the cyber dung
my notepad on infosec, malware research, reverse engineering, coding, and more dung.

Thursday, February 14, 2013

Breaking MSVBVM60.DLL

Reversing Visual Basic compiled executable requires some sort of understanding of its native code APIs. These can be found in the Language Extension DLL. In Visual Basic 6.0, the library used was MSVBVM60.DLL. Older versions use MSBVBM50.DLL.

However, with the introduction of the .NET framework, new versions of Visual Basic compiled programs runs through the CLR (Common Language Runtime). Unlike those compiled in VB6, these new versions can only be set as a standalone program if they are bundled in an installer containing the .NET redistributable package.

With this in mind, malware authors would rather choose VB6 since not all Windows users have .NET framework installed.

The Visual Basic Executable
 A Visual Basic program can be compiled in Native or P-code format. The starting code can start from either Form_Load or Sub_Main module. These properties can all be found in the VB Structure. A partial detail about this can be found in Alex Ionescu's paper (http://www.alex-ionescu.com/vb.pdf). You can also use an IDA Pro IDC script to parse the VB executable binary which can be found at http://www.hex-rays.com/products/ida/support/freefiles/vb.idc.

MSVBVM60.DLL
The Visual Basic library is responsible for interpreting the VB p-code back to its native APIs. While the libraries contain modules that communicates with system wide libraries like KERNEL32.DLL and USER32.DLL.

The exports and symbol outputs are based on this library version:


Here is a list of exported APIs that I grabbed using dependency:

***************************| Module Dependency Tree |***************************
*                                                                              *
* Legend: F  Forwarded Module   ?  Missing Module        6  64-bit Module      *
*         D  Delay Load Module  !  Invalid Module                              *
*         *  Dynamic Module     E  Import/Export Mismatch or Load Failure      *
*                               ^  Duplicate Module                            *
*                                                                              *
*         O  Ordinal Function   E  Import/Export Error   F  Forwarded Function *
*         C  C Function         R  Called At Least Once  *  Dynamic Function   *
*         +  C++ Function                                                      *
*                                                                              *
********************************************************************************

[   ] MSVBVM60.DLL

     Import  Ordinal        Hint          Function                            Entry Point
     ------  -------------  ------------  ----------------------------------  -----------

     Export  Ordinal        Hint          Function                            Entry Point
     ------  -------------  ------------  ----------------------------------  -----------
     [C  ]    100 (0x0064)   60 (0x003C)  ThunRTMain                          0x000035A4
     [C  ]    101 (0x0065)   73 (0x0049)  VBDllUnRegisterServer               0x00093CBF
     [C  ]    102 (0x0066)   70 (0x0046)  VBDllCanUnloadNow                   0x00093A6B
     [C  ]    103 (0x0067)   72 (0x0048)  VBDllRegisterServer                 0x00093C37
     [C  ]    104 (0x0068)   71 (0x0047)  VBDllGetClassObject                 0x00093AE2
     [C  ]    105 (0x0069)   69 (0x0045)  UserDllMain                         0x000938F7
     [C  ]    106 (0x006A)   13 (0x000D)  DllRegisterServer                   0x000C6043
     [C  ]    107 (0x006B)   14 (0x000E)  DllUnregisterServer                 0x000C6221
     [C  ]    108 (0x006C)   94 (0x005E)  __vbaAryLock                        0x000DC6D9
     [C  ]    109 (0x006D)  102 (0x0066)  __vbaBoolErrVar                     0x000E1A88
     [C  ]    110 (0x006E)  296 (0x0128)  __vbaRedimVar2                      0x000DC3AC
     [C  ]    111 (0x006F)  314 (0x013A)  __vbaStrErrVarCopy                  0x000E1A7C
     [C  ]    112 (0x0070)  368 (0x0170)  __vbaVarLateMemCallLd               0x00108D8C
     [C  ]    113 (0x0071)  369 (0x0171)  __vbaVarLateMemCallLdRf             0x00108DA8
     [C  ]    114 (0x0072)  370 (0x0172)  __vbaVarLateMemCallSt               0x00108DE2
     [C  ]    115 (0x0073)  371 (0x0173)  __vbaVarLateMemSt                   0x00108DC7
     [C  ]    116 (0x0074)  372 (0x0174)  __vbaVarLateMemStAd                 0x00108DFD
     [C  ]    117 (0x0075)  101 (0x0065)  __vbaAryVarVarg                     0x001074E4
     [C  ]    118 (0x0076)  162 (0x00A2)  __vbaFpCDblR4                       0x0010761B
     [C  ]    119 (0x0077)  163 (0x00A3)  __vbaFpCDblR8                       0x0010761B
     [C  ]    120 (0x0078)  164 (0x00A4)  __vbaFpCSngR4                       0x00107604
     [C  ]    121 (0x0079)  165 (0x00A5)  __vbaFpCSngR8                       0x00107604
     [C  ]    122 (0x007A)  166 (0x00A6)  __vbaFpCmpCy                        0x00107632
     [C  ]    123 (0x007B)  167 (0x00A7)  __vbaFpCy                           0x001075AF
     [C  ]    124 (0x007C)  168 (0x00A8)  __vbaFpI2                           0x00107559
     [C  ]    125 (0x007D)  169 (0x00A9)  __vbaFpI4                           0x00107570
     [C  ]    126 (0x007E)  170 (0x00AA)  __vbaFpR4                           0x00107587
     [C  ]    127 (0x007F)  171 (0x00AB)  __vbaFpR8                           0x0010759B
     [C  ]    128 (0x0080)  172 (0x00AC)  __vbaFpUI1                          0x00107534
     [C  ]    129 (0x0081)  173 (0x00AD)  __vbaFreeObj                        0x000D9FAF
     [C  ]    130 (0x0082)  175 (0x00AF)  __vbaFreeStr                        0x000E6BEC
     [C  ]    131 (0x0083)  177 (0x00B1)  __vbaFreeVar                        0x00106831
     [C  ]    132 (0x0084)  179 (0x00B3)  __vbaFreeVarg                       0x00106A0A
     [C  ]    133 (0x0085)  193 (0x00C1)  __vbaI2Abs                          0x000E4CDA
     [C  ]    134 (0x0086)  197 (0x00C5)  __vbaI2I4                           0x000E1A08
     [C  ]    135 (0x0087)  198 (0x00C6)  __vbaI2Sgn                          0x000E4D2C
     [C  ]    136 (0x0088)  201 (0x00C9)  __vbaI4Abs                          0x000E4D03
     [C  ]    137 (0x0089)  205 (0x00CD)  __vbaI4Sgn                          0x000E4D44
     [C  ]    138 (0x008A)  311 (0x0137)  __vbaStrCopy                        0x000E6C4A
     [C  ]    139 (0x008B)  319 (0x013F)  __vbaStrMove                        0x000E6C30
     [C  ]    140 (0x008C)  332 (0x014C)  __vbaUI1I2                          0x000E19DC
     [C  ]    141 (0x008D)  333 (0x014D)  __vbaUI1I4                          0x000E19F2
     [C  ]    142 (0x008E)  334 (0x014E)  __vbaUI1Sgn                         0x000E4D19
     [C  ]    143 (0x008F)  351 (0x015F)  __vbaVarCopy                        0x00106BB8
     [C  ]    144 (0x0090)  354 (0x0162)  __vbaVarDup                         0x00106DF6
     [C  ]    145 (0x0091)  376 (0x0178)  __vbaVarMove                        0x00106AEE
     [C  ]    146 (0x0092)  409 (0x0199)  __vbaVarVargNofree                  0x0010728D
     [C  ]    147 (0x0093)  411 (0x019B)  __vbaVarZero                        0x00106EA2
     [C  ]    148 (0x0094)  414 (0x019E)  __vbaVargParmRef                    0x001072B1
     [C  ]    149 (0x0095)  417 (0x01A1)  __vbaVargVar                        0x001072BE
     [C  ]    150 (0x0096)  418 (0x01A2)  __vbaVargVarCopy                    0x00107340
     [C  ]    151 (0x0097)  419 (0x01A3)  __vbaVargVarMove                    0x00107330
     [C  ]    152 (0x0098)  420 (0x01A4)  __vbaVargVarRef                     0x00107301
     [C  ]    153 (0x0099)    9 (0x0009)  DLLGetDocumentation                 0x000C632E
     [C  ]    154 (0x009A)   10 (0x000A)  DllCanUnloadNow                     0x0009FCB2
     [C  ]    155 (0x009B)   12 (0x000C)  DllGetClassObject                   0x0009FC2D
     [C  ]    156 (0x009C)   82 (0x0052)  _CIatan                             0x000F92C0
     [C  ]    157 (0x009D)   83 (0x0053)  _CIcos                              0x000F9386
     [C  ]    158 (0x009E)   84 (0x0054)  _CIexp                              0x000EDD11
     [C  ]    159 (0x009F)   85 (0x0055)  _CIlog                              0x000F942B
     [C  ]    160 (0x00A0)   86 (0x0056)  _CIsin                              0x000F94EE
     [C  ]    161 (0x00A1)   87 (0x0057)  _CIsqrt                             0x000F9593
     [C  ]    162 (0x00A2)   88 (0x0058)  _CItan                              0x000F9644
     [C  ]    163 (0x00A3)   89 (0x0059)  __vbaAptOffset                      0x000D686A
     [C  ]    164 (0x00A4)   91 (0x005B)  __vbaAryConstruct2                  0x000DC6AE
     [C  ]    165 (0x00A5)   90 (0x005A)  __vbaAryConstruct                   0x000DC694
     [C  ]    166 (0x00A6)   92 (0x005C)  __vbaAryCopy                        0x000CC20D
     [C  ]    167 (0x00A7)   93 (0x005D)  __vbaAryDestruct                    0x000DC1FE
     [C  ]    168 (0x00A8)   95 (0x005F)  __vbaAryMove                        0x000CC244
     [C  ]    169 (0x00A9)   96 (0x0060)  __vbaAryRebase1Var                  0x000DC083
     [C  ]    170 (0x00AA)   97 (0x0061)  __vbaAryRecCopy                     0x000CC27B
     [C  ]    171 (0x00AB)   98 (0x0062)  __vbaAryRecMove                     0x000CC2F8
     [C  ]    172 (0x00AC)   99 (0x0063)  __vbaAryUnlock                      0x000DC6FC
     [C  ]    173 (0x00AD)  100 (0x0064)  __vbaAryVar                         0x00103940
     [C  ]    174 (0x00AE)  103 (0x0067)  __vbaBoolStr                        0x000E0FED
     [C  ]    175 (0x00AF)  104 (0x0068)  __vbaBoolVar                        0x000E0D73
     [C  ]    176 (0x00B0)  105 (0x0069)  __vbaBoolVarNull                    0x00107185
     [C  ]    177 (0x00B1)  106 (0x006A)  __vbaCVarAryUdt                     0x000DC146
     [C  ]    178 (0x00B2)  107 (0x006B)  __vbaCastObj                        0x00105DED
     [C  ]    179 (0x00B3)  108 (0x006C)  __vbaCastObjVar                     0x000DA17B
     [C  ]    180 (0x00B4)  109 (0x006D)  __vbaCheckType                      0x000D9609
     [C  ]    181 (0x00B5)  110 (0x006E)  __vbaCheckTypeVar                   0x000D9656
     [C  ]    182 (0x00B6)  111 (0x006F)  __vbaChkstk                         0x000F62EA
     [C  ]    183 (0x00B7)  112 (0x0070)  __vbaCopyBytes                      0x000DA0F3
     [C  ]    184 (0x00B8)  113 (0x0071)  __vbaCopyBytesZero                  0x000DA118
     [C  ]    185 (0x00B9)  114 (0x0072)  __vbaCyAbs                          0x000E9833
     [C  ]    186 (0x00BA)   46 (0x002E)  ProcCallEngine                      0x000FD05D
     [C  ]    187 (0x00BB)   11 (0x000B)  DllFunctionCall                     0x0000A0FD
     [C  ]    188 (0x00BC)  115 (0x0073)  __vbaCyAdd                          0x000E976A
     [C  ]    189 (0x00BD)  116 (0x0074)  __vbaCyErrVar                       0x000E4E36
     [C  ]    190 (0x00BE)    7 (0x0007)  CopyRecord                          0x000DB749
     [C  ]    191 (0x00BF)  117 (0x0075)  __vbaCyFix                          0x000E96C9
     [C  ]    192 (0x00C0)  118 (0x0076)  __vbaCyForInit                      0x00109410
     [C  ]    193 (0x00C1)  119 (0x0077)  __vbaCyForNext                      0x00109438
     [C  ]    194 (0x00C2)  120 (0x0078)  __vbaCyI2                           0x000E199F
     [C  ]    195 (0x00C3)   63 (0x003F)  TipGetAddressOfPredeclaredInstance  0x000CEA97
     [C  ]    196 (0x00C4)  121 (0x0079)  __vbaCyI4                           0x000E19B1
     [C  ]    197 (0x00C5)  122 (0x007A)  __vbaCyInt                          0x000E96F9
     [C  ]    198 (0x00C6)  123 (0x007B)  __vbaCyMul                          0x000E9794
     [C  ]    199 (0x00C7)   45 (0x002D)  MethCallEngine                      0x00103B68
     [C  ]    200 (0x00C8)  124 (0x007C)  __vbaCyMulI2                        0x000E9674
     [C  ]    201 (0x00C9)  125 (0x007D)  __vbaCySgn                          0x000E4DC7
     [C  ]    202 (0x00CA)  126 (0x007E)  __vbaCyStr                          0x000E1189
     [C  ]    203 (0x00CB)  127 (0x007F)  __vbaCySub                          0x000E977F
     [C  ]    204 (0x00CC)  128 (0x0080)  __vbaCyUI1                          0x000E198D
     [C  ]    205 (0x00CD)  129 (0x0081)  __vbaCyVar                          0x000E4E3D
     [C  ]    206 (0x00CE)  130 (0x0082)  __vbaDateR4                         0x000E1A1E
     [C  ]    207 (0x00CF)  131 (0x0083)  __vbaDateR8                         0x000E1A50
     [C  ]    208 (0x00D0)  132 (0x0084)  __vbaDateStr                        0x000E111B
     [C  ]    209 (0x00D1)  133 (0x0085)  __vbaDateVar                        0x000E0D16
     [C  ]    210 (0x00D2)  134 (0x0086)  __vbaDerefAry                       0x000DC292
     [C  ]    211 (0x00D3)  135 (0x0087)  __vbaDerefAry1                      0x000DC254
     [C  ]    212 (0x00D4)  136 (0x0088)  __vbaEnd                            0x000CBE88
     [C  ]    213 (0x00D5)  137 (0x0089)  __vbaErase                          0x000DC0FD
     [C  ]    214 (0x00D6)  138 (0x008A)  __vbaEraseKeepData                  0x000DC117
     [C  ]    215 (0x00D7)  139 (0x008B)  __vbaEraseNoPop                     0x000DC1DA
     [C  ]    216 (0x00D8)  140 (0x008C)  __vbaError                          0x000CE84E
     [C  ]    217 (0x00D9)  141 (0x008D)  __vbaErrorOverflow                  0x000CE867
     [C  ]    218 (0x00DA)  142 (0x008E)  __vbaExceptHandler                  0x000E47DF
     [C  ]    219 (0x00DB)  143 (0x008F)  __vbaExitEachAry                    0x00106424
     [C  ]    220 (0x00DC)   66 (0x0042)  TipSetOption                        0x000CBD77
     [C  ]    221 (0x00DD)  144 (0x0090)  __vbaExitEachColl                   0x00106446
     [C  ]    222 (0x00DE)  145 (0x0091)  __vbaExitEachVar                    0x00106404
     [C  ]    223 (0x00DF)  146 (0x0092)  __vbaExitProc                       0x000E4A48
     [C  ]    224 (0x00E0)  147 (0x0093)  __vbaFPException                    0x00107513
     [C  ]    225 (0x00E1)  148 (0x0094)  __vbaFPFix                          0x000E9758
     [C  ]    226 (0x00E2)  149 (0x0095)  __vbaFPInt                          0x000E9821
     [C  ]    227 (0x00E3)   68 (0x0044)  TipUnloadProject                    0x0000CF4C
     [C  ]    228 (0x00E4)  150 (0x0096)  __vbaFailedFriend                   0x000CBE92
     [C  ]    229 (0x00E5)  151 (0x0097)  __vbaFileClose                      0x000D417D
     [C  ]    230 (0x00E6)   62 (0x003E)  TipCreateInstanceProject2           0x000CE91E
     [C  ]    231 (0x00E7)   32 (0x0020)  EbResetProject                      0x0000CA68
     [C  ]    232 (0x00E8)   25 (0x0019)  EbGetHandleOfExecutingProject       0x000CEB1C
     [C  ]    233 (0x00E9)  152 (0x0098)  __vbaFileCloseAll                   0x000D4191
     [C  ]    234 (0x00EA)  153 (0x0099)  __vbaFileLock                       0x000E6738
     [C  ]    235 (0x00EB)  154 (0x009A)  __vbaFileOpen                       0x000D3D10
     [C  ]    236 (0x00EC)  155 (0x009B)  __vbaFileSeek                       0x000E54CB
     [C  ]    237 (0x00ED)  156 (0x009C)  __vbaFixstrConstruct                0x000E9618
     [C  ]    238 (0x00EE)  157 (0x009D)  __vbaForEachAry                     0x00106294
     [C  ]    239 (0x00EF)  158 (0x009E)  __vbaForEachCollAd                  0x00105FB3
     [C  ]    240 (0x00F0)  159 (0x009F)  __vbaForEachCollObj                 0x0010606C
     [C  ]    241 (0x00F1)  160 (0x00A0)  __vbaForEachCollVar                 0x00105ECE
     [C  ]    242 (0x00F2)  161 (0x00A1)  __vbaForEachVar                     0x00106315
     [C  ]    243 (0x00F3)  174 (0x00AE)  __vbaFreeObjList                    0x000D9FC3
     [C  ]    244 (0x00F4)  176 (0x00B0)  __vbaFreeStrList                    0x000E6C01
     [C  ]    245 (0x00F5)  178 (0x00B2)  __vbaFreeVarList                    0x00107262
     [C  ]    246 (0x00F6)  180 (0x00B4)  __vbaGenerateBoundsError            0x000DC410
     [C  ]    247 (0x00F7)  181 (0x00B5)  __vbaGet3                           0x000E56DE
     [C  ]    248 (0x00F8)  182 (0x00B6)  __vbaGet4                           0x000E5715
     [C  ]    249 (0x00F9)  183 (0x00B7)  __vbaGetFxStr3                      0x000E57C2
     [C  ]    250 (0x00FA)  184 (0x00B8)  __vbaGetFxStr4                      0x000E57F6
     [C  ]    251 (0x00FB)  185 (0x00B9)  __vbaGetOwner3                      0x000E5750
     [C  ]    252 (0x00FC)  186 (0x00BA)  __vbaGetOwner4                      0x000E5787
     [C  ]    253 (0x00FD)  187 (0x00BB)  __vbaGosub                          0x00103BD6
     [C  ]    254 (0x00FE)  188 (0x00BC)  __vbaGosubFree                      0x00103C2A
     [C  ]    255 (0x00FF)  189 (0x00BD)  __vbaGosubReturn                    0x00103BFF
     [C  ]    256 (0x0100)  190 (0x00BE)  __vbaHresultCheck                   0x000DA266
     [C  ]    257 (0x0101)  191 (0x00BF)  __vbaHresultCheckNonvirt            0x000DA2B9
     [C  ]    258 (0x0102)  192 (0x00C0)  __vbaHresultCheckObj                0x000DA274
     [C  ]    259 (0x0103)  194 (0x00C2)  __vbaI2Cy                           0x001075E0
     [C  ]    260 (0x0104)  195 (0x00C3)  __vbaI2ErrVar                       0x000E4E1A
     [C  ]    261 (0x0105)  196 (0x00C4)  __vbaI2ForNextCheck                 0x001094B0
     [C  ]    262 (0x0106)  199 (0x00C7)  __vbaI2Str                          0x000E102D
     [C  ]    263 (0x0107)  200 (0x00C8)  __vbaI2Var                          0x000E4E21
     [C  ]    264 (0x0108)  202 (0x00CA)  __vbaI4Cy                           0x001075F2
     [C  ]    265 (0x0109)   33 (0x0021)  EbResetProjectNormal                0x0000AD6B
     [C  ]    266 (0x010A)   67 (0x0043)  TipUnloadInstance                   0x000CBBF6
     [C  ]    267 (0x010B)  203 (0x00CB)  __vbaI4ErrVar                       0x000E4E28
     [C  ]    268 (0x010C)   29 (0x001D)  EbLibraryLoad                       0x00003259
     [C  ]    269 (0x010D)   30 (0x001E)  EbLibraryUnload                     0x000CCDCF
     [C  ]    270 (0x010E)  204 (0x00CC)  __vbaI4ForNextCheck                 0x001094D8
     [C  ]    271 (0x010F)   31 (0x001F)  EbLoadRunTime                       0x00008EE2
     [C  ]    272 (0x0110)  206 (0x00CE)  __vbaI4Str                          0x000E105E
     [C  ]    273 (0x0111)  207 (0x00CF)  __vbaI4Var                          0x000E4E2F
     [C  ]    274 (0x0112)   22 (0x0016)  EbCreateContext                     0x000067B7
     [C  ]    275 (0x0113)   23 (0x0017)  EbDestroyContext                    0x0000E505
     [C  ]    276 (0x0114)   34 (0x0022)  EbSetContextWorkerThread            0x000067F8
     [C  ]    277 (0x0115)  208 (0x00D0)  __vbaInStr                          0x0000A296
     [C  ]    278 (0x0116)  209 (0x00D1)  __vbaInStrB                         0x000E74C2
     [C  ]    279 (0x0117)  210 (0x00D2)  __vbaInStrVar                       0x000E738D
     [C  ]    280 (0x0118)  211 (0x00D3)  __vbaInStrVarB                      0x000E7258
     [C  ]    281 (0x0119)  212 (0x00D4)  __vbaInputFile                      0x000D3C58
     [C  ]    282 (0x011A)  213 (0x00D5)  __vbaLateIdCall                     0x00108B74
     [C  ]    283 (0x011B)  214 (0x00D6)  __vbaLateIdCallLd                   0x00108B25
     [C  ]    284 (0x011C)   24 (0x0018)  EbGetErrorInfo                      0x000CC5DE
     [C  ]    285 (0x011D)  215 (0x00D7)  __vbaLateIdCallSt                   0x00108B5D
     [C  ]    286 (0x011E)  216 (0x00D8)  __vbaLateIdNamedCall                0x00108C07
     [C  ]    287 (0x011F)  217 (0x00D9)  __vbaLateIdNamedCallLd              0x00108BBF
     [C  ]    288 (0x0120)  218 (0x00DA)  __vbaLateIdNamedCallSt              0x00108BE7
     [C  ]    289 (0x0121)  219 (0x00DB)  __vbaLateIdNamedStAd                0x00108C2B
     [C  ]    290 (0x0122)  220 (0x00DC)  __vbaLateIdSt                       0x00108B44
     [C  ]    291 (0x0123)  221 (0x00DD)  __vbaLateIdStAd                     0x00108BA6
     [C  ]    292 (0x0124)  222 (0x00DE)  __vbaLateMemCall                    0x00108CB8
     [C  ]    293 (0x0125)  223 (0x00DF)  __vbaLateMemCallLd                  0x00108C4D
     [C  ]    294 (0x0126)  224 (0x00E0)  __vbaLateMemCallSt                  0x00108C98
     [C  ]    295 (0x0127)  225 (0x00E1)  __vbaLateMemNamedCall               0x00108D46
     [C  ]    296 (0x0128)  226 (0x00E2)  __vbaLateMemNamedCallLd             0x00108CFE
     [C  ]    297 (0x0129)  227 (0x00E3)  __vbaLateMemNamedCallSt             0x00108D26
     [C  ]    298 (0x012A)   28 (0x001C)  EbIsProjectOnStack                  0x0000CA4B
     [C  ]    299 (0x012B)   61 (0x003D)  TipCreateInstanceEx                 0x000CBC56
     [C  ]    300 (0x012C)   36 (0x0024)  GetMem2                             0x000F5E10
     [C  ]    301 (0x012D)   37 (0x0025)  GetMem4                             0x000F5E23
     [C  ]    302 (0x012E)   38 (0x0026)  GetMem8                             0x000F5E34
     [C  ]    303 (0x012F)   42 (0x002A)  GetMemStr                           0x000F5E66
     [C  ]    304 (0x0130)   43 (0x002B)  GetMemVar                           0x000F5EA0
     [C  ]    305 (0x0131)   41 (0x0029)  GetMemObj                           0x000F5E4B
     [C  ]    306 (0x0132)   48 (0x0030)  PutMem2                             0x000F5F49
     [C  ]    307 (0x0133)   49 (0x0031)  PutMem4                             0x000F5F5A
     [C  ]    308 (0x0134)   50 (0x0032)  PutMem8                             0x000F5F69
     [C  ]    309 (0x0135)   54 (0x0036)  PutMemStr                           0x000F604F
     [C  ]    310 (0x0136)   55 (0x0037)  PutMemVar                           0x000F6096
     [C  ]    311 (0x0137)   53 (0x0035)  PutMemObj                           0x000F5F7F
     [C  ]    312 (0x0138)   59 (0x003B)  SetMemVar                           0x000F61D8
     [C  ]    313 (0x0139)   58 (0x003A)  SetMemObj                           0x000F61B1
     [C  ]    314 (0x013A)   40 (0x0028)  GetMemNewObj                        0x000F5EBF
     [C  ]    315 (0x013B)   52 (0x0034)  PutMemNewObj                        0x000F6149
     [C  ]    316 (0x013C)   57 (0x0039)  SetMemNewObj                        0x000F6266
     [C  ]    317 (0x013D)   35 (0x0023)  GetMem1                             0x000F5DFF
     [C  ]    318 (0x013E)   47 (0x002F)  PutMem1                             0x000F5F3A
     [C  ]    319 (0x013F)   39 (0x0027)  GetMemEvent                         0x000F5F1F
     [C  ]    320 (0x0140)   51 (0x0033)  PutMemEvent                         0x000F61A1
     [C  ]    321 (0x0141)   56 (0x0038)  SetMemEvent                         0x000F6276
     [C  ]    322 (0x0142)  228 (0x00E4)  __vbaLateMemNamedStAd               0x00108D6A
     [C  ]    323 (0x0143)  229 (0x00E5)  __vbaLateMemSt                      0x00108C75
     [C  ]    324 (0x0144)  230 (0x00E6)  __vbaLateMemStAd                    0x00108CDC
     [C  ]    325 (0x0145)  231 (0x00E7)  __vbaLbound                         0x000DC628
     [C  ]    326 (0x0146)  232 (0x00E8)  __vbaLdZeroAry                      0x00103988
     [C  ]    327 (0x0147)  233 (0x00E9)  __vbaLenBstr                        0x000E6A9B
     [C  ]    328 (0x0148)  234 (0x00EA)  __vbaLenBstrB                       0x000E6C7F
     [C  ]    329 (0x0149)  235 (0x00EB)  __vbaLenVar                         0x000E6AAB
     [C  ]    330 (0x014A)  236 (0x00EC)  __vbaLenVarB                        0x000E6B1A
     [C  ]    331 (0x014B)  237 (0x00ED)  __vbaLineInputStr                   0x000D2EC9
     [C  ]    332 (0x014C)  238 (0x00EE)  __vbaLineInputVar                   0x000D2FA3
     [C  ]    333 (0x014D)  239 (0x00EF)  __vbaLsetFixstr                     0x000E76E5
     [C  ]    334 (0x014E)  240 (0x00F0)  __vbaLsetFixstrFree                 0x000E77F3
     [C  ]    335 (0x014F)  241 (0x00F1)  __vbaMidStmtBstr                    0x000E7C22
     [C  ]    336 (0x0150)  242 (0x00F2)  __vbaMidStmtBstrB                   0x000E7CF4
     [C  ]    337 (0x0151)  243 (0x00F3)  __vbaMidStmtVar                     0x000E7C4C
     [C  ]    338 (0x0152)  244 (0x00F4)  __vbaMidStmtVarB                    0x000E7C73
     [C  ]    339 (0x0153)  245 (0x00F5)  __vbaNameFile                       0x000D6402
     [C  ]    340 (0x0154)  247 (0x00F7)  __vbaNew2                           0x000DA237
     [C  ]    341 (0x0155)  246 (0x00F6)  __vbaNew                            0x000DA204
     [C  ]    342 (0x0156)  248 (0x00F8)  __vbaNextEachAry                    0x00106119
     [C  ]    343 (0x0157)  249 (0x00F9)  __vbaNextEachCollAd                 0x00106011
     [C  ]    344 (0x0158)  250 (0x00FA)  __vbaNextEachCollObj                0x001060C4
     [C  ]    345 (0x0159)  251 (0x00FB)  __vbaNextEachCollVar                0x00105F13
     [C  ]    346 (0x015A)  252 (0x00FC)  __vbaNextEachVar                    0x001063BC
     [C  ]    347 (0x015B)  253 (0x00FD)  __vbaObjAddref                      0x000D9F9A
     [C  ]    348 (0x015C)  254 (0x00FE)  __vbaObjIs                          0x000D96C8
     [C  ]    349 (0x015D)  255 (0x00FF)  __vbaObjSet                         0x000D9FF1
     [C  ]    350 (0x015E)  256 (0x0100)  __vbaObjSetAddref                   0x000DA008
     [C  ]    351 (0x015F)  257 (0x0101)  __vbaObjVar                         0x000DA1A9
     [C  ]    352 (0x0160)  258 (0x0102)  __vbaOnError                        0x000E499D
     [C  ]    353 (0x0161)  259 (0x0103)  __vbaOnGoCheck                      0x000CC357
     [C  ]    354 (0x0162)  260 (0x0104)  __vbaPowerR8                        0x000E11CA
     [C  ]    355 (0x0163)  261 (0x0105)  __vbaPrintFile                      0x000D50A3
     [C  ]    356 (0x0164)  262 (0x0106)  __vbaPrintObj                       0x000D5041
     [C  ]    357 (0x0165)  263 (0x0107)  __vbaPut3                           0x000E56FA
     [C  ]    358 (0x0166)  264 (0x0108)  __vbaPut4                           0x000E5733
     [C  ]    359 (0x0167)  265 (0x0109)  __vbaPutFxStr3                      0x000E57DC
     [C  ]    360 (0x0168)  266 (0x010A)  __vbaPutFxStr4                      0x000E5812
     [C  ]    361 (0x0169)  267 (0x010B)  __vbaPutOwner3                      0x000E576C
     [C  ]    362 (0x016A)  268 (0x010C)  __vbaPutOwner4                      0x000E57A5
     [C  ]    363 (0x016B)  269 (0x010D)  __vbaR4Cy                           0x000E19C2
     [C  ]    364 (0x016C)  270 (0x010E)  __vbaR4ErrVar                       0x000E4E44
     [C  ]    365 (0x016D)  271 (0x010F)  __vbaR4ForNextCheck                 0x001094FC
     [C  ]    366 (0x016E)  272 (0x0110)  __vbaR4Sgn                          0x000E4D59
     [C  ]    367 (0x016F)  273 (0x0111)  __vbaR4Str                          0x000E10BA
     [C  ]    368 (0x0170)  274 (0x0112)  __vbaR4Var                          0x000E4E52
     [C  ]    369 (0x0171)  275 (0x0113)  __vbaR8Cy                           0x000E19CF
     [C  ]    370 (0x0172)  276 (0x0114)  __vbaR8ErrVar                       0x000E4E4B
     [C  ]    371 (0x0173)  277 (0x0115)  __vbaR8FixI2                        0x000E97C5
     [C  ]    372 (0x0174)  278 (0x0116)  __vbaR8FixI4                        0x000E97DC
     [C  ]    373 (0x0175)  279 (0x0117)  __vbaR8ForNextCheck                 0x00109530
     [C  ]    374 (0x0176)  280 (0x0118)  __vbaR8IntI2                        0x000E97F3
     [C  ]    375 (0x0177)  281 (0x0119)  __vbaR8IntI4                        0x000E980A
     [C  ]    376 (0x0178)  282 (0x011A)  __vbaR8Sgn                          0x000E4D90
     [C  ]    377 (0x0179)  283 (0x011B)  __vbaR8Str                          0x000E10EA
     [C  ]    378 (0x017A)  284 (0x011C)  __vbaR8Var                          0x000E4E59
     [C  ]    379 (0x017B)  285 (0x011D)  __vbaRaiseEvent                     0x00108B8F
     [C  ]    380 (0x017C)  286 (0x011E)  __vbaRecAnsiToUni                   0x000DB797
     [C  ]    381 (0x017D)  287 (0x011F)  __vbaRecAssign                      0x000DB721
     [C  ]    382 (0x017E)  288 (0x0120)  __vbaRecDestruct                    0x000DB704
     [C  ]    383 (0x017F)  289 (0x0121)  __vbaRecDestructAnsi                0x000DB7D1
     [C  ]    384 (0x0180)  290 (0x0122)  __vbaRecUniToAnsi                   0x000DB75D
     [C  ]    385 (0x0181)  291 (0x0123)  __vbaRedim                          0x000DC30A
     [C  ]    386 (0x0182)  292 (0x0124)  __vbaRedimPreserve                  0x000DC339
     [C  ]    387 (0x0183)  293 (0x0125)  __vbaRedimPreserveVar               0x000DC38A
     [C  ]    388 (0x0184)  294 (0x0126)  __vbaRedimPreserveVar2              0x000DC3DE
     [C  ]    389 (0x0185)  295 (0x0127)  __vbaRedimVar                       0x000DC368
     [C  ]    390 (0x0186)  297 (0x0129)  __vbaRefVarAry                      0x000DC417
     [C  ]    391 (0x0187)  298 (0x012A)  __vbaResume                         0x000E49E1
     [C  ]    392 (0x0188)  299 (0x012B)  __vbaRsetFixstr                     0x000E78F9
     [C  ]    393 (0x0189)  300 (0x012C)  __vbaRsetFixstrFree                 0x000E7A06
     [C  ]    394 (0x018A)  301 (0x012D)  __vbaSetSystemError                 0x000CC33A
     [C  ]    395 (0x018B)  302 (0x012E)  __vbaStopExe                        0x000CBE4A
     [C  ]    396 (0x018C)  303 (0x012F)  __vbaStr2Vec                        0x00103A40
     [C  ]    397 (0x018D)  304 (0x0130)  __vbaStrAryToAnsi                   0x000CC0E0
     [C  ]    398 (0x018E)  305 (0x0131)  __vbaStrAryToUnicode                0x000CC0F6
     [C  ]    399 (0x018F)  306 (0x0132)  __vbaStrBool                        0x000E0493
     [C  ]    400 (0x0190)   20 (0x0014)  EVENT_SINK_QueryInterface           0x000C9A85
     [C  ]    401 (0x0191)   17 (0x0011)  EVENT_SINK_AddRef                   0x000C9B74
     [C  ]    402 (0x0192)   21 (0x0015)  EVENT_SINK_Release                  0x000C9B87
     [C  ]    403 (0x0193)   18 (0x0012)  EVENT_SINK_GetIDsOfNames            0x000C9BBE
     [C  ]    404 (0x0194)   19 (0x0013)  EVENT_SINK_Invoke                   0x000C9BDC
     [C  ]    405 (0x0195)  307 (0x0133)  __vbaStrCat                         0x000E6A76
     [C  ]    406 (0x0196)  308 (0x0134)  __vbaStrCmp                         0x000E9596
     [C  ]    407 (0x0197)  309 (0x0135)  __vbaStrComp                        0x000E7BE9
     [C  ]    408 (0x0198)  310 (0x0136)  __vbaStrCompVar                     0x000E7B3E
     [C  ]    409 (0x0199)  312 (0x0138)  __vbaStrCy                          0x000E0613
     [C  ]    410 (0x019A)    3 (0x0003)  BASIC_CLASS_QueryInterface          0x00006C74
     [C  ]    411 (0x019B)    0 (0x0000)  BASIC_CLASS_AddRef                  0x00006C40
     [C  ]    412 (0x019C)    4 (0x0004)  BASIC_CLASS_Release                 0x0000EA59
     [C  ]    413 (0x019D)    1 (0x0001)  BASIC_CLASS_GetIDsOfNames           0x000CA0B3
     [C  ]    414 (0x019E)    2 (0x0002)  BASIC_CLASS_Invoke                  0x000CA14F
     [C  ]    415 (0x019F)  313 (0x0139)  __vbaStrDate                        0x000E05D0
     [C  ]    416 (0x01A0)  315 (0x013B)  __vbaStrFixstr                      0x000E9652
     [C  ]    417 (0x01A1)  316 (0x013C)  __vbaStrI2                          0x000E0507
     [C  ]    418 (0x01A2)  317 (0x013D)  __vbaStrI4                          0x000E0537
     [C  ]    419 (0x01A3)  318 (0x013E)  __vbaStrLike                        0x000E95BA
     [C  ]    420 (0x01A4)    5 (0x0005)  BASIC_DISPINTERFACE_GetTICount      0x000DE895
     [C  ]    421 (0x01A5)    6 (0x0006)  BASIC_DISPINTERFACE_GetTypeInfo     0x000C97D1
     [C  ]    422 (0x01A6)  320 (0x0140)  __vbaStrR4                          0x000E0567
     [C  ]    423 (0x01A7)  321 (0x0141)  __vbaStrR8                          0x000E059B
     [C  ]    424 (0x01A8)  322 (0x0142)  __vbaStrTextCmp                     0x000E95A8
     [C  ]    425 (0x01A9)  323 (0x0143)  __vbaStrTextLike                    0x000E95CF
     [C  ]    426 (0x01AA)  324 (0x0144)  __vbaStrToAnsi                      0x0000A3D7
     [C  ]    427 (0x01AB)  325 (0x0145)  __vbaStrToUnicode                   0x000CBF1D
     [C  ]    428 (0x01AC)  326 (0x0146)  __vbaStrUI1                         0x000E04D4
     [C  ]    429 (0x01AD)  327 (0x0147)  __vbaStrVarCopy                     0x000E0646
     [C  ]    430 (0x01AE)   80 (0x0050)  Zombie_QueryInterface               0x000CB279
     [C  ]    431 (0x01AF)   75 (0x004B)  Zombie_AddRef                       0x00006C40
     [C  ]    432 (0x01B0)   81 (0x0051)  Zombie_Release                      0x0000EA59
     [C  ]    433 (0x01B1)   78 (0x004E)  Zombie_GetTypeInfoCount             0x000CB261
     [C  ]    434 (0x01B2)   77 (0x004D)  Zombie_GetTypeInfo                  0x000CB259
     [C  ]    435 (0x01B3)   76 (0x004C)  Zombie_GetIDsOfNames                0x000CB269
     [C  ]    436 (0x01B4)   79 (0x004F)  Zombie_Invoke                       0x000CB271
     [C  ]    437 (0x01B5)  328 (0x0148)  __vbaStrVarMove                     0x000E1929
     [C  ]    438 (0x01B6)  329 (0x0149)  __vbaStrVarVal                      0x000E1948
     [C  ]    439 (0x01B7)  330 (0x014A)  __vbaUI1Cy                          0x001075CE
     [C  ]    440 (0x01B8)   15 (0x000F)  EVENT_SINK2_AddRef                  0x000C9B9A
     [C  ]    441 (0x01B9)   16 (0x0010)  EVENT_SINK2_Release                 0x000C9BAC
     [C  ]    442 (0x01BA)  331 (0x014B)  __vbaUI1ErrVar                      0x000E4DFD
     [C  ]    443 (0x01BB)  335 (0x014F)  __vbaUI1Str                         0x000E196D
     [C  ]    444 (0x01BC)  336 (0x0150)  __vbaUI1Var                         0x000E4E13
     [C  ]    445 (0x01BD)  337 (0x0151)  __vbaUbound                         0x000DC65A
     [C  ]    446 (0x01BE)  338 (0x0152)  __vbaUdtVar                         0x00103911
     [C  ]    447 (0x01BF)  339 (0x0153)  __vbaUnkVar                         0x000DA1DF
     [C  ]    448 (0x01C0)  340 (0x0154)  __vbaVar2Vec                        0x00103AEC
     [C  ]    449 (0x01C1)  341 (0x0155)  __vbaVarAbs                         0x00107752
     [C  ]    450 (0x01C2)  342 (0x0156)  __vbaVarAdd                         0x001077C1
     [C  ]    451 (0x01C3)  343 (0x0157)  __vbaVarAnd                         0x00109589
     [C  ]    452 (0x01C4)  344 (0x0158)  __vbaVarCat                         0x000E697D
     [C  ]    453 (0x01C5)  345 (0x0159)  __vbaVarCmpEq                       0x00109922
     [C  ]    454 (0x01C6)  346 (0x015A)  __vbaVarCmpGe                       0x0010998C
     [C  ]    455 (0x01C7)  347 (0x015B)  __vbaVarCmpGt                       0x001099C1
     [C  ]    456 (0x01C8)  348 (0x015C)  __vbaVarCmpLe                       0x001099F6
     [C  ]    457 (0x01C9)  349 (0x015D)  __vbaVarCmpLt                       0x00109A2B
     [C  ]    458 (0x01CA)  350 (0x015E)  __vbaVarCmpNe                       0x00109957
     [C  ]    459 (0x01CB)  352 (0x0160)  __vbaVarDateVar                     0x000E0C9C
     [C  ]    460 (0x01CC)  353 (0x0161)  __vbaVarDiv                         0x00107689
     [C  ]    461 (0x01CD)  355 (0x0163)  __vbaVarEqv                         0x00109604
     [C  ]    462 (0x01CE)  356 (0x0164)  __vbaVarErrI4                       0x000E18F1
     [C  ]    463 (0x01CF)  357 (0x0165)  __vbaVarFix                         0x00107777
     [C  ]    464 (0x01D0)  358 (0x0166)  __vbaVarForInit                     0x001093CC
     [C  ]    465 (0x01D1)  359 (0x0167)  __vbaVarForNext                     0x001093FA
     [C  ]    466 (0x01D2)  360 (0x0168)  __vbaVarIdiv                        0x001076B2
     [C  ]    467 (0x01D3)  361 (0x0169)  __vbaVarImp                         0x0010962D
     [C  ]    468 (0x01D4)  362 (0x016A)  __vbaVarIndexLoad                   0x000DC43B
     [C  ]    469 (0x01D5)  363 (0x016B)  __vbaVarIndexLoadRef                0x000DC457
     [C  ]    470 (0x01D6)  364 (0x016C)  __vbaVarIndexLoadRefLock            0x000DC484
     [C  ]    471 (0x01D7)  365 (0x016D)  __vbaVarIndexStore                  0x000DC4B2
     [C  ]    472 (0x01D8)  366 (0x016E)  __vbaVarIndexStoreObj               0x000DC4CD
     [C  ]    473 (0x01D9)  367 (0x016F)  __vbaVarInt                         0x0010779C
     [C  ]    474 (0x01DA)  373 (0x0175)  __vbaVarLike                        0x000E9542
     [C  ]    475 (0x01DB)  374 (0x0176)  __vbaVarLikeVar                     0x000E95E4
     [C  ]    476 (0x01DC)  375 (0x0177)  __vbaVarMod                         0x001076DB
     [C  ]    477 (0x01DD)  377 (0x0179)  __vbaVarMul                         0x00107660
     [C  ]    478 (0x01DE)  378 (0x017A)  __vbaVarNeg                         0x0010772D
     [C  ]    479 (0x01DF)  379 (0x017B)  __vbaVarNot                         0x00109564
     [C  ]    480 (0x01E0)  380 (0x017C)  __vbaVarOr                          0x001095B2
     [C  ]    481 (0x01E1)  381 (0x017D)  __vbaVarPow                         0x00107704
     [C  ]    482 (0x01E2)  382 (0x017E)  __vbaVarSetObj                      0x000DA01F
     [C  ]    483 (0x01E3)  383 (0x017F)  __vbaVarSetObjAddref                0x000DA049
     [C  ]    484 (0x01E4)  384 (0x0180)  __vbaVarSetUnk                      0x000DA073
     [C  ]    485 (0x01E5)  385 (0x0181)  __vbaVarSetUnkAddref                0x000DA09D
     [C  ]    486 (0x01E6)  386 (0x0182)  __vbaVarSetVar                      0x000DA0C7
     [C  ]    487 (0x01E7)  387 (0x0183)  __vbaVarSetVarAddref                0x000DA0DD
     [C  ]    488 (0x01E8)  388 (0x0184)  __vbaVarSub                         0x001077EA
     [C  ]    489 (0x01E9)  389 (0x0185)  __vbaVarTextCmpEq                   0x00109A60
     [C  ]    490 (0x01EA)  390 (0x0186)  __vbaVarTextCmpGe                   0x00109ACA
     [C  ]    491 (0x01EB)  391 (0x0187)  __vbaVarTextCmpGt                   0x00109AFF
     [C  ]    492 (0x01EC)  392 (0x0188)  __vbaVarTextCmpLe                   0x00109B34
     [C  ]    493 (0x01ED)  393 (0x0189)  __vbaVarTextCmpLt                   0x00109B69
     [C  ]    494 (0x01EE)  394 (0x018A)  __vbaVarTextCmpNe                   0x00109A95
     [C  ]    495 (0x01EF)  395 (0x018B)  __vbaVarTextLike                    0x000E956C
     [C  ]    496 (0x01F0)  396 (0x018C)  __vbaVarTextLikeVar                 0x000E95FE
     [C  ]    497 (0x01F1)  397 (0x018D)  __vbaVarTextTstEq                   0x0010988C
     [C  ]    498 (0x01F2)  398 (0x018E)  __vbaVarTextTstGe                   0x001098BE
     [C  ]    499 (0x01F3)  399 (0x018F)  __vbaVarTextTstGt                   0x001098D7
     [C  ]    500 (0x01F4)  400 (0x0190)  __vbaVarTextTstLe                   0x001098F0
     [C  ]    501 (0x01F5)  401 (0x0191)  __vbaVarTextTstLt                   0x00109909
     [C  ]    502 (0x01F6)  402 (0x0192)  __vbaVarTextTstNe                   0x001098A5
     [C  ]    503 (0x01F7)  403 (0x0193)  __vbaVarTstEq                       0x001097F6
     [C  ]    504 (0x01F8)  404 (0x0194)  __vbaVarTstGe                       0x00109828
     [C  ]    505 (0x01F9)  405 (0x0195)  __vbaVarTstGt                       0x00109841
     [C  ]    506 (0x01FA)  406 (0x0196)  __vbaVarTstLe                       0x0010985A
     [C  ]    507 (0x01FB)  407 (0x0197)  __vbaVarTstLt                       0x00109873
     [C  ]    508 (0x01FC)  408 (0x0198)  __vbaVarTstNe                       0x0010980F
     [C  ]    509 (0x01FD)  410 (0x019A)  __vbaVarXor                         0x001095DB
     [C  ]    510 (0x01FE)  412 (0x019C)  __vbaVargObj                        0x00107350
     [C  ]    511 (0x01FF)  413 (0x019D)  __vbaVargObjAddref                  0x001073B8
     [C  ]    512 (0x0200)  550 (0x0226)  rtcLeftBstr                         0x000E6CE3
     [C  ]    513 (0x0201)  555 (0x022B)  rtcLeftVar                          0x000E6D36
     [C  ]    514 (0x0202)  588 (0x024C)  rtcRightBstr                        0x000E6DD8
     [C  ]    515 (0x0203)  593 (0x0251)  rtcRightVar                         0x000E6E3A
     [C  ]    516 (0x0204)  447 (0x01BF)  rtcAnsiValueBstr                    0x000E70B7
     [C  ]    517 (0x0205)  559 (0x022F)  rtcLowerCaseBstr                    0x000E7569
     [C  ]    518 (0x0206)  560 (0x0230)  rtcLowerCaseVar                     0x000E75A0
     [C  ]    519 (0x0207)  620 (0x026C)  rtcTrimBstr                         0x000E7601
     [C  ]    520 (0x0208)  621 (0x026D)  rtcTrimVar                          0x000E7621
     [C  ]    521 (0x0209)  553 (0x0229)  rtcLeftTrimBstr                     0x000E7834
     [C  ]    522 (0x020A)  554 (0x022A)  rtcLeftTrimVar                      0x000E7854
     [C  ]    523 (0x020B)  591 (0x024F)  rtcRightTrimBstr                    0x000E7A47
     [C  ]    524 (0x020C)  592 (0x0250)  rtcRightTrimVar                     0x000E7A67
     [C  ]    525 (0x020D)  608 (0x0260)  rtcSpaceBstr                        0x000E7DB9
     [C  ]    526 (0x020E)  609 (0x0261)  rtcSpaceVar                         0x000E7DFB
     [C  ]    527 (0x020F)  623 (0x026F)  rtcUpperCaseBstr                    0x000E7F8A
     [C  ]    528 (0x0210)  624 (0x0270)  rtcUpperCaseVar                     0x000E7FAA
     [C  ]    529 (0x0211)  549 (0x0225)  rtcKillFiles                        0x000D5D41
     [C  ]    530 (0x0212)  461 (0x01CD)  rtcChangeDir                        0x000D5C68
     [C  ]    531 (0x0213)  563 (0x0233)  rtcMakeDir                          0x000D5C89
     [C  ]    532 (0x0214)  585 (0x0249)  rtcRemoveDir                        0x000D5C9A
     [C  ]    533 (0x0215)  462 (0x01CE)  rtcChangeDrive                      0x000D64C7
     [C  ]    534 (0x0216)  452 (0x01C4)  rtcBeep                             0x000DC715
     [C  ]    535 (0x0217)  523 (0x020B)  rtcGetTimer                         0x000DC85D
     [C  ]    536 (0x0218)  614 (0x0266)  rtcStrFromVar                       0x000E07D5
     [C  ]    537 (0x0219)  453 (0x01C5)  rtcBstrFromAnsi                     0x000E0EBE
     [C  ]    538 (0x021A)  577 (0x0241)  rtcPackDate                         0x000D1978
     [C  ]    539 (0x021B)  578 (0x0242)  rtcPackTime                         0x000D19D8
     [C  ]    540 (0x021C)  506 (0x01FA)  rtcGetDateValue                     0x000D1A3E
     [C  ]    541 (0x021D)  521 (0x0209)  rtcGetTimeValue                     0x000D1AAD
     [C  ]    542 (0x021E)  508 (0x01FC)  rtcGetDayOfMonth                    0x000D1B9D
     [C  ]    543 (0x021F)  513 (0x0201)  rtcGetHourOfDay                     0x000D1C50
     [C  ]    544 (0x0220)  514 (0x0202)  rtcGetMinuteOfHour                  0x000D1C93
     [C  ]    545 (0x0221)  515 (0x0203)  rtcGetMonthOfYear                   0x000D1B5A
     [C  ]    546 (0x0222)  517 (0x0205)  rtcGetPresentDate                   0x000D1D19
     [C  ]    547 (0x0223)  518 (0x0206)  rtcGetSecondOfMinute                0x000D1CD6
     [C  ]    548 (0x0224)  601 (0x0259)  rtcSetDateVar                       0x000D1DB1
     [C  ]    549 (0x0225)  600 (0x0258)  rtcSetDateBstr                      0x000D1DFB
     [C  ]    550 (0x0226)  604 (0x025C)  rtcSetTimeVar                       0x000D1FE7
     [C  ]    551 (0x0227)  603 (0x025B)  rtcSetTimeBstr                      0x000D203E
     [C  ]    552 (0x0228)  509 (0x01FD)  rtcGetDayOfWeek                     0x000D1BE0
     [C  ]    553 (0x0229)  524 (0x020C)  rtcGetYear                          0x000D1B17
     [C  ]    554 (0x022A)  493 (0x01ED)  rtcFileReset                        0x000D4156
     [C  ]    555 (0x022B)  487 (0x01E7)  rtcFileAttributes                   0x000D4203
     [C  ]    556 (0x022C)  540 (0x021C)  rtcIsArray                          0x000DC89D
     [C  ]    557 (0x022D)  541 (0x021D)  rtcIsDate                           0x000DC8B1
     [C  ]    558 (0x022E)  542 (0x021E)  rtcIsEmpty                          0x000DC988
     [C  ]    559 (0x022F)  543 (0x021F)  rtcIsError                          0x000DC99C
     [C  ]    560 (0x0230)  545 (0x0221)  rtcIsNull                           0x000DC9B4
     [C  ]    561 (0x0231)  546 (0x0222)  rtcIsNumeric                        0x000DC9CA
     [C  ]    562 (0x0232)  547 (0x0223)  rtcIsObject                         0x000DCAEE
     [C  ]    563 (0x0233)  633 (0x0279)  rtcVarType                          0x000DCB05
     [C  ]    564 (0x0234)  440 (0x01B8)  rtDecFromVar                        0x000E01FA
     [C  ]    565 (0x0235)  495 (0x01EF)  rtcFileWidth                        0x000D4199
     [C  ]    566 (0x0236)  537 (0x0219)  rtcInputCount                       0x000D3025
     [C  ]    567 (0x0237)  538 (0x021A)  rtcInputCountVar                    0x000D2FF7
     [C  ]    568 (0x0238)  494 (0x01EE)  rtcFileSeek                         0x000E544E
     [C  ]    569 (0x0239)  492 (0x01EC)  rtcFileLocation                     0x000E558A
     [C  ]    570 (0x023A)  491 (0x01EB)  rtcFileLength                       0x000E5618
     [C  ]    571 (0x023B)  481 (0x01E1)  rtcEndOfFile                        0x000D4332
     [C  ]    572 (0x023C)  525 (0x020D)  rtcHexBstrFromVar                   0x000E1290
     [C  ]    573 (0x023D)  526 (0x020E)  rtcHexVarFromVar                    0x000E1381
     [C  ]    574 (0x023E)  572 (0x023C)  rtcOctBstrFromVar                   0x000E13BB
     [C  ]    575 (0x023F)  573 (0x023D)  rtcOctVarFromVar                    0x000E14A3
     [C  ]    576 (0x0240)  488 (0x01E8)  rtcFileCopy                         0x000D5F0D
     [C  ]    577 (0x0241)  489 (0x01E9)  rtcFileDateTime                     0x000D612D
     [C  ]    578 (0x0242)  490 (0x01EA)  rtcFileLen                          0x000D61F8
     [C  ]    579 (0x0243)  511 (0x01FF)  rtcGetFileAttr                      0x000D6224
     [C  ]    580 (0x0244)  602 (0x025A)  rtcSetFileAttr                      0x000D624D
     [C  ]    581 (0x0245)  581 (0x0245)  rtcR8ValFromBstr                    0x000D325A
     [C  ]    582 (0x0246)  607 (0x025F)  rtcSin                              0x000DCB7F
     [C  ]    583 (0x0247)  468 (0x01D4)  rtcCos                              0x000DCBA8
     [C  ]    584 (0x0248)  619 (0x026B)  rtcTan                              0x000DCBD1
     [C  ]    585 (0x0249)  451 (0x01C3)  rtcAtn                              0x000DCC01
     [C  ]    586 (0x024A)  485 (0x01E5)  rtcExp                              0x000DCC0C
     [C  ]    587 (0x024B)  558 (0x022E)  rtcLog                              0x000DCC4D
     [C  ]    588 (0x024C)  587 (0x024B)  rtcRgb                              0x000DCC8D
     [C  ]    589 (0x024D)  580 (0x0244)  rtcQBColor                          0x000DCCE6
     [C  ]    590 (0x024E)  562 (0x0232)  rtcMacId                            0x000D4545
     [C  ]    591 (0x024F)  622 (0x026E)  rtcTypeName                         0x000DDEA0
     [C  ]    592 (0x0250)  544 (0x0220)  rtcIsMissing                        0x000DD6FD
     [C  ]    593 (0x0251)  582 (0x0246)  rtcRandomNext                       0x000DCD05
     [C  ]    594 (0x0252)  583 (0x0247)  rtcRandomize                        0x000DCD3A
     [C  ]    595 (0x0253)  569 (0x0239)  rtcMsgBox                           0x000DD132
     [C  ]    596 (0x0254)  534 (0x0216)  rtcInputBox                         0x000DD301
     [C  ]    597 (0x0255)  448 (0x01C0)  rtcAppActivate                      0x000DCE42
     [C  ]    598 (0x0256)  480 (0x01E0)  rtcDoEvents                         0x000CE0F7
     [C  ]    599 (0x0257)  598 (0x0256)  rtcSendKeys                         0x000CCFE4
     [C  ]    600 (0x0258)  606 (0x025E)  rtcShell                            0x000CCE69
     [C  ]    601 (0x0259)  450 (0x01C2)  rtcArray                            0x00103A13
     [C  ]    602 (0x025A)  415 (0x019F)  __vbaVargUnk                        0x00107420
     [C  ]    603 (0x025B)  416 (0x01A0)  __vbaVargUnkAddref                  0x00107482
     [C  ]    604 (0x025C)  421 (0x01A5)  __vbaVerifyVarObj                   0x000DA152
     [C  ]    605 (0x025D)  510 (0x01FE)  rtcGetErl                           0x000DC71E
     [C  ]    606 (0x025E)  616 (0x0268)  rtcStringBstr                       0x000E7E26
     [C  ]    607 (0x025F)  617 (0x0269)  rtcStringVar                        0x000E7F4D
     [C  ]    608 (0x0260)  625 (0x0271)  rtcVarBstrFromAnsi                  0x000E0F56
     [C  ]    609 (0x0261)  505 (0x01F9)  rtcGetDateBstr                      0x000D2349
     [C  ]    610 (0x0262)  507 (0x01FB)  rtcGetDateVar                       0x000D22B9
     [C  ]    611 (0x0263)  520 (0x0208)  rtcGetTimeBstr                      0x000D240B
     [C  ]    612 (0x0264)  522 (0x020A)  rtcGetTimeVar                       0x000D22FB
     [C  ]    613 (0x0265)  632 (0x0278)  rtcVarStrFromVar                    0x000E0944
     [C  ]    614 (0x0266)  611 (0x0263)  rtcSqr                              0x000DCC6E
     [C  ]    615 (0x0267)  527 (0x020F)  rtcIMEStatus                        0x000DD6E4
     [C  ]    616 (0x0268)  551 (0x0227)  rtcLeftCharBstr                     0x000E6D9A
     [C  ]    617 (0x0269)  552 (0x0228)  rtcLeftCharVar                      0x000E6DAD
     [C  ]    618 (0x026A)  589 (0x024D)  rtcRightCharBstr                    0x000E6E9E
     [C  ]    619 (0x026B)  590 (0x024E)  rtcRightCharVar                     0x000E6EB1
     [C  ]    620 (0x026C)  535 (0x0217)  rtcInputCharCount                   0x000D3118
     [C  ]    621 (0x026D)  536 (0x0218)  rtcInputCharCountVar                0x000D30EA
     [C  ]    622 (0x026E)  612 (0x0264)  rtcStrConvVar                       0x000E8FBF
     [C  ]    623 (0x026F)  422 (0x01A6)  __vbaWriteFile                      0x000D50F3
     [C  ]    624 (0x0270)  512 (0x0200)  rtcGetHostLCID                      0x000CCDD0
     [C  ]    625 (0x0271)  469 (0x01D5)  rtcCreateObject                     0x000D973F
     [C  ]    626 (0x0272)  516 (0x0204)  rtcGetObject                        0x000D9CCA
     [C  ]    627 (0x0273)  449 (0x01C1)  rtcAppleScript                      0x000F6341
     [C  ]    628 (0x0274)  564 (0x0234)  rtcMidBstr                          0x000E6EDC
     [C  ]    629 (0x0275)  567 (0x0237)  rtcMidVar                           0x000E6F7B
     [C  ]    630 (0x0276)  531 (0x0213)  rtcInStr                            0x000E71C4
     [C  ]    631 (0x0277)  565 (0x0235)  rtcMidCharBstr                      0x000E6FE2
     [C  ]    632 (0x0278)  566 (0x0236)  rtcMidCharVar                       0x000E702F
     [C  ]    633 (0x0279)  532 (0x0214)  rtcInStrChar                        0x000E712F
     [C  ]    634 (0x027A)  438 (0x01B6)  rtBstrFromErrVar                    0x000E06A0
     [C  ]    635 (0x027B)  437 (0x01B5)  rtBoolFromErrVar                    0x000E0DAB
     [C  ]    636 (0x027C)  439 (0x01B7)  rtCyFromErrVar                      0x000E0426
     [C  ]    637 (0x027D)  441 (0x01B9)  rtI2FromErrVar                      0x000E0252
     [C  ]    638 (0x027E)  442 (0x01BA)  rtI4FromErrVar                      0x000E02C1
     [C  ]    639 (0x027F)  443 (0x01BB)  rtR4FromErrVar                      0x000E0320
     [C  ]    640 (0x0280)  444 (0x01BC)  rtR8FromErrVar                      0x000E038D
     [C  ]    641 (0x0281)  476 (0x01DC)  rtcDateFromVar                      0x000E0D3D
     [C  ]    642 (0x0282)  631 (0x0277)  rtcVarFromVar                       0x000E097E
     [C  ]    643 (0x0283)  459 (0x01CB)  rtcCVErrFromVar                     0x000E09BA
     [C  ]    644 (0x0284)   74 (0x004A)  VarPtr                              0x000DDE99
     [C  ]    645 (0x0285)  479 (0x01DF)  rtcDir                              0x000D53F7
     [C  ]    646 (0x0286)  472 (0x01D8)  rtcCurrentDirBstr                   0x000D535F
     [C  ]    647 (0x0287)  471 (0x01D7)  rtcCurrentDir                       0x000D52B6
     [C  ]    648 (0x0288)  502 (0x01F6)  rtcFreeFile                         0x000D4275
     [C  ]    649 (0x0289)  467 (0x01D3)  rtcCompareBstr                      0x000E7B12
     [C  ]    650 (0x028A)  457 (0x01C9)  rtcBstrFromFormatVar                0x000F6348
     [C  ]    651 (0x028B)  456 (0x01C8)  rtcBstrFromError                    0x000DC75C
     [C  ]    652 (0x028C)  629 (0x0275)  rtcVarFromError                     0x000DC731
     [C  ]    653 (0x028D)  556 (0x022C)  rtcLenCharVar                       0x000E6BA0
     [C  ]    654 (0x028E)  557 (0x022D)  rtcLenVar                           0x000E6BC6
     [C  ]    655 (0x028F)  497 (0x01F1)  rtcFixVar                           0x000E09FC
     [C  ]    656 (0x0290)  446 (0x01BE)  rtcAbsVar                           0x000E0A4C
     [C  ]    657 (0x0291)  539 (0x021B)  rtcIntVar                           0x000E0A9C
     [C  ]    658 (0x0292)  605 (0x025D)  rtcSgnVar                           0x000E0AEC
     [C  ]    659 (0x0293)  423 (0x01A7)  _adj_fdiv_m16i                      0x000F0306
     [C  ]    660 (0x0294)  630 (0x0276)  rtcVarFromFormatVar                 0x000F642B
     [C  ]    661 (0x0295)  474 (0x01DA)  rtcDateAdd                          0x000D25A0
     [C  ]    662 (0x0296)  475 (0x01DB)  rtcDateDiff                         0x000D27DB
     [C  ]    663 (0x0297)  477 (0x01DD)  rtcDatePart                         0x000D2B0F
     [C  ]    664 (0x0298)  579 (0x0243)  rtcPartition                        0x000DD739
     [C  ]    665 (0x0299)  464 (0x01D0)  rtcChoose                           0x000DD9FD
     [C  ]    666 (0x029A)  483 (0x01E3)  rtcEnvironVar                       0x000DDB35
     [C  ]    667 (0x029B)  482 (0x01E2)  rtcEnvironBstr                      0x000DDB60
     [C  ]    668 (0x029C)  618 (0x026A)  rtcSwitch                           0x000DDD91
     [C  ]    669 (0x029D)  465 (0x01D1)  rtcCommandBstr                      0x0000A1BB
     [C  ]    670 (0x029E)  466 (0x01D2)  rtcCommandVar                       0x000DDE02
     [C  ]    671 (0x029F)  595 (0x0253)  rtcSLN                              0x000F65FF
     [C  ]    672 (0x02A0)  596 (0x0254)  rtcSYD                              0x000F6624
     [C  ]    673 (0x02A1)  473 (0x01D9)  rtcDDB                              0x000F667A
     [C  ]    674 (0x02A2)  528 (0x0210)  rtcIPMT                             0x000F67BA
     [C  ]    675 (0x02A3)  575 (0x023F)  rtcPPMT                             0x000F68A9
     [C  ]    676 (0x02A4)  574 (0x023E)  rtcPMT                              0x000F695D
     [C  ]    677 (0x02A5)  576 (0x0240)  rtcPV                               0x000F6A25
     [C  ]    678 (0x02A6)  486 (0x01E6)  rtcFV                               0x000F6AE0
     [C  ]    679 (0x02A7)  571 (0x023B)  rtcNPer                             0x000F6BAB
     [C  ]    680 (0x02A8)  584 (0x0248)  rtcRate                             0x000F6CCF
     [C  ]    681 (0x02A9)  530 (0x0212)  rtcImmediateIf                      0x000DDAE3
     [C  ]    682 (0x02AA)  529 (0x0211)  rtcIRR                              0x000F6ED6
     [C  ]    683 (0x02AB)  561 (0x0231)  rtcMIRR                             0x000F71C7
     [C  ]    684 (0x02AC)  570 (0x023A)  rtcNPV                              0x000F7361
     [C  ]    685 (0x02AD)  484 (0x01E4)  rtcErrObj                           0x000DEF7D
     [C  ]    686 (0x02AE)  445 (0x01BD)  rtUI1FromErrVar                     0x000E0DFE
     [C  ]    687 (0x02AF)  628 (0x0274)  rtcVarDateFromVar                   0x000E0D49
     [C  ]    688 (0x02B0)  424 (0x01A8)  _adj_fdiv_m32                       0x000F026E
     [C  ]    689 (0x02B1)  519 (0x0207)  rtcGetSetting                       0x000F753C
     [C  ]    690 (0x02B2)  597 (0x0255)  rtcSaveSetting                      0x000F76F2
     [C  ]    691 (0x02B3)  478 (0x01DE)  rtcDeleteSetting                    0x000F77AB
     [C  ]    692 (0x02B4)  503 (0x01F7)  rtcGetAllSettings                   0x000F7B37
     [C  ]    693 (0x02B5)  458 (0x01CA)  rtcByteValueBstr                    0x000E7096
     [C  ]    694 (0x02B6)  454 (0x01C6)  rtcBstrFromByte                     0x000E0E72
     [C  ]    695 (0x02B7)  626 (0x0272)  rtcVarBstrFromByte                  0x000E0E93
     [C  ]    696 (0x02B8)  463 (0x01CF)  rtcCharValueBstr                    0x000E710B
     [C  ]    697 (0x02B9)  455 (0x01C7)  rtcBstrFromChar                     0x000E0F81
     [C  ]    698 (0x02BA)  627 (0x0273)  rtcVarBstrFromChar                  0x000E0FC2
     [C  ]    699 (0x02BB)  599 (0x0257)  rtcSetCurrentCalendar               0x000D2E89
     [C  ]    700 (0x02BC)  504 (0x01F8)  rtcGetCurrentCalendar               0x000D2EB0
     [C  ]    701 (0x02BD)  425 (0x01A9)  _adj_fdiv_m32i                      0x000F033A
     [C  ]    702 (0x02BE)  500 (0x01F4)  rtcFormatNumber                     0x000F64A2
     [C  ]    703 (0x02BF)  498 (0x01F2)  rtcFormatCurrency                   0x000F653A
     [C  ]    704 (0x02C0)  501 (0x01F5)  rtcFormatPercent                    0x000F64EE
     [C  ]    705 (0x02C1)  499 (0x01F3)  rtcFormatDateTime                   0x000F645F
     [C  ]    706 (0x02C2)  634 (0x027A)  rtcWeekdayName                      0x000F6586
     [C  ]    707 (0x02C3)  568 (0x0238)  rtcMonthName                        0x000F65C4
     [C  ]    708 (0x02C4)  496 (0x01F0)  rtcFilter                           0x000F84A2
     [C  ]    709 (0x02C5)  533 (0x0215)  rtcInStrRev                         0x000F8299
     [C  ]    710 (0x02C6)  548 (0x0224)  rtcJoin                             0x000F8716
     [C  ]    711 (0x02C7)  610 (0x0262)  rtcSplit                            0x000F7DDB
     [C  ]    712 (0x02C8)  586 (0x024A)  rtcReplace                          0x000F89C4
     [C  ]    713 (0x02C9)  615 (0x0267)  rtcStrReverse                       0x000F8971
     [C  ]    714 (0x02CA)  594 (0x0252)  rtcRound                            0x000DE16C
     [C  ]    715 (0x02CB)  460 (0x01CC)  rtcCallByName                       0x000DE1B6
     [C  ]    716 (0x02CC)  470 (0x01D6)  rtcCreateObject2                    0x000D97D1
     [C  ]    717 (0x02CD)  613 (0x0265)  rtcStrConvVar2                      0x000E8FE9
     [C  ]    718 (0x02CE)  426 (0x01AA)  _adj_fdiv_m64                       0x000F02BA
     [C  ]    719 (0x02CF)  427 (0x01AB)  _adj_fdiv_r                         0x000EFDA9
     [C  ]    720 (0x02D0)  428 (0x01AC)  _adj_fdivr_m16i                     0x000F0406
     [C  ]    721 (0x02D1)  429 (0x01AD)  _adj_fdivr_m32                      0x000F036E
     [C  ]    722 (0x02D2)  430 (0x01AE)  _adj_fdivr_m32i                     0x000F043A
     [C  ]    723 (0x02D3)  431 (0x01AF)  _adj_fdivr_m64                      0x000F03BA
     [C  ]    724 (0x02D4)  432 (0x01B0)  _adj_fpatan                         0x000F09F6
     [C  ]    725 (0x02D5)  433 (0x01B1)  _adj_fprem                          0x000F0689
     [C  ]    726 (0x02D6)  434 (0x01B2)  _adj_fprem1                         0x000F0941
     [C  ]    727 (0x02D7)  435 (0x01B3)  _adj_fptan                          0x000F09F9
     [C  ]    728 (0x02D8)  436 (0x01B4)  _allmul                             0x000EEEED
     [C  ]    999 (0x03E7)   65 (0x0041)  TipInvokeMethod2                    0x000D8DD6
     [C  ]   1016 (0x03F8)   64 (0x0040)  TipInvokeMethod                     0x000D8EF6
     [C  ]   1024 (0x0400)   44 (0x002C)  IID_IVbaHost                        0x0002E640
     [C  ]   1025 (0x0401)   26 (0x001A)  EbGetObjConnectionCounts            0x0000AB41
     [C  ]   2000 (0x07D0)    8 (0x0008)  CreateIExprSrvObj                   0x000EB2C7
     [C  ]   2010 (0x07DA)   27 (0x001B)  EbGetVBAObject                      0x000C946F


For more reference, I have also attached a copy of the symbol dump.

msvbvm60 symdmp.zip


Decompiling and Debugging
There are a lot of tools that can be used to decompile a Visual Basic 6.0 compiled COFF. You can go to http://www.woodmann.com/collaborative/tools/index.php/Category:Visual_Basic_Tools for the list of Visual Basic tools.

Decompilers:
P32Dasm
DoDi's Visual Basic 3/4 Decompiler
RACEVB6
VB Decompiler
VBReFormer
Whiskey Kon Tequilla VB P-Code Debugger

Debuggers:
Whiskey Kon Tequilla VB P-Code Debugger
Wintruder
OllyDebug

Although, when debugging, I personally use IDA Pro IDC script found at http://www.hex-rays.com/products/ida/support/freefiles/vb.idc hand in hand with OllyDebug. I place breakpoints at every module or form entry points.

But to better understand a Visual Basic compiled executable or library, try creating and compiling from Visual Studio. From there, you will be able to easily understand how a VB program works. (Create a message box invoking program, release compile it, then debug the executable.)