ThumbsUp V3.7　

标题：ThumbsUp V3.7　
作者： yimotep
时间：2003/05/11 03:14pm
链接：http://bbs.pediy.com

http://www.skycn.com/soft/2713.html

软件大小： 1311 KB
软件语言：英文
软件类别：国外软件 / 共享版 / 图像浏览
应用平台： Win9x/NT/2000/XP
界面预览：
加入时间： 2003-05-10 10:57:54
下载次数： 723
推荐等级：

联系人： pgerhart@worldlynx.net
开发商： http://www.worldlynx.net/pgerhart/

软件介绍：
可将某个文件夹中的所有 JPEG 文件以略图方式让你一次浏览，而且还可以自行设置图片的排列大小、并可以使用全屏幻灯进行展示。虽然 ThumbsUp 在看图管理上并没特别强大的功能，但其实就一般看图软件所具备的基本功能来说，ThumbsUp 可以说是该有的都有了。有以下特点：1. 文件名称、图片尺寸、文件大小、建立日期等信息的显示。2.可依照名称、大小、日期进行排序。3.可对文件即时更名、移动或删除。

软件信息：

软件无壳，VC++ 6.0编写

声明：
俺无任何商业目的。
我的OLL和 W32Dasm不知怎么了，复制后乱七八糟的。

=============================================

:00405758 E87C410000 call 004098D9 <=====算法CALL ，请进
:0040575D 898574FFFFFF mov dword ptr [ebp+FFFFFF74], eax
:00405763 C645FC01 mov [ebp-04], 01
:00405767 8D4D88 lea ecx, dword ptr [ebp-78]
:0040576A E891050000 call 00405D00 <===比较CALL
:0040576F 85C0 test eax, eax
:00405771 7576 jne 004057E9
:00405773 8D55EC lea edx, dword ptr [ebp-14]
:00405776 52 push edx
:00405777 8D4588 lea eax, dword ptr [ebp-78]
:0040577A 50 push eax
:0040577B E8A0050000 call 00405D20 <===比较CALL
:00405780 25FF000000 and eax, 000000FF <===这里下 d edx 就看到注册码。
:00405785 85C0 test eax, eax
:00405787 7460 je 004057E9
:00405789 8D4DF0 lea ecx, dword ptr [ebp-10]
:0040578C E82FC2FFFF call 004019C0
:00405791 50 push eax

* Possible StringData Ref from Data Obj ->"Name"
|
:00405792 6858E34300 push 0043E358

* Possible StringData Ref from Data Obj ->"User"
|
:00405797 6860E34300 push 0043E360
:0040579C 8B4D84 mov ecx, dword ptr [ebp-7C]
:0040579F 81C1C4000000 add ecx, 000000C4
:004057A5 E83B550000 call 0040ACE5
:004057AA 8D4DEC lea ecx, dword ptr [ebp-14]
:004057AD E80EC2FFFF call 004019C0
:004057B2 50 push eax

* Possible StringData Ref from Data Obj ->"Code"
|
:004057B3 6868E34300 push 0043E368

* Possible StringData Ref from Data Obj ->"User"
|
:004057B8 6870E34300 push 0043E370
:004057BD 8B4D84 mov ecx, dword ptr [ebp-7C]
:004057C0 81C1C4000000 add ecx, 000000C4
:004057C6 E81A550000 call 0040ACE5
:004057CB 8B4D84 mov ecx, dword ptr [ebp-7C]
:004057CE 81C1D0000000 add ecx, 000000D0
:004057D4 E840270000 call 00407F19
:004057D9 6A00 push 00000000
:004057DB 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"Thank you for registering!"
|
:004057DD 6878E34300 push 0043E378

* Reference To: MFC42.Ordinal:04B0, Ord:04B0h
|
:004057E2 E881FD0200 Call 00435568
:004057E7 EB0E jmp 004057F7

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405771(C), :00405787(C)
|
:004057E9 6A00 push 00000000
:004057EB 6A00 push 00000000

* Possible StringData Ref from Data Obj ->"Name / Code mis-match. Try again."
|
:004057ED 6894E34300 push 0043E394

================================================
00409DF3 |> 8B45 EC /MOV EAX,DWORD PTR SS:[EBP-14]
00409DF6 |. 83C0 01 |ADD EAX,1
00409DF9 |. 8945 EC |MOV DWORD PTR SS:[EBP-14],EAX
00409DFC |> 837D EC 10 CMP DWORD PTR SS:[EBP-14],10
00409E00 |. 0F8D AF000000 |JGE THUMBSUP.00409EB5
00409E06 |. 8B4D DC |MOV ECX,DWORD PTR SS:[EBP-24]
00409E09 |. 034D EC |ADD ECX,DWORD PTR SS:[EBP-14]
00409E0C |. 8A51 75 |MOV DL,BYTE PTR DS:[ECX+75]
00409E0F |. 8855 E8 |MOV BYTE PTR SS:[EBP-18],DL
00409E12 |. 8A45 E8 |MOV AL,BYTE PTR SS:[EBP-18]
00409E15 |. 24 F0 |AND AL,0F0
00409E17 |. 8845 E8 |MOV BYTE PTR SS:[EBP-18],AL
00409E1A |. 8B4D E8 |MOV ECX,DWORD PTR SS:[EBP-18]
00409E1D |. 81E1 FF000000 |AND ECX,0FF
00409E23 |. C1F9 04 |SAR ECX,4
00409E26 |. 884D E8 |MOV BYTE PTR SS:[EBP-18],CL
00409E29 |. 8B55 E8 |MOV EDX,DWORD PTR SS:[EBP-18]
00409E2C |. 81E2 FF000000 |AND EDX,0FF
00409E32 |. 83FA 0A |CMP EDX,0A
00409E35 |. 7D 10 |JGE SHORT THUMBSUP.00409E47
00409E37 |. 8B45 E8 |MOV EAX,DWORD PTR SS:[EBP-18]
00409E3A |. 25 FF000000 |AND EAX,0FF
00409E3F |. 83C0 30 |ADD EAX,30
00409E42 |. 8845 E4 |MOV BYTE PTR SS:[EBP-1C],AL
00409E45 |. EB 0F |JMP SHORT THUMBSUP.00409E56
00409E47 |> 8B4D E8 |MOV ECX,DWORD PTR SS:[EBP-18]
00409E4A |. 81E1 FF000000 |AND ECX,0FF
00409E50 |. 83C1 37 |ADD ECX,37
00409E53 |. 884D E4 |MOV BYTE PTR SS:[EBP-1C],CL
00409E56 |> 8A55 E4 |MOV DL,BYTE PTR SS:[EBP-1C]
00409E59 |. 52 |PUSH EDX
00409E5A |. 8D4D F0 |LEA ECX,DWORD PTR SS:[EBP-10]
00409E5D |. E8 DEBA0200 |CALL <JMP.&MFC42.#940><================ 第一个
00409E62 |. 8B45 DC |MOV EAX,DWORD PTR SS:[EBP-24]
00409E65 |. 0345 EC |ADD EAX,DWORD PTR SS:[EBP-14]
00409E68 |. 8A48 75 |MOV CL,BYTE PTR DS:[EAX+75]
00409E6B |. 884D E8 |MOV BYTE PTR SS:[EBP-18],CL
00409E6E |. 8A55 E8 |MOV DL,BYTE PTR SS:[EBP-18]
00409E71 |. 80E2 0F |AND DL,0F
00409E74 |. 8855 E8 |MOV BYTE PTR SS:[EBP-18],DL
00409E77 |. 8B45 E8 |MOV EAX,DWORD PTR SS:[EBP-18]
00409E7A |. 25 FF000000 |AND EAX,0FF
00409E7F |. 83F8 0A |CMP EAX,0A
00409E82 |. 7D 11 |JGE SHORT THUMBSUP.00409E95
00409E84 |. 8B4D E8 |MOV ECX,DWORD PTR SS:[EBP-18]
00409E87 |. 81E1 FF000000 |AND ECX,0FF
00409E8D |. 83C1 30 |ADD ECX,30
00409E90 |. 884D E4 |MOV BYTE PTR SS:[EBP-1C],CL
00409E93 |. EB 0F |JMP SHORT THUMBSUP.00409EA4
00409E95 |> 8B55 E8 |MOV EDX,DWORD PTR SS:[EBP-18]
00409E98 |. 81E2 FF000000 |AND EDX,0FF
00409E9E |. 83C2 37 |ADD EDX,37
00409EA1 |. 8855 E4 |MOV BYTE PTR SS:[EBP-1C],DL
00409EA4 |> 8A45 E4 |MOV AL,BYTE PTR SS:[EBP-1C]
00409EA7 |. 50 |PUSH EAX
00409EA8 |. 8D4D F0 |LEA ECX,DWORD PTR SS:[EBP-10]
00409EAB |. E8 90BA0200 |CALL <JMP.&MFC42.#940> <========第二个
00409EB0 |.^E9 3EFFFFFF \JMP THUMBSUP.00409DF3
=============================

5F45BD22 > 8D4424 04 LEA EAX,DWORD PTR SS:[ESP+4]
5F45BD26 56 PUSH ESI
5F45BD27 50 PUSH EAX
5F45BD28 8BF1 MOV ESI,ECX
5F45BD2A 6A 01 PUSH 1
5F45BD2C E8 AF83FAFF CALL MFC42.#2028 <=====in it
5F45BD31 8BC6 MOV EAX,ESI
5F45BD33 5E POP ESI
5F45BD34 C2 0400 RETN 4

====================================== <=====以下ecx为记数器

5F4040E0 > 53 PUSH EBX ebx=1 <===定值
5F4040E1 56 PUSH ESI esi=67f8c0
5F4040E2 57 PUSH EDI edi=7a06a0
5F4040E3 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10] <=====edi=[esp+10]=1
5F4040E7 85FF TEST EDI,EDI
5F4040E9 8BF1 MOV ESI,ECX
5F4040EB 74 34 JE SHORT MFC42.5F404121
5F4040ED 8B06 MOV EAX,DWORD PTR DS:[ESI] <=====以有的注册码进eax
5F4040EF 8378 F4 01 CMP DWORD PTR DS:[EAX-C],1 <====[eax-c]=1,与1比较
5F4040F3 8D58 F4 LEA EBX,DWORD PTR DS:[EAX-C] <=edx 指向[eax]
5F4040F6 7F 2F JG SHORT MFC42.5F404127
5F4040F8 8B48 F8 MOV ECX,DWORD PTR DS:[EAX-8]<===[eax-8]=(A)h
5F4040FB 8D1439 LEA EDX,DWORD PTR DS:[ECX+EDI]<=edx=ecx+edi=(B)h
5F4040FE 3B50 FC CMP EDX,DWORD PTR DS:[EAX-4] <==[eax-4]=40
5F404101 7F 24 JG SHORT MFC42.5F404127
5F404103 57 PUSH EDI <===edi=1
5F404104 03C8 ADD ECX,EAX <====以有的注册码+ecx=(A)h
5F404106 FF7424 18 PUSH DWORD PTR SS:[ESP+18]
5F40410A 51 PUSH ECX
5F40410B E8 11D9FFFF CALL <JMP.&MSVCRT.memcpy> <===in it
5F404110 8B06 MOV EAX,DWORD PTR DS:[ESI]
5F404112 83C4 0C ADD ESP,0C
5F404115 0178 F8 ADD DWORD PTR DS:[EAX-8],EDI
5F404118 8B06 MOV EAX,DWORD PTR DS:[ESI] <====新生成的注册码进eax
5F40411A 8B48 F8 MOV ECX,DWORD PTR DS:[EAX-8]
5F40411D 802401 00 AND BYTE PTR DS:[ECX+EAX],0
5F404121 5F POP EDI
5F404122 5E POP ESI
5F404123 5B POP EBX
5F404124 C2 0800 RETN 8

==============================
5F40410B里的内容：

780015FD > 55 PUSH EBP
780015FE 8BEC MOV EBP,ESP
78001600 57 PUSH EDI <====edi=1
78001601 56 PUSH ESI <====esi=67f8c0
78001602 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
78001605 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10] <===ecx=[ebp+10]=1
78001608 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
7800160B 8BC1 MOV EAX,ECX <======eax =ecx=1
7800160D 8BD1 MOV EDX,ECX <===== edx =ecx=1
7800160F 03C6 ADD EAX,ESI <====eax=esi+eax
78001611 3BFE CMP EDI,ESI
78001613 76 08 JBE SHORT MSVCRT.7800161D
78001615 3BF8 CMP EDI,EAX
78001617 0F82 0CF40000 JB MSVCRT.78010A29
7800161D F7C7 03000000 TEST EDI,3
78001623 75 1B JNZ SHORT MSVCRT.78001640
78001625 C1E9 02 SHR ECX,2
78001628 83E2 03 AND EDX,3
7800162B 83F9 08 CMP ECX,8
7800162E 73 07 JNB SHORT MSVCRT.78001637
78001630 FF248D 481F0078 JMP DWORD PTR DS:[ECX*4+78001F48]
78001637 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
78001639 FF2495 681F0078 JMP DWORD PTR DS:[EDX*4+78001F68]
78001640 8BC7 MOV EAX,EDI
78001642 BA 03000000 MOV EDX,3 <===== edx=3
78001647 83E9 04 SUB ECX,4 <=====ecx=ecx-4
7800164A 72 0C JB SHORT MSVCRT.78001658 <====跳78001658
7800164C 83E0 03 AND EAX,3
7800164F 03C8 ADD ECX,EAX
78001651 FF2485 381F0078 JMP DWORD PTR DS:[EAX*4+78001F38]
78001658 FF248D 781F0078 JMP DWORD PTR DS:[ECX*4+78001F78]<==跳
7800165F 23D1 AND EDX,ECX <======????
78001661 8A06 MOV AL,BYTE PTR DS:[ESI]
78001663 8807 MOV BYTE PTR DS:[EDI],AL
78001665 8A46 01 MOV AL,BYTE PTR DS:[ESI+1]
78001668 C1E9 02 SHR ECX,2
7800166B 8847 01 MOV BYTE PTR DS:[EDI+1],AL
7800166E 83C6 02 ADD ESI,2
78001671 83C7 02 ADD EDI,2
78001674 83F9 08 CMP ECX,8
78001677 ^72 B7 JB SHORT MSVCRT.78001630 <======跳
78001679 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
780109F8 ^0F82 320CFFFF JB MSVCRT.78001630
780109FE F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
78010A00 FF2495 681F0078 JMP DWORD PTR DS:[EDX*4+78001F68]
78010A07 8A06 MOV AL,BYTE PTR DS:[ESI] <=== al=DS:[esi]=新生的注册码
78010A09 8807 MOV BYTE PTR DS:[EDI],AL
78010A0B 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
78010A0E 5E POP ESI
78010A0F 5F POP EDI
78010A10 C9 LEAVE
78010A11 C3 RETN

==========================================

具体到 78010A07 是怎么就有了这个数我找了好长时间，也不明白。
还请各位大哥，指教了，谢谢。

整理：
yimotepDFCG
B1A65EB2AFB5991D0A726AF7D6E874D8

内存注册机：

405780
1
25
5
内存寄存器方式

注册表信息：

HKEY_LOCAL_MACHINE\Software\Paul Gerhart Software\ThumbsUp\User

yimotepDFCG
2003.5.11

给母亲大人的礼物