-
-
算法分析之CrackMe_Code By 飘云[PYG]
-
发表于: 2006-1-27 02:55 7365
-
【破文标题】算法分析之CrackMe_Code By 飘云[PYG]
【破文作者】busheler
【作者邮箱】busheler@sohu.com
【作者主页】
【破解工具】PEID v0.94,GetVBRes VER 0.51,点睛偏移量转换器 0.94B 版,odbg110
【破解平台】Windows2000
【软件名称】想玩就玩,玩得漂亮!
【软件大小】24.0KB
【原版下载】http://www.chinapyg.cn/attachment.php?aid=748
【保护方式】
【软件简介】本CrackMe分普通方式编辑和 P-code 编辑
要求:
写出算法分析;
贴出注册机源码;
简单的东西就简单玩~~ 嘿嘿~~
想玩就玩~~ 玩的漂亮!!
Code By 飘云[PYG]
------------------------------------------------------------------------
一、查壳
PEID v0.94 查无壳， 为Microsoft Visual Basic 5.0 / 6.0编写。
二、找资源
1、GetVBRes VER 0.51载入看到如下资源：
名称： 实偏移：
Congratulations! 215C
Good,You Did It 2184
2、点睛偏移量转换器 0.94B 版载入将资源实偏移转为代码：
Congratulations! 215C===>5C214000
Good,You Did It 2184===>84214000
三、踏上破解之路：
odbg110载入
search for===>Binery string 填入“5C214000”即Congratulations! 很容易找到这里。
00403B0D . FFD7 CALL EDI ; <&MSVBVM60.__vbaFreeVarList>
00403B0F . 83C4 34 ADD ESP,34
00403B12 . 66:85F6 TEST SI,SI
00403B15 . 0F84 86000000 JE PYG.00403BA1
00403B1B . B8 04000280 MOV EAX,80020004
00403B20 . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
00403B23 . B9 0A000000 MOV ECX,0A
00403B28 . 894D 84 MOV DWORD PTR SS:[EBP-7C],ECX
00403B2B . 8945 9C MOV DWORD PTR SS:[EBP-64],EAX
00403B2E . 894D 94 MOV DWORD PTR SS:[EBP-6C],ECX
00403B31 . C785 4CFFFFFF >MOV DWORD PTR SS:[EBP-B4],PYG.00402184 ; UNICODE "Good,You Did It"
00403B3B . BB 08000000 MOV EBX,8
00403B40 . 899D 44FFFFFF MOV DWORD PTR SS:[EBP-BC],EBX
00403B46 . 8D95 44FFFFFF LEA EDX,DWORD PTR SS:[EBP-BC]
00403B4C . 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
00403B4F . 8B35 94104000 MOV ESI,DWORD PTR DS:[<&MSVBVM60.__vbaVa>; MSVBVM60.__vbaVarDup
00403B55 . FFD6 CALL ESI ; <&MSVBVM60.__vbaVarDup>
00403B57 . C785 5CFFFFFF >MOV DWORD PTR SS:[EBP-A4],PYG.0040215C ; UNICODE "Congratulations!"
往上一看，晕倒！好长好长的代码，看样子只有慢慢分析了！
1、用户名长度及注册码长度监测：
因为该程序无"确定"按钮，那就意味着程序是实时监测输入的注册码的，事实确实如此，在00402770处下断跟踪一下就会发现当你每输入一次注册码都会有一次中断，直到你输满16位。
00402770 > 55 PUSH EBP
00402771 . 8BEC MOV EBP,ESP
00402773 . 83EC 14 SUB ESP,14
00402776 . 68 F6104000 PUSH <JMP.&MSVBVM60.__vbaExceptHandler> ; SE handler installation
0040277B . 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
00402781 . 50 PUSH EAX
00402782 . 64:8925 000000>MOV DWORD PTR FS:[0],ESP
00402789 . 81EC 54010000 SUB ESP,154
0040278F . 53 PUSH EBX
00402790 . 56 PUSH ESI
00402791 . 57 PUSH EDI
00402792 . 8965 EC MOV DWORD PTR SS:[EBP-14],ESP
00402795 . C745 F0 C81040>MOV DWORD PTR SS:[EBP-10],PYG.004010C8
0040279C . 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8]
0040279F . 8BC3 MOV EAX,EBX
004027A1 . 83E0 01 AND EAX,1
004027A4 . 8945 F4 MOV DWORD PTR SS:[EBP-C],EAX
004027A7 . 83E3 FE AND EBX,FFFFFFFE
004027AA . 895D 08 MOV DWORD PTR SS:[EBP+8],EBX
004027AD . 33FF XOR EDI,EDI
004027AF . 897D F8 MOV DWORD PTR SS:[EBP-8],EDI
004027B2 . 8B0B MOV ECX,DWORD PTR DS:[EBX]
004027B4 . 53 PUSH EBX
004027B5 . FF51 04 CALL DWORD PTR DS:[ECX+4]
004027B8 . 897D E0 MOV DWORD PTR SS:[EBP-20],EDI
004027BB . 897D DC MOV DWORD PTR SS:[EBP-24],EDI
004027BE . 897D D8 MOV DWORD PTR SS:[EBP-28],EDI
004027C1 . 897D D4 MOV DWORD PTR SS:[EBP-2C],EDI
004027C4 . 897D D0 MOV DWORD PTR SS:[EBP-30],EDI
004027C7 . 897D CC MOV DWORD PTR SS:[EBP-34],EDI
004027CA . 897D C8 MOV DWORD PTR SS:[EBP-38],EDI
004027CD . 897D C4 MOV DWORD PTR SS:[EBP-3C],EDI
004027D0 . 897D B4 MOV DWORD PTR SS:[EBP-4C],EDI
004027D3 . 897D A4 MOV DWORD PTR SS:[EBP-5C],EDI
004027D6 . 897D 94 MOV DWORD PTR SS:[EBP-6C],EDI
004027D9 . 897D 84 MOV DWORD PTR SS:[EBP-7C],EDI
004027DC . 89BD 74FFFFFF MOV DWORD PTR SS:[EBP-8C],EDI
004027E2 . 89BD 64FFFFFF MOV DWORD PTR SS:[EBP-9C],EDI
004027E8 . 89BD 54FFFFFF MOV DWORD PTR SS:[EBP-AC],EDI
004027EE . 89BD 44FFFFFF MOV DWORD PTR SS:[EBP-BC],EDI
004027F4 . 6A 01 PUSH 1
004027F6 . FF15 30104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaOnErr>; MSVBVM60.__vbaOnError
004027FC . 8B13 MOV EDX,DWORD PTR DS:[EBX]
004027FE . 53 PUSH EBX
004027FF . FF92 00030000 CALL DWORD PTR DS:[EDX+300]
00402805 . 50 PUSH EAX
00402806 . 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-30]
00402809 . 50 PUSH EAX
0040280A . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402810 . 8BF0 MOV ESI,EAX
00402812 . 8B0E MOV ECX,DWORD PTR DS:[ESI]
00402814 . 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
00402817 . 52 PUSH EDX
00402818 . 56 PUSH ESI
00402819 . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
0040281F . DBE2 FCLEX
00402821 . 3BC7 CMP EAX,EDI
00402823 . 7D 12 JGE SHORT PYG.00402837
00402825 . 68 A0000000 PUSH 0A0
0040282A . 68 48214000 PUSH PYG.00402148
0040282F . 56 PUSH ESI
00402830 . 50 PUSH EAX
00402831 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402837 > 8B03 MOV EAX,DWORD PTR DS:[EBX]
00402839 . 53 PUSH EBX
0040283A . FF90 FC020000 CALL DWORD PTR DS:[EAX+2FC]
00402840 . 50 PUSH EAX
00402841 . 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00402844 . 51 PUSH ECX
00402845 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
0040284B . 8BF0 MOV ESI,EAX
0040284D . 8B16 MOV EDX,DWORD PTR DS:[ESI]
0040284F . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00402852 . 50 PUSH EAX
00402853 . 56 PUSH ESI
00402854 . FF92 A0000000 CALL DWORD PTR DS:[EDX+A0]
0040285A . DBE2 FCLEX
0040285C . 3BC7 CMP EAX,EDI
0040285E . 7D 12 JGE SHORT PYG.00402872
00402860 . 68 A0000000 PUSH 0A0
00402865 . 68 48214000 PUSH PYG.00402148
0040286A . 56 PUSH ESI
0040286B . 50 PUSH EAX
0040286C . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402872 > 8B0B MOV ECX,DWORD PTR DS:[EBX]
00402874 . 53 PUSH EBX
00402875 . FF91 00030000 CALL DWORD PTR DS:[ECX+300]
0040287B . 50 PUSH EAX
0040287C . 8D55 C8 LEA EDX,DWORD PTR SS:[EBP-38]
0040287F . 52 PUSH EDX
00402880 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402886 . 8BF0 MOV ESI,EAX
00402888 . 8B06 MOV EAX,DWORD PTR DS:[ESI]
0040288A . 8D4D D8 LEA ECX,DWORD PTR SS:[EBP-28]
0040288D . 51 PUSH ECX
0040288E . 56 PUSH ESI
0040288F . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
00402895 . DBE2 FCLEX
00402897 . 3BC7 CMP EAX,EDI
00402899 . 7D 12 JGE SHORT PYG.004028AD
0040289B . 68 A0000000 PUSH 0A0
004028A0 . 68 48214000 PUSH PYG.00402148
004028A5 . 56 PUSH ESI
004028A6 . 50 PUSH EAX
004028A7 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
004028AD > 8B13 MOV EDX,DWORD PTR DS:[EBX]
004028AF . 53 PUSH EBX
004028B0 . FF92 FC020000 CALL DWORD PTR DS:[EDX+2FC]
004028B6 . 50 PUSH EAX
004028B7 . 8D45 C4 LEA EAX,DWORD PTR SS:[EBP-3C]
004028BA . 50 PUSH EAX
004028BB . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
004028C1 . 8BF0 MOV ESI,EAX
004028C3 . 8B0E MOV ECX,DWORD PTR DS:[ESI]
004028C5 . 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
004028C8 . 52 PUSH EDX
004028C9 . 56 PUSH ESI
004028CA . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
004028D0 . DBE2 FCLEX
004028D2 . 3BC7 CMP EAX,EDI
004028D4 . 7D 12 JGE SHORT PYG.004028E8
004028D6 . 68 A0000000 PUSH 0A0
004028DB . 68 48214000 PUSH PYG.00402148
004028E0 . 56 PUSH ESI
004028E1 . 50 PUSH EAX
004028E2 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
004028E8 > 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24] ; 注册码入EAX
004028EB . 50 PUSH EAX
004028EC . 68 44214000 PUSH PYG.00402144
004028F1 . 8B3D 50104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaSt>; MSVBVM60.__vbaStrCmp
004028F7 . FFD7 CALL EDI ; <&MSVBVM60.__vbaStrCmp>
004028F9 . 8BF0 MOV ESI,EAX
004028FB . F7DE NEG ESI
004028FD . 1BF6 SBB ESI,ESI
004028FF . 46 INC ESI
00402900 . F7DE NEG ESI
00402902 . 8B4D E0 MOV ECX,DWORD PTR SS:[EBP-20] ; 用户名入ECX
00402905 . 51 PUSH ECX
00402906 . 68 44214000 PUSH PYG.00402144
0040290B . FFD7 CALL EDI
0040290D . F7D8 NEG EAX
0040290F . 1BC0 SBB EAX,EAX
00402911 . 40 INC EAX
00402912 . F7D8 NEG EAX
00402914 . 0BF0 OR ESI,EAX
00402916 . 8B55 D4 MOV EDX,DWORD PTR SS:[EBP-2C]
00402919 . 52 PUSH EDX
0040291A . 8B3D 08104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaLe>; MSVBVM60.__vbaLenBstr
00402920 . FFD7 CALL EDI ; <&MSVBVM60.__vbaLenBstr>
00402922 . 33C9 XOR ECX,ECX
00402924 . 83F8 10 CMP EAX,10 ; 注册码长度与16比较
00402927 . 0F9CC1 SETL CL
0040292A . F7D9 NEG ECX
0040292C . 0BF1 OR ESI,ECX
0040292E . 8B55 D8 MOV EDX,DWORD PTR SS:[EBP-28]
00402931 . 52 PUSH EDX
00402932 . FFD7 CALL EDI
00402934 . 33C9 XOR ECX,ECX
00402936 . 83F8 08 CMP EAX,8 ;用户名长度与8比较
00402939 . 0F9CC1 SETL CL
0040293C . F7D9 NEG ECX
0040293E . 0BF1 OR ESI,ECX
00402940 . 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00402943 . 52 PUSH EDX
00402944 . 8D45 D8 LEA EAX,DWORD PTR SS:[EBP-28]
00402947 . 50 PUSH EAX
00402948 . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
0040294B . 51 PUSH ECX
0040294C . 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
0040294F . 52 PUSH EDX
00402950 . 6A 04 PUSH 4
00402952 . FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList
00402958 . 8D45 C4 LEA EAX,DWORD PTR SS:[EBP-3C]
0040295B . 50 PUSH EAX
0040295C . 8D4D C8 LEA ECX,DWORD PTR SS:[EBP-38]
0040295F . 51 PUSH ECX
00402960 . 8D55 CC LEA EDX,DWORD PTR SS:[EBP-34]
00402963 . 52 PUSH EDX
00402964 . 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-30]
00402967 . 50 PUSH EAX
00402968 . 6A 04 PUSH 4
0040296A . FF15 14104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObjList
00402970 . 83C4 28 ADD ESP,28
00402973 . 66:85F6 TEST SI,SI
00402976 . 0F85 25120000 JNZ PYG.00403BA1 ; 注册码长度小于16或用户名长度小于8，跳！大于等于，继续...
---------------------------------------
2、注册码计算过程：注册码是逐位进行对比的，任何一位不对都会跳出，所以必须1-16位慢慢看了。。。
0040297C . 8B0B MOV ECX,DWORD PTR DS:[EBX]
0040297E . 53 PUSH EBX
0040297F . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
00402985 . 50 PUSH EAX
00402986 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00402989 . 52 PUSH EDX
0040298A . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402990 . 8BF0 MOV ESI,EAX
00402992 . 8B06 MOV EAX,DWORD PTR DS:[ESI]
00402994 . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00402997 . 51 PUSH ECX
00402998 . 56 PUSH ESI
00402999 . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
0040299F . DBE2 FCLEX
004029A1 . 85C0 TEST EAX,EAX
004029A3 . 7D 12 JGE SHORT PYG.004029B7
004029A5 . 68 A0000000 PUSH 0A0
004029AA . 68 48214000 PUSH PYG.00402148
004029AF . 56 PUSH ESI
004029B0 . 50 PUSH EAX
004029B1 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
004029B7 > C745 AC 010000>MOV DWORD PTR SS:[EBP-54],1
004029BE . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
004029C5 . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20] ; 注册码入EAX
004029C8 . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
004029CF . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
004029D2 . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
004029D9 . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
004029DC . 52 PUSH EDX
004029DD . 6A 01 PUSH 1
004029DF . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
004029E2 . 50 PUSH EAX
004029E3 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
004029E6 . 51 PUSH ECX
004029E7 . 8B35 44104000 MOV ESI,DWORD PTR DS:[<&MSVBVM60.#632>] ; MSVBVM60.rtcMidCharVar
004029ED . FFD6 CALL ESI ; <&MSVBVM60.#632>
004029EF . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
004029F2 . 52 PUSH EDX
004029F3 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
004029F6 . 50 PUSH EAX
004029F7 . 8B3D 74104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaSt>; MSVBVM60.__vbaStrVarVal
004029FD . FFD7 CALL EDI ; <&MSVBVM60.__vbaStrVarVal>
004029FF . 50 PUSH EAX
00402A00 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00402A06 . 33C9 XOR ECX,ECX
00402A08 . 66:3D 6300 CMP AX,63 ; 第一位注册码与c比较
00402A0C . 0F94C1 SETE CL
00402A0F . F7D9 NEG ECX
00402A11 . 66:898D 18FFFF>MOV WORD PTR SS:[EBP-E8],CX
00402A18 . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
00402A1B . FF15 AC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStr
00402A21 . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
00402A24 . FF15 A8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj
00402A2A . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00402A2D . 52 PUSH EDX
00402A2E . 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
00402A31 . 50 PUSH EAX
00402A32 . 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
00402A35 . 51 PUSH ECX
00402A36 . 6A 03 PUSH 3
00402A38 . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00402A3E . 83C4 10 ADD ESP,10
00402A41 . 66:83BD 18FFFF>CMP WORD PTR SS:[EBP-E8],0
00402A49 0F84 52110000 JE PYG.00403BA1 ; 不等跳
00402A4F . 8B13 MOV EDX,DWORD PTR DS:[EBX]
00402A51 . 53 PUSH EBX
00402A52 . FF92 FC020000 CALL DWORD PTR DS:[EDX+2FC]
00402A58 . 50 PUSH EAX
00402A59 . 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-30]
00402A5C . 50 PUSH EAX
00402A5D . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402A63 . 8985 20FFFFFF MOV DWORD PTR SS:[EBP-E0],EAX
00402A69 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
00402A6B . 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
00402A6E . 52 PUSH EDX
00402A6F . 50 PUSH EAX
00402A70 . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
00402A76 . DBE2 FCLEX
00402A78 . 85C0 TEST EAX,EAX
00402A7A . 7D 18 JGE SHORT PYG.00402A94
00402A7C . 68 A0000000 PUSH 0A0
00402A81 . 68 48214000 PUSH PYG.00402148
00402A86 . 8B8D 20FFFFFF MOV ECX,DWORD PTR SS:[EBP-E0]
00402A8C . 51 PUSH ECX
00402A8D . 50 PUSH EAX
00402A8E . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402A94 > 8B13 MOV EDX,DWORD PTR DS:[EBX]
00402A96 . 53 PUSH EBX
00402A97 . FF92 00030000 CALL DWORD PTR DS:[EDX+300]
00402A9D . 50 PUSH EAX
00402A9E . 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
00402AA1 . 50 PUSH EAX
00402AA2 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402AA8 . 8BD8 MOV EBX,EAX
00402AAA . 8B0B MOV ECX,DWORD PTR DS:[EBX]
00402AAC . 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
00402AAF . 52 PUSH EDX
00402AB0 . 53 PUSH EBX
00402AB1 . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
00402AB7 . DBE2 FCLEX
00402AB9 . 85C0 TEST EAX,EAX
00402ABB . 7D 12 JGE SHORT PYG.00402ACF
00402ABD . 68 A0000000 PUSH 0A0
00402AC2 . 68 48214000 PUSH PYG.00402148
00402AC7 . 53 PUSH EBX
00402AC8 . 50 PUSH EAX
00402AC9 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402ACF > BB 01000000 MOV EBX,1
00402AD4 . 895D AC MOV DWORD PTR SS:[EBP-54],EBX
00402AD7 . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
00402ADE . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
00402AE1 . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
00402AE8 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
00402AEB . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
00402AF2 . 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
00402AF5 . 50 PUSH EAX
00402AF6 . 6A 02 PUSH 2
00402AF8 . 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
00402AFB . 51 PUSH ECX
00402AFC . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00402AFF . 52 PUSH EDX
00402B00 . FFD6 CALL ESI
00402B02 . 899D 7CFFFFFF MOV DWORD PTR SS:[EBP-84],EBX
00402B08 . C785 74FFFFFF >MOV DWORD PTR SS:[EBP-8C],2
00402B12 . 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
00402B15 . C745 D8 000000>MOV DWORD PTR SS:[EBP-28],0
00402B1C . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
00402B1F . C745 84 080000>MOV DWORD PTR SS:[EBP-7C],8
00402B26 . 8D85 74FFFFFF LEA EAX,DWORD PTR SS:[EBP-8C]
00402B2C . 50 PUSH EAX
00402B2D . 53 PUSH EBX
00402B2E . 8D4D 84 LEA ECX,DWORD PTR SS:[EBP-7C]
00402B31 . 51 PUSH ECX
00402B32 . 8D95 64FFFFFF LEA EDX,DWORD PTR SS:[EBP-9C]
00402B38 . 52 PUSH EDX
00402B39 . FFD6 CALL ESI
00402B3B . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
00402B41 . 50 PUSH EAX
00402B42 . 8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]
00402B45 . 51 PUSH ECX
00402B46 . FFD7 CALL EDI
00402B48 . 50 PUSH EAX
00402B49 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00402B4F . 66:8BD8 MOV BX,AX
00402B52 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00402B55 . 52 PUSH EDX
00402B56 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00402B59 . 50 PUSH EAX
00402B5A . FFD7 CALL EDI
00402B5C . 50 PUSH EAX
00402B5D . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00402B63 . 33C9 XOR ECX,ECX
00402B65 . 66:3BC3 CMP AX,BX ; 注册码第二位与用户名第一位比较
00402B68 . 0F94C1 SETE CL
00402B6B . F7D9 NEG ECX
00402B6D . 8BD9 MOV EBX,ECX
00402B6F . 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00402B72 . 52 PUSH EDX
00402B73 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00402B76 . 50 PUSH EAX
00402B77 . 6A 02 PUSH 2
00402B79 . FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList
00402B7F . 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00402B82 . 51 PUSH ECX
00402B83 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00402B86 . 52 PUSH EDX
00402B87 . 6A 02 PUSH 2
00402B89 . FF15 14104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObjList
00402B8F . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
00402B95 . 50 PUSH EAX
00402B96 . 8D8D 74FFFFFF LEA ECX,DWORD PTR SS:[EBP-8C]
00402B9C . 51 PUSH ECX
00402B9D . 8D55 84 LEA EDX,DWORD PTR SS:[EBP-7C]
00402BA0 . 52 PUSH EDX
00402BA1 . 8D45 94 LEA EAX,DWORD PTR SS:[EBP-6C]
00402BA4 . 50 PUSH EAX
00402BA5 . 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
00402BA8 . 51 PUSH ECX
00402BA9 . 8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C]
00402BAC . 52 PUSH EDX
00402BAD . 6A 06 PUSH 6
00402BAF . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00402BB5 . 83C4 34 ADD ESP,34
00402BB8 . 66:85DB TEST BX,BX
00402BBB 0F84 E00F0000 JE PYG.00403BA1 ; 不等跳！
00402BC1 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00402BC4 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
00402BC6 . 50 PUSH EAX
00402BC7 . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
00402BCD . 50 PUSH EAX
00402BCE . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00402BD1 . 52 PUSH EDX
00402BD2 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402BD8 . 8BD8 MOV EBX,EAX
00402BDA . 8B03 MOV EAX,DWORD PTR DS:[EBX]
00402BDC . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00402BDF . 51 PUSH ECX
00402BE0 . 53 PUSH EBX
00402BE1 . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
00402BE7 . DBE2 FCLEX
00402BE9 . 85C0 TEST EAX,EAX
00402BEB . 7D 12 JGE SHORT PYG.00402BFF
00402BED . 68 A0000000 PUSH 0A0
00402BF2 . 68 48214000 PUSH PYG.00402148
00402BF7 . 53 PUSH EBX
00402BF8 . 50 PUSH EAX
00402BF9 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402BFF > C745 AC 010000>MOV DWORD PTR SS:[EBP-54],1
00402C06 . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
00402C0D . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20] ; 注册码入EAX
00402C10 . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
00402C17 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
00402C1A . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
00402C21 . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
00402C24 . 52 PUSH EDX
00402C25 . 6A 03 PUSH 3
00402C27 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
00402C2A . 50 PUSH EAX
00402C2B . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
00402C2E . 51 PUSH ECX
00402C2F . FFD6 CALL ESI
00402C31 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00402C34 . 52 PUSH EDX
00402C35 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00402C38 . 50 PUSH EAX
00402C39 . FFD7 CALL EDI
00402C3B . 50 PUSH EAX
00402C3C . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00402C42 . 33DB XOR EBX,EBX
00402C44 . 66:3D 6800 CMP AX,68 ; 第三位注册码与h比较
00402C48 . 0F94C3 SETE BL
00402C4B . F7DB NEG EBX
00402C4D . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
00402C50 . FF15 AC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStr
00402C56 . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
00402C59 . FF15 A8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj
00402C5F . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
00402C62 . 51 PUSH ECX
00402C63 . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
00402C66 . 52 PUSH EDX
00402C67 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
00402C6A . 50 PUSH EAX
00402C6B . 6A 03 PUSH 3
00402C6D . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00402C73 . 83C4 10 ADD ESP,10
00402C76 . 66:85DB TEST BX,BX
00402C79 0F84 220F0000 JE PYG.00403BA1 ; 不等跳！
00402C7F . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00402C82 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
00402C84 . 50 PUSH EAX
00402C85 . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
00402C8B . 50 PUSH EAX
00402C8C . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00402C8F . 52 PUSH EDX
00402C90 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402C96 . 8BD8 MOV EBX,EAX
00402C98 . 8B03 MOV EAX,DWORD PTR DS:[EBX]
00402C9A . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00402C9D . 51 PUSH ECX
00402C9E . 53 PUSH EBX
00402C9F . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
00402CA5 . DBE2 FCLEX
00402CA7 . 85C0 TEST EAX,EAX
00402CA9 . 7D 12 JGE SHORT PYG.00402CBD
00402CAB . 68 A0000000 PUSH 0A0
00402CB0 . 68 48214000 PUSH PYG.00402148
00402CB5 . 53 PUSH EBX
00402CB6 . 50 PUSH EAX
00402CB7 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402CBD > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00402CC0 . 8B10 MOV EDX,DWORD PTR DS:[EAX]
00402CC2 . 50 PUSH EAX
00402CC3 . FF92 00030000 CALL DWORD PTR DS:[EDX+300]
00402CC9 . 50 PUSH EAX
00402CCA . 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
00402CCD . 50 PUSH EAX
00402CCE . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402CD4 . 8BD8 MOV EBX,EAX
00402CD6 . 8B0B MOV ECX,DWORD PTR DS:[EBX]
00402CD8 . 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
00402CDB . 52 PUSH EDX
00402CDC . 53 PUSH EBX
00402CDD . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
00402CE3 . DBE2 FCLEX
00402CE5 . 85C0 TEST EAX,EAX
00402CE7 . 7D 12 JGE SHORT PYG.00402CFB
00402CE9 . 68 A0000000 PUSH 0A0
00402CEE . 68 48214000 PUSH PYG.00402148
00402CF3 . 53 PUSH EBX
00402CF4 . 50 PUSH EAX
00402CF5 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402CFB > BB 01000000 MOV EBX,1
00402D00 . 895D AC MOV DWORD PTR SS:[EBP-54],EBX
00402D03 . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
00402D0A . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20] ; 注册码入eax
00402D0D . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
00402D14 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
00402D17 . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
00402D1E . 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
00402D21 . 50 PUSH EAX
00402D22 . 6A 04 PUSH 4
00402D24 . 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
00402D27 . 51 PUSH ECX
00402D28 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00402D2B . 52 PUSH EDX
00402D2C . FFD6 CALL ESI
00402D2E . 899D 7CFFFFFF MOV DWORD PTR SS:[EBP-84],EBX
00402D34 . C785 74FFFFFF >MOV DWORD PTR SS:[EBP-8C],2
00402D3E . 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28] ; 用户名入EAX
00402D41 . C745 D8 000000>MOV DWORD PTR SS:[EBP-28],0
00402D48 . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
00402D4B . C745 84 080000>MOV DWORD PTR SS:[EBP-7C],8
00402D52 . 8D85 74FFFFFF LEA EAX,DWORD PTR SS:[EBP-8C]
00402D58 . 50 PUSH EAX
00402D59 . 6A 02 PUSH 2
00402D5B . 8D4D 84 LEA ECX,DWORD PTR SS:[EBP-7C]
00402D5E . 51 PUSH ECX
00402D5F . 8D95 64FFFFFF LEA EDX,DWORD PTR SS:[EBP-9C]
00402D65 . 52 PUSH EDX
00402D66 . FFD6 CALL ESI
00402D68 . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
00402D6E . 50 PUSH EAX
00402D6F . 8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]
00402D72 . 51 PUSH ECX
00402D73 . FFD7 CALL EDI
00402D75 . 50 PUSH EAX
00402D76 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00402D7C . 66:8BD8 MOV BX,AX
00402D7F . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00402D82 . 52 PUSH EDX
00402D83 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00402D86 . 50 PUSH EAX
00402D87 . FFD7 CALL EDI
00402D89 . 50 PUSH EAX
00402D8A . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00402D90 . 33C9 XOR ECX,ECX
00402D92 . 66:3BC3 CMP AX,BX ; 注册码第四位与用用户名第二位比较
00402D95 . 0F94C1 SETE CL
00402D98 . F7D9 NEG ECX
00402D9A . 8BD9 MOV EBX,ECX
00402D9C . 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00402D9F . 52 PUSH EDX
00402DA0 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00402DA3 . 50 PUSH EAX
00402DA4 . 6A 02 PUSH 2
00402DA6 . FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList
00402DAC . 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00402DAF . 51 PUSH ECX
00402DB0 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00402DB3 . 52 PUSH EDX
00402DB4 . 6A 02 PUSH 2
00402DB6 . FF15 14104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObjList
00402DBC . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
00402DC2 . 50 PUSH EAX
00402DC3 . 8D8D 74FFFFFF LEA ECX,DWORD PTR SS:[EBP-8C]
00402DC9 . 51 PUSH ECX
00402DCA . 8D55 84 LEA EDX,DWORD PTR SS:[EBP-7C]
00402DCD . 52 PUSH EDX
00402DCE . 8D45 94 LEA EAX,DWORD PTR SS:[EBP-6C]
00402DD1 . 50 PUSH EAX
00402DD2 . 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
00402DD5 . 51 PUSH ECX
00402DD6 . 8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C]
00402DD9 . 52 PUSH EDX
00402DDA . 6A 06 PUSH 6
00402DDC . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00402DE2 . 83C4 34 ADD ESP,34
00402DE5 . 66:85DB TEST BX,BX
00402DE8 0F84 B30D0000 JE PYG.00403BA1 ; 不等跳！
00402DEE . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00402DF1 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
00402DF3 . 50 PUSH EAX
00402DF4 . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
00402DFA . 50 PUSH EAX
00402DFB . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00402DFE . 52 PUSH EDX
00402DFF . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402E05 . 8BD8 MOV EBX,EAX
00402E07 . 8B03 MOV EAX,DWORD PTR DS:[EBX]
00402E09 . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00402E0C . 51 PUSH ECX
00402E0D . 53 PUSH EBX
00402E0E . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
00402E14 . DBE2 FCLEX
00402E16 . 85C0 TEST EAX,EAX
00402E18 . 7D 12 JGE SHORT PYG.00402E2C
00402E1A . 68 A0000000 PUSH 0A0
00402E1F . 68 48214000 PUSH PYG.00402148
00402E24 . 53 PUSH EBX
00402E25 . 50 PUSH EAX
00402E26 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402E2C > C745 AC 010000>MOV DWORD PTR SS:[EBP-54],1
00402E33 . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
00402E3A . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
00402E3D . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
00402E44 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
00402E47 . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
00402E4E . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
00402E51 . 52 PUSH EDX
00402E52 . 6A 05 PUSH 5
00402E54 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
00402E57 . 50 PUSH EAX
00402E58 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
00402E5B . 51 PUSH ECX
00402E5C . FFD6 CALL ESI
00402E5E . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00402E61 . 52 PUSH EDX
00402E62 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00402E65 . 50 PUSH EAX
00402E66 . FFD7 CALL EDI
00402E68 . 50 PUSH EAX
00402E69 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00402E6F . 33DB XOR EBX,EBX
00402E71 . 66:3D 6900 CMP AX,69 ; 注册码第五位与i比较
00402E75 . 0F94C3 SETE BL
00402E78 . F7DB NEG EBX
00402E7A . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
00402E7D . FF15 AC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStr
00402E83 . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
00402E86 . FF15 A8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj
00402E8C . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
00402E8F . 51 PUSH ECX
00402E90 . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
00402E93 . 52 PUSH EDX
00402E94 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
00402E97 . 50 PUSH EAX
00402E98 . 6A 03 PUSH 3
00402E9A . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00402EA0 . 83C4 10 ADD ESP,10
00402EA3 . 66:85DB TEST BX,BX
00402EA6 0F84 F50C0000 JE PYG.00403BA1 ; 不等跳
00402EAC . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00402EAF . 8B08 MOV ECX,DWORD PTR DS:[EAX]
00402EB1 . 50 PUSH EAX
00402EB2 . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
00402EB8 . 50 PUSH EAX
00402EB9 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00402EBC . 52 PUSH EDX
00402EBD . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402EC3 . 8BD8 MOV EBX,EAX
00402EC5 . 8B03 MOV EAX,DWORD PTR DS:[EBX]
00402EC7 . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00402ECA . 51 PUSH ECX
00402ECB . 53 PUSH EBX
00402ECC . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
00402ED2 . DBE2 FCLEX
00402ED4 . 85C0 TEST EAX,EAX
00402ED6 . 7D 12 JGE SHORT PYG.00402EEA
00402ED8 . 68 A0000000 PUSH 0A0
00402EDD . 68 48214000 PUSH PYG.00402148
00402EE2 . 53 PUSH EBX
00402EE3 . 50 PUSH EAX
00402EE4 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402EEA > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00402EED . 8B10 MOV EDX,DWORD PTR DS:[EAX]
00402EEF . 50 PUSH EAX
00402EF0 . FF92 00030000 CALL DWORD PTR DS:[EDX+300]
00402EF6 . 50 PUSH EAX
00402EF7 . 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
00402EFA . 50 PUSH EAX
00402EFB . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00402F01 . 8BD8 MOV EBX,EAX
00402F03 . 8B0B MOV ECX,DWORD PTR DS:[EBX]
00402F05 . 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
00402F08 . 52 PUSH EDX
00402F09 . 53 PUSH EBX
00402F0A . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
00402F10 . DBE2 FCLEX
00402F12 . 85C0 TEST EAX,EAX
00402F14 . 7D 12 JGE SHORT PYG.00402F28
00402F16 . 68 A0000000 PUSH 0A0
00402F1B . 68 48214000 PUSH PYG.00402148
00402F20 . 53 PUSH EBX
00402F21 . 50 PUSH EAX
00402F22 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00402F28 > C745 AC 010000>MOV DWORD PTR SS:[EBP-54],1
00402F2F . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
00402F36 . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
00402F39 . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
00402F40 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
00402F43 . BB 08000000 MOV EBX,8
00402F48 . 895D B4 MOV DWORD PTR SS:[EBP-4C],EBX
00402F4B . 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
00402F4E . 50 PUSH EAX
00402F4F . 6A 06 PUSH 6
00402F51 . 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
00402F54 . 51 PUSH ECX
00402F55 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00402F58 . 52 PUSH EDX
00402F59 . FFD6 CALL ESI
00402F5B . C785 7CFFFFFF >MOV DWORD PTR SS:[EBP-84],1
00402F65 . C785 74FFFFFF >MOV DWORD PTR SS:[EBP-8C],2
00402F6F . 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
00402F72 . C745 D8 000000>MOV DWORD PTR SS:[EBP-28],0
00402F79 . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
00402F7C . 895D 84 MOV DWORD PTR SS:[EBP-7C],EBX
00402F7F . 8D85 74FFFFFF LEA EAX,DWORD PTR SS:[EBP-8C]
00402F85 . 50 PUSH EAX
00402F86 . 6A 03 PUSH 3
00402F88 . 8D4D 84 LEA ECX,DWORD PTR SS:[EBP-7C]
00402F8B . 51 PUSH ECX
00402F8C . 8D95 64FFFFFF LEA EDX,DWORD PTR SS:[EBP-9C]
00402F92 . 52 PUSH EDX
00402F93 . FFD6 CALL ESI
00402F95 . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
00402F9B . 50 PUSH EAX
00402F9C . 8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]
00402F9F . 51 PUSH ECX
00402FA0 . FFD7 CALL EDI
00402FA2 . 50 PUSH EAX
00402FA3 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00402FA9 . 66:8BD8 MOV BX,AX
00402FAC . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00402FAF . 52 PUSH EDX
00402FB0 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00402FB3 . 50 PUSH EAX
00402FB4 . FFD7 CALL EDI
00402FB6 . 50 PUSH EAX
00402FB7 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00402FBD . 33C9 XOR ECX,ECX
00402FBF . 66:3BC3 CMP AX,BX ; 注册码第六位与用户名第三位比较
00402FC2 . 0F94C1 SETE CL
00402FC5 . F7D9 NEG ECX
00402FC7 . 8BD9 MOV EBX,ECX
00402FC9 . 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00402FCC . 52 PUSH EDX
00402FCD . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00402FD0 . 50 PUSH EAX
00402FD1 . 6A 02 PUSH 2
00402FD3 . FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList
00402FD9 . 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00402FDC . 51 PUSH ECX
00402FDD . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00402FE0 . 52 PUSH EDX
00402FE1 . 6A 02 PUSH 2
00402FE3 . FF15 14104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObjList
00402FE9 . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
00402FEF . 50 PUSH EAX
00402FF0 . 8D8D 74FFFFFF LEA ECX,DWORD PTR SS:[EBP-8C]
00402FF6 . 51 PUSH ECX
00402FF7 . 8D55 84 LEA EDX,DWORD PTR SS:[EBP-7C]
00402FFA . 52 PUSH EDX
00402FFB . 8D45 94 LEA EAX,DWORD PTR SS:[EBP-6C]
00402FFE . 50 PUSH EAX
00402FFF . 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
00403002 . 51 PUSH ECX
00403003 . 8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C]
00403006 . 52 PUSH EDX
00403007 . 6A 06 PUSH 6
00403009 . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
0040300F . 83C4 34 ADD ESP,34
00403012 . 66:85DB TEST BX,BX
00403015 0F84 860B0000 JE PYG.00403BA1 ; 不等跳！
0040301B . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
0040301E . 8B08 MOV ECX,DWORD PTR DS:[EAX]
00403020 . 50 PUSH EAX
00403021 . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
00403027 . 50 PUSH EAX
00403028 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
0040302B . 52 PUSH EDX
0040302C . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00403032 . 8BD8 MOV EBX,EAX
00403034 . 8B03 MOV EAX,DWORD PTR DS:[EBX]
00403036 . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00403039 . 51 PUSH ECX
0040303A . 53 PUSH EBX
0040303B . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
00403041 . DBE2 FCLEX
00403043 . 85C0 TEST EAX,EAX
00403045 . 7D 12 JGE SHORT PYG.00403059
00403047 . 68 A0000000 PUSH 0A0
0040304C . 68 48214000 PUSH PYG.00402148
00403051 . 53 PUSH EBX
00403052 . 50 PUSH EAX
00403053 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00403059 > C745 AC 010000>MOV DWORD PTR SS:[EBP-54],1
00403060 . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
00403067 . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
0040306A . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
00403071 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
00403074 . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
0040307B . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
0040307E . 52 PUSH EDX
0040307F . 6A 07 PUSH 7
00403081 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
00403084 . 50 PUSH EAX
00403085 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
00403088 . 51 PUSH ECX
00403089 . FFD6 CALL ESI
0040308B . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
0040308E . 52 PUSH EDX
0040308F . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00403092 . 50 PUSH EAX
00403093 . FFD7 CALL EDI
00403095 . 50 PUSH EAX
00403096 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
0040309C . 33DB XOR EBX,EBX
0040309E . 66:3D 6E00 CMP AX,6E ; AX为第七位注册码与n比较
004030A2 . 0F94C3 SETE BL
004030A5 . F7DB NEG EBX
004030A7 . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
004030AA . FF15 AC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStr
004030B0 . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
004030B3 . FF15 A8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj
004030B9 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
004030BC . 51 PUSH ECX
004030BD . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
004030C0 . 52 PUSH EDX
004030C1 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
004030C4 . 50 PUSH EAX
004030C5 . 6A 03 PUSH 3
004030C7 . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
004030CD . 83C4 10 ADD ESP,10
004030D0 . 66:85DB TEST BX,BX
004030D3 0F84 C80A0000 JE PYG.00403BA1 ; 不等跳！
004030D9 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
004030DC . 8B08 MOV ECX,DWORD PTR DS:[EAX]
004030DE . 50 PUSH EAX
004030DF . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
004030E5 . 50 PUSH EAX
004030E6 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
004030E9 . 52 PUSH EDX
004030EA . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
004030F0 . 8BD8 MOV EBX,EAX
004030F2 . 8B03 MOV EAX,DWORD PTR DS:[EBX]
004030F4 . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
004030F7 . 51 PUSH ECX
004030F8 . 53 PUSH EBX
004030F9 . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
004030FF . DBE2 FCLEX
00403101 . 85C0 TEST EAX,EAX
00403103 . 7D 12 JGE SHORT PYG.00403117
00403105 . 68 A0000000 PUSH 0A0
0040310A . 68 48214000 PUSH PYG.00402148
0040310F . 53 PUSH EBX
00403110 . 50 PUSH EAX
00403111 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00403117 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
0040311A . 8B10 MOV EDX,DWORD PTR DS:[EAX]
0040311C . 50 PUSH EAX
0040311D . FF92 00030000 CALL DWORD PTR DS:[EDX+300]
00403123 . 50 PUSH EAX
00403124 . 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
00403127 . 50 PUSH EAX
00403128 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
0040312E . 8BD8 MOV EBX,EAX
00403130 . 8B0B MOV ECX,DWORD PTR DS:[EBX]
00403132 . 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
00403135 . 52 PUSH EDX
00403136 . 53 PUSH EBX
00403137 . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
0040313D . DBE2 FCLEX
0040313F . 85C0 TEST EAX,EAX
00403141 . 7D 12 JGE SHORT PYG.00403155
00403143 . 68 A0000000 PUSH 0A0
00403148 . 68 48214000 PUSH PYG.00402148
0040314D . 53 PUSH EBX
0040314E . 50 PUSH EAX
0040314F . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00403155 > BB 01000000 MOV EBX,1
0040315A . 895D AC MOV DWORD PTR SS:[EBP-54],EBX
0040315D . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
00403164 . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
00403167 . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
0040316E . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
00403171 . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
00403178 . 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
0040317B . 50 PUSH EAX
0040317C . 6A 08 PUSH 8
0040317E . 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
00403181 . 51 PUSH ECX
00403182 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00403185 . 52 PUSH EDX
00403186 . FFD6 CALL ESI
00403188 . 899D 7CFFFFFF MOV DWORD PTR SS:[EBP-84],EBX
0040318E . C785 74FFFFFF >MOV DWORD PTR SS:[EBP-8C],2
00403198 . 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
0040319B . C745 D8 000000>MOV DWORD PTR SS:[EBP-28],0
004031A2 . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
004031A5 . C745 84 080000>MOV DWORD PTR SS:[EBP-7C],8
004031AC . 8D85 74FFFFFF LEA EAX,DWORD PTR SS:[EBP-8C]
004031B2 . 50 PUSH EAX
004031B3 . 6A 04 PUSH 4
004031B5 . 8D4D 84 LEA ECX,DWORD PTR SS:[EBP-7C]
004031B8 . 51 PUSH ECX
004031B9 . 8D95 64FFFFFF LEA EDX,DWORD PTR SS:[EBP-9C]
004031BF . 52 PUSH EDX
004031C0 . FFD6 CALL ESI
004031C2 . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
004031C8 . 50 PUSH EAX
004031C9 . 8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]
004031CC . 51 PUSH ECX
004031CD . FFD7 CALL EDI
004031CF . 50 PUSH EAX
004031D0 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
004031D6 . 66:8BD8 MOV BX,AX
004031D9 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
004031DC . 52 PUSH EDX
004031DD . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
004031E0 . 50 PUSH EAX
004031E1 . FFD7 CALL EDI
004031E3 . 50 PUSH EAX
004031E4 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
004031EA . 33C9 XOR ECX,ECX
004031EC . 66:3BC3 CMP AX,BX ; 第八位注册码与用户名第四位比较
004031EF . 0F94C1 SETE CL
004031F2 . F7D9 NEG ECX
004031F4 . 8BD9 MOV EBX,ECX
004031F6 . 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
004031F9 . 52 PUSH EDX
004031FA . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
004031FD . 50 PUSH EAX
004031FE . 6A 02 PUSH 2
00403200 . FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList
00403206 . 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00403209 . 51 PUSH ECX
0040320A . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
0040320D . 52 PUSH EDX
0040320E . 6A 02 PUSH 2
00403210 . FF15 14104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObjList
00403216 . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
0040321C . 50 PUSH EAX
0040321D . 8D8D 74FFFFFF LEA ECX,DWORD PTR SS:[EBP-8C]
00403223 . 51 PUSH ECX
00403224 . 8D55 84 LEA EDX,DWORD PTR SS:[EBP-7C]
00403227 . 52 PUSH EDX
00403228 . 8D45 94 LEA EAX,DWORD PTR SS:[EBP-6C]
0040322B . 50 PUSH EAX
0040322C . 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
0040322F . 51 PUSH ECX
00403230 . 8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C]
00403233 . 52 PUSH EDX
00403234 . 6A 06 PUSH 6
00403236 . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
0040323C . 83C4 34 ADD ESP,34
0040323F . 66:85DB TEST BX,BX
00403242 0F84 59090000 JE PYG.00403BA1 ; 如上面不相等跳！
00403248 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
0040324B . 8B08 MOV ECX,DWORD PTR DS:[EAX]
0040324D . 50 PUSH EAX
0040324E . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
00403254 . 50 PUSH EAX
00403255 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00403258 . 52 PUSH EDX
00403259 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
0040325F . 8BD8 MOV EBX,EAX
00403261 . 8B03 MOV EAX,DWORD PTR DS:[EBX]
00403263 . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00403266 . 51 PUSH ECX
00403267 . 53 PUSH EBX
00403268 . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
0040326E . DBE2 FCLEX
00403270 . 85C0 TEST EAX,EAX
00403272 . 7D 12 JGE SHORT PYG.00403286
00403274 . 68 A0000000 PUSH 0A0
00403279 . 68 48214000 PUSH PYG.00402148
0040327E . 53 PUSH EBX
0040327F . 50 PUSH EAX
00403280 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00403286 > C745 AC 010000>MOV DWORD PTR SS:[EBP-54],1
0040328D . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
00403294 . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
00403297 . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
0040329E . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
004032A1 . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
004032A8 . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
004032AB . 52 PUSH EDX
004032AC . 6A 09 PUSH 9
004032AE . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
004032B1 . 50 PUSH EAX
004032B2 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
004032B5 . 51 PUSH ECX
004032B6 . FFD6 CALL ESI
004032B8 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
004032BB . 52 PUSH EDX
004032BC . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
004032BF . 50 PUSH EAX
004032C0 . FFD7 CALL EDI
004032C2 . 50 PUSH EAX
004032C3 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
004032C9 . 33DB XOR EBX,EBX
004032CB . 66:3D 6100 CMP AX,61 ; AX为第九位注册码与a比较
004032CF . 0F94C3 SETE BL
004032D2 . F7DB NEG EBX
004032D4 . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
004032D7 . FF15 AC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStr
004032DD . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
004032E0 . FF15 A8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj
004032E6 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
004032E9 . 51 PUSH ECX
004032EA . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
004032ED . 52 PUSH EDX
004032EE . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
004032F1 . 50 PUSH EAX
004032F2 . 6A 03 PUSH 3
004032F4 . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
004032FA . 83C4 10 ADD ESP,10
004032FD . 66:85DB TEST BX,BX
00403300 0F84 9B080000 JE PYG.00403BA1 ; 不等跳！
00403306 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00403309 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
0040330B . 50 PUSH EAX
0040330C . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
00403312 . 50 PUSH EAX
00403313 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00403316 . 52 PUSH EDX
00403317 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
0040331D . 8BD8 MOV EBX,EAX
0040331F . 8B03 MOV EAX,DWORD PTR DS:[EBX]
00403321 . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00403324 . 51 PUSH ECX
00403325 . 53 PUSH EBX
00403326 . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
0040332C . DBE2 FCLEX
0040332E . 85C0 TEST EAX,EAX
00403330 . 7D 12 JGE SHORT PYG.00403344
00403332 . 68 A0000000 PUSH 0A0
00403337 . 68 48214000 PUSH PYG.00402148
0040333C . 53 PUSH EBX
0040333D . 50 PUSH EAX
0040333E . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00403344 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00403347 . 8B10 MOV EDX,DWORD PTR DS:[EAX]
00403349 . 50 PUSH EAX
0040334A . FF92 00030000 CALL DWORD PTR DS:[EDX+300]
00403350 . 50 PUSH EAX
00403351 . 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
00403354 . 50 PUSH EAX
00403355 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
0040335B . 8BD8 MOV EBX,EAX
0040335D . 8B0B MOV ECX,DWORD PTR DS:[EBX]
0040335F . 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
00403362 . 52 PUSH EDX
00403363 . 53 PUSH EBX
00403364 . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
0040336A . DBE2 FCLEX
0040336C . 85C0 TEST EAX,EAX
0040336E . 7D 12 JGE SHORT PYG.00403382
00403370 . 68 A0000000 PUSH 0A0
00403375 . 68 48214000 PUSH PYG.00402148
0040337A . 53 PUSH EBX
0040337B . 50 PUSH EAX
0040337C . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00403382 > BB 01000000 MOV EBX,1
00403387 . 895D AC MOV DWORD PTR SS:[EBP-54],EBX
0040338A . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
00403391 . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
00403394 . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
0040339B . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
0040339E . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
004033A5 . 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
004033A8 . 50 PUSH EAX
004033A9 . 6A 0A PUSH 0A
004033AB . 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
004033AE . 51 PUSH ECX
004033AF . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
004033B2 . 52 PUSH EDX
004033B3 . FFD6 CALL ESI
004033B5 . 899D 7CFFFFFF MOV DWORD PTR SS:[EBP-84],EBX
004033BB . C785 74FFFFFF >MOV DWORD PTR SS:[EBP-8C],2
004033C5 . 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
004033C8 . C745 D8 000000>MOV DWORD PTR SS:[EBP-28],0
004033CF . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
004033D2 . C745 84 080000>MOV DWORD PTR SS:[EBP-7C],8
004033D9 . 8D85 74FFFFFF LEA EAX,DWORD PTR SS:[EBP-8C]
004033DF . 50 PUSH EAX
004033E0 . 6A 05 PUSH 5
004033E2 . 8D4D 84 LEA ECX,DWORD PTR SS:[EBP-7C]
004033E5 . 51 PUSH ECX
004033E6 . 8D95 64FFFFFF LEA EDX,DWORD PTR SS:[EBP-9C]
004033EC . 52 PUSH EDX
004033ED . FFD6 CALL ESI
004033EF . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
004033F5 . 50 PUSH EAX
004033F6 . 8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]
004033F9 . 51 PUSH ECX
004033FA . FFD7 CALL EDI
004033FC . 50 PUSH EAX
004033FD . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00403403 . 66:8BD8 MOV BX,AX
00403406 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00403409 . 52 PUSH EDX
0040340A . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
0040340D . 50 PUSH EAX
0040340E . FFD7 CALL EDI
00403410 . 50 PUSH EAX
00403411 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00403417 . 33C9 XOR ECX,ECX
00403419 . 66:3BC3 CMP AX,BX ; 第十位注册码与用户名第五位比较
0040341C . 0F94C1 SETE CL
0040341F . F7D9 NEG ECX
00403421 . 8BD9 MOV EBX,ECX
00403423 . 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00403426 . 52 PUSH EDX
00403427 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
0040342A . 50 PUSH EAX
0040342B . 6A 02 PUSH 2
0040342D . FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList
00403433 . 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00403436 . 51 PUSH ECX
00403437 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
0040343A . 52 PUSH EDX
0040343B . 6A 02 PUSH 2
0040343D . FF15 14104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObjList
00403443 . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
00403449 . 50 PUSH EAX
0040344A . 8D8D 74FFFFFF LEA ECX,DWORD PTR SS:[EBP-8C]
00403450 . 51 PUSH ECX
00403451 . 8D55 84 LEA EDX,DWORD PTR SS:[EBP-7C]
00403454 . 52 PUSH EDX
00403455 . 8D45 94 LEA EAX,DWORD PTR SS:[EBP-6C]
00403458 . 50 PUSH EAX
00403459 . 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
0040345C . 51 PUSH ECX
0040345D . 8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C]
00403460 . 52 PUSH EDX
00403461 . 6A 06 PUSH 6
00403463 . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00403469 . 83C4 34 ADD ESP,34
0040346C . 66:85DB TEST BX,BX
0040346F 0F84 2C070000 JE PYG.00403BA1 ; 不等跳
00403475 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00403478 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
0040347A . 50 PUSH EAX
0040347B . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
00403481 . 50 PUSH EAX
00403482 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00403485 . 52 PUSH EDX
00403486 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
0040348C . 8BD8 MOV EBX,EAX
0040348E . 8B03 MOV EAX,DWORD PTR DS:[EBX]
00403490 . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00403493 . 51 PUSH ECX
00403494 . 53 PUSH EBX
00403495 . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
0040349B . DBE2 FCLEX
0040349D . 85C0 TEST EAX,EAX
0040349F . 7D 12 JGE SHORT PYG.004034B3
004034A1 . 68 A0000000 PUSH 0A0
004034A6 . 68 48214000 PUSH PYG.00402148
004034AB . 53 PUSH EBX
004034AC . 50 PUSH EAX
004034AD . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
004034B3 > C745 AC 010000>MOV DWORD PTR SS:[EBP-54],1
004034BA . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
004034C1 . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
004034C4 . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
004034CB . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
004034CE . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
004034D5 . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
004034D8 . 52 PUSH EDX
004034D9 . 6A 0B PUSH 0B
004034DB . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
004034DE . 50 PUSH EAX
004034DF . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
004034E2 . 51 PUSH ECX
004034E3 . FFD6 CALL ESI
004034E5 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
004034E8 . 52 PUSH EDX
004034E9 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
004034EC . 50 PUSH EAX
004034ED . FFD7 CALL EDI
004034EF . 50 PUSH EAX
004034F0 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
004034F6 . 33DB XOR EBX,EBX
004034F8 . 66:3D 7000 CMP AX,70 ; 第十一位与p比较
004034FC . 0F94C3 SETE BL
004034FF . F7DB NEG EBX
00403501 . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
00403504 . FF15 AC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStr
0040350A . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
0040350D . FF15 A8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj
00403513 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
00403516 . 51 PUSH ECX
00403517 . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
0040351A . 52 PUSH EDX
0040351B . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
0040351E . 50 PUSH EAX
0040351F . 6A 03 PUSH 3
00403521 . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00403527 . 83C4 10 ADD ESP,10
0040352A . 66:85DB TEST BX,BX
0040352D 0F84 6E060000 JE PYG.00403BA1 ; 不等跳！
00403533 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00403536 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
00403538 . 50 PUSH EAX
00403539 . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
0040353F . 50 PUSH EAX
00403540 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00403543 . 52 PUSH EDX
00403544 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
0040354A . 8BD8 MOV EBX,EAX
0040354C . 8B03 MOV EAX,DWORD PTR DS:[EBX]
0040354E . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
00403551 . 51 PUSH ECX
00403552 . 53 PUSH EBX
00403553 . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
00403559 . DBE2 FCLEX
0040355B . 85C0 TEST EAX,EAX
0040355D . 7D 12 JGE SHORT PYG.00403571
0040355F . 68 A0000000 PUSH 0A0
00403564 . 68 48214000 PUSH PYG.00402148
00403569 . 53 PUSH EBX
0040356A . 50 PUSH EAX
0040356B . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00403571 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00403574 . 8B10 MOV EDX,DWORD PTR DS:[EAX]
00403576 . 50 PUSH EAX
00403577 . FF92 00030000 CALL DWORD PTR DS:[EDX+300]
0040357D . 50 PUSH EAX
0040357E . 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
00403581 . 50 PUSH EAX
00403582 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00403588 . 8BD8 MOV EBX,EAX
0040358A . 8B0B MOV ECX,DWORD PTR DS:[EBX]
0040358C . 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
0040358F . 52 PUSH EDX
00403590 . 53 PUSH EBX
00403591 . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
00403597 . DBE2 FCLEX
00403599 . 85C0 TEST EAX,EAX
0040359B . 7D 12 JGE SHORT PYG.004035AF
0040359D . 68 A0000000 PUSH 0A0
004035A2 . 68 48214000 PUSH PYG.00402148
004035A7 . 53 PUSH EBX
004035A8 . 50 PUSH EAX
004035A9 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
004035AF > BB 01000000 MOV EBX,1
004035B4 . 895D AC MOV DWORD PTR SS:[EBP-54],EBX
004035B7 . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
004035BE . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
004035C1 . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
004035C8 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
004035CB . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
004035D2 . 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
004035D5 . 50 PUSH EAX
004035D6 . 6A 0C PUSH 0C
004035D8 . 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
004035DB . 51 PUSH ECX
004035DC . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
004035DF . 52 PUSH EDX
004035E0 . FFD6 CALL ESI
004035E2 . 899D 7CFFFFFF MOV DWORD PTR SS:[EBP-84],EBX
004035E8 . C785 74FFFFFF >MOV DWORD PTR SS:[EBP-8C],2
004035F2 . 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
004035F5 . C745 D8 000000>MOV DWORD PTR SS:[EBP-28],0
004035FC . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
004035FF . C745 84 080000>MOV DWORD PTR SS:[EBP-7C],8
00403606 . 8D85 74FFFFFF LEA EAX,DWORD PTR SS:[EBP-8C]
0040360C . 50 PUSH EAX
0040360D . 6A 06 PUSH 6
0040360F . 8D4D 84 LEA ECX,DWORD PTR SS:[EBP-7C]
00403612 . 51 PUSH ECX
00403613 . 8D95 64FFFFFF LEA EDX,DWORD PTR SS:[EBP-9C]
00403619 . 52 PUSH EDX
0040361A . FFD6 CALL ESI
0040361C . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
00403622 . 50 PUSH EAX
00403623 . 8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]
00403626 . 51 PUSH ECX
00403627 . FFD7 CALL EDI
00403629 . 50 PUSH EAX
0040362A . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00403630 . 66:8BD8 MOV BX,AX
00403633 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00403636 . 52 PUSH EDX
00403637 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
0040363A . 50 PUSH EAX
0040363B . FFD7 CALL EDI
0040363D . 50 PUSH EAX
0040363E . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00403644 . 33C9 XOR ECX,ECX
00403646 . 66:3BC3 CMP AX,BX ; 第十二位与用户名第6位比较
00403649 . 0F94C1 SETE CL
0040364C . F7D9 NEG ECX
0040364E . 8BD9 MOV EBX,ECX
00403650 . 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00403653 . 52 PUSH EDX
00403654 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00403657 . 50 PUSH EAX
00403658 . 6A 02 PUSH 2
0040365A . FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList
00403660 . 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00403663 . 51 PUSH ECX
00403664 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00403667 . 52 PUSH EDX
00403668 . 6A 02 PUSH 2
0040366A . FF15 14104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObjList
00403670 . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
00403676 . 50 PUSH EAX
00403677 . 8D8D 74FFFFFF LEA ECX,DWORD PTR SS:[EBP-8C]
0040367D . 51 PUSH ECX
0040367E . 8D55 84 LEA EDX,DWORD PTR SS:[EBP-7C]
00403681 . 52 PUSH EDX
00403682 . 8D45 94 LEA EAX,DWORD PTR SS:[EBP-6C]
00403685 . 50 PUSH EAX
00403686 . 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
00403689 . 51 PUSH ECX
0040368A . 8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C]
0040368D . 52 PUSH EDX
0040368E . 6A 06 PUSH 6
00403690 . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00403696 . 83C4 34 ADD ESP,34
00403699 . 66:85DB TEST BX,BX
0040369C 0F84 FF040000 JE PYG.00403BA1 ; 不等跳！
004036A2 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
004036A5 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
004036A7 . 50 PUSH EAX
004036A8 . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
004036AE . 50 PUSH EAX
004036AF . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
004036B2 . 52 PUSH EDX
004036B3 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
004036B9 . 8BD8 MOV EBX,EAX
004036BB . 8B03 MOV EAX,DWORD PTR DS:[EBX]
004036BD . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
004036C0 . 51 PUSH ECX
004036C1 . 53 PUSH EBX
004036C2 . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
004036C8 . DBE2 FCLEX
004036CA . 85C0 TEST EAX,EAX
004036CC . 7D 12 JGE SHORT PYG.004036E0
004036CE . 68 A0000000 PUSH 0A0
004036D3 . 68 48214000 PUSH PYG.00402148
004036D8 . 53 PUSH EBX
004036D9 . 50 PUSH EAX
004036DA . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
004036E0 > C745 AC 010000>MOV DWORD PTR SS:[EBP-54],1
004036E7 . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
004036EE . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
004036F1 . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
004036F8 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
004036FB . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
00403702 . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
00403705 . 52 PUSH EDX
00403706 . 6A 0D PUSH 0D
00403708 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
0040370B . 50 PUSH EAX
0040370C . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
0040370F . 51 PUSH ECX
00403710 . FFD6 CALL ESI
00403712 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00403715 . 52 PUSH EDX
00403716 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00403719 . 50 PUSH EAX
0040371A . FFD7 CALL EDI
0040371C . 50 PUSH EAX
0040371D . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00403723 . 33DB XOR EBX,EBX
00403725 . 66:3D 7900 CMP AX,79 ; 第十三位与y比较
00403729 . 0F94C3 SETE BL
0040372C . F7DB NEG EBX
0040372E . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
00403731 . FF15 AC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStr
00403737 . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
0040373A . FF15 A8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj
00403740 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
00403743 . 51 PUSH ECX
00403744 . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
00403747 . 52 PUSH EDX
00403748 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
0040374B . 50 PUSH EAX
0040374C . 6A 03 PUSH 3
0040374E . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
00403754 . 83C4 10 ADD ESP,10
00403757 . 66:85DB TEST BX,BX
0040375A 0F84 41040000 JE PYG.00403BA1 ; 不等跳！
00403760 . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00403763 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
00403765 . 50 PUSH EAX
00403766 . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
0040376C . 50 PUSH EAX
0040376D . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00403770 . 52 PUSH EDX
00403771 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
00403777 . 8BD8 MOV EBX,EAX
00403779 . 8B03 MOV EAX,DWORD PTR DS:[EBX]
0040377B . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
0040377E . 51 PUSH ECX
0040377F . 53 PUSH EBX
00403780 . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
00403786 . DBE2 FCLEX
00403788 . 85C0 TEST EAX,EAX
0040378A . 7D 12 JGE SHORT PYG.0040379E
0040378C . 68 A0000000 PUSH 0A0
00403791 . 68 48214000 PUSH PYG.00402148
00403796 . 53 PUSH EBX
00403797 . 50 PUSH EAX
00403798 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
0040379E > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
004037A1 . 8B10 MOV EDX,DWORD PTR DS:[EAX]
004037A3 . 50 PUSH EAX
004037A4 . FF92 00030000 CALL DWORD PTR DS:[EDX+300]
004037AA . 50 PUSH EAX
004037AB . 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
004037AE . 50 PUSH EAX
004037AF . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
004037B5 . 8BD8 MOV EBX,EAX
004037B7 . 8B0B MOV ECX,DWORD PTR DS:[EBX]
004037B9 . 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
004037BC . 52 PUSH EDX
004037BD . 53 PUSH EBX
004037BE . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
004037C4 . DBE2 FCLEX
004037C6 . 85C0 TEST EAX,EAX
004037C8 . 7D 12 JGE SHORT PYG.004037DC
004037CA . 68 A0000000 PUSH 0A0
004037CF . 68 48214000 PUSH PYG.00402148
004037D4 . 53 PUSH EBX
004037D5 . 50 PUSH EAX
004037D6 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
004037DC > BB 01000000 MOV EBX,1
004037E1 . 895D AC MOV DWORD PTR SS:[EBP-54],EBX
004037E4 . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
004037EB . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
004037EE . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
004037F5 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
004037F8 . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
004037FF . 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
00403802 . 50 PUSH EAX
00403803 . 6A 0E PUSH 0E
00403805 . 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
00403808 . 51 PUSH ECX
00403809 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
0040380C . 52 PUSH EDX
0040380D . FFD6 CALL ESI
0040380F . 899D 7CFFFFFF MOV DWORD PTR SS:[EBP-84],EBX
00403815 . C785 74FFFFFF >MOV DWORD PTR SS:[EBP-8C],2
0040381F . 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
00403822 . C745 D8 000000>MOV DWORD PTR SS:[EBP-28],0
00403829 . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
0040382C . C745 84 080000>MOV DWORD PTR SS:[EBP-7C],8
00403833 . 8D85 74FFFFFF LEA EAX,DWORD PTR SS:[EBP-8C]
00403839 . 50 PUSH EAX
0040383A . 6A 07 PUSH 7
0040383C . 8D4D 84 LEA ECX,DWORD PTR SS:[EBP-7C]
0040383F . 51 PUSH ECX
00403840 . 8D95 64FFFFFF LEA EDX,DWORD PTR SS:[EBP-9C]
00403846 . 52 PUSH EDX
00403847 . FFD6 CALL ESI
00403849 . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
0040384F . 50 PUSH EAX
00403850 . 8D4D D4 LEA ECX,DWORD PTR SS:[EBP-2C]
00403853 . 51 PUSH ECX
00403854 . FFD7 CALL EDI
00403856 . 50 PUSH EAX
00403857 . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
0040385D . 66:8BD8 MOV BX,AX
00403860 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00403863 . 52 PUSH EDX
00403864 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00403867 . 50 PUSH EAX
00403868 . FFD7 CALL EDI
0040386A . 50 PUSH EAX
0040386B . FF15 18104000 CALL DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00403871 . 33C9 XOR ECX,ECX
00403873 . 66:3BC3 CMP AX,BX ; 第十四位注册码与第七位用户名比较
00403876 . 0F94C1 SETE CL
00403879 . F7D9 NEG ECX
0040387B . 8BD9 MOV EBX,ECX
0040387D . 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00403880 . 52 PUSH EDX
00403881 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00403884 . 50 PUSH EAX
00403885 . 6A 02 PUSH 2
00403887 . FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList
0040388D . 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00403890 . 51 PUSH ECX
00403891 . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00403894 . 52 PUSH EDX
00403895 . 6A 02 PUSH 2
00403897 . FF15 14104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObjList
0040389D . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
004038A3 . 50 PUSH EAX
004038A4 . 8D8D 74FFFFFF LEA ECX,DWORD PTR SS:[EBP-8C]
004038AA . 51 PUSH ECX
004038AB . 8D55 84 LEA EDX,DWORD PTR SS:[EBP-7C]
004038AE . 52 PUSH EDX
004038AF . 8D45 94 LEA EAX,DWORD PTR SS:[EBP-6C]
004038B2 . 50 PUSH EAX
004038B3 . 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
004038B6 . 51 PUSH ECX
004038B7 . 8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C]
004038BA . 52 PUSH EDX
004038BB . 6A 06 PUSH 6
004038BD . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
004038C3 . 83C4 34 ADD ESP,34
004038C6 . 66:85DB TEST BX,BX
004038C9 0F84 D2020000 JE PYG.00403BA1 ; 不等跳！
004038CF . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
004038D2 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
004038D4 . 50 PUSH EAX
004038D5 . FF91 FC020000 CALL DWORD PTR DS:[ECX+2FC]
004038DB . 50 PUSH EAX
004038DC . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
004038DF . 52 PUSH EDX
004038E0 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
004038E6 . 8BD8 MOV EBX,EAX
004038E8 . 8B03 MOV EAX,DWORD PTR DS:[EBX]
004038EA . 8D4D E0 LEA ECX,DWORD PTR SS:[EBP-20]
004038ED . 51 PUSH ECX
004038EE . 53 PUSH EBX
004038EF . FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]
004038F5 . DBE2 FCLEX
004038F7 . 85C0 TEST EAX,EAX
004038F9 . 7D 12 JGE SHORT PYG.0040390D
004038FB . 68 A0000000 PUSH 0A0
00403900 . 68 48214000 PUSH PYG.00402148
00403905 . 53 PUSH EBX
00403906 . 50 PUSH EAX
00403907 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
0040390D > C745 AC 010000>MOV DWORD PTR SS:[EBP-54],1
00403914 . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
0040391B . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
0040391E . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
00403925 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
00403928 . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
0040392F . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
00403932 . 52 PUSH EDX
00403933 . 6A 0F PUSH 0F
00403935 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
00403938 . 50 PUSH EAX
00403939 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
0040393C . 51 PUSH ECX
0040393D . FFD6 CALL ESI
0040393F . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00403942 . 52 PUSH EDX
00403943 . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00403946 . 50 PUSH EAX
00403947 . FFD7 CALL EDI
00403949 . 50 PUSH EAX
0040394A . 8B1D 18104000 MOV EBX,DWORD PTR DS:[<&MSVBVM60.#516>] ; MSVBVM60.rtcAnsiValueBstr
00403950 . FFD3 CALL EBX ; <&MSVBVM60.#516>
00403952 . 33C9 XOR ECX,ECX
00403954 . 66:3D 6700 CMP AX,67 ; 第十五位注册码与g比较
00403958 . 0F94C1 SETE CL
0040395B . F7D9 NEG ECX
0040395D . 66:898D 18FFFF>MOV WORD PTR SS:[EBP-E8],CX
00403964 . 8D4D DC LEA ECX,DWORD PTR SS:[EBP-24]
00403967 . FF15 AC104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStr
0040396D . 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-30]
00403970 . FF15 A8104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObj
00403976 . 8D55 94 LEA EDX,DWORD PTR SS:[EBP-6C]
00403979 . 52 PUSH EDX
0040397A . 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
0040397D . 50 PUSH EAX
0040397E . 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
00403981 . 51 PUSH ECX
00403982 . 6A 03 PUSH 3
00403984 . FF15 0C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVarList
0040398A . 83C4 10 ADD ESP,10
0040398D . 66:83BD 18FFFF>CMP WORD PTR SS:[EBP-E8],0
00403995 0F84 06020000 JE PYG.00403BA1 ; 不等跳！
0040399B . 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
0040399E . 8B10 MOV EDX,DWORD PTR DS:[EAX]
004039A0 . 50 PUSH EAX
004039A1 . FF92 FC020000 CALL DWORD PTR DS:[EDX+2FC]
004039A7 . 50 PUSH EAX
004039A8 . 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-30]
004039AB . 50 PUSH EAX
004039AC . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
004039B2 . 8985 20FFFFFF MOV DWORD PTR SS:[EBP-E0],EAX
004039B8 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
004039BA . 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
004039BD . 52 PUSH EDX
004039BE . 50 PUSH EAX
004039BF . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
004039C5 . DBE2 FCLEX
004039C7 . 85C0 TEST EAX,EAX
004039C9 . 7D 18 JGE SHORT PYG.004039E3
004039CB . 68 A0000000 PUSH 0A0
004039D0 . 68 48214000 PUSH PYG.00402148
004039D5 . 8B8D 20FFFFFF MOV ECX,DWORD PTR SS:[EBP-E0]
004039DB . 51 PUSH ECX
004039DC . 50 PUSH EAX
004039DD . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
004039E3 > 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
004039E6 . 8B10 MOV EDX,DWORD PTR DS:[EAX]
004039E8 . 50 PUSH EAX
004039E9 . FF92 00030000 CALL DWORD PTR DS:[EDX+300]
004039EF . 50 PUSH EAX
004039F0 . 8D45 CC LEA EAX,DWORD PTR SS:[EBP-34]
004039F3 . 50 PUSH EAX
004039F4 . FF15 2C104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaObjSe>; MSVBVM60.__vbaObjSet
004039FA . 8985 18FFFFFF MOV DWORD PTR SS:[EBP-E8],EAX
00403A00 . 8B08 MOV ECX,DWORD PTR DS:[EAX]
00403A02 . 8D55 D8 LEA EDX,DWORD PTR SS:[EBP-28]
00403A05 . 52 PUSH EDX
00403A06 . 50 PUSH EAX
00403A07 . FF91 A0000000 CALL DWORD PTR DS:[ECX+A0]
00403A0D . DBE2 FCLEX
00403A0F . 85C0 TEST EAX,EAX
00403A11 . 7D 18 JGE SHORT PYG.00403A2B
00403A13 . 68 A0000000 PUSH 0A0
00403A18 . 68 48214000 PUSH PYG.00402148
00403A1D . 8B8D 18FFFFFF MOV ECX,DWORD PTR SS:[EBP-E8]
00403A23 . 51 PUSH ECX
00403A24 . 50 PUSH EAX
00403A25 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
00403A2B > C745 AC 010000>MOV DWORD PTR SS:[EBP-54],1
00403A32 . C745 A4 020000>MOV DWORD PTR SS:[EBP-5C],2
00403A39 . 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
00403A3C . C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
00403A43 . 8945 BC MOV DWORD PTR SS:[EBP-44],EAX
00403A46 . C745 B4 080000>MOV DWORD PTR SS:[EBP-4C],8
00403A4D . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
00403A50 . 52 PUSH EDX
00403A51 . 6A 10 PUSH 10
00403A53 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
00403A56 . 50 PUSH EAX
00403A57 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
00403A5A . 51 PUSH ECX
00403A5B . FFD6 CALL ESI
00403A5D . C785 7CFFFFFF >MOV DWORD PTR SS:[EBP-84],1
00403A67 . C785 74FFFFFF >MOV DWORD PTR SS:[EBP-8C],2
00403A71 . 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
00403A74 . C745 D8 000000>MOV DWORD PTR SS:[EBP-28],0
00403A7B . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
00403A7E . C745 84 080000>MOV DWORD PTR SS:[EBP-7C],8
00403A85 . 8D95 74FFFFFF LEA EDX,DWORD PTR SS:[EBP-8C]
00403A8B . 52 PUSH EDX
00403A8C . 6A 08 PUSH 8
00403A8E . 8D45 84 LEA EAX,DWORD PTR SS:[EBP-7C]
00403A91 . 50 PUSH EAX
00403A92 . 8D8D 64FFFFFF LEA ECX,DWORD PTR SS:[EBP-9C]
00403A98 . 51 PUSH ECX
00403A99 . FFD6 CALL ESI
00403A9B . 8D95 64FFFFFF LEA EDX,DWORD PTR SS:[EBP-9C]
00403AA1 . 52 PUSH EDX
00403AA2 . 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C]
00403AA5 . 50 PUSH EAX
00403AA6 . FFD7 CALL EDI
00403AA8 . 50 PUSH EAX
00403AA9 . FFD3 CALL EBX
00403AAB . 66:8BF0 MOV SI,AX
00403AAE . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
00403AB1 . 51 PUSH ECX
00403AB2 . 8D55 DC LEA EDX,DWORD PTR SS:[EBP-24]
00403AB5 . 52 PUSH EDX
00403AB6 . FFD7 CALL EDI
00403AB8 . 50 PUSH EAX
00403AB9 . FFD3 CALL EBX
00403ABB . 33C9 XOR ECX,ECX
00403ABD . 66:3BC6 CMP AX,SI ; 第十六位与第八位用户名比较
00403AC0 . 0F94C1 SETE CL
00403AC3 . F7D9 NEG ECX
00403AC5 . 8BF1 MOV ESI,ECX
00403AC7 . 8D55 D4 LEA EDX,DWORD PTR SS:[EBP-2C]
00403ACA . 52 PUSH EDX
00403ACB . 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
00403ACE . 50 PUSH EAX
00403ACF . 6A 02 PUSH 2
00403AD1 . FF15 84104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStrList
00403AD7 . 8D4D CC LEA ECX,DWORD PTR SS:[EBP-34]
00403ADA . 51 PUSH ECX
00403ADB . 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-30]
00403ADE . 52 PUSH EDX
00403ADF . 6A 02 PUSH 2
00403AE1 . FF15 14104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeO>; MSVBVM60.__vbaFreeObjList
00403AE7 . 8D85 64FFFFFF LEA EAX,DWORD PTR SS:[EBP-9C]
00403AED . 50 PUSH EAX
00403AEE . 8D8D 74FFFFFF LEA ECX,DWORD PTR SS:[EBP-8C]
00403AF4 . 51 PUSH ECX
00403AF5 . 8D55 84 LEA EDX,DWORD PTR SS:[EBP-7C]
00403AF8 . 52 PUSH EDX
00403AF9 . 8D45 94 LEA EAX,DWORD PTR SS:[EBP-6C]
00403AFC . 50 PUSH EAX
00403AFD . 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
00403B00 . 51 PUSH ECX
00403B01 . 8D55 B4 LEA EDX,DWORD PTR SS:[EBP-4C]
00403B04 . 52 PUSH EDX
00403B05 . 6A 06 PUSH 6
00403B07 . 8B3D 0C104000 MOV EDI,DWORD PTR DS:[<&MSVBVM60.__vbaFr>; MSVBVM60.__vbaFreeVarList
00403B0D . FFD7 CALL EDI ; <&MSVBVM60.__vbaFreeVarList>
00403B0F . 83C4 34 ADD ESP,34
00403B12 . 66:85F6 TEST SI,SI
00403B15 0F84 86000000 JE PYG.00403BA1 ; 不等跳！
00403B1B . B8 04000280 MOV EAX,80020004
00403B20 . 8945 8C MOV DWORD PTR SS:[EBP-74],EAX
00403B23 . B9 0A000000 MOV ECX,0A
00403B28 . 894D 84 MOV DWORD PTR SS:[EBP-7C],ECX
00403B2B . 8945 9C MOV DWORD PTR SS:[EBP-64],EAX
00403B2E . 894D 94 MOV DWORD PTR SS:[EBP-6C],ECX
00403B31 . C785 4CFFFFFF >MOV DWORD PTR SS:[EBP-B4],PYG.00402184 ; UNICODE "Good,You Did It"
00403B3B . BB 08000000 MOV EBX,8
00403B40 . 899D 44FFFFFF MOV DWORD PTR SS:[EBP-BC],EBX
00403B46 . 8D95 44FFFFFF LEA EDX,DWORD PTR SS:[EBP-BC]
00403B4C . 8D4D A4 LEA ECX,DWORD PTR SS:[EBP-5C]
00403B4F . 8B35 94104000 MOV ESI,DWORD PTR DS:[<&MSVBVM60.__vbaVa>; MSVBVM60.__vbaVarDup
00403B55 . FFD6 CALL ESI ; <&MSVBVM60.__vbaVarDup>
00403B57 . C785 5CFFFFFF >MOV DWORD PTR SS:[EBP-A4],PYG.0040215C ; UNICODE "Congratulations!"
00403B61 . 899D 54FFFFFF MOV DWORD PTR SS:[EBP-AC],EBX
00403B67 . 8D95 54FFFFFF LEA EDX,DWORD PTR SS:[EBP-AC]
00403B6D . 8D4D B4 LEA ECX,DWORD PTR SS:[EBP-4C]
00403B70 . FFD6 CALL ESI
00403B72 . 8D45 84 LEA EAX,DWORD PTR SS:[EBP-7C]
00403B75 . 50 PUSH EAX
00403B76 . 8D4D 94 LEA ECX,DWORD PTR SS:[EBP-6C]
00403B79 . 51 PUSH ECX
00403B7A . 8D55 A4 LEA EDX,DWORD PTR SS:[EBP-5C]
00403B7D . 52 PUSH EDX
00403B7E . 6A 40 PUSH 40
00403B80 . 8D45 B4 LEA EAX,DWORD PTR SS:[EBP-4C]
00403B83 . 50 PUSH EAX
00403B84 . FF15 34104000 CALL DWORD PTR DS:[<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox
3、注册码汇总
(1)用户名不能小于8位，注册码不能小于16位，但只验证注册码前16位
(2)如果我用户名为busheler注册码应该是这样：
1 3 5 7 9 11 13 15
c h i n a p y g ====>chinapyg
2 4 6 8 10 12 14 16
b u s h e l e r ====>busheler
合并后：
用户名：busheler
注册码：cbhuisnhaeplyegr
注册机应该很容易做的了。
四、总结
注册码算法及比较慢创意，值得学习！
-----------------------------------------------------------------------
【版权声明】交流学习，非商业应用，转载时请保证其完整！
赞赏
|
|
|---|---|
|
|
在00403B0D处下断跟踪一下就会发现当你每输入一次注册码都会有一次中断，直到你输满16位
我的上面没有中断啊，一点反映没有。 而且字符串的查找，可以直接在OD里完成不是吗？ 希望指导一下我。。。 谢谢 
|
|
|
004028E2 . FF15 20104000 CALL DWORD PTR DS:[<&MSVBVM60.__vbaHresu>; MSVBVM60.__vbaHresultCheckObj
004028E8 > 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24] ; 注册码入EAX 也没断下。。。。 
|
|
|
呵呵，是我笔误
“在00402770处下断跟踪一下就会发现当你每输入一次注册码都会有一次中断，直到你输满16位。” 实际上对用户名长度也是有限制的，不能小于8位 |
|
|
原来这样。。
我用的向来是是654321 |
|
|
嗯，不错的CRACKME，不太难，只是有点烦而已
|
|
|
- VB decompiler v2.2 Released 3297
- 算法分析之CrackMe_Code By 飘云[PYG] 7366
- 好多工具下载（俄语站） 4712
- CrackMe By ErShu算法分析 7241
- 算法分析之CrackMe001 By飘云[PYG] 8142
