<span class="pediy"><span class="pediy">
; ==============================================================================
; 00693E1E 根据 name[len-i] 计算得到 temp00
; ...
:0040799D 33FF xor edi, edi
:0040799F 8B5C2414 mov ebx, dword ptr [esp+14]]; 用户名第 len-i 位 name [len-i]
:004079A3 8B4C2418 mov ecx, dword ptr [esp+18]; 0x00000000
; ...
:004079CC 8BE9 mov ebp, ecx
:004079CE B940000000 mov ecx, 00000040
:004079D3 57 push edi
:004079D4 33FF xor edi, edi
:004079D6 33F6 xor esi, esi
; ******************************************************************************
:004079D8 D1E0 shl eax, 1; eax : 0xC7BC0D36
:004079DA D1D2 rcl edx, 1; edx : 0x0000025C
:004079DC D1D6 rcl esi, 1
:004079DE D1D7 rcl edi, 1
:004079E0 3BFD cmp edi, ebp
:004079E2 720B jb 004079EF
:004079E4 7704 ja 004079EA
:004079E6 3BF3 cmp esi, ebx; esi : temp00 的第1、2位
:004079E8 7205 jb 004079EF
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004079E4(C)
|
:004079EA 2BF3 sub esi, ebx
:004079EC 1BFD sbb edi, ebp
:004079EE 40 inc eax
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004079E2(C), :004079E8(C)
|
:004079EF E2E7 loop 004079D8; cx != 0? Yes,↑
; ******************************************************************************
:004079F1 8BC6 mov eax, esi
:004079F3 8BD7 mov edx, edi
; ...
; ==============================================================================
; 00693E52 利用 temp01 计算注册码 reg_code
; ...
:0040645A 8BF0 mov esi, eax; 中间值 temp01
:0040645C BD01000000 mov ebp, 00000001; 计数器
:00406461 33FF xor edi, edi
:00406463 C744240800000000 mov [esp+08], 00000000
:0040646B C744240C00000000 mov [esp+0C], 00000000
; ...
:00406481 45 inc ebp
:00406482 807C2EFF20 cmp byte ptr [esi+ebp-01], 20; 取第1位与 0x20 ( 
比较
:00406487 74F8 je 00406481; 等于?↑
:00406489 C644241000 mov [esp+10], 00
:0040648E 8A442EFF mov al, byte ptr [esi+ebp-01]
:00406492 3C2D cmp al, 2D; 取第1位与 0x2D (-)比较
:00406494 7508 jne 0040649E; 不等于?↓
:00406496 C644241001 mov [esp+10], 01
:0040649B 45 inc ebp
:0040649C EB05 jmp 004064A3
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406494(C)
|
:0040649E 3C2B cmp al, 2B; 取第1位与 0x2D (+)比较
:004064A0 7501 jne 004064A3; 不等于?
:004064A2 45 inc ebp
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040649C(U), :004064A0(C)
|
:004064A3 B301 mov bl, 01
:004064A5 807C2EFF24 cmp byte ptr [esi+ebp-01], 24; 与 0x24 ($)比较
:004064AA 741B je 004064C7
:004064AC 807C2EFF30 cmp byte ptr [esi+ebp-01], 30; 与 0x30 (0)比较
:004064B1 0F85DA000000 jne 00406591; 若不等于0跳走 ↓
; ==============================================================================
; 等于 0，就取下一位
:004064B7 8A042E mov al, byte ptr [esi+ebp]; temp01[1]
:004064BA E815C8FFFF call 00402CD4
; ------------------------------------------------------------------------------
:00402CD4 80F861 cmp al, 61
:00402CD7 7208 jb 00402CE1
:00402CD9 80F87A cmp al, 7A
:00402CDC 7703 ja 00402CE1
:00402CDE 80E820 sub al, 20
:00402CE1 C3 ret
; ------------------------------------------------------------------------------
:004064BF 3C58 cmp al, 58
:004064C1 0F85CA000000 jne 00406591 ↓ ; 跳到下面处理
; ...
; ==============================================================================
; 不等于 0，循环
; ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:00406591 8A442EFF mov al, byte ptr [esi+ebp-01]; 中间值第 i 位 temp01 [i]
:00406595 8BD0 mov edx, eax
:00406597 80C2D0 add dl, D0
:0040659A 80EA0A sub dl, 0A
:0040659D 7362 jnb 00406601; 如果temp01[i]>0x0A，也就是不在10D以内
:0040659F 8BF8 mov edi, eax
:004065A1 81E7FF000000 and edi, 000000FF
:004065A7 83EF30 sub edi, 00000030; temp01[i] - 0x30，为数字本身
:004065AA 837C240C00 cmp dword ptr [esp+0C], 00000000
:004065AF 7509 jne 004065BA; 不等于0？↓
:004065B1 837C240800 cmp dword ptr [esp+08], 00000000
:004065B6 7249 jb 00406601; 小于 0？↓
:004065B8 EB02 jmp 004065BC
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004065AF(C)
|
:004065BA 7C45 jl 00406601; 小于 0？↓
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004065B8(U)
|
:004065BC 817C240CCCCCCC0C cmp dword ptr [esp+0C], 0CCCCCCC
:004065C4 750C jne 004065D2; ↓
:004065C6 817C2408CCCCCCCC cmp dword ptr [esp+08], CCCCCCCC
:004065CE 7604 jbe 004065D4
:004065D0 EB2F jmp 00406601; ↓
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004065C4(C)
|
:004065D2 7F2D jg 00406601; ↓
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004065CE(C)
|
:004065D4 6A00 push 00000000
:004065D6 6A0A push 0000000A
:004065D8 8B442410 mov eax, dword ptr [esp+10]
:004065DC 8B542414 mov edx, dword ptr [esp+14]
:004065E0 E87B120000 call 00407860; 计算
; ------------------------------------------------------------------------------
* Referenced by a CALL at Addresses:
|:004065E0 , :0040AD33 , :0040AD4D , :006F61FE
|
:00407860 52 push edx
:00407861 50 push eax
:00407862 8B442410 mov eax, dword ptr [esp+10]
:00407866 F72424 mul dword ptr [esp]
:00407869 8BC8 mov ecx, eax
:0040786B 8B442404 mov eax, dword ptr [esp+04]
:0040786F F764240C mul [esp+0C]
:00407873 03C8 add ecx, eax
:00407875 8B0424 mov eax, dword ptr [esp]
:00407878 F764240C mul [esp+0C]
:0040787C 03D1 add edx, ecx
:0040787E 59 pop ecx
:0040787F 59 pop ecx
:00407880 C20800 ret 0008
; ------------------------------------------------------------------------------
:004065E5 52 push edx
:004065E6 50 push eax
:004065E7 8BC7 mov eax, edi
:004065E9 99 cdq
:004065EA 030424 add eax, dword ptr [esp]; 累加，就是注册码的后8位
:004065ED 13542404 adc edx, dword ptr [esp+04]; 前4位
:004065F1 83C408 add esp, 00000008
:004065F4 89442408 mov dword ptr [esp+08], eax
:004065F8 8954240C mov dword ptr [esp+0C], edx
:004065FC 45 inc ebp
:004065FD 33DB xor ebx, ebx
:004065FF EB90 jmp 00406591; ↑
; ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
; ...
:00406662 8B442408 mov eax, dword ptr [esp+08]; 后8位
:00406666 8B54240C mov edx, dword ptr [esp+0C]; 前4位
