title: Understand VB6 disassemble code
body: <p>I have an old VB executable that has been used for a long time in my project. 
  The current implementation of the application contains a debug window that's 
  not needed any more.</p>
  
  <p>Of course, the source code was lost and can not be modified.
  My idea is to modify the HEX code of the instance that's opening the annoying debug window. </p>
  
  <p>For that purpose, I use VB Decompiler by DotFix software, and I suppose that I found the code responsible for that instance. Unfortunately, I can't understand how it works. </p>
  
  <p>Let's see the disassemble code: </p>
  
  <pre><code>  loc_8F420C: var_8A = 0
    loc_8F4219: If (Len(var_88) = &amp;H30) Then
    loc_8F4225:   Call {3014B1BF-8A2C-23D7-B50400C24F280C20}.Method_arg_12 (var_88)
    loc_8F4233:   Call {3014B1BF-8A2C-23D7-B50400C24F280C20}.Method_arg_16 (var_108)
    loc_8F423D:   If CBool(var_108) Then
    loc_8F424D:     Me.Global.Unload Me
    loc_8F4258:   Else
    loc_8F425A:     var_8A = &amp;HFF    
                    ...
    loc_8F43B0:   End If
    loc_8F43B3: Else
  </code></pre>
  
  <p>At the first sight <strong><code>var_108</code></strong> seems a bool variable that is the one setting the debug window. Can I implicitly put in <strong><code>loc_8F423D: If CBool(false/true) Then</code></strong> to stop this window from launching? </p>
  
  <p>Can anyone explain to me what are those <strong><code>Call {#######-####-####-################}.Method_arg_##</code></strong> from above?</p>
  
  <pre><code>PEiD detect compiler:
  Microsoft Visual Basic 5.0 / 6.0 [Overlay]
  </code></pre>
  
  <p><strong>Part 2:</strong>
  It took me a long time to get the new idea - the right one, possibly. Let's take a look at the assembly code:</p>
  
  <pre><code>004F420C: 70   FStI2 var_8A &lt;- loc_8F420C: var_8A = 0
  </code></pre>
  
  <p>Looks like <code>loc_8F4219: If (Len(var_88) = &amp;H30) Then</code></p>
  
  <pre><code>004F420F: 6C   ILdRf var_88
  004F4212: 4A   FnLenStr Len()
  004F4213: F5   LitI4: 48 (0x30)
  </code></pre>
  
  <p>Let's find the next code snippets:</p>
  
  <pre><code>004F4218: C7   EqI4 =
  004F4219: 1C   BranchF 004F43B3
  </code></pre>
  
  <p>Our Call methods looks like :</p>
  
  <pre><code>004F421C: 6C   ILdRf var_88 &lt; - (var_88) from Call
  004F421F: 22   ImpAdLdPr
  004F4222: 58   MemLdPr
  004F4225: 0D   VCallHresult  var_88.vtable[12] &lt;- Method_arg_12
  004F422A: 04   FLdRfVar var_108 &lt;- (var_108) possible CALL/BACK
  004F422D: 22   ImpAdLdPr
  004F4230: 58   MemLdPr
  004F4233: 0D   VCallHresult  var_108.vtable[16] &lt;- Method_arg_16
  004F4238: 6C   ILdRf var_108 &lt;- (var_108) 70% sure is RESPONSE(true/false)
  </code></pre>
  
  <p>And now the most interesting parts of that annoying P-Code&amp;Assembly, we find the if instance that verifies if the Debug Windows is needed. If we look at P-Code we can see that if has the form:</p>
  
  <pre><code>loc_8F423D:   If CBool(var_108) Then
  loc_8F424D:     Me.Global.Unload Me
  loc_8F4258:   Else
  loc_8F425A:     var_8A = &amp;HFF
  </code></pre>
  
  <p>And now look at the Address - if is true execute address <strong>00F424D / 8F424D</strong> else jump outside to <strong>004F4258</strong></p>
  
  <pre><code>004F423B: FC52 CBoolI4
  004F423D: 1C   BranchF 004F4258
  004F4240: 6C   ILdRf param_8
  004F4243: FD9C FStAdNoPop
  004F4247: 05   ImpAdLdRf
  004F424A: 24   NewIfNullPr GLOBAL
  004F424D: 0D   VCallHresult Global._Unload(object As IDispatch)
  004F4252: 1A   FFree1Ad var_90
  004F4255: 1E   Branch 004F43B0
  004F4258: loc_004F423D
  004F4258: F4   LitI2_Byte: 255 (True)
  </code></pre>
  
  <p>Possibly, if I change the <code>004F423D: 1C   BranchF 004F4258</code> so that it points to another address <code>004F424D</code>, logically that might do the trick.</p>
  
  <blockquote>
    <p><code>004F423D: 1C   BranchF 004F424D</code></p>
  </blockquote>
  
  <hr>
  
  <p>Now I'm trying to find that address with <strong>OllyDbg</strong> - to test if that helps. If I succeed I will write part 3.</p>
  
  <p>Does anyone have some other ideas?</p>