As i commmented vb has its own set of functions
the fuction you have to look for in the 3rd crackme are
rtcMidCharVar()
vbastrvarval() ,
rtcAnsiValueBstr()
_vbavarmul()
the algo loops over the name characters
adds a constant to each
multiplies the result with another variable
and adds up all of them that is your serial
if you give the right serial you get a msgbox with password axxxxxxo
a simple keygen in powershell can look like
$b =0;$a = SOMECONSTANT;@('d','u','g','g') | % { $c= (([int][char]$_ + SOMEOTHERCONSTANT) * AVARIABLE);($b+=$c) };$b
edit ,
vb does not use registers mostly
it uses a VARIANT structure for almost all functions and uses stack
if you use windbg you can take a look at the structure with
dt ole32!VARIANT
basically it is a ten byte long structure consisting of an union
0:000> dt -v ole32!Variant
struct tagVARIANT, 50 elements, 0x10 bytes
the first member vt (SHORT int2b) indicates the variant type
the(find Wtypes.h and look for
enum VARENUM
{
VT_EMPTY = 0,
VT_NULL = 1,
VT_I2 = 2,
VT_I4 = 3,
the next 3 SHORTS are reserved
the value at 0x08 is to deciphered based on the value of vt member
the member at 0x0c is pRecInfo
the member at 0x10 is tagDec an array
now that part is clear the function __vbaVarMul Takes three Arguments of type VARIANT
the first is the result the second is multiplier the third is multiplicand
here is a redacted windbg output for char 'd'
0:000> ? poi(@esp)
Evaluate expression: 1241928 = 0012f348
0:000> ? poi(@esp+4)
Evaluate expression: 1241944 = 0012f358
0:000> ? poi(@esp+8)
Evaluate expression: 1241880 = 0012f318
0:000> dt ole32!Variant vt poi(@esp)
+0x000 vt : 0 <---- vb NULL / v_EMPTY
0:000> dt ole32!Variant vt poi(@esp+4)
+0x000 vt : 3 <-------vbLong
0:000> dt ole32!Variant vt poi(@esp+8)
+0x000 vt : 2 <-----vbInt
0:000> .enable_long_status 1
0:000> dt ole32!Variant lVal poi(@esp)
+0x008 lVal : 0x12f3f0
0:000> dt ole32!Variant lVal poi(@esp+4)
+0x008 lVal : 0xxx
0:000> dt ole32!Variant lVal poi(@esp+8)
+0x008 lVal : 0xxxx
0:000> ? 'd' + xxx
Evaluate expression: xxxx = 00000xxx