SnagIt! v5.2.1. (二） (8千字)
0045AA1E 6683FF41 cmp di, 00410045AA22 0F8233010000 jb 0045AB5B
0045AA28 81C7BFFF0000 add edi, 0000FFBF
0045AA2E 6683FF50 cmp di, 0050
0045AA32 7260 jb 0045AA94
0045AA34 8B450C mov eax, dword ptr [ebp+0C]
0045AA37 8378F812 cmp dword ptr [eax-08], 00000012
0045AA3B 7C79 jl 0045AAB6
0045AA3D 8D4508 lea eax, dword ptr [ebp+08]
0045AA40 6A04 push 00000004
0045AA42 50 push eax
0045AA43 8D4D0C lea ecx, dword ptr [ebp+0C]
0045AA46 E8C0D10300 call 00497C0B
0045AA4B 8B00 mov eax, dword ptr [eax]
0045AA4D 6A10 push 00000010
0045AA4F 53 push ebx
0045AA50 50 push eax
0045AA51 E8BEB70200 call 00486214
0045AA56 83C40C add esp, 0000000C
0045AA59 8D4D08 lea ecx, dword ptr [ebp+08]
0045AA5C 8945EC mov dword ptr [ebp-14], eax
0045AA5F E8AA520400 call 0049FD0E
0045AA64 8B450C mov eax, dword ptr [ebp+0C]
0045AA67 8D4D0C lea ecx, dword ptr [ebp+0C]
0045AA6A 8B40F8 mov eax, dword ptr [eax-08]
0045AA6D 83C0FC add eax, FFFFFFFC
0045AA70 50 push eax
0045AA71 8D4508 lea eax, dword ptr [ebp+08]
0045AA74 50 push eax
0045AA75 E80DD20300 call 00497C87
0045AA7A 50 push eax
0045AA7B 8D4D0C lea ecx, dword ptr [ebp+0C]
0045AA7E C645FC01 mov [ebp-04], 01
0045AA82 E874530400 call 0049FDFB
0045AA87 8D4D08 lea ecx, dword ptr [ebp+08]
0045AA8A 885DFC mov byte ptr [ebp-04], bl
0045AA8D E87C520400 call 0049FD0E
0045AA92 EB22 jmp 0045AAB6
Referenced by a (U)nconditional or (C)onditional Jump at Address:
:0045AA32(C)
0045AA94 FF7508 push [ebp+08]
0045AA97 E8E8D40200 call 00487F84
0045AA9C 8BF0 mov esi, eax
0045AA9E 59 pop ecx
0045AA9F 3BF3 cmp esi, ebx
0045AAA1 7413 je 0045AAB6
0045AAA3 8B4DE4 mov ecx, dword ptr [ebp-1C]
0045AAA6 56 push esi
0045AAA7 E814E20100 call 00478CC0
above call is calculating the MD5 HASH digest of the uppercase of the
input userName and get first two bytes of the digest and store it to a
memory locations for the later processing. this generate the string1.
the first two bytes.
0045AAAC 56 push esi
0045AAAD 8945EC mov dword ptr [ebp-14], eax
0045AAB0 E840C10200 call 00486BF5
0045AAB5 59 pop ecx
Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
:0045AA3B(C), :0045AA92(U), :0045AAA1(C)
0045AAB6 6A0F push 0000000F
0045AAB8 8D45D0 lea eax, dword ptr [ebp-30]
0045AABB 53 push ebx
0045AABC 50 push eax
0045AABD E84EA90200 call 00485410
0045AAC2 83C40C add esp, 0000000C
0045AAC5 8D4D0C lea ecx, dword ptr [ebp+0C]
0045AAC8 6A0E push 0000000E
0045AACA 6A0E push 0000000E
0045AACC E821560400 call 004A00F2
0045AAD1 50 push eax
0045AAD2 8D45D0 lea eax, dword ptr [ebp-30]
0045AAD5 50 push eax
0045AAD6 E895A90200 call 00485470
0045AADB 83C40C add esp, 0000000C
0045AADE 8D4D0C lea ecx, dword ptr [ebp+0C]
Possible Reference to Dialog: DialogID_0098, CONTROL_ID:00FF, ""
|
0045AAE1 6AFF push FFFFFFFF
0045AAE3 E859560400 call 004A0141
0045AAE8 8D459C lea eax, dword ptr [ebp-64]
0045AAEB 50 push eax
0045AAEC E8EFF10100 call 00479CE0
0045AAF1 85C0 test eax, eax
0045AAF3 59 pop ecx
0045AAF4 7505 jne 0045AAFB
Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
:0045AB0F(C), :0045AB25(C)
0045AAF6 885DF3 mov byte ptr [ebp-0D], bl
0045AAF9 EB67 jmp 0045AB62
Referenced by a (U)nconditional or (C)onditional Jump at Address:
:0045AAF4(C)
0045AAFB 8D45E0 lea eax, dword ptr [ebp-20]
0045AAFE 6A02 push 00000002
0045AB00 50 push eax
0045AB01 8D459C lea eax, dword ptr [ebp-64]
0045AB04 50 push eax
0045AB05 E8E6F10100 call 00479CF0
0045AB0A 83C40C add esp, 0000000C
0045AB0D 85C0 test eax, eax
0045AB0F 74E5 je 0045AAF6
0045AB11 8D45EC lea eax, dword ptr [ebp-14]
0045AB14 6A02 push 00000002
0045AB16 50 push eax
0045AB17 8D459C lea eax, dword ptr [ebp-64]
0045AB1A 50 push eax
0045AB1B E8D0F10100 call 00479CF0 <--- commented below.
through out a long way we come here. the call above is the first step to
construct the string2. by default, the string2 is initialized with '01 00'
as the first two bytes. this call fetch another two bytes in the memory loc
which store the string1 or dword zero before by the checking of h_num. cat
it to string2 follow the '01 00', now it is look like '01 00 xx xx' which
xx xx is denoted string1.
