我这样分析！ (3千字)
这是一个vb6 native编译程序。用wdasm反汇编结合vbde辅助定位，知道：自:00410390开始的代码为“添加”按钮_Click事件。
...
:004103D5 33DB xor ebx, ebx //ebx==0
...
...
:00410411 899DF0FEFFFF mov dword ptr [ebp-110], ebx
// 在现代编译器生成的代码中，dword ptr [ebp-110]指的是一局部变量。
// 后文可以知道其实际指的就是list1.listcount
// 此处是使此变量清零。
:00410417 FF92DC030000 call dword ptr [edx+000003DC]
:0041041D 50 push eax
:0041041E 8D45D8 lea eax, dword ptr [ebp-28]
:00410421 50 push eax
* Reference To: MSVBVM60.__vbaObjSet, Ord:0000h
|
:00410422 FF156C104000 Call dword ptr [0040106C]
:00410428 8BF0 mov esi, eax
:0041042A 8D95F0FEFFFF lea edx, dword ptr [ebp-110]
:00410430 52 push edx
// push List1.listcount
:00410431 56 push esi
:00410432 8B0E mov ecx, dword ptr [esi]
:00410434 FF91D8000000 call dword ptr [ecx+000000D8]
// call get list1.listcount
:0041043A 3BC3 cmp eax, ebx
:0041043C DBE2 fclex
:0041043E 7D12 jge 00410452
:00410440 68D8000000 push 000000D8
* Possible StringData Ref from Code Obj ->"O?檉??"
|
:00410445 68C47E4000 push 00407EC4
// 指向UUID{33AD4F11-6699-11CF-B70C-00AA0060D393}，即listbox1
:0041044A 56 push esi
:0041044B 50 push eax
* Reference To: MSVBVM60.__vbaHresultCheckObj, Ord:0000h
|
:0041044C FF1554104000 Call dword ptr [00401054]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041043E(C)
|
:00410452 33C0 xor eax, eax
:00410454 6683BDF0FEFFFF09 cmp word ptr [ebp-110], 0009
// cmp list1.listcount, 09
:0041045C 8D4DD8 lea ecx, dword ptr [ebp-28]
:0041045F 0F9EC0 setle al
// Is less ?
:00410462 F7D8 neg eax
:00410464 668BF0 mov si, ax
// 结果传递给si，比较
* Reference To: MSVBVM60.__vbaFreeObj, Ord:0000h
|
:00410467 FF1594114000 Call dword ptr [00401194]
:0041046D 663BF3 cmp si, bx
:00410470 0F8412050000 je 00410988
所以，我喜欢改:0041042A 8D95F0FEFFFF lea edx, dword ptr [ebp-110]
为:0041042A 8D95F2FEFFFF lea edx, dword ptr [ebp-10E]
...
...
同样，还有一处同样对比，也是同样改法。
:00410563 8D8DF0FEFFFF lea ecx, dword ptr [ebp+FFFFFEF0]
:00410569 51 push ecx
:0041056A 50 push eax
:0041056B 8985ECFEFFFF mov dword ptr [ebp+FFFFFEEC], eax
:00410571 FF92D8000000 call dword ptr [edx+000000D8]
...
:004105AE 6683BDF0FEFFFF09 cmp word ptr [ebp+FFFFFEF0], 0009
:004105B6 0F9EC1 setle cl
:004105B9 F7D9 neg ecx
