彩票快车V1.07注册码算法分析： (3千字)
016F:004A8A80 CALL 00403DE4 取name长度016F:004A8A85 ADD EAX,BYTE +0B 加上0B
016F:004A8A88 MOV ECX,EAX
016F:004A8A8A SHL ECX,07
016F:004A8A8D SUB ECX,EAX *7F 设为L
016F:004A8A8F MOV EAX,[004B7CF0]
016F:004A8A94 MOV EAX,[EAX] 取用户码
016F:004A8A96 MOV EBX,7F
016F:004A8A9B CDQ
016F:004A8A9C IDIV EBX
016F:004A8A9E MOV EDX,EAX 除以7F取余
016F:004A8AA0 SHL EAX,04
016F:004A8AA3 ADD EAX,EDX *11
016F:004A8AA5 XOR EAX,02EFB69C XOR 02EFB69C
016F:004A8AAA CDQ \
016F:004A8AAB XOR EAX,EDX > 取绝对值
016F:004A8AAD SUB EAX,EDX /
016F:004A8AAF ADD ECX,EAX 与L相加
016F:004A8AB1 MOV EAX,[004B7CF0]
016F:004A8AB6 MOV [EAX],ECX 放回用户码处，设为Y
016F:004A8AB8 MOV EDX,[004B7C08]
016F:004A8ABE MOV EDX,[EDX]
016F:004A8AC0 MOV EAX,[004B7AAC]
016F:004A8AC5 MOV ECX,004A8E40
016F:004A8ACA CALL 00403E30 将name与**&%#$@KLhd串起来
016F:004A8ACF MOV EAX,[004B7AAC] 如：abc->abc**&%#$@KLhd 设为name'
016F:004A8AD4 MOV EAX,[EAX]
016F:004A8AD6 CALL 00403DE4 取name'的长度
016F:004A8ADB MOV ECX,EAX
016F:004A8ADD TEST ECX,ECX
016F:004A8ADF JNG 004A8B17
016F:004A8AE1 MOV EBX,01 循环变量
016F:004A8AE6 MOV EAX,[004B7AAC] －－循环头－－
016F:004A8AEB MOV EAX,[EAX]
016F:004A8AED MOVZX EAX,BYTE [EAX+EBX-01] 取name'的第EBX个字符
016F:004A8AF2 MOV EDX,[004B7CF0]
016F:004A8AF8 IMUL DWORD [EDX] 与Y相乘
016F:004A8AFA ADD EAX,9F 加上9F
016F:004A8AFF CDQ
016F:004A8B00 XOR EAX,EDX
016F:004A8B02 SUB EAX,EDX 取绝对值
016F:004A8B04 MOV EDI,05F5E100
016F:004A8B09 CDQ
016F:004A8B0A IDIV EDI 除以05F5E100
016F:004A8B0C MOV EAX,[004B7CF0]
016F:004A8B11 MOV [EAX],EDX 放入Y
016F:004A8B13 INC EBX
016F:004A8B14 DEC ECX 循环次数为name'的长度
016F:004A8B15 JNZ 004A8AE6 －－循环尾－－
016F:004A8B17 MOV EAX,[004B7CF0]
016F:004A8B1C ADD DWORD [EAX],016676E1 y+016676E1-->Y
016F:004A8B22 MOV EAX,[004B7AAC]
016F:004A8B27 PUSH EAX
016F:004A8B28 LEA EDX,[EBP-10]
016F:004A8B2B MOV EAX,[004B7CF0]
016F:004A8B30 MOV EAX,[EAX]
016F:004A8B32 CALL 00408684 将Y变成10进制的字符串，设为Y'
016F:004A8B37 MOV EAX,[EBP-10]
016F:004A8B3A MOV ECX,08
016F:004A8B3F MOV EDX,01
016F:004A8B44 CALL 00403FEC 取Y'的前8位，设为Y"
016F:004A8B49 LEA EAX,[EBP-04]
016F:004A8B4C MOV EDX,004A8E54 这里有一串字符：35217864
016F:004A8B51 CALL 00403BFC
016F:004A8B56 MOV EAX,[004B7D30]
016F:004A8B5B CALL 00403B64
016F:004A8B60 MOV EBX,01 循环变量
016F:004A8B65 LEA EAX,[EBP-14] －－循环头－－
016F:004A8B68 MOV EDX,[EBP-04]
016F:004A8B6B MOVZX EDX,BYTE [EDX+EBX-01]
016F:004A8B70 MOV ECX,[004B7AAC]
016F:004A8B76 MOV ECX,[ECX]
016F:004A8B78 MOV DL,[ECX+EDX-31] 这个循环的作用是：
016F:004A8B7C CALL 00403D0C 将Y"串作位置上的变换，
016F:004A8B81 MOV EDX,[EBP-14] 如Y"=12345678，则变换为35217864
016F:004A8B84 MOV EAX,[004B7D30] 哈哈，变换后的串就是注册码了！
016F:004A8B89 CALL 00403DEC
016F:004A8B8E MOV EAX,[004B7D30]
016F:004A8B93 INC EBX
016F:004A8B94 CMP EBX,BYTE +09 循环8次
016F:004A8B97 JNZ 004A8B65 －－循环尾－－
016F:004A8B99 LEA EDX,[EBP-1C]
016F:004A8B9C MOV EAX,[ESI+02FC]
