About vbprogram cracking (5 thousand words)

Many people say that the tool used to crack the vbprogram is SmartCheck. I don't agree, because I always thought that as long as there is a debugger, all the attacks can be completed. of course, this is not necessarily the easiest, but it is undoubtedly the most effective.
This time I will talk about the vbprogram cracking. Of course, I don't know if there are any other feasible methods. I only know that a cracking can be completed through the debugger.

Example program: Write the VB Code at will and compile it as the local Code (P-Code is not covered in the scope of this article, and I also found some relevant rules, which are still under study)
Private Sub Form_Load ()
If ax = 0 Then
MsgBox ("hi! ")
End
Else
MsgBox ("OK! ")
End
End If
End Sub

Load with TR
0187: 00401166 FF2570104000 jmp near [00401070] // from 00401171 to here.
0187: 0040450c 68A0124000 push dword 004012A0 // stop here after loading
0187: 00401171 E8F0FFFFFF CALL 'msvbvm60! Thunrtmain' // This Call must be entered
0187: 00401176 0000 ADD [EAX], AL
0187: 00401178 0000 ADD [EAX], AL
0187: 0040117A 0000 ADD [EAX], AL
......
MSVBVM60! ThunRTMain
0187: 6600DE22 55 PUSH EBP
0187: 6600DE23 8BEC mov ebp, ESP
0187: 6600DE25 6AFF push byte-01
0187: 6600DE27 6898980166 push dword 66019898
0187: 6600DE2C 6871EF0E66 push dword 660EEF71
0187: 6600DE31 64a00000000 mov eax, [FS: 00]
0187: 6600DE37 50 PUSH EAX
0187: 6600DE38 64892500000000 MOV [FS: 00], ESP
0187: 6600DE3F 51 PUSH ECX
0187: 6600DE40 51 PUSH ECX
0187: 6600DE41 83EC4C sub esp, BYTE + 4C
0187: 6600DE44 53 PUSH EBX
0187: 6600DE45 56 PUSH ESI
0187: 6600DE46 57 PUSH EDI
0187: 6600DE47 8965E8 MOV [EBP-18], ESP
0187: 6600DE4A 8B7508 mov esi, [EBP + 08]
0187: 6600DE4D 8935DCF71066 MOV [6610F7DC], ESI
0187: 6600DE53 8365FC00 and dword [EBP-04], BYTE + 00
0187: 6600DE57 8D45A0 lea eax, [EBP-60]
0187: 6600DE5A 50 PUSH EAX
0187: 6600DE5B FF1518110066 CALL 'kernel32! Getstartupinfoa'
0187: 6600DE61 0FB745D0 movzx eax, WORD [EBP-30]
0187: 6600DE65 A3D8F71066 MOV [6610F7D8], EAX
0187: 6600DE6A FF35CCF61066 push dword [6610F6CC]
0187: 6600DE70 56 PUSH ESI
0187: 6600DE71 be70f000066 mov esi, 6610F470
0187: 6600DE76 8BCE mov ecx, ESI
0187: 6600DE78 E860000000 CALL 6600 DEDD // This Call must be included.
... (In fact, it is not difficult to look at the DLL transfer. It will soon be able to return to the program's airspace. My goal is to enter the program's airspace before the program is running)
0187: ********* FFD0 call eax // The last time is here, OK, return to the program's airspace!
......
0187: 0040146C 816C240433000000 sub dword [ESP + 04], 33 // stop here. It is already a procedural airspace!
0187: 00401474 E9B7040000 JMP 00401930 // Where can I jump!
0187: 00401479 0000 ADD [EAX], AL
......
0187: 00401930 55 push ebp // What does it look like? Is it the same as assembly, where the delphi program starts? We finally came to the place where the vbprogram really started.
0187: 00401931 8BEC mov ebp, ESP
0187: 00401933 83EC0C sub esp, BYTE + 0C
0187: 00401936 68A6104000 push dword 004010A6
0187: 0040193B 64a00000000 mov eax, [FS: 00]
......
0187: 00401991 C7458C02800000 mov dword [EBP-74], 8002
0187: 00401998 FF1538104000 CALL 'msvbvm60! _ VbaVarTstEq'
0187: 0040199E 6685C0 test ax, AX
0187: 004019A1 B904000280 mov ecx, 80020004
0187: 004019A6 B80A000000 mov eax, 0A
0187: 004019AB 894DA4 MOV [EBP-5C], ECX
0187: 004019AE 89459C MOV [EBP-64], EAX
0187: 004019B1 894DB4 MOV [EBP-4C], ECX
0187: 004019B4 8945AC & n