说明：
此软件的算法不难，就是在注册上有一些新的花样，若有注册成功的，请不要向外传播！！！
安装好软件后，你打开c:\windows\regmg.cfg 可看见：44604/%SQWRR#[[RTPO5".1TZ[
将/%SQWRR#[[RTPO5".1TZ[的每一位xor 62 得到MG13500Ap99062-Wyu@LS689
注意第一个的ASCI=12 第二个的ASCI=1B 第三个的ASCI=17
44604是 MG13500Ap99062-Wyu@LS689经过运算后得到的十进制数字
分析如下：
:0048FA8C 8D4C2418 lea ecx, dword ptr [esp+18] ecx=2448
:0048FA90 51 push ecx
:0048FA91 8D8E10060000 lea ecx, dword ptr [esi+00000610]
* Reference To: MFC42.Ordinal:0F22, Ord:0F22h
|
:0048FA97 E8F8D60000 Call 0049D194
:0048FA9C 8B542418 mov edx, dword ptr [esp+18] edx=2448MG13500Ap99062-Wyu@LS689
:0048FAA0 8B4C241C mov ecx, dword ptr [esp+1C] ecx=2448
:0048FAA4 8B42F8 mov eax, dword ptr [edx-08] eax=1C (注册码长度）
:0048FAA7 8B51F8 mov edx, dword ptr [ecx-08] EDX=4 （姓名长度）
:0048FAAA 3BC2 cmp eax, edx
:0048FAAC 7F0C jg 0048FABA
一定要跳转呀（注册码长度一定要大于姓名的长度）
:0048FAAE 8BCE mov ecx, esi
* Reference To: MFC42.Ordinal:12F5, Ord:12F5h
|
:0048FAB0 E859D80000 Call 0049D30E
:0048FAB5 E949070000 jmp 00490203
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FAAC(C)
|
:0048FABA 8D4C2428 lea ecx, dword ptr [esp+28] （跳转到这里）
* Reference To: MFC42.Ordinal:021C, Ord:021Ch
|
:0048FABE E8D7D60000 Call 0049D19A
:0048FAC3 8D542418 lea edx, dword ptr [esp+18]
:0048FAC7 8D4C2428 lea ecx, dword ptr [esp+28]
:0048FACB 52 push edx
:0048FACC C68424A003010002 mov byte ptr [esp+000103A0], 02
* Reference To: MFC42.Ordinal:035A, Ord:035Ah
|
:0048FAD4 E811D80000 Call 0049D2EA
:0048FAD9 8B442418 mov eax, dword ptr [esp+18]
eax=2448MG13500Ap99062-Wyu@LS689
:0048FADD 8B4C241C mov ecx, dword ptr [esp+1C] ecx=2448
:0048FAE1 8D542414 lea edx, dword ptr [esp+14]
:0048FAE5 8B40F8 mov eax, dword ptr [eax-08] eax=1c
:0048FAE8 8B59F8 mov ebx, dword ptr [ecx-08] ebx=4
:0048FAEB 2BC3 sub eax, ebx eax=18
:0048FAED 8D4C2418 lea ecx, dword ptr [esp+18]
:0048FAF1 50 push eax
:0048FAF2 52 push edx
* Reference To: MFC42.Ordinal:164E, Ord:164Eh
|
:0048FAF3 E85ED80000 Call 0049D356
:0048FAF8 50 push eax
:0048FAF9 8D4C241C lea ecx, dword ptr [esp+1C]
:0048FAFD C68424A003010003 mov byte ptr [esp+000103A0], 03
* Reference To: MFC42.Ordinal:035A, Ord:035Ah
|
:0048FB05 E8E0D70000 Call 0049D2EA
:0048FB0A 8D4C2414 lea ecx, dword ptr [esp+14]
:0048FB0E C684249C03010002 mov byte ptr [esp+0001039C], 02
* Reference To: MFC42.Ordinal:0320, Ord:0320h
|
:0048FB16 E861D60000 Call 0049D17C
:0048FB1B 8B44241C mov eax, dword ptr [esp+1C]
:0048FB1F 8D4C2410 lea ecx, dword ptr [esp+10]
:0048FB23 8B40F8 mov eax, dword ptr [eax-08] eax=4
:0048FB26 50 push eax
:0048FB27 51 push ecx
:0048FB28 8D4C2430 lea ecx, dword ptr [esp+30]
* Reference To: MFC42.Ordinal:1021, Ord:1021h
|
:0048FB2C E8BFD70000 Call 0049D2F0
:0048FB31 8D54241C lea edx, dword ptr [esp+1C]
:0048FB35 C684249C03010004 mov byte ptr [esp+0001039C], 04
:0048FB3D 52 push edx
:0048FB3E 50 push eax
:0048FB3F 8D44241C lea eax, dword ptr [esp+1C]
:0048FB43 50 push eax
* Reference To: MFC42.Ordinal:039A, Ord:039Ah
|
:0048FB44 E89BDA0000 Call 0049D5E4
:0048FB49 50 push eax
:0048FB4A 8D4C242C lea ecx, dword ptr [esp+2C]
:0048FB4E C68424A003010005 mov byte ptr [esp+000103A0], 05
* Reference To: MFC42.Ordinal:035A, Ord:035Ah
|
:0048FB56 E88FD70000 Call 0049D2EA
:0048FB5B 8D4C2414 lea ecx, dword ptr [esp+14]
:0048FB5F C684249C03010004 mov byte ptr [esp+0001039C], 04
* Reference To: MFC42.Ordinal:0320, Ord:0320h
|
:0048FB67 E810D60000 Call 0049D17C
:0048FB6C 8D4C2410 lea ecx, dword ptr [esp+10]
:0048FB70 C684249C03010002 mov byte ptr [esp+0001039C], 02
* Reference To: MFC42.Ordinal:0320, Ord:0320h
|
:0048FB78 E8FFD50000 Call 0049D17C
:0048FB7D 8B4C2418 mov ecx, dword ptr [esp+18]
ecx=2448MG13500Ap99062-Wyu@LS689
:0048FB81 8D942494030000 lea edx, dword ptr [esp+00000394]
:0048FB88 51 push ecx
* Possible StringData Ref from Data Obj ->"%s"
|
:0048FB89 6808044C00 push 004C0408 004C0408 =%s
:0048FB8E 52 push edx
* Reference To: MSVCRT.sprintf, Ord:02B2h
|
:0048FB8F FF1574C84A00 Call dword ptr [004AC874]
:0048FB95 8A8424A0030000 mov al, byte ptr [esp+000003A0]
:0048FB9C 83C40C add esp, 0000000C
:0048FB9F 33D2 xor edx, edx
:0048FBA1 84C0 test al, al
:0048FBA3 89542414 mov dword ptr [esp+14], edx
:0048FBA7 7418 je 0048FBC1
:0048FBA9 8D8C2494030000 lea ecx, dword ptr [esp+00000394]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FBBB(C)
|
:0048FBB0 0FBEC0 movsx eax, al
:0048FBB3 03D0 add edx, eax edx初始数字为0 edx=640
:0048FBB5 8A4101 mov al, byte ptr [ecx+01] （取MG13500Ap99062-Wyu@LS689的 每一位）
:0048FBB8 41 inc ecx
:0048FBB9 84C0 test al, al
:0048FBBB 75F3 jne 0048FBB0 (取位完了确认）
:0048FBBD 89542414 mov dword ptr [esp+14], edx edx=640 [esp+14]=640
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FBA7(C)
|
:0048FBC1 8B4C2418 mov ecx, dword ptr [esp+18] ecx=MG13500Ap99062-Wyu@LS689
:0048FBC5 33FF xor edi, edi edi=0
:0048FBC7 8B41F8 mov eax, dword ptr [ecx-08]
eax=18 (MG13500Ap99062-Wyu@LS689的长度）
:0048FBCA 99 cdq edx=0
:0048FBCB 2BC2 sub eax, edx eax=18
:0048FBCD D1F8 sar eax, 1 右移动一位 eax=c
:0048FBCF 8A1C08 mov bl, byte ptr [eax+ecx] 取ecx的第c位即 bl=(6)36
:0048FBD2 33C0 xor eax, eax eax=0
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FBEC(C)
|
:0048FBD4 8A8C0494030000 mov cl, byte ptr [esp+eax+00000394]
（ 对MG13500Ap99062-Wyu@LS689进行选择取）位
:0048FBDB 84C9 test cl, cl cl=M(4D)
:0048FBDD 740F je 0048FBEE (取位完了就跳转）
:0048FBDF 0FBEC9 movsx ecx, cl
:0048FBE2 83C002 add eax, 00000002 eax=eax+2 (即取位的原则是第0位，第二 位，第四位－－－－）
:0048FBE5 03F9 add edi, ecx edi=333
:0048FBE7 3DFFFF0000 cmp eax, 0000FFFF
:0048FBEC 7CE6 jl 0048FBD4 eax<ffff 继续循环
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FBDD(C)
|
:0048FBEE D9ED fldln2 (沸点运行）
:0048FBF0 DB442414 fild dword ptr [esp+14] [esp+14]=640
:0048FBF4 D9F1 fyl2x
* Reference To: MSVCRT._ftol, Ord:00F1h
|
:0048FBF6 E8C5DE0000 Call 0049DAC0 eax=7
:0048FBFB 8BF0 mov esi, eax esi=7
:0048FBFD 8D4C2430 lea ecx, dword ptr [esp+30]
:0048FC01 0FBED3 movsx edx, bl bl=(6)36(看上面）edx=36
:0048FC04 03F7 add esi, edi
:0048FC06 0FAFF2 imul esi, edx esi=ae3c
* Reference To: MFC42.Ordinal:021C, Ord:021Ch
|
:0048FC09 E88CD50000 Call 0049D19A
:0048FC0E 56 push esi
:0048FC0F 8D442434 lea eax, dword ptr [esp+34]
* Possible StringData Ref from Data Obj ->"%ld"
|
:0048FC13 681C184C00 push 004C181C
:0048FC18 50 push eax
:0048FC19 C68424A803010006 mov byte ptr [esp+000103A8], 06
* Reference To: MFC42.Ordinal:0B02, Ord:0B02h
|
:0048FC21 E83AD60000 Call 0049D260 将esi=ae3c转换撑十进制＝44604
:0048FC26 83C40C add esp, 0000000C
:0048FC29 8D4C2418 lea ecx, dword ptr [esp+18]
:0048FC2D 51 push ecx
:0048FC2E 8D4C2430 lea ecx, dword ptr [esp+30]
* Reference To: MFC42.Ordinal:0217, Ord:0217h
|
:0048FC32 E8A7D60000 Call 0049D2DE
:0048FC37 8B44242C mov eax, dword ptr [esp+2C]
:0048FC3B 33F6 xor esi, esi
:0048FC3D C684249C03010007 mov byte ptr [esp+0001039C], 07
:0048FC45 3968F8 cmp dword ptr [eax-08], ebp
:0048FC48 7E1A jle 0048FC64
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FC62(C)
|
:0048FC4A 8A0430 mov al, byte ptr [eax+esi]
取MG13500Ap99062-Wyu@LS689的每一位
:0048FC4D 8D4C242C lea ecx, dword ptr [esp+2C]
:0048FC51 3462 xor al, 62 每一位xor 62
:0048FC53 50 push eax
:0048FC54 56 push esi
* Reference To: MFC42.Ordinal:16E0, Ord:16E0h
|
:0048FC55 E8BAD90000 Call 0049D614 将每一位xor 62得到的结果转换成字符
:0048FC5A 8B44242C mov eax, dword ptr [esp+2C] eax=/%SQWRR#[[RTPO5".1TZ[
:0048FC5E 46 inc esi
:0048FC5F 3B70F8 cmp esi, dword ptr [eax-08]
:0048FC62 7CE6 jl 0048FC4A
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048FC48(C)
|
:0048FC64 8D54242C lea edx, dword ptr [esp+2C]
:0048FC68 8D442430 lea eax, dword ptr [esp+30]
:0048FC6C 52 push edx
:0048FC6D 8D4C2444 lea ecx, dword ptr [esp+44]
:0048FC71 50 push eax
:0048FC72 51 push ecx
* Reference To: MFC42.Ordinal:039A, Ord:039Ah
|
:0048FC73 E86CD90000 Call 0049D5E4
:0048FC78 55 push ebp
:0048FC79 8D542460 lea edx, dword ptr [esp+60]
:0048FC7D 55 push ebp
:0048FC7E 8D442468 lea eax, dword ptr [esp+68]
:0048FC82 52 push edx
:0048FC83 8D4C2464 lea ecx, dword ptr [esp+64]
:0048FC87 50 push eax
:0048FC88 51 push ecx
:0048FC89 8D9424A8020000 lea edx, dword ptr [esp+000002A8]
* Possible Reference to String Resource ID=00255: "*妍?N(!"
|
:0048FC90 68FF000000 push 000000FF
:0048FC95 52 push edx
* Possible StringData Ref from Data Obj ->"c:\"
|
:0048FC96 6820184C00 push 004C1820
:0048FC9B C68424BC03010008 mov byte ptr [esp+000103BC], 08
* Reference To: KERNEL32.GetVolumeInformationA, Ord:0177h
|
:0048FCA3 FF15C4C14A00 Call dword ptr [004AC1C4]
:0048FCA9 8B442458 mov eax, dword ptr [esp+58]
:0048FCAD 8B4C243C mov ecx, dword ptr [esp+3C]
:0048FCB1 50 push eax
:0048FCB2 E829060000 call 004902E0
:0048FCB7 8D4C2438 lea ecx, dword ptr [esp+38]
:0048FCBB 8BF0 mov esi, eax
* Reference To: MFC42.Ordinal:021C, Ord:021Ch
|
:0048FCBD E8D8D40000 Call 0049D19A
:0048FCC2 56 push esi
:0048FCC3 8D4C243C lea ecx, dword ptr [esp+3C]
* Possible StringData Ref from Data Obj ->"%ld"
|
:0048FCC7 681C184C00 push 004C181C
:0048FCCC 51 push ecx
:0048FCCD C68424A803010009 mov byte ptr [esp+000103A8], 09
* Reference To: MFC42.Ordinal:0B02, Ord:0B02h
|
:0048FCD5 E886D50000 Call 0049D260
ecx=2448(软件得到的注册名）你的注册名不是2448,你也可以注 册成功，但是在后面的软件进行有比对，不否则你不能用软件的定时提醒）
:0048FCDA 83C40C add esp, 0000000C
:0048FCDD 8D4C2448 lea ecx, dword ptr [esp+48]
* Reference To: MFC42.Ordinal:0162, Ord:0162h
|
:0048FCE1 E810D90000 Call 0049D5F6
:0048FCE6 668B15DC394C00 mov dx, word ptr [004C39DC]
:0048FCED B940000000 mov ecx, 00000040
:0048FCF2 33C0 xor eax, eax
:0048FCF4 8D7C2466 lea edi, dword ptr [esp+66]
:0048FCF8 6689542464 mov word ptr [esp+64], dx
* Possible Reference to String Resource ID=00260: "婼"
|
:0048FCFD 6804010000 push 00000104
:0048FD02 F3 repz
:0048FD03 AB stosd
:0048FD04 66AB stosw
:0048FD06 8D442468 lea eax, dword ptr [esp+68]
:0048FD0A C68424A00301000A mov byte ptr [esp+000103A0], 0A
:0048FD12 50 push eax