Monday, February 24, 2014

Private sub- VB

Private sub Proc_4_0_408C04
  loc_00408C04: push ebp
  loc_00408C05: mov ebp, esp
  loc_00408C07: sub esp, 0000000Ch
  loc_00408C0A: push 004011B6h ; MSVBVM60.DLL.__vbaExceptHandler
  loc_00408C0F: mov eax, fs:[00h]
  loc_00408C15: push eax
  loc_00408C16: mov fs:[00000000h], esp
  loc_00408C1D: push 00000028h
  loc_00408C1F: pop eax
  loc_00408C20: call 004011B0h ; MSVBVM60.DLL.__vbaChkstk
  loc_00408C25: push ebx
  loc_00408C26: push esi
  loc_00408C27: push edi
  loc_00408C28: mov var_C, esp
  loc_00408C2B: mov var_8, 00401100h
  loc_00408C32: mov eax, arg_8
  loc_00408C35: and eax, 00000001h
  loc_00408C38: mov var_4, eax
  loc_00408C3B: mov eax, arg_8
  loc_00408C3E: and al, FEh
  loc_00408C40: mov arg_8, eax
  loc_00408C43: mov eax, arg_8
  loc_00408C46: mov eax, [eax]
  loc_00408C48: push arg_8
  loc_00408C4B: call [eax+04h]
  loc_00408C4E: push 00000000h
  loc_00408C50: push FFFFFFFFh
  loc_00408C52: push 00000001h
  loc_00408C54: push 00402860h
  loc_00408C59: push 00402858h
  loc_00408C5E: push 00402850h
  loc_00408C63: call 00401288h ; Replace(arg_1, arg_2, arg_3, arg_4, arg_5, arg_6)
  loc_00408C68: mov edx, eax
  loc_00408C6A: lea ecx, var_20
  loc_00408C6D: call 0040128Eh ; MSVBVM60.DLL.__vbaStrMove
  loc_00408C72: mov var_18, 00000001h
  loc_00408C79: push 00000001h
  loc_00408C7B: push 00402868h ; "DLILX"
  loc_00408C80: call 00401282h ; Right$(arg_1, arg_2)
  loc_00408C85: mov edx, eax
  loc_00408C87: lea ecx, var_1C
  loc_00408C8A: call 0040128Eh ; MSVBVM60.DLL.__vbaStrMove
  loc_00408C8F: cmp [00411024h], 00000000h
  loc_00408C96: jnz 408CB0h
  loc_00408C98: push 00411024h
  loc_00408C9D: push 004019D8h
  loc_00408CA2: call 0040127Ch ; MSVBVM60.DLL.__vbaNew2
  loc_00408CA7: mov var_38, 00411024h
  loc_00408CAE: jmp 408CB7h
  loc_00408CB0: mov var_38, 00411024h
  loc_00408CB7: mov eax, var_38
  loc_00408CBA: mov eax, [eax]
  loc_00408CBC: mov var_28, eax
  loc_00408CBF: push 00402878h ; "Medallary"
  loc_00408CC4: push 00402890h ; "Pellard"
  loc_00408CC9: call 00401276h ; &
  loc_00408CCE: mov edx, eax
  loc_00408CD0: lea ecx, var_24
  loc_00408CD3: call 0040128Eh ; MSVBVM60.DLL.__vbaStrMove
  loc_00408CD8: push eax
  loc_00408CD9: mov eax, var_28
  loc_00408CDC: mov eax, [eax]
  loc_00408CDE: push var_28
  loc_00408CE1: call [eax+54h]
  loc_00408CE4: fclex
  loc_00408CE6: mov var_2C, eax
  loc_00408CE9: cmp var_2C, 00000000h
  loc_00408CED: jnl 408D06h
  loc_00408CEF: push 00000054h
  loc_00408CF1: push 004027E4h
  loc_00408CF6: push var_28
  loc_00408CF9: push var_2C
  loc_00408CFC: call 00401270h ; MSVBVM60.DLL.__vbaHresultCheckObj
  loc_00408D01: mov var_3C, eax
  loc_00408D04: jmp 408D0Ah
  loc_00408D06: and var_3C, 00000000h
  loc_00408D0A: lea ecx, var_24
  loc_00408D0D: call 0040126Ah ; MSVBVM60.DLL.__vbaFreeStr
  loc_00408D12: mov var_4, 00000000h
  loc_00408D19: push 00408D3Ah
  loc_00408D1E: jmp 408D29h
  loc_00408D20: lea ecx, var_24
  loc_00408D23: call 0040126Ah ; MSVBVM60.DLL.__vbaFreeStr
  loc_00408D28: ret
End Sub

No comments:

Operating system - Part 1:

 In our blog, we published several articles on OS concepts which mostly on the perspective for malware analysis/security research. In few in...