利用PEID发现该程序是ASProtect 2.1x SKE -> Alexey Solodovnikov加密的,利用Volx提供的Aspr2.XX_unpacker_v1.0SC.osc脚本脱壳,然后利用ImprtRec修复IAT,OEP为0x6ABD7,脱壳完成.
首先利用对Kernel32.dll中的CreateFileA函数下断点,可以知道注册码存放在Key.dat中,利用C32ASM可以定位程序的注册信息保存部分:
0040DEB0              .  6A FF           push -1
0040DEB2              .  68 B3CD4600     push de_***_.0046CDB3               ;  SE handler installation
0040DEB7              .  64:A1 00000000  mov eax,dword ptr fs:[0]
0040DEBD              .  50              push eax
0040DEBE              .  64:8925 0000000>mov dword ptr fs:[0],esp
0040DEC5              .  81EC 38020000   sub esp,238
0040DECB              .  53              push ebx
0040DECC              .  56              push esi
0040DECD              .  8BF1            mov esi,ecx
0040DECF              .  57              push edi
0040DED0              .  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040DED4              .  FF15 58274700   call dword ptr ds:[<&mfc80u.#293>]  ;  mfc80u.783997F3
0040DEDA              .  33FF            xor edi,edi
0040DEDC              .  8D4C24 10       lea ecx,dword ptr ss:[esp+10]
0040DEE0              .  89BC24 4C020000 mov dword ptr ss:[esp+24C],edi
0040DEE7              .  FF15 58274700   call dword ptr ds:[<&mfc80u.#293>]  ;  mfc80u.783997F3
0040DEED              .  8D4424 10       lea eax,dword ptr ss:[esp+10]
0040DEF1              .  50              push eax
0040DEF2              .  8D8E F8010000   lea ecx,dword ptr ds:[esi+1F8]
0040DEF8              .  C68424 50020000>mov byte ptr ss:[esp+250],1
0040DF00              .  E8 F3C60500     call <jmp.&mfc80u.#3756>
0040DF05              .  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040DF09              .  8D9E A4010000   lea ebx,dword ptr ds:[esi+1A4]
0040DF0F              .  51              push ecx
0040DF10              .  8BCB            mov ecx,ebx
0040DF12              .  E8 E1C60500     call <jmp.&mfc80u.#3756>
0040DF17              .  68 00010000     push 100                            ; /n = 100 (256.)
0040DF1C              .  8D5424 2A       lea edx,dword ptr ss:[esp+2A]       ; |
0040DF20              .  57              push edi                            ; |c
0040DF21              .  52              push edx                            ; |s
0040DF22              .  66:897C24 30    mov word ptr ss:[esp+30],di         ; |
0040DF27              .  E8 16CD0500     call <jmp.&msvcr80.memset>          ; \memset
0040DF2C              .  83C4 0C         add esp,0C
0040DF2F              .  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040DF33              .  FF15 5C274700   call dword ptr ds:[<&mfc80u.#2895>] ;  mfc80u.78305457
0040DF39              .  85C0            test eax,eax
0040DF3B              .  7E 41           jle short de_***_.0040DF7E
0040DF3D              .  55              push ebp
0040DF3E              .  8D6C24 28       lea ebp,dword ptr ss:[esp+28]
0040DF42              >  57              push edi
0040DF43              .  8D4C24 14       lea ecx,dword ptr ss:[esp+14]
0040DF47              .  FF15 94234700   call dword ptr ds:[<&mfc80u.#860>]  ;  mfc80u.783053F6
0040DF4D              .  0FB7C0          movzx eax,ax
0040DF50              .  66:3D 4100      cmp ax,41
0040DF54              .  72 06           jb short de_***_.0040DF5C
0040DF56              .  66:3D 5A00      cmp ax,5A
0040DF5A              .  76 09           jbe short de_***_.0040DF65
0040DF5C              >  8D48 D0         lea ecx,dword ptr ds:[eax-30]       ;  如果注册码是数字的话
0040DF5F              .  66:83F9 09      cmp cx,9
0040DF63              .  77 07           ja short de_***_.0040DF6C
0040DF65              >  66:8945 00      mov word ptr ss:[ebp],ax
0040DF69              .  83C5 02         add ebp,2
0040DF6C              >  8D4C24 10       lea ecx,dword ptr ss:[esp+10]
0040DF70              .  83C7 01         add edi,1
0040DF73              .  FF15 5C274700   call dword ptr ds:[<&mfc80u.#2895>] ;  注册码的长度
0040DF79              .  3BF8            cmp edi,eax
0040DF7B              .^ 7C C5           jl short de_***_.0040DF42           ;  将注册码转变为UNICODE类型的
0040DF7D              .  5D              pop ebp
0040DF7E              >  8D5424 24       lea edx,dword ptr ss:[esp+24]       ;  UNICODE的注册码
0040DF82              .  52              push edx
0040DF83              .  8D4424 10       lea eax,dword ptr ss:[esp+10]
0040DF87              .  68 20304700     push de_***_.00473020               ;  UNICODE "%s"
0040DF8C              .  50              push eax
0040DF8D              .  FF15 60274700   call dword ptr ds:[<&mfc80u.#2311>] ;  mfc80u.78306E74
0040DF93              .  83C4 0C         add esp,0C
0040DF96              .  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040DF9A              .  FF15 F8264700   call dword ptr ds:[<&mfc80u.#6167>] ;  mfc80u.783063CC
0040DFA0              .  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040DFA4              .  FF15 FC264700   call dword ptr ds:[<&mfc80u.#6173>] ;  mfc80u.78306382
0040DFAA              .  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040DFAE              .  FF15 5C274700   call dword ptr ds:[<&mfc80u.#2895>] ;  mfc80u.78305457
0040DFB4              .  3D 80000000     cmp eax,80                          ;  注册码长度与0x80比较
0040DFB9              .  0F8F C8000000   jg de_***_.0040E087
0040DFBF              .  8D4C24 14       lea ecx,dword ptr ss:[esp+14]
0040DFC3              .  E8 9EC40500     call <jmp.&mfc80u.#384>
0040DFC8              .  6A 00           push 0
0040DFCA              .  68 01100000     push 1001
0040DFCF              .  68 F8644700     push de_***_.004764F8               ;  UNICODE "Key.dat"
0040DFD4              .  8D4C24 20       lea ecx,dword ptr ss:[esp+20]
0040DFD8              .  C68424 58020000>mov byte ptr ss:[esp+258],2
0040DFE0              .  E8 7BC40500     call <jmp.&mfc80u.#5083>
0040DFE5              .  85C0            test eax,eax
0040DFE7              .  75 1F           jnz short de_***_.0040E008
0040DFE9              .  8B4E 20         mov ecx,dword ptr ds:[esi+20]
0040DFEC              .  51              push ecx
0040DFED              .  68 D5000000     push 0D5                            ;  保存注册信息失败
0040DFF2              .  E8 E9200000     call de_***_.004100E0
0040DFF7              .  8B16            mov edx,dword ptr ds:[esi]
0040DFF9              .  8B82 58010000   mov eax,dword ptr ds:[edx+158]
0040DFFF              .  83C4 08         add esp,8
0040E002              .  8BCE            mov ecx,esi
0040E004              .  FFD0            call eax
0040E006              .  EB 60           jmp short de_***_.0040E068
0040E008              >  8D4C24 10       lea ecx,dword ptr ss:[esp+10]
0040E00C              .  FF15 74274700   call dword ptr ds:[<&mfc80u.#870>]  ;  mfc80u.7839327F
0040E012              .  8B3D D4224700   mov edi,dword ptr ds:[<&kernel32.ls>;  KERNEL32.lstrcpyW
0040E018              .  50              push eax                            ; /机器码
0040E019              .  8D8C24 2C010000 lea ecx,dword ptr ss:[esp+12C]      ; |
0040E020              .  51              push ecx                            ; |String1
0040E021              .  FFD7            call edi                            ; \lstrcpyW
0040E023              .  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040E027              .  FF15 74274700   call dword ptr ds:[<&mfc80u.#870>]  ;  mfc80u.7839327F
0040E02D              .  50              push eax
0040E02E              .  8D9424 46010000 lea edx,dword ptr ss:[esp+146]
0040E035              .  52              push edx
0040E036              .  FFD7            call edi
0040E038              .  68 1C010000     push 11C
0040E03D              .  8D8424 2C010000 lea eax,dword ptr ss:[esp+12C]
0040E044              .  50              push eax                            ;  机器码
0040E045              .  8D4C24 1C       lea ecx,dword ptr ss:[esp+1C]
0040E049              .  E8 32C50500     call <jmp.&mfc80u.#6284>
0040E04E              .  8D4C24 14       lea ecx,dword ptr ss:[esp+14]
0040E052              .  E8 03C40500     call <jmp.&mfc80u.#1430>
0040E057              .  8B4E 20         mov ecx,dword ptr ds:[esi+20]
0040E05A              .  51              push ecx
0040E05B              .  68 D6000000     push 0D6                            ;  重新启动程序后将判断注册信息是否正确
0040E060              .  E8 7B200000     call de_***_.004100E0
0040E065              .  83C4 08         add esp,8
0040E068              >  8D4C24 14       lea ecx,dword ptr ss:[esp+14]
0040E06C              .  C68424 4C020000>mov byte ptr ss:[esp+24C],1
0040E074              .  E8 DBC30500     call <jmp.&mfc80u.#629>
0040E079              .  8B16            mov edx,dword ptr ds:[esi]
0040E07B              .  8B82 58010000   mov eax,dword ptr ds:[edx+158]
0040E081              .  8BCE            mov ecx,esi
0040E083              .  FFD0            call eax
0040E085              .  EB 18           jmp short de_***_.0040E09F
0040E087              >  8B4E 20         mov ecx,dword ptr ds:[esi+20]
0040E08A              .  51              push ecx
0040E08B              .  68 D7000000     push 0D7
0040E090              .  E8 4B200000     call de_***_.004100E0
0040E095              .  83C4 08         add esp,8
0040E098              .  8BCB            mov ecx,ebx
0040E09A              .  E8 49C30500     call <jmp.&mfc80u.#5829>
0040E09F              >  8D4C24 10       lea ecx,dword ptr ss:[esp+10]
0040E0A3              .  FF15 6C274700   call dword ptr ds:[<&mfc80u.#575>]  ;  mfc80u.7834DD87
0040E0A9              .  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040E0AD              .  FF15 6C274700   call dword ptr ds:[<&mfc80u.#575>]  ;  mfc80u.7834DD87
0040E0B3              .  8B8C24 44020000 mov ecx,dword ptr ss:[esp+244]
0040E0BA              .  5F              pop edi
0040E0BB              .  5E              pop esi
0040E0BC              .  5B              pop ebx
0040E0BD              .  64:890D 0000000>mov dword ptr fs:[0],ecx
0040E0C4              .  81C4 44020000   add esp,244
0040E0CA              .  C3              retn
然后利用搜索字符串"Key.dat"可以定位到重启验证的检查部分如下: 

0041A9E0                        > /55              push ebp
0041A9E1                        . |8BEC            mov ebp,esp
0041A9E3                        . |6A FF           push -1
0041A9E5                        . |68 34E04600     push de_***_.0046E034                      ;  SE handler installation
0041A9EA                        . |64:A1 00000000  mov eax,dword ptr fs:[0]
0041A9F0                        . |50              push eax
0041A9F1                        . |64:8925 0000000>mov dword ptr fs:[0],esp
0041A9F8                        . |81EC 30010000   sub esp,130
0041A9FE                        . |53              push ebx
0041A9FF                        . |57              push edi
0041AA00                        . |70 03           jo short de_***_.0041AA05
0041AA02                        . |71 01           jno short de_***_.0041AA05
0041AA04                          |E8              db E8
0041AA05                        > |8B7D 08         mov edi,dword ptr ss:[ebp+8]
0041AA08                        . |C707 17000000   mov dword ptr ds:[edi],17
0041AA0E                        . |7C 03           jl short de_***_.0041AA13
0041AA10                        > |EB 03           jmp short de_***_.0041AA15
0041AA12                          |E9              db E9
0041AA13                        >^|74 FB           je short de_***_.0041AA10
0041AA15                        > |8D4D F0         lea ecx,dword ptr ss:[ebp-10]
0041AA18                        . |FF15 58274700   call dword ptr ds:[<&mfc80u.#293>]         ;  mfc80u.783997F3
0041AA1E                        . |33DB            xor ebx,ebx
0041AA20                        . |68 F4000000     push 0F4                                   ;  Key.dat
0041AA25                        . |8D4D F0         lea ecx,dword ptr ss:[ebp-10]
0041AA28                        . |895D FC         mov dword ptr ss:[ebp-4],ebx
0041AA2B                        . |FF15 78274700   call dword ptr ds:[<&mfc80u.#4026>]        ;  mfc80u.783068D6
0041AA31                        . |8D45 F0         lea eax,dword ptr ss:[ebp-10]
0041AA34                        . |50              push eax
0041AA35                        . |E8 3A5D0000     call <jmp.&interfacedll.checkFileCun>
0041AA3A                        . |83C4 04         add esp,4
0041AA3D                        . |85C0            test eax,eax
0041AA3F                        . |75 22           jnz short de_***_.0041AA63
0041AA41                        . |7C 03           jl short de_***_.0041AA46
0041AA43                        > |EB 03           jmp short de_***_.0041AA48
0041AA45                          |E9              db E9
0041AA46                        >^|74 FB           je short de_***_.0041AA43
0041AA48                        > |8D4D F0         lea ecx,dword ptr ss:[ebp-10]
0041AA4B                        . |FF15 6C274700   call dword ptr ds:[<&mfc80u.#575>]         ;  mfc80u.7834DD87
0041AA51                        . |5F              pop edi
0041AA52                        . |32C0            xor al,al
0041AA54                        . |5B              pop ebx
0041AA55                        . |8B4D F4         mov ecx,dword ptr ss:[ebp-C]
0041AA58                        . |64:890D 0000000>mov dword ptr fs:[0],ecx
0041AA5F                        . |8BE5            mov esp,ebp
0041AA61                        . |5D              pop ebp
0041AA62                        . |C3              retn
0041AA63                        > |56              push esi
0041AA64                        . |7C 03           jl short de_***_.0041AA69
0041AA66                        > |EB 03           jmp short de_***_.0041AA6B
0041AA68                          |E9              db E9
0041AA69                        >^|74 FB           je short de_***_.0041AA66
0041AA6B                        > |8D8D C4FEFFFF   lea ecx,dword ptr ss:[ebp-13C]
0041AA71                        . |E8 EC5C0000     call <jmp.&crtool.CCRTools::CCRTools>
0041AA76                        . |C645 FC 01      mov byte ptr ss:[ebp-4],1
0041AA7A                        . |70 03           jo short de_***_.0041AA7F
0041AA7C                        . |71 01           jno short de_***_.0041AA7F
0041AA7E                          |E8              db E8
0041AA7F                        > |6A 45           push 45
0041AA81                        . |6A 53           push 53
0041AA83                        . |8D8D C4FEFFFF   lea ecx,dword ptr ss:[ebp-13C]
0041AA89                        . |E8 E05C0000     call <jmp.&crtool.CCRTools::Init>
0041AA8E                        . |8BF0            mov esi,eax
0041AA90                        . |7E 03           jle short de_***_.0041AA95
0041AA92                        . |7F 01           jg short de_***_.0041AA95
0041AA94                          |E8              db E8
0041AA95                        > |83FE 21         cmp esi,21
0041AA98                        . |75 0A           jnz short de_***_.0041AAA4
0041AA9A                        . |70 03           jo short de_***_.0041AA9F
0041AA9C                        . |71 01           jno short de_***_.0041AA9F
0041AA9E                          |E8              db E8
0041AA9F                        . |E9 8D000000     jmp de_***_.0041AB31
0041AAA4                        . |70 03           jo short de_***_.0041AAA9
0041AAA6                        . |71 01           jno short de_***_.0041AAA9
0041AAA8                          |E8              db E8
0041AAA9                        > |83FE 2C         cmp esi,2C
0041AAAC                        . |75 09           jnz short de_***_.0041AAB7
0041AAAE                        . |7C 03           jl short de_***_.0041AAB3
0041AAB0                        > |EB 03           jmp short de_***_.0041AAB5
0041AAB2                          |E9              db E9
0041AAB3                        >^|74 FB           je short de_***_.0041AAB0
0041AAB5                        > |EB 7A           jmp short de_***_.0041AB31
0041AAB7                        > |895D EC         mov dword ptr ss:[ebp-14],ebx
0041AABA                        . |7C 03           jl short de_***_.0041AABF
0041AABC                        > |EB 03           jmp short de_***_.0041AAC1
0041AABE                          |E9              db E9
0041AABF                        >^|74 FB           je short de_***_.0041AABC
0041AAC1                        > |8D4D EC         lea ecx,dword ptr ss:[ebp-14]
0041AAC4                        . |51              push ecx
0041AAC5                        . |8D8D C4FEFFFF   lea ecx,dword ptr ss:[ebp-13C]             ;  机器码
0041AACB                        . |E8 985C0000     call <jmp.&crtool.CCRTools::IsOkUse>       ;  关键函数判断
0041AAD0                        . |84C0            test al,al
0041AAD2                        . |74 56           je short de_***_.0041AB2A
0041AAD4                        . |8B45 EC         mov eax,dword ptr ss:[ebp-14]
0041AAD7                        . |8D50 A8         lea edx,dword ptr ds:[eax-58]
0041AADA                        . |85D2            test edx,edx
0041AADC                        . |75 0E           jnz short de_***_.0041AAEC
0041AADE                        . |83FE 4D         cmp esi,4D
0041AAE1                        . |75 09           jnz short de_***_.0041AAEC
0041AAE3                        . |7C 03           jl short de_***_.0041AAE8
0041AAE5                        > |EB 03           jmp short de_***_.0041AAEA
0041AAE7                          |E9              db E9
0041AAE8                        >^|74 FB           je short de_***_.0041AAE5
0041AAEA                        > |EB 45           jmp short de_***_.0041AB31
0041AAEC                        > |83C0 D4         add eax,-2C
0041AAEF                        . |75 09           jnz short de_***_.0041AAFA
0041AAF1                        . |7C 03           jl short de_***_.0041AAF6
0041AAF3                        > |EB 03           jmp short de_***_.0041AAF8
0041AAF5                          |E9              db E9
0041AAF6                        >^|74 FB           je short de_***_.0041AAF3
0041AAF8                        > |EB 37           jmp short de_***_.0041AB31
0041AAFA                        > |8D8D C4FEFFFF   lea ecx,dword ptr ss:[ebp-13C]
0041AB00                        . |C707 58000000   mov dword ptr ds:[edi],58
0041AB06                        . |885D FC         mov byte ptr ss:[ebp-4],bl
0041AB09                        . |E8 485C0000     call <jmp.&crtool.CCRTools::~CCRTools>
0041AB0E                        . |8D4D F0         lea ecx,dword ptr ss:[ebp-10]
0041AB11                        . |FF15 6C274700   call dword ptr ds:[<&mfc80u.#575>]         ;  mfc80u.7834DD87
0041AB17                        . |5E              pop esi
0041AB18                        . |5F              pop edi
0041AB19                        . |B0 01           mov al,1
0041AB1B                        . |5B              pop ebx
0041AB1C                        . |8B4D F4         mov ecx,dword ptr ss:[ebp-C]
0041AB1F                        . |64:890D 0000000>mov dword ptr fs:[0],ecx
0041AB26                        . |8BE5            mov esp,ebp
0041AB28                        . |5D              pop ebp
0041AB29                        . |C3              retn
0041AB2A                        > |7C 03           jl short de_***_.0041AB2F
0041AB2C                        > |EB 03           jmp short de_***_.0041AB31
0041AB2E                          |E9              db E9
0041AB2F                        >^|74 FB           je short de_***_.0041AB2C
0041AB31                        > |8D8D C4FEFFFF   lea ecx,dword ptr ss:[ebp-13C]
0041AB37                        . |885D FC         mov byte ptr ss:[ebp-4],bl
0041AB3A                        . |E8 175C0000     call <jmp.&crtool.CCRTools::~CCRTools>
0041AB3F                        . |8D4D F0         lea ecx,dword ptr ss:[ebp-10]
0041AB42                        . |FF15 6C274700   call dword ptr ds:[<&mfc80u.#575>]         ;  mfc80u.7834DD87
0041AB48                        . |8B4D F4         mov ecx,dword ptr ss:[ebp-C]
0041AB4B                        . |5E              pop esi
0041AB4C                        . |5F              pop edi
0041AB4D                        . |32C0            xor al,al
0041AB4F                        . |5B              pop ebx
0041AB50                        . |64:890D 0000000>mov dword ptr fs:[0],ecx
0041AB57                        . |8BE5            mov esp,ebp
0041AB59                        . |5D              pop ebp
0041AB5A                        . |C3              retn

其中0041AACB                        . |E8 985C0000     call <jmp.&crtool.CCRTools::IsOkUse>       ;  关键函数判断部分分析如下:
10003F20                         52                push edx                                   ; 注册码
10003F21                         51                push ecx                                   ; 机器码
10003F22                         E8 B9F8FFFF       call crtool.CCRTools::ffoot                ; 关键函数

其中10003F22                         E8 B9F8FFFF       call crtool.CCRTools::ffoot                ; 关键函数如下:
100037E0 crtool.CCRTools::ffoo>  55                push ebp
100037E1                         8DAC24 74FDFFFF   lea ebp,dword ptr ss:[esp-28C]
100037E8                         81EC 0C030000     sub esp,30C
100037EE                         A1 1C000210       mov eax,dword ptr ds:[1002001C]
100037F3                         33C5              xor eax,ebp
100037F5                         8985 88020000     mov dword ptr ss:[ebp+288],eax
100037FB                         53                push ebx
100037FC                         56                push esi
100037FD                         8BB5 94020000     mov esi,dword ptr ss:[ebp+294]             ; 机器码
10003803                         57                push edi
10003804                         8BBD 98020000     mov edi,dword ptr ss:[ebp+298]             ; 注册码
1000380A                         68 D8020000       push 2D8
1000380F                         6A 01             push 1
10003811                         FF15 78D10110     call dword ptr ds:[1001D178]               ; MSVCR80.calloc
10003817                         A3 F00C0210       mov dword ptr ds:[10020CF0],eax
1000381C                         E8 EF5B0000       call crtool.10009410
10003821                         68 FE000000       push 0FE
10003826                         8BD8              mov ebx,eax
10003828                         8D85 89000000     lea eax,dword ptr ss:[ebp+89]
1000382E                         6A 00             push 0
10003830                         50                push eax
10003831                         C685 88000000 00  mov byte ptr ss:[ebp+88],0
10003838                         E8 9B8D0100       call crtool.1001C5D8                       ; jmp to MSVCR80.memset
1000383D                         68 FE000000       push 0FE
10003842                         8D8D 89010000     lea ecx,dword ptr ss:[ebp+189]
10003848                         6A 00             push 0
1000384A                         51                push ecx
1000384B                         C685 88010000 00  mov byte ptr ss:[ebp+188],0
10003852                         E8 818D0100       call crtool.1001C5D8                       ; jmp to MSVCR80.memset
10003857                         68 FE000000       push 0FE
1000385C                         8D55 89           lea edx,dword ptr ss:[ebp-77]
1000385F                         6A 00             push 0
10003861                         52                push edx
10003862                         C645 88 00        mov byte ptr ss:[ebp-78],0
10003866                         E8 6D8D0100       call crtool.1001C5D8                       ; jmp to MSVCR80.memset
1000386B                         83C4 2C           add esp,2C
1000386E                         6A 00             push 0
10003870                         6A 00             push 0
10003872                         68 FF000000       push 0FF
10003877                         8D85 88000000     lea eax,dword ptr ss:[ebp+88]
1000387D                         50                push eax
1000387E                         6A FF             push -1
10003880                         56                push esi
10003881                         8B35 08D00110     mov esi,dword ptr ds:[1001D008]            ; KERNEL32.WideCharToMultiByte
10003887                         6A 00             push 0
10003889                         6A 00             push 0
1000388B                         FFD6              call esi
1000388D                         6A 00             push 0
1000388F                         6A 00             push 0
10003891                         68 FF000000       push 0FF
10003896                         8D8D 88010000     lea ecx,dword ptr ss:[ebp+188]
1000389C                         51                push ecx
1000389D                         6A FF             push -1
1000389F                         57                push edi
100038A0                         6A 00             push 0
100038A2                         6A 00             push 0
100038A4                         FFD6              call esi
100038A6                         8D85 88000000     lea eax,dword ptr ss:[ebp+88]              ; ASCII码的机器码
100038AC                         8D50 01           lea edx,dword ptr ds:[eax+1]
100038AF                         90                nop
100038B0                         8A08              mov cl,byte ptr ds:[eax]
100038B2                         83C0 01           add eax,1
100038B5                         84C9              test cl,cl
100038B7                       ^ 75 F7             jnz short crtool.100038B0
100038B9                         2BC2              sub eax,edx                                ; 机器码的长度
100038BB                         75 0A             jnz short crtool.100038C7
100038BD                         7E 03             jle short crtool.100038C2
100038BF                         7F 01             jg short crtool.100038C2
100038C1                         E8 E9E50100       call crtool.10021EAF
100038C6                         0080 BD880100     add byte ptr ds:[eax+188BD],al
100038CC                         0000              add byte ptr ds:[eax],al
100038CE                         74 29             je short crtool.100038F9
100038D0                         8B3D 9CD10110     mov edi,dword ptr ds:[1001D19C]            ; MSVCR80.isxdigit
100038D6                         8DB5 88010000     lea esi,dword ptr ss:[ebp+188]             ; ASCII码的注册码
100038DC                         8D6424 00         lea esp,dword ptr ss:[esp]
100038E0                         0FBE16            movsx edx,byte ptr ds:[esi]
100038E3                         52                push edx
100038E4                         FFD7              call edi
100038E6                         83C4 04           add esp,4
100038E9                         85C0              test eax,eax
100038EB                         0F84 C5000000     je crtool.100039B6
100038F1                         83C6 01           add esi,1
100038F4                         803E 00           cmp byte ptr ds:[esi],0
100038F7                       ^ 75 E7             jnz short crtool.100038E0
100038F9                         C783 30020000 100>mov dword ptr ds:[ebx+230],10
10003903                         E8 A8540000       call crtool.10008DB0
10003908                         8BF0              mov esi,eax
1000390A                         E8 A1540000       call crtool.10008DB0
1000390F                         8BD8              mov ebx,eax
10003911                         E8 9A540000       call crtool.10008DB0
10003916                         8BF8              mov edi,eax
10003918                         897D 80           mov dword ptr ss:[ebp-80],edi
1000391B                         E8 90540000       call crtool.10008DB0
10003920                         8945 84           mov dword ptr ss:[ebp-7C],eax
10003923                         8D85 88010000     lea eax,dword ptr ss:[ebp+188]
10003929                         50                push eax                                   ; 注册码
1000392A                         57                push edi
1000392B                         E8 F0240100       call crtool.10015E20
10003930                         68 E0D50110       push crtool.1001D5E0                       ; ASCII "9CF08479954EFBA3EC8EFAEDEA56B772BD4CDA02ECBBD969D13700A6096475474BC5FA07B264D82225123AF00F9FB452BC7B97D6A056CD37A54416C3D1724E21"
10003935                         56                push esi
10003936                         E8 E5240100       call crtool.10015E20
1000393B                         68 64D60110       push crtool.1001D664                       ; ASCII "1975071"
10003940                         53                push ebx
10003941                         E8 DA240100       call crtool.10015E20
10003946                         56                push esi
10003947                         57                push edi
10003948                         E8 53670000       call crtool.1000A0A0
1000394D                         83C4 20           add esp,20
10003950                         83F8 FF           cmp eax,-1
10003953                         0F85 4E010000     jnz crtool.10003AA7
10003959                         8B4D 84           mov ecx,dword ptr ss:[ebp-7C]
1000395C                         51                push ecx
1000395D                         57                push edi
1000395E                         8BC6              mov eax,esi
10003960                         8BCB              mov ecx,ebx
10003962                         E8 498E0000       call crtool.1000C7B0
10003967                         8B45 84           mov eax,dword ptr ss:[ebp-7C]
1000396A                         6A 00             push 0
1000396C                         8D55 88           lea edx,dword ptr ss:[ebp-78]
1000396F                         52                push edx                        ; 注册码生成的目标机器码地址
10003970                         50                push eax
10003971                         6A 00             push 0
10003973                         E8 88E60000       call crtool.10012000            ; 注册码生成的目标机器码函数
10003978                         83C4 18           add esp,18
1000397B                         85F6              test esi,esi
1000397D                         74 43             je short crtool.100039C2
1000397F                         8B06              mov eax,dword ptr ds:[esi]
10003981                         8B56 04           mov edx,dword ptr ds:[esi+4]
10003984                         25 FFFFFF7F       and eax,7FFFFFFF
10003989                         8BC8              mov ecx,eax
1000398B                         C1E9 10           shr ecx,10
1000398E                         25 FFFF0000       and eax,0FFFF
10003993                         03C8              add ecx,eax
10003995                         85C9              test ecx,ecx
10003997                         7E 09             jle short crtool.100039A2
10003999                         33C0              xor eax,eax
1000399B                         8BFA              mov edi,edx
1000399D                         F3:AB             rep stos dword ptr es:[edi]
1000399F                         8B7D 80           mov edi,dword ptr ss:[ebp-80]
100039A2                         C706 00000000     mov dword ptr ds:[esi],0
100039A8                         56                push esi
100039A9                         8B35 7CD10110     mov esi,dword ptr ds:[1001D17C]            ; MSVCR80.free
100039AF                         FFD6              call esi
100039B1                         83C4 04           add esp,4
100039B4                         EB 12             jmp short crtool.100039C8
100039B6                         7C 03             jl short crtool.100039BB
100039B8                         EB 03             jmp short crtool.100039BD
100039BA                       - E9 74FBE9EA       jmp FAEA3533
100039BF                         0000              add byte ptr ds:[eax],al
100039C1                         008B 357CD101     add byte ptr ds:[ebx+1D17C35],cl
100039C7                         1085 DB742F8B     adc byte ptr ss:[ebp+8B2F74DB],al
100039CD                         038B 530425FF     add ecx,dword ptr ds:[ebx+FF250453]
100039D3                         FFFF              ???                                        ; 未知命令
100039D5                       ^ 7F 8B             jg short crtool.10003962
100039D7                         C8 C1E910         enter 0E9C1,10
100039DB                         25 FFFF0000       and eax,0FFFF
100039E0                         03C8              add ecx,eax
100039E2                         85C9              test ecx,ecx
100039E4                         7E 09             jle short crtool.100039EF
100039E6                         33C0              xor eax,eax
100039E8                         8BFA              mov edi,edx
100039EA                         F3:AB             rep stos dword ptr es:[edi]
100039EC                         8B7D 80           mov edi,dword ptr ss:[ebp-80]
100039EF                         53                push ebx
100039F0                         C703 00000000     mov dword ptr ds:[ebx],0
100039F6                         FFD6              call esi
100039F8                         83C4 04           add esp,4
100039FB                         85FF              test edi,edi
100039FD                         74 2F             je short crtool.10003A2E
100039FF                         8B07              mov eax,dword ptr ds:[edi]
10003A01                         8B57 04           mov edx,dword ptr ds:[edi+4]
10003A04                         25 FFFFFF7F       and eax,7FFFFFFF
10003A09                         8BC8              mov ecx,eax
10003A0B                         C1E9 10           shr ecx,10
10003A0E                         25 FFFF0000       and eax,0FFFF
10003A13                         03C8              add ecx,eax
10003A15                         85C9              test ecx,ecx
10003A17                         7E 09             jle short crtool.10003A22
10003A19                         33C0              xor eax,eax
10003A1B                         8BFA              mov edi,edx
10003A1D                         F3:AB             rep stos dword ptr es:[edi]
10003A1F                         8B7D 80           mov edi,dword ptr ss:[ebp-80]
10003A22                         57                push edi
10003A23                         C707 00000000     mov dword ptr ds:[edi],0
10003A29                         FFD6              call esi
10003A2B                         83C4 04           add esp,4
10003A2E                         8B55 84           mov edx,dword ptr ss:[ebp-7C]
10003A31                         85D2              test edx,edx
10003A33                         74 2A             je short crtool.10003A5F
10003A35                         8B02              mov eax,dword ptr ds:[edx]
10003A37                         8B7A 04           mov edi,dword ptr ds:[edx+4]
10003A3A                         25 FFFFFF7F       and eax,7FFFFFFF
10003A3F                         8BC8              mov ecx,eax
10003A41                         C1E9 10           shr ecx,10
10003A44                         25 FFFF0000       and eax,0FFFF
10003A49                         03C8              add ecx,eax
10003A4B                         85C9              test ecx,ecx
10003A4D                         7E 04             jle short crtool.10003A53
10003A4F                         33C0              xor eax,eax
10003A51                         F3:AB             rep stos dword ptr es:[edi]
10003A53                         52                push edx
10003A54                         C702 00000000     mov dword ptr ds:[edx],0
10003A5A                         FFD6              call esi
10003A5C                         83C4 04           add esp,4
10003A5F                         E8 BC5F0000       call crtool.10009A20
10003A64                         8D55 88           lea edx,dword ptr ss:[ebp-78]
10003A67                         8D8D 88000000     lea ecx,dword ptr ss:[ebp+88]
10003A6D                         8D49 00           lea ecx,dword ptr ds:[ecx]
10003A70                         8A01              mov al,byte ptr ds:[ecx]
10003A72                         3A02              cmp al,byte ptr ds:[edx]                   ; 机器码与注册码运算得到的注册码比较1
10003A74                         75 1A             jnz short crtool.10003A90                  ; 关键跳转1
10003A76                         84C0              test al,al
10003A78                         74 12             je short crtool.10003A8C
10003A7A                         8A41 01           mov al,byte ptr ds:[ecx+1]
10003A7D                         3A42 01           cmp al,byte ptr ds:[edx+1]                 ; 机器码与注册码运算得到的注册码比较2
10003A80                         75 0E             jnz short crtool.10003A90                  ; 关键跳转2
10003A82                         83C1 02           add ecx,2
10003A85                         83C2 02           add edx,2
10003A88                         84C0              test al,al
10003A8A                       ^ 75 E4             jnz short crtool.10003A70
10003A8C                         33C0              xor eax,eax
10003A8E                         EB 05             jmp short crtool.10003A95
10003A90                         1BC0              sbb eax,eax
10003A92                         83D8 FF           sbb eax,-1
10003A95                         85C0              test eax,eax
10003A97                         74 07             je short crtool.10003AA0
10003A99                         70 03             jo short crtool.10003A9E
10003A9B                         71 01             jno short crtool.10003A9E
10003A9D                         E8 EB0CB858       call 68B8478D
10003AA2                         0000              add byte ptr ds:[eax],al
10003AA4                         00EB              add bl,ch
10003AA6                         0A7E 03           or bh,byte ptr ds:[esi+3]
10003AA9                         7F 01             jg short crtool.10003AAC
10003AAB                         E8 B82C0000       call crtool.10006768
10003AB0                         008B 8D880200     add byte ptr ds:[ebx+2888D],cl
10003AB6                         005F 5E           add byte ptr ds:[edi+5E],bl
10003AB9                         33CD              xor ecx,ebp
10003ABB                         5B                pop ebx
10003ABC                         E8 1A800100       call crtool.1001BADB
10003AC1                         81C5 8C020000     add ebp,28C
10003AC7                         8BE5              mov esp,ebp
10003AC9                         5D                pop ebp
10003ACA                         C2 0800           retn 8

刚开始我想的是在*******.dll中爆破,这样就需要修改上面的两处关键跳转为NOP即可,但是程序显然有个自校验,而且比较麻烦,为了避开它,我选择将下面爆破:
将0041AAD0                        . |84C0            test al,al
0041AAD2                        . |74 56           je short de_***_.0041AB2A
0041AAD4                        . |8B45 EC         mov eax,dword ptr ss:[ebp-14]
代码修改为:
mov eax,0x**(国产软件,不说了)
nop
nop
这样运行程序显示是注册版,但解密有问题.显示"文件系统异常",下面是分析,但是爆破不成功:

0040EC16                         8D4C24 0C         lea ecx,dword ptr ss:[esp+>
0040EC1A                         FF15 58274700     call dword ptr ds:[472758] ; mfc80u.783997F3
0040EC20                         33DB              xor ebx,ebx
0040EC22                         68 A3000000       push 0A3
0040EC27                         8D4C24 10         lea ecx,dword ptr ss:[esp+>
0040EC2B                         899C24 F8040000   mov dword ptr ss:[esp+4F8]>
0040EC32                         FF15 78274700     call dword ptr ds:[472778] ; mfc80u.783068D6
0040EC38                         8D4C24 10         lea ecx,dword ptr ss:[esp+>
0040EC3C                         FF15 58274700     call dword ptr ds:[472758] ; mfc80u.783997F3
0040EC42                         68 A4000000       push 0A4
0040EC47                         8D4C24 14         lea ecx,dword ptr ss:[esp+>
0040EC4B                         C68424 F8040000 0>mov byte ptr ss:[esp+4F8],>
0040EC53                         FF15 78274700     call dword ptr ds:[472778] ; mfc80u.783068D6
0040EC59                         68 D8040000       push 4D8
0040EC5E                         8D4C24 18         lea ecx,dword ptr ss:[esp+>
0040EC62                         53                push ebx
0040EC63                         51                push ecx
0040EC64                         E8 D9BF0500       call ***.0046AC42          ; jmp to MSVCR80.memset
0040EC69                         83C4 0C           add esp,0C
0040EC6C                         399E 80000000     cmp dword ptr ds:[esi+80],>
0040EC72                         8BCF              mov ecx,edi
0040EC74                         0F95C2            setne dl
0040EC77                         885424 20         mov byte ptr ss:[esp+20],d>
0040EC7B                         885C24 21         mov byte ptr ss:[esp+21],b>
0040EC7F                         FF15 74274700     call dword ptr ds:[472774] ; mfc80u.7839327F
0040EC85                         8B3D D4224700     mov edi,dword ptr ds:[4722>; kernel32.lstrcpyW
0040EC8B                         50                push eax                   ; 密码
0040EC8C                         8D8424 26040000   lea eax,dword ptr ss:[esp+>
0040EC93                         50                push eax
0040EC94                         FFD7              call edi
0040EC96                         8D4E 74           lea ecx,dword ptr ds:[esi+>
0040EC99                         FF15 74274700     call dword ptr ds:[472774] ; mfc80u.7839327F
0040EC9F                         50                push eax                   ; 文件路径
0040ECA0                         8D4C24 26         lea ecx,dword ptr ss:[esp+>
0040ECA4                         51                push ecx
0040ECA5                         FFD7              call edi
0040ECA7                         8D4E 78           lea ecx,dword ptr ds:[esi+>
0040ECAA                         FF15 74274700     call dword ptr ds:[472774] ; mfc80u.7839327F
0040ECB0                         50                push eax                   ; 解密后的文件路径
0040ECB1                         8D9424 26020000   lea edx,dword ptr ss:[esp+>
0040ECB8                         52                push edx
0040ECB9                         FFD7              call edi
0040ECBB                         399E 84000000     cmp dword ptr ds:[esi+84],>
0040ECC1                         74 4E             je short ***.0040ED11
0040ECC3                         8B46 20           mov eax,dword ptr ds:[esi+>
0040ECC6                         50                push eax
0040ECC7                         8D8C24 26040000   lea ecx,dword ptr ss:[esp+>
0040ECCE                         51                push ecx                   ; 密码
0040ECCF                         8D5424 2A         lea edx,dword ptr ss:[esp+>
0040ECD3                         52                push edx                   ; 文件路径
0040ECD4                         E8 47F9FFFF       call ***.0040E620

其中
0040ECD4                         E8 47F9FFFF       call ***.0040E620
函数处理:
0040E620                         6A FF             push -1
0040E622                         68 4BCE4600       push ***.0046CE4B
0040E627                         64:A1 00000000    mov eax,dword ptr fs:[0]
0040E62D                         50                push eax
0040E62E                         64:8925 00000000  mov dword ptr fs:[0],esp
0040E635                         81EC F4010000     sub esp,1F4
0040E63B                         8B8424 04020000   mov eax,dword ptr ss:[esp+204]
0040E642                         68 F8664700       push ***.004766F8                         ; UNICODE "rb"
0040E647                         50                push eax
0040E648                         8D4C24 08         lea ecx,dword ptr ss:[esp+8]
0040E64C                         51                push ecx
0040E64D                         C74424 0C 0000000>mov dword ptr ss:[esp+C],0
0040E655                         FF15 9C284700     call dword ptr ds:[47289C]                ; MSVCR80._wfopen_s
0040E65B                         83C4 0C           add esp,0C
0040E65E                         85C0              test eax,eax
0040E660                         74 2D             je short ***.0040E68F                     ; 1
0040E662                         8B9424 0C020000   mov edx,dword ptr ss:[esp+20C]
0040E669                         52                push edx
0040E66A                         68 AE000000       push 0AE
0040E66F                         E8 6C1A0000       call ***.004100E0
0040E674                         83C4 08           add esp,8
0040E677                         83C8 FF           or eax,FFFFFFFF
0040E67A                         8B8C24 F4010000   mov ecx,dword ptr ss:[esp+1F4]
0040E681                         64:890D 00000000  mov dword ptr fs:[0],ecx
0040E688                         81C4 00020000     add esp,200
0040E68E                         C3                retn
0040E68F                         68 1C010000       push 11C
0040E694                         8D8424 DC000000   lea eax,dword ptr ss:[esp+DC]
0040E69B                         6A 00             push 0
0040E69D                         50                push eax
0040E69E                         E8 9FC50500       call ***.0046AC42                         ; jmp to MSVCR80.memset
0040E6A3                         8B4C24 0C         mov ecx,dword ptr ss:[esp+C]
0040E6A7                         51                push ecx
0040E6A8                         6A 01             push 1
0040E6AA                         8D9424 EC000000   lea edx,dword ptr ss:[esp+EC]
0040E6B1                         68 1C010000       push 11C
0040E6B6                         52                push edx
0040E6B7                         FF15 98284700     call dword ptr ds:[472898]                ; MSVCR80.fread
0040E6BD                         83C4 1C           add esp,1C
0040E6C0                         81BC24 D8000000 1>cmp dword ptr ss:[esp+D8],11C
0040E6CB                         74 38             je short ***.0040E705                     ; 1
0040E6CD                         8B8424 0C020000   mov eax,dword ptr ss:[esp+20C]
0040E6D4                         50                push eax
0040E6D5                         68 AF000000       push 0AF
0040E6DA                         E8 011A0000       call ***.004100E0
0040E6DF                         8B4C24 08         mov ecx,dword ptr ss:[esp+8]
0040E6E3                         51                push ecx
0040E6E4                         FF15 94284700     call dword ptr ds:[472894]                ; MSVCR80.fclose
0040E6EA                         83C4 0C           add esp,0C
0040E6ED                         83C8 FF           or eax,FFFFFFFF
0040E6F0                         8B8C24 F4010000   mov ecx,dword ptr ss:[esp+1F4]
0040E6F7                         64:890D 00000000  mov dword ptr fs:[0],ecx
0040E6FE                         81C4 00020000     add esp,200
0040E704                         C3                retn
0040E705                         56                push esi
0040E706                         57                push edi
0040E707                         6A 63             push 63
0040E709                         8D5424 11         lea edx,dword ptr ss:[esp+11]
0040E70D                         6A 00             push 0
0040E70F                         52                push edx
0040E710                         C64424 18 00      mov byte ptr ss:[esp+18],0
0040E715                         E8 28C50500       call ***.0046AC42                         ; jmp to MSVCR80.memset
0040E71A                         8B8C24 1C020000   mov ecx,dword ptr ss:[esp+21C]
0040E721                         83C4 0C           add esp,0C
0040E724                         6A 00             push 0
0040E726                         6A 00             push 0
0040E728                         6A 64             push 64
0040E72A                         8D4424 18         lea eax,dword ptr ss:[esp+18]
0040E72E                         50                push eax
0040E72F                         6A FF             push -1
0040E731                         51                push ecx
0040E732                         6A 00             push 0
0040E734                         6A 00             push 0
0040E736                         FF15 50224700     call dword ptr ds:[472250]                ; kernel32.WideCharToMultiByte
0040E73C                         8D5424 0C         lea edx,dword ptr ss:[esp+C]
0040E740                         52                push edx
0040E741                         8D4C24 74         lea ecx,dword ptr ss:[esp+74]
0040E745                         E8 5641FFFF       call ***.004028A0
0040E74A                         8D8424 EC010000   lea eax,dword ptr ss:[esp+1EC]
0040E751                         50                push eax
0040E752                         8BC8              mov ecx,eax
0040E754                         6A 10             push 10
0040E756                         51                push ecx
0040E757                         8D4C24 7C         lea ecx,dword ptr ss:[esp+7C]
0040E75B                         C78424 10020000 0>mov dword ptr ss:[esp+210],0
0040E766                         E8 2545FFFF       call ***.00402C90
0040E76B                         BF E8664700       mov edi,***.004766E8                      ; ASCII "wxbsoftSE300088"
0040E770                         8DB424 EC010000   lea esi,dword ptr ss:[esp+1EC]
0040E777                         B9 10000000       mov ecx,10
0040E77C                         33D2              xor edx,edx
0040E77E                         F3:A6             repe cmps byte ptr es:[edi],byte ptr ds:[>
0040E780                         5F                pop edi
0040E781                         5E                pop esi
0040E782                         74 4B             je short ***.0040E7CF                     ; 1
0040E784                         8B8424 0C020000   mov eax,dword ptr ss:[esp+20C]
0040E78B                         50                push eax
0040E78C                         68 A9000000       push 0A9
0040E791                         E8 4A190000       call ***.004100E0
0040E796                         8B4C24 08         mov ecx,dword ptr ss:[esp+8]
0040E79A                         51                push ecx
0040E79B                         FF15 94284700     call dword ptr ds:[472894]                ; MSVCR80.fclose
0040E7A1                         83C4 0C           add esp,0C
0040E7A4                         8D4C24 68         lea ecx,dword ptr ss:[esp+68]
0040E7A8                         C78424 FC010000 F>mov dword ptr ss:[esp+1FC],-1
0040E7B3                         E8 F838FFFF       call ***.004020B0
0040E7B8                         33C0              xor eax,eax
0040E7BA                         8B8C24 F4010000   mov ecx,dword ptr ss:[esp+1F4]
0040E7C1                         64:890D 00000000  mov dword ptr fs:[0],ecx
0040E7C8                         81C4 00020000     add esp,200
0040E7CE                         C3                retn
0040E7CF                         8B1424            mov edx,dword ptr ss:[esp]
0040E7D2                         52                push edx
0040E7D3                         FF15 94284700     call dword ptr ds:[472894]                ; MSVCR80.fclose
0040E7D9                         83C4 04           add esp,4
0040E7DC                         8D4C24 68         lea ecx,dword ptr ss:[esp+68]
0040E7E0                         C78424 FC010000 F>mov dword ptr ss:[esp+1FC],-1
0040E7EB                         E8 C038FFFF       call ***.004020B0
0040E7F0                         8B8C24 F4010000   mov ecx,dword ptr ss:[esp+1F4]
0040E7F7                         B8 01000000       mov eax,1
0040E7FC                         64:890D 00000000  mov dword ptr fs:[0],ecx
0040E803                         81C4 00020000     add esp,200
0040E809                         C3                retn


其中"加密文件夹-闪电加密" 出现的"文件系统异常"的爆破如下:
0040BD50                       /$  6A FF           push -1
0040BD52                       |.  68 13CA4600     push de_***_1.0046CA13                  ;  SE handler installation
0040BD57                       |.  64:A1 00000000  mov eax,dword ptr fs:[0]
0040BD5D                       |.  50              push eax
0040BD5E                       |.  64:8925 0000000>mov dword ptr fs:[0],esp
0040BD65                       |.  81EC 9C020000   sub esp,29C
0040BD6B                       |.  56              push esi
0040BD6C                       |.  8BF1            mov esi,ecx
0040BD6E                       |.  57              push edi
0040BD6F                       |.  8D4C24 10       lea ecx,dword ptr ss:[esp+10]
0040BD73                       |.  E8 68AB0000     call de_***_1.004168E0
0040BD78                       |.  56              push esi                                ; /Arg4
0040BD79                       |.  8D46 04         lea eax,dword ptr ds:[esi+4]            ; |
0040BD7C                       |.  50              push eax                                ; |Arg3
0040BD7D                       |.  8D7E 08         lea edi,dword ptr ds:[esi+8]            ; |
0040BD80                       |.  57              push edi                                ; |Arg2
0040BD81                       |.  8D4C24 18       lea ecx,dword ptr ss:[esp+18]           ; |
0040BD85                       |.  51              push ecx                                ; |Arg1
0040BD86                       |.  8D4C24 20       lea ecx,dword ptr ss:[esp+20]           ; |
0040BD8A                       |.  C78424 BC020000>mov dword ptr ss:[esp+2BC],0            ; |
0040BD95                       |.  E8 66AD0000     call de_***_1.00416B00                  ; \de_***_1.00416B00
0040BD9A                       |.  833F 00         cmp dword ptr ds:[edi],0
0040BD9D                       |.  C68424 AC020000>mov byte ptr ss:[esp+2AC],1
0040BDA5                       |.  0F85 D2000000   jnz de_***_1.0040BE7D
0040BDAB                       |.  53              push ebx
0040BDAC                       |.  68 F85F4700     push de_***_1.00475FF8                  ;  UNICODE ".***"
0040BDB1                       |.  8D5424 10       lea edx,dword ptr ss:[esp+10]
0040BDB5                       |.  56              push esi
0040BDB6                       |.  52              push edx
0040BDB7                       |.  E8 148BFFFF     call de_***_1.004048D0
0040BDBC                       |.  83C4 0C         add esp,0C
0040BDBF                       |.  8BC8            mov ecx,eax
0040BDC1                       |.  FF15 74274700   call dword ptr ds:[<&mfc80u.#870>]      ;  mfc80u.7839327F
0040BDC7                       |.  50              push eax                                ; /FileName
0040BDC8                       |.  FF15 CC224700   call dword ptr ds:[<&kernel32.DeleteFil>; \DeleteFileW
0040BDCE                       |.  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040BDD2                       |.  FF15 6C274700   call dword ptr ds:[<&mfc80u.#575>]      ;  mfc80u.7834DD87
0040BDD8                       |.  68 F85F4700     push de_***_1.00475FF8                  ;  UNICODE ".***"
0040BDDD                       |.  8D4424 10       lea eax,dword ptr ss:[esp+10]
0040BDE1                       |.  56              push esi
0040BDE2                       |.  50              push eax
0040BDE3                       |.  E8 E88AFFFF     call de_***_1.004048D0
0040BDE8                       |.  83C4 0C         add esp,0C
0040BDEB                       |.  6A 00           push 0
0040BDED                       |.  8BC8            mov ecx,eax
0040BDEF                       |.  FF15 74274700   call dword ptr ds:[<&mfc80u.#870>]      ;  mfc80u.7839327F
0040BDF5                       |.  50              push eax
0040BDF6                       |.  8D4C24 18       lea ecx,dword ptr ss:[esp+18]
0040BDFA                       |.  FF15 74274700   call dword ptr ds:[<&mfc80u.#870>]      ;  mfc80u.7839327F
0040BE00                       |.  50              push eax                                ; |ExistingFileName
0040BE01                       |.  FF15 68224700   call dword ptr ds:[<&kernel32.CopyFileW>; \CopyFileW
0040BE07                       |.  85C0            test eax,eax
0040BE09                       |.  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040BE0D                       |.  0F94C3          sete bl
0040BE10                       |.  FF15 6C274700   call dword ptr ds:[<&mfc80u.#575>]      ;  mfc80u.7834DD87
0040BE16                       |.  84DB            test bl,bl
0040BE18                       |.  5B              pop ebx
0040BE19                       |.  74 37           je short de_***_1.0040BE52              ;  文件系统是否异常的判断关键跳转
0040BE1B                       |.  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040BE1F                       |.  FF15 6C274700   call dword ptr ds:[<&mfc80u.#575>]      ;  mfc80u.7834DD87
0040BE25                       |.  8D4C24 10       lea ecx,dword ptr ss:[esp+10]
0040BE29                       |.  C78424 AC020000>mov dword ptr ss:[esp+2AC],-1
0040BE34                       |.  E8 27AB0000     call de_***_1.00416960
0040BE39                       |.  5F              pop edi
0040BE3A                       |.  32C0            xor al,al
0040BE3C                       |.  5E              pop esi
0040BE3D                       |.  8B8C24 9C020000 mov ecx,dword ptr ss:[esp+29C]
0040BE44                       |.  64:890D 0000000>mov dword ptr fs:[0],ecx
0040BE4B                       |.  81C4 A8020000   add esp,2A8
0040BE51                       |.  C3              retn
0040BE52                       |>  68 F85F4700     push de_***_1.00475FF8                  ;  UNICODE ".***"
0040BE57                       |.  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040BE5B                       |.  56              push esi
0040BE5C                       |.  51              push ecx
0040BE5D                       |.  E8 6E8AFFFF     call de_***_1.004048D0
0040BE62                       |.  50              push eax
0040BE63                       |.  C68424 BC020000>mov byte ptr ss:[esp+2BC],2
0040BE6B                       |.  E8 C0A8FFFF     call de_***_1.00406730
0040BE70                       |.  83C4 10         add esp,10
0040BE73                       |.  8D4C24 08       lea ecx,dword ptr ss:[esp+8]
0040BE77                       |.  FF15 6C274700   call dword ptr ds:[<&mfc80u.#575>]      ;  mfc80u.7834DD87
0040BE7D                       |>  8D4C24 0C       lea ecx,dword ptr ss:[esp+C]
0040BE81                       |.  FF15 6C274700   call dword ptr ds:[<&mfc80u.#575>]      ;  mfc80u.7834DD87
0040BE87                       |.  8D4C24 10       lea ecx,dword ptr ss:[esp+10]
0040BE8B                       |.  C78424 AC020000>mov dword ptr ss:[esp+2AC],-1
0040BE96                       |.  E8 C5AA0000     call de_***_1.00416960
0040BE9B                       |.  8B8C24 A4020000 mov ecx,dword ptr ss:[esp+2A4]
0040BEA2                       |.  5F              pop edi
0040BEA3                       |.  B0 01           mov al,1
0040BEA5                       |.  5E              pop esi
0040BEA6                       |.  64:890D 0000000>mov dword ptr fs:[0],ecx
0040BEAD                       |.  81C4 A8020000   add esp,2A8
0040BEB3                       \.  C3              retn

上面讲到的"文件系统异常"问题,我始终不能解决,但是发现不脱壳的程序能够解密,而脱壳后的程序,调用"CreateFileW"时总是失败,看来壳中有东西,要想找出这个东西来还是很麻烦的,逼着我学习写Loader了.参考Loveboom的Loader:

我将其修改如下: 
include windows.inc
include kernel32.inc
include user32.inc


includelib kernel32.lib
includelib user32.lib


.data
    szcap        db   'Loader by Laowanghai',0
    szerr        db  'Could not found :'
              db 100h dup (0)
              
    
    PatchAddr1      dd  041AA**h(国产软件支持一下了)
    raddr        dd   006C933Ch
    pdat        dd   05674*****h(国产软件支持一下了)
              
    pdat1        db  0B8h,58h,00h,00h,00h,90h,90h,0,0
              
    rbuffer        dd   100h dup(0)
    
    szapppath      db  100h dup(0)
    appname        db    '***.exe',0
  
            

.data?
    align        dword
    startinfo       STARTUPINFO <> 
    pi           PROCESS_INFORMATION <> 
    handle        dd ?
    
.code 
  start:
      ;获取程序所在的路径
      invoke GetCurrentDirectory,100h,addr szapppath
      lea ebx,[eax+of***t szapppath]
      cmp byte ptr [ebx-1],'\'
      je @F
      mov byte ptr [ebx],'\'
    @@:
      invoke lstrcat,addr szapppath,addr appname      
      invoke GetStartupInfo,addr startinfo
      invoke CreateProcess,addr szapppath,NULL,NULL,NULL,NULL,CREATE_SUSPENDED,NULL,NULL,addr startinfo,addr pi
      .if eax==0
        invoke lstrcat,addr szerr,addr szapppath
        invoke MessageBox,NULL,addr szerr,addr szcap,MB_OK OR MB_ICONSTOP
        jmp @@end
      .endif
      mov handle,eax
      mov ebx, pdat
    @@:
      invoke ResumeThread,pi.hThread
      invoke Sleep,60h
      invoke SuspendThread,pi.hThread
      invoke ReadProcessMemory,pi.hProcess,PatchAddr1,addr rbuffer,4,NULL
      mov edx,[rbuffer]
      cmp ebx,edx
      jne @B
      
      
      
    ;如果解压完毕则添加相关信息
      
      invoke WriteProcessMemory,pi.hProcess,PatchAddr1,addr pdat1,7,NULL    ;修改原流程
      invoke ResumeThread,pi.hThread
      invoke CloseHandle,handle
    @@end:
      invoke ExitProcess,NULL
      
  end start

生成Loader.exe,然后利用Loader启动***.exe,这样就能实现注册了,而且没有功能限制了.
但是由于Sleep的时间很不好确定,这样有时运行会出现"未注册"或是"Error"对话框的情况,但只好如此了.好累!!!

呵呵,后来发现,其实有个不用做Loader也可以但是国产软件不提了。