About
-------
This is my first useful IDC script. It helps you identify and name all external DLL calls issued by a VB application.
It has been tested w/ VB6 executables.

In case of bugs or comments write me to lallousx86 at yahoo dot com


VB's DllFunctionCall
----------------------------
The form of the DllFunctionCall in VB is like this:

 dllName db "kernel32.dll", 0
 functionName db "ExitProcess", 0

 o_functionDescription dd offset dllName ; "kernel32.dll"
                       dd offset functionName ; "ExitProcess"
 
 sub_xyz proc near              
                 mov     eax, o_api
                 or      eax, eax
                 jz      short @@1

                 jmp     eax

 ; ---------------------------------------------------------------------------

 @@1:                             
                 push    offset o_functionDescription
                 mov     eax, offset DllFunctionCall
                 call    eax ; DllFunctionCall

                 jmp     eax

 sub_xyz endp

What happens is that when you first call this function the 'o_api' (offset to the actual API code) is still zero and uninitialized.
DllFunctionCall() will be called with one parameter which is a pointer to a function description which consists of two string pointers.
The first pointer is the DLL name and the second pointer is the function name.
When this function returns the actual API address will be returned into EAX and 'o_api' will be initialized.
Please note that o_functionDescription is not simply a two pointers structure, but have more info (for example where is the 'o_api').


How to use this script
------------------------
Simple run the script inside a VB6 executable database. The script will look for DllFunctionCall() reference and try to name all valid external DLL calls.
This script might fail if no reference to DllFunctionCall() exist, or the form of the DllFunctionCall implementation has changed.
If the function was already named then no name will be given.