VB Function Analysis

Source: Internet
Author: User

VB Function conventions are too messy and there is no uniformity. I have analyzed several functions myself: Some use eax and EDX conventions, some use single ECx conventions, some use stacks and registers together, and some use them like stdcall conventions, sometimes it will be referenced by the internal component of the virtual machine.
The function analysis is provided first. When analyzing the Assembly below, you can see these functions. They are not very complete and have errors. They are for your reference only. You can add them together.
-----------------------------------------------------------------
Msvbvm60. _ vbaobjset is similar to msvbvm60. _ vbanew2, which is used to assign values or instantiate objects.
Similar to stdcall
Push eax -----> Class Object template address
Lea eax, [ebp-1C]
Push eax --------> to set the pointer of the referenced object to eax
Call 401048 ---> msvbvm60. _ vbaobjset
--------------------------------------------------
Before each event is triggered, call msvbvm60.zombie _ addref to count
COM Component Object referenced by the event. Agreed eax, ECx
MoV eax, ESI
And eax, 1
MoV [ebp-4], eax
And ESI, fffffffe ------> the addressing is exactly the virtual table pointer of the object.
Push ESI ------> Save the object virtual table pointer ESI
MoV [EBP + 8], ESI ----> ESI is saved by local variables [EBP + 8]
MoV ECx, [esi] -----> virtual table address of the object to ECx
Call [ECx + 4] ---------> msvbvm60.zombie _ addref
--------------------------------------------------
Call msvbvm60.zombie _ release after each event ends.
Release the COM Component Object referenced by the event, and agree to eax.
Msvbvm60.zombie _ release object Convention parameter register: eax
MoV eax, [EBP + 8]
Push eax ----------- object address eax
MoV edX, [eax] -----> virtual table address of the object to edX
Call [edX + 8] -----> msvbvm60.zombie _ release
-------------------------------------------------------------------

Msvbvm60. _ vbafreeobj release object Convention Register: ECx
Lea ECx, [ebp-24] ---> Object Reference pointer ECx
Call [401140] ---> msvbvm60. _ vbafreeobj
--------------------------------------------------
Msvbvm60. _ vbachkstk adjustment Stack pointer Convention Register: eax
MoV eax, 10
Call 004016c0 ----> msvbvm60. _ vbachkstk ---> when this function returns, the ESP + 10
---------------------------------------------------
Msvbvm60. _ vbanew2 is similar to C ++/Java's new function.
Push 0043e120 ---> object address
Push 004031a4 ----------> class template address
Call 4010e0 ---> msvbvm60. _ vbanew2
----------------------------------------------------
Msvbvm60. _ vbastrmove is a register convention between EDX and ECx.
MoV edX, eax ----> Unicode string Source Address: edX
Lea ECx, [ebp-24] ----> Unicode string Destination Address: ECx
Call 401120 ----> msvbvm60. _ vbastrmove
-----------------------------------------------------
Msvbvm60. _ vbastrcat is the stdcall Convention
Push edX -----> connect to the destination Unicode string
Push 00404230 ----> Unicode String constant
Call 401034 ----> msvbvm60. _ vbastrcat
-----------------------------------------------------
Msvbvm60. _ vbafreestr Convention Register: ECx
Lea ECx, [ebp-24] ---> ECx passed string reference
Call 40113c ----> msvbvm60. _ vbafreestr
-----------------------------------------------------
Msvbvm60. _ vbafreestrlist is a variable parameter cdcall Convention
Lea eax, [ebp-28] ---> Unicode string reference address eax
Push eax
Lea ECx, [ebp-24] ----> Unicode string reference address ECx
Push ECx
Push 2 -------> Release 2 Unicode strings
Call 4010f0 ---> msvbvm60. _ vbafreestrlist
Add ESP, 0c
-----------------------------------------------------
Msvbvm60. _ vbafileopen is a cdcall convention.
Push eax ----> Unicode file string name
Push 1
Push-1
Push 1
Call 4010f0 -----> msvbvm60. _ vbafileopen
Add ESP, 0c
----------------------------------------------------

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.