0074994B 8B15 14737500 mov edx,dword ptr ds:[757314] ; servermo.00759294
00749951 8B12 mov edx,dword ptr ds:[edx]
00749953 E8 64E6E6FF call servermo.005B7FBC
00749958 8B45 CC mov eax,dword ptr ss:[ebp-34]
0074995B 50 push eax ; 38630A0882
0074995C 8D45 B8 lea eax,dword ptr ss:[ebp-48]
0074995F E8 E4E4E6FF call servermo.005B7E48
00749964 8B55 B8 mov edx,dword ptr ss:[ebp-48] ; S2A5AP4S 保存在数据库
00749967 8D45 BC lea eax,dword ptr ss:[ebp-44]
0074996A E8 F1AECBFF call servermo.00404860
0074996F 8B45 BC mov eax,dword ptr ss:[ebp-44] ; S2A5AP4S
00749972 8D4D C0 lea ecx,dword ptr ss:[ebp-40]
00749975 8B15 14737500 mov edx,dword ptr ds:[757314] ; servermo.00759294
0074997B 8B12 mov edx,dword ptr ds:[edx] ; 0600000025AE7B475B3FC8ED11E400D9C4C58F0D
0074997D E8 3AE6E6FF call servermo.005B7FBC
00749982 8B45 C0 mov eax,dword ptr ss:[ebp-40] ; 38630A0882
00749985 8D4D D0 lea ecx,dword ptr ss:[ebp-30]
00749988 5A pop edx ; 38630A0882
00749989 E8 66E8E6FF call servermo.005B81F4
0074998E 8B45 D0 mov eax,dword ptr ss:[ebp-30] ; 328868300AA003868823 机器码
00749991 8D4D D4 lea ecx,dword ptr ss:[ebp-2C]
00749994 8B15 14737500 mov edx,dword ptr ds:[757314] ; servermo.00759294
0074999A 8B12 mov edx,dword ptr ds:[edx] ; 0600000025AE7B475B3FC8ED11E400D9C4C58F0D
0074999C E8 1BE6E6FF call servermo.005B7FBC ; 找到生成下面那个号码的代码
007499A1 8B45 D4 mov eax,dword ptr ss:[ebp-2C] ; B7BF0E82C6 找到这个号那得的
007499A4 50 push eax ; B7BF0E82C6
007499A5 8D4D B4 lea ecx,dword ptr ss:[ebp-4C]
007499A8 8B15 14737500 mov edx,dword ptr ds:[757314] ; servermo.00759294
007499AE 8B12 mov edx,dword ptr ds:[edx] ; 0600000025AE7B475B3FC8ED11E400D9C4C58F0D
007499B0 A1 00737500 mov eax,dword ptr ds:[757300]
007499B5 8B00 mov eax,dword ptr ds:[eax]
007499B7 E8 00E6E6FF call servermo.005B7FBC
007499BC 8B45 B4 mov eax,dword ptr ss:[ebp-4C] ; 41A4003A1F 医院名称转换后的号码
007499BF 8D4D D8 lea ecx,dword ptr ss:[ebp-28]
007499C2 5A pop edx ; B7BF0E82C6 电脑中生成的随机号用于和医院名合并计算
007499C3 E8 2CE8E6FF call servermo.005B81F4
007499C8 8B45 D8 mov eax,dword ptr ss:[ebp-28] ; 461CA2480E003FAB17FB 合并后的号码用于生成注册码比对号
007499CB B9 05000000 mov ecx,5
007499D0 BA 0D000000 mov edx,0D ; 41A4003A1F 医院名称转换后的号码
007499D5 E8 1EB1CBFF call servermo.00404AF8
007499DA 8B45 DC mov eax,dword ptr ss:[ebp-24] ; 3FAB1 本机生成的新码用于数据库注册码比对
007499DD 8D55 E0 lea edx,dword ptr ss:[ebp-20]
007499E0 E8 C7DDE6FF call servermo.005B77AC
007499E5 8B45 E0 mov eax,dword ptr ss:[ebp-20] ; 050000005EBB32A85C1D0DDBAC1E20C19DD88F7A
007499E8 50 push eax ; 050000005EBB32A85C1D0DDBAC1E20C19DD88F7A
007499E9 8D55 A0 lea edx,dword ptr ss:[ebp-60] ; 3FAB1 本机生成的新码用于数据库注册码比对
007499EC A1 B0D87500 mov eax,dword ptr ds:[75D8B0]
007499F1 E8 DEDEE6FF call servermo.005B78D4
007499F6 8B4D A0 mov ecx,dword ptr ss:[ebp-60] ; 880714440EE8DB8C1ED53FFAF1A15623 数据库中保存的注册码
007499F9 8D45 A4 lea eax,dword ptr ss:[ebp-5C]
007499FC BA 749E7400 mov edx,servermo.00749E74 ; ASCII "10000000"
00749A01 E8 DEAECBFF call servermo.004048E4 ; 此CALL 给数据库中的注册码前面加10000000
00749A06 8B45 A4 mov eax,dword ptr ss:[ebp-5C] ; 10000000880714440EE8DB8C1ED53FFAF1A15623
00749A09 8D55 A8 lea edx,dword ptr ss:[ebp-58]
00749A0C E8 A7E0E6FF call servermo.005B7AB8
00749A11 8B45 A8 mov eax,dword ptr ss:[ebp-58] ; 35 注册码正确时是32
00749A14 8D4D AC lea ecx,dword ptr ss:[ebp-54]
00749A17 BA 01000000 mov edx,1 ; 10000000880714440EE8DB8C1ED53FFAF1A15623
00749A1C E8 77A8FEFF call servermo.00734298 ; 跟进去看看下面那个码如何计算
00749A21 8B45 AC mov eax,dword ptr ss:[ebp-54] ; 39A61 数据库中的注册码计算出来的号码
00749A24 8D55 B0 lea edx,dword ptr ss:[ebp-50]
00749A27 E8 38DCE6FF call servermo.005B7664
00749A2C 8B55 B0 mov edx,dword ptr ss:[ebp-50] ; 05000000B0CC841E48C30C805F8736740F8A3189 39A61计算出来的
00749A2F 58 pop eax ; 050000005EBB32A85C1D0DDBAC1E20C19DD88F7A 3FAB1计算出来的
00749A30 E8 AFAFCBFF call servermo.004049E4
00749A35 0F85 D3000000 jnz servermo.00749B0E ; 上面两个对比不一样就跳过去了正确时不跳
知道的帮忙看一下了，要从那里跟踪呢，有偿也可以的
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
