[原创]XXXX飞车 1.15 注册算法分析-软件逆向-看雪-安全社区|安全招聘|kanxue.com

[原创]XXXX飞车 1.15 注册算法分析

发表于: 2006-12-20 22:57 4062

[原创]XXXX飞车 1.15 注册算法分析

冷血书生

2006-12-20 22:57

4062

【破解日期】 2006年12月20日
【破解作者】冷血书生
【作者邮箱】 meiyou
【作者主页】 hxxp://www.126.com
【使用工具】 OD
【破解平台】 Win9x/NT/2000/XP
【软件名称】 3D都市飞车 1.15
【下载地址】 http://gx.onlinedown.net/soft/50587.htm
【软件简介】 3D都市飞车是一款在城市街道上的3D赛车游戏，跑起来相当流畅，带有声音效果，可以让

你体验城市飚车的极速快感。游戏的操作，以「LEFT」、「RIGHT」左右方向键控制车辆的左、右转向，

「UP」向上键加速，「DOWN」向下键减速或后退，「ESC」键退出。游戏需要direct 7以上版本支持。

【软件大小】 2675KB
【加壳方式】无
【破解声明】我是一只小菜鸟，偶得一点心得，愿与大家分享：）
--------------------------------------------------------------------------------
【破解内容】


00424084   call 3D都市飞.00428DE0                  ; 机器码算法
00424089   mov eax,dword ptr ds:[42D14C]
0042408E   lea ecx,dword ptr ss:[ebp-34]
00424091   mov dword ptr ss:[ebp-9C],eax           ;  3dcityrace
00424097   lea edx,dword ptr ss:[ebp-A4]
0042409D   push ecx
0042409E   lea eax,dword ptr ss:[ebp-44]
004240A1   mov ebx,8
004240A6   push edx
004240A7   push eax
004240A8   mov dword ptr ss:[ebp-A4],ebx
004240AE   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
004240B4   push eax
004240B5   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
004240BB   mov edi,dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaStrMove
004240C1   mov edx,eax                          ; 机器码与固定字符串3dcityrace连接后指向EDX
004240C3   lea ecx,dword ptr ss:[ebp-18]
004240C6   call edi
004240C8   lea ecx,dword ptr ss:[ebp-18]
004240CB   push ecx
004240CC   call 3D都市飞.00429600                  ; md5运算
004240D1   mov edx,eax                             ; 结果保存到edx
004240D3   lea ecx,dword ptr ss:[ebp-20]
004240D6   call edi
004240D8   mov eax,dword ptr ss:[ebp-20]
004240DB   lea edx,dword ptr ss:[ebp-54]
004240DE   mov dword ptr ss:[ebp-4C],eax
004240E1   push 10
004240E3   lea eax,dword ptr ss:[ebp-64]
004240E6   push edx
004240E7   push eax
004240E8   mov dword ptr ss:[ebp-20],0
004240EF   mov dword ptr ss:[ebp-54],ebx
004240F2   call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar    /// 取前面16位

即为注册码
004240F8   mov ecx,dword ptr ds:[esi]
004240FA   push esi
004240FB   call dword ptr ds:[ecx+30C]
00424101   lea edx,dword ptr ss:[ebp-24]
00424104   push eax
00424105   push edx
00424106   call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
0042410C   mov ecx,dword ptr ds:[eax]
0042410E   lea edx,dword ptr ss:[ebp-1C]
00424111   push edx
00424112   push eax
00424113   mov dword ptr ss:[ebp-D0],eax
00424119   call dword ptr ds:[ecx+A0]
0042411F   test eax,eax
00424121   fclex
00424123   jge short 3D都市飞.0042413D
00424125   mov ecx,dword ptr ss:[ebp-D0]
0042412B   push 0A0
00424130   push 3D都市飞.0040874C
00424135   push ecx
00424136   push eax
00424137   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042413D   mov eax,dword ptr ss:[ebp-1C]        ; 
00424140   lea edx,dword ptr ss:[ebp-74]
00424143   mov dword ptr ss:[ebp-6C],eax
00424146   lea eax,dword ptr ss:[ebp-84]
0042414C   push edx
0042414D   push eax
0042414E   mov dword ptr ss:[ebp-1C],0
00424155   mov dword ptr ss:[ebp-74],ebx
00424158   call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
0042415E   lea ecx,dword ptr ss:[ebp-64]
00424161   lea edx,dword ptr ss:[ebp-84]
00424167   push ecx
00424168   push edx
00424169   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarTstEq
0042416F   mov word ptr ss:[ebp-D8],ax
00424176   lea eax,dword ptr ss:[ebp-20]
00424179   lea ecx,dword ptr ss:[ebp-18]
0042417C   push eax
0042417D   push ecx
0042417E   push 2
00424180   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
00424186   add esp,0C
00424189   lea ecx,dword ptr ss:[ebp-24]
0042418C   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424192   lea edx,dword ptr ss:[ebp-84]
00424198   lea eax,dword ptr ss:[ebp-64]
0042419B   push edx
0042419C   lea ecx,dword ptr ss:[ebp-74]
0042419F   push eax
004241A0   lea edx,dword ptr ss:[ebp-54]
004241A3   push ecx
004241A4   lea eax,dword ptr ss:[ebp-44]
004241A7   push edx
004241A8   lea ecx,dword ptr ss:[ebp-34]
004241AB   push eax
004241AC   push ecx
004241AD   push 6
004241AF   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004241B5   add esp,1C
004241B8   cmp word ptr ss:[ebp-D8],0
004241C0   je 3D都市飞.0042428D
004241C6   mov edx,dword ptr ds:[esi]
004241C8   push esi
004241C9   call dword ptr ds:[edx+30C]
004241CF   push eax
004241D0   lea eax,dword ptr ss:[ebp-24]
004241D3   push eax
004241D4   call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
004241DA   mov ecx,dword ptr ds:[eax]
004241DC   lea edx,dword ptr ss:[ebp-18]
004241DF   push edx
004241E0   push eax
004241E1   mov dword ptr ss:[ebp-D0],eax
004241E7   call dword ptr ds:[ecx+A0]
004241ED   test eax,eax
004241EF   fclex
004241F1   jge short 3D都市飞.0042420B
004241F3   mov ecx,dword ptr ss:[ebp-D0]
004241F9   push 0A0
004241FE   push 3D都市飞.0040874C
00424203   push ecx
00424204   push eax
00424205   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042420B   mov eax,dword ptr ss:[ebp-18]
0042420E   lea edx,dword ptr ss:[ebp-34]
00424211   mov dword ptr ss:[ebp-2C],eax
00424214   lea eax,dword ptr ss:[ebp-44]
00424217   push edx
00424218   push eax
00424219   mov dword ptr ss:[ebp-18],0
00424220   mov dword ptr ss:[ebp-34],ebx
00424223   call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424229   lea ecx,dword ptr ss:[ebp-44]
0042422C   push ecx
0042422D   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
00424233   mov edx,eax
00424235   lea ecx,dword ptr ss:[ebp-1C]
00424238   call edi
0042423A   mov edx,dword ptr ds:[esi]
0042423C   lea eax,dword ptr ss:[ebp-1C]
0042423F   push eax
00424240   push esi
00424241   call dword ptr ds:[edx+6FC]
00424247   test eax,eax
00424249   jge short 3D都市飞.0042425D
0042424B   push 6FC
00424250   push 3D都市飞.00408238
00424255   push esi
00424256   push eax
00424257   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042425D   lea ecx,dword ptr ss:[ebp-1C]
00424260   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
00424266   lea ecx,dword ptr ss:[ebp-24]
00424269   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
0042426F   lea ecx,dword ptr ss:[ebp-44]
00424272   lea edx,dword ptr ss:[ebp-34]
00424275   push ecx
00424276   push edx
00424277   push 2
00424279   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
0042427F   add esp,0C
00424282   call dword ptr ds:[<&MSVBVM60.__vbaE>; MSVBVM60.__vbaEnd
00424288   jmp 3D都市飞.00424BFE
0042428D   lea eax,dword ptr ss:[ebp-34]
00424290   push eax
00424291   call 3D都市飞.00428DE0
00424296   lea ecx,dword ptr ss:[ebp-34]
00424299   lea edx,dword ptr ss:[ebp-A4]
0042429F   push ecx
004242A0   lea eax,dword ptr ss:[ebp-44]
004242A3   push edx
004242A4   push eax
004242A5   mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "free"
004242AF   mov dword ptr ss:[ebp-A4],ebx
004242B5   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
004242BB   push eax
004242BC   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
004242C2   mov edx,eax                          ; 机器码与固定字符串free连接后指向EDX
004242C4   lea ecx,dword ptr ss:[ebp-18]
004242C7   call edi
004242C9   lea ecx,dword ptr ss:[ebp-18]
004242CC   push ecx
004242CD   call 3D都市飞.00429600               ; md5运算
004242D2   mov edx,eax                          ; 结果保存到edx
004242D4   lea ecx,dword ptr ss:[ebp-20]
004242D7   call edi
004242D9   mov eax,dword ptr ss:[ebp-20]
004242DC   lea edx,dword ptr ss:[ebp-54]
004242DF   mov dword ptr ss:[ebp-4C],eax
004242E2   push 10
004242E4   lea eax,dword ptr ss:[ebp-64]
004242E7   push edx
004242E8   push eax
004242E9   mov dword ptr ss:[ebp-20],0
004242F0   mov dword ptr ss:[ebp-54],ebx
004242F3   call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar   /// 取前面16位即

为注册码
004242F9   mov ecx,dword ptr ds:[esi]
004242FB   push esi
004242FC   call dword ptr ds:[ecx+30C]
00424302   lea edx,dword ptr ss:[ebp-24]
00424305   push eax
00424306   push edx
00424307   call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
0042430D   mov ecx,dword ptr ds:[eax]
0042430F   lea edx,dword ptr ss:[ebp-1C]
00424312   push edx
00424313   push eax
00424314   mov dword ptr ss:[ebp-D0],eax
0042431A   call dword ptr ds:[ecx+A0]
00424320   test eax,eax
00424322   fclex
00424324   jge short 3D都市飞.0042433E
00424326   mov ecx,dword ptr ss:[ebp-D0]
0042432C   push 0A0
00424331   push 3D都市飞.0040874C
00424336   push ecx
00424337   push eax
00424338   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042433E   mov eax,dword ptr ss:[ebp-1C]
00424341   lea edx,dword ptr ss:[ebp-74]
00424344   mov dword ptr ss:[ebp-6C],eax
00424347   lea eax,dword ptr ss:[ebp-84]
0042434D   push edx
0042434E   push eax
0042434F   mov dword ptr ss:[ebp-1C],0
00424356   mov dword ptr ss:[ebp-74],ebx
00424359   call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
0042435F   lea ecx,dword ptr ss:[ebp-64]
00424362   lea edx,dword ptr ss:[ebp-84]
00424368   push ecx
00424369   push edx
0042436A   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarTstEq
00424370   mov word ptr ss:[ebp-D8],ax
00424377   lea eax,dword ptr ss:[ebp-20]
0042437A   lea ecx,dword ptr ss:[ebp-18]
0042437D   push eax
0042437E   push ecx
0042437F   push 2
00424381   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
00424387   add esp,0C
0042438A   lea ecx,dword ptr ss:[ebp-24]
0042438D   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424393   lea edx,dword ptr ss:[ebp-84]
00424399   lea eax,dword ptr ss:[ebp-64]
0042439C   push edx
0042439D   lea ecx,dword ptr ss:[ebp-74]
004243A0   push eax
004243A1   lea edx,dword ptr ss:[ebp-54]
004243A4   push ecx
004243A5   lea eax,dword ptr ss:[ebp-44]
004243A8   push edx
004243A9   lea ecx,dword ptr ss:[ebp-34]
004243AC   push eax
004243AD   push ecx
004243AE   push 6
004243B0   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004243B6   add esp,1C
004243B9   cmp word ptr ss:[ebp-D8],0
004243C1   je 3D都市飞.004244C4
004243C7   mov edx,dword ptr ds:[esi]
004243C9   push esi
004243CA   call dword ptr ds:[edx+30C]
004243D0   push eax
004243D1   lea eax,dword ptr ss:[ebp-24]
004243D4   push eax
004243D5   call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
004243DB   mov ecx,dword ptr ds:[eax]
004243DD   lea edx,dword ptr ss:[ebp-18]
004243E0   push edx
004243E1   push eax
004243E2   mov dword ptr ss:[ebp-D0],eax
004243E8   call dword ptr ds:[ecx+A0]
004243EE   test eax,eax
004243F0   fclex
004243F2   jge short 3D都市飞.0042440C
004243F4   mov ecx,dword ptr ss:[ebp-D0]
004243FA   push 0A0
004243FF   push 3D都市飞.0040874C
00424404   push ecx
00424405   push eax
00424406   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042440C   mov eax,dword ptr ss:[ebp-18]
0042440F   lea edx,dword ptr ss:[ebp-34]
00424412   mov dword ptr ss:[ebp-2C],eax
00424415   lea eax,dword ptr ss:[ebp-44]
00424418   push edx
00424419   push eax
0042441A   mov dword ptr ss:[ebp-18],0
00424421   mov dword ptr ss:[ebp-34],ebx
00424424   call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
0042442A   lea ecx,dword ptr ss:[ebp-44]
0042442D   push ecx
0042442E   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
00424434   mov edx,eax
00424436   lea ecx,dword ptr ss:[ebp-1C]
00424439   call edi
0042443B   mov edx,dword ptr ds:[esi]
0042443D   lea eax,dword ptr ss:[ebp-1C]
00424440   push eax
00424441   push esi
00424442   call dword ptr ds:[edx+6FC]
00424448   test eax,eax
0042444A   jge short 3D都市飞.0042445E
0042444C   push 6FC
00424451   push 3D都市飞.00408238
00424456   push esi
00424457   push eax
00424458   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042445E   lea ecx,dword ptr ss:[ebp-1C]
00424461   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
00424467   lea ecx,dword ptr ss:[ebp-24]
0042446A   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424470   lea ecx,dword ptr ss:[ebp-44]
00424473   lea edx,dword ptr ss:[ebp-34]
00424476   push ecx
00424477   push edx
00424478   push 2
0042447A   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
00424480   add esp,0C
00424483   lea edx,dword ptr ss:[ebp-A4]
00424489   lea ecx,dword ptr ss:[ebp-34]
0042448C   mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "updatenet.exe 1"
00424496   mov dword ptr ss:[ebp-A4],ebx
0042449C   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarDup
004244A2   lea eax,dword ptr ss:[ebp-34]
004244A5   push 0
004244A7   push eax
004244A8   call dword ptr ds:[<&MSVBVM60.#600>] ; MSVBVM60.rtcShell
004244AE   lea ecx,dword ptr ss:[ebp-34]
004244B1   fstp st
004244B3   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVar
004244B9   call dword ptr ds:[<&MSVBVM60.__vbaE>; MSVBVM60.__vbaEnd
004244BF   jmp 3D都市飞.00424BFE
004244C4   lea ecx,dword ptr ss:[ebp-34]
004244C7   push ecx
004244C8   call 3D都市飞.00428DE0
004244CD   lea edx,dword ptr ss:[ebp-34]
004244D0   lea eax,dword ptr ss:[ebp-A4]
004244D6   push edx
004244D7   lea ecx,dword ptr ss:[ebp-44]
004244DA   push eax
004244DB   push ecx
004244DC   mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "register"
004244E6   mov dword ptr ss:[ebp-A4],ebx
004244EC   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
004244F2   push eax
004244F3   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
004244F9   mov edx,eax                          ; 机器码与固定字符串register连接后指向EDX
004244FB   lea ecx,dword ptr ss:[ebp-18]
004244FE   call edi
00424500   lea edx,dword ptr ss:[ebp-18]
00424503   push edx
00424504   call 3D都市飞.00429600               ; md5运算
00424509   mov edx,eax                          ; 结果保存到edx
0042450B   lea ecx,dword ptr ss:[ebp-20]
0042450E   call edi
00424510   mov eax,dword ptr ss:[ebp-20]
00424513   push 10
00424515   mov dword ptr ss:[ebp-4C],eax
00424518   lea eax,dword ptr ss:[ebp-54]
0042451B   lea ecx,dword ptr ss:[ebp-64]
0042451E   push eax
0042451F   push ecx
00424520   mov dword ptr ss:[ebp-20],0
00424527   mov dword ptr ss:[ebp-54],ebx
0042452A   call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar   /// 取前面16位即

为注册码
00424530   mov edx,dword ptr ds:[esi]
00424532   push esi
00424533   call dword ptr ds:[edx+30C]
00424539   push eax
0042453A   lea eax,dword ptr ss:[ebp-24]
0042453D   push eax
0042453E   call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
00424544   mov ecx,dword ptr ds:[eax]
00424546   lea edx,dword ptr ss:[ebp-1C]
00424549   push edx
0042454A   push eax
0042454B   mov dword ptr ss:[ebp-D0],eax
00424551   call dword ptr ds:[ecx+A0]
00424557   test eax,eax
00424559   fclex
0042455B   jge short 3D都市飞.00424575
0042455D   mov ecx,dword ptr ss:[ebp-D0]
00424563   push 0A0
00424568   push 3D都市飞.0040874C
0042456D   push ecx
0042456E   push eax
0042456F   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
00424575   mov eax,dword ptr ss:[ebp-1C]
00424578   lea edx,dword ptr ss:[ebp-74]
0042457B   mov dword ptr ss:[ebp-6C],eax
0042457E   lea eax,dword ptr ss:[ebp-84]
00424584   push edx
00424585   push eax
00424586   mov dword ptr ss:[ebp-1C],0
0042458D   mov dword ptr ss:[ebp-74],ebx
00424590   call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424596   lea ecx,dword ptr ss:[ebp-64]
00424599   lea edx,dword ptr ss:[ebp-84]
0042459F   push ecx
004245A0   push edx
004245A1   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarTstEq
004245A7   mov word ptr ss:[ebp-D8],ax
004245AE   lea eax,dword ptr ss:[ebp-20]
004245B1   lea ecx,dword ptr ss:[ebp-18]
004245B4   push eax
004245B5   push ecx
004245B6   push 2
004245B8   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
004245BE   add esp,0C
004245C1   lea ecx,dword ptr ss:[ebp-24]
004245C4   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
004245CA   lea edx,dword ptr ss:[ebp-84]
004245D0   lea eax,dword ptr ss:[ebp-64]
004245D3   push edx
004245D4   lea ecx,dword ptr ss:[ebp-74]
004245D7   push eax
004245D8   lea edx,dword ptr ss:[ebp-54]
004245DB   push ecx
004245DC   lea eax,dword ptr ss:[ebp-44]
004245DF   push edx
004245E0   lea ecx,dword ptr ss:[ebp-34]
004245E3   push eax
004245E4   push ecx
004245E5   push 6
004245E7   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004245ED   add esp,1C
004245F0   cmp word ptr ss:[ebp-D8],0
004245F8   je 3D都市飞.004246FB
004245FE   mov edx,dword ptr ds:[esi]
00424600   push esi
00424601   call dword ptr ds:[edx+30C]
00424607   push eax
00424608   lea eax,dword ptr ss:[ebp-24]
0042460B   push eax
0042460C   call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
00424612   mov ecx,dword ptr ds:[eax]
00424614   lea edx,dword ptr ss:[ebp-18]
00424617   push edx
00424618   push eax
00424619   mov dword ptr ss:[ebp-D0],eax
0042461F   call dword ptr ds:[ecx+A0]
00424625   test eax,eax
00424627   fclex
00424629   jge short 3D都市飞.00424643
0042462B   mov ecx,dword ptr ss:[ebp-D0]
00424631   push 0A0
00424636   push 3D都市飞.0040874C
0042463B   push ecx
0042463C   push eax
0042463D   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
00424643   mov eax,dword ptr ss:[ebp-18]
00424646   lea edx,dword ptr ss:[ebp-34]
00424649   mov dword ptr ss:[ebp-2C],eax
0042464C   lea eax,dword ptr ss:[ebp-44]
0042464F   push edx
00424650   push eax
00424651   mov dword ptr ss:[ebp-18],0
00424658   mov dword ptr ss:[ebp-34],ebx
0042465B   call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424661   lea ecx,dword ptr ss:[ebp-44]
00424664   push ecx
00424665   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
0042466B   mov edx,eax
0042466D   lea ecx,dword ptr ss:[ebp-1C]
00424670   call edi
00424672   mov edx,dword ptr ds:[esi]
00424674   lea eax,dword ptr ss:[ebp-1C]
00424677   push eax
00424678   push esi
00424679   call dword ptr ds:[edx+6FC]
0042467F   test eax,eax
00424681   jge short 3D都市飞.00424695
00424683   push 6FC
00424688   push 3D都市飞.00408238
0042468D   push esi
0042468E   push eax
0042468F   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
00424695   lea ecx,dword ptr ss:[ebp-1C]
00424698   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
0042469E   lea ecx,dword ptr ss:[ebp-24]
004246A1   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
004246A7   lea ecx,dword ptr ss:[ebp-44]
004246AA   lea edx,dword ptr ss:[ebp-34]
004246AD   push ecx
004246AE   push edx
004246AF   push 2
004246B1   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004246B7   add esp,0C
004246BA   lea edx,dword ptr ss:[ebp-A4]
004246C0   lea ecx,dword ptr ss:[ebp-34]
004246C3   mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "updatenet.exe 2"
004246CD   mov dword ptr ss:[ebp-A4],ebx
004246D3   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarDup
004246D9   lea eax,dword ptr ss:[ebp-34]
004246DC   push 0
004246DE   push eax
004246DF   call dword ptr ds:[<&MSVBVM60.#600>] ; MSVBVM60.rtcShell
004246E5   lea ecx,dword ptr ss:[ebp-34]
004246E8   fstp st
004246EA   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVar
004246F0   call dword ptr ds:[<&MSVBVM60.__vbaE>; MSVBVM60.__vbaEnd
004246F6   jmp 3D都市飞.00424BFE
004246FB   lea ecx,dword ptr ss:[ebp-34]
004246FE   push ecx
004246FF   call 3D都市飞.00428DE0
00424704   lea edx,dword ptr ss:[ebp-34]
00424707   lea eax,dword ptr ss:[ebp-A4]
0042470D   push edx
0042470E   lea ecx,dword ptr ss:[ebp-44]
00424711   push eax
00424712   push ecx
00424713   mov dword ptr ss:[ebp-9C],3D都市飞.0040>
0042471D   mov dword ptr ss:[ebp-A4],ebx
00424723   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
00424729   push eax
0042472A   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
00424730   mov edx,eax                          ; 机器码与固定字符串3连接后指向EDX
00424732   lea ecx,dword ptr ss:[ebp-18]
00424735   call edi
00424737   lea edx,dword ptr ss:[ebp-18]
0042473A   push edx
0042473B   call 3D都市飞.00429600               ; md5运算
00424740   mov edx,eax                          ; 结果保存到edx
00424742   lea ecx,dword ptr ss:[ebp-20]
00424745   call edi
00424747   mov eax,dword ptr ss:[ebp-20]
0042474A   push 10
0042474C   mov dword ptr ss:[ebp-4C],eax
0042474F   lea eax,dword ptr ss:[ebp-54]
00424752   lea ecx,dword ptr ss:[ebp-64]
00424755   push eax
00424756   push ecx
00424757   mov dword ptr ss:[ebp-20],0
0042475E   mov dword ptr ss:[ebp-54],ebx
00424761   call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar   /// 取前面16位即

为注册码
00424767   mov edx,dword ptr ds:[esi]
00424769   push esi
0042476A   call dword ptr ds:[edx+30C]
00424770   push eax
00424771   lea eax,dword ptr ss:[ebp-24]
00424774   push eax
00424775   call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
0042477B   mov ecx,dword ptr ds:[eax]
0042477D   lea edx,dword ptr ss:[ebp-1C]
00424780   push edx
00424781   push eax
00424782   mov dword ptr ss:[ebp-D0],eax
00424788   call dword ptr ds:[ecx+A0]
0042478E   test eax,eax
00424790   fclex
00424792   jge short 3D都市飞.004247AC
00424794   mov ecx,dword ptr ss:[ebp-D0]
0042479A   push 0A0
0042479F   push 3D都市飞.0040874C
004247A4   push ecx
004247A5   push eax
004247A6   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
004247AC   mov eax,dword ptr ss:[ebp-1C]
004247AF   lea edx,dword ptr ss:[ebp-74]
004247B2   mov dword ptr ss:[ebp-6C],eax
004247B5   lea eax,dword ptr ss:[ebp-84]
004247BB   push edx
004247BC   push eax
004247BD   mov dword ptr ss:[ebp-1C],0
004247C4   mov dword ptr ss:[ebp-74],ebx
004247C7   call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
004247CD   lea ecx,dword ptr ss:[ebp-64]
004247D0   lea edx,dword ptr ss:[ebp-84]
004247D6   push ecx
004247D7   push edx
004247D8   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarTstEq
004247DE   mov word ptr ss:[ebp-D8],ax
004247E5   lea eax,dword ptr ss:[ebp-20]
004247E8   lea ecx,dword ptr ss:[ebp-18]
004247EB   push eax
004247EC   push ecx
004247ED   push 2
004247EF   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
004247F5   add esp,0C
004247F8   lea ecx,dword ptr ss:[ebp-24]
004247FB   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424801   lea edx,dword ptr ss:[ebp-84]
00424807   lea eax,dword ptr ss:[ebp-64]
0042480A   push edx
0042480B   lea ecx,dword ptr ss:[ebp-74]
0042480E   push eax
0042480F   lea edx,dword ptr ss:[ebp-54]
00424812   push ecx
00424813   lea eax,dword ptr ss:[ebp-44]
00424816   push edx
00424817   lea ecx,dword ptr ss:[ebp-34]
0042481A   push eax
0042481B   push ecx
0042481C   push 6
0042481E   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
00424824   add esp,1C
00424827   cmp word ptr ss:[ebp-D8],0
0042482F   je 3D都市飞.00424932
00424835   mov edx,dword ptr ds:[esi]
00424837   push esi
00424838   call dword ptr ds:[edx+30C]
0042483E   push eax
0042483F   lea eax,dword ptr ss:[ebp-24]
00424842   push eax
00424843   call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
00424849   mov ecx,dword ptr ds:[eax]
0042484B   lea edx,dword ptr ss:[ebp-18]
0042484E   push edx
0042484F   push eax
00424850   mov dword ptr ss:[ebp-D0],eax
00424856   call dword ptr ds:[ecx+A0]
0042485C   test eax,eax
0042485E   fclex
00424860   jge short 3D都市飞.0042487A
00424862   mov ecx,dword ptr ss:[ebp-D0]
00424868   push 0A0
0042486D   push 3D都市飞.0040874C
00424872   push ecx
00424873   push eax
00424874   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
0042487A   mov eax,dword ptr ss:[ebp-18]
0042487D   lea edx,dword ptr ss:[ebp-34]
00424880   mov dword ptr ss:[ebp-2C],eax
00424883   lea eax,dword ptr ss:[ebp-44]
00424886   push edx
00424887   push eax
00424888   mov dword ptr ss:[ebp-18],0
0042488F   mov dword ptr ss:[ebp-34],ebx
00424892   call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424898   lea ecx,dword ptr ss:[ebp-44]
0042489B   push ecx
0042489C   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
004248A2   mov edx,eax
004248A4   lea ecx,dword ptr ss:[ebp-1C]
004248A7   call edi
004248A9   mov edx,dword ptr ds:[esi]
004248AB   lea eax,dword ptr ss:[ebp-1C]
004248AE   push eax
004248AF   push esi
004248B0   call dword ptr ds:[edx+6FC]
004248B6   test eax,eax
004248B8   jge short 3D都市飞.004248CC
004248BA   push 6FC
004248BF   push 3D都市飞.00408238
004248C4   push esi
004248C5   push eax
004248C6   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
004248CC   lea ecx,dword ptr ss:[ebp-1C]
004248CF   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
004248D5   lea ecx,dword ptr ss:[ebp-24]
004248D8   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
004248DE   lea ecx,dword ptr ss:[ebp-44]
004248E1   lea edx,dword ptr ss:[ebp-34]
004248E4   push ecx
004248E5   push edx
004248E6   push 2
004248E8   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004248EE   add esp,0C
004248F1   lea edx,dword ptr ss:[ebp-A4]
004248F7   lea ecx,dword ptr ss:[ebp-34]
004248FA   mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "updatenet.exe 3"
00424904   mov dword ptr ss:[ebp-A4],ebx
0042490A   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarDup
00424910   lea eax,dword ptr ss:[ebp-34]
00424913   push 0
00424915   push eax
00424916   call dword ptr ds:[<&MSVBVM60.#600>] ; MSVBVM60.rtcShell
0042491C   lea ecx,dword ptr ss:[ebp-34]
0042491F   fstp st
00424921   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVar
00424927   call dword ptr ds:[<&MSVBVM60.__vbaE>; MSVBVM60.__vbaEnd
0042492D   jmp 3D都市飞.00424BFE
00424932   lea ecx,dword ptr ss:[ebp-34]
00424935   push ecx
00424936   call 3D都市飞.00428DE0
0042493B   lea edx,dword ptr ss:[ebp-34]
0042493E   lea eax,dword ptr ss:[ebp-A4]
00424944   push edx
00424945   lea ecx,dword ptr ss:[ebp-44]
00424948   push eax
00424949   push ecx
0042494A   mov dword ptr ss:[ebp-9C],3D都市飞.0040>
00424954   mov dword ptr ss:[ebp-A4],ebx
0042495A   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
00424960   push eax
00424961   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
00424967   mov edx,eax                          ; 机器码与固定字符串4连接后指向EDX
00424969   lea ecx,dword ptr ss:[ebp-18]
0042496C   call edi
0042496E   lea edx,dword ptr ss:[ebp-18]
00424971   push edx
00424972   call 3D都市飞.00429600               ; md5运算
00424977   mov edx,eax                          ; 结果保存到edx
00424979   lea ecx,dword ptr ss:[ebp-20]
0042497C   call edi
0042497E   mov eax,dword ptr ss:[ebp-20]
00424981   push 10
00424983   mov dword ptr ss:[ebp-4C],eax
00424986   lea eax,dword ptr ss:[ebp-54]
00424989   lea ecx,dword ptr ss:[ebp-64]
0042498C   push eax
0042498D   push ecx
0042498E   mov dword ptr ss:[ebp-20],0
00424995   mov dword ptr ss:[ebp-54],ebx
00424998   call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar    /// 取前面16位

即为注册码
0042499E   mov edx,dword ptr ds:[esi]
004249A0   push esi
004249A1   call dword ptr ds:[edx+30C]
004249A7   push eax
004249A8   lea eax,dword ptr ss:[ebp-24]
004249AB   push eax
004249AC   call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
004249B2   mov ecx,dword ptr ds:[eax]
004249B4   lea edx,dword ptr ss:[ebp-1C]
004249B7   push edx
004249B8   push eax
004249B9   mov dword ptr ss:[ebp-D0],eax
004249BF   call dword ptr ds:[ecx+A0]
004249C5   test eax,eax
004249C7   fclex
004249C9   jge short 3D都市飞.004249E3
004249CB   mov ecx,dword ptr ss:[ebp-D0]
004249D1   push 0A0
004249D6   push 3D都市飞.0040874C
004249DB   push ecx
004249DC   push eax
004249DD   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
004249E3   mov eax,dword ptr ss:[ebp-1C]
004249E6   lea edx,dword ptr ss:[ebp-74]
004249E9   mov dword ptr ss:[ebp-6C],eax
004249EC   lea eax,dword ptr ss:[ebp-84]
004249F2   push edx
004249F3   push eax
004249F4   mov dword ptr ss:[ebp-1C],0
004249FB   mov dword ptr ss:[ebp-74],ebx
004249FE   call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424A04   lea ecx,dword ptr ss:[ebp-64]
00424A07   lea edx,dword ptr ss:[ebp-84]
00424A0D   push ecx
00424A0E   push edx
00424A0F   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarTstEq
00424A15   mov word ptr ss:[ebp-D8],ax
00424A1C   lea eax,dword ptr ss:[ebp-20]
00424A1F   lea ecx,dword ptr ss:[ebp-18]
00424A22   push eax
00424A23   push ecx
00424A24   push 2
00424A26   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
00424A2C   add esp,0C
00424A2F   lea ecx,dword ptr ss:[ebp-24]
00424A32   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424A38   lea edx,dword ptr ss:[ebp-84]
00424A3E   lea eax,dword ptr ss:[ebp-64]
00424A41   push edx
00424A42   lea ecx,dword ptr ss:[ebp-74]
00424A45   push eax
00424A46   lea edx,dword ptr ss:[ebp-54]
00424A49   push ecx
00424A4A   lea eax,dword ptr ss:[ebp-44]
00424A4D   push edx
00424A4E   lea ecx,dword ptr ss:[ebp-34]
00424A51   push eax
00424A52   push ecx
00424A53   push 6
00424A55   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
00424A5B   add esp,1C
00424A5E   cmp word ptr ss:[ebp-D8],0
00424A66   je 3D都市飞.00424B69
00424A6C   mov edx,dword ptr ds:[esi]
00424A6E   push esi
00424A6F   call dword ptr ds:[edx+30C]
00424A75   push eax
00424A76   lea eax,dword ptr ss:[ebp-24]
00424A79   push eax
00424A7A   call dword ptr ds:[<&MSVBVM60.__vbaO>; MSVBVM60.__vbaObjSet
00424A80   mov ecx,dword ptr ds:[eax]
00424A82   lea edx,dword ptr ss:[ebp-18]
00424A85   push edx
00424A86   push eax
00424A87   mov dword ptr ss:[ebp-D0],eax
00424A8D   call dword ptr ds:[ecx+A0]
00424A93   test eax,eax
00424A95   fclex
00424A97   jge short 3D都市飞.00424AB1
00424A99   mov ecx,dword ptr ss:[ebp-D0]
00424A9F   push 0A0
00424AA4   push 3D都市飞.0040874C
00424AA9   push ecx
00424AAA   push eax
00424AAB   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
00424AB1   mov eax,dword ptr ss:[ebp-18]
00424AB4   lea edx,dword ptr ss:[ebp-34]
00424AB7   mov dword ptr ss:[ebp-2C],eax
00424ABA   lea eax,dword ptr ss:[ebp-44]
00424ABD   push edx
00424ABE   push eax
00424ABF   mov dword ptr ss:[ebp-18],0
00424AC6   mov dword ptr ss:[ebp-34],ebx
00424AC9   call dword ptr ds:[<&MSVBVM60.#520>] ; MSVBVM60.rtcTrimVar
00424ACF   lea ecx,dword ptr ss:[ebp-44]
00424AD2   push ecx
00424AD3   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
00424AD9   mov edx,eax
00424ADB   lea ecx,dword ptr ss:[ebp-1C]
00424ADE   call edi
00424AE0   mov edx,dword ptr ds:[esi]
00424AE2   lea eax,dword ptr ss:[ebp-1C]
00424AE5   push eax
00424AE6   push esi
00424AE7   call dword ptr ds:[edx+6FC]
00424AED   test eax,eax
00424AEF   jge short 3D都市飞.00424B03
00424AF1   push 6FC
00424AF6   push 3D都市飞.00408238
00424AFB   push esi
00424AFC   push eax
00424AFD   call dword ptr ds:[<&MSVBVM60.__vbaH>; MSVBVM60.__vbaHresultCheckObj
00424B03   lea ecx,dword ptr ss:[ebp-1C]
00424B06   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr
00424B0C   lea ecx,dword ptr ss:[ebp-24]
00424B0F   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeObj
00424B15   lea ecx,dword ptr ss:[ebp-44]
00424B18   lea edx,dword ptr ss:[ebp-34]
00424B1B   push ecx
00424B1C   push edx
00424B1D   push 2
00424B1F   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
00424B25   add esp,0C
00424B28   lea edx,dword ptr ss:[ebp-A4]
00424B2E   lea ecx,dword ptr ss:[ebp-34]
00424B31   mov dword ptr ss:[ebp-9C],3D都市飞.0040>; UNICODE "updatenet.exe 4"
00424B3B   mov dword ptr ss:[ebp-A4],ebx
00424B41   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarDup
00424B47   lea eax,dword ptr ss:[ebp-34]
00424B4A   push 0
00424B4C   push eax
00424B4D   call dword ptr ds:[<&MSVBVM60.#600>] ; MSVBVM60.rtcShell
00424B53   lea ecx,dword ptr ss:[ebp-34]
00424B56   fstp st
00424B58   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVar
00424B5E   call dword ptr ds:[<&MSVBVM60.__vbaE>; MSVBVM60.__vbaEnd
00424B64   jmp 3D都市飞.00424BFE
00424B69   mov ecx,80020004
00424B6E   mov eax,0A
00424B73   mov dword ptr ss:[ebp-5C],ecx
00424B76   mov dword ptr ss:[ebp-4C],ecx
00424B79   mov cx,word ptr ds:[esi+38]
00424B7D   push 3D都市飞.00408844
00424B82   push ecx
00424B83   mov dword ptr ss:[ebp-64],eax
00424B86   mov dword ptr ss:[ebp-54],eax
00424B89   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrI2
00424B8F   mov edx,eax
00424B91   lea ecx,dword ptr ss:[ebp-18]
00424B94   call edi
00424B96   push eax
00424B97   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrCat
00424B9D   lea edx,dword ptr ss:[ebp-A4]
00424BA3   lea ecx,dword ptr ss:[ebp-34]
00424BA6   mov dword ptr ss:[ebp-3C],eax
00424BA9   mov dword ptr ss:[ebp-44],ebx
00424BAC   mov dword ptr ss:[ebp-9C],3D都市飞.0040>
00424BB6   mov dword ptr ss:[ebp-A4],ebx
00424BBC   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarDup
00424BC2   lea edx,dword ptr ss:[ebp-64]
00424BC5   lea eax,dword ptr ss:[ebp-54]
00424BC8   push edx
00424BC9   lea ecx,dword ptr ss:[ebp-44]
00424BCC   push eax
00424BCD   push ecx
00424BCE   lea edx,dword ptr ss:[ebp-34]
00424BD1   push 0
00424BD3   push edx
00424BD4   call dword ptr ds:[<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox
00424BDA   lea ecx,dword ptr ss:[ebp-18]        ; 失败
00424BDD   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStr


////////////////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////


0042929C   push eax                             ; 将硬盘型号压栈
0042929D   push ecx                             ; 将硬盘ID号压栈
0042929E   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrCat
004292A4   mov dword ptr ss:[ebp-78],eax
004292A7   lea edx,dword ptr ss:[ebp-80]
004292AA   push 8
004292AC   lea eax,dword ptr ss:[ebp-90]
004292B2   push edx
004292B3   push eax
004292B4   mov dword ptr ss:[ebp-80],8
004292BB   call dword ptr ds:[<&MSVBVM60.#619>] ; MSVBVM60.rtcRightCharVar
004292C1   lea ecx,dword ptr ss:[ebp-90]
004292C7   push ecx
004292C8   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrVarMove
004292CE   mov edi,dword ptr ds:[<&MSVBVM60.__v>; MSVBVM60.__vbaStrMove
004292D4   mov edx,eax
004292D6   lea ecx,dword ptr ss:[ebp-1C]
004292D9   call edi
004292DB   lea edx,dword ptr ss:[ebp-90]
004292E1   lea eax,dword ptr ss:[ebp-80]
004292E4   push edx
004292E5   push eax
004292E6   push 2
004292E8   call ebx
004292EA   mov ecx,dword ptr ss:[ebp-1C]
004292ED   add esp,0C
004292F0   push ecx
004292F1   push 3D都市飞.0040920C                  ; UNICODE "thgame"
004292F6   call dword ptr ds:[<&MSVBVM60.__vbaS>; MSVBVM60.__vbaStrCat
004292FC   mov edx,eax
004292FE   lea ecx,dword ptr ss:[ebp-6C]
00429301   call edi
00429303   lea edx,dword ptr ss:[ebp-6C]
00429306   push edx
00429307   call 3D都市飞.00429600                  ; MD5运算
0042930C   mov edx,eax                             ; 得到运算后结果
0042930E   lea ecx,dword ptr ss:[ebp-70]
00429311   call edi
00429313   mov eax,dword ptr ss:[ebp-70]
00429316   mov dword ptr ss:[ebp-70],esi
00429319   mov dword ptr ss:[ebp-78],eax
0042931C   mov esi,8
00429321   lea eax,dword ptr ss:[ebp-80]
00429324   push esi
00429325   lea ecx,dword ptr ss:[ebp-90]
0042932B   push eax
0042932C   push ecx
0042932D   mov dword ptr ss:[ebp-80],esi
00429330   call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar
00429336   mov edx,dword ptr ss:[ebp-1C]
00429339   lea eax,dword ptr ss:[ebp-90]
0042933F   mov dword ptr ss:[ebp-B8],edx
00429345   lea ecx,dword ptr ss:[ebp-C0]
0042934B   push eax
0042934C   lea edx,dword ptr ss:[ebp-A0]
00429352   push ecx
00429353   push edx
00429354   mov dword ptr ss:[ebp-C0],esi
0042935A   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarCat
00429360   mov edx,eax
00429362   lea ecx,dword ptr ss:[ebp-2C]
00429365   call dword ptr ds:[<&MSVBVM60.__vbaV>; MSVBVM60.__vbaVarMove
0042936B   lea eax,dword ptr ss:[ebp-70]
0042936E   lea ecx,dword ptr ss:[ebp-6C]
00429371   push eax
00429372   push ecx
00429373   push 2
00429375   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
0042937B   lea edx,dword ptr ss:[ebp-90]
00429381   lea eax,dword ptr ss:[ebp-80]
00429384   push edx
00429385   push eax
00429386   push 2
00429388   call ebx
0042938A   add esp,18
0042938D   push 3D都市飞.00429417
00429392   jmp short 3D都市飞.004293D8
00429394   test byte ptr ss:[ebp-4],4
00429398   je short 3D都市飞.004293A3
0042939A   lea ecx,dword ptr ss:[ebp-2C]
0042939D   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVar
004293A3   lea ecx,dword ptr ss:[ebp-70]
004293A6   lea edx,dword ptr ss:[ebp-6C]
004293A9   push ecx
004293AA   push edx
004293AB   push 2
004293AD   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeStrList
004293B3   lea eax,dword ptr ss:[ebp-B0]
004293B9   lea ecx,dword ptr ss:[ebp-A0]
004293BF   push eax
004293C0   lea edx,dword ptr ss:[ebp-90]
004293C6   push ecx
004293C7   lea eax,dword ptr ss:[ebp-80]
004293CA   push edx
004293CB   push eax
004293CC   push 4
004293CE   call dword ptr ds:[<&MSVBVM60.__vbaF>; MSVBVM60.__vbaFreeVarList
004293D4   add esp,20
004293D7   retn


////////////////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////////////////

算法总结:

机器码算法: 硬盘ID号与固定字符串thgame连接后进行MD5运算,取其前8位,再与硬盘ID号连接,即为机器

码

注册码算法: 这里有五个选择:
1) 通过机器码与固定字符串3dcityrace连接后进行MD5运算后,取其前16位,即为注册码
2) 通过机器码与固定字符串free连接后进行MD5运算后,取其前16位,即为注册码
3) 通过机器码与固定字符串register连接后进行MD5运算后,取其前16位,即为注册码
4) 通过机器码与固定字符串3连接后进行MD5运算后,取其前16位,即为注册码
5) 通过机器码与固定字符串4连接后进行MD5运算后,取其前16位,即为注册码

五种随便选一种都可以注册,注册成功后,在安装目录下生成一个regid文件,删除后又变回未注册状态,可

以再玩一次
--------------------------------------------------------------------------------

[课程]Linux pwn 探索篇！

收藏・0

免费・0

支持

最新回复 (6)
小娃崽雪币： 383 活跃值： (41) 能力值： ( LV12，RANK：530 ) 在线值：发帖 42 回帖 283 粉丝 1 关注私信	小娃崽 13 2 楼ＶＢ的呀 2006-12-21 08:49 0
邪秀才雪币： 250 活跃值： (11) 能力值： ( LV6，RANK：90 ) 在线值：发帖 10 回帖 311 粉丝 0 关注私信	邪秀才 2 3 楼书生越来越厉害了,看来要中举了 2006-12-21 11:33 0
slsdz 雪币： 209 活跃值： (47) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 75 粉丝 0 关注私信	slsdz 4 楼辛苦了只是注释少了点 2006-12-21 14:18 0
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 5 楼在赢政天下见到注册器了，是大侠发的吗？ 2006-12-21 22:19 0
zhaoocn 雪币： 50 活跃值： (145) 能力值： ( LV12，RANK：290 ) 在线值：发帖 9 回帖 348 粉丝 0 关注私信	zhaoocn 7 6 楼书生的，顶一下 2006-12-22 22:31 0
冷血书生雪币： 443 活跃值： (200) 能力值： ( LV9，RANK：1140 ) 在线值：发帖 53 回帖 1135 粉丝 2 关注私信	冷血书生 28 7 楼最初由 KAN* 发布* 在赢政天下见到注册器了，是大侠发的吗？呵呵，不是！ 2006-12-23 00:04 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

冷血书生

发帖

1135

回帖

1140

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (6)
小娃崽雪币： 383 活跃值： (41) 能力值： ( LV12，RANK：530 ) 在线值：发帖 42 回帖 283 粉丝 1 关注私信	小娃崽 13 2 楼ＶＢ的呀 2006-12-21 08:49 0
邪秀才雪币： 250 活跃值： (11) 能力值： ( LV6，RANK：90 ) 在线值：发帖 10 回帖 311 粉丝 0 关注私信	邪秀才 2 3 楼书生越来越厉害了,看来要中举了 2006-12-21 11:33 0
slsdz 雪币： 209 活跃值： (47) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 75 粉丝 0 关注私信	slsdz 4 楼辛苦了只是注释少了点 2006-12-21 14:18 0
KAN 雪币： 263 活跃值： (10) 能力值： ( LV9，RANK：250 ) 在线值：发帖 11 回帖 589 粉丝 0 关注私信	KAN 6 5 楼在赢政天下见到注册器了，是大侠发的吗？ 2006-12-21 22:19 0
zhaoocn 雪币： 50 活跃值： (145) 能力值： ( LV12，RANK：290 ) 在线值：发帖 9 回帖 348 粉丝 0 关注私信	zhaoocn 7 6 楼书生的，顶一下 2006-12-22 22:31 0
冷血书生雪币： 443 活跃值： (200) 能力值： ( LV9，RANK：1140 ) 在线值：发帖 53 回帖 1135 粉丝 2 关注私信	冷血书生 28 7 楼最初由 KAN* 发布* 在赢政天下见到注册器了，是大侠发的吗？呵呵，不是！ 2006-12-23 00:04 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复