00497A10 . 55 PUSH EBP
00497A11 . 8BEC MOV EBP,ESP
00497A13 . 33C9 XOR ECX,ECX
00497A15 . 51 PUSH ECX
00497A16 . 51 PUSH ECX
00497A17 . 51 PUSH ECX
00497A18 . 51 PUSH ECX
00497A19 . 53 PUSH EBX
00497A1A . 56 PUSH ESI
00497A1B . 57 PUSH EDI
00497A1C . 8BD8 MOV EBX,EAX
00497A1E . 33C0 XOR EAX,EAX
00497A20 . 55 PUSH EBP
00497A21 . 68 247B4900 PUSH _nettv.00497B24
00497A26 . 64:FF30 PUSH DWORD PTR FS:[EAX]
00497A29 . 64:8920 MOV DWORD PTR FS:[EAX],ESP
00497A2C . 33D2 XOR EDX,EDX
00497A2E . 55 PUSH EBP
00497A2F . 68 E47A4900 PUSH _nettv.00497AE4
00497A34 . 64:FF32 PUSH DWORD PTR FS:[EDX]
00497A37 . 64:8922 MOV DWORD PTR FS:[EDX],ESP
00497A3A . 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-8]
00497A3D . 8B83 E0020000 MOV EAX,DWORD PTR DS:[EBX+2E0]
00497A43 . E8 D44BF9FF CALL _nettv.0042C61C ; 名字长度
00497A48 . 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; 输入的名字
00497A4B . 8D55 FC LEA EDX,DWORD PTR SS:[EBP-4]
00497A4E . E8 B90AF7FF CALL _nettv.0040850C
00497A53 . 837D FC 00 CMP DWORD PTR SS:[EBP-4],0 ; 输入名字了吗?
00497A57 . 75 18 JNZ SHORT _nettv.00497A71
00497A59 . A1 50A84900 MOV EAX,DWORD PTR DS:[49A850] ;
00497A5E . 8B00 MOV EAX,DWORD PTR DS:[EAX]
00497A60 . E8 D3FDFAFF CALL _nettv.00447838 ; 输入名字空时在标题上显示未注册
00497A65 . A1 C0B94900 MOV EAX,DWORD PTR DS:[49B9C0]
00497A6A . E8 C1FDFAFF CALL _nettv.00447830
00497A6F . EB 69 JMP SHORT _nettv.00497ADA
00497A71 > 8D55 F0 LEA EDX,DWORD PTR SS:[EBP-10]
00497A74 . 8B83 E4020000 MOV EAX,DWORD PTR DS:[EBX+2E4]
00497A7A . E8 9D4BF9FF CALL _nettv.0042C61C ; 注册码长度
00497A7F . 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] ; 输入的注册码
00497A82 . 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
00497A85 . E8 820AF7FF CALL _nettv.0040850C
00497A8A . 837D F4 00 CMP DWORD PTR SS:[EBP-C],0 ; 输入注册码了吗?
00497A8E 75 18 JNZ SHORT _nettv.00497AA8
00497A90 . A1 50A84900 MOV EAX,DWORD PTR DS:[49A850]
00497A95 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
00497A97 . E8 9CFDFAFF CALL _nettv.00447838 ; 没输注册码时,标题上显示未注册
00497A9C . A1 C0B94900 MOV EAX,DWORD PTR DS:[49B9C0]
00497AA1 . E8 8AFDFAFF CALL _nettv.00447830
00497AA6 . EB 32 JMP SHORT _nettv.00497ADA
00497AA8 > 8BC3 MOV EAX,EBX
00497AAA . E8 25020000 CALL _nettv.00497CD4 ; 名字与注册码运算,注册算法核心,见下
00497AAF . 84C0 TEST AL,AL ; 判断注册是否成功AL非0成功,0失败
00497AB1 . 74 09 JE SHORT _nettv.00497ABC
00497AB3 . 8BC3 MOV EAX,EBX
00497AB5 . E8 7A000000 CALL _nettv.00497B34 ; 注册成功时将注册信息写入注册表
00497ABA . EB 1E JMP SHORT _nettv.00497ADA
00497ABC > B8 F4010000 MOV EAX,1F4
00497AC1 > 48 DEC EAX
00497AC2 .^75 FD JNZ SHORT _nettv.00497AC1
00497AC4 . A1 50A84900 MOV EAX,DWORD PTR DS:[49A850]
00497AC9 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
00497ACB . E8 68FDFAFF CALL _nettv.00447838
00497AD0 . A1 C0B94900 MOV EAX,DWORD PTR DS:[49B9C0]
00497AD5 . E8 56FDFAFF CALL _nettv.00447830
00497ADA > 33C0 XOR EAX,EAX
00497ADC . 5A POP EDX
00497ADD . 59 POP ECX
00497ADE . 59 POP ECX
00497ADF . 64:8910 MOV DWORD PTR FS:[EAX],EDX
00497AE2 . EB 12 JMP SHORT _nettv.00497AF6
00497AE4 .^E9 D7B7F6FF JMP _nettv.004032C0
00497AE9 . B8 F4010000 MOV EAX,1F4
00497AEE > 48 DEC EAX
00497AEF .^75 FD JNZ SHORT _nettv.00497AEE
00497AF1 . E8 26BBF6FF CALL _nettv.0040361C
00497AF6 > 33C0 XOR EAX,EAX
00497AF8 . 5A POP EDX
00497AF9 . 59 POP ECX
00497AFA . 59 POP ECX
00497AFB . 64:8910 MOV DWORD PTR FS:[EAX],EDX
00497AFE . 68 2B7B4900 PUSH _nettv.00497B2B
00497B03 > 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
00497B06 . E8 D1BFF6FF CALL _nettv.00403ADC
00497B0B . 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
00497B0E . E8 C9BFF6FF CALL _nettv.00403ADC
00497B13 . 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
00497B16 . E8 C1BFF6FF CALL _nettv.00403ADC
00497B1B . 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
00497B1E . E8 B9BFF6FF CALL _nettv.00403ADC
00497B23 . C3 RETN
注册算法核心如下:
00497CD4 /$ 55 PUSH EBP
00497CD5 |. 8BEC MOV EBP,ESP
00497CD7 |. 83C4 E8 ADD ESP,-18
00497CDA |. 53 PUSH EBX
00497CDB |. 56 PUSH ESI
00497CDC |. 33D2 XOR EDX,EDX
00497CDE |. 8955 E8 MOV DWORD PTR SS:[EBP-18],EDX
00497CE1 |. 8955 EC MOV DWORD PTR SS:[EBP-14],EDX
00497CE4 |. 8955 F4 MOV DWORD PTR SS:[EBP-C],EDX
00497CE7 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
00497CEA |. 33C0 XOR EAX,EAX
00497CEC |. 55 PUSH EBP
00497CED |. 68 D37D4900 PUSH _nettv.00497DD3
00497CF2 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00497CF5 |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
00497CF8 |. 33DB XOR EBX,EBX ;EBX清零,做为结果存放用的
00497CFA |. 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
00497CFD |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00497D00 |. 8B80 E0020000 MOV EAX,DWORD PTR DS:[EAX+2E0]
00497D06 |. E8 1149F9FF CALL _nettv.0042C61C ;返回EAX为字串长度
00497D0B |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] ;将名字赋给EAX
00497D0E |. E8 49C0F6FF CALL _nettv.00403D5C ;获取字串长度
00497D13 |. 8BF0 MOV ESI,EAX
00497D15 |. 85F6 TEST ESI,ESI ;判断长度
00497D17 |. 7E 38 JLE SHORT _nettv.00497D51
00497D19 |. C745 F0 010000>MOV DWORD PTR SS:[EBP-10],1
00497D20 |> 8D45 EC
/LEA
EAX,DWORD PTR SS:[EBP-14] ;下面依次取名字字串字符运算
00497D23 |. 50 |PUSH EAX
00497D24 |. B9 01000000 |MOV ECX,1 ;每次取1个
00497D29 |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10] ;第i个
00497D2C |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C] ;将名字赋给EAX
00497D2F |. E8 30C2F6FF |CALL _nettv.00403F64 ;取名字字串第i个字符,每次取1个
00497D34 |. 8B45 EC |MOV EAX,DWORD PTR SS:[EBP-14] ;名字字串的第i个字符存放的内存
00497D37 |. E8 E4C1F6FF |CALL _nettv.00403F20 ;判断第i个字符
00497D3C |. 8A00 |MOV AL,BYTE PTR DS:[EAX] ;从内存中取出第i个值赋给AL
00497D3E |. 25 FF000000 |AND EAX,0FF ;EAX&=0xff;将AL值赋给EAX
00497D43 |. 03D8 |ADD EBX,EAX ;用字符的值累加更新EBX的值
00497D45 |. 81F3 05FA0B00 |XOR EBX,0BFA05 ;EBX^=0xBFA05;
00497D4B |. FF45 F0 |INC DWORD PTR SS:[EBP-10] ;i++;
00497D4E |. 4E |DEC ESI ;判断循环是否结束
00497D4F |.^75 CF \JNZ SHORT _nettv.00497D20
00497D51 |> A1 CCB94900 MOV EAX,DWORD PTR DS:[49B9CC] ;一个固定的值为0x2977537
00497D56 |. 8BD0 MOV EDX,EAX
00497D58 |. C1E0 04 SHL EAX,4 ;2977537左移四位
00497D5B |. 03C2 ADD EAX,EDX ;EAX=2977537+(2977537<<4)
00497D5D |. 03D8 ADD EBX,EAX ;EBX=字串运算结果+EAX
00497D5F |. 81C3 D4A31300 ADD EBX,13A3D4 ;EBX+=0x13a3d4
00497D65 |. 81F3 8DED5900 XOR EBX,59ED8D ;EBX^=0x59ED8D
00497D6B |. 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
00497D6E |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00497D71 |. 8B80 E4020000 MOV EAX,DWORD PTR DS:[EAX+2E4]
00497D77 |. E8 A048F9FF CALL _nettv.0042C61C ;返回EAX为注册码长度
00497D7C |. 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-18] ;注册码赋给EAX
00497D7F |. E8 1C09F7FF CALL _nettv.004086A0 ;注册码10进制数转化成16进制数赋给EAX
00497D84 |. 8BF3 MOV ESI,EBX
00497D86 |. 81F6 2473C400 XOR ESI,0C47324 ;ESI=名字运算结果^0xC47324;
00497D8C |. 3BC6 CMP EAX,ESI ;注册码与名字运算结果比较
00497D8E |. 75 19 JNZ SHORT _nettv.00497DA9 ;相等注册成功;
00497D90 |. C645 FB 01 MOV BYTE PTR SS:[EBP-5],1
00497D94 |. B8 C4B94900 MOV EAX,_nettv.0049B9C4
00497D99 |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
00497D9C |. E8 8FBDF6FF CALL _nettv.00403B30
00497DA1 |. 8935 C8B94900 MOV DWORD PTR DS:[49B9C8],ESI
00497DA7 |. EB 04 JMP SHORT _nettv.00497DAD
00497DA9 |> C645 FB 00 MOV BYTE PTR SS:[EBP-5],0
00497DAD |> 33C0 XOR EAX,EAX
00497DAF |. 5A POP EDX
00497DB0 |. 59 POP ECX
00497DB1 |. 59 POP ECX
00497DB2 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
00497DB5 |. 68 DA7D4900 PUSH _nettv.00497DDA
00497DBA |> 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
00497DBD |. E8 1ABDF6FF CALL _nettv.00403ADC
00497DC2 |. 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
00497DC5 |. E8 12BDF6FF CALL _nettv.00403ADC
00497DCA |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
00497DCD |. E8 0ABDF6FF CALL _nettv.00403ADC
00497DD2 \. C3 RETN
00497DD3 .^E9 9CB7F6FF JMP _nettv.00403574
00497DD8 .^EB E0 JMP SHORT _nettv.00497DBA
00497DDA . 8A45 FB MOV AL,BYTE PTR SS:[EBP-5]
00497DDD . 5E POP ESI
00497DDE . 5B POP EBX
00497DDF . 8BE5 MOV ESP,EBP
00497DE1 . 5D POP EBP
00497DE2 . C3 RETN
下面函数为写入注册表部分
00497B34 /$ 55 PUSH EBP
00497B35 |. 8BEC MOV EBP,ESP
00497B37 |. 33C9 XOR ECX,ECX
00497B39 |. 51 PUSH ECX
00497B3A |. 51 PUSH ECX
00497B3B |. 51 PUSH ECX
00497B3C |. 51 PUSH ECX
00497B3D |. 53 PUSH EBX
00497B3E |. 56 PUSH ESI
00497B3F |. 57 PUSH EDI
00497B40 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
00497B43 |. 33C0 XOR EAX,EAX
00497B45 |. 55 PUSH EBP
00497B46 |. 68 497C4900 PUSH _nettv.00497C49
00497B4B |. 64:FF30 PUSH DWORD PTR FS:[EAX]
00497B4E |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
00497B51 |. B2 01 MOV DL,1
00497B53 |. A1 B8BB4400 MOV EAX,DWORD PTR DS:[44BBB8]
00497B58 |. E8 5B41FBFF CALL _nettv.0044BCB8
00497B5D |. 8BF8 MOV EDI,EAX
00497B5F |. BA 01000080 MOV EDX,80000001
00497B64 |. 8BC7 MOV EAX,EDI
00497B66 |. E8 ED41FBFF CALL _nettv.0044BD58
00497B6B |. B1 01 MOV CL,1
00497B6D |. BA 607C4900 MOV EDX,_nettv.00497C60 ; ASCII
"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Sysdisk"
写入注册表位置
00497B72 |. 8BC7 MOV EAX,EDI
00497B74 |. E8 4342FBFF CALL _nettv.0044BDBC
00497B79 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
00497B7C |. E8 5BBFF6FF CALL _nettv.00403ADC
00497B81 |. A1 C4B94900 MOV EAX,DWORD PTR DS:[49B9C4] ;注册输入的名字赋给EAX
00497B86 |. E8 D1C1F6FF CALL _nettv.00403D5C ;取注册名字的长度
00497B8B |. 8BD8 MOV EBX,EAX
00497B8D |. 85DB TEST EBX,EBX ;判断注册名字的长度是否大于0
00497B8F |. 7E 40 JLE SHORT _nettv.00497BD1
00497B91 |. BE 01000000 MOV ESI,1
00497B96 |> 8D45 F0
/LEA
EAX,DWORD PTR SS:[EBP-10] ;注册的名字在写入注册表前进行运算。
00497B99 |. 50 |PUSH EAX
00497B9A |. B9 01000000 |MOV ECX,1
00497B9F |. 8BD6 |MOV EDX,ESI
00497BA1 |. A1 C4B94900 |MOV EAX,DWORD PTR DS:[49B9C4] ;注册的名字赋给EAX
00497BA6 |. E8 B9C3F6FF |CALL _nettv.00403F64
00497BAB |. 8B45 F0 |MOV EAX,DWORD PTR SS:[EBP-10] ;EAX内存位置存放名字第EDX个字符
00497BAE |. E8 6DC3F6FF |CALL _nettv.00403F20
00497BB3 |. 33D2 |XOR EDX,EDX
00497BB5 |. 8A10 |MOV DL,BYTE PTR DS:[EAX] ;将第EDX个字符赋给DL
00497BB7 |. 83C2 05 |ADD EDX,5 ;EDX+=5;
00497BBA |. 8D45 F4 |LEA EAX,DWORD PTR SS:[EBP-C]
00497BBD |. E8 C2C0F6FF |CALL _nettv.00403C84
00497BC2 |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
00497BC5 |. 8D45 F8 |LEA EAX,DWORD PTR SS:[EBP-8]
00497BC8 |. E8 97C1F6FF |CALL _nettv.00403D64
00497BCD |. 46 |INC ESI
00497BCE |. 4B |DEC EBX
00497BCF |.^75 C5 \JNZ SHORT _nettv.00497B96
00497BD1 |> B8 C4B94900 MOV EAX,_nettv.0049B9C4
00497BD6 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ;名字变换后的字串赋给EDX
00497BD9 |. E8 52BFF6FF CALL _nettv.00403B30
00497BDE |. 8B0D C4B94900 MOV ECX,DWORD PTR DS:[49B9C4]
00497BE4 |. BA A47C4900 MOV EDX,_nettv.00497CA4 ; ASCII
"FN ame"
00497BE9 |. 8BC7 MOV EAX,EDI
00497BEB |. E8 6843FBFF CALL _nettv.0044BF58
00497BF0 |. 8B0D C8B94900 MOV ECX,DWORD PTR DS:[49B9C8]
00497BF6 |. 81F1 0AB30000 XOR ECX,0B30A ;注册码^0xB30A为写入的注册码
00497BFC |. BA B47C4900 MOV EDX,_nettv.00497CB4 ; ASCII
"FP ass"
00497C01 |. 8BC7 MOV EAX,EDI
00497C03 |. E8 F443FBFF CALL _nettv.0044BFFC
00497C08 |. 8BC7 MOV EAX,EDI
00497C0A |. E8 05B2F6FF CALL _nettv.00402E14 ;写入注册表
00497C0F |. A1 50A84900 MOV EAX,DWORD PTR DS:[49A850]
00497C14 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
00497C16 |. 8B80 D0020000 MOV EAX,DWORD PTR DS:[EAX+2D0]
00497C1C |. BA C47C4900 MOV EDX,_nettv.00497CC4
00497C21 |. E8 A266FDFF CALL _nettv.0046E2C8
00497C26 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00497C29 |. E8 B6010000 CALL _nettv.00497DE4
00497C2E |. 33C0 XOR EAX,EAX
00497C30 |. 5A POP EDX
00497C31 |. 59 POP ECX
00497C32 |. 59 POP ECX
00497C33 |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
00497C36 |. 68 507C4900 PUSH _nettv.00497C50
00497C3B |> 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
00497C3E |. BA 03000000 MOV EDX,3
00497C43 |. E8 B8BEF6FF CALL _nettv.00403B00
00497C48 \. C3 RETN
00497C49 .^E9 26B9F6FF JMP _nettv.00403574
00497C4E .^EB EB JMP SHORT _nettv.00497C3B