,dword ptr ss:[ebp+8]
00516B84   .  51            push ecx
00516B85   .  FF50 08       call dword ptr ds:[eax+8]
00516B88   .  8B45 F0       mov eax,dword ptr ss:[ebp-10]
00516B8B   .  8B4D E0       mov ecx,dword ptr ss:[ebp-20]
00516B8E   .  64:890D 00000>mov dword ptr fs:[0],ecx
00516B95   .  5F            pop edi
00516B96   .  5E            pop esi
00516B97   .  5B            pop ebx
00516B98   .  8BE5          mov esp,ebp
00516B9A   .  5D            pop ebp












评分

参与人数 11HB +29 THX +7 收起 理由
虚心学习 + 1
zxjzzh + 1 [吾爱汇编论坛52HB.COM]-学破解防破解,知进攻懂防守!
一路走来不容易 + 1
消逝的过去 + 1
侠客行 + 1
叶落花开 + 2
lies + 1
morey.z + 1 [快捷评语]--学破解论坛因为有你,而变得精彩!
cydzdiy + 3 + 1 [快捷评语] - 吃水不忘打井人,给个评分懂感恩!
染指流年123 + 1 + 1 [快捷评语] - 吃水不忘打井人,给个评分懂感恩!
Shark恒 + 20 + 1 [快捷评语] - 评分=感恩!简单却充满爱!感谢您的作品!

查看全部评分

吾爱汇编论坛-学破解,防破解!知进攻,懂防守!逆向分析,软件安全!52HB.COM
576727754 发表于 2018-6-12 13:26 | 显示全部楼层
吾爱汇编论坛-学破解,防破解!知进攻,懂防守!逆向分析,软件安全!52HB.COM
售野生奥特曼 发表于 2018-6-12 15:24 | 显示全部楼层

算法太难了,但还是感兴趣
吾爱汇编论坛-学破解,防破解!知进攻,懂防守!逆向分析,软件安全!52HB.COM
湛西哥 发表于 2018-6-12 20:15 | 显示全部楼层
吾爱汇编论坛-学破解,防破解!知进攻,懂防守!逆向分析,软件安全!52HB.COM
头像被屏蔽
df1456444222 发表于 2018-6-17 01:27 | 显示全部楼层

提示: 作者被禁止或删除 内容自动屏蔽
吾爱汇编论坛-学破解,防破解!知进攻,懂防守!逆向分析,软件安全!52HB.COM
zfzxt8281292 发表于 2018-6-18 21:14 | 显示全部楼层

学习了,最近似乎越来越多的暂停法了,看看其中的区别,谢谢分享
吾爱汇编论坛-学破解,防破解!知进攻,懂防守!逆向分析,软件安全!52HB.COM
染指流年123 发表于 2018-6-19 12:38 | 显示全部楼层

谢谢楼主分享了 !
吾爱汇编论坛-学破解,防破解!知进攻,懂防守!逆向分析,软件安全!52HB.COM
bsjasdq20615 发表于 2018-6-20 12:58 | 显示全部楼层

学习学习思路
吾爱汇编论坛-学破解,防破解!知进攻,懂防守!逆向分析,软件安全!52HB.COM
bgfa2016 发表于 2018-6-20 13:07 | 显示全部楼层

简单却充满爱!感谢您的作品!
吾爱汇编论坛-学破解,防破解!知进攻,懂防守!逆向分析,软件安全!52HB.COM
转化者 发表于 2018-6-20 13:08 | 显示全部楼层

谢谢楼主..
吾爱汇编论坛-学破解,防破解!知进攻,懂防守!逆向分析,软件安全!52HB.COM
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

警告:本站严惩灌水回复,尊重自己从尊重他人开始!

1层
2层
3层
4层
5层
6层
7层
8层
9层
10层

免责声明

吾爱汇编(www.52hb.com)所讨论的技术及相关工具仅限用于研究学习,皆在提高软件产品的安全性,严禁用于不良动机。任何个人、团体、组织不得将其用于非法目的,否则,一切后果自行承担。吾爱汇编不承担任何因为技术滥用所产生的连带责任。吾爱汇编内容源于网络,版权争议与本站无关。您必须在下载后的24个小时之内,从您的电脑中彻底删除。如有侵权请邮件或微信与我们联系处理。

站长邮箱:SharkHeng@sina.com
站长QQ:1140549900


QQ|RSS|手机版|小黑屋|帮助|吾爱汇编 ( 京公网安备11011502005403号 , 京ICP备20003498号-6 )|网站地图

Powered by Discuz!

吾爱汇编 www.52hb.com

快速回复 返回顶部 返回列表