:00484253 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN
:00484256 807A015A cmp byte ptr [edx+01], 5A----------->比较BN2是否等于0x5A
:0048425A 7501 jne 0048425D------------------------>不等则跳
:0048425C 40 inc eax----------------------------->EAX=EAX+1
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048425A(C)
|
:0048425D 8BD0 mov edx, eax------------------------>EDX=EAX
:0048425F 83E201 and edx, 00000001------------------->EDX=EDX AND 1
:00484262 4A dec edx----------------------------->EDX=EDX-1
:00484263 750E jne 00484273------------------------>EDX不为0就跳
:00484265 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN
:00484268 33DB xor ebx, ebx------------------------>EBX=0
:0048426A 8A5A0C mov bl, byte ptr [edx+0C]----------->EBX=BN13
:0048426D 6683EB30 sub bx, 0030------------------------>EBX=EBX-0x30
:00484271 EB36 jmp 004842A9------------------------>跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484263(C)
|
:00484273 8BD0 mov edx, eax------------------------>EDX=EAX
:00484275 83E202 and edx, 00000002------------------->EDX=EDX AND 2
:00484278 83FA02 cmp edx, 00000002------------------->比较EDX和2
:0048427B 7512 jne 0048428F------------------------>不等则跳
:0048427D 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN
:00484280 33DB xor ebx, ebx------------------------>EBX=0
:00484282 8A5A0C mov bl, byte ptr [edx+0C]----------->EBX=BN13
:00484285 6683EB41 sub bx, 0041------------------------>EBX=EBX-0x41
:00484289 6683C30A add bx, 000A------------------------>EBX=EBX+0xA
:0048428D EB1A jmp 004842A9------------------------>跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048427B(C)
|
:0048428F 8BD0 mov edx, eax------------------------>EDX=EAX
:00484291 83E204 and edx, 00000004------------------->EDX=EDX AND 4
:00484294 83FA04 cmp edx, 00000004------------------->比较EDX和4
:00484297 7510 jne 004842A9------------------------>不等则跳
:00484299 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN
:0048429C 33DB xor ebx, ebx------------------------>EBX=0
:0048429E 8A5A0C mov bl, byte ptr [edx+0C]----------->EBX=BN13
:004842A1 6683EB41 sub bx, 0041------------------------>EBX=EBX-0x41
:004842A5 6683C324 add bx, 0024------------------------>EBX=EBX+0x24
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00484271(U), :0048428D(U), :00484297(C)
|
:004842A9 8BD0 mov edx, eax------------------------>EDX=EAX
:004842AB 83E208 and edx, 00000008------------------->EDX=EDX AND 8
:004842AE 83FA08 cmp edx, 00000008------------------->比较EDX和8
:004842B1 750D jne 004842C0------------------------>不等则跳
:004842B3 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN
:004842B6 0FB6700D movzx esi, byte ptr [eax+0D]-------->ESI=BN14
:004842BA 6683EE30 sub si, 0030------------------------>ESI=ESI-0x30
:004842BE EB32 jmp 004842F2------------------------>跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004842B1(C)
|
:004842C0 8BD0 mov edx, eax------------------------>EDX=EAX
:004842C2 83E210 and edx, 00000010------------------->EDX=EDX AND 10
:004842C5 83FA10 cmp edx, 00000010------------------->比较EDX和10
:004842C8 7511 jne 004842DB------------------------>不等则跳
:004842CA 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN
:004842CD 0FB6700D movzx esi, byte ptr [eax+0D]-------->ESI=BN14
:004842D1 6683EE41 sub si, 0041------------------------>ESI=ESI-0x41
:004842D5 6683C60A add si, 000A------------------------>ESI=ESI+0xA
:004842D9 EB17 jmp 004842F2------------------------>跳转
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004842C8(C)
|
:004842DB 83E020 and eax, 00000020------------------->EAX=EAX AND 20
:004842DE 83F820 cmp eax, 00000020------------------->比较EAX和20
:004842E1 750F jne 004842F2------------------------>不等则跳
:004842E3 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN
:004842E6 0FB6700D movzx esi, byte ptr [eax+0D]-------->ESI=BN14
:004842EA 6683EE41 sub si, 0041------------------------>ESI=ESI-0x41
:004842EE 6683C624 add si, 0024------------------------>ESI=ESI+0x24
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004842BE(U), :004842D9(U), :004842E1(C)
|
:004842F2 0FB7C7 movzx eax, di----------------------->EAX=EDI
:004842F5 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:004842F8 E8FFFBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:004842FD 8B55FC mov edx, dword ptr [ebp-04]--------->EDX=SN
:00484300 3A420E cmp al, byte ptr [edx+0E]----------->比较EAX和SN15
:00484303 756C jne 00484371------------------------>不等则跳，跳则死
:00484305 0FB7C3 movzx eax, bx----------------------->EAX=EBX
:00484308 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:0048430B E8ECFBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:00484310 8B55FC mov edx, dword ptr [ebp-04]--------->
:00484313 3A420F cmp al, byte ptr [edx+0F]----------->比较EAX和SN16
:00484316 7559 jne 00484371------------------------>不等则跳，跳则死
:00484318 0FB7C6 movzx eax, si----------------------->EAX=ESI
:0048431B 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:0048431E E8D9FBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:00484323 8B55FC mov edx, dword ptr [ebp-04]--------->
:00484326 3A4210 cmp al, byte ptr [edx+10]----------->比较EAX和SN17
:00484329 7546 jne 00484371------------------------>不等则跳，跳则死
:0048432B 0FB7C7 movzx eax, di----------------------->EAX=EDI
:0048432E 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:00484331 83C00D add eax, 0000000D------------------->EAX=EAX+0xD
:00484334 E8C3FBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:00484339 8B55FC mov edx, dword ptr [ebp-04]--------->
:0048433C 3A4211 cmp al, byte ptr [edx+11]----------->比较EAX和SN18
:0048433F 7530 jne 00484371------------------------>不等则跳，跳则死
:00484341 0FB7C3 movzx eax, bx----------------------->EAX=EBX
:00484344 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:00484347 83C002 add eax, 00000002------------------->EAX=EAX+0x2
:0048434A E8ADFBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:0048434F 8B55FC mov edx, dword ptr [ebp-04]--------->
:00484352 3A4212 cmp al, byte ptr [edx+12]----------->比较EAX和SN19
:00484355 751A jne 00484371------------------------>不等则跳，跳则死
:00484357 0FB7C6 movzx eax, si----------------------->EAX=ESI
:0048435A 83C030 add eax, 00000030------------------->EAX=EAX+0x30
:0048435D 83C002 add eax, 00000002------------------->EAX=EAX+0x2
:00484360 E897FBFFFF call 00483EFC----------------------->根据EAX的值进行计算
:00484365 8B55FC mov edx, dword ptr [ebp-04]--------->
:00484368 3A4213 cmp al, byte ptr [edx+13]----------->比较EAX和SN20
:0048436B 7504 jne 00484371------------------------>不等则跳，跳则死
:0048436D C645F701 mov [ebp-09], 01-------------------->注册成功的标志位，到这里就成功了！！^_^
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483F64(C), :0048403B(C), :00484052(C), :00484069(C), :00484083(C)
|:0048409D(C), :004840B5(C), :004840C2(C), :0048419F(C), :004841B6(C)
|:004841CD(C), :004841E7(C), :004841FF(C), :00484219(C), :00484226(C)
|:00484303(C), :00484316(C), :00484329(C), :0048433F(C), :00484355(C)
|:0048436B(C)
|
:00484371 33C0 xor eax, eax
:00484373 5A pop edx
:00484374 59 pop ecx
:00484375 59 pop ecx
:00484376 648910 mov dword ptr fs:[eax], edx
:00484379 6893434800 push 00484393
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00484391(U)
|
:0048437E 8D45F8 lea eax, dword ptr [ebp-08]
:00484381 BA02000000 mov edx, 00000002
:00484386 E895F7F7FF call 00403B20
:0048438B C3 ret
========================================================
以下为根据EAX的值进行计算CALL的具体算法
:00483EFC 8BD0 mov edx, eax-------------->EDX=EAX
:00483EFE 3C3A cmp al, 3A---------------->将EAX与0x3A进行比较
:00483F00 720E jb 00483F10--------------->小于则跳
:00483F02 3C40 cmp al, 40---------------->将EAX与0x40进行比较
:00483F04 770A ja 00483F10--------------->大于则跳
:00483F06 33D2 xor edx, edx-------------->EDX=0
:00483F08 8AD0 mov dl, al---------------->EAX=EDX
:00483F0A 83C232 add edx, 00000032--------->EDX=EDX+0x32
:00483F0D 8BC2 mov eax, edx-------------->EAX=EDX
:00483F0F C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483F00(C), :00483F04(C)
|
:00483F10 3C5B cmp al, 5B---------------->将EAX与0x5B进行比较
:00483F12 720B jb 00483F1F--------------->小于则跳
:00483F14 3C60 cmp al, 60---------------->将EAX与0x60进行比较
:00483F16 7707 ja 00483F1F--------------->大于则跳
:00483F18 33D2 xor edx, edx-------------->EDX=0
:00483F1A 8AD0 mov dl, al---------------->EDX=EAX
:00483F1C 83C218 add edx, 00000018--------->EDX=EDX+0x18
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00483F12(C), :00483F16(C)
|
:00483F1F 8BC2 mov eax, edx-------------->EAX=EDX
:00483F21 C3 ret
=========================================================
算法整理：
以我的机器码为例：MCN9-SKKC-CCA4
1.BN1=0x4D "M"
EDI=BN1
EDI=EDI-0x41=0xC
2.BN2=0x43 "C"
EDX=BN2
EDX!=0x39
EDX=EDX-0x41+0xA=0xC
3.BN3=0x4E "N"
EBX=BN3
EBX=EBX-0x41+0x24=0x31
4.BN4=0x39 "9"
ESI=BN4
ESI=ESI-0x30=0x9
------------------------------
5.BN6=0x53 "S"
EDI=BN6
EDI=EDI-0x41=0x12
6.BN7=0x4B "K"
EDX=BN7
EDX!=0x39
SN2!=0x5A
EDX=EDX-0x41+0xA=0x14
7.BN8=0x4B "K"
EBX=BN8
EBX=EBX-0x41+0x24=0x2E
8.BN9=0x43 "C"
ESI=BN9
ESI=ESI-0x41+0x24=0x26
------------------------------
9.BN11=0x43 "C"
EDI=BN11
EDI=EDI-0x41=0x2
10.BN12=0x43 "C"
EDX=BN12
EDX!=0x39
SN2!=0x5A
EDX=EDX-0x41+0xA=0xC
11.BN13=0x41 "A"
EBX=BN13
EBX=EBX-0x41+0x24=0x24
12.BN14=0x34 "4"
ESI=BN14
ESI=ESI-0x30=0x4
=============================================
1.EAX=EDI
EAX=EAX+0x30=0x3C
因为：0x3A<EAX<0x40
所以：SN1=EAX+0x32=0x6E "n"
2.EAX=EBX
EAX=EAX+0x30=0x61
因为：EAX>0x40 & EAX>0x60
所以：SN2=EAX=0x61 "a"
3.EAX=ESI
EAX=EAX+0x30=0x39
因为：0x3A<EAX & 0x5B<EAX
所以：SN3=EAX=0x39 "9"
4.EAX=EDI
EAX=EAX+0x30+0x6=0x42
因为：0x3A<EAX<0x40
所以：SN4=EAX=EAX+0x32=0x42 "B"
5.EAX=EBX
EAX=EAX+0x30+0x2=0x63
因为：EAX>0x40 & EAX>0x60
所以：SN5=EAX=0x63 "c"
6.EAX=ESI
EAX=EAX+0x30+1=0x3A
因为：0x40>EAX>0x3A
所以：SN6=EAX+0x32=0x6C "l"
7.SN7为任意字符 "-"
---------------------------------------------
8.EAX=EDI
EAX=EAX+0x30=0x42
因为：0x3A<EAX<0x40
所以：SN8=EAX=0x42 "B"
9.EAX=EBX
EAX=EAX+0x30=0x5E
因为：0x40<EAX & EAX<60
所以：SN9=EAX+0x18=0x76 "v"
10.EAX=ESI
EAX=EAX+0x30=0x56
因为：EAX>0x40 & 0x60>EAX
所以：SN10=EAX+0x18=0x6E "n"
11.EAX=EDI
EAX=EAX+0x30+0x8=0x4A
因为：EAX>0x40 & EAX<0x5B
所以：SN11=EAX=0x4A "J"
12.EAX=EBX
EAX=EAX+0x30+1=0x5F
因为：0x40<EAX & EAX<60
所以：SN12=EAX+0x18=0x77 "w"
13.EAX=ESI
EAX=EAX+0x30+0x2=0x58
因为：0x40<EAX & EAX<60
所以：SN13=EAX+0x18=0x70 "p"
14.SN14为任意字符 "-"
---------------------------------------------
15.EAX=EDI
EAX=EAX+0x30=0x32
因为：0x3A<EAX<0x40
所以：SN15=EAX=0x32 "2"
16.EAX=EBX
EAX=EAX+0x30=0x54
因为：0x40<EAX & EAX<5B
所以：SN16=EAX=0x54 "T"
17.EAX=ESI
EAX=EAX+0x30=0x34
因为：0x3A>EAX & EAX<5B
所以：SN17=EAX=0x34 "4"
18.EAX=EDI
EAX=EAX+0x30+0xD=0x3F
因为：0x3A<EAX<0x40
所以：SN18=EAX+0x32=0x71 "q"
19.EAX=EBX
EAX=EAX+0x30+0x2=0x56
因为：0x40<EAX & EAX<5B
所以：SN19=EAX=0x56 "V"
20.EAX=ESI
EAX=EAX+0x30+0x2=0x36
因为：0x3A>EAX & EAX<5B
所以：SN20=EAX=0x36 "6"
整理:BN="MCN9-SKKC-CCA4"
SN="na9Bcl-BvnJwp-2T4qV6