File Protector 2000 v2.02 Special Edition documentation (7千字)
他的注册名注册码序列号信息放在注册表里HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Fileprot\Parameters和
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\vftd
调用regqueryvalue 三次,为什么d *(esp+4)看不到键名,如何看呢,不会吧,还有最后一次调用的时候仿佛在系统代码里就跳出注册对话框,总找不到关键部分,哪位高手可以指点?
;Generate by Txt2Asm V1.0
esp_10 db 0 ;保存ecx+5
esp_04 db 0 ;保存高4位
esp_08 db 0 ;保存低4位
lea ecx, addr Serial
mov al, 2D
mov dl, byte ptr [ecx+4]
cmp dl, al
je @sn_07
mov byte ptr [ecx+4],al
@sn_07: cmp byte ptr [ecx+7],al
je @sn_0B:
mov byte ptr [ecx+7],al
@sn_0B: cmp byte ptr [ecx+0Bh],al
je @sn_0D
mov byte ptr [ecx+0Bh],al
@sn_0D: cmp byte ptr [ecx+0Dh],al
je @sn_1C
mov byte ptr [ecx+0dh],al
@sn_1C: cmp byte ptr [ecx+1Ch],al
je @sn_over
mov byte ptr [ecx+1ch],al
@sn_over:
mov al, byte ptr [ecx+0Fh] ;取Ecx+f，10，11，12，15，16，17，19 处字符
;必须在30～46之间取值
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+10h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+11h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+12h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+15h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+16h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+17h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+19h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
cmp byte ptr [ecx], 46 ;前4位必须为FP18-
jne 0040E4FF
cmp byte ptr [ecx+01], 50
jne 0040E4FF
cmp byte ptr [ecx+02], 31
jne 0040E4FF
cmp byte ptr [ecx+03], 38
jne 0040E4FF
mov dl, byte ptr [ecx+05] ;dl<-ecx+5
mov bl, byte ptr [ecx+08] ;bl<-ecx+8
mov byte ptr esp_10, dl ;save to esp_10
mov dl, byte ptr [ecx+17] ;al=ecx+19 add 17,16,15,12,11,10,F
add al, dl
mov dl, byte ptr [ecx+16]
add al, dl
mov dl, byte ptr [ecx+15]
add al, dl
mov dl, byte ptr [ecx+12]
add al, dl
mov dl, byte ptr [ecx+11]
add al, dl
mov dl, byte ptr [ecx+10]
add al, dl
mov dl, byte ptr [ecx+0F]
add al, dl
mov dl, byte ptr esp_10 ;dl=saved ecx+5 (al xor dl)
xor al, dl
mov dl, byte ptr [ecx+0C] ;刚才的运算结果al与5,0C,8,5位依次xor,再与23h xor
xor al, bl ;bl=ecx+8
xor al, dl
xor al, 23
mov dl, al ;校验结果存为al,dl
shr dl, 04 ;去掉低4位,将其转化为0~F的字符
add dl, 30
cmp dl, 39
mov byte ptr esp_04, dl ;存放去掉低4位的高四位结果
jbe RA_0E38C
add dl, 07
mov byte ptr esp_04, dl
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E383(C)
;|
RA_0E38C:
and al, 0F
;0040E38E:
add al, 30
cmp al, 39
mov byte ptr esp_08, al ;存放低四位转化为0~F字符
jbe RA_0E39E
add al, 07
mov byte ptr esp_08, al
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E396(C)
;|
RA_0E39E:
movsx eax, byte ptr [ecx+13h] ;取ecx+13 标志1***********
;0040E3A2:
mov edx, dword ptr esp_04 ;高4位转化为的0~F字符
and edx, 000000FF
cmp eax, edx
je @flg_cmp1
mov byte ptr [ecx+13h],dl
@flg_cmp1:
mov dl, byte ptr [ecx+14] ;ecx+14 标志2************
push esi
mov esi, dword ptr esp_0c ;因为push esi esp_0c=esp+8
movsx eax, dl
and esi, 000000FF
cmp eax, esi
pop esi
je @flg_cmp1:
PUSH EAX
MOV EAX,dword ptr esp_0c
mov byte ptr [ecx+14h],al
POP EAX
@flg_cmp2:
mov al, byte ptr [ecx+0A] ;(ECX+0A) +'-',XOR ECX+9 XOR ECX+14 XOR ECX+13
add al, 46
xor al, byte ptr [ecx+09]
xor al, dl
mov dl, byte ptr [ecx+13]
xor al, dl
xor al, bl ;XOR BL=ECX+8 与41h 异或得到结果
xor al, 41
mov dl, al
shr dl, 04 ;高位转化为0~f字符 ->esp_04
add dl, 30
cmp dl, 39
mov byte ptr esp_04, dl
jbe RA_0E3F9
add dl, 07
mov byte ptr esp_04, dl
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E3F0(C)
;|
RA_0E3F9:
and al, 0F
;0040E3FB:
add al, 30
cmp al, 39
mov byte ptr esp_08, al ;低位化为0~f字符 ->esp_08
jbe RA_0E40B
add al, 07
mov byte ptr [esp+08], al
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E403(C)
;|
RA_0E40B:
movsx edx, byte ptr [ecx+1A] ;ecx+1A 标志3******************
;0040E40F:
mov eax, dword ptr [esp+04] ;高位与ecx+1A 对比
and eax, 000000FF
cmp edx, eax
je @sn_flgcmp3
mov byte ptr [ecx+1A],al
@sn_flgcmp3:
mov bl, byte ptr [ecx+1B] ;ecx+1bh 标志4*************
mov eax, dword ptr esp_8
movsx edx, bl
and eax, 000000FF
cmp edx, eax
jne @sn_flgcmp3:
mov byte ptr [ecx+1B],al
@sn_flgcmp3:
mov al, byte ptr [ecx+06] ;ecx+06 xor ecx+14 xor 13 xor ecx+5
;与ABh数字异或得到结果
mov dl, byte ptr [ecx+14]
xor al, dl
mov dl, byte ptr [ecx+13]
xor al, dl
mov dl, byte ptr esp_10 ;esp_10=ecx+5
xor al, dl
xor al, AB
mov dl, al
shr dl, 04
add dl, 30
cmp dl, 39
mov byte ptr esp_04, dl ;高4位
jbe RA_0E464
add dl, 07
mov byte ptr esp_04, dl
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E45B(C)
;|
RA_0E464:
and al, 0F
;0040E466:
add al, 30
cmp al, 39
mov byte ptr esp_08, al ;低4位
jbe RA_0E476
add al, 07
mov byte ptr esp_08, al
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E46E(C)
;|
RA_0E476:
movsx edx, byte ptr [ecx+0E] ;ecx+0E 标志5******************
;0040E47A:
mov eax, dword ptr [esp+04]
and eax, 000000FF
cmp edx, eax
jne 0040E4FF
movsx edx, byte ptr [ecx+18] ;ecx+18 标志6********************
mov eax, dword ptr [esp+08]
and eax, 000000FF
cmp edx, eax
jne 0040E4FF
mov al, byte ptr [ecx+1A] ;1a,1c
mov dl, byte ptr [ecx+0C]
xor bl, al ;ecx+8 xor 1A xor 1C xor 数字63h最后结果
xor bl, dl
xor bl, 63
mov dl, bl
mov al, dl
shr al, 04 ;高四位
add al, 30
cmp al, 39
mov byte ptr [esp+04], al
jbe RA_0E4BC
add al, 07
mov byte ptr [esp+04], al
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E4B4(C)
;|
RA_0E4BC:
and dl, 0F ;低四位
;0040E4BF:
add dl, 30
cmp dl, 39
mov byte ptr [esp+08], dl
jbe RA_0E4D2
add dl, 07
mov byte ptr [esp+08], dl
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E4C9(C)
;|
RA_0E4D2:
movsx edx, byte ptr [ecx+1D] ;ecx+1D 标志7*************
;0040E4D6:
mov eax, dword ptr [esp+04]
and eax, 000000FF
cmp edx, eax
jne 0040E4FF
movsx ecx, byte ptr [ecx+1E] ;ecx+1E 标志8************
mov edx, dword ptr [esp+08]
xor eax, eax
and edx, 000000FF
pop ebx
cmp ecx, edx
sete al
add esp, 00000008
ret 0004
;* Referenced by a (U)nconditional or (C)onditional Jump at Addresses
;|0040E24F(C), 0040E258(C), 0040E261(C), 0040E26A(C), 0040E273(C)
;|0040E27E(C), 0040E286(C), 0040E291(C), 0040E299(C), 0040E2A4(C)
;|0040E2AC(C), 0040E2B7(C), 0040E2BF(C), 0040E2CA(C), 0040E2D2(C)
;|0040E2DD(C), 0040E2E5(C), 0040E2F0(C), 0040E2F8(C), 0040E303(C)
;|0040E30B(C), 0040E314(C), 0040E31E(C), 0040E328(C), 0040E332(C)
;|0040E3AE(C), 0040E3C8(C), 0040E41A(C), 0040E431(C), 0040E485(C)
;|0040E496(C), 0040E4E1(C)
;|
RA_0E4FF:
xor eax, eax
;0040E501:
ret 0004
nop
