续3 (9千字)
* Referenced by a CALL at Address:|:00416950
|
:00416710 55 push ebp
:00416711 8BEC mov ebp, esp
:00416713 6AFF push FFFFFFFF
:00416715 68B0354400 push 004435B0
:0041671A 6814934300 push 00439314
:0041671F 64A100000000 mov eax, dword ptr fs:[00000000]
:00416725 50 push eax
:00416726 64892500000000 mov dword ptr fs:[00000000], esp
:0041672D 83EC08 sub esp, 00000008
:00416730 53 push ebx
:00416731 56 push esi
:00416732 57 push edi
:00416733 8965E8 mov dword ptr [ebp-18], esp
:00416736 C745FC00000000 mov [ebp-04], 00000000
:0041673D 68B0B24400 push 0044B2B0
* Reference To: KRNLAPI.Ordinal:001B, Ord:001Bh
|
:00416742 E813260200 Call 00438D5A
:00416747 83C404 add esp, 00000004
:0041674A 85C0 test eax, eax
:0041674C 7419 je 00416767
:0041674E 6818C14400 push 0044C118
:00416753 681CB64400 push 0044B61C
:00416758 E8E3CDFEFF call 00403540<---跟进去，核心计算
:0041675D 83C408 add esp, 00000008
:00416760 A358C24400 mov dword ptr [0044C258], eax
:00416765 EB1F jmp 00416786
===================================================================
* Referenced by a CALL at Address:
|:00416758
|
:00403540 83EC20 sub esp, 00000020
:00403543 B908000000 mov ecx, 00000008
:00403548 33C0 xor eax, eax
:0040354A 53 push ebx
:0040354B 55 push ebp
:0040354C 8B6C2430 mov ebp, dword ptr [esp+30]
:00403550 56 push esi
:00403551 57 push edi
:00403552 8D7C2410 lea edi, dword ptr [esp+10]
:00403556 F3 repz
:00403557 AB stosd
:00403558 8BDD mov ebx, ebp
:0040355A 8D442410 lea eax, dword ptr [esp+10]
:0040355E 33F6 xor esi, esi
:00403560 2BD8 sub ebx, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403586(C)
|
:00403562 8D7C3410 lea edi, dword ptr [esp+esi+10]
:00403566 0FBE043B movsx eax, byte ptr [ebx+edi]<--注册码
:0040356A 83F841 cmp eax, 00000041 第一字
:0040356D 7C08 jl 00403577
:0040356F 83F85A cmp eax, 0000005A
:00403572 7F03 jg 00403577
:00403574 83C020 add eax, 00000020
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040356D(C), :00403572(C)
|
:00403577 50 push eax
:00403578 E863FFFFFF call 004034E0
:0040357D 83C404 add esp, 00000004
:00403580 46 inc esi
:00403581 83FE04 cmp esi, 00000004
:00403584 8807 mov byte ptr [edi], al
:00403586 7CDA jl 00403562
:00403588 8B442410 mov eax, dword ptr [esp+10]
:0040358C 8D4801 lea ecx, dword ptr [eax+01]
:0040358F 0FAFC8 imul ecx, eax
:00403592 894C2414 mov dword ptr [esp+14], ecx
:00403596 33F6 xor esi, esi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004035B9(C)
|
:00403598 8A543414 mov dl, byte ptr [esp+esi+14]
:0040359C 52 push edx
:0040359D 56 push esi
:0040359E E81DFFFFFF call 004034C0
:004035A3 25FF000000 and eax, 000000FF
:004035A8 50 push eax
:004035A9 E832FFFFFF call 004034E0
:004035AE 83C40C add esp, 0000000C
:004035B1 88443414 mov byte ptr [esp+esi+14], al<--算出第5个字
:004035B5 46 inc esi
:004035B6 83FE04 cmp esi, 00000004<--循环算出6,7,8个字
:004035B9 7CDD jl 00403598
:004035BB 33C9 xor ecx, ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004035E0(C)
|
:004035BD 0FBE442905 movsx eax, byte ptr [ecx+ebp+05]
:004035C2 83F841 cmp eax, 00000041
:004035C5 7C08 jl 004035CF
:004035C7 83F85A cmp eax, 0000005A
:004035CA 7F03 jg 004035CF
:004035CC 83C020 add eax, 00000020
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004035C5(C), :004035CA(C)
|
:004035CF 0FBE540C14 movsx edx, byte ptr [esp+ecx+14]
:004035D4 3BC2 cmp eax, edx<---与假注册码比较
:004035D6 0F85BA000000 jne 00403696
:004035DC 41 inc ecx
:004035DD 83F904 cmp ecx, 00000004
:004035E0 7CDB jl 004035BD
:004035E2 8B442414 mov eax, dword ptr [esp+14]
:004035E6 8B4C2410 mov ecx, dword ptr [esp+10]
:004035EA 8BD0 mov edx, eax
:004035EC 33D1 xor edx, ecx
:004035EE 42 inc edx
:004035EF 0FAFD1 imul edx, ecx
:004035F2 03D0 add edx, eax
:004035F4 33F6 xor esi, esi
:004035F6 89542418 mov dword ptr [esp+18], edx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403610(C)
|
:004035FA 0FBE443418 movsx eax, byte ptr [esp+esi+18]
:004035FF 50 push eax
:00403600 E8DBFEFFFF call 004034E0
:00403605 83C404 add esp, 00000004
:00403608 88443418 mov byte ptr [esp+esi+18], al
:0040360C 46 inc esi
:0040360D 83FE04 cmp esi, 00000004<--由5,6,7,8算出
:00403610 7CE8 jl 004035FA 9,10,11,12个字
:00403612 33C9 xor ecx, ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403633(C)
|
:00403614 0FBE44290A movsx eax, byte ptr [ecx+ebp+0A]
:00403619 83F841 cmp eax, 00000041
:0040361C 7C08 jl 00403626
:0040361E 83F85A cmp eax, 0000005A
:00403621 7F03 jg 00403626
:00403623 83C020 add eax, 00000020
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040361C(C), :00403621(C)
|
:00403626 0FBE540C18 movsx edx, byte ptr [esp+ecx+18]
:0040362B 3BC2 cmp eax, edx<---与假注册码比较
:0040362D 7567 jne 00403696
:0040362F 41 inc ecx
:00403630 83F904 cmp ecx, 00000004
:00403633 7CDF jl 00403614
:00403635 8B4C2414 mov ecx, dword ptr [esp+14]
:00403639 8B442410 mov eax, dword ptr [esp+10]
:0040363D 0FAFC8 imul ecx, eax
:00403640 41 inc ecx
:00403641 0FAF4C2418 imul ecx, dword ptr [esp+18]
:00403646 03C8 add ecx, eax
:00403648 33F6 xor esi, esi
:0040364A 894C241C mov dword ptr [esp+1C], ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403664(C)
|
:0040364E 0FBE54341C movsx edx, byte ptr [esp+esi+1C]
:00403653 52 push edx
:00403654 E887FEFFFF call 004034E0
:00403659 83C404 add esp, 00000004
:0040365C 8844341C mov byte ptr [esp+esi+1C], al
:00403660 46 inc esi
:00403661 83FE04 cmp esi, 00000004<--注册码的13,14,15,16个字
:00403664 7CE8 jl 0040364E
:00403666 33C9 xor ecx, ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403687(C)
|
:00403668 0FBE44290F movsx eax, byte ptr [ecx+ebp+0F]
:0040366D 83F841 cmp eax, 00000041
:00403670 7C08 jl 0040367A
:00403672 83F85A cmp eax, 0000005A
:00403675 7F03 jg 0040367A
:00403677 83C020 add eax, 00000020
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403670(C), :00403675(C)
|
:0040367A 0FBE540C1C movsx edx, byte ptr [esp+ecx+1C]
:0040367F 3BC2 cmp eax, edx<--与假注册码比较
:00403681 7513 jne 00403696
:00403683 41 inc ecx
:00403684 83F904 cmp ecx, 00000004
:00403687 7CDF jl 00403668
:00403689 5F pop edi
:0040368A 5E pop esi
:0040368B 5D pop ebp
:0040368C B801000000 mov eax, 00000001<--到这里就注册成功了
:00403691 5B pop ebx
:00403692 83C420 add esp, 00000020
:00403695 C3 ret
用户名：lancelot 注册码：4343-bz5x-15qq-m35q
crack by lancelot 2001.7.8
