-
-
[求助]真的有点奇怪，请高手帮忙看看
-
发表于: 2006-7-12 11:06 5056
-
这个程序用Trw2000跟踪了一下按13次F12出现失败画面，按12次F12然后按F10进入下面，在OllyDBG中下断点下面的地方也可以断下：
10015EA2 8D6B 5C LEA EBP,DWORD PTR DS:[EBX+5C]
10015EA5 8BCD MOV ECX,EBP
10015EA7 E8 84DA0000 CALL RegClien.10023930 读取注册码
10015EAC 8BCD MOV ECX,EBP
10015EAE E8 31DA0000 CALL RegClien.100238E4 可能是算出位数，没明白。
10015EB3 8B45 00 MOV EAX,DWORD PTR SS:[EBP]
10015EB6 68 90770310 PUSH RegClien.10037790
10015EBB 50 PUSH EAX
10015EBC E8 3D250000 CALL RegClien.100183FE
10015EC1 83C4 08 ADD ESP,8
10015EC4 85C0 TEST EAX,EAX
10015EC6 75 30 JNZ SHORT RegClien.10015EF8 如果注册码不为空跳
10015EC8 6A 40 PUSH 40
10015ECA 68 44510310 PUSH RegClien.10035144 系统提示
10015ECF 68 E4610310 PUSH RegClien.100361E4 注册码为空，输入注册码
10015ED4 8BCB MOV ECX,EBX
10015ED6 E8 D9020100 CALL RegClien.100261B4
10015EDB 68 59040000 PUSH 459
10015EE0 8BCB MOV ECX,EBX
10015EE2 E8 6C130100 CALL RegClien.10027253
10015EE7 8BC8 MOV ECX,EAX
10015EE9 E8 45150100 CALL RegClien.10027433
10015EEE 5E POP ESI
10015EEF 5D POP EBP
10015EF0 5B POP EBX
10015EF1 81C4 00080000 ADD ESP,800
10015EF7 C3 RETN
10015EF8 8D73 60 LEA ESI,DWORD PTR DS:[EBX+60]
10015EFB 8BCE MOV ECX,ESI
10015EFD E8 2EDA0000 CALL RegClien.10023930 读取序列号
10015F02 8BCE MOV ECX,ESI
10015F04 E8 DBD90000 CALL RegClien.100238E4 可能是算出位数？
10015F09 8B36 MOV ESI,DWORD PTR DS:[ESI]
10015F0B 68 90770310 PUSH RegClien.10037790
10015F10 56 PUSH ESI
10015F11 E8 E8240000 CALL RegClien.100183FE
10015F16 83C4 08 ADD ESP,8
10015F19 85C0 TEST EAX,EAX
10015F1B 75 30 JNZ SHORT RegClien.10015F4D 序列号不空则跳
10015F1D 6A 40 PUSH 40
10015F1F 68 44510310 PUSH RegClien.10035144 提示
10015F24 68 10600310 PUSH RegClien.10036010 序列号为空……
10015F29 8BCB MOV ECX,EBX
10015F2B E8 84020100 CALL RegClien.100261B4
10015F30 68 FD030000 PUSH 3FD
10015F35 8BCB MOV ECX,EBX
10015F37 E8 17130100 CALL RegClien.10027253
10015F3C 8BC8 MOV ECX,EAX
10015F3E E8 F0140100 CALL RegClien.10027433
10015F43 5E POP ESI
10015F44 5D POP EBP
10015F45 5B POP EBX
10015F46 81C4 00080000 ADD ESP,800
10015F4C C3 RETN
10015F4D 8D73 64 LEA ESI,DWORD PTR DS:[EBX+64]
10015F50 8BCE MOV ECX,ESI
10015F52 E8 D9D90000 CALL RegClien.10023930 读取密码
10015F57 8BCE MOV ECX,ESI
10015F59 E8 86D90000 CALL RegClien.100238E4 可能是算位数
10015F5E 8B36 MOV ESI,DWORD PTR DS:[ESI]
10015F60 68 90770310 PUSH RegClien.10037790
10015F65 56 PUSH ESI
10015F66 E8 93240000 CALL RegClien.100183FE
10015F6B 83C4 08 ADD ESP,8
10015F6E 85C0 TEST EAX,EAX
10015F70 75 30 JNZ SHORT RegClien.10015FA2
10015F72 6A 40 PUSH 40
10015F74 68 44510310 PUSH RegClien.10035144
10015F79 68 F45F0310 PUSH RegClien.10035FF4
10015F7E 8BCB MOV ECX,EBX
10015F80 E8 2F020100 CALL RegClien.100261B4
10015F85 68 FE030000 PUSH 3FE
10015F8A 8BCB MOV ECX,EBX
10015F8C E8 C2120100 CALL RegClien.10027253
10015F91 8BC8 MOV ECX,EAX
10015F93 E8 9B140100 CALL RegClien.10027433
10015F98 5E POP ESI
10015F99 5D POP EBP
10015F9A 5B POP EBX
10015F9B 81C4 00080000 ADD ESP,800
10015FA1 C3 RETN
10015FA2 57 PUSH EDI
10015FA3 B9 00010000 MOV ECX,100
10015FA8 33C0 XOR EAX,EAX
10015FAA 8D7C24 10 LEA EDI,DWORD PTR SS:[ESP+10]
10015FAE F3:AB REP STOS DWORD PTR ES:[EDI]
10015FB0 B9 00010000 MOV ECX,100
10015FB5 8DBC24 10040000 LEA EDI,DWORD PTR SS:[ESP+410]
10015FBC F3:AB REP STOS DWORD PTR ES:[EDI]
10015FBE 8B45 00 MOV EAX,DWORD PTR SS:[EBP]
10015FC1 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
10015FC5 50 PUSH EAX
10015FC6 68 58510310 PUSH RegClien.10035158 ; ASCII "%s"
10015FCB 51 PUSH ECX
10015FCC E8 9B250000 CALL RegClien.1001856C
10015FD1 8B55 00 MOV EDX,DWORD PTR SS:[EBP]
10015FD4 83C4 0C ADD ESP,0C
10015FD7 33C9 XOR ECX,ECX
10015FD9 8B42 F8 MOV EAX,DWORD PTR DS:[EDX-8]
10015FDC 5F POP EDI
10015FDD 85C0 TEST EAX,EAX
10015FDF 7E 1E JLE SHORT RegClien.10015FFF
10015FE1 8DB424 0C040000 LEA ESI,DWORD PTR SS:[ESP+40C]
10015FE8 8A440C 0C MOV AL,BYTE PTR SS:[ESP+ECX+C]
10015FEC 3C 0D CMP AL,0D
10015FEE 74 07 JE SHORT RegClien.10015FF7
10015FF0 3C 0A CMP AL,0A
10015FF2 74 03 JE SHORT RegClien.10015FF7
10015FF4 8806 MOV BYTE PTR DS:[ESI],AL
10015FF6 46 INC ESI
10015FF7 8B42 F8 MOV EAX,DWORD PTR DS:[EDX-8]
10015FFA 41 INC ECX
10015FFB 3BC8 CMP ECX,EAX
10015FFD ^ 7C E9 JL SHORT RegClien.10015FE8
10015FFF 8D9424 0C040000 LEA EDX,DWORD PTR SS:[ESP+40C]
10016006 8BCD MOV ECX,EBP
10016008 52 PUSH EDX
10016009 E8 211D0100 CALL RegClien.10027D2F
1001600E 8BCB MOV ECX,EBX
10016010 E8 8DE60000 CALL RegClien.100246A2
10016015 5E POP ESI
10016016 5D POP EBP
10016017 5B POP EBX
10016018 81C4 00080000 ADD ESP,800
1001601E C3 RETN
1001601F 90 NOP
10016020 56 PUSH ESI
10016021 57 PUSH EDI
10016022 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+C]
10016026 8BF1 MOV ESI,ECX
10016028 817F 04 0001000>CMP DWORD PTR DS:[EDI+4],100
1001602F 0F85 BC000000 JNZ RegClien.100160F1
10016035 8B47 08 MOV EAX,DWORD PTR DS:[EDI+8]
10016038 83F8 0D CMP EAX,0D
1001603B 74 09 JE SHORT RegClien.10016046
1001603D 83F8 1B CMP EAX,1B
10016040 0F85 AB000000 JNZ RegClien.100160F1
10016046 83F8 1B CMP EAX,1B
10016049 75 14 JNZ SHORT RegClien.1001605F
1001604B 8B06 MOV EAX,DWORD PTR DS:[ESI]
1001604D 8BCE MOV ECX,ESI
1001604F FF90 C8000000 CALL DWORD PTR DS:[EAX+C8]
10016055 5F POP EDI
10016056 B8 01000000 MOV EAX,1
1001605B 5E POP ESI
1001605C C2 0400 RETN 4
注册码是65位，在10015FE8至10015FFD这里可以看到转65次。
10015EA2 8D6B 5C LEA EBP,DWORD PTR DS:[EBX+5C]
10015EA5 8BCD MOV ECX,EBP
10015EA7 E8 84DA0000 CALL RegClien.10023930 读取注册码
10015EAC 8BCD MOV ECX,EBP
10015EAE E8 31DA0000 CALL RegClien.100238E4 可能是算出位数，没明白。
10015EB3 8B45 00 MOV EAX,DWORD PTR SS:[EBP]
10015EB6 68 90770310 PUSH RegClien.10037790
10015EBB 50 PUSH EAX
10015EBC E8 3D250000 CALL RegClien.100183FE
10015EC1 83C4 08 ADD ESP,8
10015EC4 85C0 TEST EAX,EAX
10015EC6 75 30 JNZ SHORT RegClien.10015EF8 如果注册码不为空跳
10015EC8 6A 40 PUSH 40
10015ECA 68 44510310 PUSH RegClien.10035144 系统提示
10015ECF 68 E4610310 PUSH RegClien.100361E4 注册码为空，输入注册码
10015ED4 8BCB MOV ECX,EBX
10015ED6 E8 D9020100 CALL RegClien.100261B4
10015EDB 68 59040000 PUSH 459
10015EE0 8BCB MOV ECX,EBX
10015EE2 E8 6C130100 CALL RegClien.10027253
10015EE7 8BC8 MOV ECX,EAX
10015EE9 E8 45150100 CALL RegClien.10027433
10015EEE 5E POP ESI
10015EEF 5D POP EBP
10015EF0 5B POP EBX
10015EF1 81C4 00080000 ADD ESP,800
10015EF7 C3 RETN
10015EF8 8D73 60 LEA ESI,DWORD PTR DS:[EBX+60]
10015EFB 8BCE MOV ECX,ESI
10015EFD E8 2EDA0000 CALL RegClien.10023930 读取序列号
10015F02 8BCE MOV ECX,ESI
10015F04 E8 DBD90000 CALL RegClien.100238E4 可能是算出位数？
10015F09 8B36 MOV ESI,DWORD PTR DS:[ESI]
10015F0B 68 90770310 PUSH RegClien.10037790
10015F10 56 PUSH ESI
10015F11 E8 E8240000 CALL RegClien.100183FE
10015F16 83C4 08 ADD ESP,8
10015F19 85C0 TEST EAX,EAX
10015F1B 75 30 JNZ SHORT RegClien.10015F4D 序列号不空则跳
10015F1D 6A 40 PUSH 40
10015F1F 68 44510310 PUSH RegClien.10035144 提示
10015F24 68 10600310 PUSH RegClien.10036010 序列号为空……
10015F29 8BCB MOV ECX,EBX
10015F2B E8 84020100 CALL RegClien.100261B4
10015F30 68 FD030000 PUSH 3FD
10015F35 8BCB MOV ECX,EBX
10015F37 E8 17130100 CALL RegClien.10027253
10015F3C 8BC8 MOV ECX,EAX
10015F3E E8 F0140100 CALL RegClien.10027433
10015F43 5E POP ESI
10015F44 5D POP EBP
10015F45 5B POP EBX
10015F46 81C4 00080000 ADD ESP,800
10015F4C C3 RETN
10015F4D 8D73 64 LEA ESI,DWORD PTR DS:[EBX+64]
10015F50 8BCE MOV ECX,ESI
10015F52 E8 D9D90000 CALL RegClien.10023930 读取密码
10015F57 8BCE MOV ECX,ESI
10015F59 E8 86D90000 CALL RegClien.100238E4 可能是算位数
10015F5E 8B36 MOV ESI,DWORD PTR DS:[ESI]
10015F60 68 90770310 PUSH RegClien.10037790
10015F65 56 PUSH ESI
10015F66 E8 93240000 CALL RegClien.100183FE
10015F6B 83C4 08 ADD ESP,8
10015F6E 85C0 TEST EAX,EAX
10015F70 75 30 JNZ SHORT RegClien.10015FA2
10015F72 6A 40 PUSH 40
10015F74 68 44510310 PUSH RegClien.10035144
10015F79 68 F45F0310 PUSH RegClien.10035FF4
10015F7E 8BCB MOV ECX,EBX
10015F80 E8 2F020100 CALL RegClien.100261B4
10015F85 68 FE030000 PUSH 3FE
10015F8A 8BCB MOV ECX,EBX
10015F8C E8 C2120100 CALL RegClien.10027253
10015F91 8BC8 MOV ECX,EAX
10015F93 E8 9B140100 CALL RegClien.10027433
10015F98 5E POP ESI
10015F99 5D POP EBP
10015F9A 5B POP EBX
10015F9B 81C4 00080000 ADD ESP,800
10015FA1 C3 RETN
10015FA2 57 PUSH EDI
10015FA3 B9 00010000 MOV ECX,100
10015FA8 33C0 XOR EAX,EAX
10015FAA 8D7C24 10 LEA EDI,DWORD PTR SS:[ESP+10]
10015FAE F3:AB REP STOS DWORD PTR ES:[EDI]
10015FB0 B9 00010000 MOV ECX,100
10015FB5 8DBC24 10040000 LEA EDI,DWORD PTR SS:[ESP+410]
10015FBC F3:AB REP STOS DWORD PTR ES:[EDI]
10015FBE 8B45 00 MOV EAX,DWORD PTR SS:[EBP]
10015FC1 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10]
10015FC5 50 PUSH EAX
10015FC6 68 58510310 PUSH RegClien.10035158 ; ASCII "%s"
10015FCB 51 PUSH ECX
10015FCC E8 9B250000 CALL RegClien.1001856C
10015FD1 8B55 00 MOV EDX,DWORD PTR SS:[EBP]
10015FD4 83C4 0C ADD ESP,0C
10015FD7 33C9 XOR ECX,ECX
10015FD9 8B42 F8 MOV EAX,DWORD PTR DS:[EDX-8]
10015FDC 5F POP EDI
10015FDD 85C0 TEST EAX,EAX
10015FDF 7E 1E JLE SHORT RegClien.10015FFF
10015FE1 8DB424 0C040000 LEA ESI,DWORD PTR SS:[ESP+40C]
10015FE8 8A440C 0C MOV AL,BYTE PTR SS:[ESP+ECX+C]
10015FEC 3C 0D CMP AL,0D
10015FEE 74 07 JE SHORT RegClien.10015FF7
10015FF0 3C 0A CMP AL,0A
10015FF2 74 03 JE SHORT RegClien.10015FF7
10015FF4 8806 MOV BYTE PTR DS:[ESI],AL
10015FF6 46 INC ESI
10015FF7 8B42 F8 MOV EAX,DWORD PTR DS:[EDX-8]
10015FFA 41 INC ECX
10015FFB 3BC8 CMP ECX,EAX
10015FFD ^ 7C E9 JL SHORT RegClien.10015FE8
10015FFF 8D9424 0C040000 LEA EDX,DWORD PTR SS:[ESP+40C]
10016006 8BCD MOV ECX,EBP
10016008 52 PUSH EDX
10016009 E8 211D0100 CALL RegClien.10027D2F
1001600E 8BCB MOV ECX,EBX
10016010 E8 8DE60000 CALL RegClien.100246A2
10016015 5E POP ESI
10016016 5D POP EBP
10016017 5B POP EBX
10016018 81C4 00080000 ADD ESP,800
1001601E C3 RETN
1001601F 90 NOP
10016020 56 PUSH ESI
10016021 57 PUSH EDI
10016022 8B7C24 0C MOV EDI,DWORD PTR SS:[ESP+C]
10016026 8BF1 MOV ESI,ECX
10016028 817F 04 0001000>CMP DWORD PTR DS:[EDI+4],100
1001602F 0F85 BC000000 JNZ RegClien.100160F1
10016035 8B47 08 MOV EAX,DWORD PTR DS:[EDI+8]
10016038 83F8 0D CMP EAX,0D
1001603B 74 09 JE SHORT RegClien.10016046
1001603D 83F8 1B CMP EAX,1B
10016040 0F85 AB000000 JNZ RegClien.100160F1
10016046 83F8 1B CMP EAX,1B
10016049 75 14 JNZ SHORT RegClien.1001605F
1001604B 8B06 MOV EAX,DWORD PTR DS:[ESI]
1001604D 8BCE MOV ECX,ESI
1001604F FF90 C8000000 CALL DWORD PTR DS:[EAX+C8]
10016055 5F POP EDI
10016056 B8 01000000 MOV EAX,1
1001605B 5E POP ESI
1001605C C2 0400 RETN 4
注册码是65位，在10015FE8至10015FFD这里可以看到转65次。
赞赏
|
|
|---|---|
|
|
此程序有注册码、序列号（可能也是用户名）、密码三个输入。如果输入不对的话提示输入的注册码不对，可以重新输入。
|
|
|
把10015EBC处的Call拿出来大家研究一下：
100183FE 55 PUSH EBP 100183FF 8BEC MOV EBP,ESP 10018401 833D 4CAF0310 00 CMP DWORD PTR DS:[1003AF4C],0 10018408 53 PUSH EBX 10018409 56 PUSH ESI 1001840A 57 PUSH EDI 1001840B 75 12 JNZ SHORT RegClien.1001841F 1001840D FF75 0C PUSH DWORD PTR SS:[EBP+C] 10018410 FF75 08 PUSH DWORD PTR SS:[EBP+8] 10018413 E8 683E0000 CALL RegClien.1001C280 10018418 59 POP ECX 10018419 59 POP ECX 1001841A E9 89000000 JMP RegClien.100184A8 1001841F 6A 19 PUSH 19 10018421 E8 DE3D0000 CALL RegClien.1001C204 10018426 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C] 10018429 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8] 1001842C 59 POP ECX 1001842D 66:0FB60F MOVZX CX,BYTE PTR DS:[EDI] 10018431 0FB6C1 MOVZX EAX,CL 10018434 47 INC EDI 10018435 894D 0C MOV DWORD PTR SS:[EBP+C],ECX 10018438 F680 61B00310 04 TEST BYTE PTR DS:[EAX+1003B061],4 1001843F 74 16 JE SHORT RegClien.10018457 10018441 8A07 MOV AL,BYTE PTR DS:[EDI] 10018443 84C0 TEST AL,AL 10018445 75 06 JNZ SHORT RegClien.1001844D 10018447 8365 0C 00 AND DWORD PTR SS:[EBP+C],0 1001844B EB 0A JMP SHORT RegClien.10018457 1001844D 33D2 XOR EDX,EDX 1001844F 47 INC EDI 10018450 8AF1 MOV DH,CL 10018452 8AD0 MOV DL,AL 10018454 8955 0C MOV DWORD PTR SS:[EBP+C],EDX 10018457 66:0FB61E MOVZX BX,BYTE PTR DS:[ESI] 1001845B 0FB6C3 MOVZX EAX,BL 1001845E 46 INC ESI 1001845F F680 61B00310 04 TEST BYTE PTR DS:[EAX+1003B061],4 10018466 74 13 JE SHORT RegClien.1001847B 10018468 8A06 MOV AL,BYTE PTR DS:[ESI] 1001846A 84C0 TEST AL,AL 1001846C 75 04 JNZ SHORT RegClien.10018472 1001846E 33DB XOR EBX,EBX 10018470 EB 09 JMP SHORT RegClien.1001847B 10018472 33C9 XOR ECX,ECX 10018474 46 INC ESI 10018475 8AEB MOV CH,BL 10018477 8AC8 MOV CL,AL 10018479 8BD9 MOV EBX,ECX 1001847B 66:395D 0C CMP WORD PTR SS:[EBP+C],BX 1001847F 75 09 JNZ SHORT RegClien.1001848A 10018481 66:837D 0C 00 CMP WORD PTR SS:[EBP+C],0 10018486 74 16 JE SHORT RegClien.1001849E 10018488 ^ EB A3 JMP SHORT RegClien.1001842D 1001848A 6A 19 PUSH 19 1001848C E8 D43D0000 CALL RegClien.1001C265 10018491 66:3B5D 0C CMP BX,WORD PTR SS:[EBP+C] 10018495 59 POP ECX 10018496 1BC0 SBB EAX,EAX 10018498 83E0 02 AND EAX,2 1001849B 48 DEC EAX 1001849C EB 0A JMP SHORT RegClien.100184A8 1001849E 6A 19 PUSH 19 100184A0 E8 C03D0000 CALL RegClien.1001C265 100184A5 59 POP ECX 100184A6 33C0 XOR EAX,EAX 100184A8 5F POP EDI 100184A9 5E POP ESI 100184AA 5B POP EBX 100184AB 5D POP EBP 100184AC C3 RETN |
|
|
 没有一个人回复，是不是太简单了 好象上面的程序是经过多次比较，比较一次向下面跳一次，不知道是作什么比较？65位的注册码在下半部分中间做了比较吧？ |
|
|
10014090 6A FF PUSH -1
10014092 68 76D30210 PUSH RegClien.1002D376 10014097 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 1001409D 50 PUSH EAX 1001409E 64:8925 0000000>MOV DWORD PTR FS:[0],ESP 100140A5 81EC 9C0C0000 SUB ESP,0C9C 100140AB 53 PUSH EBX 100140AC 55 PUSH EBP 100140AD 56 PUSH ESI 100140AE 57 PUSH EDI 100140AF 8BE9 MOV EBP,ECX 100140B1 6A 01 PUSH 1 100140B3 E8 58280100 CALL RegClien.10026910 100140B8 33F6 XOR ESI,ESI 100140BA 8D4C24 54 LEA ECX,DWORD PTR SS:[ESP+54] 100140BE 56 PUSH ESI 100140BF E8 9C1C0000 CALL RegClien.10015D60 100140C4 8DBD D4000000 LEA EDI,DWORD PTR SS:[EBP+D4] 100140CA 8D8C24 B4000000 LEA ECX,DWORD PTR SS:[ESP+B4] 100140D1 57 PUSH EDI 100140D2 89B424 B80C0000 MOV DWORD PTR SS:[ESP+CB8],ESI 100140D9 E8 013C0100 CALL RegClien.10027CDF 100140DE 8D4C24 54 LEA ECX,DWORD PTR SS:[ESP+54] 100140E2 E8 CD020100 CALL RegClien.100243B4 100140E7 83F8 01 CMP EAX,1 100140EA 0F85 AC130000 JNZ RegClien.1001549C 100140F0 8D8424 B8000000 LEA EAX,DWORD PTR SS:[ESP+B8] 100140F7 8BCF MOV ECX,EDI 100140F9 50 PUSH EAX 100140FA E8 E03B0100 CALL RegClien.10027CDF 100140FF 8B9424 B0000000 MOV EDX,DWORD PTR SS:[ESP+B0] 10014106 8B5A F8 MOV EBX,DWORD PTR DS:[EDX-8] 10014109 81FB 90000000 CMP EBX,90 1001410F 7D 4B JGE SHORT RegClien.1001415C 10014111 6A 40 PUSH 40 10014113 68 44510310 PUSH RegClien.10035144 ; 系统提示 10014118 68 BC610310 PUSH RegClien.100361BC ; 输入的注册码错误，请输入正确注册码！ 1001411D 8BCD MOV ECX,EBP 1001411F E8 90200100 CALL RegClien.100261B4 10014124 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] 1001412B C78424 B40C0000>MOV DWORD PTR SS:[ESP+CB4],3 10014136 E8 B73A0100 CALL RegClien.10027BF2 1001413B 8D8C24 B4000000 LEA ECX,DWORD PTR SS:[ESP+B4] 10014142 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],2 1001414A E8 A33A0100 CALL RegClien.10027BF2 1001414F C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],1 10014157 E9 73130000 JMP RegClien.100154CF 1001415C B9 00010000 MOV ECX,100 10014161 33C0 XOR EAX,EAX 10014163 8DBC24 AC060000 LEA EDI,DWORD PTR SS:[ESP+6AC] 1001416A 52 PUSH EDX 1001416B F3:AB REP STOS DWORD PTR ES:[EDI] 1001416D 8D8C24 B0060000 LEA ECX,DWORD PTR SS:[ESP+6B0] 10014174 68 58510310 PUSH RegClien.10035158 ; %s 10014179 51 PUSH ECX 1001417A E8 ED430000 CALL RegClien.1001856C 1001417F B9 06000000 MOV ECX,6 10014184 33C0 XOR EAX,EAX 10014186 8DBC24 F8000000 LEA EDI,DWORD PTR SS:[ESP+F8] 1001418D 83C4 0C ADD ESP,0C 10014190 F3:AB REP STOS DWORD PTR ES:[EDI] 10014192 8D5424 34 LEA EDX,DWORD PTR SS:[ESP+34] 10014196 6A 16 PUSH 16 10014198 52 PUSH EDX 10014199 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] 100141A0 AA STOS BYTE PTR ES:[EDI] 100141A1 E8 D4F20000 CALL RegClien.1002347A 100141A6 8B00 MOV EAX,DWORD PTR DS:[EAX] 100141A8 8D8C24 EC000000 LEA ECX,DWORD PTR SS:[ESP+EC] 100141AF 50 PUSH EAX 100141B0 68 58510310 PUSH RegClien.10035158 ; %s 100141B5 51 PUSH ECX 100141B6 E8 B1430000 CALL RegClien.1001856C 100141BB 83C4 0C ADD ESP,0C 100141BE 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 100141C2 E8 2B3A0100 CALL RegClien.10027BF2 100141C7 B9 80000000 MOV ECX,80 100141CC 33C0 XOR EAX,EAX 100141CE 8DBC24 08020000 LEA EDI,DWORD PTR SS:[ESP+208] 100141D5 83EB 16 SUB EBX,16 100141D8 F3:AB REP STOS DWORD PTR ES:[EDI] 100141DA 33FF XOR EDI,EDI 100141DC 3BDE CMP EBX,ESI 100141DE 895C24 30 MOV DWORD PTR SS:[ESP+30],EBX 100141E2 897424 18 MOV DWORD PTR SS:[ESP+18],ESI 100141E6 897C24 34 MOV DWORD PTR SS:[ESP+34],EDI 100141EA 0F8E 6E010000 JLE RegClien.1001435E 100141F0 895C24 20 MOV DWORD PTR SS:[ESP+20],EBX 100141F4 83C3 FE ADD EBX,-2 100141F7 837C24 20 0C CMP DWORD PTR SS:[ESP+20],0C 100141FC 0F8D DE000000 JGE RegClien.100142E0 10014202 8DB43C AC060000 LEA ESI,DWORD PTR SS:[ESP+EDI+6AC] 10014209 6A 01 PUSH 1 1001420B 56 PUSH ESI 1001420C 8BCD MOV ECX,EBP 1001420E E8 6D130000 CALL RegClien.10015580 10014213 46 INC ESI 10014214 53 PUSH EBX 10014215 56 PUSH ESI 10014216 8BCD MOV ECX,EBP 10014218 894424 44 MOV DWORD PTR SS:[ESP+44],EAX 1001421C E8 5F130000 CALL RegClien.10015580 10014221 8D941C AD060000 LEA EDX,DWORD PTR SS:[ESP+EBX+6AD] 10014228 6A 01 PUSH 1 1001422A 03D7 ADD EDX,EDI 1001422C 8BCD MOV ECX,EBP 1001422E 52 PUSH EDX 1001422F 8BF0 MOV ESI,EAX 10014231 E8 4A130000 CALL RegClien.10015580 10014236 0FAF7424 3C IMUL ESI,DWORD PTR SS:[ESP+3C] 1001423B 03F0 ADD ESI,EAX 1001423D 83FB 01 CMP EBX,1 10014240 75 08 JNZ SHORT RegClien.1001424A 10014242 56 PUSH ESI 10014243 68 B4600310 PUSH RegClien.100360B4 ; %01x 10014248 EB 7C JMP SHORT RegClien.100142C6 1001424A 83FB 02 CMP EBX,2 1001424D 75 14 JNZ SHORT RegClien.10014263 1001424F 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18] 10014253 56 PUSH ESI 10014254 68 C8600310 PUSH RegClien.100360C8 ; %02x 10014259 8D8414 10020000 LEA EAX,DWORD PTR SS:[ESP+EDX+210] 10014260 50 PUSH EAX 10014261 EB 6F JMP SHORT RegClien.100142D2 10014263 83FB 03 CMP EBX,3 10014266 75 14 JNZ SHORT RegClien.1001427C 10014268 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 1001426C 56 PUSH ESI 1001426D 68 B4610310 PUSH RegClien.100361B4 ; %03x 10014272 8D940C 10020000 LEA EDX,DWORD PTR SS:[ESP+ECX+210] 10014279 52 PUSH EDX 1001427A EB 56 JMP SHORT RegClien.100142D2 1001427C 83FB 04 CMP EBX,4 1001427F 75 08 JNZ SHORT RegClien.10014289 10014281 56 PUSH ESI 10014282 68 AC610310 PUSH RegClien.100361AC ; %04x 10014287 EB 3D JMP SHORT RegClien.100142C6 10014289 83FB 05 CMP EBX,5 1001428C 75 14 JNZ SHORT RegClien.100142A2 1001428E 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+18] 10014292 56 PUSH ESI 10014293 68 A4610310 PUSH RegClien.100361A4 ; %05x 10014298 8D8414 10020000 LEA EAX,DWORD PTR SS:[ESP+EDX+210] 1001429F 50 PUSH EAX 100142A0 EB 30 JMP SHORT RegClien.100142D2 100142A2 83FB 06 CMP EBX,6 100142A5 75 14 JNZ SHORT RegClien.100142BB 100142A7 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+18] 100142AB 56 PUSH ESI 100142AC 68 9C610310 PUSH RegClien.1003619C ; %06x 100142B1 8D940C 10020000 LEA EDX,DWORD PTR SS:[ESP+ECX+210] 100142B8 52 PUSH EDX 100142B9 EB 17 JMP SHORT RegClien.100142D2 100142BB 83FB 07 CMP EBX,7 100142BE 75 1A JNZ SHORT RegClien.100142DA 100142C0 56 PUSH ESI 100142C1 68 94610310 PUSH RegClien.10036194 ; %07x 100142C6 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+20] 100142CA 8D8C04 10020000 LEA ECX,DWORD PTR SS:[ESP+EAX+210] 100142D1 51 PUSH ECX 100142D2 E8 95420000 CALL RegClien.1001856C 100142D7 83C4 0C ADD ESP,0C 100142DA 015C24 18 ADD DWORD PTR SS:[ESP+18],EBX 100142DE EB 5D JMP SHORT RegClien.1001433D 100142E0 8DBC3C AC060000 LEA EDI,DWORD PTR SS:[ESP+EDI+6AC] 100142E7 6A 02 PUSH 2 100142E9 57 PUSH EDI 100142EA 8BCD MOV ECX,EBP 100142EC E8 8F120000 CALL RegClien.10015580 100142F1 8D57 02 LEA EDX,DWORD PTR DS:[EDI+2] 100142F4 6A 08 PUSH 8 100142F6 52 PUSH EDX 100142F7 8BCD MOV ECX,EBP 100142F9 894424 44 MOV DWORD PTR SS:[ESP+44],EAX 100142FD E8 7E120000 CALL RegClien.10015580 10014302 83C7 0A ADD EDI,0A 10014305 6A 02 PUSH 2 10014307 57 PUSH EDI 10014308 8BCD MOV ECX,EBP 1001430A 8BF0 MOV ESI,EAX 1001430C E8 6F120000 CALL RegClien.10015580 10014311 0FAF7424 3C IMUL ESI,DWORD PTR SS:[ESP+3C] 10014316 03F0 ADD ESI,EAX 10014318 56 PUSH ESI 10014319 8B7424 1C MOV ESI,DWORD PTR SS:[ESP+1C] 1001431D 68 8C610310 PUSH RegClien.1003618C ; %08x 10014322 8D8434 10020000 LEA EAX,DWORD PTR SS:[ESP+ESI+210] 10014329 50 PUSH EAX 1001432A E8 3D420000 CALL RegClien.1001856C 1001432F 8B7C24 40 MOV EDI,DWORD PTR SS:[ESP+40] 10014333 83C4 0C ADD ESP,0C 10014336 83C6 08 ADD ESI,8 10014339 897424 18 MOV DWORD PTR SS:[ESP+18],ESI 1001433D 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20] 10014341 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+30] 10014345 83C7 0C ADD EDI,0C 10014348 83EA 0C SUB EDX,0C 1001434B 83EB 0C SUB EBX,0C 1001434E 3BF8 CMP EDI,EAX 10014350 897C24 34 MOV DWORD PTR SS:[ESP+34],EDI 10014354 895424 20 MOV DWORD PTR SS:[ESP+20],EDX 10014358 ^ 0F8C 99FEFFFF JL RegClien.100141F7 1001435E 8B0D FC630310 MOV ECX,DWORD PTR DS:[100363FC] ; RegClien.10036410 10014364 894C24 1C MOV DWORD PTR SS:[ESP+1C],ECX 10014368 8D5424 1C LEA EDX,DWORD PTR SS:[ESP+1C] 1001436C C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],4 10014374 52 PUSH EDX 10014375 E8 4612FFFF CALL RegClien.100055C0 1001437A 8D4424 20 LEA EAX,DWORD PTR SS:[ESP+20] 1001437E 8BCC MOV ECX,ESP 10014380 896424 14 MOV DWORD PTR SS:[ESP+14],ESP 10014384 50 PUSH EAX 10014385 E8 DD350100 CALL RegClien.10027967 1001438A E8 D13AFFFF CALL RegClien.10007E60 1001438F 894424 38 MOV DWORD PTR SS:[ESP+38],EAX 10014393 E8 883EFFFF CALL RegClien.10008220 10014398 33C9 XOR ECX,ECX 1001439A 8D5424 48 LEA EDX,DWORD PTR SS:[ESP+48] 1001439E 894C24 48 MOV DWORD PTR SS:[ESP+48],ECX 100143A2 52 PUSH EDX 100143A3 894C24 50 MOV DWORD PTR SS:[ESP+50],ECX 100143A7 6A 01 PUSH 1 100143A9 894C24 58 MOV DWORD PTR SS:[ESP+58],ECX 100143AD 894424 48 MOV DWORD PTR SS:[ESP+48],EAX 100143B1 894C24 5C MOV DWORD PTR SS:[ESP+5C],ECX 100143B5 E8 C640FFFF CALL RegClien.10008480 100143BA 8D4424 50 LEA EAX,DWORD PTR SS:[ESP+50] 100143BE C64424 5C 00 MOV BYTE PTR SS:[ESP+5C],0 100143C3 50 PUSH EAX 100143C4 E8 9DED0000 CALL RegClien.10023166 100143C9 A1 FC630310 MOV EAX,DWORD PTR DS:[100363FC] 100143CE 83C4 10 ADD ESP,10 100143D1 894424 28 MOV DWORD PTR SS:[ESP+28],EAX 100143D5 894424 24 MOV DWORD PTR SS:[ESP+24],EAX 100143D9 894424 2C MOV DWORD PTR SS:[ESP+2C],EAX 100143DD 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 100143E1 8DBD F0000000 LEA EDI,DWORD PTR SS:[EBP+F0] 100143E7 6A 05 PUSH 5 100143E9 51 PUSH ECX 100143EA 8BCF MOV ECX,EDI 100143EC C68424 BC0C0000>MOV BYTE PTR SS:[ESP+CBC],7 100143F4 E8 81F00000 CALL RegClien.1002347A 100143F9 8BF0 MOV ESI,EAX 100143FB 8D9D EC000000 LEA EBX,DWORD PTR SS:[EBP+EC] 10014401 8D5424 30 LEA EDX,DWORD PTR SS:[ESP+30] 10014405 6A 05 PUSH 5 10014407 52 PUSH EDX 10014408 8BCB MOV ECX,EBX 1001440A C68424 BC0C0000>MOV BYTE PTR SS:[ESP+CBC],8 10014412 E8 DFF00000 CALL RegClien.100234F6 10014417 56 PUSH ESI 10014418 50 PUSH EAX 10014419 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28] 1001441D C68424 BC0C0000>MOV BYTE PTR SS:[ESP+CBC],9 10014425 50 PUSH EAX 10014426 E8 69390100 CALL RegClien.10027D94 1001442B 50 PUSH EAX 1001442C 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C] 10014430 C68424 B80C0000>MOV BYTE PTR SS:[ESP+CB8],0A 10014438 E8 A2380100 CALL RegClien.10027CDF 1001443D 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20] 10014441 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],9 10014449 E8 A4370100 CALL RegClien.10027BF2 1001444E 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30] 10014452 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],8 1001445A E8 93370100 CALL RegClien.10027BF2 1001445F 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 10014463 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],7 1001446B E8 82370100 CALL RegClien.10027BF2 10014470 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30] 10014474 6A 05 PUSH 5 10014476 51 PUSH ECX 10014477 8BCB MOV ECX,EBX 10014479 E8 FCEF0000 CALL RegClien.1002347A 1001447E 8BF0 MOV ESI,EAX 10014480 8D5424 20 LEA EDX,DWORD PTR SS:[ESP+20] 10014484 B3 0B MOV BL,0B 10014486 6A 05 PUSH 5 10014488 52 PUSH EDX 10014489 8BCF MOV ECX,EDI 1001448B 889C24 BC0C0000 MOV BYTE PTR SS:[ESP+CBC],BL 10014492 E8 5FF00000 CALL RegClien.100234F6 10014497 56 PUSH ESI 10014498 50 PUSH EAX 10014499 8D4424 18 LEA EAX,DWORD PTR SS:[ESP+18] 1001449D C68424 BC0C0000>MOV BYTE PTR SS:[ESP+CBC],0C 100144A5 50 PUSH EAX 100144A6 E8 E9380100 CALL RegClien.10027D94 100144AB 50 PUSH EAX 100144AC 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 100144B0 C68424 B80C0000>MOV BYTE PTR SS:[ESP+CB8],0D 100144B8 E8 22380100 CALL RegClien.10027CDF 100144BD 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 100144C1 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0C 100144C9 E8 24370100 CALL RegClien.10027BF2 100144CE 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20] 100144D2 889C24 B40C0000 MOV BYTE PTR SS:[ESP+CB4],BL 100144D9 E8 14370100 CALL RegClien.10027BF2 100144DE 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30] 100144E2 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],7 100144EA E8 03370100 CALL RegClien.10027BF2 100144EF 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 100144F3 E8 813B0100 CALL RegClien.10028079 100144F8 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 100144FC E8 783B0100 CALL RegClien.10028079 10014501 B9 80000000 MOV ECX,80 10014506 33C0 XOR EAX,EAX 10014508 8DBC24 AC060000 LEA EDI,DWORD PTR SS:[ESP+6AC] 1001450F 8D9424 AC060000 LEA EDX,DWORD PTR SS:[ESP+6AC] 10014516 F3:AB REP STOS DWORD PTR ES:[EDI] 10014518 8B8C24 B8000000 MOV ECX,DWORD PTR SS:[ESP+B8] 1001451F 51 PUSH ECX 10014520 68 58510310 PUSH RegClien.10035158 ; %s 10014525 52 PUSH EDX 10014526 E8 41400000 CALL RegClien.1001856C 1001452B 8D8424 E4000000 LEA EAX,DWORD PTR SS:[ESP+E4] 10014532 8DBC24 B8060000 LEA EDI,DWORD PTR SS:[ESP+6B8] 10014539 50 PUSH EAX 1001453A 83C9 FF OR ECX,FFFFFFFF 1001453D 33C0 XOR EAX,EAX 1001453F 6A 00 PUSH 0 10014541 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 10014543 F7D1 NOT ECX 10014545 49 DEC ECX 10014546 6A 00 PUSH 0 10014548 51 PUSH ECX 10014549 8D8C24 C8060000 LEA ECX,DWORD PTR SS:[ESP+6C8] 10014550 51 PUSH ECX 10014551 E8 FA7CFFFF CALL RegClien.MD5_Ex 10014556 33C0 XOR EAX,EAX 10014558 B9 08000000 MOV ECX,8 1001455D 8DBC24 CC060000 LEA EDI,DWORD PTR SS:[ESP+6CC] 10014564 50 PUSH EAX 10014565 8D9424 D0060000 LEA EDX,DWORD PTR SS:[ESP+6D0] 1001456C 6A 20 PUSH 20 1001456E F3:AB REP STOS DWORD PTR ES:[EDI] 10014570 52 PUSH EDX 10014571 8D8424 04010000 LEA EAX,DWORD PTR SS:[ESP+104] 10014578 6A 10 PUSH 10 1001457A 50 PUSH EAX 1001457B E8 107AFFFF CALL RegClien.DoBASE64 10014580 83C4 34 ADD ESP,34 10014583 33C0 XOR EAX,EAX 10014585 80BC04 AC060000>CMP BYTE PTR SS:[ESP+EAX+6AC],2B 1001458D 75 08 JNZ SHORT RegClien.10014597 1001458F C68404 AC060000>MOV BYTE PTR SS:[ESP+EAX+6AC],2A 10014597 40 INC EAX 10014598 83F8 18 CMP EAX,18 1001459B ^ 7C E8 JL SHORT RegClien.10014585 1001459D 8D8C24 AC060000 LEA ECX,DWORD PTR SS:[ESP+6AC] 100145A4 51 PUSH ECX 100145A5 8D4C24 30 LEA ECX,DWORD PTR SS:[ESP+30] 100145A9 E8 81370100 CALL RegClien.10027D2F 100145AE 8B5424 2C MOV EDX,DWORD PTR SS:[ESP+2C] 100145B2 B9 80000000 MOV ECX,80 100145B7 33C0 XOR EAX,EAX 100145B9 8DBC24 AC060000 LEA EDI,DWORD PTR SS:[ESP+6AC] 100145C0 F3:AB REP STOS DWORD PTR ES:[EDI] 100145C2 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+24] 100145C6 8B4C24 34 MOV ECX,DWORD PTR SS:[ESP+34] 100145CA 52 PUSH EDX 100145CB 50 PUSH EAX 100145CC B8 610F9C89 MOV EAX,899C0F61 100145D1 F7E1 MUL ECX 100145D3 2BCA SUB ECX,EDX 100145D5 8B4424 44 MOV EAX,DWORD PTR SS:[ESP+44] 100145D9 D1E9 SHR ECX,1 100145DB 03CA ADD ECX,EDX 100145DD 8D9424 10020000 LEA EDX,DWORD PTR SS:[ESP+210] 100145E4 C1E9 09 SHR ECX,9 100145E7 51 PUSH ECX 100145E8 8B4C24 34 MOV ECX,DWORD PTR SS:[ESP+34] 100145EC 51 PUSH ECX 100145ED 52 PUSH EDX 100145EE 8B9424 C8000000 MOV EDX,DWORD PTR SS:[ESP+C8] 100145F5 8D4C24 58 LEA ECX,DWORD PTR SS:[ESP+58] 100145F9 50 PUSH EAX 100145FA 51 PUSH ECX 100145FB 52 PUSH EDX 100145FC 8D8424 CC060000 LEA EAX,DWORD PTR SS:[ESP+6CC] 10014603 68 78610310 PUSH RegClien.10036178 ; %s%s%d%s%s%d%s%s 10014608 50 PUSH EAX 10014609 E8 5E3F0000 CALL RegClien.1001856C 1001460E 8D8C24 00010000 LEA ECX,DWORD PTR SS:[ESP+100] 10014615 8DBC24 D4060000 LEA EDI,DWORD PTR SS:[ESP+6D4] 1001461C 51 PUSH ECX 1001461D 83C9 FF OR ECX,FFFFFFFF 10014620 33C0 XOR EAX,EAX 10014622 6A 00 PUSH 0 10014624 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 10014626 F7D1 NOT ECX 10014628 49 DEC ECX 10014629 6A 00 PUSH 0 1001462B 8D9424 E0060000 LEA EDX,DWORD PTR SS:[ESP+6E0] 10014632 51 PUSH ECX 10014633 52 PUSH EDX 10014634 E8 177CFFFF CALL RegClien.MD5_Ex 10014639 B9 08000000 MOV ECX,8 1001463E 33C0 XOR EAX,EAX 10014640 8DBC24 E8060000 LEA EDI,DWORD PTR SS:[ESP+6E8] 10014647 50 PUSH EAX 10014648 F3:AB REP STOS DWORD PTR ES:[EDI] 1001464A 8D8424 EC060000 LEA EAX,DWORD PTR SS:[ESP+6EC] 10014651 6A 20 PUSH 20 10014653 50 PUSH EAX 10014654 8D8C24 20010000 LEA ECX,DWORD PTR SS:[ESP+120] 1001465B 6A 10 PUSH 10 1001465D 51 PUSH ECX 1001465E E8 2D79FFFF CALL RegClien.DoBASE64 10014663 83C4 50 ADD ESP,50 10014666 C68424 C2060000>MOV BYTE PTR SS:[ESP+6C2],0 1001466E 33C0 XOR EAX,EAX 10014670 80BC04 AC060000>CMP BYTE PTR SS:[ESP+EAX+6AC],2B 10014678 75 08 JNZ SHORT RegClien.10014682 1001467A C68404 AC060000>MOV BYTE PTR SS:[ESP+EAX+6AC],40 10014682 40 INC EAX 10014683 83F8 16 CMP EAX,16 10014686 ^ 7C E8 JL SHORT RegClien.10014670 10014688 8DB424 EC000000 LEA ESI,DWORD PTR SS:[ESP+EC] 1001468F 8D8424 AC060000 LEA EAX,DWORD PTR SS:[ESP+6AC] 10014696 8A10 MOV DL,BYTE PTR DS:[EAX] 10014698 8A1E MOV BL,BYTE PTR DS:[ESI] 1001469A 8ACA MOV CL,DL 1001469C 3AD3 CMP DL,BL 1001469E 75 1E JNZ SHORT RegClien.100146BE 100146A0 84C9 TEST CL,CL 100146A2 74 16 JE SHORT RegClien.100146BA 100146A4 8A50 01 MOV DL,BYTE PTR DS:[EAX+1] 100146A7 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1] 100146AA 8ACA MOV CL,DL 100146AC 3AD3 CMP DL,BL 100146AE 75 0E JNZ SHORT RegClien.100146BE 100146B0 83C0 02 ADD EAX,2 100146B3 83C6 02 ADD ESI,2 100146B6 84C9 TEST CL,CL 100146B8 ^ 75 DC JNZ SHORT RegClien.10014696 100146BA 33C0 XOR EAX,EAX 100146BC EB 05 JMP SHORT RegClien.100146C3 100146BE 1BC0 SBB EAX,EAX 100146C0 83D8 FF SBB EAX,-1 100146C3 85C0 TEST EAX,EAX 100146C5 0F84 8F000000 JE RegClien.1001475A 100146CB 6A 40 PUSH 40 100146CD 68 44510310 PUSH RegClien.10035144 ; 系统提示 100146D2 68 38610310 PUSH RegClien.10036138 ; 导入注册码失败！请确认序列号、口令正确及输入的注册码正常可用。 100146D7 8BCD MOV ECX,EBP 100146D9 E8 D61A0100 CALL RegClien.100261B4 100146DE 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C] 100146E2 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],6 100146EA E8 03350100 CALL RegClien.10027BF2 100146EF 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 100146F3 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],5 100146FB E8 F2340100 CALL RegClien.10027BF2 10014700 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 10014704 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],4 1001470C E8 E1340100 CALL RegClien.10027BF2 10014711 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 10014715 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0 1001471D E8 D0340100 CALL RegClien.10027BF2 10014722 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] 10014729 C78424 B40C0000>MOV DWORD PTR SS:[ESP+CB4],10 10014734 E8 B9340100 CALL RegClien.10027BF2 10014739 8D8C24 B4000000 LEA ECX,DWORD PTR SS:[ESP+B4] 10014740 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0F 10014748 E8 A5340100 CALL RegClien.10027BF2 1001474D C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0E 10014755 E9 750D0000 JMP RegClien.100154CF 1001475A 8B5C24 18 MOV EBX,DWORD PTR SS:[ESP+18] 1001475E B9 80000000 MOV ECX,80 10014763 33C0 XOR EAX,EAX 10014765 8DBC24 AC060000 LEA EDI,DWORD PTR SS:[ESP+6AC] 1001476C F3:AB REP STOS DWORD PTR ES:[EDI] 1001476E 33F6 XOR ESI,ESI 10014770 33FF XOR EDI,EDI 10014772 85DB TEST EBX,EBX 10014774 897424 30 MOV DWORD PTR SS:[ESP+30],ESI 10014778 7E 6F JLE SHORT RegClien.100147E9 1001477A 895C24 20 MOV DWORD PTR SS:[ESP+20],EBX 1001477E 8D843C 08020000 LEA EAX,DWORD PTR SS:[ESP+EDI+208] 10014785 6A 01 PUSH 1 10014787 50 PUSH EAX 10014788 8BCD MOV ECX,EBP 1001478A E8 F10D0000 CALL RegClien.10015580 1001478F 85C0 TEST EAX,EAX 10014791 0F84 F4010000 JE RegClien.1001498B 10014797 837C24 20 02 CMP DWORD PTR SS:[ESP+20],2 1001479C 0F8C 78020000 JL RegClien.10014A1A 100147A2 85C0 TEST EAX,EAX 100147A4 76 2A JBE SHORT RegClien.100147D0 100147A6 8A943C 09020000 MOV DL,BYTE PTR SS:[ESP+EDI+209] 100147AD 8A9C3C 0A020000 MOV BL,BYTE PTR SS:[ESP+EDI+20A] 100147B4 8D8C34 AD060000 LEA ECX,DWORD PTR SS:[ESP+ESI+6AD] 100147BB 8BF0 MOV ESI,EAX 100147BD 8851 FF MOV BYTE PTR DS:[ECX-1],DL 100147C0 8819 MOV BYTE PTR DS:[ECX],BL 100147C2 83C1 02 ADD ECX,2 100147C5 4E DEC ESI 100147C6 ^ 75 F5 JNZ SHORT RegClien.100147BD 100147C8 8B7424 30 MOV ESI,DWORD PTR SS:[ESP+30] 100147CC 8B5C24 18 MOV EBX,DWORD PTR SS:[ESP+18] 100147D0 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 100147D4 83C7 03 ADD EDI,3 100147D7 8D3446 LEA ESI,DWORD PTR DS:[ESI+EAX*2] 100147DA 83E9 03 SUB ECX,3 100147DD 3BFB CMP EDI,EBX 100147DF 897424 30 MOV DWORD PTR SS:[ESP+30],ESI 100147E3 894C24 20 MOV DWORD PTR SS:[ESP+20],ECX 100147E7 ^ 7C 95 JL SHORT RegClien.1001477E 100147E9 B9 80000000 MOV ECX,80 100147EE 8DB424 AC060000 LEA ESI,DWORD PTR SS:[ESP+6AC] 100147F5 8DBC24 08020000 LEA EDI,DWORD PTR SS:[ESP+208] 100147FC F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 100147FE 8D8C24 BC000000 LEA ECX,DWORD PTR SS:[ESP+BC] 10014805 E8 9D2E0000 CALL RegClien.100176A7 1001480A 8B0D FC630310 MOV ECX,DWORD PTR DS:[100363FC] ; RegClien.10036410 10014810 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX 10014814 8D9424 08010000 LEA EDX,DWORD PTR SS:[ESP+108] 1001481B B9 40000000 MOV ECX,40 10014820 33C0 XOR EAX,EAX 10014822 8DBC24 08010000 LEA EDI,DWORD PTR SS:[ESP+108] 10014829 52 PUSH EDX 1001482A 68 7C510310 PUSH RegClien.1003517C ; e5n4xa<5~ttqm]x4 1001482F F3:AB REP STOS DWORD PTR ES:[EDI] 10014831 C68424 BC0C0000>MOV BYTE PTR SS:[ESP+CBC],18 10014839 E8 221C0000 CALL RegClien.10016460 1001483E 83C4 08 ADD ESP,8 10014841 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14] 10014845 8D8C24 08010000 LEA ECX,DWORD PTR SS:[ESP+108] 1001484C 50 PUSH EAX 1001484D 51 PUSH ECX 1001484E 51 PUSH ECX 1001484F 8D85 F0000000 LEA EAX,DWORD PTR SS:[EBP+F0] 10014855 8BCC MOV ECX,ESP 10014857 896424 1C MOV DWORD PTR SS:[ESP+1C],ESP 1001485B 50 PUSH EAX 1001485C E8 06310100 CALL RegClien.10027967 10014861 51 PUSH ECX 10014862 8D85 D4000000 LEA EAX,DWORD PTR SS:[EBP+D4] 10014868 8BCC MOV ECX,ESP 1001486A 896424 30 MOV DWORD PTR SS:[ESP+30],ESP 1001486E 50 PUSH EAX 1001486F C68424 C80C0000>MOV BYTE PTR SS:[ESP+CC8],19 10014877 E8 EB300100 CALL RegClien.10027967 1001487C 51 PUSH ECX 1001487D 8D85 EC000000 LEA EAX,DWORD PTR SS:[EBP+EC] 10014883 8BCC MOV ECX,ESP 10014885 896424 44 MOV DWORD PTR SS:[ESP+44],ESP 10014889 50 PUSH EAX 1001488A C68424 CC0C0000>MOV BYTE PTR SS:[ESP+CCC],1A 10014892 E8 D0300100 CALL RegClien.10027967 10014897 51 PUSH ECX 10014898 C68424 CC0C0000>MOV BYTE PTR SS:[ESP+CCC],1B 100148A0 8BCC MOV ECX,ESP 100148A2 896424 30 MOV DWORD PTR SS:[ESP+30],ESP 100148A6 68 90770310 PUSH RegClien.10037790 100148AB E8 B0330100 CALL RegClien.10027C60 100148B0 C68424 CC0C0000>MOV BYTE PTR SS:[ESP+CCC],18 100148B8 E8 3341FFFF CALL RegClien.100089F0 100148BD 8B5424 2C MOV EDX,DWORD PTR SS:[ESP+2C] 100148C1 68 90770310 PUSH RegClien.10037790 100148C6 52 PUSH EDX 100148C7 E8 323B0000 CALL RegClien.100183FE 100148CC 83C4 20 ADD ESP,20 100148CF 85C0 TEST EAX,EAX 100148D1 0F85 D2010000 JNZ RegClien.10014AA9 100148D7 6A 40 PUSH 40 100148D9 68 44510310 PUSH RegClien.10035144 ; 系统提示 100148DE 68 24610310 PUSH RegClien.10036124 ; 打开配置文件出错！ 100148E3 8BCD MOV ECX,EBP 100148E5 E8 CA180100 CALL RegClien.100261B4 100148EA 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 100148EE C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],17 100148F6 E8 F7320100 CALL RegClien.10027BF2 100148FB 8D8C24 BC000000 LEA ECX,DWORD PTR SS:[ESP+BC] 10014902 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],7 1001490A E8 D52D0000 CALL RegClien.100176E4 1001490F 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C] 10014913 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],6 1001491B E8 D2320100 CALL RegClien.10027BF2 10014920 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 10014924 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],5 1001492C E8 C1320100 CALL RegClien.10027BF2 10014931 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 10014935 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],4 1001493D E8 B0320100 CALL RegClien.10027BF2 10014942 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 10014946 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0 1001494E E8 9F320100 CALL RegClien.10027BF2 10014953 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] 1001495A C78424 B40C0000>MOV DWORD PTR SS:[ESP+CB4],1E 10014965 E8 88320100 CALL RegClien.10027BF2 1001496A 8D8C24 B4000000 LEA ECX,DWORD PTR SS:[ESP+B4] 10014971 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],1D 10014979 E8 74320100 CALL RegClien.10027BF2 1001497E C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],1C 10014986 E9 440B0000 JMP RegClien.100154CF 1001498B 6A 40 PUSH 40 1001498D 68 44510310 PUSH RegClien.10035144 ; 系统提示 10014992 68 FC600310 PUSH RegClien.100360FC ; 输入的注册码有误，请输入正确注册码！ 10014997 8BCD MOV ECX,EBP 10014999 E8 16180100 CALL RegClien.100261B4 1001499E 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C] 100149A2 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],6 100149AA E8 43320100 CALL RegClien.10027BF2 100149AF 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 100149B3 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],5 100149BB E8 32320100 CALL RegClien.10027BF2 100149C0 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 100149C4 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],4 100149CC E8 21320100 CALL RegClien.10027BF2 100149D1 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 100149D5 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0 100149DD E8 10320100 CALL RegClien.10027BF2 100149E2 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] 100149E9 C78424 B40C0000>MOV DWORD PTR SS:[ESP+CB4],13 100149F4 E8 F9310100 CALL RegClien.10027BF2 100149F9 8D8C24 B4000000 LEA ECX,DWORD PTR SS:[ESP+B4] 10014A00 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],12 10014A08 E8 E5310100 CALL RegClien.10027BF2 10014A0D C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],11 10014A15 E9 B50A0000 JMP RegClien.100154CF 10014A1A 6A 40 PUSH 40 10014A1C 68 44510310 PUSH RegClien.10035144 ; 系统提示 10014A21 68 FC600310 PUSH RegClien.100360FC ; 输入的注册码有误，请输入正确注册码！ 10014A26 8BCD MOV ECX,EBP 10014A28 E8 87170100 CALL RegClien.100261B4 10014A2D 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C] 10014A31 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],6 10014A39 E8 B4310100 CALL RegClien.10027BF2 10014A3E 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 10014A42 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],5 10014A4A E8 A3310100 CALL RegClien.10027BF2 10014A4F 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 10014A53 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],4 10014A5B E8 92310100 CALL RegClien.10027BF2 10014A60 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 10014A64 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0 10014A6C E8 81310100 CALL RegClien.10027BF2 10014A71 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] 10014A78 C78424 B40C0000>MOV DWORD PTR SS:[ESP+CB4],16 10014A83 E8 6A310100 CALL RegClien.10027BF2 10014A88 8D8C24 B4000000 LEA ECX,DWORD PTR SS:[ESP+B4] 10014A8F C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],15 10014A97 E8 56310100 CALL RegClien.10027BF2 10014A9C C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],14 10014AA4 E9 260A0000 JMP RegClien.100154CF 10014AA9 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 10014AAD E8 C7350100 CALL RegClien.10028079 10014AB2 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14] 10014AB6 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 10014ABA 50 PUSH EAX 10014ABB 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+14] 10014ABF 51 PUSH ECX 10014AC0 52 PUSH EDX 10014AC1 E8 CE320100 CALL RegClien.10027D94 10014AC6 8B00 MOV EAX,DWORD PTR DS:[EAX] 10014AC8 6A 00 PUSH 0 10014ACA 50 PUSH EAX 10014ACB 8D8C24 C4000000 LEA ECX,DWORD PTR SS:[ESP+C4] 10014AD2 C68424 BC0C0000>MOV BYTE PTR SS:[ESP+CBC],1F 10014ADA E8 8B2C0000 CALL RegClien.1001776A 10014ADF 85C0 TEST EAX,EAX 10014AE1 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 10014AE5 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],18 10014AED 0F94C3 SETE BL 10014AF0 E8 FD300100 CALL RegClien.10027BF2 10014AF5 84DB TEST BL,BL 10014AF7 74 19 JE SHORT RegClien.10014B12 10014AF9 B9 A9000000 MOV ECX,0A9 10014AFE 33C0 XOR EAX,EAX 10014B00 8DBC24 08040000 LEA EDI,DWORD PTR SS:[ESP+408] 10014B07 F3:AB REP STOS DWORD PTR ES:[EDI] 10014B09 51 PUSH ECX 10014B0A 8BCC MOV ECX,ESP 10014B0C 896424 14 MOV DWORD PTR SS:[ESP+14],ESP 10014B10 EB 42 JMP SHORT RegClien.10014B54 10014B12 8D9424 08040000 LEA EDX,DWORD PTR SS:[ESP+408] 10014B19 52 PUSH EDX 10014B1A 51 PUSH ECX 10014B1B 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 10014B1F 8BC4 MOV EAX,ESP 10014B21 896424 18 MOV DWORD PTR SS:[ESP+18],ESP 10014B25 8D5424 24 LEA EDX,DWORD PTR SS:[ESP+24] 10014B29 51 PUSH ECX 10014B2A 52 PUSH EDX 10014B2B 50 PUSH EAX 10014B2C E8 63320100 CALL RegClien.10027D94 10014B31 E8 2A4AFFFF CALL RegClien.10009560 10014B36 83C4 08 ADD ESP,8 10014B39 85C0 TEST EAX,EAX 10014B3B 74 30 JE SHORT RegClien.10014B6D 10014B3D B9 A9000000 MOV ECX,0A9 10014B42 33C0 XOR EAX,EAX 10014B44 8DBC24 08040000 LEA EDI,DWORD PTR SS:[ESP+408] 10014B4B F3:AB REP STOS DWORD PTR ES:[EDI] 10014B4D 51 PUSH ECX 10014B4E 8BCC MOV ECX,ESP 10014B50 896424 14 MOV DWORD PTR SS:[ESP+14],ESP 10014B54 8D4424 18 LEA EAX,DWORD PTR SS:[ESP+18] 10014B58 50 PUSH EAX 10014B59 E8 092E0100 CALL RegClien.10027967 10014B5E 8D8C24 0C040000 LEA ECX,DWORD PTR SS:[ESP+40C] 10014B65 51 PUSH ECX 10014B66 8BCD MOV ECX,EBP 10014B68 E8 830A0000 CALL RegClien.100155F0 10014B6D B9 80000000 MOV ECX,80 10014B72 33C0 XOR EAX,EAX 10014B74 8DBC24 AC060000 LEA EDI,DWORD PTR SS:[ESP+6AC] 10014B7B 33F6 XOR ESI,ESI 10014B7D F3:AB REP STOS DWORD PTR ES:[EDI] 10014B7F 8DBC24 AC060000 LEA EDI,DWORD PTR SS:[ESP+6AC] 10014B86 8D9434 08020000 LEA EDX,DWORD PTR SS:[ESP+ESI+208] 10014B8D 6A 02 PUSH 2 10014B8F 52 PUSH EDX 10014B90 8BCD MOV ECX,EBP 10014B92 E8 E9090000 CALL RegClien.10015580 10014B97 8807 MOV BYTE PTR DS:[EDI],AL 10014B99 83C6 02 ADD ESI,2 10014B9C 47 INC EDI 10014B9D 83FE 3C CMP ESI,3C 10014BA0 ^ 7C E4 JL SHORT RegClien.10014B86 10014BA2 8D8424 AC060000 LEA EAX,DWORD PTR SS:[ESP+6AC] 10014BA9 8D8C24 30060000 LEA ECX,DWORD PTR SS:[ESP+630] 10014BB0 50 PUSH EAX 10014BB1 68 58510310 PUSH RegClien.10035158 ; %s 10014BB6 51 PUSH ECX 10014BB7 E8 B0390000 CALL RegClien.1001856C 10014BBC 83C4 0C ADD ESP,0C 10014BBF 8D9424 44020000 LEA EDX,DWORD PTR SS:[ESP+244] 10014BC6 8BCD MOV ECX,EBP 10014BC8 6A 02 PUSH 2 10014BCA 52 PUSH EDX 10014BCB E8 B0090000 CALL RegClien.10015580 10014BD0 8BD8 MOV EBX,EAX 10014BD2 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10] 10014BD6 50 PUSH EAX 10014BD7 E8 8AEE0000 CALL RegClien.10023A66 10014BDC 8B08 MOV ECX,DWORD PTR DS:[EAX] 10014BDE F6C3 80 TEST BL,80 10014BE1 894C24 40 MOV DWORD PTR SS:[ESP+40],ECX 10014BE5 74 49 JE SHORT RegClien.10014C30 10014BE7 8D5424 10 LEA EDX,DWORD PTR SS:[ESP+10] 10014BEB 33DB XOR EBX,EBX 10014BED 68 C8520310 PUSH RegClien.100352C8 ; %y-%m-%d 10014BF2 52 PUSH EDX 10014BF3 8D4C24 48 LEA ECX,DWORD PTR SS:[ESP+48] 10014BF7 C68424 58050000>MOV BYTE PTR SS:[ESP+558],0 10014BFF 899C24 70050000 MOV DWORD PTR SS:[ESP+570],EBX 10014C06 899C24 74050000 MOV DWORD PTR SS:[ESP+574],EBX 10014C0D E8 96EE0000 CALL RegClien.10023AA8 10014C12 8B00 MOV EAX,DWORD PTR DS:[EAX] 10014C14 50 PUSH EAX 10014C15 8D8424 74050000 LEA EAX,DWORD PTR SS:[ESP+574] 10014C1C 50 PUSH EAX 10014C1D E8 4A390000 CALL RegClien.1001856C 10014C22 83C4 08 ADD ESP,8 10014C25 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 10014C29 E8 C42F0100 CALL RegClien.10027BF2 10014C2E EB 09 JMP SHORT RegClien.10014C39 10014C30 889C24 50050000 MOV BYTE PTR SS:[ESP+550],BL 10014C37 33DB XOR EBX,EBX 10014C39 8D8C24 46020000 LEA ECX,DWORD PTR SS:[ESP+246] 10014C40 6A 02 PUSH 2 10014C42 51 PUSH ECX 10014C43 8BCD MOV ECX,EBP 10014C45 E8 36090000 CALL RegClien.10015580 10014C4A 8D9424 48020000 LEA EDX,DWORD PTR SS:[ESP+248] 10014C51 6A 08 PUSH 8 10014C53 52 PUSH EDX 10014C54 8BCD MOV ECX,EBP 10014C56 888424 59050000 MOV BYTE PTR SS:[ESP+559],AL 10014C5D E8 1E090000 CALL RegClien.10015580 10014C62 898424 54050000 MOV DWORD PTR SS:[ESP+554],EAX 10014C69 8D8424 50020000 LEA EAX,DWORD PTR SS:[ESP+250] 10014C70 6A 08 PUSH 8 10014C72 50 PUSH EAX 10014C73 8BCD MOV ECX,EBP 10014C75 E8 06090000 CALL RegClien.10015580 10014C7A 8D8C24 58020000 LEA ECX,DWORD PTR SS:[ESP+258] 10014C81 6A 02 PUSH 2 10014C83 51 PUSH ECX 10014C84 8BCD MOV ECX,EBP 10014C86 898424 60050000 MOV DWORD PTR SS:[ESP+560],EAX 10014C8D E8 EE080000 CALL RegClien.10015580 10014C92 8D9424 5A020000 LEA EDX,DWORD PTR SS:[ESP+25A] 10014C99 6A 08 PUSH 8 10014C9B 52 PUSH EDX 10014C9C 8BCD MOV ECX,EBP 10014C9E 888424 83050000 MOV BYTE PTR SS:[ESP+583],AL 10014CA5 E8 D6080000 CALL RegClien.10015580 10014CAA 898424 7C050000 MOV DWORD PTR SS:[ESP+57C],EAX 10014CB1 8D8424 62020000 LEA EAX,DWORD PTR SS:[ESP+262] 10014CB8 6A 08 PUSH 8 10014CBA 50 PUSH EAX 10014CBB 8BCD MOV ECX,EBP 10014CBD E8 BE080000 CALL RegClien.10015580 10014CC2 8D8C24 6A020000 LEA ECX,DWORD PTR SS:[ESP+26A] 10014CC9 6A 02 PUSH 2 10014CCB 51 PUSH ECX 10014CCC 8BCD MOV ECX,EBP 10014CCE 898424 88050000 MOV DWORD PTR SS:[ESP+588],EAX 10014CD5 E8 A6080000 CALL RegClien.10015580 10014CDA 8D9424 6C020000 LEA EDX,DWORD PTR SS:[ESP+26C] 10014CE1 6A 02 PUSH 2 10014CE3 52 PUSH EDX 10014CE4 8BCD MOV ECX,EBP 10014CE6 888424 8C050000 MOV BYTE PTR SS:[ESP+58C],AL 10014CED E8 8E080000 CALL RegClien.10015580 10014CF2 888424 85050000 MOV BYTE PTR SS:[ESP+585],AL 10014CF9 8D8424 6E020000 LEA EAX,DWORD PTR SS:[ESP+26E] 10014D00 6A 08 PUSH 8 10014D02 50 PUSH EAX 10014D03 8BCD MOV ECX,EBP 10014D05 E8 76080000 CALL RegClien.10015580 10014D0A 8D8C24 76020000 LEA ECX,DWORD PTR SS:[ESP+276] 10014D11 6A 08 PUSH 8 10014D13 51 PUSH ECX 10014D14 8BCD MOV ECX,EBP 10014D16 898424 AC050000 MOV DWORD PTR SS:[ESP+5AC],EAX 10014D1D E8 5E080000 CALL RegClien.10015580 10014D22 8D9424 7E020000 LEA EDX,DWORD PTR SS:[ESP+27E] 10014D29 6A 08 PUSH 8 10014D2B 52 PUSH EDX 10014D2C 8BCD MOV ECX,EBP 10014D2E 898424 A4050000 MOV DWORD PTR SS:[ESP+5A4],EAX 10014D35 E8 46080000 CALL RegClien.10015580 10014D3A 898424 A0050000 MOV DWORD PTR SS:[ESP+5A0],EAX 10014D41 B9 80000000 MOV ECX,80 10014D46 33C0 XOR EAX,EAX 10014D48 8DBC24 AC060000 LEA EDI,DWORD PTR SS:[ESP+6AC] 10014D4F F3:AB REP STOS DWORD PTR ES:[EDI] 10014D51 33F6 XOR ESI,ESI 10014D53 8DBC24 AC060000 LEA EDI,DWORD PTR SS:[ESP+6AC] 10014D5A 8D8434 86020000 LEA EAX,DWORD PTR SS:[ESP+ESI+286] 10014D61 6A 02 PUSH 2 10014D63 50 PUSH EAX 10014D64 8BCD MOV ECX,EBP 10014D66 E8 15080000 CALL RegClien.10015580 10014D6B 8807 MOV BYTE PTR DS:[EDI],AL 10014D6D 83C6 02 ADD ESI,2 10014D70 47 INC EDI 10014D71 83FE 14 CMP ESI,14 10014D74 ^ 7C E4 JL SHORT RegClien.10014D5A 10014D76 8D8C24 AC060000 LEA ECX,DWORD PTR SS:[ESP+6AC] 10014D7D 8D9424 5C050000 LEA EDX,DWORD PTR SS:[ESP+55C] 10014D84 51 PUSH ECX 10014D85 68 58510310 PUSH RegClien.10035158 ; %s 10014D8A 52 PUSH EDX 10014D8B E8 DC370000 CALL RegClien.1001856C 10014D90 B9 80000000 MOV ECX,80 10014D95 33C0 XOR EAX,EAX 10014D97 8DBC24 B8060000 LEA EDI,DWORD PTR SS:[ESP+6B8] 10014D9E 83C4 0C ADD ESP,0C 10014DA1 F3:AB REP STOS DWORD PTR ES:[EDI] 10014DA3 33F6 XOR ESI,ESI 10014DA5 8DBC24 AC060000 LEA EDI,DWORD PTR SS:[ESP+6AC] 10014DAC 8D8434 9A020000 LEA EAX,DWORD PTR SS:[ESP+ESI+29A] 10014DB3 6A 02 PUSH 2 10014DB5 50 PUSH EAX 10014DB6 8BCD MOV ECX,EBP 10014DB8 E8 C3070000 CALL RegClien.10015580 10014DBD 8807 MOV BYTE PTR DS:[EDI],AL 10014DBF 83C6 02 ADD ESI,2 10014DC2 47 INC EDI 10014DC3 83FE 22 CMP ESI,22 10014DC6 ^ 7C E4 JL SHORT RegClien.10014DAC 10014DC8 8D8C24 AC060000 LEA ECX,DWORD PTR SS:[ESP+6AC] 10014DCF 8D9424 4F060000 LEA EDX,DWORD PTR SS:[ESP+64F] 10014DD6 51 PUSH ECX 10014DD7 68 58510310 PUSH RegClien.10035158 ; %s 10014DDC 52 PUSH EDX 10014DDD E8 8A370000 CALL RegClien.1001856C 10014DE2 B9 80000000 MOV ECX,80 10014DE7 33C0 XOR EAX,EAX 10014DE9 8DBC24 B8060000 LEA EDI,DWORD PTR SS:[ESP+6B8] 10014DF0 83C4 0C ADD ESP,0C 10014DF3 F3:AB REP STOS DWORD PTR ES:[EDI] 10014DF5 33F6 XOR ESI,ESI 10014DF7 8DBC24 AC060000 LEA EDI,DWORD PTR SS:[ESP+6AC] 10014DFE 8D8434 BC020000 LEA EAX,DWORD PTR SS:[ESP+ESI+2BC] 10014E05 6A 02 PUSH 2 10014E07 50 PUSH EAX 10014E08 8BCD MOV ECX,EBP 10014E0A E8 71070000 CALL RegClien.10015580 10014E0F 8807 MOV BYTE PTR DS:[EDI],AL 10014E11 83C6 02 ADD ESI,2 10014E14 47 INC EDI 10014E15 83FE 40 CMP ESI,40 10014E18 ^ 7C E4 JL SHORT RegClien.10014DFE 10014E1A 8D8C24 AC060000 LEA ECX,DWORD PTR SS:[ESP+6AC] 10014E21 8D9424 A8050000 LEA EDX,DWORD PTR SS:[ESP+5A8] 10014E28 51 PUSH ECX 10014E29 68 58510310 PUSH RegClien.10035158 ; %s 10014E2E 52 PUSH EDX 10014E2F E8 38370000 CALL RegClien.1001856C 10014E34 8D8424 14040000 LEA EAX,DWORD PTR SS:[ESP+414] 10014E3B 50 PUSH EAX 10014E3C E8 1F3FFFFF CALL RegClien.10008D60 10014E41 83C4 10 ADD ESP,10 10014E44 85C0 TEST EAX,EAX 10014E46 0F84 F1000000 JE RegClien.10014F3D 10014E4C F68424 50050000>TEST BYTE PTR SS:[ESP+550],1 10014E54 0F84 E3000000 JE RegClien.10014F3D 10014E5A B9 40000000 MOV ECX,40 10014E5F 33C0 XOR EAX,EAX 10014E61 8DBC24 AC0A0000 LEA EDI,DWORD PTR SS:[ESP+AAC] 10014E68 F3:AB REP STOS DWORD PTR ES:[EDI] 10014E6A 8D8C24 AC0A0000 LEA ECX,DWORD PTR SS:[ESP+AAC] 10014E71 51 PUSH ECX 10014E72 51 PUSH ECX 10014E73 8BD4 MOV EDX,ESP 10014E75 896424 18 MOV DWORD PTR SS:[ESP+18],ESP 10014E79 6A 08 PUSH 8 10014E7B 6A 03 PUSH 3 10014E7D 52 PUSH EDX 10014E7E 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 10014E82 E8 5DE50000 CALL RegClien.100233E4 10014E87 E8 143EFFFF CALL RegClien.10008CA0 10014E8C 83C4 08 ADD ESP,8 10014E8F 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10] 10014E93 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 10014E97 6A 08 PUSH 8 10014E99 6A 03 PUSH 3 10014E9B 50 PUSH EAX 10014E9C E8 43E50000 CALL RegClien.100233E4 10014EA1 8B08 MOV ECX,DWORD PTR DS:[EAX] 10014EA3 8D9424 AC0B0000 LEA EDX,DWORD PTR SS:[ESP+BAC] 10014EAA 51 PUSH ECX 10014EAB 68 58510310 PUSH RegClien.10035158 ; %s 10014EB0 52 PUSH EDX 10014EB1 E8 B6360000 CALL RegClien.1001856C 10014EB6 83C4 0C ADD ESP,0C 10014EB9 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 10014EBD E8 302D0100 CALL RegClien.10027BF2 10014EC2 B9 40000000 MOV ECX,40 10014EC7 33C0 XOR EAX,EAX 10014EC9 8DBC24 08010000 LEA EDI,DWORD PTR SS:[ESP+108] 10014ED0 F3:AB REP STOS DWORD PTR ES:[EDI] 10014ED2 8D8424 08010000 LEA EAX,DWORD PTR SS:[ESP+108] 10014ED9 50 PUSH EAX 10014EDA 68 90520310 PUSH RegClien.10035290 ; okjxs]va``ie_vkokjx``serhkso``?qvvarxzavoekr``a|tpkvav 10014EDF E8 7C150000 CALL RegClien.10016460 10014EE4 8D8C24 B40A0000 LEA ECX,DWORD PTR SS:[ESP+AB4] 10014EEB 68 88520310 PUSH RegClien.10035288 ; netb 10014EF0 8D9424 14010000 LEA EDX,DWORD PTR SS:[ESP+114] 10014EF7 51 PUSH ECX 10014EF8 52 PUSH EDX 10014EF9 E8 02150000 CALL RegClien.10016400 10014EFE B9 40000000 MOV ECX,40 10014F03 33C0 XOR EAX,EAX 10014F05 8DBC24 1C010000 LEA EDI,DWORD PTR SS:[ESP+11C] 10014F0C F3:AB REP STOS DWORD PTR ES:[EDI] 10014F0E 8D8424 1C010000 LEA EAX,DWORD PTR SS:[ESP+11C] 10014F15 50 PUSH EAX 10014F16 68 60520310 PUSH RegClien.10035260 ; okjxs]va``ie_vkokjx``erxavrax$a|tpkvav 10014F1B E8 40150000 CALL RegClien.10016460 10014F20 8D8C24 C80B0000 LEA ECX,DWORD PTR SS:[ESP+BC8] 10014F27 68 58520310 PUSH RegClien.10035258 ; lade 10014F2C 8D9424 28010000 LEA EDX,DWORD PTR SS:[ESP+128] 10014F33 51 PUSH ECX 10014F34 52 PUSH EDX 10014F35 E8 C6140000 CALL RegClien.10016400 10014F3A 83C4 28 ADD ESP,28 10014F3D 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10] 10014F41 68 C8520310 PUSH RegClien.100352C8 ; %y-%m-%d 10014F46 50 PUSH EAX 10014F47 8D4C24 48 LEA ECX,DWORD PTR SS:[ESP+48] 10014F4B 899C24 94050000 MOV DWORD PTR SS:[ESP+594],EBX 10014F52 899C24 90050000 MOV DWORD PTR SS:[ESP+590],EBX 10014F59 E8 4AEB0000 CALL RegClien.10023AA8 10014F5E 8B00 MOV EAX,DWORD PTR DS:[EAX] 10014F60 8D8C24 90050000 LEA ECX,DWORD PTR SS:[ESP+590] 10014F67 50 PUSH EAX 10014F68 51 PUSH ECX 10014F69 E8 FE350000 CALL RegClien.1001856C 10014F6E 83C4 08 ADD ESP,8 10014F71 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 10014F75 E8 782C0100 CALL RegClien.10027BF2 10014F7A 8B4424 3C MOV EAX,DWORD PTR SS:[ESP+3C] 10014F7E 8D7C24 44 LEA EDI,DWORD PTR SS:[ESP+44] 10014F82 898424 68060000 MOV DWORD PTR SS:[ESP+668],EAX 10014F89 83C9 FF OR ECX,FFFFFFFF 10014F8C 33C0 XOR EAX,EAX 10014F8E 8B5424 34 MOV EDX,DWORD PTR SS:[ESP+34] 10014F92 F2:AE REPNE SCAS BYTE PTR ES:[EDI] 10014F94 F7D1 NOT ECX 10014F96 49 DEC ECX 10014F97 899424 64060000 MOV DWORD PTR SS:[ESP+664],EDX 10014F9E 74 1A JE SHORT RegClien.10014FBA 10014FA0 8D4C24 44 LEA ECX,DWORD PTR SS:[ESP+44] 10014FA4 8D9424 6C060000 LEA EDX,DWORD PTR SS:[ESP+66C] 10014FAB 51 PUSH ECX 10014FAC 68 58510310 PUSH RegClien.10035158 ; %s 10014FB1 52 PUSH EDX 10014FB2 E8 B5350000 CALL RegClien.1001856C 10014FB7 83C4 0C ADD ESP,0C 10014FBA 8D8424 08040000 LEA EAX,DWORD PTR SS:[ESP+408] 10014FC1 6A 01 PUSH 1 10014FC3 50 PUSH EAX 10014FC4 51 PUSH ECX 10014FC5 8D5424 20 LEA EDX,DWORD PTR SS:[ESP+20] 10014FC9 8BCC MOV ECX,ESP 10014FCB 896424 1C MOV DWORD PTR SS:[ESP+1C],ESP 10014FCF 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28] 10014FD3 52 PUSH EDX 10014FD4 50 PUSH EAX 10014FD5 51 PUSH ECX 10014FD6 E8 B92D0100 CALL RegClien.10027D94 10014FDB E8 8056FFFF CALL RegClien.1000A660 10014FE0 83C4 0C ADD ESP,0C 10014FE3 3BC3 CMP EAX,EBX 10014FE5 0F84 B4000000 JE RegClien.1001509F 10014FEB 6A 40 PUSH 40 10014FED 68 44510310 PUSH RegClien.10035144 ; 系统提示 10014FF2 68 E4600310 PUSH RegClien.100360E4 ; 保存配置文件时出错！ 10014FF7 8BCD MOV ECX,EBP 10014FF9 E8 B6110100 CALL RegClien.100261B4 10014FFE 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 10015002 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],17 1001500A E8 E32B0100 CALL RegClien.10027BF2 1001500F 8D8C24 BC000000 LEA ECX,DWORD PTR SS:[ESP+BC] 10015016 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],7 1001501E E8 C1260000 CALL RegClien.100176E4 10015023 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C] 10015027 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],6 1001502F E8 BE2B0100 CALL RegClien.10027BF2 10015034 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 10015038 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],5 10015040 E8 AD2B0100 CALL RegClien.10027BF2 10015045 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 10015049 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],4 10015051 E8 9C2B0100 CALL RegClien.10027BF2 10015056 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 1001505A C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0 10015062 E8 8B2B0100 CALL RegClien.10027BF2 10015067 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] 1001506E C78424 B40C0000>MOV DWORD PTR SS:[ESP+CB4],22 10015079 E8 742B0100 CALL RegClien.10027BF2 1001507E 8D8C24 B4000000 LEA ECX,DWORD PTR SS:[ESP+B4] 10015085 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],21 1001508D E8 602B0100 CALL RegClien.10027BF2 10015092 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],20 1001509A E9 30040000 JMP RegClien.100154CF 1001509F 8D8C24 08010000 LEA ECX,DWORD PTR SS:[ESP+108] 100150A6 68 00010000 PUSH 100 100150AB 51 PUSH ECX 100150AC FF15 48E20210 CALL DWORD PTR DS:[<&KERNEL32.GetSystemD>; kernel32.GetSystemDirectoryA 100150B2 8B15 FC630310 MOV EDX,DWORD PTR DS:[100363FC] ; RegClien.10036410 100150B8 895424 38 MOV DWORD PTR SS:[ESP+38],EDX 100150BC 3D 00010000 CMP EAX,100 100150C1 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],23 100150C9 7E 10 JLE SHORT RegClien.100150DB 100150CB 68 54520310 PUSH RegClien.10035254 ; c:\ 100150D0 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] 100150D4 E8 562C0100 CALL RegClien.10027D2F 100150D9 EB 73 JMP SHORT RegClien.1001514E 100150DB C68404 08010000>MOV BYTE PTR SS:[ESP+EAX+108],0 100150E3 8D8424 08010000 LEA EAX,DWORD PTR SS:[ESP+108] 100150EA 50 PUSH EAX 100150EB 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] 100150EF E8 3B2C0100 CALL RegClien.10027D2F 100150F4 68 50520310 PUSH RegClien.10035250 ; \ 100150F9 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 100150FD E8 5E2B0100 CALL RegClien.10027C60 10015102 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 10015106 50 PUSH EAX 10015107 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+14] 1001510B B3 24 MOV BL,24 1001510D 51 PUSH ECX 1001510E 52 PUSH EDX 1001510F 889C24 C00C0000 MOV BYTE PTR SS:[ESP+CC0],BL 10015116 E8 792C0100 CALL RegClien.10027D94 1001511B 50 PUSH EAX 1001511C 8D4C24 3C LEA ECX,DWORD PTR SS:[ESP+3C] 10015120 C68424 B80C0000>MOV BYTE PTR SS:[ESP+CB8],25 10015128 E8 B22B0100 CALL RegClien.10027CDF 1001512D 8D4C24 10 LEA ECX,DWORD PTR SS:[ESP+10] 10015131 889C24 B40C0000 MOV BYTE PTR SS:[ESP+CB4],BL 10015138 E8 B52A0100 CALL RegClien.10027BF2 1001513D 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34] 10015141 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],23 10015149 E8 A42A0100 CALL RegClien.10027BF2 1001514E B9 40000000 MOV ECX,40 10015153 33C0 XOR EAX,EAX 10015155 8DBC24 08010000 LEA EDI,DWORD PTR SS:[ESP+108] 1001515C F3:AB REP STOS DWORD PTR ES:[EDI] 1001515E 8D8424 08010000 LEA EAX,DWORD PTR SS:[ESP+108] 10015165 50 PUSH EAX 10015166 68 7C510310 PUSH RegClien.1003517C ; e5n4xa<5~ttqm]x4 1001516B E8 F0120000 CALL RegClien.10016460 10015170 83C4 08 ADD ESP,8 10015173 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 10015177 8D9424 08010000 LEA EDX,DWORD PTR SS:[ESP+108] 1001517E 8DBD EC000000 LEA EDI,DWORD PTR SS:[EBP+EC] 10015184 51 PUSH ECX 10015185 52 PUSH EDX 10015186 51 PUSH ECX 10015187 8BCC MOV ECX,ESP 10015189 896424 2C MOV DWORD PTR SS:[ESP+2C],ESP 1001518D 57 PUSH EDI 1001518E E8 D4270100 CALL RegClien.10027967 10015193 51 PUSH ECX 10015194 8D9D D4000000 LEA EBX,DWORD PTR SS:[EBP+D4] 1001519A 8BCC MOV ECX,ESP 1001519C 896424 4C MOV DWORD PTR SS:[ESP+4C],ESP 100151A0 53 PUSH EBX 100151A1 C68424 C80C0000>MOV BYTE PTR SS:[ESP+CC8],26 100151A9 E8 B9270100 CALL RegClien.10027967 100151AE 51 PUSH ECX 100151AF 8DB5 F0000000 LEA ESI,DWORD PTR SS:[EBP+F0] 100151B5 8BCC MOV ECX,ESP 100151B7 896424 44 MOV DWORD PTR SS:[ESP+44],ESP 100151BB 56 PUSH ESI 100151BC C68424 CC0C0000>MOV BYTE PTR SS:[ESP+CCC],27 100151C4 E8 9E270100 CALL RegClien.10027967 100151C9 51 PUSH ECX 100151CA 8D4424 34 LEA EAX,DWORD PTR SS:[ESP+34] 100151CE 8BCC MOV ECX,ESP 100151D0 896424 30 MOV DWORD PTR SS:[ESP+30],ESP 100151D4 50 PUSH EAX 100151D5 C68424 D00C0000>MOV BYTE PTR SS:[ESP+CD0],28 100151DD E8 85270100 CALL RegClien.10027967 100151E2 C68424 CC0C0000>MOV BYTE PTR SS:[ESP+CCC],23 100151EA E8 0138FFFF CALL RegClien.100089F0 100151EF 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+2C] 100151F3 68 90770310 PUSH RegClien.10037790 100151F8 51 PUSH ECX 100151F9 E8 00320000 CALL RegClien.100183FE 100151FE 83C4 20 ADD ESP,20 10015201 85C0 TEST EAX,EAX 10015203 0F85 C5000000 JNZ RegClien.100152CE 10015209 6A 40 PUSH 40 1001520B 68 44510310 PUSH RegClien.10035144 ; 系统提示 10015210 68 24610310 PUSH RegClien.10036124 ; 打开配置文件出错！ 10015215 8BCD MOV ECX,EBP 10015217 E8 980F0100 CALL RegClien.100261B4 1001521C 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 10015220 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],18 10015228 E8 C5290100 CALL RegClien.10027BF2 1001522D 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 10015231 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],17 10015239 E8 B4290100 CALL RegClien.10027BF2 1001523E 8D8C24 BC000000 LEA ECX,DWORD PTR SS:[ESP+BC] 10015245 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],7 1001524D E8 92240000 CALL RegClien.100176E4 10015252 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C] 10015256 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],6 1001525E E8 8F290100 CALL RegClien.10027BF2 10015263 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 10015267 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],5 1001526F E8 7E290100 CALL RegClien.10027BF2 10015274 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 10015278 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],4 10015280 E8 6D290100 CALL RegClien.10027BF2 10015285 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 10015289 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0 10015291 E8 5C290100 CALL RegClien.10027BF2 10015296 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] 1001529D C78424 B40C0000>MOV DWORD PTR SS:[ESP+CB4],2B 100152A8 E8 45290100 CALL RegClien.10027BF2 100152AD 8D8C24 B4000000 LEA ECX,DWORD PTR SS:[ESP+B4] 100152B4 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],2A 100152BC E8 31290100 CALL RegClien.10027BF2 100152C1 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],29 100152C9 E9 01020000 JMP RegClien.100154CF 100152CE 8D9424 08040000 LEA EDX,DWORD PTR SS:[ESP+408] 100152D5 6A 00 PUSH 0 100152D7 52 PUSH EDX 100152D8 51 PUSH ECX 100152D9 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20] 100152DD 8BC4 MOV EAX,ESP 100152DF 896424 2C MOV DWORD PTR SS:[ESP+2C],ESP 100152E3 8D5424 44 LEA EDX,DWORD PTR SS:[ESP+44] 100152E7 51 PUSH ECX 100152E8 52 PUSH EDX 100152E9 50 PUSH EAX 100152EA E8 A52A0100 CALL RegClien.10027D94 100152EF E8 6C53FFFF CALL RegClien.1000A660 100152F4 83C4 0C ADD ESP,0C 100152F7 85C0 TEST EAX,EAX 100152F9 0F84 C5000000 JE RegClien.100153C4 100152FF 6A 40 PUSH 40 10015301 68 44510310 PUSH RegClien.10035144 ; 系统提示 10015306 68 E4600310 PUSH RegClien.100360E4 ; 保存配置文件时出错！ 1001530B 8BCD MOV ECX,EBP 1001530D E8 A20E0100 CALL RegClien.100261B4 10015312 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 10015316 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],18 1001531E E8 CF280100 CALL RegClien.10027BF2 10015323 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 10015327 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],17 1001532F E8 BE280100 CALL RegClien.10027BF2 10015334 8D8C24 BC000000 LEA ECX,DWORD PTR SS:[ESP+BC] 1001533B C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],7 10015343 E8 9C230000 CALL RegClien.100176E4 10015348 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C] 1001534C C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],6 10015354 E8 99280100 CALL RegClien.10027BF2 10015359 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 1001535D C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],5 10015365 E8 88280100 CALL RegClien.10027BF2 1001536A 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 1001536E C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],4 10015376 E8 77280100 CALL RegClien.10027BF2 1001537B 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 1001537F C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0 10015387 E8 66280100 CALL RegClien.10027BF2 1001538C 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] 10015393 C78424 B40C0000>MOV DWORD PTR SS:[ESP+CB4],2E 1001539E E8 4F280100 CALL RegClien.10027BF2 100153A3 8D8C24 B4000000 LEA ECX,DWORD PTR SS:[ESP+B4] 100153AA C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],2D 100153B2 E8 3B280100 CALL RegClien.10027BF2 100153B7 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],2C 100153BF E9 0B010000 JMP RegClien.100154CF 100153C4 8B36 MOV ESI,DWORD PTR DS:[ESI] 100153C6 8B3F MOV EDI,DWORD PTR DS:[EDI] 100153C8 56 PUSH ESI 100153C9 57 PUSH EDI 100153CA 68 2C520310 PUSH RegClien.1003522C ; software 100153CF E8 5C0E0000 CALL RegClien.10016230 100153D4 8BF0 MOV ESI,EAX 100153D6 83C4 0C ADD ESP,0C 100153D9 85F6 TEST ESI,ESI 100153DB 74 32 JE SHORT RegClien.1001540F 100153DD 8B03 MOV EAX,DWORD PTR DS:[EBX] 100153DF 8D8C24 08010000 LEA ECX,DWORD PTR SS:[ESP+108] 100153E6 50 PUSH EAX 100153E7 68 58510310 PUSH RegClien.10035158 ; %s 100153EC 51 PUSH ECX 100153ED E8 7A310000 CALL RegClien.1001856C 100153F2 8D9424 14010000 LEA EDX,DWORD PTR SS:[ESP+114] 100153F9 52 PUSH EDX 100153FA 68 80570310 PUSH RegClien.10035780 ; username 100153FF 56 PUSH ESI 10015400 E8 5B0F0000 CALL RegClien.10016360 10015405 83C4 18 ADD ESP,18 10015408 56 PUSH ESI 10015409 FF15 08E00210 CALL DWORD PTR DS:[<&ADVAPI32.RegCloseKe>; advapi32.RegCloseKey 1001540F 6A 40 PUSH 40 10015411 68 44510310 PUSH RegClien.10035144 ; 系统提示 10015416 68 D0600310 PUSH RegClien.100360D0 ; 成功导入注册信息！ 1001541B 8BCD MOV ECX,EBP 1001541D E8 920D0100 CALL RegClien.100261B4 10015422 8D4C24 38 LEA ECX,DWORD PTR SS:[ESP+38] 10015426 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],18 1001542E E8 BF270100 CALL RegClien.10027BF2 10015433 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] 10015437 C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],17 1001543F E8 AE270100 CALL RegClien.10027BF2 10015444 8D8C24 BC000000 LEA ECX,DWORD PTR SS:[ESP+BC] 1001544B C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],7 10015453 E8 8C220000 CALL RegClien.100176E4 10015458 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C] 1001545C C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],6 10015464 E8 89270100 CALL RegClien.10027BF2 10015469 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] 1001546D C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],5 10015475 E8 78270100 CALL RegClien.10027BF2 1001547A 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 1001547E C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],4 10015486 E8 67270100 CALL RegClien.10027BF2 1001548B 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C] 1001548F C68424 B40C0000>MOV BYTE PTR SS:[ESP+CB4],0 10015497 E8 56270100 CALL RegClien.10027BF2 1001549C 8D8C24 B8000000 LEA ECX,DWORD PTR SS:[ESP+B8] |
|
|
这个程序弄了很长时间总算有一点点眉目了，其中走了很多弯路，但正是这个弯路带出了问题。走弯路主要是因为没用串式参考，没想到dll文件里面也有参考的。现在把问题阐述一下：前面已经讲了，在Trw2000调试了一下，所以在前面设置了断点，而且确实断了下来。是让程序运行后，并输入注册码等再设置上面的断点，点击“确定”就被OllyDBG接管了。之所以在上面设置断点也是因为在Trw2000调试时是按12次F12之后按F10进入了上面的地方。后来在OllyDBG中调试老是感觉没有什么比较，最终找到了上一楼的地方，并在下面这个地方设置断点成功。
100140E2 E8 CD020100 CALL RegClien.100243B4 100140E7 83F8 01 CMP EAX,1 在100140E2这个地方还不能输入注册码，到下面100140E7已经有了注册码，可以设置断点的。这里设了断点后按F8一直走下去就返回到10027573处。在前面设置断点按F8一直按下去也是返到10027573处。但是不管怎么按两个地方为什么没有交叉运行呢？这两个地方按照我的想法不管是哪个先哪个后总有个先后运行的，但是现在没有了，为什么？ |
|
|
赞赏
雪币:
留言:
