发新话题
打印

[转载]算法分析之CrackMe_Code

[转载]算法分析之CrackMe_Code

文章作者:busheler

【破解工具】PEIDv0.94,GetVBResVER0.51,点睛偏移量转换器0.94B版,odbg110
【破解平台】Windows2000
【软件名称】想玩就玩,玩得漂亮!
【软件大小】24.0KB
【原版下载】http://www.chinapyg.cn/attachment.php?aid=748
【保护方式】
【软件简介】本CrackMe分普通方式编辑和P-code编辑
要求:
写出算法分析;
贴出注册机源码;
简单的东西就简单玩~~嘿嘿~~
想玩就玩~~玩的漂亮!!

CodeBy飘云[PYG]
------------------------------------------------------------------------
一、查壳
PEIDv0.94查无壳,为MicrosoftVisualBasic5.0/6.0编写。

二、找资源

1、GetVBResVER0.51载入看到如下资源:

名称:实偏移:
Congratulations!215C

Good,YouDidIt2184

2、点睛偏移量转换器0.94B版载入将资源实偏移转为代码:


Congratulations!215C===>5C214000

Good,YouDidIt2184===>84214000

三、踏上破解之路:

odbg110载入

searchfor===>Binerystring填入“5C214000”即Congratulations!很容易找到这里。

00403B0D.FFD7CALLEDI;<&MSVBVM60.__vbaFreeVarList>
00403B0F.83C434ADDESP,34
00403B12.66:85F6TESTSI,SI
00403B15.0F8486000000JEPYG.00403BA1
00403B1B.B804000280MOVEAX,80020004
00403B20.89458CMOVDWORDPTRSS:[EBP-74],EAX
00403B23.B90A000000MOVECX,0A
00403B28.894D84MOVDWORDPTRSS:[EBP-7C],ECX
00403B2B.89459CMOVDWORDPTRSS:[EBP-64],EAX
00403B2E.894D94MOVDWORDPTRSS:[EBP-6C],ECX
00403B31.C7854CFFFFFF>MOVDWORDPTRSS:[EBP-B4],PYG.00402184;UNICODE"Good,YouDidIt"
00403B3B.BB08000000MOVEBX,8
00403B40.899D44FFFFFFMOVDWORDPTRSS:[EBP-BC],EBX
00403B46.8D9544FFFFFFLEAEDX,DWORDPTRSS:[EBP-BC]
00403B4C.8D4DA4LEAECX,DWORDPTRSS:[EBP-5C]
00403B4F.8B3594104000MOVESI,DWORDPTRDS:[<&MSVBVM60.__vbaVa>;MSVBVM60.__vbaVarDup
00403B55.FFD6CALLESI;<&MSVBVM60.__vbaVarDup>
00403B57.C7855CFFFFFF>MOVDWORDPTRSS:[EBP-A4],PYG.0040215C;UNICODE"Congratulations!"


往上一看,晕倒!好长好长的代码,看样子只有慢慢分析了!

1、用户名长度及注册码长度监测:

因为该程序无"确定"按钮,那就意味着程序是实时监测输入的注册码的,事实确实如此,在00402770处下断跟踪一下就会发现当你每输入一次注册码都会有一次中断,直到你输满16位。

00402770>55PUSHEBP
00402771.8BECMOVEBP,ESP
00402773.83EC14SUBESP,14
00402776.68F6104000PUSH;SEhandlerinstallation
0040277B.64:A100000000MOVEAX,DWORDPTRFS:[0]
00402781.50PUSHEAX
00402782.64:8925000000>MOVDWORDPTRFS:[0],ESP
00402789.81EC54010000SUBESP,154
0040278F.53PUSHEBX
00402790.56PUSHESI
00402791.57PUSHEDI
00402792.8965ECMOVDWORDPTRSS:[EBP-14],ESP
00402795.C745F0C81040>MOVDWORDPTRSS:[EBP-10],PYG.004010C8
0040279C.8B5D08MOVEBX,DWORDPTRSS:[EBP+8]
0040279F.8BC3MOVEAX,EBX
004027A1.83E001ANDEAX,1
004027A4.8945F4MOVDWORDPTRSS:[EBP-C],EAX
004027A7.83E3FEANDEBX,FFFFFFFE
004027AA.895D08MOVDWORDPTRSS:[EBP+8],EBX
004027AD.33FFXOREDI,EDI
004027AF.897DF8MOVDWORDPTRSS:[EBP-8],EDI
004027B2.8B0BMOVECX,DWORDPTRDS:[EBX]
004027B4.53PUSHEBX
004027B5.FF5104CALLDWORDPTRDS:[ECX+4]
004027B8.897DE0MOVDWORDPTRSS:[EBP-20],EDI
004027BB.897DDCMOVDWORDPTRSS:[EBP-24],EDI
004027BE.897DD8MOVDWORDPTRSS:[EBP-28],EDI
004027C1.897DD4MOVDWORDPTRSS:[EBP-2C],EDI
004027C4.897DD0MOVDWORDPTRSS:[EBP-30],EDI
004027C7.897DCCMOVDWORDPTRSS:[EBP-34],EDI
004027CA.897DC8MOVDWORDPTRSS:[EBP-38],EDI
004027CD.897DC4MOVDWORDPTRSS:[EBP-3C],EDI
004027D0.897DB4MOVDWORDPTRSS:[EBP-4C],EDI
004027D3.897DA4MOVDWORDPTRSS:[EBP-5C],EDI
004027D6.897D94MOVDWORDPTRSS:[EBP-6C],EDI
004027D9.897D84MOVDWORDPTRSS:[EBP-7C],EDI
004027DC.89BD74FFFFFFMOVDWORDPTRSS:[EBP-8C],EDI
004027E2.89BD64FFFFFFMOVDWORDPTRSS:[EBP-9C],EDI
004027E8.89BD54FFFFFFMOVDWORDPTRSS:[EBP-AC],EDI
004027EE.89BD44FFFFFFMOVDWORDPTRSS:[EBP-BC],EDI
004027F4.6A01PUSH1
004027F6.FF1530104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaOnErr>;MSVBVM60.__vbaOnError
004027FC.8B13MOVEDX,DWORDPTRDS:[EBX]
004027FE.53PUSHEBX
004027FF.FF9200030000CALLDWORDPTRDS:[EDX+300]
00402805.50PUSHEAX
00402806.8D45D0LEAEAX,DWORDPTRSS:[EBP-30]
00402809.50PUSHEAX
0040280A.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402810.8BF0MOVESI,EAX
00402812.8B0EMOVECX,DWORDPTRDS:[ESI]
00402814.8D55E0LEAEDX,DWORDPTRSS:[EBP-20]
00402817.52PUSHEDX
00402818.56PUSHESI
00402819.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
0040281F.DBE2FCLEX
00402821.3BC7CMPEAX,EDI
00402823.7D12JGESHORTPYG.00402837
00402825.68A0000000PUSH0A0
0040282A.6848214000PUSHPYG.00402148
0040282F.56PUSHESI
00402830.50PUSHEAX
00402831.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00402837>8B03MOVEAX,DWORDPTRDS:[EBX]
00402839.53PUSHEBX
0040283A.FF90FC020000CALLDWORDPTRDS:[EAX+2FC]
00402840.50PUSHEAX
00402841.8D4DCCLEAECX,DWORDPTRSS:[EBP-34]
00402844.51PUSHECX
00402845.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
0040284B.8BF0MOVESI,EAX
0040284D.8B16MOVEDX,DWORDPTRDS:[ESI]
0040284F.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00402852.50PUSHEAX
00402853.56PUSHESI
00402854.FF92A0000000CALLDWORDPTRDS:[EDX+A0]
0040285A.DBE2FCLEX
0040285C.3BC7CMPEAX,EDI
0040285E.7D12JGESHORTPYG.00402872
00402860.68A0000000PUSH0A0
00402865.6848214000PUSHPYG.00402148
0040286A.56PUSHESI
0040286B.50PUSHEAX
0040286C.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00402872>8B0BMOVECX,DWORDPTRDS:[EBX]
00402874.53PUSHEBX
00402875.FF9100030000CALLDWORDPTRDS:[ECX+300]
0040287B.50PUSHEAX
0040287C.8D55C8LEAEDX,DWORDPTRSS:[EBP-38]
0040287F.52PUSHEDX
00402880.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402886.8BF0MOVESI,EAX
00402888.8B06MOVEAX,DWORDPTRDS:[ESI]
0040288A.8D4DD8LEAECX,DWORDPTRSS:[EBP-28]
0040288D.51PUSHECX
0040288E.56PUSHESI
0040288F.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
00402895.DBE2FCLEX
00402897.3BC7CMPEAX,EDI
00402899.7D12JGESHORTPYG.004028AD
0040289B.68A0000000PUSH0A0
004028A0.6848214000PUSHPYG.00402148
004028A5.56PUSHESI
004028A6.50PUSHEAX
004028A7.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004028AD>8B13MOVEDX,DWORDPTRDS:[EBX]
004028AF.53PUSHEBX
004028B0.FF92FC020000CALLDWORDPTRDS:[EDX+2FC]
004028B6.50PUSHEAX
004028B7.8D45C4LEAEAX,DWORDPTRSS:[EBP-3C]
004028BA.50PUSHEAX
004028BB.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004028C1.8BF0MOVESI,EAX
004028C3.8B0EMOVECX,DWORDPTRDS:[ESI]
004028C5.8D55D4LEAEDX,DWORDPTRSS:[EBP-2C]
004028C8.52PUSHEDX
004028C9.56PUSHESI
004028CA.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
004028D0.DBE2FCLEX
004028D2.3BC7CMPEAX,EDI
004028D4.7D12JGESHORTPYG.004028E8
004028D6.68A0000000PUSH0A0
004028DB.6848214000PUSHPYG.00402148
004028E0.56PUSHESI
004028E1.50PUSHEAX
004028E2.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004028E8>8B45DCMOVEAX,DWORDPTRSS:[EBP-24];注册码入EAX
004028EB.50PUSHEAX
004028EC.6844214000PUSHPYG.00402144
004028F1.8B3D50104000MOVEDI,DWORDPTRDS:[<&MSVBVM60.__vbaSt>;MSVBVM60.__vbaStrCmp
004028F7.FFD7CALLEDI;<&MSVBVM60.__vbaStrCmp>
004028F9.8BF0MOVESI,EAX
004028FB.F7DENEGESI
004028FD.1BF6SBBESI,ESI
004028FF.46INCESI
00402900.F7DENEGESI
00402902.8B4DE0MOVECX,DWORDPTRSS:[EBP-20];用户名入ECX
00402905.51PUSHECX
00402906.6844214000PUSHPYG.00402144
0040290B.FFD7CALLEDI
0040290D.F7D8NEGEAX
0040290F.1BC0SBBEAX,EAX
00402911.40INCEAX
00402912.F7D8NEGEAX
00402914.0BF0ORESI,EAX
00402916.8B55D4MOVEDX,DWORDPTRSS:[EBP-2C]
00402919.52PUSHEDX
0040291A.8B3D08104000MOVEDI,DWORDPTRDS:[<&MSVBVM60.__vbaLe>;MSVBVM60.__vbaLenBstr
00402920.FFD7CALLEDI;<&MSVBVM60.__vbaLenBstr>
00402922.33C9XORECX,ECX
00402924.83F810CMPEAX,10;注册码长度与16比较
00402927.0F9CC1SETLCL
0040292A.F7D9NEGECX
0040292C.0BF1ORESI,ECX
0040292E.8B55D8MOVEDX,DWORDPTRSS:[EBP-28]
00402931.52PUSHEDX
00402932.FFD7CALLEDI
00402934.33C9XORECX,ECX
00402936.83F808CMPEAX,8;用户名长度与8比较
00402939.0F9CC1SETLCL
0040293C.F7D9NEGECX
0040293E.0BF1ORESI,ECX
00402940.8D55D4LEAEDX,DWORDPTRSS:[EBP-2C]
00402943.52PUSHEDX
00402944.8D45D8LEAEAX,DWORDPTRSS:[EBP-28]
00402947.50PUSHEAX
00402948.8D4DDCLEAECX,DWORDPTRSS:[EBP-24]
0040294B.51PUSHECX
0040294C.8D55E0LEAEDX,DWORDPTRSS:[EBP-20]
0040294F.52PUSHEDX
00402950.6A04PUSH4
00402952.FF1584104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
00402958.8D45C4LEAEAX,DWORDPTRSS:[EBP-3C]
0040295B.50PUSHEAX
0040295C.8D4DC8LEAECX,DWORDPTRSS:[EBP-38]
0040295F.51PUSHECX
00402960.8D55CCLEAEDX,DWORDPTRSS:[EBP-34]
00402963.52PUSHEDX
00402964.8D45D0LEAEAX,DWORDPTRSS:[EBP-30]
00402967.50PUSHEAX
00402968.6A04PUSH4
0040296A.FF1514104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObjList
00402970.83C428ADDESP,28
00402973.66:85F6TESTSI,SI
00402976.0F8525120000JNZPYG.00403BA1;注册码长度小于16或用户名长度小于8,跳!大于等于,继续...



---------------------------------------



2、注册码计算过程:注册码是逐位进行对比的,任何一位不对都会跳出,所以必须1-16位慢慢看了。。。

0040297C.8B0BMOVECX,DWORDPTRDS:[EBX]
0040297E.53PUSHEBX
0040297F.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
00402985.50PUSHEAX
00402986.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00402989.52PUSHEDX
0040298A.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402990.8BF0MOVESI,EAX
00402992.8B06MOVEAX,DWORDPTRDS:[ESI]
00402994.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
00402997.51PUSHECX
00402998.56PUSHESI
00402999.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
0040299F.DBE2FCLEX
004029A1.85C0TESTEAX,EAX
004029A3.7D12JGESHORTPYG.004029B7
004029A5.68A0000000PUSH0A0
004029AA.6848214000PUSHPYG.00402148
004029AF.56PUSHESI
004029B0.50PUSHEAX
004029B1.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004029B7>C745AC010000>MOVDWORDPTRSS:[EBP-54],1
004029BE.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
004029C5.8B45E0MOVEAX,DWORDPTRSS:[EBP-20];注册码入EAX
004029C8.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
004029CF.8945BCMOVDWORDPTRSS:[EBP-44],EAX
004029D2.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
004029D9.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
004029DC.52PUSHEDX
004029DD.6A01PUSH1
004029DF.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
004029E2.50PUSHEAX
004029E3.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
004029E6.51PUSHECX
004029E7.8B3544104000MOVESI,DWORDPTRDS:[<&MSVBVM60.#632>];MSVBVM60.rtcMidCharVar
004029ED.FFD6CALLESI;<&MSVBVM60.#632>
004029EF.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
004029F2.52PUSHEDX
004029F3.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
004029F6.50PUSHEAX
004029F7.8B3D74104000MOVEDI,DWORDPTRDS:[<&MSVBVM60.__vbaSt>;MSVBVM60.__vbaStrVarVal
004029FD.FFD7CALLEDI;<&MSVBVM60.__vbaStrVarVal>
004029FF.50PUSHEAX
00402A00.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00402A06.33C9XORECX,ECX
00402A08.66:3D6300CMPAX,63;第一位注册码与c比较
00402A0C.0F94C1SETECL
00402A0F.F7D9NEGECX
00402A11.66:898D18FFFF>MOVWORDPTRSS:[EBP-E8],CX
00402A18.8D4DDCLEAECX,DWORDPTRSS:[EBP-24]
00402A1B.FF15AC104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
00402A21.8D4DD0LEAECX,DWORDPTRSS:[EBP-30]
00402A24.FF15A8104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
00402A2A.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00402A2D.52PUSHEDX
00402A2E.8D45A4LEAEAX,DWORDPTRSS:[EBP-5C]
00402A31.50PUSHEAX
00402A32.8D4DB4LEAECX,DWORDPTRSS:[EBP-4C]
00402A35.51PUSHECX
00402A36.6A03PUSH3
00402A38.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
00402A3E.83C410ADDESP,10
00402A41.66:83BD18FFFF>CMPWORDPTRSS:[EBP-E8],0
00402A490F8452110000JEPYG.00403BA1;不等跳
00402A4F.8B13MOVEDX,DWORDPTRDS:[EBX]
00402A51.53PUSHEBX
00402A52.FF92FC020000CALLDWORDPTRDS:[EDX+2FC]
00402A58.50PUSHEAX
00402A59.8D45D0LEAEAX,DWORDPTRSS:[EBP-30]
00402A5C.50PUSHEAX
00402A5D.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402A63.898520FFFFFFMOVDWORDPTRSS:[EBP-E0],EAX
00402A69.8B08MOVECX,DWORDPTRDS:[EAX]
00402A6B.8D55E0LEAEDX,DWORDPTRSS:[EBP-20]
00402A6E.52PUSHEDX
00402A6F.50PUSHEAX
00402A70.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
00402A76.DBE2FCLEX
00402A78.85C0TESTEAX,EAX
00402A7A.7D18JGESHORTPYG.00402A94
00402A7C.68A0000000PUSH0A0
00402A81.6848214000PUSHPYG.00402148
00402A86.8B8D20FFFFFFMOVECX,DWORDPTRSS:[EBP-E0]
00402A8C.51PUSHECX
00402A8D.50PUSHEAX
00402A8E.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00402A94>8B13MOVEDX,DWORDPTRDS:[EBX]
00402A96.53PUSHEBX
00402A97.FF9200030000CALLDWORDPTRDS:[EDX+300]
00402A9D.50PUSHEAX
00402A9E.8D45CCLEAEAX,DWORDPTRSS:[EBP-34]
00402AA1.50PUSHEAX
00402AA2.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402AA8.8BD8MOVEBX,EAX
00402AAA.8B0BMOVECX,DWORDPTRDS:[EBX]
00402AAC.8D55D8LEAEDX,DWORDPTRSS:[EBP-28]
00402AAF.52PUSHEDX
00402AB0.53PUSHEBX
00402AB1.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
00402AB7.DBE2FCLEX
00402AB9.85C0TESTEAX,EAX
00402ABB.7D12JGESHORTPYG.00402ACF
00402ABD.68A0000000PUSH0A0
00402AC2.6848214000PUSHPYG.00402148
00402AC7.53PUSHEBX
00402AC8.50PUSHEAX
00402AC9.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00402ACF>BB01000000MOVEBX,1
00402AD4.895DACMOVDWORDPTRSS:[EBP-54],EBX
00402AD7.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
00402ADE.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
00402AE1.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
00402AE8.8945BCMOVDWORDPTRSS:[EBP-44],EAX
00402AEB.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
00402AF2.8D45A4LEAEAX,DWORDPTRSS:[EBP-5C]
00402AF5.50PUSHEAX
00402AF6.6A02PUSH2
00402AF8.8D4DB4LEAECX,DWORDPTRSS:[EBP-4C]
00402AFB.51PUSHECX
00402AFC.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00402AFF.52PUSHEDX
00402B00.FFD6CALLESI
00402B02.899D7CFFFFFFMOVDWORDPTRSS:[EBP-84],EBX
00402B08.C78574FFFFFF>MOVDWORDPTRSS:[EBP-8C],2
00402B12.8B45D8MOVEAX,DWORDPTRSS:[EBP-28]
00402B15.C745D8000000>MOVDWORDPTRSS:[EBP-28],0
00402B1C.89458CMOVDWORDPTRSS:[EBP-74],EAX
00402B1F.C74584080000>MOVDWORDPTRSS:[EBP-7C],8
00402B26.8D8574FFFFFFLEAEAX,DWORDPTRSS:[EBP-8C]
00402B2C.50PUSHEAX
00402B2D.53PUSHEBX
00402B2E.8D4D84LEAECX,DWORDPTRSS:[EBP-7C]
00402B31.51PUSHECX
00402B32.8D9564FFFFFFLEAEDX,DWORDPTRSS:[EBP-9C]
00402B38.52PUSHEDX
00402B39.FFD6CALLESI
00402B3B.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
00402B41.50PUSHEAX
00402B42.8D4DD4LEAECX,DWORDPTRSS:[EBP-2C]
00402B45.51PUSHECX
00402B46.FFD7CALLEDI
00402B48.50PUSHEAX
00402B49.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00402B4F.66:8BD8MOVBX,AX
00402B52.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00402B55.52PUSHEDX
00402B56.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00402B59.50PUSHEAX
00402B5A.FFD7CALLEDI
00402B5C.50PUSHEAX
00402B5D.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00402B63.33C9XORECX,ECX
00402B65.66:3BC3CMPAX,BX;注册码第二位与用户名第一位比较
00402B68.0F94C1SETECL
00402B6B.F7D9NEGECX
00402B6D.8BD9MOVEBX,ECX
00402B6F.8D55D4LEAEDX,DWORDPTRSS:[EBP-2C]
00402B72.52PUSHEDX
00402B73.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00402B76.50PUSHEAX
00402B77.6A02PUSH2
00402B79.FF1584104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
00402B7F.8D4DCCLEAECX,DWORDPTRSS:[EBP-34]
00402B82.51PUSHECX
00402B83.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00402B86.52PUSHEDX
00402B87.6A02PUSH2
00402B89.FF1514104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObjList
00402B8F.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
00402B95.50PUSHEAX
00402B96.8D8D74FFFFFFLEAECX,DWORDPTRSS:[EBP-8C]
00402B9C.51PUSHECX
00402B9D.8D5584LEAEDX,DWORDPTRSS:[EBP-7C]
00402BA0.52PUSHEDX
00402BA1.8D4594LEAEAX,DWORDPTRSS:[EBP-6C]
00402BA4.50PUSHEAX
00402BA5.8D4DA4LEAECX,DWORDPTRSS:[EBP-5C]
00402BA8.51PUSHECX
00402BA9.8D55B4LEAEDX,DWORDPTRSS:[EBP-4C]
00402BAC.52PUSHEDX
00402BAD.6A06PUSH6
00402BAF.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
00402BB5.83C434ADDESP,34
00402BB8.66:85DBTESTBX,BX
00402BBB0F84E00F0000JEPYG.00403BA1;不等跳!
00402BC1.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00402BC4.8B08MOVECX,DWORDPTRDS:[EAX]
00402BC6.50PUSHEAX
00402BC7.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
00402BCD.50PUSHEAX
00402BCE.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00402BD1.52PUSHEDX
00402BD2.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402BD8.8BD8MOVEBX,EAX
00402BDA.8B03MOVEAX,DWORDPTRDS:[EBX]
00402BDC.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
00402BDF.51PUSHECX
00402BE0.53PUSHEBX
00402BE1.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
00402BE7.DBE2FCLEX
00402BE9.85C0TESTEAX,EAX
00402BEB.7D12JGESHORTPYG.00402BFF
00402BED.68A0000000PUSH0A0
00402BF2.6848214000PUSHPYG.00402148
00402BF7.53PUSHEBX
00402BF8.50PUSHEAX
00402BF9.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00402BFF>C745AC010000>MOVDWORDPTRSS:[EBP-54],1
00402C06.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
00402C0D.8B45E0MOVEAX,DWORDPTRSS:[EBP-20];注册码入EAX
00402C10.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
00402C17.8945BCMOVDWORDPTRSS:[EBP-44],EAX
00402C1A.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
00402C21.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
00402C24.52PUSHEDX
00402C25.6A03PUSH3
00402C27.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
00402C2A.50PUSHEAX
00402C2B.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
00402C2E.51PUSHECX
00402C2F.FFD6CALLESI
00402C31.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00402C34.52PUSHEDX
00402C35.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00402C38.50PUSHEAX
00402C39.FFD7CALLEDI
00402C3B.50PUSHEAX
00402C3C.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00402C42.33DBXOREBX,EBX
00402C44.66:3D6800CMPAX,68;第三位注册码与h比较
00402C48.0F94C3SETEBL
00402C4B.F7DBNEGEBX
00402C4D.8D4DDCLEAECX,DWORDPTRSS:[EBP-24]
00402C50.FF15AC104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
00402C56.8D4DD0LEAECX,DWORDPTRSS:[EBP-30]
00402C59.FF15A8104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
00402C5F.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
00402C62.51PUSHECX
00402C63.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
00402C66.52PUSHEDX
00402C67.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
00402C6A.50PUSHEAX
00402C6B.6A03PUSH3
00402C6D.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
00402C73.83C410ADDESP,10
00402C76.66:85DBTESTBX,BX
00402C790F84220F0000JEPYG.00403BA1;不等跳!
00402C7F.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00402C82.8B08MOVECX,DWORDPTRDS:[EAX]
00402C84.50PUSHEAX
00402C85.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
00402C8B.50PUSHEAX
00402C8C.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00402C8F.52PUSHEDX
00402C90.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402C96.8BD8MOVEBX,EAX
00402C98.8B03MOVEAX,DWORDPTRDS:[EBX]
00402C9A.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
00402C9D.51PUSHECX
00402C9E.53PUSHEBX
00402C9F.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
00402CA5.DBE2FCLEX
00402CA7.85C0TESTEAX,EAX
00402CA9.7D12JGESHORTPYG.00402CBD
00402CAB.68A0000000PUSH0A0
00402CB0.6848214000PUSHPYG.00402148
00402CB5.53PUSHEBX
00402CB6.50PUSHEAX
00402CB7.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00402CBD>8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00402CC0.8B10MOVEDX,DWORDPTRDS:[EAX]
00402CC2.50PUSHEAX
00402CC3.FF9200030000CALLDWORDPTRDS:[EDX+300]
00402CC9.50PUSHEAX
00402CCA.8D45CCLEAEAX,DWORDPTRSS:[EBP-34]
00402CCD.50PUSHEAX
00402CCE.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402CD4.8BD8MOVEBX,EAX
00402CD6.8B0BMOVECX,DWORDPTRDS:[EBX]
00402CD8.8D55D8LEAEDX,DWORDPTRSS:[EBP-28]
00402CDB.52PUSHEDX
00402CDC.53PUSHEBX
00402CDD.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
00402CE3.DBE2FCLEX
00402CE5.85C0TESTEAX,EAX
00402CE7.7D12JGESHORTPYG.00402CFB
00402CE9.68A0000000PUSH0A0
00402CEE.6848214000PUSHPYG.00402148
00402CF3.53PUSHEBX
00402CF4.50PUSHEAX
00402CF5.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00402CFB>BB01000000MOVEBX,1
00402D00.895DACMOVDWORDPTRSS:[EBP-54],EBX
00402D03.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
00402D0A.8B45E0MOVEAX,DWORDPTRSS:[EBP-20];注册码入eax
00402D0D.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
00402D14.8945BCMOVDWORDPTRSS:[EBP-44],EAX
00402D17.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
00402D1E.8D45A4LEAEAX,DWORDPTRSS:[EBP-5C]
00402D21.50PUSHEAX
00402D22.6A04PUSH4
00402D24.8D4DB4LEAECX,DWORDPTRSS:[EBP-4C]
00402D27.51PUSHECX
00402D28.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00402D2B.52PUSHEDX
00402D2C.FFD6CALLESI
00402D2E.899D7CFFFFFFMOVDWORDPTRSS:[EBP-84],EBX
00402D34.C78574FFFFFF>MOVDWORDPTRSS:[EBP-8C],2
00402D3E.8B45D8MOVEAX,DWORDPTRSS:[EBP-28];用户名入EAX
00402D41.C745D8000000>MOVDWORDPTRSS:[EBP-28],0
00402D48.89458CMOVDWORDPTRSS:[EBP-74],EAX
00402D4B.C74584080000>MOVDWORDPTRSS:[EBP-7C],8
00402D52.8D8574FFFFFFLEAEAX,DWORDPTRSS:[EBP-8C]
00402D58.50PUSHEAX
00402D59.6A02PUSH2
00402D5B.8D4D84LEAECX,DWORDPTRSS:[EBP-7C]
00402D5E.51PUSHECX
00402D5F.8D9564FFFFFFLEAEDX,DWORDPTRSS:[EBP-9C]
00402D65.52PUSHEDX
00402D66.FFD6CALLESI
00402D68.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
00402D6E.50PUSHEAX
00402D6F.8D4DD4LEAECX,DWORDPTRSS:[EBP-2C]
00402D72.51PUSHECX
00402D73.FFD7CALLEDI
00402D75.50PUSHEAX
00402D76.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00402D7C.66:8BD8MOVBX,AX
00402D7F.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00402D82.52PUSHEDX
00402D83.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00402D86.50PUSHEAX
00402D87.FFD7CALLEDI
00402D89.50PUSHEAX
00402D8A.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00402D90.33C9XORECX,ECX
00402D92.66:3BC3CMPAX,BX;注册码第四位与用用户名第二位比较
00402D95.0F94C1SETECL
00402D98.F7D9NEGECX
00402D9A.8BD9MOVEBX,ECX
00402D9C.8D55D4LEAEDX,DWORDPTRSS:[EBP-2C]
00402D9F.52PUSHEDX
00402DA0.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00402DA3.50PUSHEAX
00402DA4.6A02PUSH2
00402DA6.FF1584104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
00402DAC.8D4DCCLEAECX,DWORDPTRSS:[EBP-34]
00402DAF.51PUSHECX
00402DB0.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00402DB3.52PUSHEDX
00402DB4.6A02PUSH2
00402DB6.FF1514104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObjList
00402DBC.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
00402DC2.50PUSHEAX
00402DC3.8D8D74FFFFFFLEAECX,DWORDPTRSS:[EBP-8C]
00402DC9.51PUSHECX
00402DCA.8D5584LEAEDX,DWORDPTRSS:[EBP-7C]
00402DCD.52PUSHEDX
00402DCE.8D4594LEAEAX,DWORDPTRSS:[EBP-6C]
00402DD1.50PUSHEAX
00402DD2.8D4DA4LEAECX,DWORDPTRSS:[EBP-5C]
00402DD5.51PUSHECX
00402DD6.8D55B4LEAEDX,DWORDPTRSS:[EBP-4C]
00402DD9.52PUSHEDX
00402DDA.6A06PUSH6
00402DDC.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
00402DE2.83C434ADDESP,34
00402DE5.66:85DBTESTBX,BX
00402DE80F84B30D0000JEPYG.00403BA1;不等跳!
00402DEE.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00402DF1.8B08MOVECX,DWORDPTRDS:[EAX]
00402DF3.50PUSHEAX
00402DF4.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
00402DFA.50PUSHEAX
00402DFB.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00402DFE.52PUSHEDX
00402DFF.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402E05.8BD8MOVEBX,EAX
00402E07.8B03MOVEAX,DWORDPTRDS:[EBX]
00402E09.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
00402E0C.51PUSHECX
00402E0D.53PUSHEBX
00402E0E.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
00402E14.DBE2FCLEX
00402E16.85C0TESTEAX,EAX
00402E18.7D12JGESHORTPYG.00402E2C
00402E1A.68A0000000PUSH0A0
00402E1F.6848214000PUSHPYG.00402148
00402E24.53PUSHEBX
00402E25.50PUSHEAX
00402E26.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00402E2C>C745AC010000>MOVDWORDPTRSS:[EBP-54],1
00402E33.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
00402E3A.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
00402E3D.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
00402E44.8945BCMOVDWORDPTRSS:[EBP-44],EAX
00402E47.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
00402E4E.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
00402E51.52PUSHEDX
00402E52.6A05PUSH5
00402E54.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
00402E57.50PUSHEAX
00402E58.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
00402E5B.51PUSHECX
00402E5C.FFD6CALLESI
00402E5E.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00402E61.52PUSHEDX
00402E62.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00402E65.50PUSHEAX
00402E66.FFD7CALLEDI
00402E68.50PUSHEAX
00402E69.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00402E6F.33DBXOREBX,EBX
00402E71.66:3D6900CMPAX,69;注册码第五位与i比较
00402E75.0F94C3SETEBL
00402E78.F7DBNEGEBX
00402E7A.8D4DDCLEAECX,DWORDPTRSS:[EBP-24]
00402E7D.FF15AC104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
00402E83.8D4DD0LEAECX,DWORDPTRSS:[EBP-30]
00402E86.FF15A8104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
00402E8C.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
00402E8F.51PUSHECX
00402E90.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
00402E93.52PUSHEDX
00402E94.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
00402E97.50PUSHEAX
00402E98.6A03PUSH3
00402E9A.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
00402EA0.83C410ADDESP,10
00402EA3.66:85DBTESTBX,BX
00402EA60F84F50C0000JEPYG.00403BA1;不等跳
00402EAC.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00402EAF.8B08MOVECX,DWORDPTRDS:[EAX]
00402EB1.50PUSHEAX
00402EB2.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
00402EB8.50PUSHEAX
00402EB9.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00402EBC.52PUSHEDX
00402EBD.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402EC3.8BD8MOVEBX,EAX
00402EC5.8B03MOVEAX,DWORDPTRDS:[EBX]
00402EC7.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
00402ECA.51PUSHECX
00402ECB.53PUSHEBX
00402ECC.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
00402ED2.DBE2FCLEX
00402ED4.85C0TESTEAX,EAX
00402ED6.7D12JGESHORTPYG.00402EEA
00402ED8.68A0000000PUSH0A0
00402EDD.6848214000PUSHPYG.00402148
00402EE2.53PUSHEBX
00402EE3.50PUSHEAX
00402EE4.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00402EEA>8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00402EED.8B10MOVEDX,DWORDPTRDS:[EAX]
00402EEF.50PUSHEAX
00402EF0.FF9200030000CALLDWORDPTRDS:[EDX+300]
00402EF6.50PUSHEAX
00402EF7.8D45CCLEAEAX,DWORDPTRSS:[EBP-34]
00402EFA.50PUSHEAX
00402EFB.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00402F01.8BD8MOVEBX,EAX
00402F03.8B0BMOVECX,DWORDPTRDS:[EBX]
00402F05.8D55D8LEAEDX,DWORDPTRSS:[EBP-28]
00402F08.52PUSHEDX
00402F09.53PUSHEBX
00402F0A.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
00402F10.DBE2FCLEX
00402F12.85C0TESTEAX,EAX
00402F14.7D12JGESHORTPYG.00402F28
00402F16.68A0000000PUSH0A0
00402F1B.6848214000PUSHPYG.00402148
00402F20.53PUSHEBX
00402F21.50PUSHEAX
00402F22.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00402F28>C745AC010000>MOVDWORDPTRSS:[EBP-54],1
00402F2F.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
00402F36.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
00402F39.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
00402F40.8945BCMOVDWORDPTRSS:[EBP-44],EAX
00402F43.BB08000000MOVEBX,8
00402F48.895DB4MOVDWORDPTRSS:[EBP-4C],EBX
00402F4B.8D45A4LEAEAX,DWORDPTRSS:[EBP-5C]
00402F4E.50PUSHEAX
00402F4F.6A06PUSH6
00402F51.8D4DB4LEAECX,DWORDPTRSS:[EBP-4C]
00402F54.51PUSHECX
00402F55.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00402F58.52PUSHEDX
00402F59.FFD6CALLESI
00402F5B.C7857CFFFFFF>MOVDWORDPTRSS:[EBP-84],1
00402F65.C78574FFFFFF>MOVDWORDPTRSS:[EBP-8C],2
00402F6F.8B45D8MOVEAX,DWORDPTRSS:[EBP-28]
00402F72.C745D8000000>MOVDWORDPTRSS:[EBP-28],0
00402F79.89458CMOVDWORDPTRSS:[EBP-74],EAX
00402F7C.895D84MOVDWORDPTRSS:[EBP-7C],EBX
00402F7F.8D8574FFFFFFLEAEAX,DWORDPTRSS:[EBP-8C]
00402F85.50PUSHEAX
00402F86.6A03PUSH3
00402F88.8D4D84LEAECX,DWORDPTRSS:[EBP-7C]
00402F8B.51PUSHECX
00402F8C.8D9564FFFFFFLEAEDX,DWORDPTRSS:[EBP-9C]
00402F92.52PUSHEDX
00402F93.FFD6CALLESI
00402F95.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
00402F9B.50PUSHEAX
00402F9C.8D4DD4LEAECX,DWORDPTRSS:[EBP-2C]
00402F9F.51PUSHECX
00402FA0.FFD7CALLEDI
00402FA2.50PUSHEAX
00402FA3.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00402FA9.66:8BD8MOVBX,AX
00402FAC.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00402FAF.52PUSHEDX
00402FB0.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00402FB3.50PUSHEAX
00402FB4.FFD7CALLEDI
00402FB6.50PUSHEAX
00402FB7.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00402FBD.33C9XORECX,ECX
00402FBF.66:3BC3CMPAX,BX;注册码第六位与用户名第三位比较
00402FC2.0F94C1SETECL
00402FC5.F7D9NEGECX
00402FC7.8BD9MOVEBX,ECX
00402FC9.8D55D4LEAEDX,DWORDPTRSS:[EBP-2C]
00402FCC.52PUSHEDX
00402FCD.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00402FD0.50PUSHEAX
00402FD1.6A02PUSH2
00402FD3.FF1584104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
00402FD9.8D4DCCLEAECX,DWORDPTRSS:[EBP-34]
00402FDC.51PUSHECX
00402FDD.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00402FE0.52PUSHEDX
00402FE1.6A02PUSH2
00402FE3.FF1514104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObjList
00402FE9.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
00402FEF.50PUSHEAX
00402FF0.8D8D74FFFFFFLEAECX,DWORDPTRSS:[EBP-8C]
00402FF6.51PUSHECX
00402FF7.8D5584LEAEDX,DWORDPTRSS:[EBP-7C]
00402FFA.52PUSHEDX
00402FFB.8D4594LEAEAX,DWORDPTRSS:[EBP-6C]
00402FFE.50PUSHEAX
00402FFF.8D4DA4LEAECX,DWORDPTRSS:[EBP-5C]
00403002.51PUSHECX
00403003.8D55B4LEAEDX,DWORDPTRSS:[EBP-4C]
00403006.52PUSHEDX
00403007.6A06PUSH6
00403009.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
0040300F.83C434ADDESP,34
00403012.66:85DBTESTBX,BX
004030150F84860B0000JEPYG.00403BA1;不等跳!
0040301B.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
0040301E.8B08MOVECX,DWORDPTRDS:[EAX]
00403020.50PUSHEAX
00403021.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
00403027.50PUSHEAX
00403028.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
0040302B.52PUSHEDX
0040302C.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00403032.8BD8MOVEBX,EAX
00403034.8B03MOVEAX,DWORDPTRDS:[EBX]
00403036.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
00403039.51PUSHECX
0040303A.53PUSHEBX
0040303B.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
00403041.DBE2FCLEX
00403043.85C0TESTEAX,EAX
00403045.7D12JGESHORTPYG.00403059
00403047.68A0000000PUSH0A0
0040304C.6848214000PUSHPYG.00402148
00403051.53PUSHEBX
00403052.50PUSHEAX
00403053.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00403059>C745AC010000>MOVDWORDPTRSS:[EBP-54],1
00403060.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
00403067.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
0040306A.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
00403071.8945BCMOVDWORDPTRSS:[EBP-44],EAX
00403074.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
0040307B.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
0040307E.52PUSHEDX
0040307F.6A07PUSH7
00403081.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
00403084.50PUSHEAX
00403085.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
00403088.51PUSHECX
00403089.FFD6CALLESI
0040308B.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
0040308E.52PUSHEDX
0040308F.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00403092.50PUSHEAX
00403093.FFD7CALLEDI
00403095.50PUSHEAX
00403096.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
0040309C.33DBXOREBX,EBX
0040309E.66:3D6E00CMPAX,6E;AX为第七位注册码与n比较
004030A2.0F94C3SETEBL
004030A5.F7DBNEGEBX
004030A7.8D4DDCLEAECX,DWORDPTRSS:[EBP-24]
004030AA.FF15AC104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
004030B0.8D4DD0LEAECX,DWORDPTRSS:[EBP-30]
004030B3.FF15A8104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004030B9.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
004030BC.51PUSHECX
004030BD.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
004030C0.52PUSHEDX
004030C1.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
004030C4.50PUSHEAX
004030C5.6A03PUSH3
004030C7.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004030CD.83C410ADDESP,10
004030D0.66:85DBTESTBX,BX
004030D30F84C80A0000JEPYG.00403BA1;不等跳!
004030D9.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
004030DC.8B08MOVECX,DWORDPTRDS:[EAX]
004030DE.50PUSHEAX
004030DF.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
004030E5.50PUSHEAX
004030E6.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
004030E9.52PUSHEDX
004030EA.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004030F0.8BD8MOVEBX,EAX
004030F2.8B03MOVEAX,DWORDPTRDS:[EBX]
004030F4.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
004030F7.51PUSHECX
004030F8.53PUSHEBX
004030F9.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
004030FF.DBE2FCLEX
00403101.85C0TESTEAX,EAX
00403103.7D12JGESHORTPYG.00403117
00403105.68A0000000PUSH0A0
0040310A.6848214000PUSHPYG.00402148
0040310F.53PUSHEBX
00403110.50PUSHEAX
00403111.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00403117>8B4508MOVEAX,DWORDPTRSS:[EBP+8]
0040311A.8B10MOVEDX,DWORDPTRDS:[EAX]
0040311C.50PUSHEAX
0040311D.FF9200030000CALLDWORDPTRDS:[EDX+300]
00403123.50PUSHEAX
00403124.8D45CCLEAEAX,DWORDPTRSS:[EBP-34]
00403127.50PUSHEAX
00403128.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
0040312E.8BD8MOVEBX,EAX
00403130.8B0BMOVECX,DWORDPTRDS:[EBX]
00403132.8D55D8LEAEDX,DWORDPTRSS:[EBP-28]
00403135.52PUSHEDX
00403136.53PUSHEBX
00403137.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
0040313D.DBE2FCLEX
0040313F.85C0TESTEAX,EAX
00403141.7D12JGESHORTPYG.00403155
00403143.68A0000000PUSH0A0
00403148.6848214000PUSHPYG.00402148
0040314D.53PUSHEBX
0040314E.50PUSHEAX
0040314F.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00403155>BB01000000MOVEBX,1
0040315A.895DACMOVDWORDPTRSS:[EBP-54],EBX
0040315D.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
00403164.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
00403167.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
0040316E.8945BCMOVDWORDPTRSS:[EBP-44],EAX
00403171.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
00403178.8D45A4LEAEAX,DWORDPTRSS:[EBP-5C]
0040317B.50PUSHEAX
0040317C.6A08PUSH8
0040317E.8D4DB4LEAECX,DWORDPTRSS:[EBP-4C]
00403181.51PUSHECX
00403182.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00403185.52PUSHEDX
00403186.FFD6CALLESI
00403188.899D7CFFFFFFMOVDWORDPTRSS:[EBP-84],EBX
0040318E.C78574FFFFFF>MOVDWORDPTRSS:[EBP-8C],2
00403198.8B45D8MOVEAX,DWORDPTRSS:[EBP-28]
0040319B.C745D8000000>MOVDWORDPTRSS:[EBP-28],0
004031A2.89458CMOVDWORDPTRSS:[EBP-74],EAX
004031A5.C74584080000>MOVDWORDPTRSS:[EBP-7C],8
004031AC.8D8574FFFFFFLEAEAX,DWORDPTRSS:[EBP-8C]
004031B2.50PUSHEAX
004031B3.6A04PUSH4
004031B5.8D4D84LEAECX,DWORDPTRSS:[EBP-7C]
004031B8.51PUSHECX
004031B9.8D9564FFFFFFLEAEDX,DWORDPTRSS:[EBP-9C]
004031BF.52PUSHEDX
004031C0.FFD6CALLESI
004031C2.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
004031C8.50PUSHEAX
004031C9.8D4DD4LEAECX,DWORDPTRSS:[EBP-2C]
004031CC.51PUSHECX
004031CD.FFD7CALLEDI
004031CF.50PUSHEAX
004031D0.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
004031D6.66:8BD8MOVBX,AX
004031D9.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
004031DC.52PUSHEDX
004031DD.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
004031E0.50PUSHEAX
004031E1.FFD7CALLEDI
004031E3.50PUSHEAX
004031E4.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
004031EA.33C9XORECX,ECX
004031EC.66:3BC3CMPAX,BX;第八位注册码与用户名第四位比较
004031EF.0F94C1SETECL
004031F2.F7D9NEGECX
004031F4.8BD9MOVEBX,ECX
004031F6.8D55D4LEAEDX,DWORDPTRSS:[EBP-2C]
004031F9.52PUSHEDX
004031FA.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
004031FD.50PUSHEAX
004031FE.6A02PUSH2
00403200.FF1584104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
00403206.8D4DCCLEAECX,DWORDPTRSS:[EBP-34]
00403209.51PUSHECX
0040320A.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
0040320D.52PUSHEDX
0040320E.6A02PUSH2
00403210.FF1514104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObjList
00403216.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
0040321C.50PUSHEAX
0040321D.8D8D74FFFFFFLEAECX,DWORDPTRSS:[EBP-8C]
00403223.51PUSHECX
00403224.8D5584LEAEDX,DWORDPTRSS:[EBP-7C]
00403227.52PUSHEDX
00403228.8D4594LEAEAX,DWORDPTRSS:[EBP-6C]
0040322B.50PUSHEAX
0040322C.8D4DA4LEAECX,DWORDPTRSS:[EBP-5C]
0040322F.51PUSHECX
00403230.8D55B4LEAEDX,DWORDPTRSS:[EBP-4C]
00403233.52PUSHEDX
00403234.6A06PUSH6
00403236.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
0040323C.83C434ADDESP,34
0040323F.66:85DBTESTBX,BX
004032420F8459090000JEPYG.00403BA1;如上面不相等跳!
00403248.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
0040324B.8B08MOVECX,DWORDPTRDS:[EAX]
0040324D.50PUSHEAX
0040324E.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
00403254.50PUSHEAX
00403255.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00403258.52PUSHEDX
00403259.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
0040325F.8BD8MOVEBX,EAX
00403261.8B03MOVEAX,DWORDPTRDS:[EBX]
00403263.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
00403266.51PUSHECX
00403267.53PUSHEBX
00403268.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
0040326E.DBE2FCLEX
00403270.85C0TESTEAX,EAX
00403272.7D12JGESHORTPYG.00403286
00403274.68A0000000PUSH0A0
00403279.6848214000PUSHPYG.00402148
0040327E.53PUSHEBX
0040327F.50PUSHEAX
00403280.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00403286>C745AC010000>MOVDWORDPTRSS:[EBP-54],1
0040328D.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
00403294.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
00403297.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
0040329E.8945BCMOVDWORDPTRSS:[EBP-44],EAX
004032A1.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
004032A8.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
004032AB.52PUSHEDX
004032AC.6A09PUSH9
004032AE.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
004032B1.50PUSHEAX
004032B2.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
004032B5.51PUSHECX
004032B6.FFD6CALLESI
004032B8.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
004032BB.52PUSHEDX
004032BC.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
004032BF.50PUSHEAX
004032C0.FFD7CALLEDI
004032C2.50PUSHEAX
004032C3.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
004032C9.33DBXOREBX,EBX
004032CB.66:3D6100CMPAX,61;AX为第九位注册码与a比较
004032CF.0F94C3SETEBL
004032D2.F7DBNEGEBX
004032D4.8D4DDCLEAECX,DWORDPTRSS:[EBP-24]
004032D7.FF15AC104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
004032DD.8D4DD0LEAECX,DWORDPTRSS:[EBP-30]
004032E0.FF15A8104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
004032E6.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
004032E9.51PUSHECX
004032EA.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
004032ED.52PUSHEDX
004032EE.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
004032F1.50PUSHEAX
004032F2.6A03PUSH3
004032F4.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004032FA.83C410ADDESP,10
004032FD.66:85DBTESTBX,BX
004033000F849B080000JEPYG.00403BA1;不等跳!
00403306.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00403309.8B08MOVECX,DWORDPTRDS:[EAX]
0040330B.50PUSHEAX
0040330C.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
00403312.50PUSHEAX
00403313.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00403316.52PUSHEDX
00403317.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
0040331D.8BD8MOVEBX,EAX
0040331F.8B03MOVEAX,DWORDPTRDS:[EBX]
00403321.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
00403324.51PUSHECX
00403325.53PUSHEBX
00403326.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
0040332C.DBE2FCLEX
0040332E.85C0TESTEAX,EAX
00403330.7D12JGESHORTPYG.00403344
00403332.68A0000000PUSH0A0
00403337.6848214000PUSHPYG.00402148
0040333C.53PUSHEBX
0040333D.50PUSHEAX
0040333E.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00403344>8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00403347.8B10MOVEDX,DWORDPTRDS:[EAX]
00403349.50PUSHEAX
0040334A.FF9200030000CALLDWORDPTRDS:[EDX+300]
00403350.50PUSHEAX
00403351.8D45CCLEAEAX,DWORDPTRSS:[EBP-34]
00403354.50PUSHEAX
00403355.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
0040335B.8BD8MOVEBX,EAX
0040335D.8B0BMOVECX,DWORDPTRDS:[EBX]
0040335F.8D55D8LEAEDX,DWORDPTRSS:[EBP-28]
00403362.52PUSHEDX
00403363.53PUSHEBX
00403364.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
0040336A.DBE2FCLEX
0040336C.85C0TESTEAX,EAX
0040336E.7D12JGESHORTPYG.00403382
00403370.68A0000000PUSH0A0
00403375.6848214000PUSHPYG.00402148
0040337A.53PUSHEBX
0040337B.50PUSHEAX
0040337C.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00403382>BB01000000MOVEBX,1
00403387.895DACMOVDWORDPTRSS:[EBP-54],EBX
0040338A.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
00403391.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
00403394.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
0040339B.8945BCMOVDWORDPTRSS:[EBP-44],EAX
0040339E.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
004033A5.8D45A4LEAEAX,DWORDPTRSS:[EBP-5C]
004033A8.50PUSHEAX
004033A9.6A0APUSH0A
004033AB.8D4DB4LEAECX,DWORDPTRSS:[EBP-4C]
004033AE.51PUSHECX
004033AF.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
004033B2.52PUSHEDX
004033B3.FFD6CALLESI
004033B5.899D7CFFFFFFMOVDWORDPTRSS:[EBP-84],EBX
004033BB.C78574FFFFFF>MOVDWORDPTRSS:[EBP-8C],2
004033C5.8B45D8MOVEAX,DWORDPTRSS:[EBP-28]
004033C8.C745D8000000>MOVDWORDPTRSS:[EBP-28],0
004033CF.89458CMOVDWORDPTRSS:[EBP-74],EAX
004033D2.C74584080000>MOVDWORDPTRSS:[EBP-7C],8
004033D9.8D8574FFFFFFLEAEAX,DWORDPTRSS:[EBP-8C]
004033DF.50PUSHEAX
004033E0.6A05PUSH5
004033E2.8D4D84LEAECX,DWORDPTRSS:[EBP-7C]
004033E5.51PUSHECX
004033E6.8D9564FFFFFFLEAEDX,DWORDPTRSS:[EBP-9C]
004033EC.52PUSHEDX
004033ED.FFD6CALLESI
004033EF.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
004033F5.50PUSHEAX
004033F6.8D4DD4LEAECX,DWORDPTRSS:[EBP-2C]
004033F9.51PUSHECX
004033FA.FFD7CALLEDI
004033FC.50PUSHEAX
004033FD.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00403403.66:8BD8MOVBX,AX
00403406.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00403409.52PUSHEDX
0040340A.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
0040340D.50PUSHEAX
0040340E.FFD7CALLEDI
00403410.50PUSHEAX
00403411.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00403417.33C9XORECX,ECX
00403419.66:3BC3CMPAX,BX;第十位注册码与用户名第五位比较
0040341C.0F94C1SETECL
0040341F.F7D9NEGECX
00403421.8BD9MOVEBX,ECX
00403423.8D55D4LEAEDX,DWORDPTRSS:[EBP-2C]
00403426.52PUSHEDX
00403427.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
0040342A.50PUSHEAX
0040342B.6A02PUSH2
0040342D.FF1584104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
00403433.8D4DCCLEAECX,DWORDPTRSS:[EBP-34]
00403436.51PUSHECX
00403437.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
0040343A.52PUSHEDX
0040343B.6A02PUSH2
0040343D.FF1514104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObjList
00403443.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
00403449.50PUSHEAX
0040344A.8D8D74FFFFFFLEAECX,DWORDPTRSS:[EBP-8C]
00403450.51PUSHECX
00403451.8D5584LEAEDX,DWORDPTRSS:[EBP-7C]
00403454.52PUSHEDX
00403455.8D4594LEAEAX,DWORDPTRSS:[EBP-6C]
00403458.50PUSHEAX
00403459.8D4DA4LEAECX,DWORDPTRSS:[EBP-5C]
0040345C.51PUSHECX
0040345D.8D55B4LEAEDX,DWORDPTRSS:[EBP-4C]
00403460.52PUSHEDX
00403461.6A06PUSH6
00403463.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
00403469.83C434ADDESP,34
0040346C.66:85DBTESTBX,BX
0040346F0F842C070000JEPYG.00403BA1;不等跳
00403475.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00403478.8B08MOVECX,DWORDPTRDS:[EAX]
0040347A.50PUSHEAX
0040347B.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
00403481.50PUSHEAX
00403482.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00403485.52PUSHEDX
00403486.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
0040348C.8BD8MOVEBX,EAX
0040348E.8B03MOVEAX,DWORDPTRDS:[EBX]
00403490.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
00403493.51PUSHECX
00403494.53PUSHEBX
00403495.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
0040349B.DBE2FCLEX
0040349D.85C0TESTEAX,EAX
0040349F.7D12JGESHORTPYG.004034B3
004034A1.68A0000000PUSH0A0
004034A6.6848214000PUSHPYG.00402148
004034AB.53PUSHEBX
004034AC.50PUSHEAX
004034AD.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004034B3>C745AC010000>MOVDWORDPTRSS:[EBP-54],1
004034BA.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
004034C1.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
004034C4.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
004034CB.8945BCMOVDWORDPTRSS:[EBP-44],EAX
004034CE.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
004034D5.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
004034D8.52PUSHEDX
004034D9.6A0BPUSH0B
004034DB.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
004034DE.50PUSHEAX
004034DF.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
004034E2.51PUSHECX
004034E3.FFD6CALLESI
004034E5.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
004034E8.52PUSHEDX
004034E9.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
004034EC.50PUSHEAX
004034ED.FFD7CALLEDI
004034EF.50PUSHEAX
004034F0.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
004034F6.33DBXOREBX,EBX
004034F8.66:3D7000CMPAX,70;第十一位与p比较
004034FC.0F94C3SETEBL
004034FF.F7DBNEGEBX
00403501.8D4DDCLEAECX,DWORDPTRSS:[EBP-24]
00403504.FF15AC104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
0040350A.8D4DD0LEAECX,DWORDPTRSS:[EBP-30]
0040350D.FF15A8104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
00403513.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
00403516.51PUSHECX
00403517.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
0040351A.52PUSHEDX
0040351B.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
0040351E.50PUSHEAX
0040351F.6A03PUSH3
00403521.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
00403527.83C410ADDESP,10
0040352A.66:85DBTESTBX,BX
0040352D0F846E060000JEPYG.00403BA1;不等跳!
00403533.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00403536.8B08MOVECX,DWORDPTRDS:[EAX]
00403538.50PUSHEAX
00403539.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
0040353F.50PUSHEAX
00403540.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00403543.52PUSHEDX
00403544.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
0040354A.8BD8MOVEBX,EAX
0040354C.8B03MOVEAX,DWORDPTRDS:[EBX]
0040354E.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
00403551.51PUSHECX
00403552.53PUSHEBX
00403553.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
00403559.DBE2FCLEX
0040355B.85C0TESTEAX,EAX
0040355D.7D12JGESHORTPYG.00403571
0040355F.68A0000000PUSH0A0
00403564.6848214000PUSHPYG.00402148
00403569.53PUSHEBX
0040356A.50PUSHEAX
0040356B.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00403571>8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00403574.8B10MOVEDX,DWORDPTRDS:[EAX]
00403576.50PUSHEAX
00403577.FF9200030000CALLDWORDPTRDS:[EDX+300]
0040357D.50PUSHEAX
0040357E.8D45CCLEAEAX,DWORDPTRSS:[EBP-34]
00403581.50PUSHEAX
00403582.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00403588.8BD8MOVEBX,EAX
0040358A.8B0BMOVECX,DWORDPTRDS:[EBX]
0040358C.8D55D8LEAEDX,DWORDPTRSS:[EBP-28]
0040358F.52PUSHEDX
00403590.53PUSHEBX
00403591.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
00403597.DBE2FCLEX
00403599.85C0TESTEAX,EAX
0040359B.7D12JGESHORTPYG.004035AF
0040359D.68A0000000PUSH0A0
004035A2.6848214000PUSHPYG.00402148
004035A7.53PUSHEBX
004035A8.50PUSHEAX
004035A9.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004035AF>BB01000000MOVEBX,1
004035B4.895DACMOVDWORDPTRSS:[EBP-54],EBX
004035B7.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
004035BE.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
004035C1.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
004035C8.8945BCMOVDWORDPTRSS:[EBP-44],EAX
004035CB.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
004035D2.8D45A4LEAEAX,DWORDPTRSS:[EBP-5C]
004035D5.50PUSHEAX
004035D6.6A0CPUSH0C
004035D8.8D4DB4LEAECX,DWORDPTRSS:[EBP-4C]
004035DB.51PUSHECX
004035DC.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
004035DF.52PUSHEDX
004035E0.FFD6CALLESI
004035E2.899D7CFFFFFFMOVDWORDPTRSS:[EBP-84],EBX
004035E8.C78574FFFFFF>MOVDWORDPTRSS:[EBP-8C],2
004035F2.8B45D8MOVEAX,DWORDPTRSS:[EBP-28]
004035F5.C745D8000000>MOVDWORDPTRSS:[EBP-28],0
004035FC.89458CMOVDWORDPTRSS:[EBP-74],EAX
004035FF.C74584080000>MOVDWORDPTRSS:[EBP-7C],8
00403606.8D8574FFFFFFLEAEAX,DWORDPTRSS:[EBP-8C]
0040360C.50PUSHEAX
0040360D.6A06PUSH6
0040360F.8D4D84LEAECX,DWORDPTRSS:[EBP-7C]
00403612.51PUSHECX
00403613.8D9564FFFFFFLEAEDX,DWORDPTRSS:[EBP-9C]
00403619.52PUSHEDX
0040361A.FFD6CALLESI
0040361C.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
00403622.50PUSHEAX
00403623.8D4DD4LEAECX,DWORDPTRSS:[EBP-2C]
00403626.51PUSHECX
00403627.FFD7CALLEDI
00403629.50PUSHEAX
0040362A.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00403630.66:8BD8MOVBX,AX
00403633.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00403636.52PUSHEDX
00403637.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
0040363A.50PUSHEAX
0040363B.FFD7CALLEDI
0040363D.50PUSHEAX
0040363E.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00403644.33C9XORECX,ECX
00403646.66:3BC3CMPAX,BX;第十二位与用户名第6位比较
00403649.0F94C1SETECL
0040364C.F7D9NEGECX
0040364E.8BD9MOVEBX,ECX
00403650.8D55D4LEAEDX,DWORDPTRSS:[EBP-2C]
00403653.52PUSHEDX
00403654.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00403657.50PUSHEAX
00403658.6A02PUSH2
0040365A.FF1584104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
00403660.8D4DCCLEAECX,DWORDPTRSS:[EBP-34]
00403663.51PUSHECX
00403664.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00403667.52PUSHEDX
00403668.6A02PUSH2
0040366A.FF1514104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObjList
00403670.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
00403676.50PUSHEAX
00403677.8D8D74FFFFFFLEAECX,DWORDPTRSS:[EBP-8C]
0040367D.51PUSHECX
0040367E.8D5584LEAEDX,DWORDPTRSS:[EBP-7C]
00403681.52PUSHEDX
00403682.8D4594LEAEAX,DWORDPTRSS:[EBP-6C]
00403685.50PUSHEAX
00403686.8D4DA4LEAECX,DWORDPTRSS:[EBP-5C]
00403689.51PUSHECX
0040368A.8D55B4LEAEDX,DWORDPTRSS:[EBP-4C]
0040368D.52PUSHEDX
0040368E.6A06PUSH6
00403690.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
00403696.83C434ADDESP,34
00403699.66:85DBTESTBX,BX
0040369C0F84FF040000JEPYG.00403BA1;不等跳!
004036A2.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
004036A5.8B08MOVECX,DWORDPTRDS:[EAX]
004036A7.50PUSHEAX
004036A8.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
004036AE.50PUSHEAX
004036AF.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
004036B2.52PUSHEDX
004036B3.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004036B9.8BD8MOVEBX,EAX
004036BB.8B03MOVEAX,DWORDPTRDS:[EBX]
004036BD.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
004036C0.51PUSHECX
004036C1.53PUSHEBX
004036C2.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
004036C8.DBE2FCLEX
004036CA.85C0TESTEAX,EAX
004036CC.7D12JGESHORTPYG.004036E0
004036CE.68A0000000PUSH0A0
004036D3.6848214000PUSHPYG.00402148
004036D8.53PUSHEBX
004036D9.50PUSHEAX
004036DA.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004036E0>C745AC010000>MOVDWORDPTRSS:[EBP-54],1
004036E7.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
004036EE.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
004036F1.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
004036F8.8945BCMOVDWORDPTRSS:[EBP-44],EAX
004036FB.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
00403702.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
00403705.52PUSHEDX
00403706.6A0DPUSH0D
00403708.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
0040370B.50PUSHEAX
0040370C.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
0040370F.51PUSHECX
00403710.FFD6CALLESI
00403712.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00403715.52PUSHEDX
00403716.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00403719.50PUSHEAX
0040371A.FFD7CALLEDI
0040371C.50PUSHEAX
0040371D.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00403723.33DBXOREBX,EBX
00403725.66:3D7900CMPAX,79;第十三位与y比较
00403729.0F94C3SETEBL
0040372C.F7DBNEGEBX
0040372E.8D4DDCLEAECX,DWORDPTRSS:[EBP-24]
00403731.FF15AC104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
00403737.8D4DD0LEAECX,DWORDPTRSS:[EBP-30]
0040373A.FF15A8104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
00403740.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
00403743.51PUSHECX
00403744.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
00403747.52PUSHEDX
00403748.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
0040374B.50PUSHEAX
0040374C.6A03PUSH3
0040374E.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
00403754.83C410ADDESP,10
00403757.66:85DBTESTBX,BX
0040375A0F8441040000JEPYG.00403BA1;不等跳!
00403760.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
00403763.8B08MOVECX,DWORDPTRDS:[EAX]
00403765.50PUSHEAX
00403766.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
0040376C.50PUSHEAX
0040376D.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00403770.52PUSHEDX
00403771.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
00403777.8BD8MOVEBX,EAX
00403779.8B03MOVEAX,DWORDPTRDS:[EBX]
0040377B.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
0040377E.51PUSHECX
0040377F.53PUSHEBX
00403780.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
00403786.DBE2FCLEX
00403788.85C0TESTEAX,EAX
0040378A.7D12JGESHORTPYG.0040379E
0040378C.68A0000000PUSH0A0
00403791.6848214000PUSHPYG.00402148
00403796.53PUSHEBX
00403797.50PUSHEAX
00403798.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
0040379E>8B4508MOVEAX,DWORDPTRSS:[EBP+8]
004037A1.8B10MOVEDX,DWORDPTRDS:[EAX]
004037A3.50PUSHEAX
004037A4.FF9200030000CALLDWORDPTRDS:[EDX+300]
004037AA.50PUSHEAX
004037AB.8D45CCLEAEAX,DWORDPTRSS:[EBP-34]
004037AE.50PUSHEAX
004037AF.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004037B5.8BD8MOVEBX,EAX
004037B7.8B0BMOVECX,DWORDPTRDS:[EBX]
004037B9.8D55D8LEAEDX,DWORDPTRSS:[EBP-28]
004037BC.52PUSHEDX
004037BD.53PUSHEBX
004037BE.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
004037C4.DBE2FCLEX
004037C6.85C0TESTEAX,EAX
004037C8.7D12JGESHORTPYG.004037DC
004037CA.68A0000000PUSH0A0
004037CF.6848214000PUSHPYG.00402148
004037D4.53PUSHEBX
004037D5.50PUSHEAX
004037D6.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004037DC>BB01000000MOVEBX,1
004037E1.895DACMOVDWORDPTRSS:[EBP-54],EBX
004037E4.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
004037EB.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
004037EE.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
004037F5.8945BCMOVDWORDPTRSS:[EBP-44],EAX
004037F8.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
004037FF.8D45A4LEAEAX,DWORDPTRSS:[EBP-5C]
00403802.50PUSHEAX
00403803.6A0EPUSH0E
00403805.8D4DB4LEAECX,DWORDPTRSS:[EBP-4C]
00403808.51PUSHECX
00403809.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
0040380C.52PUSHEDX
0040380D.FFD6CALLESI
0040380F.899D7CFFFFFFMOVDWORDPTRSS:[EBP-84],EBX
00403815.C78574FFFFFF>MOVDWORDPTRSS:[EBP-8C],2
0040381F.8B45D8MOVEAX,DWORDPTRSS:[EBP-28]
00403822.C745D8000000>MOVDWORDPTRSS:[EBP-28],0
00403829.89458CMOVDWORDPTRSS:[EBP-74],EAX
0040382C.C74584080000>MOVDWORDPTRSS:[EBP-7C],8
00403833.8D8574FFFFFFLEAEAX,DWORDPTRSS:[EBP-8C]
00403839.50PUSHEAX
0040383A.6A07PUSH7
0040383C.8D4D84LEAECX,DWORDPTRSS:[EBP-7C]
0040383F.51PUSHECX
00403840.8D9564FFFFFFLEAEDX,DWORDPTRSS:[EBP-9C]
00403846.52PUSHEDX
00403847.FFD6CALLESI
00403849.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
0040384F.50PUSHEAX
00403850.8D4DD4LEAECX,DWORDPTRSS:[EBP-2C]
00403853.51PUSHECX
00403854.FFD7CALLEDI
00403856.50PUSHEAX
00403857.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
0040385D.66:8BD8MOVBX,AX
00403860.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00403863.52PUSHEDX
00403864.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00403867.50PUSHEAX
00403868.FFD7CALLEDI
0040386A.50PUSHEAX
0040386B.FF1518104000CALLDWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00403871.33C9XORECX,ECX
00403873.66:3BC3CMPAX,BX;第十四位注册码与第七位用户名比较
00403876.0F94C1SETECL
00403879.F7D9NEGECX
0040387B.8BD9MOVEBX,ECX
0040387D.8D55D4LEAEDX,DWORDPTRSS:[EBP-2C]
00403880.52PUSHEDX
00403881.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00403884.50PUSHEAX
00403885.6A02PUSH2
00403887.FF1584104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
0040388D.8D4DCCLEAECX,DWORDPTRSS:[EBP-34]
00403890.51PUSHECX
00403891.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00403894.52PUSHEDX
00403895.6A02PUSH2
00403897.FF1514104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObjList
0040389D.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
004038A3.50PUSHEAX
004038A4.8D8D74FFFFFFLEAECX,DWORDPTRSS:[EBP-8C]
004038AA.51PUSHECX
004038AB.8D5584LEAEDX,DWORDPTRSS:[EBP-7C]
004038AE.52PUSHEDX
004038AF.8D4594LEAEAX,DWORDPTRSS:[EBP-6C]
004038B2.50PUSHEAX
004038B3.8D4DA4LEAECX,DWORDPTRSS:[EBP-5C]
004038B6.51PUSHECX
004038B7.8D55B4LEAEDX,DWORDPTRSS:[EBP-4C]
004038BA.52PUSHEDX
004038BB.6A06PUSH6
004038BD.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
004038C3.83C434ADDESP,34
004038C6.66:85DBTESTBX,BX
004038C90F84D2020000JEPYG.00403BA1;不等跳!
004038CF.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
004038D2.8B08MOVECX,DWORDPTRDS:[EAX]
004038D4.50PUSHEAX
004038D5.FF91FC020000CALLDWORDPTRDS:[ECX+2FC]
004038DB.50PUSHEAX
004038DC.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
004038DF.52PUSHEDX
004038E0.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004038E6.8BD8MOVEBX,EAX
004038E8.8B03MOVEAX,DWORDPTRDS:[EBX]
004038EA.8D4DE0LEAECX,DWORDPTRSS:[EBP-20]
004038ED.51PUSHECX
004038EE.53PUSHEBX
004038EF.FF90A0000000CALLDWORDPTRDS:[EAX+A0]
004038F5.DBE2FCLEX
004038F7.85C0TESTEAX,EAX
004038F9.7D12JGESHORTPYG.0040390D
004038FB.68A0000000PUSH0A0
00403900.6848214000PUSHPYG.00402148
00403905.53PUSHEBX
00403906.50PUSHEAX
00403907.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
0040390D>C745AC010000>MOVDWORDPTRSS:[EBP-54],1
00403914.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
0040391B.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
0040391E.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
00403925.8945BCMOVDWORDPTRSS:[EBP-44],EAX
00403928.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
0040392F.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
00403932.52PUSHEDX
00403933.6A0FPUSH0F
00403935.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
00403938.50PUSHEAX
00403939.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
0040393C.51PUSHECX
0040393D.FFD6CALLESI
0040393F.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00403942.52PUSHEDX
00403943.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00403946.50PUSHEAX
00403947.FFD7CALLEDI
00403949.50PUSHEAX
0040394A.8B1D18104000MOVEBX,DWORDPTRDS:[<&MSVBVM60.#516>];MSVBVM60.rtcAnsiValueBstr
00403950.FFD3CALLEBX;<&MSVBVM60.#516>
00403952.33C9XORECX,ECX
00403954.66:3D6700CMPAX,67;第十五位注册码与g比较
00403958.0F94C1SETECL
0040395B.F7D9NEGECX
0040395D.66:898D18FFFF>MOVWORDPTRSS:[EBP-E8],CX
00403964.8D4DDCLEAECX,DWORDPTRSS:[EBP-24]
00403967.FF15AC104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStr
0040396D.8D4DD0LEAECX,DWORDPTRSS:[EBP-30]
00403970.FF15A8104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObj
00403976.8D5594LEAEDX,DWORDPTRSS:[EBP-6C]
00403979.52PUSHEDX
0040397A.8D45A4LEAEAX,DWORDPTRSS:[EBP-5C]
0040397D.50PUSHEAX
0040397E.8D4DB4LEAECX,DWORDPTRSS:[EBP-4C]
00403981.51PUSHECX
00403982.6A03PUSH3
00403984.FF150C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeV>;MSVBVM60.__vbaFreeVarList
0040398A.83C410ADDESP,10
0040398D.66:83BD18FFFF>CMPWORDPTRSS:[EBP-E8],0
004039950F8406020000JEPYG.00403BA1;不等跳!
0040399B.8B4508MOVEAX,DWORDPTRSS:[EBP+8]
0040399E.8B10MOVEDX,DWORDPTRDS:[EAX]
004039A0.50PUSHEAX
004039A1.FF92FC020000CALLDWORDPTRDS:[EDX+2FC]
004039A7.50PUSHEAX
004039A8.8D45D0LEAEAX,DWORDPTRSS:[EBP-30]
004039AB.50PUSHEAX
004039AC.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004039B2.898520FFFFFFMOVDWORDPTRSS:[EBP-E0],EAX
004039B8.8B08MOVECX,DWORDPTRDS:[EAX]
004039BA.8D55E0LEAEDX,DWORDPTRSS:[EBP-20]
004039BD.52PUSHEDX
004039BE.50PUSHEAX
004039BF.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
004039C5.DBE2FCLEX
004039C7.85C0TESTEAX,EAX
004039C9.7D18JGESHORTPYG.004039E3
004039CB.68A0000000PUSH0A0
004039D0.6848214000PUSHPYG.00402148
004039D5.8B8D20FFFFFFMOVECX,DWORDPTRSS:[EBP-E0]
004039DB.51PUSHECX
004039DC.50PUSHEAX
004039DD.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
004039E3>8B4508MOVEAX,DWORDPTRSS:[EBP+8]
004039E6.8B10MOVEDX,DWORDPTRDS:[EAX]
004039E8.50PUSHEAX
004039E9.FF9200030000CALLDWORDPTRDS:[EDX+300]
004039EF.50PUSHEAX
004039F0.8D45CCLEAEAX,DWORDPTRSS:[EBP-34]
004039F3.50PUSHEAX
004039F4.FF152C104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaObjSe>;MSVBVM60.__vbaObjSet
004039FA.898518FFFFFFMOVDWORDPTRSS:[EBP-E8],EAX
00403A00.8B08MOVECX,DWORDPTRDS:[EAX]
00403A02.8D55D8LEAEDX,DWORDPTRSS:[EBP-28]
00403A05.52PUSHEDX
00403A06.50PUSHEAX
00403A07.FF91A0000000CALLDWORDPTRDS:[ECX+A0]
00403A0D.DBE2FCLEX
00403A0F.85C0TESTEAX,EAX
00403A11.7D18JGESHORTPYG.00403A2B
00403A13.68A0000000PUSH0A0
00403A18.6848214000PUSHPYG.00402148
00403A1D.8B8D18FFFFFFMOVECX,DWORDPTRSS:[EBP-E8]
00403A23.51PUSHECX
00403A24.50PUSHEAX
00403A25.FF1520104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaHresu>;MSVBVM60.__vbaHresultCheckObj
00403A2B>C745AC010000>MOVDWORDPTRSS:[EBP-54],1
00403A32.C745A4020000>MOVDWORDPTRSS:[EBP-5C],2
00403A39.8B45E0MOVEAX,DWORDPTRSS:[EBP-20]
00403A3C.C745E0000000>MOVDWORDPTRSS:[EBP-20],0
00403A43.8945BCMOVDWORDPTRSS:[EBP-44],EAX
00403A46.C745B4080000>MOVDWORDPTRSS:[EBP-4C],8
00403A4D.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
00403A50.52PUSHEDX
00403A51.6A10PUSH10
00403A53.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
00403A56.50PUSHEAX
00403A57.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
00403A5A.51PUSHECX
00403A5B.FFD6CALLESI
00403A5D.C7857CFFFFFF>MOVDWORDPTRSS:[EBP-84],1
00403A67.C78574FFFFFF>MOVDWORDPTRSS:[EBP-8C],2
00403A71.8B45D8MOVEAX,DWORDPTRSS:[EBP-28]
00403A74.C745D8000000>MOVDWORDPTRSS:[EBP-28],0
00403A7B.89458CMOVDWORDPTRSS:[EBP-74],EAX
00403A7E.C74584080000>MOVDWORDPTRSS:[EBP-7C],8
00403A85.8D9574FFFFFFLEAEDX,DWORDPTRSS:[EBP-8C]
00403A8B.52PUSHEDX
00403A8C.6A08PUSH8
00403A8E.8D4584LEAEAX,DWORDPTRSS:[EBP-7C]
00403A91.50PUSHEAX
00403A92.8D8D64FFFFFFLEAECX,DWORDPTRSS:[EBP-9C]
00403A98.51PUSHECX
00403A99.FFD6CALLESI
00403A9B.8D9564FFFFFFLEAEDX,DWORDPTRSS:[EBP-9C]
00403AA1.52PUSHEDX
00403AA2.8D45D4LEAEAX,DWORDPTRSS:[EBP-2C]
00403AA5.50PUSHEAX
00403AA6.FFD7CALLEDI
00403AA8.50PUSHEAX
00403AA9.FFD3CALLEBX
00403AAB.66:8BF0MOVSI,AX
00403AAE.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
00403AB1.51PUSHECX
00403AB2.8D55DCLEAEDX,DWORDPTRSS:[EBP-24]
00403AB5.52PUSHEDX
00403AB6.FFD7CALLEDI
00403AB8.50PUSHEAX
00403AB9.FFD3CALLEBX
00403ABB.33C9XORECX,ECX
00403ABD.66:3BC6CMPAX,SI;第十六位与第八位用户名比较
00403AC0.0F94C1SETECL
00403AC3.F7D9NEGECX
00403AC5.8BF1MOVESI,ECX
00403AC7.8D55D4LEAEDX,DWORDPTRSS:[EBP-2C]
00403ACA.52PUSHEDX
00403ACB.8D45DCLEAEAX,DWORDPTRSS:[EBP-24]
00403ACE.50PUSHEAX
00403ACF.6A02PUSH2
00403AD1.FF1584104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeS>;MSVBVM60.__vbaFreeStrList
00403AD7.8D4DCCLEAECX,DWORDPTRSS:[EBP-34]
00403ADA.51PUSHECX
00403ADB.8D55D0LEAEDX,DWORDPTRSS:[EBP-30]
00403ADE.52PUSHEDX
00403ADF.6A02PUSH2
00403AE1.FF1514104000CALLDWORDPTRDS:[<&MSVBVM60.__vbaFreeO>;MSVBVM60.__vbaFreeObjList
00403AE7.8D8564FFFFFFLEAEAX,DWORDPTRSS:[EBP-9C]
00403AED.50PUSHEAX
00403AEE.8D8D74FFFFFFLEAECX,DWORDPTRSS:[EBP-8C]
00403AF4.51PUSHECX
00403AF5.8D5584LEAEDX,DWORDPTRSS:[EBP-7C]
00403AF8.52PUSHEDX
00403AF9.8D4594LEAEAX,DWORDPTRSS:[EBP-6C]
00403AFC.50PUSHEAX
00403AFD.8D4DA4LEAECX,DWORDPTRSS:[EBP-5C]
00403B00.51PUSHECX
00403B01.8D55B4LEAEDX,DWORDPTRSS:[EBP-4C]
00403B04.52PUSHEDX
00403B05.6A06PUSH6
00403B07.8B3D0C104000MOVEDI,DWORDPTRDS:[<&MSVBVM60.__vbaFr>;MSVBVM60.__vbaFreeVarList
00403B0D.FFD7CALLEDI;<&MSVBVM60.__vbaFreeVarList>
00403B0F.83C434ADDESP,34
00403B12.66:85F6TESTSI,SI
00403B150F8486000000JEPYG.00403BA1;不等跳!
00403B1B.B804000280MOVEAX,80020004
00403B20.89458CMOVDWORDPTRSS:[EBP-74],EAX
00403B23.B90A000000MOVECX,0A
00403B28.894D84MOVDWORDPTRSS:[EBP-7C],ECX
00403B2B.89459CMOVDWORDPTRSS:[EBP-64],EAX
00403B2E.894D94MOVDWORDPTRSS:[EBP-6C],ECX
00403B31.C7854CFFFFFF>MOVDWORDPTRSS:[EBP-B4],PYG.00402184;UNICODE"Good,YouDidIt"
00403B3B.BB08000000MOVEBX,8
00403B40.899D44FFFFFFMOVDWORDPTRSS:[EBP-BC],EBX
00403B46.8D9544FFFFFFLEAEDX,DWORDPTRSS:[EBP-BC]
00403B4C.8D4DA4LEAECX,DWORDPTRSS:[EBP-5C]
00403B4F.8B3594104000MOVESI,DWORDPTRDS:[<&MSVBVM60.__vbaVa>;MSVBVM60.__vbaVarDup
00403B55.FFD6CALLESI;<&MSVBVM60.__vbaVarDup>
00403B57.C7855CFFFFFF>MOVDWORDPTRSS:[EBP-A4],PYG.0040215C;UNICODE"Congratulations!"
00403B61.899D54FFFFFFMOVDWORDPTRSS:[EBP-AC],EBX
00403B67.8D9554FFFFFFLEAEDX,DWORDPTRSS:[EBP-AC]
00403B6D.8D4DB4LEAECX,DWORDPTRSS:[EBP-4C]
00403B70.FFD6CALLESI
00403B72.8D4584LEAEAX,DWORDPTRSS:[EBP-7C]
00403B75.50PUSHEAX
00403B76.8D4D94LEAECX,DWORDPTRSS:[EBP-6C]
00403B79.51PUSHECX
00403B7A.8D55A4LEAEDX,DWORDPTRSS:[EBP-5C]
00403B7D.52PUSHEDX
00403B7E.6A40PUSH40
00403B80.8D45B4LEAEAX,DWORDPTRSS:[EBP-4C]
00403B83.50PUSHEAX
00403B84.FF1534104000CALLDWORDPTRDS:[<&MSVBVM60.#595>];MSVBVM60.rtcMsgBox


3、注册码汇总

(1)用户名不能小于8位,注册码不能小于16位,但只验证注册码前16位
(2)如果我用户名为busheler注册码应该是这样:


13579111315
chinapyg====>chinapyg


246810121416
busheler====>busheler


合并后:

用户名:busheler
注册码:cbhuisnhaeplyegr

注册机应该很容易做的了。


四、总结

注册码算法及比较慢创意,值得学习!

-----------------------------------------------------------------------
【版权声明】交流学习,非商业应用,转载时请保证其完整!

所上传文件
crackme_code by 飘云[pyg].rar

TOP

发新话题