FreeMen Professional Trial Version

标题：FreeMen Professional Trial Version (31千字)
作者：abcde-12345
时间：2001-11-9 20:44:02
链接：http://bbs.pediy.com

********FreeMen Professional Trial Version********
:0044F671 807C02FF5C cmp byte ptr [edx+eax-01], 5C       <--| 启动时判断
:0044F676 740D je 0044F685 |
:0044F678 8D45FC lea eax, dword ptr [ebp-04] |
:0044F67B BA70F74400 mov edx, 0044F770 |
:0044F680 E85B45FBFF call 00403BE0 |
|
* Referenced by a (U)nconditional or (C)onditional Jump at Address: |
|:0044F676(C) |
| |
:0044F685 803DA430450000 cmp byte ptr [004530A4], 00 |
:0044F68C 0F8491000000 je 0044F723 |
:0044F692 33D2 xor edx, edx |
:0044F694 8B8380030000 mov eax, dword ptr [ebx+00000380] |
:0044F69A E879F9FCFF call 0041F018 |
:0044F69F 33D2 xor edx, edx |
:0044F6A1 8B8390030000 mov eax, dword ptr [ebx+00000390] |
:0044F6A7 E86CF9FCFF call 0041F018 |
|
* Possible StringData Ref from Code Obj ->"Thank you for your Registration"|
| |
:0044F6AC BA7CF74400 mov edx, 0044F77C |
:0044F6B1 8B8344020000 mov eax, dword ptr [ebx+00000244] |
:0044F6B7 E830FAFCFF call 0041F0EC |
:0044F6BC A100324500 mov eax, dword ptr [00453200] |
:0044F6C1 8B00 mov eax, dword ptr [eax] |
:0044F6C3 83C034 add eax, 00000034 |
|
* Possible StringData Ref from Code Obj ->"fmempro4.hlp" |
| |
:0044F6C6 B9A4F74400 mov ecx, 0044F7A4 <--|

/////////////////////////////////////////////////////////////////////////////////////////////////
* Possible StringData Ref from Code Obj ->"Registration"
|
:0044BCA1 BA2CC94400 mov edx, 0044C92C

* Possible StringData Ref from Code Obj ->"HKEY_CURRENT_USER\Software\Meikel "
->"Weber\FreeMem Pro"
|
:0044BCA6 B844C94400 mov eax, 0044C944
:0044BCAB E8F092FFFF call 00444FA0
:0044BCB0 8B45E0 mov eax, dword ptr [ebp-20]
:0044BCB3 E8283D0000 call 0044F9E0
:0044BCB8 A2A4304500 mov byte ptr [004530A4], al       <--赋值
:0044BCBD 803DA430450000 cmp byte ptr [004530A4], 00
:0044BCC4 7544 jne 0044BD0A
:0044BCC6 E87DFCFFFF call 0044B948
:0044BCCB A2A4304500 mov byte ptr [004530A4], al       <--赋值
:0044BCD0 803DA430450000 cmp byte ptr [004530A4], 00
:0044BCD7 752B jne 0044BD04
:0044BCD9 E80EFBFFFF call 0044B7EC
:0044BCDE 8845DB mov byte ptr [ebp-25], al       <--what a u doing ?
:0044BCE1 8A45DB mov al, byte ptr [ebp-25]       <--??
:0044BCE4 A2A4304500 mov byte ptr [004530A4], al       <--赋值
:0044BCE9 803DA430450000 cmp byte ptr [004530A4], 00
:0044BCF0 751C jne 0044BD0E
:0044BCF2 E84DFCFFFF call 0044B944
:0044BCF7 8845DA mov byte ptr [ebp-26], al       <--what a u doing ?
:0044BCFA 8A45DA mov al, byte ptr [ebp-26] <--??
:0044BCFD A2A4304500 mov byte ptr [004530A4], al <--赋值
:0044BD02 EB0A jmp 0044BD0E

/////////////////////////////////////////////////////////////////////////////////////////////////
* Possible StringData Ref from Code Obj ->"Professional Version"
|
:0044C789 BA6CCC4400 mov edx, 0044CC6C
:0044C78E 8B83D8030000 mov eax, dword ptr [ebx+000003D8]
:0044C794 E85329FDFF call 0041F0EC
:0044C799 33D2 xor edx, edx
:0044C79B 8B8350050000 mov eax, dword ptr [ebx+00000550]
:0044C7A1 E87228FDFF call 0041F018
:0044C7A6 33D2 xor edx, edx
:0044C7A8 8B8350050000 mov eax, dword ptr [ebx+00000550]
:0044C7AE E86D07FFFF call 0043CF20
:0044C7B3 A0A4304500 mov al, byte ptr [004530A4]       <--可能是判断版本????
:0044C7B8 2245DB and al, byte ptr [ebp-25]
:0044C7BB 741C je 0044C7D9
:0044C7BD 33D2 xor edx, edx
:0044C7BF 8B8334020000 mov eax, dword ptr [ebx+00000234]
:0044C7C5 E84E28FDFF call 0041F018
:0044C7CA 33D2 xor edx, edx
:0044C7CC 8B8334020000 mov eax, dword ptr [ebx+00000234]
:0044C7D2 E84907FFFF call 0043CF20
:0044C7D7 EB65 jmp 0044C83E                   <--|
|
* Referenced by a (U)nconditional or (C)onditional Jump at Address: |
|:0044C7BB(C) |
| |
:0044C7D9 A0A4304500 mov al, byte ptr [004530A4]       <--我不懂?? |
:0044C7DE 2245DA and al, byte ptr [ebp-26] |
:0044C7E1 741C je 0044C7FF |
:0044C7E3 33D2 xor edx, edx |
:0044C7E5 8B8334020000 mov eax, dword ptr [ebx+00000234] |
:0044C7EB E82828FDFF call 0041F018 |
:0044C7F0 33D2 xor edx, edx |
:0044C7F2 8B8334020000 mov eax, dword ptr [ebx+00000234] |
:0044C7F8 E82307FFFF call 0043CF20 |
:0044C7FD EB3F jmp 0044C83E                   <--|

/////////////////////////////////////////////////////////////////////////////////////////////////
* Possible StringData Ref from Code Obj ->"FreeMem"
|
:0044C87A 8B15782F4500 mov edx, dword ptr [00452F78]
:0044C880 8B833C020000 mov eax, dword ptr [ebx+0000023C]
:0044C886 E86128FDFF call 0041F0EC
:0044C88B C683AC05000000 mov byte ptr [ebx+000005AC], 00
:0044C892 803DA430450000 cmp byte ptr [004530A4], 00       <--判断版本????
:0044C899 7513 jne 0044C8AE
:0044C89B 8B93E8010000 mov edx, dword ptr [ebx+000001E8]
:0044C8A1 8B83E0010000 mov eax, dword ptr [ebx+000001E0]
:0044C8A7 E89C0AFFFF call 0043D348
:0044C8AC EB11 jmp 0044C8BF

/////////////////////////////////////////////////////////////////////////////////////////////////
* Possible StringData Ref from Code Obj ->"Show"
|
:0044EC45 BA5CF04400 mov edx, 0044F05C
:0044EC4A E88560FFFF call 00444CD4
:0044EC4F 803DA430450000 cmp byte ptr [004530A4], 00       <--显示版本????可能吧!
:0044EC56 0F84A0020000 je 0044EEFC
:0044EC5C 8B8390020000 mov eax, dword ptr [ebx+00000290]
:0044EC62 E88967FEFF call 004353F0
:0044EC67 8BC8 mov ecx, eax

/////////////////////////////////////////////////////////////////////////////////////////////////
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F37F(C)
|
:0044F3F5 65 BYTE 065h
:0044F3F6 6D insd
:0044F3F7 6F outsd
:0044F3F8 7279 jb 0044F473
:0044F3FA 0000 add byte ptr [eax], al
:0044F3FC 55 push ebp
:0044F3FD 8BEC mov ebp, esp
:0044F3FF 6A00 push 00000000
:0044F401 53 push ebx
:0044F402 8BD8 mov ebx, eax
:0044F404 33C0 xor eax, eax
:0044F406 55 push ebp
:0044F407 68A1F54400 push 0044F5A1
:0044F40C 64FF30 push dword ptr fs:[eax]
:0044F40F 648920 mov dword ptr fs:[eax], esp
:0044F412 803DA430450000 cmp byte ptr [004530A4], 00       <--判断是否已注册?
:0044F419 0F856C010000 jne 0044F58B               <--Register
:0044F41F 8D55FC lea edx, dword ptr [ebp-04]       <--NoRegister
:0044F422 8B8380030000 mov eax, dword ptr [ebx+00000380]
:0044F428 E88FFCFCFF call 0041F0BC
:0044F42D 8B45FC mov eax, dword ptr [ebp-04]
:0044F430 E8AB050000 call 0044F9E0
:0044F435 A2A4304500 mov byte ptr [004530A4], al       <--写入Flag
:0044F43A 803DA430450000 cmp byte ptr [004530A4], 00
:0044F441 0F8444010000 je 0044F58B
:0044F447 8D55FC lea edx, dword ptr [ebp-04]
:0044F44A 8B8380030000 mov eax, dword ptr [ebx+00000380]
:0044F450 E867FCFCFF call 0041F0BC
:0044F455 8B4DFC mov ecx, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F3F1(C)
|

* Possible StringData Ref from Code Obj ->"Registration"
|
:0044F458 BAB4F54400 mov edx, 0044F5B4
/////////////////////////////////////////////////////////////////////////////////////////////////
* Referenced by a (U)nconditional or (C)onditional Jump at Address:   计算过程
|:0044F975(C)
|
:0044F9E0 55 push ebp
:0044F9E1 8BEC mov ebp, esp
:0044F9E3 51 push ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F970(C)
|
:0044F9E4 53 push ebx
:0044F9E5 8945FC mov dword ptr [ebp-04], eax
:0044F9E8 8B45FC mov eax, dword ptr [ebp-04]
:0044F9EB E89C43FBFF call 00403D8C
:0044F9F0 33C0 xor eax, eax
:0044F9F2 55 push ebp
:0044F9F3 6854FA4400 push 0044FA54
:0044F9F8 64FF30 push dword ptr fs:[eax]
:0044F9FB 648920 mov dword ptr fs:[eax], esp
:0044F9FE 8B55FC mov edx, dword ptr [ebp-04]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F99A(C)
|
:0044FA01 B864000000 mov eax, 00000064
:0044FA06 E899A4FEFF call 00439EA4 <--关键!!!
:0044FA0B 84C0 test al, al
:0044FA0D 7515 jne 0044FA24       F&NJ 错误注册码不跳 R&J
:0044FA0F 8B55FC mov edx, dword ptr [ebp-04]
:0044FA12 B867000000 mov eax, 00000067
:0044FA17 E888A4FEFF call 00439EA4
:0044FA1C 84C0 test al, al
:0044FA1E 7504 jne 0044FA24 F&NJ
:0044FA20 33DB xor ebx, ebx
:0044FA22 EB02 jmp 0044FA26

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044FA0D(C), :0044FA1E(C)
|
:0044FA24 B301 mov bl, 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FA22(U)
|
:0044FA26 84DB test bl, bl
:0044FA28 740C je 0044FA36 F&J 错误注册码跳
:0044FA2A 8B45FC mov eax, dword ptr [ebp-04]
:0044FA2D E8DEA5FEFF call 0043A010
:0044FA32 84C0 test al, al
:0044FA34 7404 je 0044FA3A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FA28(C)
|
:0044FA36 33C0 xor eax, eax
:0044FA38 EB02 jmp 0044FA3C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FA34(C)
|
:0044FA3A B001 mov al, 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FA38(U)
|
:0044FA3C 8BD8 mov ebx, eax
:0044FA3E 33C0 xor eax, eax
:0044FA40 5A pop edx
:0044FA41 59 pop ecx
:0044FA42 59 pop ecx
:0044FA43 648910 mov dword ptr fs:[eax], edx
:0044FA46 685BFA4400 push 0044FA5B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044FA59(U)
|
:0044FA4B 8D45FC lea eax, dword ptr [ebp-04]
:0044FA4E E8093FFBFF call 0040395C
:0044FA53 C3 ret >--|
|
|
:0044FA54 E92339FBFF jmp 0040337C |
:0044FA59 EBF0 jmp 0044FA4B |
:0044FA5B 8BC3 mov eax, ebx <--|
:0044FA5D 5B pop ebx
:0044FA5E 59 pop ecx
:0044FA5F 5D pop ebp
:0044FA60 C3 ret

//////////////