::004023E5:: F3 REP STOS DWORD PTR ES:[EDI]
::004023E6:: AB STOS DWORD PTR ES:[EDI]
::004023E7:: 66:AB STOS WORD PTR ES:[EDI]
::004023E9:: 8D8C24 D8060000 LEA ECX, [ESP+6D8]
::004023F0:: 68 B0F34100 PUSH 41F3B0 \->: %d
::004023F5:: 51 PUSH ECX
::004023F6:: AA STOS BYTE PTR ES:[EDI]
::004023F7:: E8 12300000 CALL 0040540E \:JMPDOWN
::004023FC:: 83C4 0C ADD ESP, C
::004023FF:: 8D9424 CC000000 LEA EDX, [ESP+CC]
::00402406:: 8D8424 D4060000 LEA EAX, [ESP+6D4]
::0040240D:: 8D4C24 68 LEA ECX, [ESP+68]
::00402411:: 52 PUSH EDX
::00402412:: 50 PUSH EAX
::00402413:: 51 PUSH ECX
::00402414:: 68 B4F34100 PUSH 41F3B4 \->: Product
::00402419:: FF15 5C924100 CALL [41925C] >>>: KERNEL32.DLL:写ini文件
::0040241F:: E9 0CFEFFFF JMP 00402230 \:JMPUP
::00402424:: 2BD3 SUB EDX, EBX \:BYJMP JmpBy:004023C8,
::00402426:: 78 09 JS SHORT 00402431 \:JMPDOWN
::00402428:: 83FA 0F CMP EDX, F //这一块的F是15天限制，开始想着把时间改长一点试试，结果大于15天也会过期小于15天也会过期
::0040242B:: 0F8C FFFDFFFF JL 00402230 \:JMPUP
::00402431:: 6A 00 PUSH 0 \:BYJMP JmpBy:00402426,
::00402433:: 6A 40 PUSH 40
::00402435:: 68 84F34100 PUSH 41F384 \->: 软件试用期已经过期。
::0040243A:: E8 EE3E0100 CALL 0041632D \:JMPDOWN
::0040243F:: E9 52050000 JMP 00402996 \:JMPDOWN
::00402444:: 8B5424 34 MOV EDX, [ESP+34] \:BYJMP JmpBy:00402512,
::00402448:: 8BFA MOV EDI, EDX \:BYJMP JmpBy:004022B5,
::0040244A:: 83C9 FF OR ECX, FFFFFFFF
::0040244D:: 33C0 XOR EAX, EAX
........
注册部分
::00403841:: 8D8E 04010000 LEA ECX, [ESI+104]
::00403847:: 51 PUSH ECX
::00403848:: 52 PUSH EDX
::00403849:: 68 F4F34100 PUSH 41F3F4 \->: RegCode
::0040384E:: 68 ECF34100 PUSH 41F3EC \->: System
::00403853:: FF15 5C924100 CALL [41925C] >>>: KERNEL32.DLL:写ini文件
::00403859:: 6A 00 PUSH 0
::0040385B:: 68 F7030000 PUSH 3F7
::00403860:: 8BCE MOV ECX, ESI
::00403862:: E8 A1040100 CALL 00413D08 \:JMPDOWN
::00403867:: 8BC8 MOV ECX, EAX
::00403869:: E8 CF050100 CALL 00413E3D \:JMPDOWN
::0040386E:: 6A 00 PUSH 0
::00403870:: 6A 40 PUSH 40
::00403872:: 68 20F64100 PUSH 41F620 \->: 注册成功，请重启****服务端!
::00403877:: EB 09 JMP SHORT 00403882 \:JMPDOWN
::00403879:: 6A 00 PUSH 0 \:BYJMP JmpBy:0040383B,
::0040387B:: 6A 40 PUSH 40
::0040387D:: 68 14F64100 PUSH 41F614 \->: 注册失败!
::00403882:: E8 A62A0100 CALL 0041632D \:JMPDOWN\:BYJMP JmpBy:00403877,
::00403887:: 8D4C24 60 LEA ECX, [ESP+60] \:BYJMP JmpBy:0040382A,
::0040388B:: C74424 6C 01000000 MOV DWORD PTR [ESP+6C], 1
::00403893:: E8 7C0D0100 CALL 00414614 \:JMPDOWN
::00403898:: 8D4C24 04 LEA ECX, [ESP+4]
::0040389C:: C74424 6C FFFFFFFF MOV DWORD PTR [ESP+6C], -1
::004038A4:: E8 70D20000 CALL 00410B19 \:JMPDOWN
::004038A9:: 8B4C24 64 MOV ECX, [ESP+64]
::004038AD:: 5E POP ESI
::004038AE:: 64:890D 00000000 MOV FS:[0], ECX
::004038B5:: 83C4 6C ADD ESP, 6C
::004038B8:: C3 RETN
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
