key = 01234567890111A

0123 4567 8901 0111A

A     B    C    D

esp - 4 : 00413131
esp - 8 : C
esp - 12 : B
esp - 16 : A

mov eax,0
mov [0041B034],eax
pop eax ; A
mov ecx,eax
pop eax ; B
mov ebx,eax
pop eax : C
mov edx,eax ; ecx: A ebx:B edx:C
mov ecx,eax
sub eax,ebx ; A-B
shl eax,2 ; (A-B)<<2
add eax,ecx; (A-B)<<2 + A
add eax,edx; (A-B)<<2 + A + C
sub eax,0xEAF917E2 ; (A-B)<<2 + A + C - 0xEAF917E2
jnz end
add eax,ecx
sub eax,ebx; A-B
mov ebx,eax ; !!!!! ebx = A-B
shl eax,1 ; (A-B)<<1
add eax,ebx ; 2(A-B)+A-B
add eax,ecx ; 2(A-B)+A-B+A
mov ecx,eax ; !!!!! ecx = 2(A-B)+A-B+A
add eax,edx ; 2(A-B)+A-B+A + C
sub eax,0XE8F508C8; 2(A-B)+A-B+A + C- 0xE8F508C8
jnz end
mov eax,ecx ; eax = 2(A-B)+A-B+A
sub eax,edx ; 2(A-B)+A-B+A  - C
sub eax,0x0C0A3C68; 2(A-B)+A-B+A  - C -0x0C0A3C68
mov eax,D ; pop eax
xor eax,0X8101 ; D^0x8101
mov edi,eax 
xor eax,eax
stos es:[edi] ; edi = 0041B030 eax = 0
call 00413841
    pop eax ; eax = 00413835
    push eax
    mov edi,eax
    push 4e000969
    pop eax ; eax = 4e000969
    xor eax,edx ; 4e00969^C
    stos es:[edi] ; edi = 00413835 eax = 4e00969^C
    xor eax,10A3E; 4e00969^D^0x10A3E
    
......省去一亿个废话

end:
pop eax ; D
xor eax,0x1210E ; D^0x1210E
xor eax, [41B032] ; D^0x1210E^0
jmp 0040103F ; bad-register code