BonziBuddy Leaked Source Code by NixButterPlay
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1450 lines
45 KiB

  1. VERSION 5.00
  2. Begin VB.Form frmNBAbout
  3. Caption = "About MyApp"
  4. ScaleMode = 0
  5. AutoRedraw = False
  6. FontTransparent = True
  7. BorderStyle = 3 'Fixed Dialog
  8. Icon = "frmNBAbout.frx":0000
  9. LinkTopic = "Form2"
  10. MaxButton = 0 'False
  11. MinButton = 0 'False
  12. ClipControls = 0 'False
  13. ClientLeft = 2340
  14. ClientTop = 1935
  15. ClientWidth = 5730
  16. ClientHeight = 4725
  17. ScaleLeft = 0
  18. ScaleTop = 0
  19. ScaleWidth = 5380.766
  20. ScaleHeight = 3261.279
  21. LockControls = -1 'True
  22. ShowInTaskbar = 0 'False
  23. StartUpPosition = 2 'CenterScreen
  24. Begin VB.Frame Frame1
  25. Caption = "Licensed to:"
  26. Left = 300
  27. Top = 3540
  28. Width = 3735
  29. Height = 795
  30. TabIndex = 6
  31. Begin VB.Label Label1
  32. Caption = "Registration Number: 5324698"
  33. Left = 120
  34. Top = 480
  35. Width = 3435
  36. Height = 195
  37. TabIndex = 8
  38. Alignment = 2 'Center
  39. End
  40. Begin VB.Label lblRegName
  41. Caption = "RegName"
  42. Left = 120
  43. Top = 240
  44. Width = 3435
  45. Height = 195
  46. TabIndex = 7
  47. Alignment = 2 'Center
  48. End
  49. End
  50. Begin VB.CommandButton cmdOK
  51. Caption = "OK"
  52. Left = 4245
  53. Top = 3585
  54. Width = 1260
  55. Height = 345
  56. TabIndex = 0
  57. Default = -1 'True
  58. Cancel = -1 'True
  59. End
  60. Begin VB.CommandButton cmdSysInfo
  61. Caption = "&System Info..."
  62. Left = 4260
  63. Top = 4035
  64. Width = 1245
  65. Height = 345
  66. TabIndex = 1
  67. End
  68. Begin VB.Label lblBuild
  69. Caption = "Build 3"
  70. Left = 3660
  71. Top = 1620
  72. Width = 1275
  73. Height = 225
  74. TabIndex = 9
  75. End
  76. Begin VB.Image Image1
  77. Picture = "frmNBAbout.frx":0442
  78. Left = 135
  79. Top = 60
  80. Width = 5475
  81. Height = 975
  82. End
  83. Begin VB.Line Line1
  84. Index = 1
  85. BorderColor = &H808080&
  86. X1 = 90
  87. Y1 = 3405
  88. X2 = 5654
  89. Y2 = 3405
  90. BorderStyle = 6 'Inside Solid
  91. End
  92. Begin VB.Label lblDescription
  93. Caption = "App Description"
  94. ForeColor = &H0&
  95. Left = 1050
  96. Top = 2085
  97. Width = 3885
  98. Height = 1170
  99. TabIndex = 2
  100. End
  101. Begin VB.Label lblTitle
  102. Caption = "Application Title"
  103. ForeColor = &H0&
  104. Left = 1050
  105. Top = 1200
  106. Width = 3885
  107. Height = 240
  108. TabIndex = 4
  109. End
  110. Begin VB.Line Line1
  111. Index = 0
  112. BorderColor = &HFFFFFF&
  113. X1 = 105
  114. Y1 = 3420
  115. X2 = 5654
  116. Y2 = 3420
  117. BorderWidth = 2
  118. End
  119. Begin VB.Label lblVersion
  120. Caption = "Version"
  121. Left = 1050
  122. Top = 1620
  123. Width = 2505
  124. Height = 225
  125. TabIndex = 5
  126. End
  127. Begin VB.Label lblDisclaimer
  128. Caption = "Copyright 1999, BONZI.COM Software. All rights reserved."
  129. ForeColor = &H0&
  130. Left = 1395
  131. Top = 4470
  132. Width = 4110
  133. Height = 195
  134. TabIndex = 3
  135. Alignment = 1 'Right Justify
  136. AutoSize = -1 'True
  137. End
  138. End
  139. Attribute VB_Name = "frmNBAbout"
  140. Private Sub cmdOK_Click() '6CE000
  141. loc_006CE000: push ebp
  142. loc_006CE001: mov ebp, esp
  143. loc_006CE003: sub esp, 0000000Ch
  144. loc_006CE006: push 00412856h ; __vbaExceptHandler
  145. loc_006CE00B: mov eax, fs:[00000000h]
  146. loc_006CE011: push eax
  147. loc_006CE012: mov fs:[00000000h], esp
  148. loc_006CE019: sub esp, 00000018h
  149. loc_006CE01C: push ebx
  150. loc_006CE01D: push esi
  151. loc_006CE01E: push edi
  152. loc_006CE01F: mov var_C, esp
  153. loc_006CE022: mov var_8, 0040D5F0h
  154. loc_006CE029: mov edi, Me
  155. loc_006CE02C: mov eax, edi
  156. loc_006CE02E: and eax, 00000001h
  157. loc_006CE031: mov var_4, eax
  158. loc_006CE034: and edi, FFFFFFFEh
  159. loc_006CE037: push edi
  160. loc_006CE038: mov Me, edi
  161. loc_006CE03B: mov ecx, [edi]
  162. loc_006CE03D: call [ecx+00000004h]
  163. loc_006CE040: mov eax, [0073C818h]
  164. loc_006CE045: xor ebx, ebx
  165. loc_006CE047: cmp eax, ebx
  166. loc_006CE049: mov var_18, ebx
  167. loc_006CE04C: jnz 006CE05Eh
  168. loc_006CE04E: push 0073C818h
  169. loc_006CE053: push 00441F00h
  170. loc_006CE058: call [004012FCh] ; __vbaNew2
  171. loc_006CE05E: mov esi, [0073C818h]
  172. loc_006CE064: lea eax, var_18
  173. loc_006CE067: push edi
  174. loc_006CE068: push eax
  175. loc_006CE069: mov edx, [esi]
  176. loc_006CE06B: mov var_2C, edx
  177. loc_006CE06E: call [00401130h] ; __vbaObjSetAddref
  178. loc_006CE074: mov ecx, var_2C
  179. loc_006CE077: push eax
  180. loc_006CE078: push esi
  181. loc_006CE079: call [ecx+00000010h]
  182. loc_006CE07C: cmp eax, ebx
  183. loc_006CE07E: fnclex
  184. loc_006CE080: jge 006CE091h
  185. loc_006CE082: push 00000010h
  186. loc_006CE084: push 00441EF0h
  187. loc_006CE089: push esi
  188. loc_006CE08A: push eax
  189. loc_006CE08B: call [004010CCh] ; __vbaHresultCheckObj
  190. loc_006CE091: lea ecx, var_18
  191. loc_006CE094: call [0040142Ch] ; __vbaFreeObj
  192. loc_006CE09A: mov var_4, ebx
  193. loc_006CE09D: push 006CE0AFh
  194. loc_006CE0A2: jmp 006CE0AEh
  195. loc_006CE0A4: lea ecx, var_18
  196. loc_006CE0A7: call [0040142Ch] ; __vbaFreeObj
  197. loc_006CE0AD: ret
  198. loc_006CE0AE: ret
  199. loc_006CE0AF: mov eax, Me
  200. loc_006CE0B2: push eax
  201. loc_006CE0B3: mov edx, [eax]
  202. loc_006CE0B5: call [edx+00000008h]
  203. loc_006CE0B8: mov eax, var_4
  204. loc_006CE0BB: mov ecx, var_14
  205. loc_006CE0BE: pop edi
  206. loc_006CE0BF: pop esi
  207. loc_006CE0C0: mov fs:[00000000h], ecx
  208. loc_006CE0C7: pop ebx
  209. loc_006CE0C8: mov esp, ebp
  210. loc_006CE0CA: pop ebp
  211. loc_006CE0CB: retn 0004h
  212. End Sub
  213. Private Sub Form_Load() '6CE0D0
  214. loc_006CE0D0: push ebp
  215. loc_006CE0D1: mov ebp, esp
  216. loc_006CE0D3: sub esp, 0000000Ch
  217. loc_006CE0D6: push 00412856h ; __vbaExceptHandler
  218. loc_006CE0DB: mov eax, fs:[00000000h]
  219. loc_006CE0E1: push eax
  220. loc_006CE0E2: mov fs:[00000000h], esp
  221. loc_006CE0E9: sub esp, 000000B0h
  222. loc_006CE0EF: push ebx
  223. loc_006CE0F0: push esi
  224. loc_006CE0F1: push edi
  225. loc_006CE0F2: mov var_C, esp
  226. loc_006CE0F5: mov var_8, 0040D600h
  227. loc_006CE0FC: mov ebx, Me
  228. loc_006CE0FF: mov eax, ebx
  229. loc_006CE101: and eax, 00000001h
  230. loc_006CE104: mov var_4, eax
  231. loc_006CE107: and ebx, FFFFFFFEh
  232. loc_006CE10A: push ebx
  233. loc_006CE10B: mov Me, ebx
  234. loc_006CE10E: mov ecx, [ebx]
  235. loc_006CE110: call [ecx+00000004h]
  236. loc_006CE113: lea edx, var_2C
  237. loc_006CE116: xor esi, esi
  238. loc_006CE118: push edx
  239. loc_006CE119: push 000000FAh
  240. loc_006CE11E: mov var_24, esi
  241. loc_006CE121: mov var_28, esi
  242. loc_006CE124: mov var_30, esi
  243. loc_006CE127: mov var_34, esi
  244. loc_006CE12A: mov var_38, esi
  245. loc_006CE12D: mov var_3C, esi
  246. loc_006CE130: mov var_40, esi
  247. loc_006CE133: mov var_44, esi
  248. loc_006CE136: mov var_48, esi
  249. loc_006CE139: mov var_4C, esi
  250. loc_006CE13C: mov var_50, esi
  251. loc_006CE13F: mov var_54, esi
  252. loc_006CE142: mov var_58, esi
  253. loc_006CE145: mov var_5C, esi
  254. loc_006CE148: mov var_6C, esi
  255. loc_006CE14B: mov var_70, esi
  256. loc_006CE14E: mov var_74, esi
  257. loc_006CE151: mov var_78, esi
  258. loc_006CE154: call [00401210h] ; __vbaFixstrConstruct
  259. loc_006CE15A: mov eax, var_2C
  260. loc_006CE15D: mov edi, [00401370h] ; __vbaStrToAnsi
  261. loc_006CE163: push 000000F9h
  262. loc_006CE168: lea ecx, var_3C
  263. loc_006CE16B: push eax
  264. loc_006CE16C: push ecx
  265. loc_006CE16D: call edi
  266. loc_006CE16F: push eax
  267. loc_006CE170: lea edx, var_38
  268. loc_006CE173: push 0043C9F4h
  269. loc_006CE178: push edx
  270. loc_006CE179: call edi
  271. loc_006CE17B: push eax
  272. loc_006CE17C: lea eax, var_34
  273. loc_006CE17F: push 0046857Ch ; "RegName"
  274. loc_006CE184: push eax
  275. loc_006CE185: call edi
  276. loc_006CE187: push eax
  277. loc_006CE188: lea ecx, var_30
  278. loc_006CE18B: push 00468378h ; "NetBOOST"
  279. loc_006CE190: push ecx
  280. loc_006CE191: call edi
  281. loc_006CE193: push eax
  282. loc_006CE194: GetProfileString(%x1v, %x2v, %x3v, %x4v, %x5v)
  283. loc_006CE199: mov edi, eax
  284. loc_006CE19B: call [004010BCh] ; __vbaSetSystemError
  285. loc_006CE1A1: mov edx, var_3C
  286. loc_006CE1A4: lea eax, var_40
  287. loc_006CE1A7: push edx
  288. loc_006CE1A8: push eax
  289. loc_006CE1A9: call [00401260h] ; __vbaStrToUnicode
  290. loc_006CE1AF: mov ecx, var_2C
  291. loc_006CE1B2: push eax
  292. loc_006CE1B3: push ecx
  293. loc_006CE1B4: push esi
  294. loc_006CE1B5: call [004010A4h] ; __vbaLsetFixstr
  295. loc_006CE1BB: lea edx, var_6C
  296. loc_006CE1BE: lea ecx, var_24
  297. loc_006CE1C1: mov var_64, edi
  298. loc_006CE1C4: mov var_6C, 00000003h
  299. loc_006CE1CB: call [00401020h] ; __vbaVarMove
  300. loc_006CE1D1: lea edx, var_40
  301. loc_006CE1D4: lea eax, var_3C
  302. loc_006CE1D7: push edx
  303. loc_006CE1D8: lea ecx, var_38
  304. loc_006CE1DB: push eax
  305. loc_006CE1DC: lea edx, var_34
  306. loc_006CE1DF: push ecx
  307. loc_006CE1E0: lea eax, var_30
  308. loc_006CE1E3: push edx
  309. loc_006CE1E4: push eax
  310. loc_006CE1E5: push 00000005h
  311. loc_006CE1E7: call [00401324h] ; __vbaFreeStrList
  312. loc_006CE1ED: mov ecx, var_2C
  313. loc_006CE1F0: add esp, 00000018h
  314. loc_006CE1F3: push 00000001h
  315. loc_006CE1F5: push ecx
  316. loc_006CE1F6: push esi
  317. loc_006CE1F7: call [004012C8h] ; rtcBstrFromAnsi
  318. loc_006CE1FD: mov edi, [004013C0h] ; __vbaStrMove
  319. loc_006CE203: mov edx, eax
  320. loc_006CE205: lea ecx, var_30
  321. loc_006CE208: call edi
  322. loc_006CE20A: push eax
  323. loc_006CE20B: push esi
  324. loc_006CE20C: call [004012ECh] ; __vbaInStr
  325. loc_006CE212: mov edx, var_2C
  326. loc_006CE215: sub eax, 00000001h
  327. loc_006CE218: jo 006CE7B8h
  328. loc_006CE21E: push eax
  329. loc_006CE21F: lea ecx, var_34
  330. loc_006CE222: call [00401310h] ; __vbaStrCopy
  331. loc_006CE228: push eax
  332. loc_006CE229: call [00401394h] ; rtcLeftCharBstr
  333. loc_006CE22F: mov edx, eax
  334. loc_006CE231: lea ecx, var_38
  335. loc_006CE234: call edi
  336. loc_006CE236: mov edx, var_34
  337. loc_006CE239: mov eax, var_2C
  338. loc_006CE23C: push edx
  339. loc_006CE23D: push eax
  340. loc_006CE23E: push esi
  341. loc_006CE23F: call [004010A4h] ; __vbaLsetFixstr
  342. loc_006CE245: mov edx, var_38
  343. loc_006CE248: lea ecx, var_28
  344. loc_006CE24B: mov var_38, esi
  345. loc_006CE24E: call edi
  346. loc_006CE250: lea ecx, var_34
  347. loc_006CE253: lea edx, var_30
  348. loc_006CE256: push ecx
  349. loc_006CE257: push edx
  350. loc_006CE258: push 00000002h
  351. loc_006CE25A: call [00401324h] ; __vbaFreeStrList
  352. loc_006CE260: mov eax, [ebx]
  353. loc_006CE262: add esp, 0000000Ch
  354. loc_006CE265: push ebx
  355. loc_006CE266: call [eax+00000304h]
  356. loc_006CE26C: lea ecx, var_50
  357. loc_006CE26F: push eax
  358. loc_006CE270: push ecx
  359. loc_006CE271: call [00401128h] ; __vbaObjSet
  360. loc_006CE277: mov edi, eax
  361. loc_006CE279: mov eax, var_28
  362. loc_006CE27C: push eax
  363. loc_006CE27D: push edi
  364. loc_006CE27E: mov edx, [edi]
  365. loc_006CE280: call [edx+00000054h]
  366. loc_006CE283: cmp eax, esi
  367. loc_006CE285: fnclex
  368. loc_006CE287: jge 006CE298h
  369. loc_006CE289: push 00000054h
  370. loc_006CE28B: push 00441988h
  371. loc_006CE290: push edi
  372. loc_006CE291: push eax
  373. loc_006CE292: call [004010CCh] ; __vbaHresultCheckObj
  374. loc_006CE298: lea ecx, var_50
  375. loc_006CE29B: call [0040142Ch] ; __vbaFreeObj
  376. loc_006CE2A1: cmp [0073C818h], esi
  377. loc_006CE2A7: jnz 006CE2B9h
  378. loc_006CE2A9: push 0073C818h
  379. loc_006CE2AE: push 00441F00h
  380. loc_006CE2B3: call [004012FCh] ; __vbaNew2
  381. loc_006CE2B9: mov edi, [0073C818h]
  382. loc_006CE2BF: lea edx, var_50
  383. loc_006CE2C2: push edx
  384. loc_006CE2C3: push edi
  385. loc_006CE2C4: mov ecx, [edi]
  386. loc_006CE2C6: call [ecx+00000014h]
  387. loc_006CE2C9: cmp eax, esi
  388. loc_006CE2CB: fnclex
  389. loc_006CE2CD: jge 006CE2DEh
  390. loc_006CE2CF: push 00000014h
  391. loc_006CE2D1: push 00441EF0h
  392. loc_006CE2D6: push edi
  393. loc_006CE2D7: push eax
  394. loc_006CE2D8: call [004010CCh] ; __vbaHresultCheckObj
  395. loc_006CE2DE: mov eax, var_50
  396. loc_006CE2E1: lea edx, var_30
  397. loc_006CE2E4: push edx
  398. loc_006CE2E5: push eax
  399. loc_006CE2E6: mov ecx, [eax]
  400. loc_006CE2E8: mov edi, eax
  401. loc_006CE2EA: call [ecx+00000060h]
  402. loc_006CE2ED: cmp eax, esi
  403. loc_006CE2EF: fnclex
  404. loc_006CE2F1: jge 006CE302h
  405. loc_006CE2F3: push 00000060h
  406. loc_006CE2F5: push 004437B4h
  407. loc_006CE2FA: push edi
  408. loc_006CE2FB: push eax
  409. loc_006CE2FC: call [004010CCh] ; __vbaHresultCheckObj
  410. loc_006CE302: mov eax, var_30
  411. loc_006CE305: mov edi, [ebx]
  412. loc_006CE307: push 0046E52Ch ; "About "
  413. loc_006CE30C: push eax
  414. loc_006CE30D: call [00401098h] ; __vbaStrCat
  415. loc_006CE313: mov edx, eax
  416. loc_006CE315: lea ecx, var_34
  417. loc_006CE318: call [004013C0h] ; __vbaStrMove
  418. loc_006CE31E: push eax
  419. loc_006CE31F: push ebx
  420. loc_006CE320: call [edi+00000054h]
  421. loc_006CE323: cmp eax, esi
  422. loc_006CE325: fnclex
  423. loc_006CE327: jge 006CE338h
  424. loc_006CE329: push 00000054h
  425. loc_006CE32B: push 004566B0h
  426. loc_006CE330: push ebx
  427. loc_006CE331: push eax
  428. loc_006CE332: call [004010CCh] ; __vbaHresultCheckObj
  429. loc_006CE338: lea ecx, var_34
  430. loc_006CE33B: lea edx, var_30
  431. loc_006CE33E: push ecx
  432. loc_006CE33F: push edx
  433. loc_006CE340: push 00000002h
  434. loc_006CE342: call [00401324h] ; __vbaFreeStrList
  435. loc_006CE348: add esp, 0000000Ch
  436. loc_006CE34B: lea ecx, var_50
  437. loc_006CE34E: call [0040142Ch] ; __vbaFreeObj
  438. loc_006CE354: mov eax, [ebx]
  439. loc_006CE356: push ebx
  440. loc_006CE357: call [eax+00000324h]
  441. loc_006CE35D: lea ecx, var_5C
  442. loc_006CE360: push eax
  443. loc_006CE361: push ecx
  444. loc_006CE362: call [00401128h] ; __vbaObjSet
  445. loc_006CE368: mov var_B0, eax
  446. loc_006CE36E: mov eax, [0073C818h]
  447. loc_006CE373: cmp eax, esi
  448. loc_006CE375: jnz 006CE387h
  449. loc_006CE377: push 0073C818h
  450. loc_006CE37C: push 00441F00h
  451. loc_006CE381: call [004012FCh] ; __vbaNew2
  452. loc_006CE387: mov edi, [0073C818h]
  453. loc_006CE38D: lea eax, var_50
  454. loc_006CE390: push eax
  455. loc_006CE391: push edi
  456. loc_006CE392: mov edx, [edi]
  457. loc_006CE394: call [edx+00000014h]
  458. loc_006CE397: cmp eax, esi
  459. loc_006CE399: fnclex
  460. loc_006CE39B: jge 006CE3ACh
  461. loc_006CE39D: push 00000014h
  462. loc_006CE39F: push 00441EF0h
  463. loc_006CE3A4: push edi
  464. loc_006CE3A5: push eax
  465. loc_006CE3A6: call [004010CCh] ; __vbaHresultCheckObj
  466. loc_006CE3AC: mov eax, var_50
  467. loc_006CE3AF: lea edx, var_70
  468. loc_006CE3B2: push edx
  469. loc_006CE3B3: push eax
  470. loc_006CE3B4: mov ecx, [eax]
  471. loc_006CE3B6: mov edi, eax
  472. loc_006CE3B8: call [ecx+000000B8h]
  473. loc_006CE3BE: cmp eax, esi
  474. loc_006CE3C0: fnclex
  475. loc_006CE3C2: jge 006CE3D6h
  476. loc_006CE3C4: push 000000B8h
  477. loc_006CE3C9: push 004437B4h
  478. loc_006CE3CE: push edi
  479. loc_006CE3CF: push eax
  480. loc_006CE3D0: call [004010CCh] ; __vbaHresultCheckObj
  481. loc_006CE3D6: cmp [0073C818h], esi
  482. loc_006CE3DC: jnz 006CE3EEh
  483. loc_006CE3DE: push 0073C818h
  484. loc_006CE3E3: push 00441F00h
  485. loc_006CE3E8: call [004012FCh] ; __vbaNew2
  486. loc_006CE3EE: mov edi, [0073C818h]
  487. loc_006CE3F4: lea ecx, var_54
  488. loc_006CE3F7: push ecx
  489. loc_006CE3F8: push edi
  490. loc_006CE3F9: mov eax, [edi]
  491. loc_006CE3FB: call [eax+00000014h]
  492. loc_006CE3FE: cmp eax, esi
  493. loc_006CE400: fnclex
  494. loc_006CE402: jge 006CE413h
  495. loc_006CE404: push 00000014h
  496. loc_006CE406: push 00441EF0h
  497. loc_006CE40B: push edi
  498. loc_006CE40C: push eax
  499. loc_006CE40D: call [004010CCh] ; __vbaHresultCheckObj
  500. loc_006CE413: mov eax, var_54
  501. loc_006CE416: lea ecx, var_74
  502. loc_006CE419: push ecx
  503. loc_006CE41A: push eax
  504. loc_006CE41B: mov edx, [eax]
  505. loc_006CE41D: mov edi, eax
  506. loc_006CE41F: call [edx+000000C0h]
  507. loc_006CE425: cmp eax, esi
  508. loc_006CE427: fnclex
  509. loc_006CE429: jge 006CE43Dh
  510. loc_006CE42B: push 000000C0h
  511. loc_006CE430: push 004437B4h
  512. loc_006CE435: push edi
  513. loc_006CE436: push eax
  514. loc_006CE437: call [004010CCh] ; __vbaHresultCheckObj
  515. loc_006CE43D: cmp [0073C818h], esi
  516. loc_006CE443: jnz 006CE455h
  517. loc_006CE445: push 0073C818h
  518. loc_006CE44A: push 00441F00h
  519. loc_006CE44F: call [004012FCh] ; __vbaNew2
  520. loc_006CE455: mov edi, [0073C818h]
  521. loc_006CE45B: lea eax, var_58
  522. loc_006CE45E: push eax
  523. loc_006CE45F: push edi
  524. loc_006CE460: mov edx, [edi]
  525. loc_006CE462: call [edx+00000014h]
  526. loc_006CE465: cmp eax, esi
  527. loc_006CE467: fnclex
  528. loc_006CE469: jge 006CE47Ah
  529. loc_006CE46B: push 00000014h
  530. loc_006CE46D: push 00441EF0h
  531. loc_006CE472: push edi
  532. loc_006CE473: push eax
  533. loc_006CE474: call [004010CCh] ; __vbaHresultCheckObj
  534. loc_006CE47A: mov eax, var_58
  535. loc_006CE47D: lea edx, var_78
  536. loc_006CE480: push edx
  537. loc_006CE481: push eax
  538. loc_006CE482: mov ecx, [eax]
  539. loc_006CE484: mov edi, eax
  540. loc_006CE486: call [ecx+000000C8h]
  541. loc_006CE48C: cmp eax, esi
  542. loc_006CE48E: fnclex
  543. loc_006CE490: jge 006CE4A4h
  544. loc_006CE492: push 000000C8h
  545. loc_006CE497: push 004437B4h
  546. loc_006CE49C: push edi
  547. loc_006CE49D: push eax
  548. loc_006CE49E: call [004010CCh] ; __vbaHresultCheckObj
  549. loc_006CE4A4: mov eax, var_B0
  550. loc_006CE4AA: mov ecx, var_70
  551. loc_006CE4AD: push 004515DCh ; "Version "
  552. loc_006CE4B2: push ecx
  553. loc_006CE4B3: mov edi, [eax]
  554. loc_006CE4B5: call [0040100Ch] ; __vbaStrI2
  555. loc_006CE4BB: mov edx, eax
  556. loc_006CE4BD: lea ecx, var_30
  557. loc_006CE4C0: call [004013C0h] ; __vbaStrMove
  558. loc_006CE4C6: push eax
  559. loc_006CE4C7: call [00401098h] ; __vbaStrCat
  560. loc_006CE4CD: mov edx, eax
  561. loc_006CE4CF: lea ecx, var_34
  562. loc_006CE4D2: call [004013C0h] ; __vbaStrMove
  563. loc_006CE4D8: push eax
  564. loc_006CE4D9: push 00444D98h ; "."
  565. loc_006CE4DE: call [00401098h] ; __vbaStrCat
  566. loc_006CE4E4: mov edx, eax
  567. loc_006CE4E6: lea ecx, var_38
  568. loc_006CE4E9: call [004013C0h] ; __vbaStrMove
  569. loc_006CE4EF: mov edx, var_74
  570. loc_006CE4F2: push eax
  571. loc_006CE4F3: push edx
  572. loc_006CE4F4: call [0040100Ch] ; __vbaStrI2
  573. loc_006CE4FA: mov edx, eax
  574. loc_006CE4FC: lea ecx, var_3C
  575. loc_006CE4FF: call [004013C0h] ; __vbaStrMove
  576. loc_006CE505: push eax
  577. loc_006CE506: call [00401098h] ; __vbaStrCat
  578. loc_006CE50C: mov edx, eax
  579. loc_006CE50E: lea ecx, var_40
  580. loc_006CE511: call [004013C0h] ; __vbaStrMove
  581. loc_006CE517: push eax
  582. loc_006CE518: push 00444D98h ; "."
  583. loc_006CE51D: call [00401098h] ; __vbaStrCat
  584. loc_006CE523: mov edx, eax
  585. loc_006CE525: lea ecx, var_44
  586. loc_006CE528: call [004013C0h] ; __vbaStrMove
  587. loc_006CE52E: push eax
  588. loc_006CE52F: mov eax, var_78
  589. loc_006CE532: push eax
  590. loc_006CE533: call [0040100Ch] ; __vbaStrI2
  591. loc_006CE539: mov edx, eax
  592. loc_006CE53B: lea ecx, var_48
  593. loc_006CE53E: call [004013C0h] ; __vbaStrMove
  594. loc_006CE544: push eax
  595. loc_006CE545: call [00401098h] ; __vbaStrCat
  596. loc_006CE54B: mov edx, eax
  597. loc_006CE54D: lea ecx, var_4C
  598. loc_006CE550: call [004013C0h] ; __vbaStrMove
  599. loc_006CE556: mov ecx, edi
  600. loc_006CE558: mov edi, var_B0
  601. loc_006CE55E: push eax
  602. loc_006CE55F: push edi
  603. loc_006CE560: call [ecx+00000054h]
  604. loc_006CE563: cmp eax, esi
  605. loc_006CE565: fnclex
  606. loc_006CE567: jge 006CE578h
  607. loc_006CE569: push 00000054h
  608. loc_006CE56B: push 00441988h
  609. loc_006CE570: push edi
  610. loc_006CE571: push eax
  611. loc_006CE572: call [004010CCh] ; __vbaHresultCheckObj
  612. loc_006CE578: lea edx, var_4C
  613. loc_006CE57B: lea eax, var_48
  614. loc_006CE57E: push edx
  615. loc_006CE57F: lea ecx, var_44
  616. loc_006CE582: push eax
  617. loc_006CE583: lea edx, var_40
  618. loc_006CE586: push ecx
  619. loc_006CE587: lea eax, var_3C
  620. loc_006CE58A: push edx
  621. loc_006CE58B: lea ecx, var_38
  622. loc_006CE58E: push eax
  623. loc_006CE58F: lea edx, var_34
  624. loc_006CE592: push ecx
  625. loc_006CE593: lea eax, var_30
  626. loc_006CE596: push edx
  627. loc_006CE597: push eax
  628. loc_006CE598: push 00000008h
  629. loc_006CE59A: call [00401324h] ; __vbaFreeStrList
  630. loc_006CE5A0: lea ecx, var_5C
  631. loc_006CE5A3: lea edx, var_58
  632. loc_006CE5A6: push ecx
  633. loc_006CE5A7: lea eax, var_54
  634. loc_006CE5AA: push edx
  635. loc_006CE5AB: lea ecx, var_50
  636. loc_006CE5AE: push eax
  637. loc_006CE5AF: push ecx
  638. loc_006CE5B0: push 00000004h
  639. loc_006CE5B2: call [00401068h] ; __vbaFreeObjList
  640. loc_006CE5B8: mov edx, [ebx]
  641. loc_006CE5BA: add esp, 00000038h
  642. loc_006CE5BD: push ebx
  643. loc_006CE5BE: call [edx+00000320h]
  644. loc_006CE5C4: push eax
  645. loc_006CE5C5: lea eax, var_54
  646. loc_006CE5C8: push eax
  647. loc_006CE5C9: call [00401128h] ; __vbaObjSet
  648. loc_006CE5CF: mov var_90, eax
  649. loc_006CE5D5: mov eax, [0073C818h]
  650. loc_006CE5DA: cmp eax, esi
  651. loc_006CE5DC: jnz 006CE5EEh
  652. loc_006CE5DE: push 0073C818h
  653. loc_006CE5E3: push 00441F00h
  654. loc_006CE5E8: call [004012FCh] ; __vbaNew2
  655. loc_006CE5EE: mov edi, [0073C818h]
  656. loc_006CE5F4: lea edx, var_50
  657. loc_006CE5F7: push edx
  658. loc_006CE5F8: push edi
  659. loc_006CE5F9: mov ecx, [edi]
  660. loc_006CE5FB: call [ecx+00000014h]
  661. loc_006CE5FE: cmp eax, esi
  662. loc_006CE600: fnclex
  663. loc_006CE602: jge 006CE613h
  664. loc_006CE604: push 00000014h
  665. loc_006CE606: push 00441EF0h
  666. loc_006CE60B: push edi
  667. loc_006CE60C: push eax
  668. loc_006CE60D: call [004010CCh] ; __vbaHresultCheckObj
  669. loc_006CE613: mov eax, var_50
  670. loc_006CE616: lea edx, var_30
  671. loc_006CE619: push edx
  672. loc_006CE61A: push eax
  673. loc_006CE61B: mov ecx, [eax]
  674. loc_006CE61D: mov edi, eax
  675. loc_006CE61F: call [ecx+00000060h]
  676. loc_006CE622: cmp eax, esi
  677. loc_006CE624: fnclex
  678. loc_006CE626: jge 006CE637h
  679. loc_006CE628: push 00000060h
  680. loc_006CE62A: push 004437B4h
  681. loc_006CE62F: push edi
  682. loc_006CE630: push eax
  683. loc_006CE631: call [004010CCh] ; __vbaHresultCheckObj
  684. loc_006CE637: mov edi, var_90
  685. loc_006CE63D: mov ecx, var_30
  686. loc_006CE640: push ecx
  687. loc_006CE641: push edi
  688. loc_006CE642: mov eax, [edi]
  689. loc_006CE644: call [eax+00000054h]
  690. loc_006CE647: cmp eax, esi
  691. loc_006CE649: fnclex
  692. loc_006CE64B: jge 006CE65Ch
  693. loc_006CE64D: push 00000054h
  694. loc_006CE64F: push 00441988h
  695. loc_006CE654: push edi
  696. loc_006CE655: push eax
  697. loc_006CE656: call [004010CCh] ; __vbaHresultCheckObj
  698. loc_006CE65C: lea ecx, var_30
  699. loc_006CE65F: call [00401430h] ; __vbaFreeStr
  700. loc_006CE665: lea edx, var_54
  701. loc_006CE668: lea eax, var_50
  702. loc_006CE66B: push edx
  703. loc_006CE66C: push eax
  704. loc_006CE66D: push 00000002h
  705. loc_006CE66F: call [00401068h] ; __vbaFreeObjList
  706. loc_006CE675: mov ecx, [ebx]
  707. loc_006CE677: add esp, 0000000Ch
  708. loc_006CE67A: push ebx
  709. loc_006CE67B: call [ecx+0000031Ch]
  710. loc_006CE681: lea edx, var_54
  711. loc_006CE684: push eax
  712. loc_006CE685: push edx
  713. loc_006CE686: call [00401128h] ; __vbaObjSet
  714. loc_006CE68C: mov edi, eax
  715. loc_006CE68E: mov eax, [0073C818h]
  716. loc_006CE693: cmp eax, esi
  717. loc_006CE695: jnz 006CE6A7h
  718. loc_006CE697: push 0073C818h
  719. loc_006CE69C: push 00441F00h
  720. loc_006CE6A1: call [004012FCh] ; __vbaNew2
  721. loc_006CE6A7: mov ebx, [0073C818h]
  722. loc_006CE6AD: lea ecx, var_50
  723. loc_006CE6B0: push ecx
  724. loc_006CE6B1: push ebx
  725. loc_006CE6B2: mov eax, [ebx]
  726. loc_006CE6B4: call [eax+00000014h]
  727. loc_006CE6B7: cmp eax, esi
  728. loc_006CE6B9: fnclex
  729. loc_006CE6BB: jge 006CE6CCh
  730. loc_006CE6BD: push 00000014h
  731. loc_006CE6BF: push 00441EF0h
  732. loc_006CE6C4: push ebx
  733. loc_006CE6C5: push eax
  734. loc_006CE6C6: call [004010CCh] ; __vbaHresultCheckObj
  735. loc_006CE6CC: mov eax, var_50
  736. loc_006CE6CF: lea ecx, var_30
  737. loc_006CE6D2: push ecx
  738. loc_006CE6D3: push eax
  739. loc_006CE6D4: mov edx, [eax]
  740. loc_006CE6D6: mov ebx, eax
  741. loc_006CE6D8: call [edx+000000E0h]
  742. loc_006CE6DE: cmp eax, esi
  743. loc_006CE6E0: fnclex
  744. loc_006CE6E2: jge 006CE6F6h
  745. loc_006CE6E4: push 000000E0h
  746. loc_006CE6E9: push 004437B4h
  747. loc_006CE6EE: push ebx
  748. loc_006CE6EF: push eax
  749. loc_006CE6F0: call [004010CCh] ; __vbaHresultCheckObj
  750. loc_006CE6F6: mov eax, var_30
  751. loc_006CE6F9: mov edx, [edi]
  752. loc_006CE6FB: push eax
  753. loc_006CE6FC: push edi
  754. loc_006CE6FD: call [edx+00000054h]
  755. loc_006CE700: cmp eax, esi
  756. loc_006CE702: fnclex
  757. loc_006CE704: jge 006CE715h
  758. loc_006CE706: push 00000054h
  759. loc_006CE708: push 00441988h
  760. loc_006CE70D: push edi
  761. loc_006CE70E: push eax
  762. loc_006CE70F: call [004010CCh] ; __vbaHresultCheckObj
  763. loc_006CE715: lea ecx, var_30
  764. loc_006CE718: call [00401430h] ; __vbaFreeStr
  765. loc_006CE71E: lea ecx, var_54
  766. loc_006CE721: lea edx, var_50
  767. loc_006CE724: push ecx
  768. loc_006CE725: push edx
  769. loc_006CE726: push 00000002h
  770. loc_006CE728: call [00401068h] ; __vbaFreeObjList
  771. loc_006CE72E: add esp, 0000000Ch
  772. loc_006CE731: mov var_4, esi
  773. loc_006CE734: push 006CE799h
  774. loc_006CE739: jmp 006CE77Fh
  775. loc_006CE73B: lea eax, var_4C
  776. loc_006CE73E: lea ecx, var_48
  777. loc_006CE741: push eax
  778. loc_006CE742: lea edx, var_44
  779. loc_006CE745: push ecx
  780. loc_006CE746: lea eax, var_40
  781. loc_006CE749: push edx
  782. loc_006CE74A: lea ecx, var_3C
  783. loc_006CE74D: push eax
  784. loc_006CE74E: lea edx, var_38
  785. loc_006CE751: push ecx
  786. loc_006CE752: lea eax, var_34
  787. loc_006CE755: push edx
  788. loc_006CE756: lea ecx, var_30
  789. loc_006CE759: push eax
  790. loc_006CE75A: push ecx
  791. loc_006CE75B: push 00000008h
  792. loc_006CE75D: call [00401324h] ; __vbaFreeStrList
  793. loc_006CE763: lea edx, var_5C
  794. loc_006CE766: lea eax, var_58
  795. loc_006CE769: push edx
  796. loc_006CE76A: lea ecx, var_54
  797. loc_006CE76D: push eax
  798. loc_006CE76E: lea edx, var_50
  799. loc_006CE771: push ecx
  800. loc_006CE772: push edx
  801. loc_006CE773: push 00000004h
  802. loc_006CE775: call [00401068h] ; __vbaFreeObjList
  803. loc_006CE77B: add esp, 00000038h
  804. loc_006CE77E: ret
  805. loc_006CE77F: lea ecx, var_24
  806. loc_006CE782: call [00401030h] ; __vbaFreeVar
  807. loc_006CE788: mov esi, [00401430h] ; __vbaFreeStr
  808. loc_006CE78E: lea ecx, var_28
  809. loc_006CE791: call __vbaFreeStr
  810. loc_006CE793: lea ecx, var_2C
  811. loc_006CE796: call __vbaFreeStr
  812. loc_006CE798: ret
  813. loc_006CE799: mov eax, Me
  814. loc_006CE79C: push eax
  815. loc_006CE79D: mov ecx, [eax]
  816. loc_006CE79F: call [ecx+00000008h]
  817. loc_006CE7A2: mov eax, var_4
  818. loc_006CE7A5: mov ecx, var_14
  819. loc_006CE7A8: pop edi
  820. loc_006CE7A9: pop esi
  821. loc_006CE7AA: mov fs:[00000000h], ecx
  822. loc_006CE7B1: pop ebx
  823. loc_006CE7B2: mov esp, ebp
  824. loc_006CE7B4: pop ebp
  825. loc_006CE7B5: retn 0004h
  826. End Sub
  827. Private Sub cmdSysInfo_Click() '6CDF70
  828. loc_006CDF70: push ebp
  829. loc_006CDF71: mov ebp, esp
  830. loc_006CDF73: sub esp, 0000000Ch
  831. loc_006CDF76: push 00412856h ; __vbaExceptHandler
  832. loc_006CDF7B: mov eax, fs:[00000000h]
  833. loc_006CDF81: push eax
  834. loc_006CDF82: mov fs:[00000000h], esp
  835. loc_006CDF89: sub esp, 0000000Ch
  836. loc_006CDF8C: push ebx
  837. loc_006CDF8D: push esi
  838. loc_006CDF8E: push edi
  839. loc_006CDF8F: mov var_C, esp
  840. loc_006CDF92: mov var_8, 0040D5E8h
  841. loc_006CDF99: mov esi, Me
  842. loc_006CDF9C: mov eax, esi
  843. loc_006CDF9E: and eax, 00000001h
  844. loc_006CDFA1: mov var_4, eax
  845. loc_006CDFA4: and esi, FFFFFFFEh
  846. loc_006CDFA7: push esi
  847. loc_006CDFA8: mov Me, esi
  848. loc_006CDFAB: mov ecx, [esi]
  849. loc_006CDFAD: call [ecx+00000004h]
  850. loc_006CDFB0: mov edx, [esi]
  851. loc_006CDFB2: push esi
  852. loc_006CDFB3: call [edx+000006F8h]
  853. loc_006CDFB9: test eax, eax
  854. loc_006CDFBB: jge 006CDFCFh
  855. loc_006CDFBD: push 000006F8h
  856. loc_006CDFC2: push 004566E0h
  857. loc_006CDFC7: push esi
  858. loc_006CDFC8: push eax
  859. loc_006CDFC9: call [004010CCh] ; __vbaHresultCheckObj
  860. loc_006CDFCF: mov var_4, 00000000h
  861. loc_006CDFD6: mov eax, Me
  862. loc_006CDFD9: push eax
  863. loc_006CDFDA: mov ecx, [eax]
  864. loc_006CDFDC: call [ecx+00000008h]
  865. loc_006CDFDF: mov eax, var_4
  866. loc_006CDFE2: mov ecx, var_14
  867. loc_006CDFE5: pop edi
  868. loc_006CDFE6: pop esi
  869. loc_006CDFE7: mov fs:[00000000h], ecx
  870. loc_006CDFEE: pop ebx
  871. loc_006CDFEF: mov esp, ebp
  872. loc_006CDFF1: pop ebp
  873. loc_006CDFF2: retn 0004h
  874. End Sub
  875. Public Sub StartSysInfo() '6CE7C0
  876. loc_006CE7C0: push ebp
  877. loc_006CE7C1: mov ebp, esp
  878. loc_006CE7C3: sub esp, 00000014h
  879. loc_006CE7C6: push 00412856h ; __vbaExceptHandler
  880. loc_006CE7CB: mov eax, fs:[00000000h]
  881. loc_006CE7D1: push eax
  882. loc_006CE7D2: mov fs:[00000000h], esp
  883. loc_006CE7D9: sub esp, 000000B8h
  884. loc_006CE7DF: push ebx
  885. loc_006CE7E0: push esi
  886. loc_006CE7E1: push edi
  887. loc_006CE7E2: mov var_14, esp
  888. loc_006CE7E5: mov var_10, 0040D610h
  889. loc_006CE7EC: xor ebx, ebx
  890. loc_006CE7EE: mov var_C, ebx
  891. loc_006CE7F1: mov var_8, ebx
  892. loc_006CE7F4: mov esi, Me
  893. loc_006CE7F7: mov eax, [esi]
  894. loc_006CE7F9: push esi
  895. loc_006CE7FA: call [eax+00000004h]
  896. loc_006CE7FD: mov var_24, ebx
  897. loc_006CE800: mov var_28, ebx
  898. loc_006CE803: mov var_2C, ebx
  899. loc_006CE806: mov var_3C, ebx
  900. loc_006CE809: mov var_4C, ebx
  901. loc_006CE80C: mov var_5C, ebx
  902. loc_006CE80F: mov var_6C, ebx
  903. loc_006CE812: mov var_7C, ebx
  904. loc_006CE815: mov var_B0, ebx
  905. loc_006CE81B: mov var_B4, ebx
  906. loc_006CE821: push 00000001h
  907. loc_006CE823: call [00401124h] ; __vbaOnError
  908. loc_006CE829: mov edx, 0043DFA0h ; "PATH"
  909. loc_006CE82E: lea ecx, var_2C
  910. loc_006CE831: mov edi, [00401310h] ; __vbaStrCopy
  911. loc_006CE837: call edi
  912. loc_006CE839: mov edx, 0043DF4Ch ; "SOFTWARE\Microsoft\Shared Tools\MSINFO"
  913. loc_006CE83E: lea ecx, var_28
  914. loc_006CE841: call edi
  915. loc_006CE843: mov var_B4, 80000002h
  916. loc_006CE84D: mov ecx, [esi]
  917. loc_006CE84F: lea edx, var_B0
  918. loc_006CE855: push edx
  919. loc_006CE856: lea eax, var_24
  920. loc_006CE859: push eax
  921. loc_006CE85A: lea edx, var_2C
  922. loc_006CE85D: push edx
  923. loc_006CE85E: lea eax, var_28
  924. loc_006CE861: push eax
  925. loc_006CE862: lea edx, var_B4
  926. loc_006CE868: push edx
  927. loc_006CE869: push esi
  928. loc_006CE86A: call [ecx+000006FCh]
  929. loc_006CE870: cmp eax, ebx
  930. loc_006CE872: jge 006CE886h
  931. loc_006CE874: push 000006FCh
  932. loc_006CE879: push 004566E0h
  933. loc_006CE87E: push esi
  934. loc_006CE87F: push eax
  935. loc_006CE880: call [004010CCh] ; __vbaHresultCheckObj
  936. loc_006CE886: mov eax, var_B0
  937. loc_006CE88C: mov var_C4, eax
  938. loc_006CE892: lea ecx, var_2C
  939. loc_006CE895: push ecx
  940. loc_006CE896: lea edx, var_28
  941. loc_006CE899: push edx
  942. loc_006CE89A: push 00000002h
  943. loc_006CE89C: call [00401324h] ; __vbaFreeStrList
  944. loc_006CE8A2: add esp, 0000000Ch
  945. loc_006CE8A5: cmp var_C4, bx
  946. loc_006CE8AC: jnz 006CE99Fh
  947. loc_006CE8B2: mov edx, 0043DF38h ; "MSINFO"
  948. loc_006CE8B7: lea ecx, var_2C
  949. loc_006CE8BA: call edi
  950. loc_006CE8BC: mov edx, 0043DEE0h ; "SOFTWARE\Microsoft\Shared Tools Location"
  951. loc_006CE8C1: lea ecx, var_28
  952. loc_006CE8C4: call edi
  953. loc_006CE8C6: mov var_B4, 80000002h
  954. loc_006CE8D0: mov eax, [esi]
  955. loc_006CE8D2: lea ecx, var_B0
  956. loc_006CE8D8: push ecx
  957. loc_006CE8D9: lea edx, var_24
  958. loc_006CE8DC: push edx
  959. loc_006CE8DD: lea ecx, var_2C
  960. loc_006CE8E0: push ecx
  961. loc_006CE8E1: lea edx, var_28
  962. loc_006CE8E4: push edx
  963. loc_006CE8E5: lea ecx, var_B4
  964. loc_006CE8EB: push ecx
  965. loc_006CE8EC: push esi
  966. loc_006CE8ED: call [eax+000006FCh]
  967. loc_006CE8F3: cmp eax, ebx
  968. loc_006CE8F5: jge 006CE909h
  969. loc_006CE8F7: push 000006FCh
  970. loc_006CE8FC: push 004566E0h
  971. loc_006CE901: push esi
  972. loc_006CE902: push eax
  973. loc_006CE903: call [004010CCh] ; __vbaHresultCheckObj
  974. loc_006CE909: mov esi, var_B0
  975. loc_006CE90F: lea edx, var_2C
  976. loc_006CE912: push edx
  977. loc_006CE913: lea eax, var_28
  978. loc_006CE916: push eax
  979. loc_006CE917: push 00000002h
  980. loc_006CE919: call [00401324h] ; __vbaFreeStrList
  981. loc_006CE91F: add esp, 0000000Ch
  982. loc_006CE922: cmp si, bx
  983. loc_006CE925: jz 006CE9BCh
  984. loc_006CE92B: mov ecx, var_24
  985. loc_006CE92E: push ecx
  986. loc_006CE92F: push 0046E540h ; "\MSINFO32.EXE"
  987. loc_006CE934: mov edi, [00401098h] ; __vbaStrCat
  988. loc_006CE93A: call edi
  989. loc_006CE93C: mov var_34, eax
  990. loc_006CE93F: mov var_3C, 00000008h
  991. loc_006CE946: push ebx
  992. loc_006CE947: lea edx, var_3C
  993. loc_006CE94A: push edx
  994. loc_006CE94B: call [004012D0h] ; rtcDir
  995. loc_006CE951: mov edx, eax
  996. loc_006CE953: lea ecx, var_28
  997. loc_006CE956: call [004013C0h] ; __vbaStrMove
  998. loc_006CE95C: push eax
  999. loc_006CE95D: push 0043C9F4h
  1000. loc_006CE962: call [004011B8h] ; __vbaStrCmp
  1001. loc_006CE968: mov esi, eax
  1002. loc_006CE96A: neg esi
  1003. loc_006CE96C: sbb esi, esi
  1004. loc_006CE96E: neg esi
  1005. loc_006CE970: neg esi
  1006. loc_006CE972: lea ecx, var_28
  1007. loc_006CE975: call [00401430h] ; __vbaFreeStr
  1008. loc_006CE97B: lea ecx, var_3C
  1009. loc_006CE97E: call [00401030h] ; __vbaFreeVar
  1010. loc_006CE984: cmp si, bx
  1011. loc_006CE987: jz 006CE9BCh
  1012. loc_006CE989: mov eax, var_24
  1013. loc_006CE98C: push eax
  1014. loc_006CE98D: push 0046E540h ; "\MSINFO32.EXE"
  1015. loc_006CE992: call edi
  1016. loc_006CE994: mov edx, eax
  1017. loc_006CE996: lea ecx, var_24
  1018. loc_006CE999: call [004013C0h] ; __vbaStrMove
  1019. loc_006CE99F: lea ecx, var_24
  1020. loc_006CE9A2: mov var_74, ecx
  1021. loc_006CE9A5: mov var_7C, 00004008h
  1022. loc_006CE9AC: push 00000001h
  1023. loc_006CE9AE: lea edx, var_7C
  1024. loc_006CE9B1: push edx
  1025. loc_006CE9B2: call [00401230h] ; rtcShell
  1026. loc_006CE9B8: fstp st0
  1027. loc_006CE9BA: jmp 006CEA25h
  1028. loc_006CE9BC: mov ecx, 80020004h
  1029. loc_006CE9C1: mov var_64, ecx
  1030. loc_006CE9C4: mov eax, 0000000Ah
  1031. loc_006CE9C9: mov var_6C, eax
  1032. loc_006CE9CC: mov var_54, ecx
  1033. loc_006CE9CF: mov var_5C, eax
  1034. loc_006CE9D2: mov var_44, ecx
  1035. loc_006CE9D5: mov var_4C, eax
  1036. loc_006CE9D8: mov var_74, 0046E590h ; "System Information Is Unavailable At This Time"
  1037. loc_006CE9DF: mov var_7C, 00000008h
  1038. loc_006CE9E6: lea edx, var_7C
  1039. loc_006CE9E9: lea ecx, var_3C
  1040. loc_006CE9EC: call [00401374h] ; __vbaVarDup
  1041. loc_006CE9F2: lea eax, var_6C
  1042. loc_006CE9F5: push eax
  1043. loc_006CE9F6: lea ecx, var_5C
  1044. loc_006CE9F9: push ecx
  1045. loc_006CE9FA: lea edx, var_4C
  1046. loc_006CE9FD: push edx
  1047. loc_006CE9FE: push 00000000h
  1048. loc_006CEA00: lea eax, var_3C
  1049. loc_006CEA03: push eax
  1050. loc_006CEA04: call [00401120h] ; rtcMsgBox
  1051. loc_006CEA0A: lea ecx, var_6C
  1052. loc_006CEA0D: push ecx
  1053. loc_006CEA0E: lea edx, var_5C
  1054. loc_006CEA11: push edx
  1055. loc_006CEA12: lea eax, var_4C
  1056. loc_006CEA15: push eax
  1057. loc_006CEA16: lea ecx, var_3C
  1058. loc_006CEA19: push ecx
  1059. loc_006CEA1A: push 00000004h
  1060. loc_006CEA1C: call [00401050h] ; __vbaFreeVarList
  1061. loc_006CEA22: add esp, 00000014h
  1062. loc_006CEA25: call [00401114h] ; __vbaExitProc
  1063. loc_006CEA2B: fwait
  1064. loc_006CEA2C: push 006CEA69h
  1065. loc_006CEA31: jmp 006CEA5Fh
  1066. loc_006CEA33: lea edx, var_2C
  1067. loc_006CEA36: push edx
  1068. loc_006CEA37: lea eax, var_28
  1069. loc_006CEA3A: push eax
  1070. loc_006CEA3B: push 00000002h
  1071. loc_006CEA3D: call [00401324h] ; __vbaFreeStrList
  1072. loc_006CEA43: lea ecx, var_6C
  1073. loc_006CEA46: push ecx
  1074. loc_006CEA47: lea edx, var_5C
  1075. loc_006CEA4A: push edx
  1076. loc_006CEA4B: lea eax, var_4C
  1077. loc_006CEA4E: push eax
  1078. loc_006CEA4F: lea ecx, var_3C
  1079. loc_006CEA52: push ecx
  1080. loc_006CEA53: push 00000004h
  1081. loc_006CEA55: call [00401050h] ; __vbaFreeVarList
  1082. loc_006CEA5B: add esp, 00000020h
  1083. loc_006CEA5E: ret
  1084. loc_006CEA5F: lea ecx, var_24
  1085. loc_006CEA62: call [00401430h] ; __vbaFreeStr
  1086. loc_006CEA68: ret
  1087. loc_006CEA69: mov eax, Me
  1088. loc_006CEA6C: mov edx, [eax]
  1089. loc_006CEA6E: push eax
  1090. loc_006CEA6F: call [edx+00000008h]
  1091. loc_006CEA72: mov eax, var_C
  1092. loc_006CEA75: mov ecx, var_1C
  1093. loc_006CEA78: mov fs:[00000000h], ecx
  1094. loc_006CEA7F: pop edi
  1095. loc_006CEA80: pop esi
  1096. loc_006CEA81: pop ebx
  1097. loc_006CEA82: mov esp, ebp
  1098. loc_006CEA84: pop ebp
  1099. loc_006CEA85: retn 0004h
  1100. End Sub
  1101. Public Function GetKeyValue(KeyRoot, KeyName, SubKeyRef, KeyVal) '6CEA90
  1102. loc_006CEA90: push ebp
  1103. loc_006CEA91: mov ebp, esp
  1104. loc_006CEA93: sub esp, 0000000Ch
  1105. loc_006CEA96: push 00412856h ; __vbaExceptHandler
  1106. loc_006CEA9B: mov eax, fs:[00000000h]
  1107. loc_006CEAA1: push eax
  1108. loc_006CEAA2: mov fs:[00000000h], esp
  1109. loc_006CEAA9: sub esp, 000000D4h
  1110. loc_006CEAAF: push ebx
  1111. loc_006CEAB0: push esi
  1112. loc_006CEAB1: push edi
  1113. loc_006CEAB2: mov var_C, esp
  1114. loc_006CEAB5: mov var_8, 0040D638h
  1115. loc_006CEABC: xor edi, edi
  1116. loc_006CEABE: mov var_4, edi
  1117. loc_006CEAC1: mov eax, Me
  1118. loc_006CEAC4: push eax
  1119. loc_006CEAC5: mov ecx, [eax]
  1120. loc_006CEAC7: call [ecx+00000004h]
  1121. loc_006CEACA: mov ebx, KeyName
  1122. loc_006CEACD: mov esi, [00401370h] ; __vbaStrToAnsi
  1123. loc_006CEAD3: lea edx, var_18
  1124. loc_006CEAD6: lea ecx, var_38
  1125. loc_006CEAD9: mov eax, [ebx]
  1126. loc_006CEADB: push edx
  1127. loc_006CEADC: push 0002003Fh
  1128. loc_006CEAE1: push edi
  1129. loc_006CEAE2: push eax
  1130. loc_006CEAE3: push ecx
  1131. loc_006CEAE4: mov var_18, edi
  1132. loc_006CEAE7: mov var_24, edi
  1133. loc_006CEAEA: mov var_2C, edi
  1134. loc_006CEAED: mov var_30, edi
  1135. loc_006CEAF0: mov var_34, edi
  1136. loc_006CEAF3: mov var_38, edi
  1137. loc_006CEAF6: mov var_3C, edi
  1138. loc_006CEAF9: mov var_4C, edi
  1139. loc_006CEAFC: mov var_5C, edi
  1140. loc_006CEAFF: mov var_6C, edi
  1141. loc_006CEB02: mov var_7C, edi
  1142. loc_006CEB05: mov var_8C, edi
  1143. loc_006CEB0B: mov var_9C, edi
  1144. loc_006CEB11: mov var_CC, edi
  1145. loc_006CEB17: call __vbaStrToAnsi
  1146. loc_006CEB19: mov edx, KeyRoot
  1147. loc_006CEB1C: push eax
  1148. loc_006CEB1D: mov eax, [edx]
  1149. loc_006CEB1F: push eax
  1150. loc_006CEB20: RegOpenKeyEx(%x1v, %x2v, %x3v, %x4v, %x5v)
  1151. loc_006CEB25: mov var_D0, eax
  1152. loc_006CEB2B: call [004010BCh] ; __vbaSetSystemError
  1153. loc_006CEB31: mov ecx, var_38
  1154. loc_006CEB34: push ecx
  1155. loc_006CEB35: push ebx
  1156. loc_006CEB36: call [00401260h] ; __vbaStrToUnicode
  1157. loc_006CEB3C: lea ecx, var_38
  1158. loc_006CEB3F: call [00401430h] ; __vbaFreeStr
  1159. loc_006CEB45: cmp var_D0, edi
  1160. loc_006CEB4B: jnz 006CEBECh
  1161. loc_006CEB51: lea edx, var_4C
  1162. loc_006CEB54: mov var_44, edi
  1163. loc_006CEB57: push edx
  1164. loc_006CEB58: push 00000400h
  1165. loc_006CEB5D: mov var_4C, 00000002h
  1166. loc_006CEB64: call [00401264h] ; rtcStringBstr
  1167. loc_006CEB6A: mov ebx, [004013C0h] ; __vbaStrMove
  1168. loc_006CEB70: mov edx, eax
  1169. loc_006CEB72: lea ecx, var_30
  1170. loc_006CEB75: call ebx
  1171. loc_006CEB77: lea ecx, var_4C
  1172. loc_006CEB7A: call [00401030h] ; __vbaFreeVar
  1173. loc_006CEB80: mov ecx, var_30
  1174. loc_006CEB83: lea eax, var_34
  1175. loc_006CEB86: push eax
  1176. loc_006CEB87: lea edx, var_3C
  1177. loc_006CEB8A: push ecx
  1178. loc_006CEB8B: push edx
  1179. loc_006CEB8C: mov var_34, 00000400h
  1180. loc_006CEB93: call __vbaStrToAnsi
  1181. loc_006CEB95: mov ecx, SubKeyRef
  1182. loc_006CEB98: push eax
  1183. loc_006CEB99: lea eax, var_24
  1184. loc_006CEB9C: mov edx, [ecx]
  1185. loc_006CEB9E: push eax
  1186. loc_006CEB9F: push edi
  1187. loc_006CEBA0: lea eax, var_38
  1188. loc_006CEBA3: push edx
  1189. loc_006CEBA4: push eax
  1190. loc_006CEBA5: call __vbaStrToAnsi
  1191. loc_006CEBA7: mov ecx, var_18
  1192. loc_006CEBAA: push eax
  1193. loc_006CEBAB: push ecx
  1194. loc_006CEBAC: RegQueryValueEx(%x1v, %x2v, %x3v, %x4v, %x5v, %x6v)
  1195. loc_006CEBB1: mov esi, eax
  1196. loc_006CEBB3: call [004010BCh] ; __vbaSetSystemError
  1197. loc_006CEBB9: mov edx, var_38
  1198. loc_006CEBBC: mov eax, SubKeyRef
  1199. loc_006CEBBF: push edx
  1200. loc_006CEBC0: push eax
  1201. loc_006CEBC1: call [00401260h] ; __vbaStrToUnicode
  1202. loc_006CEBC7: mov ecx, var_3C
  1203. loc_006CEBCA: lea edx, var_30
  1204. loc_006CEBCD: push ecx
  1205. loc_006CEBCE: push edx
  1206. loc_006CEBCF: call [00401260h] ; __vbaStrToUnicode
  1207. loc_006CEBD5: lea eax, var_3C
  1208. loc_006CEBD8: lea ecx, var_38
  1209. loc_006CEBDB: push eax
  1210. loc_006CEBDC: push ecx
  1211. loc_006CEBDD: push 00000002h
  1212. loc_006CEBDF: call [00401324h] ; __vbaFreeStrList
  1213. loc_006CEBE5: add esp, 0000000Ch
  1214. loc_006CEBE8: cmp esi, edi
  1215. loc_006CEBEA: jz 006CEC06h
  1216. loc_006CEBEC: mov ecx, KeyVal
  1217. loc_006CEBEF: mov edx, 0043C9F4h
  1218. loc_006CEBF4: call [00401310h] ; __vbaStrCopy
  1219. loc_006CEBFA: mov edx, var_18
  1220. loc_006CEBFD: mov var_2C, edi
  1221. loc_006CEC00: push edx
  1222. loc_006CEC01: jmp 006CEE68h
  1223. loc_006CEC06: mov edx, var_34
  1224. loc_006CEC09: lea eax, var_30
  1225. loc_006CEC0C: lea ecx, var_4C
  1226. loc_006CEC0F: mov var_94, eax
  1227. loc_006CEC15: push ecx
  1228. loc_006CEC16: lea eax, var_9C
  1229. loc_006CEC1C: push edx
  1230. loc_006CEC1D: lea ecx, var_5C
  1231. loc_006CEC20: push eax
  1232. loc_006CEC21: push ecx
  1233. loc_006CEC22: mov var_44, 00000001h
  1234. loc_006CEC29: mov var_4C, 00000002h
  1235. loc_006CEC30: mov var_9C, 00004008h
  1236. loc_006CEC3A: call [00401188h] ; rtcMidCharVar
  1237. loc_006CEC40: lea edx, var_5C
  1238. loc_006CEC43: lea eax, var_38
  1239. loc_006CEC46: push edx
  1240. loc_006CEC47: push eax
  1241. loc_006CEC48: call [004012A8h] ; __vbaStrVarVal
  1242. loc_006CEC4E: push eax
  1243. loc_006CEC4F: call [0040106Ch] ; rtcAnsiValueBstr
  1244. loc_006CEC55: mov si, ax
  1245. loc_006CEC58: lea ecx, var_38
  1246. loc_006CEC5B: neg si
  1247. loc_006CEC5E: sbb esi, esi
  1248. loc_006CEC60: inc esi
  1249. loc_006CEC61: neg esi
  1250. loc_006CEC63: call [00401430h] ; __vbaFreeStr
  1251. loc_006CEC69: lea ecx, var_5C
  1252. loc_006CEC6C: lea edx, var_4C
  1253. loc_006CEC6F: push ecx
  1254. loc_006CEC70: push edx
  1255. loc_006CEC71: push 00000002h
  1256. loc_006CEC73: call [00401050h] ; __vbaFreeVarList
  1257. loc_006CEC79: add esp, 0000000Ch
  1258. loc_006CEC7C: cmp si, di
  1259. loc_006CEC7F: jz 006CECB8h
  1260. loc_006CEC81: mov ecx, var_34
  1261. loc_006CEC84: lea eax, var_30
  1262. loc_006CEC87: sub ecx, 00000001h
  1263. loc_006CEC8A: mov var_94, eax
  1264. loc_006CEC90: jo 006CEEE0h
  1265. loc_006CEC96: lea edx, var_9C
  1266. loc_006CEC9C: push ecx
  1267. loc_006CEC9D: lea eax, var_4C
  1268. loc_006CECA0: push edx
  1269. loc_006CECA1: push eax
  1270. loc_006CECA2: mov var_9C, 00004008h
  1271. loc_006CECAC: call [004013ACh] ; rtcLeftCharVar
  1272. loc_006CECB2: lea ecx, var_4C
  1273. loc_006CECB5: push ecx
  1274. loc_006CECB6: jmp 006CECE4h
  1275. loc_006CECB8: mov eax, var_34
  1276. loc_006CECBB: lea edx, var_30
  1277. loc_006CECBE: mov var_94, edx
  1278. loc_006CECC4: lea ecx, var_9C
  1279. loc_006CECCA: push eax
  1280. loc_006CECCB: lea edx, var_4C
  1281. loc_006CECCE: push ecx
  1282. loc_006CECCF: push edx
  1283. loc_006CECD0: mov var_9C, 00004008h
  1284. loc_006CECDA: call [004013ACh] ; rtcLeftCharVar
  1285. loc_006CECE0: lea eax, var_4C
  1286. loc_006CECE3: push eax
  1287. loc_006CECE4: call [00401040h] ; __vbaStrVarMove
  1288. loc_006CECEA: mov edx, eax
  1289. loc_006CECEC: lea ecx, var_30
  1290. loc_006CECEF: call ebx
  1291. loc_006CECF1: lea ecx, var_4C
  1292. loc_006CECF4: call [00401030h] ; __vbaFreeVar
  1293. loc_006CECFA: mov eax, var_24
  1294. loc_006CECFD: dec eax
  1295. loc_006CECFE: jz 006CEE51h
  1296. loc_006CED04: sub eax, 00000003h
  1297. loc_006CED07: jnz 006CEE5Dh
  1298. loc_006CED0D: mov ecx, var_30
  1299. loc_006CED10: push ecx
  1300. loc_006CED11: call [00401044h] ; __vbaLenBstr
  1301. loc_006CED17: mov edi, KeyVal
  1302. loc_006CED1A: mov esi, eax
  1303. loc_006CED1C: mov eax, 00000001h
  1304. loc_006CED21: cmp esi, eax
  1305. loc_006CED23: jl 006CEDFEh
  1306. loc_006CED29: mov edx, [edi]
  1307. loc_006CED2B: mov var_44, eax
  1308. loc_006CED2E: lea eax, var_30
  1309. loc_006CED31: lea ecx, var_4C
  1310. loc_006CED34: mov var_C4, edx
  1311. loc_006CED3A: mov var_94, eax
  1312. loc_006CED40: push ecx
  1313. loc_006CED41: lea edx, var_9C
  1314. loc_006CED47: push esi
  1315. loc_006CED48: lea eax, var_5C
  1316. loc_006CED4B: push edx
  1317. loc_006CED4C: push eax
  1318. loc_006CED4D: mov var_CC, 00000008h
  1319. loc_006CED57: mov var_4C, 00000002h
  1320. loc_006CED5E: mov var_9C, 00004008h
  1321. loc_006CED68: call [00401188h] ; rtcMidCharVar
  1322. loc_006CED6E: lea ecx, var_5C
  1323. loc_006CED71: lea edx, var_38
  1324. loc_006CED74: push ecx
  1325. loc_006CED75: push edx
  1326. loc_006CED76: call [004012A8h] ; __vbaStrVarVal
  1327. loc_006CED7C: push eax
  1328. loc_006CED7D: call [0040106Ch] ; rtcAnsiValueBstr
  1329. loc_006CED83: mov var_64, ax
  1330. loc_006CED87: lea eax, var_6C
  1331. loc_006CED8A: lea ecx, var_7C
  1332. loc_006CED8D: push eax
  1333. loc_006CED8E: push ecx
  1334. loc_006CED8F: mov var_6C, 00000002h
  1335. loc_006CED96: call [0040130Ch] ; rtcHexVarFromVar
  1336. loc_006CED9C: lea edx, var_CC
  1337. loc_006CEDA2: lea eax, var_7C
  1338. loc_006CEDA5: push edx
  1339. loc_006CEDA6: lea ecx, var_8C
  1340. loc_006CEDAC: push eax
  1341. loc_006CEDAD: push ecx
  1342. loc_006CEDAE: call [0040135Ch] ; __vbaVarAdd
  1343. loc_006CEDB4: push eax
  1344. loc_006CEDB5: call [00401040h] ; __vbaStrVarMove
  1345. loc_006CEDBB: mov edx, eax
  1346. loc_006CEDBD: mov ecx, edi
  1347. loc_006CEDBF: call ebx
  1348. loc_006CEDC1: lea ecx, var_38
  1349. loc_006CEDC4: call [00401430h] ; __vbaFreeStr
  1350. loc_006CEDCA: lea edx, var_8C
  1351. loc_006CEDD0: lea eax, var_7C
  1352. loc_006CEDD3: push edx
  1353. loc_006CEDD4: lea ecx, var_6C
  1354. loc_006CEDD7: push eax
  1355. loc_006CEDD8: lea edx, var_5C
  1356. loc_006CEDDB: push ecx
  1357. loc_006CEDDC: lea eax, var_4C
  1358. loc_006CEDDF: push edx
  1359. loc_006CEDE0: push eax
  1360. loc_006CEDE1: push 00000005h
  1361. loc_006CEDE3: call [00401050h] ; __vbaFreeVarList
  1362. loc_006CEDE9: or eax, FFFFFFFFh
  1363. loc_006CEDEC: add esp, 00000018h
  1364. loc_006CEDEF: add eax, esi
  1365. loc_006CEDF1: jo 006CEEE0h
  1366. loc_006CEDF7: mov esi, eax
  1367. loc_006CEDF9: jmp 006CED1Ch
  1368. loc_006CEDFE: mov ecx, [edi]
  1369. loc_006CEE00: push 0046E5F4h ; "&h"
  1370. loc_006CEE05: push ecx
  1371. loc_006CEE06: mov var_54, 80020004h
  1372. loc_006CEE0D: mov var_5C, 0000000Ah
  1373. loc_006CEE14: call [00401098h] ; __vbaStrCat
  1374. loc_006CEE1A: mov var_44, eax
  1375. loc_006CEE1D: push 00000001h
  1376. loc_006CEE1F: lea edx, var_5C
  1377. loc_006CEE22: push 00000001h
  1378. loc_006CEE24: lea eax, var_4C
  1379. loc_006CEE27: push edx
  1380. loc_006CEE28: push eax
  1381. loc_006CEE29: mov var_4C, 00000008h
  1382. loc_006CEE30: call [004013E4h] ; rtcBstrFromFormatVar
  1383. loc_006CEE36: mov edx, eax
  1384. loc_006CEE38: mov ecx, edi
  1385. loc_006CEE3A: call ebx
  1386. loc_006CEE3C: lea ecx, var_5C
  1387. loc_006CEE3F: lea edx, var_4C
  1388. loc_006CEE42: push ecx
  1389. loc_006CEE43: push edx
  1390. loc_006CEE44: push 00000002h
  1391. loc_006CEE46: call [00401050h] ; __vbaFreeVarList
  1392. loc_006CEE4C: add esp, 0000000Ch
  1393. loc_006CEE4F: jmp 006CEE5Dh
  1394. loc_006CEE51: mov edx, var_30
  1395. loc_006CEE54: mov ecx, KeyVal
  1396. loc_006CEE57: call [00401310h] ; __vbaStrCopy
  1397. loc_006CEE5D: mov eax, var_18
  1398. loc_006CEE60: mov var_2C, FFFFFFFFh
  1399. loc_006CEE67: push eax
  1400. loc_006CEE68: RegCloseKey(%x1v)
  1401. loc_006CEE6D: call [004010BCh] ; __vbaSetSystemError
  1402. loc_006CEE73: push 006CEEB7h
  1403. loc_006CEE78: jmp 006CEEADh
  1404. loc_006CEE7A: lea ecx, var_3C
  1405. loc_006CEE7D: lea edx, var_38
  1406. loc_006CEE80: push ecx
  1407. loc_006CEE81: push edx
  1408. loc_006CEE82: push 00000002h
  1409. loc_006CEE84: call [00401324h] ; __vbaFreeStrList
  1410. loc_006CEE8A: lea eax, var_8C
  1411. loc_006CEE90: lea ecx, var_7C
  1412. loc_006CEE93: push eax
  1413. loc_006CEE94: lea edx, var_6C
  1414. loc_006CEE97: push ecx
  1415. loc_006CEE98: lea eax, var_5C
  1416. loc_006CEE9B: push edx
  1417. loc_006CEE9C: lea ecx, var_4C
  1418. loc_006CEE9F: push eax
  1419. loc_006CEEA0: push ecx
  1420. loc_006CEEA1: push 00000005h
  1421. loc_006CEEA3: call [00401050h] ; __vbaFreeVarList
  1422. loc_006CEEA9: add esp, 00000024h
  1423. loc_006CEEAC: ret
  1424. loc_006CEEAD: lea ecx, var_30
  1425. loc_006CEEB0: call [00401430h] ; __vbaFreeStr
  1426. loc_006CEEB6: ret
  1427. loc_006CEEB7: mov eax, Me
  1428. loc_006CEEBA: push eax
  1429. loc_006CEEBB: mov edx, [eax]
  1430. loc_006CEEBD: call [edx+00000008h]
  1431. loc_006CEEC0: mov eax, arg_1C
  1432. loc_006CEEC3: mov cx, var_2C
  1433. loc_006CEEC7: mov [eax], cx
  1434. loc_006CEECA: mov eax, var_4
  1435. loc_006CEECD: mov ecx, var_14
  1436. loc_006CEED0: pop edi
  1437. loc_006CEED1: pop esi
  1438. loc_006CEED2: mov fs:[00000000h], ecx
  1439. loc_006CEED9: pop ebx
  1440. loc_006CEEDA: mov esp, ebp
  1441. loc_006CEEDC: pop ebp
  1442. loc_006CEEDD: retn 0018h
  1443. End Function