批量文件设置器 V2.2a

标题：批量文件设置器 V2.2a (18千字)
作者：floatsnow
时间：2001-3-22 23:18:01
链接：http://bbs.pediy.com

标题: 刚刚写完破解过程请大家指教!写错了应该是Caspr1.010,请问如何知道是用什么版本的Aspack加的壳,我只能检测到是Aspack加的壳,但不知道是什么版本的!

内容:
软件名称: 批量文件设置器 V2.2a
文件大小: 1228KB
下载地址: http://www.cnvnet.com/download/d/fo22a.exe
调试工具：SoftICE 4.05 Caspr1.1 DeDe fi
调试平台：Win98、W32dsm89
软件简介：
在WINDOWS的使用中，经常要用到对批量的文件进行属性更改，例如从盘复制过来的文件，要去了只读属性；又有时要对某些文件，如自写的程序，某些特殊用途的文件等的创建日期进行设置，以保持文档与文件的时间一致性；又有时要将某些文件按要求一一改名，而且方法、要求奇特，数量巨大。所有的这些，《批量文件设置器》均能帮你一一搞定。

该软件用Delphi5编写，执行文件有Aspack加密（版本不清楚），用Caspr1.1版本可直接脱壳。脱壳后用DeDe反编译可找到注册窗体，注册部分代码如下：

procedure TFormReg.BtnOKClick(Sender: TObject);
begin

004AA8A0 55 push ebp
004AA8A1 8BEC mov ebp, esp
004AA8A3 B90D000000 mov ecx, $0000000D
004AA8A8 6A00 push $00
004AA8AA 6A00 push $00
004AA8AC 49 dec ecx
004AA8AD 75F9 jnz 004AA8A8
004AA8AF 51 push ecx
004AA8B0 53 push ebx
004AA8B1 56 push esi
004AA8B2 57 push edi
004AA8B3 8945FC mov [ebp-$04], eax
004AA8B6 8D7DE6 lea edi, [ebp-$1A]
004AA8B9 33C0 xor eax, eax
004AA8BB 55 push ebp

* Possible String Reference to: '閴婖?腚_^[嬪]门课募柚闷?
|
004AA8BC 68D2AC4A00 push $004AACD2

***** TRY
|
004AA8C1 64FF30 push dword ptr fs:[eax]
004AA8C4 648920 mov fs:[eax], esp
004AA8C7 8D55E0 lea edx, [ebp-$20]

* Reference to FormReg
|
004AA8CA 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AA8CD 8B80DC020000 mov eax, [eax+$02DC]

|
004AA8D3 E81483F8FF call 00432BEC
004AA8D8 8B45E0 mov eax, [ebp-$20]

|
004AA8DB E80897F5FF call 00403FE8
004AA8E0 83F802 cmp eax, +$02
004AA8E3 7C1E jl 004AA903
004AA8E5 8D55DC lea edx, [ebp-$24]

* Reference to FormReg
|
004AA8E8 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AA8EB 8B80E0020000 mov eax, [eax+$02E0]

|
004AA8F1 E8F682F8FF call 00432BEC
004AA8F6 8B45DC mov eax, [ebp-$24]

|
004AA8F9 E8EA96F5FF call 00403FE8
004AA8FE 83F802 cmp eax, +$02
004AA901 7D1F jnl 004AA922
004AA903 6A10 push $10

* Possible String Reference to: '批量文件设置器'
|
004AA905 68E0AC4A00 push $004AACE0

* Possible String Reference to: '用户名或公司名，请不短于两位（一个?
| 鹤郑?
|
004AA90A 68F0AC4A00 push $004AACF0

* Reference to FormReg
|
004AA90F 8B45FC mov eax, [ebp-$04]

|
004AA912 E8E9E4F8FF call 00438E00
004AA917 50 push eax

* Reference to: user32.MessageBoxA()
|
004AA918 E8B7CAF5FF call 004073D4
004AA91D E995030000 jmp 004AACB7
004AA922 B301 mov bl, $01
004AA924 8BF7 mov esi, edi
004AA926 8D45D8 lea eax, [ebp-$28]
004AA929 50 push eax
004AA92A 8D55D4 lea edx, [ebp-$2C]

* Reference to FormReg
|
004AA92D 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditCode : TEdit
|
004AA930 8B80E8020000 mov eax, [eax+$02E8]

|
004AA936 E8B182F8FF call 00432BEC
004AA93B 8B45D4 mov eax, [ebp-$2C]
004AA93E 33D2 xor edx, edx
004AA940 8AD3 mov dl, bl
004AA942 8D1452 lea edx, [edx+edx*2]
004AA945 83EA02 sub edx, +$02
004AA948 B903000000 mov ecx, $00000003

|
004AA94D E89E98F5FF call 004041F0
004AA952 8B45D8 mov eax, [ebp-$28]
004AA955 33D2 xor edx, edx

| 依次取得3位注册码
004AA957 E814E2F5FF call 00408B70 //将取得的3位注册码转换成数值
004AA95C 668906 mov [esi], ax //讲转换结果存于esi所指内存
004AA95F 43 inc ebx
004AA960 83C602 add esi, +$02
004AA963 80FB09 cmp bl, $09 //是否取得8次
004AA966 75BE jnz 004AA926 //未到这跳转
004AA968 33F6 xor esi, esi //esi清0
004AA96A 8D55D0 lea edx, [ebp-$30]

* Reference to FormReg
|
004AA96D 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AA970 8B80DC020000 mov eax, [eax+$02DC]

|
004AA976 E87182F8FF call 00432BEC
004AA97B 8B45D0 mov eax, [ebp-$30]

|
004AA97E E86596F5FF call 00403FE8 //取得用户名长度
004AA983 84C0 test al, al
004AA985 765F jbe 004AA9E6
004AA987 8845F7 mov [ebp-$09], al //存于[ebp-$09]
004AA98A B301 mov bl, $01
004AA98C 8D55CC lea edx, [ebp-$34]

* Reference to FormReg
|
004AA98F 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AA992 8B80DC020000 mov eax, [eax+$02DC]

|
004AA998 E84F82F8FF call 00432BEC
004AA99D 8B45CC mov eax, [ebp-$34]
004AA9A0 33D2 xor edx, edx
004AA9A2 8AD3 mov dl, bl
004AA9A4 0FB64410FF movzx eax, byte ptr [eax+edx-$01] //依次取得用户名
004AA9A9 B914000000 mov ecx, $00000014
004AA9AE 33D2 xor edx, edx
004AA9B0 F7F1 div ecx
004AA9B2 50 push eax //保留商
004AA9B3 8D55C8 lea edx, [ebp-$38]

* Reference to FormReg
|
004AA9B6 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AA9B9 8B80DC020000 mov eax, [eax+$02DC]

|
004AA9BF E82882F8FF call 00432BEC
004AA9C4 8B45C8 mov eax, [ebp-$38]
004AA9C7 33D2 xor edx, edx
004AA9C9 8AD3 mov dl, bl
004AA9CB 0FB64410FF movzx eax, byte ptr [eax+edx-$01] //取相同用户名
004AA9D0 B90D000000 mov ecx, $0000000D
004AA9D5 33D2 xor edx, edx
004AA9D7 F7F1 div ecx //保留余数在edx中
004AA9D9 58 pop eax //弹出保留的商
004AA9DA 6603C2 add ax, dx //余数+商
004AA9DD 6603F0 add si, ax //加到si
004AA9E0 43 inc ebx
004AA9E1 FE4DF7 dec byte ptr [ebp-$09] //用户名是否读完
004AA9E4 75A6 jnz 004AA98C //否，继续累加
004AA9E6 6683FE6F cmp si, +$6F //累加值是否大于$6f
004AA9EA 7604 jbe 004AA9F0 //小于则跳过
004AA9EC 66BE6F00 mov si, $006F //大于则 si=$6f
004AA9F0 8D55C4 lea edx, [ebp-$3C] //si将和第五组注册码比较
//下面程序不影响si的值
* Reference to FormReg
|
004AA9F3 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AA9F6 8B80DC020000 mov eax, [eax+$02DC]

|
004AA9FC E8EB81F8FF call 00432BEC
004AAA01 8B45C4 mov eax, [ebp-$3C]
004AAA04 33DB xor ebx, ebx

* Reference to field TEdit.OFFS_0001
|
004AAA06 8A5801 mov bl, byte ptr [eax+$01] //取第二位用户名
004AAA09 8D55C0 lea edx, [ebp-$40]

* Reference to FormReg
|
004AAA0C 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AAA0F 8B80E0020000 mov eax, [eax+$02E0]

|
004AAA15 E8D281F8FF call 00432BEC
004AAA1A 8B45C0 mov eax, [ebp-$40]
004AAA1D 0FB64001 movzx eax, byte ptr [eax+$01] /取第二位公司名
004AAA21 03D8 add ebx, eax //相加
004AAA23 0FB707 movzx eax, word ptr [edi] //取头三位注册码的值
004AAA26 3BD8 cmp ebx, eax //是否相等
004AAA28 0F8502010000 jnz 004AAB30 //不等就完了
004AAA2E 8D55BC lea edx, [ebp-$44]

* Reference to FormReg
|
004AAA31 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AAA34 8B80DC020000 mov eax, [eax+$02DC]

|
004AAA3A E8AD81F8FF call 00432BEC
004AAA3F 8B45BC mov eax, [ebp-$44]
004AAA42 33DB xor ebx, ebx
004AAA44 8A18 mov bl, byte ptr [eax] //取第一位用户名
004AAA46 8D55B8 lea edx, [ebp-$48]

* Reference to FormReg
|
004AAA49 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AAA4C 8B80E0020000 mov eax, [eax+$02E0]

|
004AAA52 E89581F8FF call 00432BEC
004AAA57 8B45B8 mov eax, [ebp-$48]
004AAA5A 0FB600 movzx eax, byte ptr [eax] //取第一位公司名
004AAA5D 03D8 add ebx, eax //相加
004AAA5F 0FB74702 movzx eax, word ptr [edi+$02] //取下面三位注册码的值
004AAA63 3BD8 cmp ebx, eax //比脚
004AAA65 0F85C5000000 jnz 004AAB30 //同上
004AAA6B 8D55B4 lea edx, [ebp-$4C]

* Reference to FormReg
|
004AAA6E 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AAA71 8B80DC020000 mov eax, [eax+$02DC]

|
004AAA77 E87081F8FF call 00432BEC
004AAA7C 8B45B4 mov eax, [ebp-$4C]
004AAA7F 33DB xor ebx, ebx
004AAA81 8A18 mov bl, byte ptr [eax] //取第一位用户名
004AAA83 8D55B0 lea edx, [ebp-$50]

* Reference to FormReg
|
004AAA86 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AAA89 8B80DC020000 mov eax, [eax+$02DC]

|
004AAA8F E85881F8FF call 00432BEC
004AAA94 8B45B0 mov eax, [ebp-$50]
004AAA97 0FB64001 movzx eax, byte ptr [eax+$01] //取第二位用户名
004AAA9B 03D8 add ebx, eax //相加
004AAA9D 0FB74704 movzx eax, word ptr [edi+$04] //和下一组注册码比较
004AAAA1 3BD8 cmp ebx, eax
004AAAA3 0F8587000000 jnz 004AAB30
004AAAA9 8D55AC lea edx, [ebp-$54]

* Reference to FormReg
|
004AAAAC 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AAAAF 8B80E0020000 mov eax, [eax+$02E0]

|
004AAAB5 E83281F8FF call 00432BEC
004AAABA 8B45AC mov eax, [ebp-$54]
004AAABD 33DB xor ebx, ebx
004AAABF 8A18 mov bl, byte ptr [eax] //取第一位公司名
004AAAC1 8D55A8 lea edx, [ebp-$58]

* Reference to FormReg
|
004AAAC4 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AAAC7 8B80E0020000 mov eax, [eax+$02E0]

|
004AAACD E81A81F8FF call 00432BEC
004AAAD2 8B45A8 mov eax, [ebp-$58]
004AAAD5 0FB64001 movzx eax, byte ptr [eax+$01] //取第二位公司名
004AAAD9 03D8 add ebx, eax
004AAADB 0FB74706 movzx eax, word ptr [edi+$06]
004AAADF 3BD8 cmp ebx, eax
004AAAE1 754D jnz 004AAB30 //这里同上
004AAAE3 0FB707 movzx eax, word ptr [edi] //edi指向转换过的注册码
004AAAE6 0FB75702 movzx edx, word ptr [edi+$02]
004AAAEA 03C2 add eax, edx
004AAAEC 0FB75704 movzx edx, word ptr [edi+$04]
004AAAF0 03C2 add eax, edx
004AAAF2 0FB75706 movzx edx, word ptr [edi+$06]
004AAAF6 03C2 add eax, edx //前四组相加
004AAAF8 0FB75708 movzx edx, word ptr [edi+$08]
004AAAFC 0FB74F0A movzx ecx, word ptr [edi+$0A]
004AAB00 03D1 add edx, ecx
004AAB02 0FB74F0C movzx ecx, word ptr [edi+$0C]
004AAB06 03D1 add edx, ecx
004AAB08 0FB74F0E movzx ecx, word ptr [edi+$0E]
004AAB0C 03D1 add edx, ecx //后四组相加
004AAB0E 3BC2 cmp eax, edx
004AAB10 751E jnz 004AAB30
004AAB12 663B7708 cmp si, word ptr [edi+$08] //比较si和第5组是否相等
004AAB16 7518 jnz 004AAB30
004AAB18 0FB74708 movzx eax, word ptr [edi+$08] //取第五组
004AAB1C 0FB717 movzx edx, word ptr [edi] //取第四组
004AAB1F 03C2 add eax, edx //相加
004AAB21 0FB7570A movzx edx, word ptr [edi+$0A] //取第七组
004AAB25 3BC2 cmp eax, edx //四组+五组是否等于七组
004AAB27 7507 jnz 004AAB30
004AAB29 66837F0C64 cmp word ptr [edi+$0C], +$64 //第六组应等于$64
004AAB2E 743B jz 004AAB6B //跳转就OK了！
004AAB30 6A10 push $10

* Possible String Reference to: '批量文件设置器'
|
004AAB32 68E0AC4A00 push $004AACE0

* Possible String Reference to: '您的注册码不正确。如果该注册码是从?
| 髡吣抢锏玫降模胗胱髡吡怠?
|
004AAB37 681CAD4A00 push $004AAD1C

* Reference to FormReg
|
004AAB3C 8B45FC mov eax, [ebp-$04]

|
004AAB3F E8BCE2F8FF call 00438E00
004AAB44 50 push eax

* Reference to: user32.MessageBoxA()
|
004AAB45 E88AC8F5FF call 004073D4
004AAB4A 803D58C94C0003 cmp byte ptr [$4CC958], $03
004AAB51 730B jnb 004AAB5E
004AAB53 FE0558C94C00 inc byte ptr [$4CC958]
004AAB59 E959010000 jmp 004AACB7

* Reference to FormReg
|
004AAB5E 8B45FC mov eax, [ebp-$04]

|
004AAB61 E84635FAFF call 0044E0AC
004AAB66 E94C010000 jmp 004AACB7
004AAB6B 6A40 push $40

* Possible String Reference to: '批量文件设置器'
|
004AAB6D 68E0AC4A00 push $004AACE0

* Possible String Reference to: '感谢您！您已经成功地注册了！'
|
004AAB72 6860AD4A00 push $004AAD60

* Reference to FormReg
|
004AAB77 8B45FC mov eax, [ebp-$04]

|
004AAB7A E881E2F8FF call 00438E00
004AAB7F 50 push eax

* Reference to: user32.MessageBoxA()
|
004AAB80 E84FC8F5FF call 004073D4

* Reference to TMainForm instance
|
004AAB85 A1B0B14C00 mov eax, dword ptr [$4CB1B0]
004AAB8A 8B00 mov eax, [eax]

* Possible String Reference to: '批量文件设置器'
|
004AAB8C BA88AD4A00 mov edx, $004AAD88

|
004AAB91 E88680F8FF call 00432C1C

* Reference to TMainForm instance
|
004AAB96 A1B0B14C00 mov eax, dword ptr [$4CB1B0]
004AAB9B 8B00 mov eax, [eax]

* Reference to control TMainForm.MenuReg : TMenuItem
|
004AAB9D 8B80F0030000 mov eax, [eax+$03F0]
004AABA3 33D2 xor edx, edx

|
004AABA5 E8728DF9FF call 0044391C
004AABAA 8D55A4 lea edx, [ebp-$5C]

* Reference to FormReg
|
004AABAD 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AABB0 8B80DC020000 mov eax, [eax+$02DC]

|
004AABB6 E83180F8FF call 00432BEC
004AABBB 8B55A4 mov edx, [ebp-$5C]

* Reference to TAboutBox instance
|
004AABBE A1BCB14C00 mov eax, dword ptr [$4CB1BC]
004AABC3 8B00 mov eax, [eax]

* Reference to control TAboutBox.LabelUser : TLabel
|
004AABC5 8B80E0020000 mov eax, [eax+$02E0]

|
004AABCB E84C80F8FF call 00432C1C
004AABD0 8D55A0 lea edx, [ebp-$60]

* Reference to FormReg
|
004AABD3 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AABD6 8B80E0020000 mov eax, [eax+$02E0]

|
004AABDC E80B80F8FF call 00432BEC
004AABE1 8B55A0 mov edx, [ebp-$60]

* Reference to TAboutBox instance
|
004AABE4 A1BCB14C00 mov eax, dword ptr [$4CB1BC]
004AABE9 8B00 mov eax, [eax]

* Reference to control TAboutBox.LabelComp : TLabel
|
004AABEB 8B80E4020000 mov eax, [eax+$02E4]

|
004AABF1 E82680F8FF call 00432C1C
004AABF6 8B0DCCB04C00 mov ecx, [$4CB0CC]
004AABFC 8B09 mov ecx, [ecx]
004AABFE B201 mov dl, $01

* Reference to class TIniFile
|
004AAC00 A1846A4700 mov eax, dword ptr [$476A84]

|
004AAC05 E822BFFCFF call 00476B2C
004AAC0A 8945F8 mov [ebp-$08], eax
004AAC0D 33C0 xor eax, eax
004AAC0F 55 push ebp
004AAC10 68A8AC4A00 push $004AACA8

***** TRY
|
004AAC15 64FF30 push dword ptr fs:[eax]
004AAC18 648920 mov fs:[eax], esp
004AAC1B 8D559C lea edx, [ebp-$64]

* Reference to FormReg
|
004AAC1E 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AAC21 8B80DC020000 mov eax, [eax+$02DC]

|
004AAC27 E8C07FF8FF call 00432BEC
004AAC2C 8B459C mov eax, [ebp-$64]
004AAC2F 50 push eax

* Possible String Reference to: 'RegUserName'
|
004AAC30 B9A0AD4A00 mov ecx, $004AADA0

* Possible String Reference to: 'RegData'
|
004AAC35 BAB4AD4A00 mov edx, $004AADB4
004AAC3A 8B45F8 mov eax, [ebp-$08]
004AAC3D 8B18 mov ebx, [eax]

* Possible reference to virtual method TIniFile.OFFS_04
|
004AAC3F FF5304 call dword ptr [ebx+$04]
004AAC42 8D5598 lea edx, [ebp-$68]

* Reference to FormReg
|
004AAC45 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AAC48 8B80E0020000 mov eax, [eax+$02E0]

|
004AAC4E E8997FF8FF call 00432BEC
004AAC53 8B4598 mov eax, [ebp-$68]
004AAC56 50 push eax

* Possible String Reference to: 'RegCompant'
|
004AAC57 B9C4AD4A00 mov ecx, $004AADC4

* Possible String Reference to: 'RegData'
|
004AAC5C BAB4AD4A00 mov edx, $004AADB4
004AAC61 8B45F8 mov eax, [ebp-$08]
004AAC64 8B18 mov ebx, [eax]

* Possible reference to virtual method TIniFile.OFFS_04
|
004AAC66 FF5304 call dword ptr [ebx+$04]
004AAC69 8D5594 lea edx, [ebp-$6C]

* Reference to FormReg
|
004AAC6C 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditCode : TEdit
|
004AAC6F 8B80E8020000 mov eax, [eax+$02E8]

|
004AAC75 E8727FF8FF call 00432BEC
004AAC7A 8B4594 mov eax, [ebp-$6C]
004AAC7D 50 push eax

* Possible String Reference to: 'RegCode'
|
004AAC7E B9D8AD4A00 mov ecx, $004AADD8

* Possible String Reference to: 'RegData'
|
004AAC83 BAB4AD4A00 mov edx, $004AADB4
004AAC88 8B45F8 mov eax, [ebp-$08]
004AAC8B 8B18 mov ebx, [eax]

* Possible reference to virtual method TIniFile.OFFS_04
|
004AAC8D FF5304 call dword ptr [ebx+$04]
004AAC90 33C0 xor eax, eax
004AAC92 5A pop edx
004AAC93 59 pop ecx
004AAC94 59 pop ecx
004AAC95 648910 mov fs:[eax], edx

****** FINALLY
|
004AAC98 68AFAC4A00 push $004AACAF
004AAC9D B201 mov dl, $01
004AAC9F 8B45F8 mov eax, [ebp-$08]
004AACA2 8B08 mov ecx, [eax]

* Possible reference to virtual method TIniFile.OFFS_04
|
004AACA4 FF51FC call dword ptr [ecx-$04]
004AACA7 C3 ret

004AACA8 E9B38AF5FF jmp 00403760
004AACAD EBEE jmp 004AAC9D

****** END
|
* Reference to FormReg
|
004AACAF 8B45FC mov eax, [ebp-$04]

|
004AACB2 E8F533FAFF call 0044E0AC
004AACB7 33C0 xor eax, eax
004AACB9 5A pop edx
004AACBA 59 pop ecx
004AACBB 59 pop ecx
004AACBC 648910 mov fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '_^[嬪]门课募柚闷?
|
004AACBF 68D9AC4A00 p