* Referenced by a CALL at Address:
|:00416950
|
:00416710 55
push ebp
:00416711 8BEC
mov ebp, esp
:00416713 6AFF
push FFFFFFFF
:00416715 68B0354400 push 004435B0
:0041671A 6814934300 push 00439314
:0041671F 64A100000000 mov eax, dword
ptr fs:[00000000]
:00416725 50
push eax
:00416726 64892500000000 mov dword ptr fs:[00000000],
esp
:0041672D 83EC08
sub esp, 00000008
:00416730 53
push ebx
:00416731 56
push esi
:00416732 57
push edi
:00416733 8965E8
mov dword ptr [ebp-18], esp
:00416736 C745FC00000000 mov [ebp-04], 00000000
:0041673D 68B0B24400 push 0044B2B0
* Reference To: KRNLAPI.Ordinal:001B, Ord:001Bh
|
:00416742 E813260200 Call 00438D5A
:00416747 83C404
add esp, 00000004
:0041674A 85C0
test eax, eax
:0041674C 7419
je 00416767
:0041674E 6818C14400 push 0044C118
:00416753 681CB64400 push 0044B61C
:00416758 E8E3CDFEFF call 00403540<---跟进去,核心计算
:0041675D 83C408
add esp, 00000008
:00416760 A358C24400 mov dword
ptr [0044C258], eax
:00416765 EB1F
jmp 00416786
===================================================================
* Referenced by a CALL at Address:
|:00416758
|
:00403540 83EC20
sub esp, 00000020
:00403543 B908000000 mov ecx,
00000008
:00403548 33C0
xor eax, eax
:0040354A 53
push ebx
:0040354B 55
push ebp
:0040354C 8B6C2430 mov
ebp, dword ptr [esp+30]
:00403550 56
push esi
:00403551 57
push edi
:00403552 8D7C2410 lea
edi, dword ptr [esp+10]
:00403556 F3
repz
:00403557 AB
stosd
:00403558 8BDD
mov ebx, ebp
:0040355A 8D442410 lea
eax, dword ptr [esp+10]
:0040355E 33F6
xor esi, esi
:00403560 2BD8
sub ebx, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403586(C)
|
:00403562 8D7C3410 lea
edi, dword ptr [esp+esi+10]
:00403566 0FBE043B movsx
eax, byte ptr [ebx+edi]<--注册码
:0040356A 83F841
cmp eax, 00000041 第一字
:0040356D 7C08
jl 00403577
:0040356F 83F85A
cmp eax, 0000005A
:00403572 7F03
jg 00403577
:00403574 83C020
add eax, 00000020
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040356D(C), :00403572(C)
|
:00403577 50
push eax
:00403578 E863FFFFFF call 004034E0
:0040357D 83C404
add esp, 00000004
:00403580 46
inc esi
:00403581 83FE04
cmp esi, 00000004
:00403584 8807
mov byte ptr [edi], al
:00403586 7CDA
jl 00403562
:00403588 8B442410 mov
eax, dword ptr [esp+10]
:0040358C 8D4801
lea ecx, dword ptr [eax+01]
:0040358F 0FAFC8
imul ecx, eax
:00403592 894C2414 mov
dword ptr [esp+14], ecx
:00403596 33F6
xor esi, esi
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004035B9(C)
|
:00403598 8A543414 mov
dl, byte ptr [esp+esi+14]
:0040359C 52
push edx
:0040359D 56
push esi
:0040359E E81DFFFFFF call 004034C0
:004035A3 25FF000000 and eax,
000000FF
:004035A8 50
push eax
:004035A9 E832FFFFFF call 004034E0
:004035AE 83C40C
add esp, 0000000C
:004035B1 88443414 mov
byte ptr [esp+esi+14], al<--算出第5个字
:004035B5 46
inc esi
:004035B6 83FE04
cmp esi, 00000004<--循环算出6,7,8个字
:004035B9 7CDD
jl 00403598
:004035BB 33C9
xor ecx, ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004035E0(C)
|
:004035BD 0FBE442905 movsx eax,
byte ptr [ecx+ebp+05]
:004035C2 83F841
cmp eax, 00000041
:004035C5 7C08
jl 004035CF
:004035C7 83F85A
cmp eax, 0000005A
:004035CA 7F03
jg 004035CF
:004035CC 83C020
add eax, 00000020
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004035C5(C), :004035CA(C)
|
:004035CF 0FBE540C14 movsx edx,
byte ptr [esp+ecx+14]
:004035D4 3BC2
cmp eax, edx<---与假注册码比较
:004035D6 0F85BA000000 jne 00403696
:004035DC 41
inc ecx
:004035DD 83F904
cmp ecx, 00000004
:004035E0 7CDB
jl 004035BD
:004035E2 8B442414 mov
eax, dword ptr [esp+14]
:004035E6 8B4C2410 mov
ecx, dword ptr [esp+10]
:004035EA 8BD0
mov edx, eax
:004035EC 33D1
xor edx, ecx
:004035EE 42
inc edx
:004035EF 0FAFD1
imul edx, ecx
:004035F2 03D0
add edx, eax
:004035F4 33F6
xor esi, esi
:004035F6 89542418 mov
dword ptr [esp+18], edx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403610(C)
|
:004035FA 0FBE443418 movsx eax,
byte ptr [esp+esi+18]
:004035FF 50
push eax
:00403600 E8DBFEFFFF call 004034E0
:00403605 83C404
add esp, 00000004
:00403608 88443418 mov
byte ptr [esp+esi+18], al
:0040360C 46
inc esi
:0040360D 83FE04
cmp esi, 00000004<--由5,6,7,8算出
:00403610 7CE8
jl 004035FA 9,10,11,12个字
:00403612 33C9
xor ecx, ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403633(C)
|
:00403614 0FBE44290A movsx eax,
byte ptr [ecx+ebp+0A]
:00403619 83F841
cmp eax, 00000041
:0040361C 7C08
jl 00403626
:0040361E 83F85A
cmp eax, 0000005A
:00403621 7F03
jg 00403626
:00403623 83C020
add eax, 00000020
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040361C(C), :00403621(C)
|
:00403626 0FBE540C18 movsx edx,
byte ptr [esp+ecx+18]
:0040362B 3BC2
cmp eax, edx<---与假注册码比较
:0040362D 7567
jne 00403696
:0040362F 41
inc ecx
:00403630 83F904
cmp ecx, 00000004
:00403633 7CDF
jl 00403614
:00403635 8B4C2414 mov
ecx, dword ptr [esp+14]
:00403639 8B442410 mov
eax, dword ptr [esp+10]
:0040363D 0FAFC8
imul ecx, eax
:00403640 41
inc ecx
:00403641 0FAF4C2418 imul ecx,
dword ptr [esp+18]
:00403646 03C8
add ecx, eax
:00403648 33F6
xor esi, esi
:0040364A 894C241C mov
dword ptr [esp+1C], ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403664(C)
|
:0040364E 0FBE54341C movsx edx,
byte ptr [esp+esi+1C]
:00403653 52
push edx
:00403654 E887FEFFFF call 004034E0
:00403659 83C404
add esp, 00000004
:0040365C 8844341C mov
byte ptr [esp+esi+1C], al
:00403660 46
inc esi
:00403661 83FE04
cmp esi, 00000004<--注册码的13,14,15,16个字
:00403664 7CE8
jl 0040364E
:00403666 33C9
xor ecx, ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403687(C)
|
:00403668 0FBE44290F movsx eax,
byte ptr [ecx+ebp+0F]
:0040366D 83F841
cmp eax, 00000041
:00403670 7C08
jl 0040367A
:00403672 83F85A
cmp eax, 0000005A
:00403675 7F03
jg 0040367A
:00403677 83C020
add eax, 00000020
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00403670(C), :00403675(C)
|
:0040367A 0FBE540C1C movsx edx,
byte ptr [esp+ecx+1C]
:0040367F 3BC2
cmp eax, edx<--与假注册码比较
:00403681 7513
jne 00403696
:00403683 41
inc ecx
:00403684 83F904
cmp ecx, 00000004
:00403687 7CDF
jl 00403668
:00403689 5F
pop edi
:0040368A 5E
pop esi
:0040368B 5D
pop ebp
:0040368C B801000000 mov eax,
00000001<--到这里就注册成功了
:00403691 5B
pop ebx
:00403692 83C420
add esp, 00000020
:00403695 C3
ret
用户名:lancelot 注册码:4343-bz5x-15qq-m35q
crack by lancelot 2001.7.8