00404DD5   . FF15 28114000 CALL DWORD PTR DS:[<&msvbvm60.__vbaFileOp>; msvbvm60.__vbaFileOpen

00404DDB   . 8D8D 5CFEFFFF LEA ECX,DWORD PTR SS:[EBP-1A4]

00404DE1   . 51         PUSH ECX

00404DE2   . 8D95 60FEFFFF LEA EDX,DWORD PTR SS:[EBP-1A0]

00404DE8   . 52         PUSH EDX

00404DE9   . 6A 02       PUSH 2

00404DEB   . FF15 48114000 CALL DWORD PTR DS:[<&msvbvm60.__vbaFreeSt>; msvbvm60.__vbaFreeStrList

00404DF1   . 83C4 0C     ADD ESP,0C

00404DF4   . 8D8D 40FEFFFF LEA ECX,DWORD PTR SS:[EBP-1C0]

00404DFA   . FF15 A8114000 CALL DWORD PTR DS:[<&msvbvm60.__vbaFreeOb>; msvbvm60.__vbaFreeObj

00404E00   . C745 FC 23000>MOV DWORD PTR SS:[EBP-4],23

00404E07   . 68 9C274000   PUSH Rundll32.0040279C             ; @echo off

00404E0C   . 6A 01       PUSH 1

00404E0E   . 68 B4274000   PUSH Rundll32.004027B4

00404E13   . FF15 F8104000 CALL DWORD PTR DS:[<&msvbvm60.__vbaPrintF>; msvbvm60.__vbaPrintFile

00404E19   . 83C4 0C     ADD ESP,0C

00404E1C   . C745 FC 24000>MOV DWORD PTR SS:[EBP-4],24

00404E23   . 68 BC274000   PUSH Rundll32.004027BC             ; sleep 100

00404E28   . 6A 01       PUSH 1

00404E2A   . 68 B4274000   PUSH Rundll32.004027B4

00404E2F   . FF15 F8104000 CALL DWORD PTR DS:[<&msvbvm60.__vbaPrintF>; msvbvm60.__vbaPrintFile

00404E35   . 83C4 0C     ADD ESP,0C

00404E38   . C745 FC 25000>MOV DWORD PTR SS:[EBP-4],25

00404E3F   . 833D A8934000>CMP DWORD PTR DS:[4093A8],0

00404E46   . 75 1C       JNZ SHORT Rundll32.00404E64

00404E48   . 68 A8934000   PUSH Rundll32.004093A8

00404E4D   . 68 94254000   PUSH Rundll32.00402594

00404E52   . FF15 30114000 CALL DWORD PTR DS:[<&msvbvm60.__vbaNew2>] ; msvbvm60.__vbaNew2

00404E58   . C785 84FCFFFF>MOV DWORD PTR SS:[EBP-37C],Rundll32.00409>

00404E62   . EB 0A       JMP SHORT Rundll32.00404E6E

00404E64   > C785 84FCFFFF>MOV DWORD PTR SS:[EBP-37C],Rundll32.00409>

00404E6E   > 8B85 84FCFFFF MOV EAX,DWORD PTR SS:[EBP-37C]

00404E74   . 8B08       MOV ECX,DWORD PTR DS:[EAX]

........

00404F1D   . 52         PUSH EDX

00404F1E   . FF15 54104000 CALL DWORD PTR DS:[<&msvbvm60.__vbaHresul>; msvbvm60.__vbaHresultCheckObj

00404F24   . 8985 7CFCFFFF MOV DWORD PTR SS:[EBP-384],EAX          

00404F2A   . EB 0A       JMP SHORT Rundll32.00404F36    

00404F2C   > C785 7CFCFFFF>MOV DWORD PTR SS:[EBP-384],0          

00404F36   > 68 D4274000   PUSH Rundll32.004027D4             ; del

00404F3B   . 8B85 60FEFFFF MOV EAX,DWORD PTR SS:[EBP-1A0]         //程序的文件名字

00404F41   . 50         PUSH EAX                         //文件名入栈 （rundll322）

00404F42   . 68 E4274000   PUSH Rundll32.004027E4             ; .exe   （rundll322.exe）

00404F47   . FF15 48104000 CALL DWORD PTR DS:[<&msvbvm60.__vbaStrCat>; msvbvm60.__vbaStrCat

00404F4D   . 8BD0       MOV EDX,EAX

00404F4F   . 8D8D 5CFEFFFF LEA ECX,DWORD PTR SS:[EBP-1A4]

00404F55   . FF15 80114000 CALL DWORD PTR DS:[<&msvbvm60.__vbaStrMov>; msvbvm60.__vbaStrMove

00404F5B   . 50         PUSH EAX

00404F5C   . FF15 48104000 CALL DWORD PTR DS:[<&msvbvm60.__vbaStrCat>; msvbvm60.__vbaStrCat

00404F62   . 8BD0       MOV EDX,EAX                       //（del rundll322.exe）    

00404F64   . 8D8D 58FEFFFF LEA ECX,DWORD PTR SS:[EBP-1A8]

00404F6A   . FF15 80114000 CALL DWORD PTR DS:[<&msvbvm60.__vbaStrMov>; msvbvm60.__vbaStrMove

00404F70   . 50         PUSH EAX

00404F71   . 6A 01       PUSH 1

00404F73   . 68 B4274000   PUSH Rundll32.004027B4

00404F78   . FF15 F8104000 CALL DWORD PTR DS:[<&msvbvm60.__vbaPrintF>; msvbvm60.__vbaPrintFile

00404F7E   . 83C4 0C     ADD ESP,0C

00404F81   . 8D8D 58FEFFFF LEA ECX,DWORD PTR SS:[EBP-1A8]

00404F87   . 51         PUSH ECX

00404F88   . 8D95 5CFEFFFF LEA EDX,DWORD PTR SS:[EBP-1A4]

00404F8E   . 52         PUSH EDX

00404F8F   . 8D85 60FEFFFF LEA EAX,DWORD PTR SS:[EBP-1A0]

00404F95   . 50         PUSH EAX

00404F96   . 6A 03       PUSH 3

00404F98   . FF15 48114000 CALL DWORD PTR DS:[<&msvbvm60.__vbaFreeSt>; msvbvm60.__vbaFreeStrList

00404F9E   . 83C4 10     ADD ESP,

10 00404FA1 . 8D8D 40FEFFFF LEA ECX,DWORD PTR SS:[EBP-1C0] 00404FA7 . FF15 A8114000 CALL DWORD PTR DS:[<&msvbvm60.__vbaFreeOb>; msvbvm60.__vbaFreeObj 00404FAD . C745 FC 26000>MOV DWORD PTR SS:[EBP-4],26 00404FB4 . 68 F4274000 PUSH Rundll32.004027F4 ; del killme.bat 00404FB9 . 6A 01 PUSH 1 00404FBB . 68 B4274000 PUSH Rundll32.004027B4 00404FC0 . FF15 F8104000 CALL DWORD PTR DS:[<&msvbvm60.__vbaPrintF>; msvbvm60.__vbaPrintFile 00404FC6 . 83C4 0C ADD ESP,0C 00404FC9 . C745 FC 27000>MOV DWORD PTR SS:[EBP-4],27 00404FD0 . 68 18284000 PUSH Rundll32.00402818 ; cls 00404FD5 . 6A 01 PUSH 1 00404FD7 . 68 B4274000 PUSH Rundll32.004027B4 00404FDC . FF15 F8104000 CALL DWORD PTR DS:[<&msvbvm60.__vbaPrintF>; msvbvm60.__vbaPrintFile 00404FE2 . 83C4 0C ADD ESP,0C 00404FE5 . C745 FC 28000>MOV DWORD PTR SS:[EBP-4],28 00404FEC . 68 24284000 PUSH Rundll32.00402824 ; exit 00404FF1 . 6A 01 PUSH 1 00404FF3 . 68 B4274000 PUSH Rundll32.004027B4 00404FF8 . FF15 F8104000 CALL DWORD PTR DS:[<&msvbvm60.__vbaPrintF>; msvbvm60.__vbaPrintFile 00404FFE . 83C4 0C ADD ESP,0C 00405001 . C745 FC 29000>MOV DWORD PTR SS:[EBP-4],29 00405008 . 6A 01 PUSH 1 0040500A . FF15 A4104000 CALL DWORD PTR DS:[<&msvbvm60.__vbaFileCl>; msvbvm60.__vbaFileClose 00405010 . C745 FC 2A000>MOV DWORD PTR SS:[EBP-4],2A 00405017 . 833D A8934000>CMP DWORD PTR DS:[4093A8],0 0040501E . 75 1C JNZ SHORT Rundll32.0040503C 00405020 . 68 A8934000 PUSH Rundll32.004093A8 00405025 . 68 94254000 PUSH Rundll32.00402594