olevba: added a workaround in detect_vba_stomping to fix #489

decalage2
1 parent 4f51278f
Showing 1 changed file with 3 additions and 0 deletions
oletools/olevba.py
@@ -3557,6 +3557,9 @@ class VBA_Parser(object):
                     #     funcdefn = args.strip('()')
                     #     keywords.add(funcdefn)
                     if mnemonic in ('ArgsCall', 'ArgsLd', 'St', 'Ld', 'MemSt', 'Label'):
+                        # sometimes ArgsCall is followed by "(Call)", if so we remove it (issue #489)
+                        if args.startswith('(Call) '):
+                            args = args[7:]
                         # add 1st argument:
                         name = args.split(None, 1)[0]
                         # sometimes pcodedmp reports names like "id_FFFF", which are not