从哪里可以看出:判断注册,弹出窗口,多谢了!
00472F5C 55 push ebp
00472F5D 8BEC mov ebp, esp
00472F5F 33C9 xor ecx, ecx
00472F61 51 push ecx
00472F62 51 push ecx
00472F63 51 push ecx
00472F64 51 push ecx
00472F65 51 push ecx
00472F66 51 push ecx
00472F67 51 push ecx
00472F68 51 push ecx
00472F69 53 push ebx
00472F6A 56 push esi
00472F6B 57 push edi
00472F6C 8BD8 mov ebx, eax
00472F6E 33C0 xor eax, eax
00472F70 55 push ebp
* Possible String Reference to: '??脎_^[?]?
|
00472F71 682B314700 push $0047312B
***** TRY
|
00472F76 64FF30 push dword ptr fs:[eax]
00472F79 648920 mov fs:[eax], esp
00472F7C 8D55F0 lea edx, [ebp-$10]
00472F7F 33C0 xor eax, eax
* Reference to: System.ParamStr(Integer):String;
|
00472F81 E852FBF8FF call 00402AD8
00472F86 8B45F0 mov eax, [ebp-$10]
00472F89 8D55F4 lea edx, [ebp-$0C]
* Reference to: Unit_004078D8.Proc_00408C80
|
00472F8C E8EF5CF9FF call 00408C80
00472F91 8B55F4 mov edx, [ebp-$0C]
* Reference to pointer to GlobalVar_00476CA0
|
00472F94 A134504700 mov eax, dword ptr [$00475034]
* Reference to: System.@LStrAsg(void;void;void;void);
|
00472F99 E84615F9FF call 004044E4
00472F9E 8BC3 mov eax, ebx
* Reference to: Unit_00462834.Proc_00463174
|
00472FA0 E8CF01FFFF call 00463174
* Reference to : TMainForm.Proc_00464AC8()
|
00472FA5 E81E1BFFFF call 00464AC8
00472FAA 84C0 test al, al
00472FAC 743A jz 00472FE8
* Reference to TApplication instance
|
00472FAE 8B0D70524700 mov ecx, [$00475270]
00472FB4 8B09 mov ecx, [ecx]
00472FB6 B201 mov dl, $01
* Reference to class TMainForm
|
00472FB8 A1483A4600 mov eax, dword ptr [$00463A48]
* Reference to: Forms.TCustomForm.Create(TCustomForm;boolean;TComponent);
| or: QForms.TCustomForm.Create(TCustomForm;boolean;TComponent);
|
00472FBD E8B60CFEFF call 00453C78
* Reference to pointer to GlobalVar_00476CB4
|
00472FC2 8B15B8504700 mov edx, [$004750B8]
00472FC8 8902 mov [edx], eax
* Reference to: System.ParamCount:Integer;
|
00472FCA E8A9FAF8FF call 00402A78
00472FCF 85C0 test eax, eax
00472FD1 0F8529010000 jnz 00473100
* Reference to pointer to GlobalVar_00476CB4
|
00472FD7 A1B8504700 mov eax, dword ptr [$004750B8]
00472FDC 8B00 mov eax, [eax]
* Reference to: Forms.TCustomForm.Show(TCustomForm);
|
00472FDE E8D14EFEFF call 00457EB4
00472FE3 E918010000 jmp 00473100
* Possible String Reference to: 'Setup.ini'
|
00472FE8 B944314700 mov ecx, $00473144
00472FED B201 mov dl, $01
* Reference to class TIniFile
|
00472FEF A130CB4500 mov eax, dword ptr [$0045CB30]
* Reference to: Unit_0045CA08.Proc_0045CBE0
|
00472FF4 E8E79BFEFF call 0045CBE0
00472FF9 8945F8 mov [ebp-$08], eax
00472FFC 6A14 push $14
* Possible String Reference to: 'Right'
|
00472FFE B958314700 mov ecx, $00473158
* Possible String Reference to: 'FileCount'
|
00473003 BA68314700 mov edx, $00473168
00473008 8B45F8 mov eax, [ebp-$08]
0047300B 8B30 mov esi, [eax]
* Reference to method TIniFile.ReadInteger(string,string,Longint)
|
0047300D FF5608 call dword ptr [esi+$08]
00473010 8BF0 mov esi, eax
* Possible String Reference to: '1.0'
|
00473012 687C314700 push $0047317C
00473017 8D45FC lea eax, [ebp-$04]
0047301A 50 push eax
* Possible String Reference to: 'Version'
|
0047301B B988314700 mov ecx, $00473188
* Possible String Reference to: 'FileCount'
|
00473020 BA68314700 mov edx, $00473168
00473025 8B45F8 mov eax, [ebp-$08]
00473028 8B38 mov edi, [eax]
0047302A FF17 call dword ptr [edi]
0047302C 8B45FC mov eax, [ebp-$04]
* Possible String Reference to: '2.1'
|
0047302F BA98314700 mov edx, $00473198
* Reference to: System.@LStrCmp;
|
00473034 E85318F9FF call 0040488C
00473039 7430 jz 0047306B
0047303B 6A14 push $14
* Possible String Reference to: 'Right'
|
0047303D B958314700 mov ecx, $00473158
* Possible String Reference to: 'FileCount'
|
00473042 BA68314700 mov edx, $00473168
00473047 8B45F8 mov eax, [ebp-$08]
0047304A 8B30 mov esi, [eax]
* Reference to method TIniFile.WriteInteger(string,string,Longint)
|
0047304C FF560C call dword ptr [esi+$0C]
* Possible String Reference to: '2.1'
|
0047304F 6898314700 push $00473198
* Possible String Reference to: 'Version'
|
00473054 B988314700 mov ecx, $00473188
* Possible String Reference to: 'FileCount'
|
00473059 BA68314700 mov edx, $00473168
0047305E 8B45F8 mov eax, [ebp-$08]
00473061 8B30 mov esi, [eax]
* Reference to method TIniFile.WriteString(string,string,string)
|
00473063 FF5604 call dword ptr [esi+$04]
00473066 BE14000000 mov esi, $00000014
0047306B 83FE14 cmp esi, +$14
0047306E 7F05 jnle 00473075
00473070 83FE01 cmp esi, +$01
00473073 7D40 jnl 004730B5
00473075 8D45EC lea eax, [ebp-$14]
00473078 50 push eax
00473079 C745E414000000 mov dword ptr [ebp-$1C], $00000014
00473080 C645E800 mov byte ptr [ebp-$18], $00
00473084 8D55E4 lea edx, [ebp-$1C]
00473087 33C9 xor ecx, ecx
* Possible String Reference to: '试用已满 %d 次，感谢您试用e族软件！'
|
00473089 B8A4314700 mov eax, $004731A4
* Reference to: Unit_004078D8.Proc_0040951C
|
0047308E E88964F9FF call 0040951C
00473093 8B55EC mov edx, [ebp-$14]
* Reference to control TTryForm.lblInfo : TLabel
|
00473096 8B8304030000 mov eax, [ebx+$0304]
* Reference to: Controls.TControl.SetText(TControl;TCaption);
|
0047309C E8AB86FCFF call 0043B74C
* Possible String Reference to: '退出软件'
|
004730A1 BAD0314700 mov edx, $004731D0
* Reference to control TTryForm.bnTry : TAOLButton
|
004730A6 8B8310030000 mov eax, [ebx+$0310]
* Reference to : TImageButton._PROC_00461F98()
|
004730AC E8E7EEFEFF call 00461F98
004730B1 33F6 xor esi, esi
004730B3 EB29 jmp 004730DE
004730B5 8D45E0 lea eax, [ebp-$20]
004730B8 50 push eax
004730B9 8975E4 mov [ebp-$1C], esi
004730BC C645E800 mov byte ptr [ebp-$18], $00
004730C0 8D55E4 lea edx, [ebp-$1C]
004730C3 33C9 xor ecx, ecx
* Possible String Reference to: '您还可以再试用 %d 次'
|
004730C5 B8E4314700 mov eax, $004731E4
* Reference to: Unit_004078D8.Proc_0040951C
|
004730CA E84D64F9FF call 0040951C
004730CF 8B55E0 mov edx, [ebp-$20]
* Reference to control TTryForm.lblInfo : TLabel
|
004730D2 8B8304030000 mov eax, [ebx+$0304]
* Reference to: Controls.TControl.SetText(TControl;TCaption);
|
004730D8 E86F86FCFF call 0043B74C
004730DD 4E dec esi
004730DE 56 push esi
* Possible String Reference to: 'Right'
|
004730DF B958314700 mov ecx, $00473158
* Possible String Reference to: 'FileCount'
|
004730E4 BA68314700 mov edx, $00473168
004730E9 8B45F8 mov eax, [ebp-$08]
004730EC 8B30 mov esi, [eax]
* Reference to method TIniFile.WriteInteger(string,string,Longint)
|
004730EE FF560C call dword ptr [esi+$0C]
004730F1 8B45F8 mov eax, [ebp-$08]
* Reference to: System.TObject.Free(TObject);
|
004730F4 E82B06F9FF call 00403724
004730F9 8BC3 mov eax, ebx
* Reference to: Forms.TCustomForm.Show(TCustomForm);
|
004730FB E8B44DFEFF call 00457EB4
00473100 33C0 xor eax, eax
00473102 5A pop edx
00473103 59 pop ecx
00473104 59 pop ecx
00473105 648910 mov fs:[eax], edx
****** FINALLY
|
* Possible String Reference to: '_^[?]?
|
00473108 6832314700 push $00473132
0047310D 8D45E0 lea eax, [ebp-$20]
* Reference to: System.@LStrClr(void;void);
|
00473110 E87B13F9FF call 00404490
00473115 8D45EC lea eax, [ebp-$14]
00473118 BA03000000 mov edx, $00000003
* Reference to: System.@LStrArrayClr(void;void;Integer);
|
0047311D E89213F9FF call 004044B4
00473122 8D45FC lea eax, [ebp-$04]
* Reference to: System.@LStrClr(void;void);
|
00473125 E86613F9FF call 00404490
0047312A C3 ret
* Reference to: System.@HandleFinally;
|
0047312B E9880DF9FF jmp 00403EB8
00473130 EBDB jmp 0047310D
****** END
|
00473132 5F pop edi
00473133 5E pop esi
00473134 5B pop ebx
00473135 8BE5 mov esp, ebp
00473137 5D pop ebp
00473138 C3 ret
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
