看一段VB6程序检查时间的典型代码 (2千字)
* Reference To: MSVBVM60.rtcGetPresentDate, Ord:0222h|
:1100C0F9 FF1584120011 Call dword ptr [11001284]
:1100C0FF 8D435C lea eax, dword ptr [ebx+5C]
:1100C102 6A01 push 00000001
:1100C104 898574FFFFFF mov dword ptr [ebp+FFFFFF74], eax
:1100C10A 8D856CFFFFFF lea eax, dword ptr [ebp+FFFFFF6C]
:1100C110 6A01 push 00000001
:1100C112 8D4D9C lea ecx, dword ptr [ebp-64]
:1100C115 50 push eax
:1100C116 51 push ecx
:1100C117 8D558C lea edx, dword ptr [ebp-74]
:1100C11A 6880480011 push 11004880
:1100C11F 52 push edx
:1100C120 C7856CFFFFFF07400000 mov dword ptr [ebp+FFFFFF6C], 00004007
* Reference To: MSVBVM60.rtcDateDiff, Ord:0296h
|
:1100C12A FF156C100011 Call dword ptr [1100106C]
:1100C130 8D458C lea eax, dword ptr [ebp-74]
:1100C133 50 push eax
* Reference To: MSVBVM60.__vbaI2Var, Ord:0000h
|
:1100C134 FF15B0110011 Call dword ptr [110011B0]
:1100C13A 8D4D8C lea ecx, dword ptr [ebp-74]
:1100C13D 8D559C lea edx, dword ptr [ebp-64]
:1100C140 51 push ecx
:1100C141 52 push edx
:1100C142 6A02 push 00000002
:1100C144 8945D4 mov dword ptr [ebp-2C], eax
* Reference To: MSVBVM60.__vbaFreeVarList, Ord:0000h
|
:1100C147 FF1534100011 Call dword ptr [11001034]
:1100C14D 8B45D4 mov eax, dword ptr [ebp-2C]
:1100C150 83C40C add esp, 0000000C
* Possible StringData Ref from Code Obj ->"YYour Temporary Software License "
->"Key has only "
|
:1100C153 6830530011 push 11005330
:1100C158 50 push eax
* Reference To: MSVBVM60.__vbaStrI2, Ord:0000h
|
:1100C159 FF1508100011 Call dword ptr [11001008]
:1100C15F 8BD0 mov edx, eax
:1100C161 8D4DC0 lea ecx, dword ptr [ebp-40]
:1100C164 FFD6 call esi
:1100C166 50 push eax
:1100C167 FFD7 call edi
:1100C169 8BD0 mov edx, eax
:1100C16B 8D4DBC lea ecx, dword ptr [ebp-44]
:1100C16E FFD6 call esi
:1100C170 50 push eax
* Possible StringData Ref from Code Obj ->" days left."
|
:1100C171 6890530011 push 11005390
:1100C176 FFD7 call edi
