00401240 $ 68 00E04500 push CrackMe_.0045E000
00401245 .- E9 B6CD0400 jmp CrackMe_.0044E000

0044E029 FEC8 dec al
0044E02B C0C8 04 ror al,0x4
0044E02E C0C8 00 ror al,0x0
0044E031 C0C8 02 ror al,0x2
0044E034 F6D0 not al
0044E036 FEC8 dec al
0044E038 FEC8 dec al
0044E03A C0C8 0C ror al,0xC
0044E03D FEC8 dec al
0044E03F 80F0 0C xor al,0xC
0044E042 80F0 0A xor al,0xA
0044E045 F6D8 neg al
0044E047 FEC8 dec al
0044E049 80F0 07 xor al,0x7
0044E04C 80F0 01 xor al,0x1

0044FE99    8B0424          MOV EAX,DWORD PTR SS:[ESP] //[17F0E0] = 0 送 EAX
0044FEA9    8B8C24 04000000 MOV ECX,DWORD PTR SS:[ESP+4] //[17F0E4] = 0 送 ECX
0044FEFD    50              PUSH EAX
0044FED6    8B87 24000000   MOV EAX,DWORD PTR DS:[EDI+24] //5C 送 EAX
0044FEC4    8B0438          MOV EAX,DWORD PTR DS:[EDI+EAX] // 202 ->EAX 
0044FE79    50              PUSH EAX  -|
0044FEBD    9D              POPFD -----| 标志寄存器EFL初始化为202
0044FF04    50              PUSH EAX
0044FF0B    85C8            TEST EAX,ECX //如果序列号不对，两者都是0，ZF=1；否则，都是1， ZF=0
0044FE8D    8B87 24000000   MOV EAX,DWORD PTR DS:[EDI+24] 
0044FEB6    9C              PUSHFD // 这个很关键。保存判断后的EFL标志
/* 这里序列号不对， EFL =246 (ZF=1)；对的话 EFL = 202 (ZF=0) */

0044FECD    8F0438          POP DWORD PTR DS:[EDI+EAX] //将EFL（246）保存到[EDI+EAX]
/* 由于EAX是变量，所以保存的地址或许会不同；用内存断点搞它会很痛苦呵 */

0044EF72    8B0438          MOV EAX,DWORD PTR DS:[EDI+EAX] //将246 从[EDI+EAX]读出->eax
0044EF7B    50              PUSH EAX
0044EF82    9D              POPFD //映射到EFL标志
0044EF89    58              POP EAX //45E892 -> EAX
0044EFB7    0F443424        CMOVE ESI,DWORD PTR SS:[ESP] 
/* 如果序列号错误则条件满足，然后 [17F0E4]中的45E892 -> ESI；
序列号对的话，条件不满足， 还是原来的 ESI=45E838； */

BOOL Check(const char* pName, const char* pPassword)
{
	BOOL bret = FALSE;
	int nameLen = 0;
	int pawsswordlen = 0;
	
	__try
	{
		while(*(pName + nameLen))
		{
			++nameLen;
		}
		
		while(*(pPassword + pawsswordlen))
		{
			++pawsswordlen;
		}
		
		bret = (nameLen + pawsswordlen) / bret;
	}
	__except(1)
	{
		if (pName[0] == 'V' 
			&& pPassword[0] == 'C'
			&& pawsswordlen == (nameLen - pawsswordlen))
		{
			bret = TRUE;
			//return bret;
		}
		else
		{
			bret = FALSE;
		}
	}
	
	char szbuf[MAX_PATH] = {0};
	szbuf[0] = 'o';
	szbuf[1] = 'k';

	char szbuf2[MAX_PATH] = {0};
	szbuf2[0] = 'f';
	szbuf2[1] = 'a';
	szbuf2[2] = 'i';
	szbuf2[3] = 'l';

	if (bret)
	{
		::MessageBoxA(NULL, szbuf, szbuf, 0);
	}
	else
	{
		::MessageBoxA(NULL, szbuf2, szbuf2, 0);
	}

	return bret; 
}

void CCrackMeDlg::OnButton1() 
{
	// TODO: Add your control notification handler code here

	UpdateData();

	if (m_name.GetLength() == 0
		|| m_pwd.GetLength() == 0)
	{
		::MessageBoxA(NULL, "名字和密码不能为空", "名字和密码不能为空", 0);
	}
	else
	{
		if (Check(m_name, m_pwd))
		{
			
		}
		else
		{
			
		}
	}
}