我只知道是用到了BASE64、MD5、RSA加密，但不知道它的运算顺序是怎样的？
1111B45C C785 94FEFFFF 1>MOV DWORD PTR SS:[EBP-16C],PE_EShop.11010914 ; 0c2766f5868ec65d29f2a08059f2bdab
1111B466 C785 8CFEFFFF 0>MOV DWORD PTR SS:[EBP-174],8 ;判断本地管理，不需要序列号
1111B470 FF15 98120011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarCopy>] ; msvbvm60.__vbaVarCopy
1111B476 8D95 8CFEFFFF LEA EDX,DWORD PTR SS:[EBP-174]
1111B47C 8D8D 0CFFFFFF LEA ECX,DWORD PTR SS:[EBP-F4]
1111B482 C785 94FEFFFF B>MOV DWORD PTR SS:[EBP-16C],PE_EShop.110114B0 ; c64d1730ce6fac08dfe10336250c3e72
1111B48C C785 8CFEFFFF 0>MOV DWORD PTR SS:[EBP-174],8
1111B496 FF15 98120011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarCopy>] ; msvbvm60.__vbaVarCopy
1111B49C 8D55 9C LEA EDX,DWORD PTR SS:[EBP-64]
1111B49F 8D85 1CFFFFFF LEA EAX,DWORD PTR SS:[EBP-E4]
1111B4A5 52 PUSH EDX
1111B4A6 8D8D ECFEFFFF LEA ECX,DWORD PTR SS:[EBP-114]
1111B4AC 50 PUSH EAX
1111B4AD 51 PUSH ECX
1111B4AE FF15 64120011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarCmpEq>] ; msvbvm60.__vbaVarCmpEq
1111B4B4 50 PUSH EAX
1111B4B5 8D55 9C LEA EDX,DWORD PTR SS:[EBP-64]
1111B4B8 8D85 0CFFFFFF LEA EAX,DWORD PTR SS:[EBP-F4]
1111B4BE 52 PUSH EDX
1111B4BF 8D8D DCFEFFFF LEA ECX,DWORD PTR SS:[EBP-124]
1111B4C5 50 PUSH EAX
1111B4C6 51 PUSH ECX
1111B4C7 FF15 64120011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarCmpEq>] ; msvbvm60.__vbaVarCmpEq
1111B4CD 8D95 CCFEFFFF LEA EDX,DWORD PTR SS:[EBP-134]
1111B4D3 50 PUSH EAX
1111B4D4 52 PUSH EDX
1111B4D5 FF15 74110011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarOr>] ; msvbvm60.__vbaVarOr
1111B4DB 50 PUSH EAX
1111B4DC FF15 0C110011 CALL DWORD PTR DS:[<&msvbvm60.__vbaBoolVarNull>] ; msvbvm60.__vbaBoolVarNull
1111B4E2 66:85C0 TEST AX,AX //非本地管理，需要序列号
1111B4E5 E9 EE0A0000 JMP PE_EShop.1111BFD8 //判断是否存在序列号,并正确,正确,且没过期,则转到程序真正入口111BFD8
1111B4EA 008D 958CFEFF ADD BYTE PTR SS:[EBP+FFFE8C95],CL
1111B4F0 FF8D 8D4CFFFF DEC DWORD PTR SS:[EBP+FFFF4C8D]
1111B4F6 FFC7 INC EDI
1111B4F8 8594FE FFFF0000 TEST DWORD PTR DS:[ESI+EDI*8+FFFF],EDX
1111B4FF 0000 ADD BYTE PTR DS:[EAX],AL
1111B501 C785 8CFEFFFF 0>MOV DWORD PTR SS:[EBP-174],0B
1111B50B FFD6 CALL ESI
1111B50D 8B8D 5CFFFFFF MOV ECX,DWORD PTR SS:[EBP-A4]
1111B513 8B95 60FFFFFF MOV EDX,DWORD PTR SS:[EBP-A0]
1111B519 83EC 10 SUB ESP,10
1111B51C 8BC4 MOV EAX,ESP
1111B51E 8908 MOV DWORD PTR DS:[EAX],ECX
1111B520 8B8D 64FFFFFF MOV ECX,DWORD PTR SS:[EBP-9C]
1111B526 8950 04 MOV DWORD PTR DS:[EAX+4],EDX
1111B529 8B95 68FFFFFF MOV EDX,DWORD PTR SS:[EBP-98]
1111B52F 8948 08 MOV DWORD PTR DS:[EAX+8],ECX
1111B532 8950 0C MOV DWORD PTR DS:[EAX+C],EDX
1111B535 8D85 ECFEFFFF LEA EAX,DWORD PTR SS:[EBP-114]
1111B53B 50 PUSH EAX
1111B53C E8 4FFD2200 CALL PE_EShop.1134B290
1111B541 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
1111B544 8D8D 8CFEFFFF LEA ECX,DWORD PTR SS:[EBP-174]
1111B54A 51 PUSH ECX
1111B54B C785 94FEFFFF D>MOV DWORD PTR SS:[EBP-16C],PE_EShop.1102A5D8 ; eshop
1111B555 8D42 7C LEA EAX,DWORD PTR DS:[EDX+7C]
1111B558 C785 8CFEFFFF 0>MOV DWORD PTR SS:[EBP-174],8
1111B562 50 PUSH EAX
1111B563 8D85 DCFEFFFF LEA EAX,DWORD PTR SS:[EBP-124]
1111B569 50 PUSH EAX
1111B56A FF15 00120011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarCat>] ; msvbvm60.__vbaVarCat
1111B570 8B10 MOV EDX,DWORD PTR DS:[EAX]
1111B572 83EC 10 SUB ESP,10
1111B575 8BCC MOV ECX,ESP
1111B577 8911 MOV DWORD PTR DS:[ECX],EDX
1111B579 8B50 04 MOV EDX,DWORD PTR DS:[EAX+4]
1111B57C 8951 04 MOV DWORD PTR DS:[ECX+4],EDX
1111B57F 8B50 08 MOV EDX,DWORD PTR DS:[EAX+8]
1111B582 8B40 0C MOV EAX,DWORD PTR DS:[EAX+C]
1111B585 8951 08 MOV DWORD PTR DS:[ECX+8],EDX
1111B588 8941 0C MOV DWORD PTR DS:[ECX+C],EAX
1111B58B 8D8D CCFEFFFF LEA ECX,DWORD PTR SS:[EBP-134]
1111B591 51 PUSH ECX
1111B592 E8 F9FC2200 CALL PE_EShop.1134B290
1111B597 8D95 ACFEFFFF LEA EDX,DWORD PTR SS:[EBP-154]
1111B59D 8D85 ECFEFFFF LEA EAX,DWORD PTR SS:[EBP-114]
1111B5A3 52 PUSH EDX
1111B5A4 8D8D CCFEFFFF LEA ECX,DWORD PTR SS:[EBP-134]
1111B5AA 50 PUSH EAX
1111B5AB 8D95 BCFEFFFF LEA EDX,DWORD PTR SS:[EBP-144]
1111B5B1 51 PUSH ECX
1111B5B2 52 PUSH EDX
1111B5B3 C785 B4FEFFFF 2>MOV DWORD PTR SS:[EBP-14C],20
1111B5BD 899D ACFEFFFF MOV DWORD PTR SS:[EBP-154],EBX
1111B5C3 FF15 00120011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarCat>] ; msvbvm60.__vbaVarCat
1111B5C9 50 PUSH EAX
1111B5CA 8D85 9CFEFFFF LEA EAX,DWORD PTR SS:[EBP-164]
1111B5D0 50 PUSH EAX
1111B5D1 E8 3A87FBFF CALL PE_EShop.110D3D10
1111B5D6 8D95 9CFEFFFF LEA EDX,DWORD PTR SS:[EBP-164]
1111B5DC 8D4D 9C LEA ECX,DWORD PTR SS:[EBP-64]
1111B5DF FFD6 CALL ESI
1111B5E1 8D8D ACFEFFFF LEA ECX,DWORD PTR SS:[EBP-154]
1111B5E7 8D95 BCFEFFFF LEA EDX,DWORD PTR SS:[EBP-144]
1111B5ED 51 PUSH ECX
1111B5EE 8D85 CCFEFFFF LEA EAX,DWORD PTR SS:[EBP-134]
1111B5F4 52 PUSH EDX
1111B5F5 8D8D ECFEFFFF LEA ECX,DWORD PTR SS:[EBP-114]
1111B5FB 50 PUSH EAX
1111B5FC 8D95 DCFEFFFF LEA EDX,DWORD PTR SS:[EBP-124]
1111B602 51 PUSH ECX
1111B603 52 PUSH EDX
1111B604 6A 05 PUSH 5
1111B606 FFD7 CALL EDI
1111B608 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
1111B60B 83C4 18 ADD ESP,18
1111B60E 8D8D 7CFFFFFF LEA ECX,DWORD PTR SS:[EBP-84]
1111B614 8D90 9C000000 LEA EDX,DWORD PTR DS:[EAX+9C]
1111B61A FF15 98120011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarCopy>] ; msvbvm60.__vbaVarCopy
1111B620 8D8D 7CFFFFFF LEA ECX,DWORD PTR SS:[EBP-84]
1111B626 51 PUSH ECX
1111B627 FF15 58110011 CALL DWORD PTR DS:[<&msvbvm60.rtcIsNull>] ; msvbvm60.rtcIsNull
1111B62D 66:8985 84FEFFF>MOV WORD PTR SS:[EBP-17C],AX
1111B634 C785 7CFEFFFF 0>MOV DWORD PTR SS:[EBP-184],0B
1111B63E 8D95 7CFFFFFF LEA EDX,DWORD PTR SS:[EBP-84]
1111B644 8D85 ECFEFFFF LEA EAX,DWORD PTR SS:[EBP-114]
1111B64A 52 PUSH EDX
1111B64B 50 PUSH EAX
1111B64C FF15 08110011 CALL DWORD PTR DS:[<&msvbvm60.rtcTrimVar>] ; msvbvm60.rtcTrimVar
1111B652 8D8D 7CFEFFFF LEA ECX,DWORD PTR SS:[EBP-184]
1111B658 8D95 ECFEFFFF LEA EDX,DWORD PTR SS:[EBP-114]
1111B65E 51 PUSH ECX
1111B65F 8D85 8CFEFFFF LEA EAX,DWORD PTR SS:[EBP-174]
1111B665 52 PUSH EDX
1111B666 8D8D DCFEFFFF LEA ECX,DWORD PTR SS:[EBP-124]
1111B66C 50 PUSH EAX
1111B66D 51 PUSH ECX
1111B66E C785 94FEFFFF 3>MOV DWORD PTR SS:[EBP-16C],PE_EShop.1100D63C
1111B678 C785 8CFEFFFF 0>MOV DWORD PTR SS:[EBP-174],8008
1111B682 FF15 64120011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarCmpEq>] ; msvbvm60.__vbaVarCmpEq
1111B688 8D95 CCFEFFFF LEA EDX,DWORD PTR SS:[EBP-134]
1111B68E 50 PUSH EAX
1111B68F 52 PUSH EDX
1111B690 FF15 74110011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarOr>] ; msvbvm60.__vbaVarOr
1111B696 50 PUSH EAX
1111B697 FF15 0C110011 CALL DWORD PTR DS:[<&msvbvm60.__vbaBoolVarNull>] ; msvbvm60.__vbaBoolVarNull
1111B69D 66:8985 68FEFFF>MOV WORD PTR SS:[EBP-198],AX
1111B6A4 8D85 7CFEFFFF LEA EAX,DWORD PTR SS:[EBP-184]
1111B6AA 8D8D ECFEFFFF LEA ECX,DWORD PTR SS:[EBP-114]
1111B6B0 50 PUSH EAX
1111B6B1 51 PUSH ECX
1111B6B2 53 PUSH EBX
1111B6B3 FFD7 CALL EDI
1111B6B5 83C4 0C ADD ESP,0C
1111B6B8 66:83BD 68FEFFF>CMP WORD PTR SS:[EBP-198],0
1111B6C0 0F84 81000000 JE PE_EShop.1111B747 ;判断序列号是否存在,存在则111b747判断序列号是否正确,否则显示"每个使用本系统的网站都有一个我们授权的唯一序列号，如果你还没有此序列号，请联系我们获取，否则，你"
1111B6C6 B8 60D20011 MOV EAX,PE_EShop.1100D260 ; w7+49sq508oxvs+1zbo1xm341b62vnpq0ru49s7sw8fk2siotctoqnk70plb0lrfo6zi57n7xoo7uco709c0y9dywdc6xaosx+vbqs+1ztldx7vxykgjrlfx1pkjrmtj
1111B6CB 83EC 10 SUB ESP,10 ; 每个使用本系统的网站都有一个我们授权的唯一序列号，如果你还没有此序列号，请联系我们获取，否则，你
1111B6CE B9 08000000 MOV ECX,8
1111B6D3 8BD4 MOV EDX,ESP
1111B73C 0F8D 63060000 JGE PE_EShop.1111BDA5
1111B742 E9 4C060000 JMP PE_EShop.1111BD93
1111B747 8D85 7CFFFFFF LEA EAX,DWORD PTR SS:[EBP-84] ;如果有序列号入口//
1111B74D 8D8D ECFEFFFF LEA ECX,DWORD PTR SS:[EBP-114]
1111B753 50 PUSH EAX
1111B754 51 PUSH ECX
1111B755 C785 94FEFFFF 0>MOV DWORD PTR SS:[EBP-16C],1000 ;序列号长度 10进制4096
1111B75F C785 8CFEFFFF 0>MOV DWORD PTR SS:[EBP-174],8002
1111B769 FF15 A4100011 CALL DWORD PTR DS:[<&msvbvm60.__vbaLenVar>] ; msvbvm60.__vbaLenVar
1111B76F 8D95 8CFEFFFF LEA EDX,DWORD PTR SS:[EBP-174]
1111B775 50 PUSH EAX
1111B776 52 PUSH EDX
1111B777 FF15 4C120011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarTstNe>] ; msvbvm60.__vbaVarTstNe
1111B77D 66:85C0 TEST AX,AX
1111B780 74 0A JE SHORT PE_EShop.1111B78C ;;判断序列号是否正确, 正确转PE_EShop.1111B78c 不正确显示"你的序列号不对！请联系我们以获得正确的序列号"并转到JMP PE_EShop.1111B6CB
1111B782 B8 B8D30011 MOV EAX,PE_EShop.1100D3B8 ;xoo1xndywdc6xbk7ttsjocfrwarptc7sw8fs1lvxtcpv/ci3tctq8shquswjoq==
1111B787 ^ E9 3FFFFFFF JMP PE_EShop.1111B6CB ;你的序列号不对！请联系我们以获得正确的序列号！
1111B78C 8D85 7CFFFFFF LEA EAX,DWORD PTR SS:[EBP-84]
1111B792 68 A00F0000 PUSH 0FA0 ；4000个
1111B797 8D8D ECFEFFFF LEA ECX,DWORD PTR SS:[EBP-114]
1111BB41 66:83BD 68FEFFF>CMP WORD PTR SS:[EBP-198],0
1111BB49 74 0A JE SHORT PE_EShop.1111BB55 ;判断序列号是否正确, 正确转PE_EShop.1111BB55 不正确显示"你的序列号不对！请联系我们以获得正确的序列号"并转到JMP PE_EShop.1111B6CB
1111BB4B B8 B8D30011 MOV EAX,PE_EShop.1100D3B8 ; xoo1xndywdc6xbk7ttsjocfrwarptc7sw8fs1lvxtcpv/ci3tctq8shquswjoq==
1111BB50 ^ E9 76FBFFFF JMP PE_EShop.1111B6CB ;你的序列号不对！请联系我们以获得正确的序列号
1111BB55 68 E8880011 PUSH PE_EShop.110088E8
1111BB5A FF15 90110011 CALL DWORD PTR DS:[<&msvbvm60.__vbaNew>] ; msvbvm60.__vbaNew
1111BB60 50 PUSH EAX
1111BB61 8D45 AC LEA EAX,DWORD PTR SS:[EBP-54]
1111BB64 50 PUSH EAX
1111BB65 FF15 2C120011 CALL DWORD PTR DS:[<&msvbvm60.__vbaVarSetObj>] ; msvbvm60.__vbaVarSetObj
1111BB6B 83EC 10 SUB ESP,10
1111BB6E B9 08000000 MOV ECX,8
1111BB73 8BD4 MOV EDX,ESP
1111BB75 898D 8CFEFFFF MOV DWORD PTR SS:[EBP-174],ECX
1111BB7B B8 48A60211 MOV EAX,PE_EShop.1102A648 ; mzy0oq== 3649
1111BB80 890A MOV DWORD PTR DS:[EDX],ECX
1111BB82 8B8D 90FEFFFF MOV ECX,DWORD PTR SS:[EBP-170]
1111BB88 8985 94FEFFFF MOV DWORD PTR SS:[EBP-16C],EAX
1111BB8E 894A 04 MOV DWORD PTR DS:[EDX+4],ECX
1111BB91 8D8D ECFEFFFF LEA ECX,DWORD PTR SS:[EBP-114]
1111BB97 51 PUSH ECX
1111BB98 8942 08 MOV DWORD PTR DS:[EDX+8],EAX
1111BB9B 8B85 98FEFFFF MOV EAX,DWORD PTR SS:[EBP-168]
1111BBA1 8942 0C MOV DWORD PTR DS:[EDX+C],EAX
1111BBA4 E8 470A2300 CALL PE_EShop.1134C5F0 //1134c5f0 判断序列号是否过期
1111BBA9 8B85 ECFEFFFF MOV EAX,DWORD PTR SS:[EBP-114]
1111BBAF 8B8D F0FEFFFF MOV ECX,DWORD PTR SS:[EBP-110]
1111BBB5 83EC 10 SUB ESP,10
1111BBB8 8BD4 MOV EDX,ESP
1111BBBA 68 5CA60211 PUSH PE_EShop.1102A65C ; privatekey
1111BBBF 8902 MOV DWORD PTR DS:[EDX],EAX
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
