For Guo Dongxin (29千字)
FontTwister v1.1 forWin95/98/NT的破解使用FontTwister你在几秒种之内就可以建立出色的字体。它的直观的表格式界面能够方便的让你增加斜面，浮雕，透明感，纹理，边缘和在你的字体上加上污点或使用它提供的12个内置的字体类型。你可以在字体建立的过程中随时预览并修改它。你可以将你的作品保存为以下几种类型的文件，包括.bmp, .emf, .jpg, 和.wmf。尽管它的界面看上去不那么出色，但FontTwister 仍是一个为网页，插图，多媒体文件和介绍建立自己的特色字体的实用工具。在你没注册之前，“试用版”这三个字将会出现在你所有输出的字体的中间 。
本人试了一下，制作按钮确实很好，值得破
* Reference To: user32.GetDlgCtrlID, Ord:0000h
|
:004BD833 E8F098F4FF Call 00407128
:004BD838 50 push eax
:004BD839 8BC3 mov eax, ebx
:004BD83B E8809BF7FF call 004373C0
:004BD840 50 push eax
* Reference To: user32.GetDlgItemTextA, Ord:0000h
|
:004BD841 E8F298F4FF Call 00407138
:004BD846 8D850BFEFFFF lea eax, dword ptr [ebp+FFFFFE0B] ====> eax指向输入的注册码
:004BD84C E8C7B7F4FF call 00409018 ====> 计算注册码的长度
:004BD851 83F819 cmp eax, 00000019 ====> 长度是否大于等于19h，即25
:004BD854 7340 jnb 004BD896 ====> 是则转
:004BD856 8D850BFEFFFF lea eax, dword ptr [ebp+FFFFFE0B] ====> eax指向输入的注册码
:004BD85C E8B7B7F4FF call 00409018 ====> 计算注册码的长度
:004BD861 83F801 cmp eax, 00000001 ====> 注册码是否为空
:004BD864 7623 jbe 004BD889 ====> 是则转
:004BD866 8D8516FCFFFF lea eax, dword ptr [ebp+FFFFFC16] ====> eax指向输入的注册名
:004BD86C E8A7B7F4FF call 00409018 ====> 计算注册码的长度
:004BD871 83F801 cmp eax, 00000001 ====> 注册码是否为空
:004BD874 7613 jbe 004BD889 ====> 是则转
:004BD876 6A10 push 00000010
* Possible StringData Ref from Code Obj ->"FontTwister"
|
:004BD878 68ECDA4B00 push 004BDAEC ====> 显示错误信息
* Possible StringData Ref from Code Obj ->"Wrong name or registration code! Enter here your address exactly so how "
->"this is written in your registering documents. Pay attention to case sensitive."
|
:004BD87D 68F8DA4B00 push 004BDAF8
:004BD882 6A00 push 00000000
* Reference To: user32.MessageBoxA, Ord:0000h
|
:004BD884 E87F9AF4FF Call 00407308
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004BD864(C), :004BD874(C)
|
:004BD889 33C0 xor eax, eax
:004BD88B 5A pop edx
:004BD88C 59 pop ecx
:004BD88D 59 pop ecx
:004BD88E 648910 mov dword ptr fs:[eax], edx
:004BD891 E927020000 jmp 004BDABD
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BD854(C)
|
:004BD896 55 push ebp
:004BD897 6A08 push 00000008 ====> 8入栈
:004BD899 B940000000 mov ecx, 00000040 ====> 40h即64入栈
:004BD89E BA0E000000 mov edx, 0000000E ====> 0Eh即14入栈
:004BD8A3 B80A000000 mov eax, 0000000A ====> 0Ah即10入栈，实际上是取注册码的第11-15个字符(因为包括第0位)
:004BD8A8 E82BFDFFFF call 004BD5D8 ====> 计算注册码并进行比较
:004BD8AD 59 pop ecx
:004BD8AE 84C0 test al, al ====> al做旗标
:004BD8B0 0F8407010000 je 004BD9BD ====> al=0则注册码错误
:004BD8B6 55 push ebp
:004BD8B7 6A09 push 00000009 ====> 9入栈
:004BD8B9 B930000000 mov ecx, 00000030 ====> 30h即48入栈
:004BD8BE BA13000000 mov edx, 00000013 ====> 13h即19入栈
:004BD8C3 B80F000000 mov eax, 0000000F ====> 0Fh即15入栈，实际上是取注册码的第16-20个字符(因为包括第0位)
:004BD8C8 E80BFDFFFF call 004BD5D8 ====> 计算注册码并进行比较
:004BD8CD 59 pop ecx
:004BD8CE 84C0 test al, al ====> al做旗标
:004BD8D0 0F84E7000000 je 004BD9BD ====> al=0则注册码错误
:004BD8D6 55 push ebp
:004BD8D7 6A0A push 0000000A ====> 0Ah即10入栈
:004BD8D9 B933000000 mov ecx, 00000033 ====> 30h即51入栈
:004BD8DE BA18000000 mov edx, 00000018 ====> 18h即24入栈
:004BD8E3 B814000000 mov eax, 00000014 ====> 14h即20入栈，实际上是取注册码的第21-25个字符(因为包括第0位)
:004BD8E8 E8EBFCFFFF call 004BD5D8 ====> 计算注册码并进行比较
:004BD8ED 59 pop ecx
:004BD8EE 84C0 test al, al ====> al做旗标
:004BD8F0 0F84C7000000 je 004BD9BD ====> al=0则注册码错误
:004BD8F6 6A01 push 00000001 ====> 3处比较正确则置正确标志
:004BD8F8 A150CD4D00 mov eax, dword ptr [004DCD50]
:004BD8FD 8B00 mov eax, dword ptr [eax]
* Possible StringData Ref from Code Obj ->"OkAll"
|
:004BD8FF B99CDB4B00 mov ecx, 004BDB9C
* Possible StringData Ref from Code Obj ->"Program"
|
:004BD904 BAACDB4B00 mov edx, 004BDBAC
:004BD909 8B30 mov esi, dword ptr [eax]
:004BD90B FF560C call [esi+0C]
:004BD90E 8D9514FAFFFF lea edx, dword ptr [ebp+FFFFFA14]
:004BD914 8D8516FCFFFF lea eax, dword ptr [ebp+FFFFFC16]
:004BD91A E851B9F4FF call 00409270
:004BD91F 8B8514FAFFFF mov eax, dword ptr [ebp+FFFFFA14]
:004BD925 50 push eax
:004BD926 A150CD4D00 mov eax, dword ptr [004DCD50]
:004BD92B 8B00 mov eax, dword ptr [eax]
:004BD92D B9BCDB4B00 mov ecx, 004BDBBC
* Possible StringData Ref from Code Obj ->"Program"
|
:004BD932 BAACDB4B00 mov edx, 004BDBAC
:004BD937 8B30 mov esi, dword ptr [eax]
:004BD939 FF5604 call [esi+04]
:004BD93C 8D850BFEFFFF lea eax, dword ptr [ebp+FFFFFE0B]
:004BD942 E8D1B6F4FF call 00409018
:004BD947 8BD0 mov edx, eax
:004BD949 4A dec edx
:004BD94A 85D2 test edx, edx
:004BD94C 7C14 jl 004BD962
:004BD94E 42 inc edx
:004BD94F 8D850BFEFFFF lea eax, dword ptr [ebp+FFFFFE0B] ====> eax指向注册码
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BD960(C)
|
:004BD955 33C9 xor ecx, ecx ====> ecx清0
:004BD957 8A08 mov cl, byte ptr [eax] ====> 取一个注册码字符
:004BD959 83C103 add ecx, 00000003 ====> 将该值+3
:004BD95C 8808 mov byte ptr [eax], cl ====> 再送回去
:004BD95E 40 inc eax ====> 准备取下一个
:004BD95F 4A dec edx ====> 是否取完
:004BD960 75F3 jne 004BD955 ====> 没有则继续
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BD94C(C)
|
:004BD962 8D9514FAFFFF lea edx, dword ptr [ebp+FFFFFA14]
:004BD968 8D850BFEFFFF lea eax, dword ptr [ebp+FFFFFE0B]
:004BD96E E8FDB8F4FF call 00409270
:004BD973 8B8514FAFFFF mov eax, dword ptr [ebp+FFFFFA14]
:004BD979 50 push eax
:004BD97A A150CD4D00 mov eax, dword ptr [004DCD50]
:004BD97F 8B00 mov eax, dword ptr [eax]
:004BD981 B9C8DB4B00 mov ecx, 004BDBC8
* Possible StringData Ref from Code Obj ->"Program"
|
:004BD986 BAACDB4B00 mov edx, 004BDBAC
:004BD98B 8B30 mov esi, dword ptr [eax]
:004BD98D FF5604 call [esi+04] ====> 存入到FTwister.ini中
:004BD990 6A40 push 00000040
* Possible StringData Ref from Code Obj ->"FontTwister"
|
:004BD992 68ECDA4B00 push 004BDAEC
* Possible StringData Ref from Code Obj ->"Thank you very much for registering. FontTwister is now unlocked. Please restart "
->"the program to activate all changes."
|
:004BD997 68CCDB4B00 push 004BDBCC
:004BD99C 8BC3 mov eax, ebx
:004BD99E E81D9AF7FF call 004373C0
:004BD9A3 50 push eax
* Reference To: user32.MessageBoxA, Ord:0000h
|
:004BD9A4 E85F99F4FF Call 00407308
:004BD9A9 8BC3 mov eax, ebx
:004BD9AB E8B8CFF8FF call 0044A968
:004BD9B0 33C0 xor eax, eax
:004BD9B2 5A pop edx
:004BD9B3 59 pop ecx
:004BD9B4 59 pop ecx
:004BD9B5 648910 mov dword ptr fs:[eax], edx
:004BD9B8 E900010000 jmp 004BDABD
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004BD8B0(C), :004BD8D0(C), :004BD8F0(C)
|
:004BD9BD BE25000000 mov esi, 00000025
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BD9D3(C)
|
:004BD9C2 BA44DC4B00 mov edx, 004BDC44
:004BD9C7 8D850BFEFFFF lea eax, dword ptr [ebp+FFFFFE0B]
:004BD9CD E87AB7F4FF call 0040914C
:004BD9D2 4E dec esi
:004BD9D3 75ED jne 004BD9C2
:004BD9D5 33F6 xor esi, esi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BDA7A(C)
|
:004BD9D7 68F5010000 push 000001F5
:004BD9DC 8D8516FCFFFF lea eax, dword ptr [ebp+FFFFFC16]
:004BD9E2 50 push eax
:004BD9E3 8B83E8020000 mov eax, dword ptr [ebx+000002E8]
:004BD9E9 E8D299F7FF call 004373C0
:004BD9EE 50 push eax
* Reference To: user32.GetDlgCtrlID, Ord:0000h
|
:004BD9EF E83497F4FF Call 00407128
:004BD9F4 50 push eax
:004BD9F5 8BC3 mov eax, ebx
:004BD9F7 E8C499F7FF call 004373C0
:004BD9FC 50 push eax
* Reference To: user32.GetDlgItemTextA, Ord:0000h
|
:004BD9FD E83697F4FF Call 00407138
:004BDA02 68F5010000 push 000001F5
:004BDA07 8D851BFAFFFF lea eax, dword ptr [ebp+FFFFFA1B]
:004BDA0D 50 push eax
:004BDA0E 8B83D8020000 mov eax, dword ptr [ebx+000002D8]
:004BDA14 E8A799F7FF call 004373C0
:004BDA19 50 push eax
* Reference To: user32.GetDlgCtrlID, Ord:0000h
|
:004BDA1A E80997F4FF Call 00407128
:004BDA1F 50 push eax
:004BDA20 8BC3 mov eax, ebx
:004BDA22 E89999F7FF call 004373C0
:004BDA27 50 push eax
* Reference To: user32.GetDlgItemTextA, Ord:0000h
|
:004BDA28 E80B97F4FF Call 00407138
:004BDA2D 8BC6 mov eax, esi
:004BDA2F F7AD10FCFFFF imul dword ptr [ebp+FFFFFC10]
:004BDA35 03C7 add eax, edi
:004BDA37 898510FAFFFF mov dword ptr [ebp+FFFFFA10], eax
:004BDA3D DB8510FAFFFF fild dword ptr [ebp+FFFFFA10]
:004BDA43 E8AC4FF4FF call 004029F4
:004BDA48 D80D48DC4B00 fmul dword ptr [004BDC48]
:004BDA4E E8CD4FF4FF call 00402A20
:004BDA53 85D2 test edx, edx
:004BDA55 7D07 jge 004BDA5E
:004BDA57 F7D8 neg eax
:004BDA59 83D200 adc edx, 00000000
:004BDA5C F7DA neg edx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BDA55(C)
|
:004BDA5E 03F8 add edi, eax
:004BDA60 89BD10FCFFFF mov dword ptr [ebp+FFFFFC10], edi
:004BDA66 8B8510FCFFFF mov eax, dword ptr [ebp+FFFFFC10]
:004BDA6C B964000000 mov ecx, 00000064
:004BDA71 99 cdq
:004BDA72 F7F9 idiv ecx
:004BDA74 8BFA mov edi, edx
:004BDA76 46 inc esi
:004BDA77 83FE65 cmp esi, 00000065
:004BDA7A 0F8557FFFFFF jne 004BD9D7
:004BDA80 8D850BFEFFFF lea eax, dword ptr [ebp+FFFFFE0B]
:004BDA86 E88DB5F4FF call 00409018
:004BDA8B 83F83A cmp eax, 0000003A
:004BDA8E 7319 jnb 004BDAA9
:004BDA90 6A10 push 00000010
* Possible StringData Ref from Code Obj ->"FontTwister"
|
:004BDA92 68ECDA4B00 push 004BDAEC
* Possible StringData Ref from Code Obj ->"Wrong name or registration code! Enter here your address exactly so how "
->"this is written in your registering documents. Pay attention to case sensitive."
|
:004BDA97 68F8DA4B00 push 004BDAF8
:004BDA9C 8BC3 mov eax, ebx
:004BDA9E E81D99F7FF call 004373C0
:004BDAA3 50 push eax
* Reference To: user32.MessageBoxA, Ord:0000h
|
:004BDAA4 E85F98F4FF Call 00407308
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BDA8E(C)
|
:004BDAA9 33C0 xor eax, eax
:004BDAAB 5A pop edx
:004BDAAC 59 pop ecx
:004BDAAD 59 pop ecx
:004BDAAE 648910 mov dword ptr fs:[eax], edx
:004BDAB1 EB0A jmp 004BDABD
:004BDAB3 E9E858F4FF jmp 004033A0
:004BDAB8 E8935BF4FF call 00403650
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004BD891(U), :004BD9B8(U), :004BDAB1(U)
|
:004BDABD 33C0 xor eax, eax
:004BDABF 5A pop edx
:004BDAC0 59 pop ecx
:004BDAC1 59 pop ecx
:004BDAC2 648910 mov dword ptr fs:[eax], edx
:004BDAC5 68DDDA4B00 push 004BDADD
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BDADB(U)
|
:004BDACA 8D8514FAFFFF lea eax, dword ptr [ebp+FFFFFA14]
:004BDAD0 E8B360F4FF call 00403B88
:004BDAD5 C3 ret
:004BDAD6 E9CD5AF4FF jmp 004035A8
:004BDADB EBED jmp 004BDACA
:004BDADD 5F pop edi
:004BDADE 5E pop esi
:004BDADF 5B pop ebx
:004BDAE0 8BE5 mov esp, ebp
:004BDAE2 5D pop ebp
:004BDAE3 C20C00 ret 000C
计算注册码并比较的Call
* Referenced by a CALL at Addresses:
|:004BD8A8 , :004BD8C8 , :004BD8E8
|
:004BD5D8 55 push ebp
:004BD5D9 8BEC
