VB Decompiler

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

NumBytes: 3
ArgStr: uc
SrcStr: |
Comments: controlindex = (arg - 760) / 4

Runtime debug:
[asm:3re0n41c]

mov   ebx, [ebp-4Ch]                ; ebx = currentObject
movzx eax, word ptr [esi]           ; eax = arg0
push  ebx                           ; save currentObject
cmp   _g_EventMonitorsEnabled, 0    ; if EventMonitors are enabled
jnz   short lblEventMonitorsEnabled
add   eax, [ebx]                    ; eax = currentObject.vtable(arg0)
call  dword ptr [eax]               ; call proc at vtable
 
lblEndProc:
  push  eax                           ; save method address
 
lblNextOpCode:
  xor   eax, eax
  mov   al, [esi+2]
  add   esi, 3
  jmp   ds:_tblByteDisp[eax*4]
 
lblEventMonitorsEnabled:
  pusha
  push  esp
  push  eax
  push  ebx
  call  _VBAEventVtableCall@12        ; VBAEventVtableCall(x,x,x)
  popa
  add   eax, [ebx]
  call  dword ptr [eax]
  pusha
  push  esp
  call  _VBAEventProcExit@4           ; VBAEventProcExit(x)
  popa
  jmp   short lblEndProc

[/asm:3re0n41c]

_aLfa_ · Posted: Tue Mar 11, 2008 10:50 am Post subject: Re: 0F VCallAd

Microsoft latest debug information file for MSVBVM60.DLL SP6 calls this opcode VCallI4.

I'd like to know why do we call it VCallAd. VCallI4 means that we get a dword as a return value (which is the address to the control vtable). There is also VCallHresult, meaning we get a Hresult as a return value, etc...

For the sake of consistency I'll stick to Microsoft naming conventions only to make my life easier when debugging.
_________________
One thing only I know, and that is that I know nothing. (Socrates)