Quote:

_Load
  OnError
  RegOpenKeyExA returns Long:2
  *
  *
  *
_Load
¿ÉÒÔ¿´µ½£¬µÚÒ»²½ÊÇ´ò¿ª×¢²á±í£¬²éRegOpenKeyExº¯Êý£¬ÓУº
RegOpenKeyEx(ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long)
ËüÓÐ5¸ö²ÎÊý£¬ÎÒÃÇ¿´¿´ËüÊÇÔÚÄÄÀÔÚSmartCheckÖУ¬Êó±êµã»÷×ó±ßµÄRegOpenKeyExA returns Long:2,ÔÚÓұ߿ÉÒÔ¿´µ½ËüµÄµØÖ·ÊÇ0040C4AC£¬ÎÒÃÇÔÚW32dsmÖвéÕÒÕâ¸öµØÖ·£¬¿´ËüÊÇ´ÓÄÄÀïÌø¹ýÀ´µÄ¡£
Quote£º

* Referenced by a CALL at Address:
|:0040CD88                                                                      £»ÊÇ´ÓÕâÀïÌø¹ýÀ´µÄ
|                                                                               £»0040CD88¾ÍÊÇÎÒÃÇÉÏÃæÄǸöCall
:0040C410 55                      push ebp
:0040C411 8BEC                    mov ebp, esp
:0040C413 83EC14                  sub esp, 00000014

* Possible StringData Ref from Code Obj ->"ÿ%?@"
                                  |
:0040C416 68A6134000              push 004013A6
:0040C41B 64A100000000            mov eax, dword ptr fs:[00000000]
:0040C421 50                      push eax
:0040C422 64892500000000          mov dword ptr fs:[00000000], esp
:0040C429 81ECA0000000            sub esp, 000000A0
:0040C42F 53                      push ebx
:0040C430 56                      push esi
:0040C431 57                      push edi
:0040C432 8965EC                  mov dword ptr [ebp-14], esp
:0040C435 C745F0E8124000          mov [ebp-10], 004012E8
:0040C43C 33F6                    xor esi, esi
:0040C43E 8975F4                  mov dword ptr [ebp-0C], esi                    £»
:0040C441 8975F8                  mov dword ptr [ebp-08], esi
:0040C444 8975E0                  mov dword ptr [ebp-20], esi                 £»Dim bb as string
:0040C447 8975D8                  mov dword ptr [ebp-28], esi                 £»Dim aa as string
:0040C44A 8975D0                  mov dword ptr [ebp-30], esi
:0040C44D 8975CC                  mov dword ptr [ebp-34], esi
:0040C450 8975BC                  mov dword ptr [ebp-44], esi
:0040C453 8975AC                  mov dword ptr [ebp-54], esi
:0040C456 89759C                  mov dword ptr [ebp-64], esi
:0040C459 89758C                  mov dword ptr [ebp-74], esi
:0040C45C 89B57CFFFFFF            mov dword ptr [ebp+FFFFFF7C], esi              £»
:0040C462 89B56CFFFFFF            mov dword ptr [ebp+FFFFFF6C], esi
:0040C468 89B55CFFFFFF            mov dword ptr [ebp+FFFFFF5C], esi
:0040C46E 8B550C                  mov edx, dword ptr [ebp+0C]                 £»Êµ²Î£¬¼´ÉÏÃæµÄArg2
:0040C471 8D4DD8                  lea ecx, dword ptr [ebp-28]

* Reference To: MSVBVM60.__vbaStrCopy, Ord:0000h
                                  |
:0040C474 8B3D04114000            mov edi, dword ptr [00401104]
:0040C47A FFD7                    call edi                                    £»aa=Arg2
:0040C47C 8B5510                  mov edx, dword ptr [ebp+10]                 £»Êµ²Î£¬¼´ÉÏÃæµÄArg3
:0040C47F 8D4DE0                  lea ecx, dword ptr [ebp-20]
:0040C482 FFD7                    call edi                                    £»bb=Arg3
:0040C484 6A01                    push 00000001

* Reference To: MSVBVM60.__vbaOnError, Ord:0000h
                                  |
:0040C486 FF155C104000            Call dword ptr [0040105C]                   £»On Error Resume Next
:0040C48C 68EC214100              push 004121EC                               £»Arg5:phKeyResult
:0040C491 6819000200              push 00020019                               £»Arg4:SamDesired
:0040C496 56                      push esi                                    £»Arg3:ulOptions
:0040C497 8B45D8                  mov eax, dword ptr [ebp-28]
:0040C49A 50                      push eax
:0040C49B 8D4DD0                  lea ecx, dword ptr [ebp-30]
:0040C49E 51                      push ecx

* Reference To: MSVBVM60.__vbaStrToAnsi, Ord:0000h
                                  |
:0040C49F 8B3528114000            mov esi, dword ptr [00401128]
:0040C4A5 FFD6                    call esi
:0040C4A7 50                      push eax                                     £»Arg2:lpSubKey
:0040C4A8 8B5508                  mov edx, dword ptr [ebp+08]
:0040C4AB 52                      push edx                                     £»Arg1:hKey=80000001
:0040C4AC E8D395FFFF              call 00405A84                                £»ÎÒÃÇÀ´µ½ÕâÀïRegOpenKeyEx
--------------------------------------------------------------------------------------------------------------
 ÒÔÉÏÊÇһС¶ÎÄæÏòÐĵã¬ÇëÓÐÐËȤµÄÅóÓѺÍÎÒ¹²Í¬Ì½ÌÖ¡£ÎÒµÄE-mail£ºnnscccn@yahoo.com.cn     

ÉÏÒ»Ò³  [1] [2] [3]