|
:0048FD13 FF15CCC14A00 Call dword ptr [004AC1CC]
:0048FD19 8D4C2464 lea ecx, dword ptr [esp+64]
:0048FD1D 51 push ecx
:0048FD1E 8D4C2414 lea ecx, dword ptr [esp+14]
* Reference To: MFC42.Ordinal:0219, Ord:0219h
|
:0048FD22 E8E1D50000 Call 0049D308
* Possible StringData Ref from Data Obj ->"\regmg.cfg"
|
:0048FD27 6800184C00 push 004C1800
:0048FD2C 8D542418 lea edx, dword ptr [esp+18]
:0048FD30 50 push eax
:0048FD31 52 push edx
:0048FD32 C68424A80301000B mov byte ptr [esp+000103A8], 0B
* Reference To: MFC42.Ordinal:039C, Ord:039Ch
|
:0048FD3A E899D50000 Call 0049D2D8
:0048FD3F 8B00 mov eax, dword ptr [eax]
:0048FD41 55 push ebp
:0048FD42 55 push ebp
:0048FD43 50 push eax
:0048FD44 8D4C2454 lea ecx, dword ptr [esp+54]
:0048FD48 C68424A80301000C mov byte ptr [esp+000103A8], 0C
* Reference To: MFC42.Ordinal:1442, Ord:1442h
|
:0048FD50 E89BD80000 Call 0049D5F0
:0048FD55 85C0 test eax, eax
:0048FD57 8D4C2414 lea ecx, dword ptr [esp+14]
:0048FD5B C684249C0301000B mov byte ptr [esp+0001039C], 0B
:0048FD63 0F94C3 sete bl
* Reference To: MFC42.Ordinal:0320, Ord:0320h
|
:0048FD66 E811D40000 Call 0049D17C
:0048FD6B 8D4C2410 lea ecx, dword ptr [esp+10]
:0048FD6F C684249C0301000A mov byte ptr [esp+0001039C], 0A
* Reference To: MFC42.Ordinal:0320, Ord:0320h
|
:0048FD77 E800D40000 Call 0049D17C
:0048FD7C 84DB test bl, bl
:0048FD7E 747A je 0048FDFA
:0048FD80 8D4C2420 lea ecx, dword ptr [esp+20]
* Reference To: MFC42.Ordinal:021C, Ord:021Ch
|
:0048FD84 E811D40000 Call 0049D19A
:0048FD89 B30D mov bl, 0D
:0048FD8B 8D4C2434 lea ecx, dword ptr [esp+34]
:0048FD8F 889C249C030100 mov byte ptr [esp+0001039C], bl
* Reference To: MFC42.Ordinal:021C, Ord:021Ch
|
:0048FD96 E8FFD30000 Call 0049D19A
* Possible Reference to String Resource ID=00664: "`勮尷K圅"1_O`舺桶 }錹?&嗾鑼?宼H,"
|
:0048FD9B 6898020000 push 00000298
:0048FDA0 8D4C2424 lea ecx, dword ptr [esp+24]
:0048FDA4 C68424A00301000E mov byte ptr [esp+000103A0], 0E
* Reference To: MFC42.Ordinal:1040, Ord:1040h
|
:0048FDAC E869D50000 Call 0049D31A
* Possible Reference to String Resource ID=00665: "q髃?003---鑼1%"
|
:0048FDB1 6899020000 push 00000299
:0048FDB6 8D4C2438 lea ecx, dword ptr [esp+38]
* Reference To: MFC42.Ordinal:1040, Ord:1040h
|
:0048FDBA E85BD50000 Call 0049D31A
:0048FDBF 8B442434 mov eax, dword ptr [esp+34]
:0048FDC3 8B4C2420 mov ecx, dword ptr [esp+20]
:0048FDC7 6A10 push 00000010
:0048FDC9 50 push eax
:0048FDCA 51 push ecx
:0048FDCB 8B4C2448 mov ecx, dword ptr [esp+48]
* Reference To: MFC42.Ordinal:1080, Ord:1080h
|
:0048FDCF E840D50000 Call 0049D314
:0048FDD4 8D4C2434 lea ecx, dword ptr [esp+34]
:0048FDD8 889C249C030100 mov byte ptr [esp+0001039C], bl
* Reference To: MFC42.Ordinal:0320, Ord:0320h
|
:0048FDDF E898D30000 Call 0049D17C
:0048FDE4 8D4C2420 lea ecx, dword ptr [esp+20]
:0048FDE8 C684249C0301000A mov byte ptr [esp+0001039C], 0A
* Reference To: MFC42.Ordinal:0320, Ord:0320h
|
:0048FDF0 E887D30000 Call 0049D17C
:0048FDF5 E9A3030000 jmp 0049019D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FD7E(C)
|
:0048FDFA 8D942468010000 lea edx, dword ptr [esp+00000168]
* Possible Reference to String Resource ID=00300: "寻v-"
|
:0048FE01 682C010000 push 0000012C
:0048FE06 52 push edx
:0048FE07 8D4C2450 lea ecx, dword ptr [esp+50]
* Reference To: MFC42.Ordinal:1542, Ord:1542h
|
:0048FE0B E80AD80000 Call 0049D61A
:0048FE10 8D4C2448 lea ecx, dword ptr [esp+48]
* Reference To: MFC42.Ordinal:07BB, Ord:07BBh
|
:0048FE14 E807D80000 Call 0049D620
:0048FE19 8D842468010000 lea eax, dword ptr [esp+00000168]
:0048FE20 8D4C2414 lea ecx, dword ptr [esp+14]
:0048FE24 50 push eax
* Reference To: MFC42.Ordinal:0219, Ord:0219h
|
:0048FE25 E8DED40000 Call 0049D308
:0048FE2A 8B30 mov esi, dword ptr [eax]
:0048FE2C 8B442440 mov eax, dword ptr [esp+40]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FE52(C)
|
:0048FE30 8A10 mov dl, byte ptr [eax]
eax=前面得到的44604与MG13500Ap99062-Wyu@LS689运算得到/%SQWRR#[[RTPO5".1TZ[的组合---1
:0048FE32 8A1E mov bl, byte ptr [esi]
（ esi=c:\windows\regmg.cfg文件你的内容即44604/%SQWRR#[[RTPO5".1TZ[ ）----2
在这里你可以看见三个的数字是不一样的！！
:0048FE34 8ACA mov cl, dl
比较－－1和－－－2的每一位 （全部相等就调到0048FE54)
:0048FE36 3AD3 cmp dl, bl
:0048FE38 751E jne 0048FE58
:0048FE3A 84C9 test cl, cl
:0048FE3C 7416 je 0048FE54
:0048FE3E 8A5001 mov dl, byte ptr [eax+01]
:0048FE41 8A5E01 mov bl, byte ptr [esi+01]
:0048FE44 8ACA mov cl, dl
:0048FE46 3AD3 cmp dl, bl
:0048FE48 750E jne 0048FE58
:0048FE4A 83C002 add eax, 00000002
:0048FE4D 83C602 add esi, 00000002
:0048FE50 84C9 test cl, cl
:0048FE52 75DC jne 0048FE30
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FE3C(C)
|
:0048FE54 33C0 xor eax, eax （调到这里，好了eax=0)
:0048FE56 EB05 jmp 0048FE5D
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0048FE38(C), :0048FE48(C)
|
:0048FE58 1BC0 sbb eax, eax
:0048FE5A 83D8FF sbb eax, FFFFFFFF
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FE56(U)
|
:0048FE5D 3BC5 cmp eax, ebp eax=ebp=0
:0048FE5F 8D4C2414 lea ecx, dword ptr [esp+14]
:0048FE63 0F94C3 sete bl (b1=1好东西）
* Reference To: MFC42.Ordinal:0320, Ord:0320h
|
:0048FE66 E811D30000 Call 0049D17C
:0048FE6B 84DB test bl, bl （b1=1哟，看看不跳了，注册ok)
:0048FE6D 0F8421030000 je 00490194
* Possible StringData Ref from Data Obj ->"软注支件持册"
|
:0048FE73 68E8174C00 push 004C17E8
:0048FE78 B9683B5000 mov ecx, 00503B68
* Reference To: MFC42.Ordinal:035C, Ord:035Ch
|
:0048FE7D E8B6D40000 Call 0049D338
:0048FE82 8D442464 lea eax, dword ptr [esp+64]
:0048FE86 8D4C2424 lea ecx, dword ptr [esp+24]
:0048FE8A 50 push eax
* Reference To: MFC42.Ordinal:0219, Ord:0219h
|
:0048FE8B E878D40000 Call 0049D308
* Possible StringData Ref from Data Obj ->"\regmg.cfg"
|
:0048FE90 6800184C00 push 004C1800
:0048FE95 8D4C2414 lea ecx, dword ptr [esp+14]
:0048FE99 B30F mov bl, 0F
:0048FE9B 50 push eax
:0048FE9C 51 push ecx
:0048FE9D 889C24A8030100 mov byte ptr [esp+000103A8], bl
注册完了后把c:\windows\regmg.cfg的内容改成04460 即把44604/%SQWRR#[[RTPO5".1TZ[取前面的四位，并在前面加0
在软件退出后在起动时会读c:\windows\regmg.cfg的内容是否是04460若不是你还是注册不成功！！