【破解日期】 2006年12月20日
【破解作者】 冷血书生
【作者邮箱】 meiyou
【作者主页】 hxxp://www.126.com
【使用工具】 OD
【破解平台】 Win9x/NT/2000/XP
【软件名称】 3D都市飞车 1.15
【下载地址】 http://gx.onlinedown.net/soft/50587.htm
【软件简介】 3D都市飞车是一款在城市街道上的3D赛车游戏,跑起来相当流畅,带有声音效果,可以让
你体验城市飚车的极速快感。游戏的操作,以「LEFT」、「RIGHT」左右方向键控制车辆的左、右转向,
「UP」向上键加速,「DOWN」向下键减速或后退,「ESC」键退出。游戏需要direct 7以上版本支持。
【软件大小】 2675KB
【加壳方式】 无
【破解声明】 我是一只小菜鸟,偶得一点心得,愿与大家分享:)
--------------------------------------------------------------------------------
【破解内容】
00424084 call 3D都市飞.00428DE0 ; 机器码算法
00424089 mov eax,dword ptr ds:[42D14C]
0042408E lea ecx,dword ptr ss:[ebp-34]
00424091 mov dword ptr ss:[ebp-9C],eax ; 3dcityrace
00424097 lea edx,dword ptr ss:[ebp-A4]
0042409D push ecx
0042409E lea eax,dword ptr ss:[ebp-44]
004240A1 mov ebx,8
004240A6 push edx
004240A7 push eax
004240A8 mov dword ptr ss:[ebp-A4],ebx
004240AE call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
004240B4 push eax
004240B5 call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
004240BB mov edi,dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaStrMove
004240C1 mov edx,eax ; 机器码与固定字符串3dcityrace连接后指向EDX
004240C3 lea ecx,dword ptr ss:[ebp-18]
004240C6 call edi
004240C8 lea ecx,dword ptr ss:[ebp-18]
004240CB push ecx
004240CC call 3D都市飞.00429600 ; md5运算
004240D1 mov edx,eax ; 结果保存到edx
004240D3 lea ecx,dword ptr ss:[ebp-20]
004240D6 call edi
004240D8 mov eax,dword ptr ss:[ebp-20]
004240DB lea edx,dword ptr ss:[ebp-54]
004240DE mov dword ptr ss:[ebp-4C],eax
004240E1 push 10
004240E3 lea eax,dword ptr ss:[ebp-64]
004240E6 push edx
004240E7 push eax
004240E8 mov dword ptr ss:[ebp-20],0
004240EF mov dword ptr ss:[ebp-54],ebx
004240F2 call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar /// 取前面16位
即为注册码
004240F8 mov ecx,dword ptr ds:[esi]
004240FA push esi
004240FB call dword ptr ds:[ecx+30C]
00424101 lea edx,dword ptr ss:[ebp-24]
00424104 push eax
00424105 push edx
00424106 call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
0042410C mov ecx,dword ptr ds:[eax]
0042410E lea edx,dword ptr ss:[ebp-1C]
00424111 push edx
00424112 push eax
00424113 mov dword ptr ss:[ebp-D0],eax
00424119 call dword ptr ds:[ecx+A0]
0042411F test eax,eax
00424121 fclex
00424123 jge short 3D都市飞.0042413D
00424125 mov ecx,dword ptr ss:[ebp-D0]
0042412B push 0A0
00424130 push 3D都市飞.0040874C
00424135 push ecx
00424136 push eax
00424137 call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042413D mov eax,dword ptr ss:[ebp-1C] ;
00424140 lea edx,dword ptr ss:[ebp-74]
00424143 mov dword ptr ss:[ebp-6C],eax
00424146 lea eax,dword ptr ss:[ebp-84]
0042414C push edx
0042414D push eax
0042414E mov dword ptr ss:[ebp-1C],0
00424155 mov dword ptr ss:[ebp-74],ebx
00424158 call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
0042415E lea ecx,dword ptr ss:[ebp-64]
00424161 lea edx,dword ptr ss:[ebp-84]
00424167 push ecx
00424168 push edx
00424169 call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarTstEq
0042416F mov word ptr ss:[ebp-D8],ax
00424176 lea eax,dword ptr ss:[ebp-20]
00424179 lea ecx,dword ptr ss:[ebp-18]
0042417C push eax
0042417D push ecx
0042417E push 2
00424180 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
00424186 add esp,0C
00424189 lea ecx,dword ptr ss:[ebp-24]
0042418C call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424192 lea edx,dword ptr ss:[ebp-84]
00424198 lea eax,dword ptr ss:[ebp-64]
0042419B push edx
0042419C lea ecx,dword ptr ss:[ebp-74]
0042419F push eax
004241A0 lea edx,dword ptr ss:[ebp-54]
004241A3 push ecx
004241A4 lea eax,dword ptr ss:[ebp-44]
004241A7 push edx
004241A8 lea ecx,dword ptr ss:[ebp-34]
004241AB push eax
004241AC push ecx
004241AD push 6
004241AF call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004241B5 add esp,1C
004241B8 cmp word ptr ss:[ebp-D8],0
004241C0 je 3D都市飞.0042428D
004241C6 mov edx,dword ptr ds:[esi]
004241C8 push esi
004241C9 call dword ptr ds:[edx+30C]
004241CF push eax
004241D0 lea eax,dword ptr ss:[ebp-24]
004241D3 push eax
004241D4 call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
004241DA mov ecx,dword ptr ds:[eax]
004241DC lea edx,dword ptr ss:[ebp-18]
004241DF push edx
004241E0 push eax
004241E1 mov dword ptr ss:[ebp-D0],eax
004241E7 call dword ptr ds:[ecx+A0]
004241ED test eax,eax
004241EF fclex
004241F1 jge short 3D都市飞.0042420B
004241F3 mov ecx,dword ptr ss:[ebp-D0]
004241F9 push 0A0
004241FE push 3D都市飞.0040874C
00424203 push ecx
00424204 push eax
00424205 call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042420B mov eax,dword ptr ss:[ebp-18]
0042420E lea edx,dword ptr ss:[ebp-34]
00424211 mov dword ptr ss:[ebp-2C],eax
00424214 lea eax,dword ptr ss:[ebp-44]
00424217 push edx
00424218 push eax
00424219 mov dword ptr ss:[ebp-18],0
00424220 mov dword ptr ss:[ebp-34],ebx
00424223 call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424229 lea ecx,dword ptr ss:[ebp-44]
0042422C push ecx
0042422D call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
00424233 mov edx,eax
00424235 lea ecx,dword ptr ss:[ebp-1C]
00424238 call edi
0042423A mov edx,dword ptr ds:[esi]
0042423C lea eax,dword ptr ss:[ebp-1C]
0042423F push eax
00424240 push esi
00424241 call dword ptr ds:[edx+6FC]
00424247 test eax,eax
00424249 jge short 3D都市飞.0042425D
0042424B push 6FC
00424250 push 3D都市飞.00408238
00424255 push esi
00424256 push eax
00424257 call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042425D lea ecx,dword ptr ss:[ebp-1C]
00424260 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
00424266 lea ecx,dword ptr ss:[ebp-24]
00424269 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
0042426F lea ecx,dword ptr ss:[ebp-44]
00424272 lea edx,dword ptr ss:[ebp-34]
00424275 push ecx
00424276 push edx
00424277 push 2
00424279 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
0042427F add esp,0C
00424282 call dword ptr ds:[<&MSVBVM60.__vbaE>; MSVBVM60.__vbaEnd
00424288 jmp 3D都市飞.00424BFE
0042428D lea eax,dword ptr ss:[ebp-34]
00424290 push eax
00424291 call 3D都市飞.00428DE0
00424296 lea ecx,dword ptr ss:[ebp-34]
00424299 lea edx,dword ptr ss:[ebp-A4]
0042429F push ecx
004242A0 lea eax,dword ptr ss:[ebp-44]
004242A3 push edx
004242A4 push eax
004242A5 mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "free"
004242AF mov dword ptr ss:[ebp-A4],ebx
004242B5 call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
004242BB push eax
004242BC call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
004242C2 mov edx,eax ; 机器码与固定字符串free连接后指向EDX
004242C4 lea ecx,dword ptr ss:[ebp-18]
004242C7 call edi
004242C9 lea ecx,dword ptr ss:[ebp-18]
004242CC push ecx
004242CD call 3D都市飞.00429600 ; md5运算
004242D2 mov edx,eax ; 结果保存到edx
004242D4 lea ecx,dword ptr ss:[ebp-20]
004242D7 call edi
004242D9 mov eax,dword ptr ss:[ebp-20]
004242DC lea edx,dword ptr ss:[ebp-54]
004242DF mov dword ptr ss:[ebp-4C],eax
004242E2 push 10
004242E4 lea eax,dword ptr ss:[ebp-64]
004242E7 push edx
004242E8 push eax
004242E9 mov dword ptr ss:[ebp-20],0
004242F0 mov dword ptr ss:[ebp-54],ebx
004242F3 call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar /// 取前面16位即
为注册码
004242F9 mov ecx,dword ptr ds:[esi]
004242FB push esi
004242FC call dword ptr ds:[ecx+30C]
00424302 lea edx,dword ptr ss:[ebp-24]
00424305 push eax
00424306 push edx
00424307 call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
0042430D mov ecx,dword ptr ds:[eax]
0042430F lea edx,dword ptr ss:[ebp-1C]
00424312 push edx
00424313 push eax
00424314 mov dword ptr ss:[ebp-D0],eax
0042431A call dword ptr ds:[ecx+A0]
00424320 test eax,eax
00424322 fclex
00424324 jge short 3D都市飞.0042433E
00424326 mov ecx,dword ptr ss:[ebp-D0]
0042432C push 0A0
00424331 push 3D都市飞.0040874C
00424336 push ecx
00424337 push eax
00424338 call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042433E mov eax,dword ptr ss:[ebp-1C]
00424341 lea edx,dword ptr ss:[ebp-74]
00424344 mov dword ptr ss:[ebp-6C],eax
00424347 lea eax,dword ptr ss:[ebp-84]
0042434D push edx
0042434E push eax
0042434F mov dword ptr ss:[ebp-1C],0
00424356 mov dword ptr ss:[ebp-74],ebx
00424359 call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
0042435F lea ecx,dword ptr ss:[ebp-64]
00424362 lea edx,dword ptr ss:[ebp-84]
00424368 push ecx
00424369 push edx
0042436A call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarTstEq
00424370 mov word ptr ss:[ebp-D8],ax
00424377 lea eax,dword ptr ss:[ebp-20]
0042437A lea ecx,dword ptr ss:[ebp-18]
0042437D push eax
0042437E push ecx
0042437F push 2
00424381 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
00424387 add esp,0C
0042438A lea ecx,dword ptr ss:[ebp-24]
0042438D call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424393 lea edx,dword ptr ss:[ebp-84]
00424399 lea eax,dword ptr ss:[ebp-64]
0042439C push edx
0042439D lea ecx,dword ptr ss:[ebp-74]
004243A0 push eax
004243A1 lea edx,dword ptr ss:[ebp-54]
004243A4 push ecx
004243A5 lea eax,dword ptr ss:[ebp-44]
004243A8 push edx
004243A9 lea ecx,dword ptr ss:[ebp-34]
004243AC push eax
004243AD push ecx
004243AE push 6
004243B0 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004243B6 add esp,1C
004243B9 cmp word ptr ss:[ebp-D8],0
004243C1 je 3D都市飞.004244C4
004243C7 mov edx,dword ptr ds:[esi]
004243C9 push esi
004243CA call dword ptr ds:[edx+30C]
004243D0 push eax
004243D1 lea eax,dword ptr ss:[ebp-24]
004243D4 push eax
004243D5 call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
004243DB mov ecx,dword ptr ds:[eax]
004243DD lea edx,dword ptr ss:[ebp-18]
004243E0 push edx
004243E1 push eax
004243E2 mov dword ptr ss:[ebp-D0],eax
004243E8 call dword ptr ds:[ecx+A0]
004243EE test eax,eax
004243F0 fclex
004243F2 jge short 3D都市飞.0042440C
004243F4 mov ecx,dword ptr ss:[ebp-D0]
004243FA push 0A0
004243FF push 3D都市飞.0040874C
00424404 push ecx
00424405 push eax
00424406 call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042440C mov eax,dword ptr ss:[ebp-18]
0042440F lea edx,dword ptr ss:[ebp-34]
00424412 mov dword ptr ss:[ebp-2C],eax
00424415 lea eax,dword ptr ss:[ebp-44]
00424418 push edx
00424419 push eax
0042441A mov dword ptr ss:[ebp-18],0
00424421 mov dword ptr ss:[ebp-34],ebx
00424424 call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
0042442A lea ecx,dword ptr ss:[ebp-44]
0042442D push ecx
0042442E call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
00424434 mov edx,eax
00424436 lea ecx,dword ptr ss:[ebp-1C]
00424439 call edi
0042443B mov edx,dword ptr ds:[esi]
0042443D lea eax,dword ptr ss:[ebp-1C]
00424440 push eax
00424441 push esi
00424442 call dword ptr ds:[edx+6FC]
00424448 test eax,eax
0042444A jge short 3D都市飞.0042445E
0042444C push 6FC
00424451 push 3D都市飞.00408238
00424456 push esi
00424457 push eax
00424458 call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042445E lea ecx,dword ptr ss:[ebp-1C]
00424461 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
00424467 lea ecx,dword ptr ss:[ebp-24]
0042446A call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424470 lea ecx,dword ptr ss:[ebp-44]
00424473 lea edx,dword ptr ss:[ebp-34]
00424476 push ecx
00424477 push edx
00424478 push 2
0042447A call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
00424480 add esp,0C
00424483 lea edx,dword ptr ss:[ebp-A4]
00424489 lea ecx,dword ptr ss:[ebp-34]
0042448C mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "updatenet.exe 1"
00424496 mov dword ptr ss:[ebp-A4],ebx
0042449C call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarDup
004244A2 lea eax,dword ptr ss:[ebp-34]
004244A5 push 0
004244A7 push eax
004244A8 call dword ptr ds:[<&MSVBVM60.#600>] ; MSVBVM60.rtcShell
004244AE lea ecx,dword ptr ss:[ebp-34]
004244B1 fstp st
004244B3 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVar
004244B9 call dword ptr ds:[<&MSVBVM60.__vbaE>; MSVBVM60.__vbaEnd
004244BF jmp 3D都市飞.00424BFE
004244C4 lea ecx,dword ptr ss:[ebp-34]
004244C7 push ecx
004244C8 call 3D都市飞.00428DE0
004244CD lea edx,dword ptr ss:[ebp-34]
004244D0 lea eax,dword ptr ss:[ebp-A4]
004244D6 push edx
004244D7 lea ecx,dword ptr ss:[ebp-44]
004244DA push eax
004244DB push ecx
004244DC mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "register"
004244E6 mov dword ptr ss:[ebp-A4],ebx
004244EC call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
004244F2 push eax
004244F3 call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
004244F9 mov edx,eax ; 机器码与固定字符串register连接后指向EDX
004244FB lea ecx,dword ptr ss:[ebp-18]
004244FE call edi
00424500 lea edx,dword ptr ss:[ebp-18]
00424503 push edx
00424504 call 3D都市飞.00429600 ; md5运算
00424509 mov edx,eax ; 结果保存到edx
0042450B lea ecx,dword ptr ss:[ebp-20]
0042450E call edi
00424510 mov eax,dword ptr ss:[ebp-20]
00424513 push 10
00424515 mov dword ptr ss:[ebp-4C],eax
00424518 lea eax,dword ptr ss:[ebp-54]
0042451B lea ecx,dword ptr ss:[ebp-64]
0042451E push eax
0042451F push ecx
00424520 mov dword ptr ss:[ebp-20],0
00424527 mov dword ptr ss:[ebp-54],ebx
0042452A call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar /// 取前面16位即
为注册码
00424530 mov edx,dword ptr ds:[esi]
00424532 push esi
00424533 call dword ptr ds:[edx+30C]
00424539 push eax
0042453A lea eax,dword ptr ss:[ebp-24]
0042453D push eax
0042453E call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
00424544 mov ecx,dword ptr ds:[eax]
00424546 lea edx,dword ptr ss:[ebp-1C]
00424549 push edx
0042454A push eax
0042454B mov dword ptr ss:[ebp-D0],eax
00424551 call dword ptr ds:[ecx+A0]
00424557 test eax,eax
00424559 fclex
0042455B jge short 3D都市飞.00424575
0042455D mov ecx,dword ptr ss:[ebp-D0]
00424563 push 0A0
00424568 push 3D都市飞.0040874C
0042456D push ecx
0042456E push eax
0042456F call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
00424575 mov eax,dword ptr ss:[ebp-1C]
00424578 lea edx,dword ptr ss:[ebp-74]
0042457B mov dword ptr ss:[ebp-6C],eax
0042457E lea eax,dword ptr ss:[ebp-84]
00424584 push edx
00424585 push eax
00424586 mov dword ptr ss:[ebp-1C],0
0042458D mov dword ptr ss:[ebp-74],ebx
00424590 call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424596 lea ecx,dword ptr ss:[ebp-64]
00424599 lea edx,dword ptr ss:[ebp-84]
0042459F push ecx
004245A0 push edx
004245A1 call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarTstEq
004245A7 mov word ptr ss:[ebp-D8],ax
004245AE lea eax,dword ptr ss:[ebp-20]
004245B1 lea ecx,dword ptr ss:[ebp-18]
004245B4 push eax
004245B5 push ecx
004245B6 push 2
004245B8 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
004245BE add esp,0C
004245C1 lea ecx,dword ptr ss:[ebp-24]
004245C4 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
004245CA lea edx,dword ptr ss:[ebp-84]
004245D0 lea eax,dword ptr ss:[ebp-64]
004245D3 push edx
004245D4 lea ecx,dword ptr ss:[ebp-74]
004245D7 push eax
004245D8 lea edx,dword ptr ss:[ebp-54]
004245DB push ecx
004245DC lea eax,dword ptr ss:[ebp-44]
004245DF push edx
004245E0 lea ecx,dword ptr ss:[ebp-34]
004245E3 push eax
004245E4 push ecx
004245E5 push 6
004245E7 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004245ED add esp,1C
004245F0 cmp word ptr ss:[ebp-D8],0
004245F8 je 3D都市飞.004246FB
004245FE mov edx,dword ptr ds:[esi]
00424600 push esi
00424601 call dword ptr ds:[edx+30C]
00424607 push eax
00424608 lea eax,dword ptr ss:[ebp-24]
0042460B push eax
0042460C call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
00424612 mov ecx,dword ptr ds:[eax]
00424614 lea edx,dword ptr ss:[ebp-18]
00424617 push edx
00424618 push eax
00424619 mov dword ptr ss:[ebp-D0],eax
0042461F call dword ptr ds:[ecx+A0]
00424625 test eax,eax
00424627 fclex
00424629 jge short 3D都市飞.00424643
0042462B mov ecx,dword ptr ss:[ebp-D0]
00424631 push 0A0
00424636 push 3D都市飞.0040874C
0042463B push ecx
0042463C push eax
0042463D call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
00424643 mov eax,dword ptr ss:[ebp-18]
00424646 lea edx,dword ptr ss:[ebp-34]
00424649 mov dword ptr ss:[ebp-2C],eax
0042464C lea eax,dword ptr ss:[ebp-44]
0042464F push edx
00424650 push eax
00424651 mov dword ptr ss:[ebp-18],0
00424658 mov dword ptr ss:[ebp-34],ebx
0042465B call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424661 lea ecx,dword ptr ss:[ebp-44]
00424664 push ecx
00424665 call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
0042466B mov edx,eax
0042466D lea ecx,dword ptr ss:[ebp-1C]
00424670 call edi
00424672 mov edx,dword ptr ds:[esi]
00424674 lea eax,dword ptr ss:[ebp-1C]
00424677 push eax
00424678 push esi
00424679 call dword ptr ds:[edx+6FC]
0042467F test eax,eax
00424681 jge short 3D都市飞.00424695
00424683 push 6FC
00424688 push 3D都市飞.00408238
0042468D push esi
0042468E push eax
0042468F call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
00424695 lea ecx,dword ptr ss:[ebp-1C]
00424698 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
0042469E lea ecx,dword ptr ss:[ebp-24]
004246A1 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
004246A7 lea ecx,dword ptr ss:[ebp-44]
004246AA lea edx,dword ptr ss:[ebp-34]
004246AD push ecx
004246AE push edx
004246AF push 2
004246B1 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004246B7 add esp,0C
004246BA lea edx,dword ptr ss:[ebp-A4]
004246C0 lea ecx,dword ptr ss:[ebp-34]
004246C3 mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "updatenet.exe 2"
004246CD mov dword ptr ss:[ebp-A4],ebx
004246D3 call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarDup
004246D9 lea eax,dword ptr ss:[ebp-34]
004246DC push 0
004246DE push eax
004246DF call dword ptr ds:[<&MSVBVM60.#600>] ; MSVBVM60.rtcShell
004246E5 lea ecx,dword ptr ss:[ebp-34]
004246E8 fstp st
004246EA call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVar
004246F0 call dword ptr ds:[<&MSVBVM60.__vbaE>; MSVBVM60.__vbaEnd
004246F6 jmp 3D都市飞.00424BFE
004246FB lea ecx,dword ptr ss:[ebp-34]
004246FE push ecx
004246FF call 3D都市飞.00428DE0
00424704 lea edx,dword ptr ss:[ebp-34]
00424707 lea eax,dword ptr ss:[ebp-A4]
0042470D push edx
0042470E lea ecx,dword ptr ss:[ebp-44]
00424711 push eax
00424712 push ecx
00424713 mov dword ptr ss:[ebp-9C],3D都市飞.0040>
0042471D mov dword ptr ss:[ebp-A4],ebx
00424723 call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
00424729 push eax
0042472A call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
00424730 mov edx,eax ; 机器码与固定字符串3连接后指向EDX
00424732 lea ecx,dword ptr ss:[ebp-18]
00424735 call edi
00424737 lea edx,dword ptr ss:[ebp-18]
0042473A push edx
0042473B call 3D都市飞.00429600 ; md5运算
00424740 mov edx,eax ; 结果保存到edx
00424742 lea ecx,dword ptr ss:[ebp-20]
00424745 call edi
00424747 mov eax,dword ptr ss:[ebp-20]
0042474A push 10
0042474C mov dword ptr ss:[ebp-4C],eax
0042474F lea eax,dword ptr ss:[ebp-54]
00424752 lea ecx,dword ptr ss:[ebp-64]
00424755 push eax
00424756 push ecx
00424757 mov dword ptr ss:[ebp-20],0
0042475E mov dword ptr ss:[ebp-54],ebx
00424761 call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar /// 取前面16位即
为注册码
00424767 mov edx,dword ptr ds:[esi]
00424769 push esi
0042476A call dword ptr ds:[edx+30C]
00424770 push eax
00424771 lea eax,dword ptr ss:[ebp-24]
00424774 push eax
00424775 call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
0042477B mov ecx,dword ptr ds:[eax]
0042477D lea edx,dword ptr ss:[ebp-1C]
00424780 push edx
00424781 push eax
00424782 mov dword ptr ss:[ebp-D0],eax
00424788 call dword ptr ds:[ecx+A0]
0042478E test eax,eax
00424790 fclex
00424792 jge short 3D都市飞.004247AC
00424794 mov ecx,dword ptr ss:[ebp-D0]
0042479A push 0A0
0042479F push 3D都市飞.0040874C
004247A4 push ecx
004247A5 push eax
004247A6 call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
004247AC mov eax,dword ptr ss:[ebp-1C]
004247AF lea edx,dword ptr ss:[ebp-74]
004247B2 mov dword ptr ss:[ebp-6C],eax
004247B5 lea eax,dword ptr ss:[ebp-84]
004247BB push edx
004247BC push eax
004247BD mov dword ptr ss:[ebp-1C],0
004247C4 mov dword ptr ss:[ebp-74],ebx
004247C7 call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
004247CD lea ecx,dword ptr ss:[ebp-64]
004247D0 lea edx,dword ptr ss:[ebp-84]
004247D6 push ecx
004247D7 push edx
004247D8 call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarTstEq
004247DE mov word ptr ss:[ebp-D8],ax
004247E5 lea eax,dword ptr ss:[ebp-20]
004247E8 lea ecx,dword ptr ss:[ebp-18]
004247EB push eax
004247EC push ecx
004247ED push 2
004247EF call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
004247F5 add esp,0C
004247F8 lea ecx,dword ptr ss:[ebp-24]
004247FB call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424801 lea edx,dword ptr ss:[ebp-84]
00424807 lea eax,dword ptr ss:[ebp-64]
0042480A push edx
0042480B lea ecx,dword ptr ss:[ebp-74]
0042480E push eax
0042480F lea edx,dword ptr ss:[ebp-54]
00424812 push ecx
00424813 lea eax,dword ptr ss:[ebp-44]
00424816 push edx
00424817 lea ecx,dword ptr ss:[ebp-34]
0042481A push eax
0042481B push ecx
0042481C push 6
0042481E call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
00424824 add esp,1C
00424827 cmp word ptr ss:[ebp-D8],0
0042482F je 3D都市飞.00424932
00424835 mov edx,dword ptr ds:[esi]
00424837 push esi
00424838 call dword ptr ds:[edx+30C]
0042483E push eax
0042483F lea eax,dword ptr ss:[ebp-24]
00424842 push eax
00424843 call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
00424849 mov ecx,dword ptr ds:[eax]
0042484B lea edx,dword ptr ss:[ebp-18]
0042484E push edx
0042484F push eax
00424850 mov dword ptr ss:[ebp-D0],eax
00424856 call dword ptr ds:[ecx+A0]
0042485C test eax,eax
0042485E fclex
00424860 jge short 3D都市飞.0042487A
00424862 mov ecx,dword ptr ss:[ebp-D0]
00424868 push 0A0
0042486D push 3D都市飞.0040874C
00424872 push ecx
00424873 push eax
00424874 call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042487A mov eax,dword ptr ss:[ebp-18]
0042487D lea edx,dword ptr ss:[ebp-34]
00424880 mov dword ptr ss:[ebp-2C],eax
00424883 lea eax,dword ptr ss:[ebp-44]
00424886 push edx
00424887 push eax
00424888 mov dword ptr ss:[ebp-18],0
0042488F mov dword ptr ss:[ebp-34],ebx
00424892 call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424898 lea ecx,dword ptr ss:[ebp-44]
0042489B push ecx
0042489C call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
004248A2 mov edx,eax
004248A4 lea ecx,dword ptr ss:[ebp-1C]
004248A7 call edi
004248A9 mov edx,dword ptr ds:[esi]
004248AB lea eax,dword ptr ss:[ebp-1C]
004248AE push eax
004248AF push esi
004248B0 call dword ptr ds:[edx+6FC]
004248B6 test eax,eax
004248B8 jge short 3D都市飞.004248CC
004248BA push 6FC
004248BF push 3D都市飞.00408238
004248C4 push esi
004248C5 push eax
004248C6 call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
004248CC lea ecx,dword ptr ss:[ebp-1C]
004248CF call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
004248D5 lea ecx,dword ptr ss:[ebp-24]
004248D8 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
004248DE lea ecx,dword ptr ss:[ebp-44]
004248E1 lea edx,dword ptr ss:[ebp-34]
004248E4 push ecx
004248E5 push edx
004248E6 push 2
004248E8 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004248EE add esp,0C
004248F1 lea edx,dword ptr ss:[ebp-A4]
004248F7 lea ecx,dword ptr ss:[ebp-34]
004248FA mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "updatenet.exe 3"
00424904 mov dword ptr ss:[ebp-A4],ebx
0042490A call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarDup
00424910 lea eax,dword ptr ss:[ebp-34]
00424913 push 0
00424915 push eax
00424916 call dword ptr ds:[<&MSVBVM60.#600>] ; MSVBVM60.rtcShell
0042491C lea ecx,dword ptr ss:[ebp-34]
0042491F fstp st
00424921 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVar
00424927 call dword ptr ds:[<&MSVBVM60.__vbaE>; MSVBVM60.__vbaEnd
0042492D jmp 3D都市飞.00424BFE
00424932 lea ecx,dword ptr ss:[ebp-34]
00424935 push ecx
00424936 call 3D都市飞.00428DE0
0042493B lea edx,dword ptr ss:[ebp-34]
0042493E lea eax,dword ptr ss:[ebp-A4]
00424944 push edx
00424945 lea ecx,dword ptr ss:[ebp-44]
00424948 push eax
00424949 push ecx
0042494A mov dword ptr ss:[ebp-9C],3D都市飞.0040>
00424954 mov dword ptr ss:[ebp-A4],ebx
0042495A call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
00424960 push eax
00424961 call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
00424967 mov edx,eax ; 机器码与固定字符串4连接后指向EDX
00424969 lea ecx,dword ptr ss:[ebp-18]
0042496C call edi
0042496E lea edx,dword ptr ss:[ebp-18]
00424971 push edx
00424972 call 3D都市飞.00429600 ; md5运算
00424977 mov edx,eax ; 结果保存到edx
00424979 lea ecx,dword ptr ss:[ebp-20]
0042497C call edi
0042497E mov eax,dword ptr ss:[ebp-20]
00424981 push 10
00424983 mov dword ptr ss:[ebp-4C],eax
00424986 lea eax,dword ptr ss:[ebp-54]
00424989 lea ecx,dword ptr ss:[ebp-64]
0042498C push eax
0042498D push ecx
0042498E mov dword ptr ss:[ebp-20],0
00424995 mov dword ptr ss:[ebp-54],ebx
00424998 call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar /// 取前面16位
即为注册码
0042499E mov edx,dword ptr ds:[esi]
004249A0 push esi
004249A1 call dword ptr ds:[edx+30C]
004249A7 push eax
004249A8 lea eax,dword ptr ss:[ebp-24]
004249AB push eax
004249AC call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
004249B2 mov ecx,dword ptr ds:[eax]
004249B4 lea edx,dword ptr ss:[ebp-1C]
004249B7 push edx
004249B8 push eax
004249B9 mov dword ptr ss:[ebp-D0],eax
004249BF call dword ptr ds:[ecx+A0]
004249C5 test eax,eax
004249C7 fclex
004249C9 jge short 3D都市飞.004249E3
004249CB mov ecx,dword ptr ss:[ebp-D0]
004249D1 push 0A0
004249D6 push 3D都市飞.0040874C
004249DB push ecx
004249DC push eax
004249DD call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
004249E3 mov eax,dword ptr ss:[ebp-1C]
004249E6 lea edx,dword ptr ss:[ebp-74]
004249E9 mov dword ptr ss:[ebp-6C],eax
004249EC lea eax,dword ptr ss:[ebp-84]
004249F2 push edx
004249F3 push eax
004249F4 mov dword ptr ss:[ebp-1C],0
004249FB mov dword ptr ss:[ebp-74],ebx
004249FE call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424A04 lea ecx,dword ptr ss:[ebp-64]
00424A07 lea edx,dword ptr ss:[ebp-84]
00424A0D push ecx
00424A0E push edx
00424A0F call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarTstEq
00424A15 mov word ptr ss:[ebp-D8],ax
00424A1C lea eax,dword ptr ss:[ebp-20]
00424A1F lea ecx,dword ptr ss:[ebp-18]
00424A22 push eax
00424A23 push ecx
00424A24 push 2
00424A26 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
00424A2C add esp,0C
00424A2F lea ecx,dword ptr ss:[ebp-24]
00424A32 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424A38 lea edx,dword ptr ss:[ebp-84]
00424A3E lea eax,dword ptr ss:[ebp-64]
00424A41 push edx
00424A42 lea ecx,dword ptr ss:[ebp-74]
00424A45 push eax
00424A46 lea edx,dword ptr ss:[ebp-54]
00424A49 push ecx
00424A4A lea eax,dword ptr ss:[ebp-44]
00424A4D push edx
00424A4E lea ecx,dword ptr ss:[ebp-34]
00424A51 push eax
00424A52 push ecx
00424A53 push 6
00424A55 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
00424A5B add esp,1C
00424A5E cmp word ptr ss:[ebp-D8],0
00424A66 je 3D都市飞.00424B69
00424A6C mov edx,dword ptr ds:[esi]
00424A6E push esi
00424A6F call dword ptr ds:[edx+30C]
00424A75 push eax
00424A76 lea eax,dword ptr ss:[ebp-24]
00424A79 push eax
00424A7A call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
00424A80 mov ecx,dword ptr ds:[eax]
00424A82 lea edx,dword ptr ss:[ebp-18]
00424A85 push edx
00424A86 push eax
00424A87 mov dword ptr ss:[ebp-D0],eax
00424A8D call dword ptr ds:[ecx+A0]
00424A93 test eax,eax
00424A95 fclex
00424A97 jge short 3D都市飞.00424AB1
00424A99 mov ecx,dword ptr ss:[ebp-D0]
00424A9F push 0A0
00424AA4 push 3D都市飞.0040874C
00424AA9 push ecx
00424AAA push eax
00424AAB call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
00424AB1 mov eax,dword ptr ss:[ebp-18]
00424AB4 lea edx,dword ptr ss:[ebp-34]
00424AB7 mov dword ptr ss:[ebp-2C],eax
00424ABA lea eax,dword ptr ss:[ebp-44]
00424ABD push edx
00424ABE push eax
00424ABF mov dword ptr ss:[ebp-18],0
00424AC6 mov dword ptr ss:[ebp-34],ebx
00424AC9 call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424ACF lea ecx,dword ptr ss:[ebp-44]
00424AD2 push ecx
00424AD3 call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
00424AD9 mov edx,eax
00424ADB lea ecx,dword ptr ss:[ebp-1C]
00424ADE call edi
00424AE0 mov edx,dword ptr ds:[esi]
00424AE2 lea eax,dword ptr ss:[ebp-1C]
00424AE5 push eax
00424AE6 push esi
00424AE7 call dword ptr ds:[edx+6FC]
00424AED test eax,eax
00424AEF jge short 3D都市飞.00424B03
00424AF1 push 6FC
00424AF6 push 3D都市飞.00408238
00424AFB push esi
00424AFC push eax
00424AFD call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
00424B03 lea ecx,dword ptr ss:[ebp-1C]
00424B06 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
00424B0C lea ecx,dword ptr ss:[ebp-24]
00424B0F call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424B15 lea ecx,dword ptr ss:[ebp-44]
00424B18 lea edx,dword ptr ss:[ebp-34]
00424B1B push ecx
00424B1C push edx
00424B1D push 2
00424B1F call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
00424B25 add esp,0C
00424B28 lea edx,dword ptr ss:[ebp-A4]
00424B2E lea ecx,dword ptr ss:[ebp-34]
00424B31 mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "updatenet.exe 4"
00424B3B mov dword ptr ss:[ebp-A4],ebx
00424B41 call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarDup
00424B47 lea eax,dword ptr ss:[ebp-34]
00424B4A push 0
00424B4C push eax
00424B4D call dword ptr ds:[<&MSVBVM60.#600>] ; MSVBVM60.rtcShell
00424B53 lea ecx,dword ptr ss:[ebp-34]
00424B56 fstp st
00424B58 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVar
00424B5E call dword ptr ds:[<&MSVBVM60.__vbaE>; MSVBVM60.__vbaEnd
00424B64 jmp 3D都市飞.00424BFE
00424B69 mov ecx,80020004
00424B6E mov eax,0A
00424B73 mov dword ptr ss:[ebp-5C],ecx
00424B76 mov dword ptr ss:[ebp-4C],ecx
00424B79 mov cx,word ptr ds:[esi+38]
00424B7D push 3D都市飞.00408844
00424B82 push ecx
00424B83 mov dword ptr ss:[ebp-64],eax
00424B86 mov dword ptr ss:[ebp-54],eax
00424B89 call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrI2
00424B8F mov edx,eax
00424B91 lea ecx,dword ptr ss:[ebp-18]
00424B94 call edi
00424B96 push eax
00424B97 call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrCat
00424B9D lea edx,dword ptr ss:[ebp-A4]
00424BA3 lea ecx,dword ptr ss:[ebp-34]
00424BA6 mov dword ptr ss:[ebp-3C],eax
00424BA9 mov dword ptr ss:[ebp-44],ebx
00424BAC mov dword ptr ss:[ebp-9C],3D都市飞.0040>
00424BB6 mov dword ptr ss:[ebp-A4],ebx
00424BBC call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarDup
00424BC2 lea edx,dword ptr ss:[ebp-64]
00424BC5 lea eax,dword ptr ss:[ebp-54]
00424BC8 push edx
00424BC9 lea ecx,dword ptr ss:[ebp-44]
00424BCC push eax
00424BCD push ecx
00424BCE lea edx,dword ptr ss:[ebp-34]
00424BD1 push 0
00424BD3 push edx
00424BD4 call dword ptr ds:[<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox
00424BDA lea ecx,dword ptr ss:[ebp-18] ; 失败
00424BDD call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
////////////////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////
0042929C push eax ; 将硬盘型号压栈
0042929D push ecx ; 将硬盘ID号压栈
0042929E call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrCat
004292A4 mov dword ptr ss:[ebp-78],eax
004292A7 lea edx,dword ptr ss:[ebp-80]
004292AA push 8
004292AC lea eax,dword ptr ss:[ebp-90]
004292B2 push edx
004292B3 push eax
004292B4 mov dword ptr ss:[ebp-80],8
004292BB call dword ptr ds:[<&MSVBVM60.#619>] ; MSVBVM60.rtcRightCharVar
004292C1 lea ecx,dword ptr ss:[ebp-90]
004292C7 push ecx
004292C8 call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
004292CE mov edi,dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaStrMove
004292D4 mov edx,eax
004292D6 lea ecx,dword ptr ss:[ebp-1C]
004292D9 call edi
004292DB lea edx,dword ptr ss:[ebp-90]
004292E1 lea eax,dword ptr ss:[ebp-80]
004292E4 push edx
004292E5 push eax
004292E6 push 2
004292E8 call ebx
004292EA mov ecx,dword ptr ss:[ebp-1C]
004292ED add esp,0C
004292F0 push ecx
004292F1 push 3D都市飞.0040920C ; UNICODE "thgame"
004292F6 call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrCat
004292FC mov edx,eax
004292FE lea ecx,dword ptr ss:[ebp-6C]
00429301 call edi
00429303 lea edx,dword ptr ss:[ebp-6C]
00429306 push edx
00429307 call 3D都市飞.00429600 ; MD5运算
0042930C mov edx,eax ; 得到运算后结果
0042930E lea ecx,dword ptr ss:[ebp-70]
00429311 call edi
00429313 mov eax,dword ptr ss:[ebp-70]
00429316 mov dword ptr ss:[ebp-70],esi
00429319 mov dword ptr ss:[ebp-78],eax
0042931C mov esi,8
00429321 lea eax,dword ptr ss:[ebp-80]
00429324 push esi
00429325 lea ecx,dword ptr ss:[ebp-90]
0042932B push eax
0042932C push ecx
0042932D mov dword ptr ss:[ebp-80],esi
00429330 call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar
00429336 mov edx,dword ptr ss:[ebp-1C]
00429339 lea eax,dword ptr ss:[ebp-90]
0042933F mov dword ptr ss:[ebp-B8],edx
00429345 lea ecx,dword ptr ss:[ebp-C0]
0042934B push eax
0042934C lea edx,dword ptr ss:[ebp-A0]
00429352 push ecx
00429353 push edx
00429354 mov dword ptr ss:[ebp-C0],esi
0042935A call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
00429360 mov edx,eax
00429362 lea ecx,dword ptr ss:[ebp-2C]
00429365 call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarMove
0042936B lea eax,dword ptr ss:[ebp-70]
0042936E lea ecx,dword ptr ss:[ebp-6C]
00429371 push eax
00429372 push ecx
00429373 push 2
00429375 call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
0042937B lea edx,dword ptr ss:[ebp-90]
00429381 lea eax,dword ptr ss:[ebp-80]
00429384 push edx
00429385 push eax
00429386 push 2
00429388 call ebx
0042938A add esp,18
0042938D push 3D都市飞.00429417
00429392 jmp short 3D都市飞.004293D8
00429394 test byte ptr ss:[ebp-4],4
00429398 je short 3D都市飞.004293A3
0042939A lea ecx,dword ptr ss:[ebp-2C]
0042939D call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVar
004293A3 lea ecx,dword ptr ss:[ebp-70]
004293A6 lea edx,dword ptr ss:[ebp-6C]
004293A9 push ecx
004293AA push edx
004293AB push 2
004293AD call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
004293B3 lea eax,dword ptr ss:[ebp-B0]
004293B9 lea ecx,dword ptr ss:[ebp-A0]
004293BF push eax
004293C0 lea edx,dword ptr ss:[ebp-90]
004293C6 push ecx
004293C7 lea eax,dword ptr ss:[ebp-80]
004293CA push edx
004293CB push eax
004293CC push 4
004293CE call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004293D4 add esp,20
004293D7 retn
////////////////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////
算法总结:
机器码算法: 硬盘ID号与固定字符串thgame连接后进行MD5运算,取其前8位,再与硬盘ID号连接,即为机器
码
注册码算法: 这里有五个选择:
1) 通过机器码与固定字符串3dcityrace连接后进行MD5运算后,取其前16位,即为注册码
2) 通过机器码与固定字符串free连接后进行MD5运算后,取其前16位,即为注册码
3) 通过机器码与固定字符串register连接后进行MD5运算后,取其前16位,即为注册码
4) 通过机器码与固定字符串3连接后进行MD5运算后,取其前16位,即为注册码
5) 通过机器码与固定字符串4连接后进行MD5运算后,取其前16位,即为注册码
五种随便选一种都可以注册,注册成功后,在安装目录下生成一个regid文件,删除后又变回未注册状态,可
以再玩一次
--------------------------------------------------------------------------------
【版权声明】 本文纯属技术交流, 转载请注明作者并保持文章的完整, 谢谢!
[课程]FART 脱壳王!加量不加价!FART作者讲授!