文件分割器的算法
-
软件介绍：一机一码性，注册成功后在注册表中写入标志。
下断点:HMEMCPY 按F12共12次来到下面。。。。。。。
:00483E54 8B45FC mov eax, dword ptr [ebp-04]----->机器码BN
:00483E57 8B15B8DE4800 mov edx, dword ptr [0048DEB8]--->输入的SN
:00483E5D E8C2000000 call 00483F24------------------->算法的关键CALL
:00483E62 84C0 test al, al--------------------->注册标志位AL=1时为注册
:00483E64 7429 je 00483E8F--------------------->跳就死
===========================================================================================
:00483F24 55 push ebp
:00483F25 8BEC mov ebp, esp
:00483F27 83C4F4 add esp, FFFFFFF4
:00483F2A 53 push ebx
:00483F2B 56 push esi
:00483F2C 57 push edi
:00483F2D 8955F8 mov dword ptr [ebp-08], edx
:00483F30 8945FC mov dword ptr [ebp-04], eax
:00483F33 8B45FC mov eax, dword ptr [ebp-04]
:00483F36 E8F5FFF7FF call 00403F30
:00483F3B 8B45F8 mov eax, dword ptr [ebp-08]
:00483F3E E8EDFFF7FF call 00403F30
:00483F43 33C0 xor eax, eax
:00483F45 55 push ebp
:00483F46 688C434800 push 0048438C
:00483F4B 64FF30 push dword ptr fs:[eax]
:00483F4E 648920 mov dword ptr fs:[eax], esp
:00483F51 33DB xor ebx, ebx
:00483F53 33F6 xor esi, esi
:00483F55 C645F700 mov [ebp-09], 00
:00483F59 8B45F8 mov eax, dword ptr [ebp-08]
:00483F5C E81BFEF7FF call 00403D7C
:00483F61 83F80E cmp eax, 0000000E
:00483F64 0F8507040000 jne 00484371
:00483F6A 8B45F8 mov eax, dword ptr [ebp-08]------------>EAX=BN
:00483F6D 0FB638 movzx edi, byte ptr [eax]-------------->EDI取BN的第1位，设为BN1
:00483F70 6683EF41 sub di, 0041--------------------------->EDI=EDI-0x41
:00483F74 8B45F8 mov eax, dword ptr [ebp-08]
:00483F77 8A5001 mov dl, byte ptr [eax+01]-------------->DL=BN2
:00483F7A 80FA39 cmp dl, 39----------------------------->DL与“9”比较
:00483F7D 7507 jne 00483F86--------------------------->不等则跳
:00483F7F B809000000 mov eax, 00000009
:00483F84 EB0A jmp 00483F90
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483F7D(C)
|
:00483F86 33C0 xor eax, eax-------------------------->EAX=0
:00483F88 8AC2 mov al, dl---------------------------->AL=DL
:00483F8A 83E841 sub eax, 00000041--------------------->EAX=EAX-0x41
:00483F8D 83C00A add eax, 0000000A--------------------->EAX=EAX+0xA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483F84(U)
|
:00483F90 80FA5A cmp dl, 5A---------------------------->将DL与0x5A
:00483F93 7501 jne 00483F96-------------------------->不等则跳
:00483F95 40 inc eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483F93(C)
|
:00483F96 8BD0 mov edx, eax-------------------------->EDX=EAX
:00483F98 83E201 and edx, 00000001--------------------->EDX=EDX AND 1
:00483F9B 4A dec edx------------------------------->EDX=EDX-1
:00483F9C 750E jne 00483FAC-------------------------->比较EDX是否为0,不为0则跳
:00483F9E 8B55F8 mov edx, dword ptr [ebp-08]----------->EDX=BN
:00483FA1 33DB xor ebx, ebx-------------------------->EBX=0
:00483FA3 8A5A02 mov bl, byte ptr [edx+02]------------->EBX=BN3
:00483FA6 6683EB30 sub bx, 0030-------------------------->EBX=EBX-0x30
:00483FAA EB36 jmp 00483FE2-------------------------->跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483F9C(C)
|
:00483FAC 8BD0 mov edx, eax-------------------------->EDX=EAX
:00483FAE 83E202 and edx, 00000002--------------------->EDX=EDX AND 2
:00483FB1 83FA02 cmp edx, 00000002--------------------->将EDX与2比较
:00483FB4 7512 jne 00483FC8-------------------------->不等就跳
:00483FB6 8B55F8 mov edx, dword ptr [ebp-08]----------->EDX=BN
:00483FB9 33DB xor ebx, ebx-------------------------->EBX=0
:00483FBB 8A5A02 mov bl, byte ptr [edx+02]------------->EBX=BN3
:00483FBE 6683EB41 sub bx, 0041-------------------------->EBX=EBX-0x41
:00483FC2 6683C30A add bx, 000A-------------------------->EBX=EBX+0xA
:00483FC6 EB1A jmp 00483FE2-------------------------->跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483FB4(C)
|
:00483FC8 8BD0 mov edx, eax-------------------------->EDX=EAX
:00483FCA 83E204 and edx, 00000004--------------------->EDX=EDX AND 4
:00483FCD 83FA04 cmp edx, 00000004--------------------->比较EDX和4
:00483FD0 7510 jne 00483FE2-------------------------->不等则跳
:00483FD2 8B55F8 mov edx, dword ptr [ebp-08]----------->EDX=BN
:00483FD5 33DB xor ebx, ebx-------------------------->EBX=0
:00483FD7 8A5A02 mov bl, byte ptr [edx+02]------------->EBX=BN3
:00483FDA 6683EB41 sub bx, 0041-------------------------->EBX=EBX-0x41
:00483FDE 6683C324 add bx, 0024-------------------------->EBX=EBX+0x24
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483FAA(U), :00483FC6(U), :00483FD0(C)
|
:00483FE2 8BD0 mov edx, eax-------------------------->EDX=EAX
:00483FE4 83E208 and edx, 00000008--------------------->EDX=EDX AND 8
:00483FE7 83FA08 cmp edx, 00000008--------------------->比较EDX 与 8
:00483FEA 750D jne 00483FF9-------------------------->不等则跳
:00483FEC 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN
:00483FEF 0FB67003 movzx esi, byte ptr [eax+03]---------->ESI=BN4
:00483FF3 6683EE30 sub si, 0030-------------------------->ESI=ESI-0x30
:00483FF7 EB32 jmp 0048402B-------------------------->跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00483FEA(C)
|
:00483FF9 8BD0 mov edx, eax-------------------------->EDX=EAX
:00483FFB 83E210 and edx, 00000010--------------------->EDX=EDX AND 10
:00483FFE 83FA10 cmp edx, 00000010--------------------->比较EDX 与 10
:00484001 7511 jne 00484014-------------------------->不等则跳
:00484003 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN
:00484006 0FB67003 movzx esi, byte ptr [eax+03]---------->ESI=BN4
:0048400A 6683EE41 sub si, 0041-------------------------->ESI=ESI-0x41
:0048400E 6683C60A add si, 000A-------------------------->ESI=ESI-0xA
:00484012 EB17 jmp 0048402B-------------------------->跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484001(C)
|
:00484014 83E020 and eax, 00000020--------------------->EDX=EAX
:00484017 83F820 cmp eax, 00000020--------------------->比较EDX 与 20
:0048401A 750F jne 0048402B-------------------------->不等则跳
:0048401C 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN
:0048401F 0FB67003 movzx esi, byte ptr [eax+03]---------->ESI=BN4
:00484023 6683EE41 sub si, 0041-------------------------->ESI=ESI-0x41
:00484027 6683C624 add si, 0024-------------------------->ESI=ESI+0x24
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483FF7(U), :00484012(U), :0048401A(C)
|
:0048402B 0FB7C7 movzx eax, di------------------------->EAX=EDI
:0048402E 83C030 add eax, 00000030--------------------->EAX=EAX+0x30
:00484031 E8C6FEFFFF call 00483EFC------------------------->根据EAX的值进行计算
:00484036 8B55FC mov edx, dword ptr [ebp-04]----------->EDX=SN
:00484039 3A02 cmp al, byte ptr [edx]---------------->比较SN1和计算后的EAX
:0048403B 0F8530030000 jne 00484371-------------------------->不等则跳，跳则死
:00484041 0FB7C3 movzx eax, bx------------------------->EAX=EBX
:00484044 83C030 add eax, 00000030--------------------->EAX=EAX+0x30
:00484047 E8B0FEFFFF call 00483EFC------------------------->根据EAX的值进行计算
:0048404C 8B55FC mov edx, dword ptr [ebp-04]----------->
:0048404F 3A4201 cmp al, byte ptr [edx+01]------------->比较SN2和计算后的EAX
:00484052 0F8519030000 jne 00484371-------------------------->不等则跳，跳则死
:00484058 0FB7C6 movzx eax, si------------------------->EAX=ESI
:0048405B 83C030 add eax, 00000030--------------------->EAX=EAX+0x30
:0048405E E899FEFFFF call 00483EFC------------------------->根据EAX的值进行计算
:00484063 8B55FC mov edx, dword ptr [ebp-04]----------->
:00484066 3A4202 cmp al, byte ptr [edx+02]------------->比较SN3和计算后的EAX
:00484069 0F8502030000 jne 00484371-------------------------->不等则跳，跳则死
:0048406F 0FB7C7 movzx eax, di------------------------->EAX=EDI
:00484072 83C030 add eax, 00000030--------------------->EAX=EAX+0x30
:00484075 83C006 add eax, 00000006--------------------->EAX=EAX+0x6
:00484078 E87FFEFFFF call 00483EFC------------------------->根据EAX的值进行计算
:0048407D 8B55FC mov edx, dword ptr [ebp-04]----------->
:00484080 3A4203 cmp al, byte ptr [edx+03]------------->比较SN4和计算后的EAX
:00484083 0F85E8020000 jne 00484371-------------------------->不等则跳，跳则死
:00484089 0FB7C3 movzx eax, bx------------------------->EAX=EBX
:0048408C 83C030 add eax, 00000030--------------------->EAX=EAX+0x30
:0048408F 83C002 add eax, 00000002--------------------->EAX=EAX+0x2
:00484092 E865FEFFFF call 00483EFC------------------------->根据EAX的值进行计算
:00484097 8B55FC mov edx, dword ptr [ebp-04]----------->
:0048409A 3A4204 cmp al, byte ptr [edx+04]------------->比较SN5和计算后的EAX
:0048409D 0F85CE020000 jne 00484371-------------------------->不等则跳，跳则死
:004840A3 0FB7C6 movzx eax, si------------------------->EAX=ESI
:004840A6 83C030 add eax, 00000030--------------------->EAX=EAX+0x30
:004840A9 40 inc eax------------------------------->EAX=EAX+1
:004840AA E84DFEFFFF call 00483EFC------------------------->根据EAX的值进行计算
:004840AF 8B55FC mov edx, dword ptr [ebp-04]----------->
:004840B2 3A4205 cmp al, byte ptr [edx+05]------------->比较SN6和计算后的EAX
:004840B5 0F85B6020000 jne 00484371-------------------------->不等则跳，跳则死
以上为根据BN的1～4位计算得SN的前1～6位
:004840BB 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN
:004840BE 8078042D cmp byte ptr [eax+04], 2D------------->比较BN5是不是2D("-")
:004840C2 0F85A9020000 jne 00484371-------------------------->不等则跳，跳则死
:004840C8 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN
:004840CB 0FB67805 movzx edi, byte ptr [eax+05]---------->EDI=BN6
:004840CF 6683EF41 sub di, 0041-------------------------->EDI=EDI-0x41
:004840D3 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN
:004840D6 8A4006 mov al, byte ptr [eax+06]------------->AL=BN7
:004840D9 3C39 cmp al, 39---------------------------->将AL与0x39进行比较
:004840DB 7507 jne 004840E4-------------------------->不等则跳
:004840DD B809000000 mov eax, 00000009
:004840E2 EB0B jmp 004840EF
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004840DB(C)
|
:004840E4 25FF000000 and eax, 000000FF--------------------->EAX=EAX AND 0xFF
:004840E9 83E841 sub eax, 00000041--------------------->EAX=EAX-0x41
:004840EC 83C00A add eax, 0000000A--------------------->EAX=EAX+0xA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004840E2(U)
|
:004840EF 8B55F8 mov edx, dword ptr [ebp-08]----------->EDX=BN
:004840F2 807A015A cmp byte ptr [edx+01], 5A------------->将SN2与0x5A进行比较
:004840F6 7501 jne 004840F9-------------------------->不等则跳
:004840F8 40 inc eax------------------------------->EAX=EAX+1
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004840F6(C)
|
:004840F9 8BD0 mov edx, eax------------------------->EDX=EAX
:004840FB 83E201 and edx, 00000001-------------------->EDX=EDX AND 1
:004840FE 4A dec edx------------------------------>EDX=EDX-1
:004840FF 750E jne 0048410F------------------------->不等0则跳
:00484101 8B55F8 mov edx, dword ptr [ebp-08]---------->EDX=BN
:00484104 33DB xor ebx, ebx------------------------->EBX=0
:00484106 8A5A07 mov bl, byte ptr [edx+07]------------>EBX=BN8
:00484109 6683EB30 sub bx, 0030------------------------->EBX=EBX-0x30
:0048410D EB36 jmp 00484145------------------------->跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004840FF(C)
|
:0048410F 8BD0 mov edx, eax------------------------->EDX=EAX
:00484111 83E202 and edx, 00000002-------------------->EDX=EDX AND 2
:00484114 83FA02 cmp edx, 00000002-------------------->比较EDX和2
:00484117 7512 jne 0048412B------------------------->不等则跳
:00484119 8B55F8 mov edx, dword ptr [ebp-08]---------->EDX=BN
:0048411C 33DB xor ebx, ebx------------------------->EBX=0
:0048411E 8A5A07 mov bl, byte ptr [edx+07]------------>EBX=BN8
:00484121 6683EB41 sub bx, 0041------------------------->EBX=EBX-0x41
:00484125 6683C30A add bx, 000A------------------------->EBX=EBX+0xA
:00484129 EB1A jmp 00484145------------------------->跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484117(C)
|
:0048412B 8BD0 mov edx, eax------------------------->EDX=EAX
:0048412D 83E204 and edx, 00000004-------------------->EDX=EDX AND 4
:00484130 83FA04 cmp edx, 00000004-------------------->比较EDX和4
:00484133 7510 jne 00484145------------------------->不等则跳
:00484135 8B55F8 mov edx, dword ptr [ebp-08]---------->EDX=BN
:00484138 33DB xor ebx, ebx------------------------->EBX=0
:0048413A 8A5A07 mov bl, byte ptr [edx+07]------------>EBX=BN8
:0048413D 6683EB41 sub bx, 0041------------------------->EBX=EBX-0x41
:00484141 6683C324 add bx, 0024------------------------->EBX=EBX+0x24
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048410D(U), :00484129(U), :00484133(C)
|
:00484145 8BD0 mov edx, eax------------------------->EDX=EAX
:00484147 83E208 and edx, 00000008-------------------->EDX=EDX AND 8
:0048414A 83FA08 cmp edx, 00000008-------------------->比较EDX和8
:0048414D 750D jne 0048415C------------------------->不等则跳
:0048414F 8B45F8 mov eax, dword ptr [ebp-08]---------->EAX=BN
:00484152 0FB67008 movzx esi, byte ptr [eax+08]--------->ESI=BN9
:00484156 6683EE30 sub si, 0030------------------------->ESI=ESI-0x30
:0048415A EB32 jmp 0048418E------------------------->跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048414D(C)
|
:0048415C 8BD0 mov edx, eax------------------------->EDX=EAX
:0048415E 83E210 and edx, 00000010-------------------->EDX=EDX AND 10
:00484161 83FA10 cmp edx, 00000010-------------------->比较EDX和10
:00484164 7511 jne 00484177------------------------->不等则跳
:00484166 8B45F8 mov eax, dword ptr [ebp-08]---------->EAX=BN
:00484169 0FB67008 movzx esi, byte ptr [eax+08]--------->ESI=BN9
:0048416D 6683EE41 sub si, 0041------------------------->ESI=ESI-0x41
:00484171 6683C60A add si, 000A------------------------->ESI=ESI+0xA
:00484175 EB17 jmp 0048418E------------------------->跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484164(C)
|
:00484177 83E020 and eax, 00000020-------------------->EAX=EAX AND 20
:0048417A 83F820 cmp eax, 00000020-------------------->比较EDX和20
:0048417D 750F jne 0048418E------------------------->不等则跳
:0048417F 8B45F8 mov eax, dword ptr [ebp-08]---------->EAX=BN
:00484182 0FB67008 movzx esi, byte ptr [eax+08]--------->ESI=BN9
:00484186 6683EE41 sub si, 0041------------------------->ESI=ESI-0x41
:0048418A 6683C624 add si, 0024------------------------->ESI=ESI+0x24
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048415A(U), :00484175(U), :0048417D(C)
|
:0048418E 0FB7C7 movzx eax, di----------------------->EAX=EDI
:00484191 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:00484194 E863FDFFFF call 00483EFC----------------------->根据EAX的值进行计算
:00484199 8B55FC mov edx, dword ptr [ebp-04]--------->EDX=SN
:0048419C 3A4207 cmp al, byte ptr [edx+07]----------->比较EAX和SN8
:0048419F 0F85CC010000 jne 00484371------------------------>不等则跳，跳则死
:004841A5 0FB7C3 movzx eax, bx----------------------->EAX=EBX
:004841A8 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:004841AB E84CFDFFFF call 00483EFC----------------------->根据EAX的值进行计算
:004841B0 8B55FC mov edx, dword ptr [ebp-04]--------->
:004841B3 3A4208 cmp al, byte ptr [edx+08]----------->比较EAX和SN9
:004841B6 0F85B5010000 jne 00484371------------------------>不等则跳，跳则死
:004841BC 0FB7C6 movzx eax, si----------------------->EAX=ESI
:004841BF 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:004841C2 E835FDFFFF call 00483EFC----------------------->根据EAX的值进行计算
:004841C7 8B55FC mov edx, dword ptr [ebp-04]--------->
:004841CA 3A4209 cmp al, byte ptr [edx+09]----------->比较EAX和SN10
:004841CD 0F859E010000 jne 00484371------------------------>不等则跳，跳则死
:004841D3 0FB7C7 movzx eax, di----------------------->EAX=EDI
:004841D6 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:004841D9 83C008 add eax, 00000008------------------->EAX=EAX+0x8
:004841DC E81BFDFFFF call 00483EFC----------------------->根据EAX的值进行计算
:004841E1 8B55FC mov edx, dword ptr [ebp-04]--------->
:004841E4 3A420A cmp al, byte ptr [edx+0A]----------->比较EAX和SN11
:004841E7 0F8584010000 jne 00484371------------------------>不等则跳，跳则死
:004841ED 0FB7C3 movzx eax, bx----------------------->EAX=EBX
:004841F0 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:004841F3 40 inc eax----------------------------->EAX=EAX+1
:004841F4 E803FDFFFF call 00483EFC----------------------->根据EAX的值进行计算
:004841F9 8B55FC mov edx, dword ptr [ebp-04]--------->
:004841FC 3A420B cmp al, byte ptr [edx+0B]----------->比较EAX和SN12
:004841FF 0F856C010000 jne 00484371------------------------>不等则跳，跳则死
:00484205 0FB7C6 movzx eax, si----------------------->EAX=ESI
:00484208 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:0048420B 83C002 add eax, 00000002------------------->EAX=EAX+0x2
:0048420E E8E9FCFFFF call 00483EFC----------------------->根据EAX的值进行计算
:00484213 8B55FC mov edx, dword ptr [ebp-04]--------->
:00484216 3A420C cmp al, byte ptr [edx+0C]----------->比较EAX和SN13
:00484219 0F8552010000 jne 00484371------------------------>不等则跳，跳则死
以上为根据BN的6～9位计算得SN的8～13位
:0048421F 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN
:00484222 8078092D cmp byte ptr [eax+09], 2D----------->比较BN10是不是2D("-")
:00484226 0F8545010000 jne 00484371------------------------>不等则跳，跳则死
:0048422C 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN
:0048422F 0FB6780A movzx edi, byte ptr [eax+0A]-------->EDI=BN11
:00484233 6683EF41 sub di, 0041------------------------>EDI=EDI-0x41
:00484237 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN
:0048423A 8A400B mov al, byte ptr [eax+0B]----------->AL=BN12
:0048423D 3C39 cmp al, 39-------------------------->比较AL是否等于0x39
:0048423F 7507 jne 00484248------------------------>不等则跳
:00484241 B809000000 mov eax, 00000009------------------->EAX=9
:00484246 EB0B jmp 00484253------------------------>跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048423F(C)
|
:00484248 25FF000000 and eax, 000000FF------------------->EAX=EAX AND FF
:0048424D 83E841 sub eax, 00000041------------------->EAX=EAX-0x41
:00484250 83C00A add eax, 0000000A------------------->EAX=EAX+0xA
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484246(U)
|
:00484253 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN
:00484256 807A015A cmp byte ptr [edx+01], 5A----------->比较BN2是否等于0x5A
:0048425A 7501 jne 0048425D------------------------>不等则跳
:0048425C 40 inc eax----------------------------->EAX=EAX+1
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048425A(C)
|
:0048425D 8BD0 mov edx, eax------------------------>EDX=EAX
:0048425F 83E201 and edx, 00000001------------------->EDX=EDX AND 1
:00484262 4A dec edx----------------------------->EDX=EDX-1
:00484263 750E jne 00484273------------------------>EDX不为0就跳
:00484265 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN
:00484268 33DB xor ebx, ebx------------------------>EBX=0
:0048426A 8A5A0C mov bl, byte ptr [edx+0C]----------->EBX=BN13
:0048426D 6683EB30 sub bx, 0030------------------------>EBX=EBX-0x30
:00484271 EB36 jmp 004842A9------------------------>跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484263(C)
|
:00484273 8BD0 mov edx, eax------------------------>EDX=EAX
:00484275 83E202 and edx, 00000002------------------->EDX=EDX AND 2
:00484278 83FA02 cmp edx, 00000002------------------->比较EDX和2
:0048427B 7512 jne 0048428F------------------------>不等则跳
:0048427D 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN
:00484280 33DB xor ebx, ebx------------------------>EBX=0
:00484282 8A5A0C mov bl, byte ptr [edx+0C]----------->EBX=BN13
:00484285 6683EB41 sub bx, 0041------------------------>EBX=EBX-0x41
:00484289 6683C30A add bx, 000A------------------------>EBX=EBX+0xA
:0048428D EB1A jmp 004842A9------------------------>跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048427B(C)
|
:0048428F 8BD0 mov edx, eax------------------------>EDX=EAX
:00484291 83E204 and edx, 00000004------------------->EDX=EDX AND 4
:00484294 83FA04 cmp edx, 00000004------------------->比较EDX和4
:00484297 7510 jne 004842A9------------------------>不等则跳
:00484299 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN
:0048429C 33DB xor ebx, ebx------------------------>EBX=0
:0048429E 8A5A0C mov bl, byte ptr [edx+0C]----------->EBX=BN13
:004842A1 6683EB41 sub bx, 0041------------------------>EBX=EBX-0x41
:004842A5 6683C324 add bx, 0024------------------------>EBX=EBX+0x24
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484271(U), :0048428D(U), :00484297(C)
|
:004842A9 8BD0 mov edx, eax------------------------>EDX=EAX
:004842AB 83E208 and edx, 00000008------------------->EDX=EDX AND 8
:004842AE 83FA08 cmp edx, 00000008------------------->比较EDX和8
:004842B1 750D jne 004842C0------------------------>不等则跳
:004842B3 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN
:004842B6 0FB6700D movzx esi, byte ptr [eax+0D]-------->ESI=BN14
:004842BA 6683EE30 sub si, 0030------------------------>ESI=ESI-0x30
:004842BE EB32 jmp 004842F2------------------------>跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004842B1(C)
|
:004842C0 8BD0 mov edx, eax------------------------>EDX=EAX
:004842C2 83E210 and edx, 00000010------------------->EDX=EDX AND 10
:004842C5 83FA10 cmp edx, 00000010------------------->比较EDX和10
:004842C8 7511 jne 004842DB------------------------>不等则跳
:004842CA 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN
:004842CD 0FB6700D movzx esi, byte ptr [eax+0D]-------->ESI=BN14
:004842D1 6683EE41 sub si, 0041------------------------>ESI=ESI-0x41
:004842D5 6683C60A add si, 000A------------------------>ESI=ESI+0xA
:004842D9 EB17 jmp 004842F2------------------------>跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004842C8(C)
|
:004842DB 83E020 and eax, 00000020------------------->EAX=EAX AND 20
:004842DE 83F820 cmp eax, 00000020------------------->比较EAX和20
:004842E1 750F jne 004842F2------------------------>不等则跳
:004842E3 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN
:004842E6 0FB6700D movzx esi, byte ptr [eax+0D]-------->ESI=BN14
:004842EA 6683EE41 sub si, 0041------------------------>ESI=ESI-0x41
:004842EE 6683C624 add si, 0024------------------------>ESI=ESI+0x24
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004842BE(U), :004842D9(U), :004842E1(C)
|
:004842F2 0FB7C7 movzx eax, di----------------------->EAX=EDI
:004842F5 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:004842F8 E8FFFBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:004842FD 8B55FC mov edx, dword ptr [ebp-04]--------->EDX=SN
:00484300 3A420E cmp al, byte ptr [edx+0E]----------->比较EAX和SN15
:00484303 756C jne 00484371------------------------>不等则跳，跳则死
:00484305 0FB7C3 movzx eax, bx----------------------->EAX=EBX
:00484308 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:0048430B E8ECFBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:00484310 8B55FC mov edx, dword ptr [ebp-04]--------->
:00484313 3A420F cmp al, byte ptr [edx+0F]----------->比较EAX和SN16
:00484316 7559 jne 00484371------------------------>不等则跳，跳则死
:00484318 0FB7C6 movzx eax, si----------------------->EAX=ESI
:0048431B 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:0048431E E8D9FBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:00484323 8B55FC mov edx, dword ptr [ebp-04]--------->
:00484326 3A4210 cmp al, byte ptr [edx+10]----------->比较EAX和SN17
:00484329 7546 jne 00484371------------------------>不等则跳，跳则死
:0048432B 0FB7C7 movzx eax, di----------------------->EAX=EDI
:0048432E 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:00484331 83C00D add eax, 0000000D------------------->EAX=EAX+0xD
:00484334 E8C3FBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:00484339 8B55FC mov edx, dword ptr [ebp-04]--------->
:0048433C 3A4211 cmp al, byte ptr [edx+11]----------->比较EAX和SN18
:0048433F 7530 jne 00484371------------------------>不等则跳，跳则死
:00484341 0FB7C3 movzx eax, bx----------------------->EAX=EBX
:00484344 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:00484347 83C002 add eax, 00000002------------------->EAX=EAX+0x2
:0048434A E8ADFBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:0048434F 8B55FC mov edx, dword ptr [ebp-04]--------->
:00484352 3A4212 cmp al, byte ptr [edx+12]----------->比较EAX和SN19
:00484355 751A jne 00484371------------------------>不等则跳，跳则死
:00484357 0FB7C6 movzx eax, si----------------------->EAX=ESI
:0048435A 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:0048435D 83C002 add eax, 00000002------------------->EAX=EAX+0x2
:00484360 E897FBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:00484365 8B55FC mov edx, dword ptr [ebp-04]--------->
:00484368 3A4213 cmp al, byte ptr [edx+13]----------->比较EAX和SN20
:0048436B 7504 jne 00484371------------------------>不等则跳，跳则死
:0048436D C645F701 mov [ebp-09], 01-------------------->注册成功的标志位，到这里就成功了！！^_^
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483F64(C), :0048403B(C), :00484052(C), :00484069(C), :00484083(C)
|:0048409D(C), :004840B5(C), :004840C2(C), :0048419F(C), :004841B6(C)
|:004841CD(C), :004841E7(C), :004841FF(C), :00484219(C), :00484226(C)
|:00484303(C), :00484316(C), :00484329(C), :0048433F(C), :00484355(C)
|:0048436B(C)
|
:00484371 33C0 xor eax, eax
:00484373 5A pop edx
:00484374 59 pop ecx
:00484375 59 pop ecx
:00484376 648910 mov dword ptr fs:[eax], edx
:00484379 6893434800 push 00484393
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484391(U)
|
:0048437E 8D45F8 lea eax, dword ptr [ebp-08]
:00484381 BA02000000 mov edx, 00000002
:00484386 E895F7F7FF call 00403B20
:0048438B C3 ret
===========================================================================================
以下为根据EAX的值进行计算CALL的具体算法
:00483EFC 8BD0 mov edx, eax-------------->EDX=EAX
:00483EFE 3C3A cmp al, 3A---------------->将EAX与0x3A进行比较
:00483F00 720E jb 00483F10--------------->小于则跳
:00483F02 3C40
相关视频
相关阅读 Windows错误代码大全 Windows错误代码查询激活windows有什么用Mac QQ和Windows QQ聊天记录怎么合并 Mac QQ和Windows QQ聊天记录Windows 10自动更新怎么关闭 如何关闭Windows 10自动更新windows 10 rs4快速预览版17017下载错误问题Win10秋季创意者更新16291更新了什么 win10 16291更新内容windows10秋季创意者更新时间 windows10秋季创意者更新内容kb3150513补丁更新了什么 Windows 10补丁kb3150513是什么
- 文章评论
-
热门文章
去除winrar注册框方法
最新文章
比特币病毒怎么破解 比去除winrar注册框方法
华为无线路由器HG522-C破解教程(附超级密码JEB格式文件京东电子书下载和阅读限制破解教UltraISO注册码全集(最新)通过Access破解MSSQL获得数据
人气排行 华为无线路由器HG522-C破解教程(附超级密码JEB格式文件京东电子书下载和阅读限制破解教UltraISO注册码全集(最新)qq相册密码破解方法去除winrar注册框方法(适应任何版本)怎么用手机破解收费游戏华为无线猫HG522破解如何给软件脱壳基础教程
查看所有0条评论>>