0040BEF0   $  55            push ebp
0040BEF1   .  8BEC          mov ebp,esp
0040BEF3   .  83EC 14       sub esp,0x14
0040BEF6   .  68 861A4000   push <jmp.&msvbvm60.__vbaExceptHandler>  ;  SE 处理程序安装
0040BEFB   .  64:A1 0000000>mov eax,dword ptr fs:[0]
0040BF01   .  50            push eax
0040BF02   .  64:8925 00000>mov dword ptr fs:[0],esp
0040BF09   .  81EC AC000000 sub esp,0xAC
0040BF0F   .  53            push ebx
0040BF10   .  56            push esi
0040BF11   .  57            push edi
0040BF12   .  8965 EC       mov dword ptr ss:[ebp-0x14],esp
0040BF15   .  C745 F0 A8174>mov dword ptr ss:[ebp-0x10],qwwwwqqw.004>
0040BF1C   .  33F6          xor esi,esi
0040BF1E   .  8975 F4       mov dword ptr ss:[ebp-0xC],esi
0040BF21   .  8975 F8       mov dword ptr ss:[ebp-0x8],esi
0040BF24   .  8975 CC       mov dword ptr ss:[ebp-0x34],esi
0040BF27   .  8975 C8       mov dword ptr ss:[ebp-0x38],esi
0040BF2A   .  8975 C4       mov dword ptr ss:[ebp-0x3C],esi
0040BF2D   .  8975 C0       mov dword ptr ss:[ebp-0x40],esi
0040BF30   .  8975 BC       mov dword ptr ss:[ebp-0x44],esi
0040BF33   .  8975 B8       mov dword ptr ss:[ebp-0x48],esi
0040BF36   .  8975 A8       mov dword ptr ss:[ebp-0x58],esi
0040BF39   .  8975 98       mov dword ptr ss:[ebp-0x68],esi
0040BF3C   .  8975 88       mov dword ptr ss:[ebp-0x78],esi
0040BF3F   .  8B55 08       mov edx,dword ptr ss:[ebp+0x8]
0040BF42   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
0040BF45   .  8B3D A0114000 mov edi,dword ptr ds:[<&msvbvm60.__vbaSt>;  msvbvm60.__vbaStrCopy
0040BF4B   .  FFD7          call edi                                 ;  <&msvbvm60.__vbaStrCopy>
0040BF4D   .  6A 01         push 0x1                                 ; /OnErrEvent = Goto Address
0040BF4F   .  FF15 78104000 call dword ptr ds:[<&msvbvm60.__vbaOnErr>; \__vbaOnError
0040BF55   .  BA 00474000   mov edx,qwwwwqqw.00404700                ;  ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz
0040BF5A   .  8D4D CC       lea ecx,dword ptr ss:[ebp-0x34]
0040BF5D   .  FFD7          call edi
0040BF5F   .  8975 D0       mov dword ptr ss:[ebp-0x30],esi
0040BF62   .  8B45 C0       mov eax,dword ptr ss:[ebp-0x40]
0040BF65   .  50            push eax                                 ; /String
0040BF66   .  FF15 18104000 call dword ptr ds:[<&msvbvm60.__vbaLenBs>; \__vbaLenBstr
0040BF6C   .  8985 68FFFFFF mov dword ptr ss:[ebp-0x98],eax
0040BF72   .  BB 01000000   mov ebx,0x1
0040BF77   .  8B3D 1C114000 mov edi,dword ptr ds:[<&msvbvm60.__vbaUI>;  msvbvm60.__vbaUI1I4
0040BF7D   >  3B9D 68FFFFFF cmp ebx,dword ptr ss:[ebp-0x98]
0040BF83   .  0F8F B2020000 jg qwwwwqqw.0040C23B
0040BF89   .  C745 B0 01000>mov dword ptr ss:[ebp-0x50],0x1
0040BF90   .  C745 A8 02000>mov dword ptr ss:[ebp-0x58],0x2
0040BF97   .  8D4D C0       lea ecx,dword ptr ss:[ebp-0x40]
0040BF9A   .  894D 90       mov dword ptr ss:[ebp-0x70],ecx
0040BF9D   .  C745 88 08400>mov dword ptr ss:[ebp-0x78],0x4008
0040BFA4   .  8D55 A8       lea edx,dword ptr ss:[ebp-0x58]
0040BFA7   .  52            push edx                                 ; /Length8
0040BFA8   .  53            push ebx                                 ; |Start
0040BFA9   .  8D45 88       lea eax,dword ptr ss:[ebp-0x78]          ; |
0040BFAC   .  50            push eax                                 ; |dString8
0040BFAD   .  8D4D 98       lea ecx,dword ptr ss:[ebp-0x68]          ; |
0040BFB0   .  51            push ecx                                 ; |RetBUFFER
0040BFB1   .  FF15 9C104000 call dword ptr ds:[<&msvbvm60.rtcMidChar>; \rtcMidCharVar
0040BFB7   .  8D55 98       lea edx,dword ptr ss:[ebp-0x68]
0040BFBA   .  52            push edx
0040BFBB   .  FF15 1C104000 call dword ptr ds:[<&msvbvm60.__vbaStrVa>;  msvbvm60.__vbaStrVarMove
0040BFC1   .  8BD0          mov edx,eax
0040BFC3   .  8D4D C4       lea ecx,dword ptr ss:[ebp-0x3C]
0040BFC6   .  8B35 04124000 mov esi,dword ptr ds:[<&msvbvm60.__vbaSt>;  msvbvm60.__vbaStrMove
0040BFCC   .  FFD6          call esi                                 ;  <&msvbvm60.__vbaStrMove>
0040BFCE   .  8D45 98       lea eax,dword ptr ss:[ebp-0x68]
0040BFD1   .  50            push eax
0040BFD2   .  8D4D A8       lea ecx,dword ptr ss:[ebp-0x58]
0040BFD5   .  51            push ecx
0040BFD6   .  6A 02         push 0x2
0040BFD8   .  FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaFreeV>;  msvbvm60.__vbaFreeVarList
0040BFDE   .  83C4 0C       add esp,0xC
0040BFE1   .  C745 B0 01000>mov dword ptr ss:[ebp-0x50],0x1
0040BFE8   .  C745 A8 02000>mov dword ptr ss:[ebp-0x58],0x2
0040BFEF   .  8D55 C0       lea edx,dword ptr ss:[ebp-0x40]
0040BFF2   .  8955 90       mov dword ptr ss:[ebp-0x70],edx
0040BFF5   .  C745 88 08400>mov dword ptr ss:[ebp-0x78],0x4008
0040BFFC   .  8D45 A8       lea eax,dword ptr ss:[ebp-0x58]
0040BFFF   .  50            push eax                                 ; /Length8
0040C000   .  8BCB          mov ecx,ebx                              ; |
0040C002   .  83C1 01       add ecx,0x1                              ; |
0040C005   .  0F80 FB020000 jo qwwwwqqw.0040C306                     ; |
0040C00B   .  51            push ecx                                 ; |Start
0040C00C   .  8D55 88       lea edx,dword ptr ss:[ebp-0x78]          ; |
0040C00F   .  52            push edx                                 ; |dString8
0040C010   .  8D45 98       lea eax,dword ptr ss:[ebp-0x68]          ; |
0040C013   .  50            push eax                                 ; |RetBUFFER
0040C014   .  FF15 9C104000 call dword ptr ds:[<&msvbvm60.rtcMidChar>; \rtcMidCharVar
0040C01A   .  8D4D 98       lea ecx,dword ptr ss:[ebp-0x68]
0040C01D   .  51            push ecx
0040C01E   .  FF15 1C104000 call dword ptr ds:[<&msvbvm60.__vbaStrVa>;  msvbvm60.__vbaStrVarMove
0040C024   .  8BD0          mov edx,eax
0040C026   .  8D4D BC       lea ecx,dword ptr ss:[ebp-0x44]
0040C029   .  FFD6          call esi
0040C02B   .  8D55 98       lea edx,dword ptr ss:[ebp-0x68]
0040C02E   .  52            push edx
0040C02F   .  8D45 A8       lea eax,dword ptr ss:[ebp-0x58]
0040C032   .  50            push eax
0040C033   .  6A 02         push 0x2
0040C035   .  FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaFreeV>;  msvbvm60.__vbaFreeVarList
0040C03B   .  83C4 0C       add esp,0xC
0040C03E   .  6A 01         push 0x1
0040C040   .  8B4D CC       mov ecx,dword ptr ss:[ebp-0x34]
0040C043   .  51            push ecx
0040C044   .  8B55 C4       mov edx,dword ptr ss:[ebp-0x3C]
0040C047   .  52            push edx
0040C048   .  6A 00         push 0x0
0040C04A   .  8B35 94114000 mov esi,dword ptr ds:[<&msvbvm60.__vbaIn>;  msvbvm60.__vbaInStr
0040C050   .  FFD6          call esi                                 ;  <&msvbvm60.__vbaInStr>
0040C052   .  8BC8          mov ecx,eax
0040C054   .  83E9 01       sub ecx,0x1
0040C057   .  0F80 A9020000 jo qwwwwqqw.0040C306
0040C05D   .  FFD7          call edi
0040C05F   .  8845 D8       mov byte ptr ss:[ebp-0x28],al
0040C062   .  6A 01         push 0x1
0040C064   .  8B45 CC       mov eax,dword ptr ss:[ebp-0x34]
0040C067   .  50            push eax
0040C068   .  8B4D BC       mov ecx,dword ptr ss:[ebp-0x44]
0040C06B   .  51            push ecx
0040C06C   .  6A 00         push 0x0
0040C06E   .  FFD6          call esi
0040C070   .  8BC8          mov ecx,eax
0040C072   .  83E9 01       sub ecx,0x1
0040C075   .  0F80 8B020000 jo qwwwwqqw.0040C306
0040C07B   .  FFD7          call edi
0040C07D   .  8845 D4       mov byte ptr ss:[ebp-0x2C],al
0040C080   .  8B75 D4       mov esi,dword ptr ss:[ebp-0x2C]
0040C083   .  81E6 FF000000 and esi,0xFF
0040C089   .  89B5 54FFFFFF mov dword ptr ss:[ebp-0xAC],esi
0040C08F   .  68 00000840   push 0x40080000
0040C094   .  6A 00         push 0x0
0040C096   .  68 00000040   push 0x40000000
0040C09B   .  6A 00         push 0x0
0040C09D   .  FF15 AC114000 call dword ptr ds:[<&msvbvm60.__vbaPower>;  msvbvm60.__vbaPowerR8
0040C0A3   .  FF15 F0114000 call dword ptr ds:[<&msvbvm60.__vbaFpI4>>;  msvbvm60.__vbaFpI4
0040C0A9   .  8BC8          mov ecx,eax
0040C0AB   .  8BC6          mov eax,esi
0040C0AD   .  99            cdq
0040C0AE   .  F7F9          idiv ecx
0040C0B0   .  8BC8          mov ecx,eax
0040C0B2   .  FFD7          call edi
0040C0B4   .  8845 DC       mov byte ptr ss:[ebp-0x24],al
0040C0B7   .  8B75 DC       mov esi,dword ptr ss:[ebp-0x24]
0040C0BA   .  81E6 FF000000 and esi,0xFF
0040C0C0   .  89B5 50FFFFFF mov dword ptr ss:[ebp-0xB0],esi
0040C0C6   .  DB85 54FFFFFF fild dword ptr ss:[ebp-0xAC]
0040C0CC   .  DD9D 48FFFFFF fstp qword ptr ss:[ebp-0xB8]
0040C0D2   .  68 00000840   push 0x40080000
0040C0D7   .  6A 00         push 0x0
0040C0D9   .  68 00000040   push 0x40000000
0040C0DE   .  6A 00         push 0x0
0040C0E0   .  FF15 AC114000 call dword ptr ds:[<&msvbvm60.__vbaPower>;  msvbvm60.__vbaPowerR8
0040C0E6   .  DB85 50FFFFFF fild dword ptr ss:[ebp-0xB0]
0040C0EC   .  DD9D 40FFFFFF fstp qword ptr ss:[ebp-0xC0]
0040C0F2   .  DC8D 40FFFFFF fmul qword ptr ss:[ebp-0xC0]
0040C0F8   .  DCAD 48FFFFFF fsubr qword ptr ss:[ebp-0xB8]
0040C0FE   .  DFE0          fstsw ax
0040C100   .  A8 0D         test al,0xD
0040C102   .  0F85 F9010000 jnz qwwwwqqw.0040C301
0040C108   .  FF15 E8104000 call dword ptr ds:[<&msvbvm60.__vbaFpUI1>;  msvbvm60.__vbaFpUI1
0040C10E   .  8845 D4       mov byte ptr ss:[ebp-0x2C],al
0040C111   .  6A 00         push 0x0
0040C113   .  8B55 D0       mov edx,dword ptr ss:[ebp-0x30]
0040C116   .  52            push edx
0040C117   .  6A 01         push 0x1
0040C119   .  6A 11         push 0x11
0040C11B   .  8D45 B8       lea eax,dword ptr ss:[ebp-0x48]
0040C11E   .  50            push eax
0040C11F   .  6A 01         push 0x1
0040C121   .  68 80000000   push 0x80
0040C126   .  FF15 EC104000 call dword ptr ds:[<&msvbvm60.__vbaRedim>;  msvbvm60.__vbaRedimPreserve
0040C12C   .  83C4 1C       add esp,0x1C
0040C12F   .  8B45 B8       mov eax,dword ptr ss:[ebp-0x48]
0040C132   .  85C0          test eax,eax
0040C134   .  74 2B         je Xqwwwwqqw.0040C161
0040C136   .  66:8338 01    cmp word ptr ds:[eax],0x1
0040C13A   .  75 25         jnz Xqwwwwqqw.0040C161
0040C13C   .  8B4D D0       mov ecx,dword ptr ss:[ebp-0x30]
0040C13F   .  2B48 14       sub ecx,dword ptr ds:[eax+0x14]
0040C142   .  898D 74FFFFFF mov dword ptr ss:[ebp-0x8C],ecx
0040C148   .  3B48 10       cmp ecx,dword ptr ds:[eax+0x10]
0040C14B   .  72 0C         jb Xqwwwwqqw.0040C159
0040C14D   .  FF15 B8104000 call dword ptr ds:[<&msvbvm60.__vbaGener>;  msvbvm60.__vbaGenerateBoundsError
0040C153   .  8B8D 74FFFFFF mov ecx,dword ptr ss:[ebp-0x8C]
0040C159   >  898D 3CFFFFFF mov dword ptr ss:[ebp-0xC4],ecx
0040C15F   .  EB 0C         jmp Xqwwwwqqw.0040C16D
0040C161   >  FF15 B8104000 call dword ptr ds:[<&msvbvm60.__vbaGener>;  msvbvm60.__vbaGenerateBoundsError
0040C167   .  8985 3CFFFFFF mov dword ptr ss:[ebp-0xC4],eax
0040C16D   >  8B4D CC       mov ecx,dword ptr ss:[ebp-0x34]
0040C170   .  51            push ecx                                 ; /String
0040C171   .  FF15 18104000 call dword ptr ds:[<&msvbvm60.__vbaLenBs>; \__vbaLenBstr
0040C177   .  8BC8          mov ecx,eax
0040C179   .  0FAFCE        imul ecx,esi
0040C17C   .  0F80 84010000 jo qwwwwqqw.0040C306
0040C182   .  8B55 D8       mov edx,dword ptr ss:[ebp-0x28]
0040C185   .  81E2 FF000000 and edx,0xFF
0040C18B   .  03CA          add ecx,edx
0040C18D   .  0F80 73010000 jo qwwwwqqw.0040C306
0040C193   .  FFD7          call edi
0040C195   .  8B4D B8       mov ecx,dword ptr ss:[ebp-0x48]
0040C198   .  8B51 0C       mov edx,dword ptr ds:[ecx+0xC]
0040C19B   .  8B8D 3CFFFFFF mov ecx,dword ptr ss:[ebp-0xC4]
0040C1A1   .  88040A        mov byte ptr ds:[edx+ecx],al
0040C1A4   .  8B4D B8       mov ecx,dword ptr ss:[ebp-0x48]
0040C1A7   .  85C9          test ecx,ecx
0040C1A9   .  74 22         je Xqwwwwqqw.0040C1CD
0040C1AB   .  66:8339 01    cmp word ptr ds:[ecx],0x1
0040C1AF   .  75 1C         jnz Xqwwwwqqw.0040C1CD
0040C1B1   .  8B75 D0       mov esi,dword ptr ss:[ebp-0x30]
0040C1B4   .  2B71 14       sub esi,dword ptr ds:[ecx+0x14]
0040C1B7   .  3B71 10       cmp esi,dword ptr ds:[ecx+0x10]
0040C1BA   .  72 09         jb Xqwwwwqqw.0040C1C5
0040C1BC   .  FF15 B8104000 call dword ptr ds:[<&msvbvm60.__vbaGener>;  msvbvm60.__vbaGenerateBoundsError
0040C1C2   .  8B4D B8       mov ecx,dword ptr ss:[ebp-0x48]
0040C1C5   >  89B5 38FFFFFF mov dword ptr ss:[ebp-0xC8],esi
0040C1CB   .  EB 0F         jmp Xqwwwwqqw.0040C1DC
0040C1CD   >  FF15 B8104000 call dword ptr ds:[<&msvbvm60.__vbaGener>;  msvbvm60.__vbaGenerateBoundsError
0040C1D3   .  8985 38FFFFFF mov dword ptr ss:[ebp-0xC8],eax
0040C1D9   .  8B4D B8       mov ecx,dword ptr ss:[ebp-0x48]
0040C1DC   >  85C9          test ecx,ecx
0040C1DE   .  74 19         je Xqwwwwqqw.0040C1F9
0040C1E0   .  66:8339 01    cmp word ptr ds:[ecx],0x1
0040C1E4   .  75 13         jnz Xqwwwwqqw.0040C1F9
0040C1E6   .  8B75 D0       mov esi,dword ptr ss:[ebp-0x30]
0040C1E9   .  2B71 14       sub esi,dword ptr ds:[ecx+0x14]
0040C1EC   .  3B71 10       cmp esi,dword ptr ds:[ecx+0x10]
0040C1EF   .  72 13         jb Xqwwwwqqw.0040C204
0040C1F1   .  FF15 B8104000 call dword ptr ds:[<&msvbvm60.__vbaGener>;  msvbvm60.__vbaGenerateBoundsError
0040C1F7   .  EB 08         jmp Xqwwwwqqw.0040C201
0040C1F9   >  FF15 B8104000 call dword ptr ds:[<&msvbvm60.__vbaGener>;  msvbvm60.__vbaGenerateBoundsError
0040C1FF   .  8BF0          mov esi,eax
0040C201   >  8B4D B8       mov ecx,dword ptr ss:[ebp-0x48]
0040C204   >  8B49 0C       mov ecx,dword ptr ds:[ecx+0xC]
0040C207   .  8B95 38FFFFFF mov edx,dword ptr ss:[ebp-0xC8]
0040C20D   .  8A0411        mov al,byte ptr ds:[ecx+edx]
0040C210   .  3245 D4       xor al,byte ptr ss:[ebp-0x2C]
0040C213   .  880431        mov byte ptr ds:[ecx+esi],al
0040C216   .  8B4D D0       mov ecx,dword ptr ss:[ebp-0x30]
0040C219   .  83C1 01       add ecx,0x1
0040C21C   .  0F80 E4000000 jo qwwwwqqw.0040C306
0040C222   .  894D D0       mov dword ptr ss:[ebp-0x30],ecx
0040C225   .  B8 02000000   mov eax,0x2
0040C22A   .  03C3          add eax,ebx
0040C22C   .  0F80 D4000000 jo qwwwwqqw.0040C306
0040C232   .  8BD8          mov ebx,eax
0040C234   .  33F6          xor esi,esi
0040C236   .^ E9 42FDFFFF   jmp qwwwwqqw.0040BF7D
0040C23B   >  8D55 B8       lea edx,dword ptr ss:[ebp-0x48]
0040C23E   .  8955 90       mov dword ptr ss:[ebp-0x70],edx
0040C241   .  C745 88 11600>mov dword ptr ss:[ebp-0x78],0x6011
0040C248   .  56            push esi
0040C249   .  6A 40         push 0x40
0040C24B   .  8D45 88       lea eax,dword ptr ss:[ebp-0x78]
0040C24E   .  50            push eax
0040C24F   .  8D4D A8       lea ecx,dword ptr ss:[ebp-0x58]
0040C252   .  51            push ecx
0040C253   .  FF15 4C114000 call dword ptr ds:[<&msvbvm60.rtcStrConv>;  msvbvm60.rtcStrConvVar2
0040C259   .  8D55 A8       lea edx,dword ptr ss:[ebp-0x58]
0040C25C   .  52            push edx
0040C25D   .  FF15 1C104000 call dword ptr ds:[<&msvbvm60.__vbaStrVa>;  msvbvm60.__vbaStrVarMove
0040C263   .  8BD0          mov edx,eax
0040C265   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
0040C268   .  FF15 04124000 call dword ptr ds:[<&msvbvm60.__vbaStrMo>;  msvbvm60.__vbaStrMove
0040C26E   .  8D4D A8       lea ecx,dword ptr ss:[ebp-0x58]
0040C271   .  FF15 14104000 call dword ptr ds:[<&msvbvm60.__vbaFreeV>;  msvbvm60.__vbaFreeVar
0040C277   .  FF15 68104000 call dword ptr ds:[<&msvbvm60.__vbaExitP>;  msvbvm60.__vbaExitProc
0040C27D   .  9B            wait
0040C27E   .  68 EBC24000   push qwwwwqqw.0040C2EB
0040C283   .  EB 3F         jmp Xqwwwwqqw.0040C2C4
0040C285   .  BA A8344000   mov edx,qwwwwqqw.004034A8
0040C28A   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
0040C28D   .  FF15 A0114000 call dword ptr ds:[<&msvbvm60.__vbaStrCo>;  msvbvm60.__vbaStrCopy
0040C293   .  FF15 68104000 call dword ptr ds:[<&msvbvm60.__vbaExitP>;  msvbvm60.__vbaExitProc
0040C299   .  9B            wait
0040C29A   .  68 EBC24000   push qwwwwqqw.0040C2EB
0040C29F   .  EB 23         jmp Xqwwwwqqw.0040C2C4
0040C2A1   .  F645 F4 04    test byte ptr ss:[ebp-0xC],0x4
0040C2A5   .  74 09         je Xqwwwwqqw.0040C2B0
0040C2A7   .  8D4D C8       lea ecx,dword ptr ss:[ebp-0x38]
0040C2AA   .  FF15 30124000 call dword ptr ds:[<&msvbvm60.__vbaFreeS>;  msvbvm60.__vbaFreeStr
0040C2B0   >  8D45 98       lea eax,dword ptr ss:[ebp-0x68]
0040C2B3   .  50            push eax
0040C2B4   .  8D4D A8       lea ecx,dword ptr ss:[ebp-0x58]
0040C2B7   .  51            push ecx
0040C2B8   .  6A 02         push 0x2
0040C2BA   .  FF15 20104000 call dword ptr ds:[<&msvbvm60.__vbaFreeV>;  msvbvm60.__vbaFreeVarList
0040C2C0   .  83C4 0C       add esp,0xC
0040C2C3   .  C3            retn

这个好像是一段加密网址的解密算法。谁能给我分析下~~~~~~


[ 本帖最后由 beyondaop 于 2011-12-5 18:22 编辑 ]

自己不能分析?

大虾，我真的不懂汇编语言。。你能帮忙解析下吗？

我是没看出怎么加密的。。。

是解密。。不好意思。。加密的网址是：iKuKsIqKuCkBjCsLuJuJkArEmBrEqFmBrEmBqFnAoDmBmBmBpCpCrEmBrErErEqFnApCrErEqFmBnAoDqFlB8LnIgNhE

谁能帮我解密~！！！

我只能看出，对一个不知名的结构操作了一堆0而已，MS有一个入口参数和一个指向了结构指针的参数，其他看不出了

我真看不懂

帮你转其他板块

谁能帮帮我啊~~！！！！！！！！！！