I decompiled a VB application using VB Decompiler pro. It contains the following call statements:

Call {EEF18FCD-D67D-4E3C-AA21EC9AF56F90E9}.Method_arg_B8 (global_248, CStr(var_98))

Can you please explain what does this call do?

  • The part {EEF18FCD-D67D-4E3C-AA21EC9AF56F90E9} seems to be a CLSID so it might refer to an ActiveX/COM object registered by the program. Therefore my guess would be that this is a method call on an COM object instance defined in an external DLL. If you have installed the program check your registry to which DLL the CLSID belongs to. You should find the details here HKEY_CLASSES_ROOT\CLSID\{EEF18FCD-D67D-4E3C-AA21EC9AF56F90E9}.
    – Robert
    Oct 17 '21 at 10:38
  • I checked the registry but could not find HKEY_CLASSES_ROOT\CLSID\{EEF18FCD-D67D-4E3C-AA21EC9AF56F90E9}. Then I tried to log the changes the program does to the registry upon installation. But these CLSIDs don't show up there too.
    – Krill
    Oct 17 '21 at 11:06
  • Try searching in regedit for that guid, it might be in HKCU or Wow64 part of HKCR
    – Remko
    Oct 18 '21 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.