Valhalla Legends Archive

Thank for the input. I was able to decode the parameter yesterday only. I looked at one of the calls and as per that there was only one PUSH so i knew that it takes only one parameter. The problem was that the function protoype was something like this

char * Func(char *)

now i was using VB and just because of it own interference in the way it calls APIs i was not able to make the function call successful. So i had to declare both the input and return value as long instead of strings and then pass the pointer to a string. I had to play around with that a bit and crashed my VB session many times. But in the end i was able to make it work. The funny part was that it takes the input as a normal string and returns a unicode string while i was doing vice versa from last so many days and that was the reason i was thinking that it might have some more parameter or the input might be a structure. Thats why i though it would be better to take help from experts.

Thanks everyone.

Well it encrypts/decrypts strings

there are 2 function in the DLL one for encryot and one for decrypt. I am more intersted in using the decrypt.

I am trying to call a exported function from a DLL in VB6. I dont know the arguments needed for the call. It is used to decrypt a string from encryted form to normal. The function uses __stdCall calling conventions.

Here is what start of exported function looks like

.text:6415200F XXXFunc proc near
.text:6415200F
.text:6415200F cchWideChar     = dword ptr -8
.text:6415200F var_4           = dword ptr -4
.text:6415200F lpWideCharStr   = dword ptr  8
.text:6415200F
.text:6415200F                 push    ebp
.text:64152010                 mov     ebp, esp
.text:64152012                 push    ecx
.text:64152013                 push    ecx
.text:64152014                 push    ebx
.text:64152015                 xor     ebx, ebx


and Here is return code


.text:641520EC                 pop     edi
.text:641520ED                 pop     esi
.text:641520EE                 pop     ebx
.text:641520EF                 leave
.text:641520F0                 retn    4


I dont have much/any knowledge about assembly language to understand the arguments from the stack. Can some one guide me on this?