004508CD |. 57 push edi
004508CE |. 8BF8 mov edi,eax
004508D0 |. 33C0 xor eax,eax
004508D2 |. 83C9 FF or ecx,FFFFFFFF
004508D5 |. F2:AE repne scas byte ptr es:[edi]
004508D7 |. F7D1 not ecx
004508D9 |. 2BF9 sub edi,ecx
004508DB |. 8DB5 ACFEFFFF lea esi,dword ptr ss:[ebp-154]
004508E1 |. 87F7 xchg edi,esi
004508E3 |. 8BD1 mov edx,ecx
004508E5 |. 8BC7 mov eax,edi
004508E7 |. C1E9 02 shr ecx,2
004508EA |. 8D85 ACFEFFFF lea eax,dword ptr ss:[ebp-154]
004508F0 |. F3:A5 rep movs dword ptr es:[edi],dword ptr >
004508F2 |. 8BCA mov ecx,edx
004508F4 |. 83E1 03 and ecx,3
004508F7 |. F3:A4 rep movs byte ptr es:[edi],byte ptr ds>
004508F9 |. 5F pop edi
004508FA |. 8985 20FFFFFF mov dword ptr ss:[ebp-E0],eax
00450900 |. 8DB5 08FFFFFF lea esi,dword ptr ss:[ebp-F8]
00450906 |. 33DB xor ebx,ebx
00450908 |> 8B95 20FFFFFF /mov edx,dword ptr ss:[ebp-E0]
0045090E |. 0FBE06 |movsx eax,byte ptr ds:[esi]
00450911 |. 0FBE0A |movsx ecx,byte ptr ds:[edx]
00450914 |. 83C1 EC |add ecx,-14
00450917 |. 3BC1 |cmp eax,ecx ; 比较eax.ecx,不相等则跳
00450919 |. 0F85 80000000 |jnz 屏录专家.0045099F ; zf等于0跳
0045091F |. 83FB 03 |cmp ebx,3
00450922 |. 75 6A |jnz short 屏录专家.0045098E
00450924 |. 81C7 444D0000 |add edi,4D44
0045092A |. 89BD A8FAFFFF |mov dword ptr ss:[ebp-558],edi
00450930 |. DB85 A8FAFFFF |fild dword ptr ss:[ebp-558]
00450936 |. DC0D 34144500 |fmul qword ptr ds:[451434]
0045093C |. DB2D 3C144500 |fld tbyte ptr ds:[45143C]
00450942 |. DEC9 |fmulp st(1),st
00450944 |. E8 CFDE0C00 |call 屏录专家.0051E818
00450949 |. 8BF8 |mov edi,eax
0045094B |. 8BC7 |mov eax,edi
0045094D |. B9 A0860100 |mov ecx,186A0
00450952 |. 99 |cdq
00450953 |. F7F9 |idiv ecx
00450955 |. 8BFA |mov edi,edx
00450957 |. 33C0 |xor eax,eax
00450959 |. 8985 2CFFFFFF |mov dword ptr ss:[ebp-D4],eax
0045095F |. 33D2 |xor edx,edx
00450961 |. 8D85 ACFEFFFF |lea eax,dword ptr ss:[ebp-154]
00450967 |> 0FBE08 |/movsx ecx,byte ptr ds:[eax]
0045096A |. 018D 2CFFFFFF ||add dword ptr ss:[ebp-D4],ecx
00450970 |. 42 ||inc edx
00450971 |. 40 ||inc eax
00450972 |. 83FA 13 ||cmp edx,13
00450975 |.^ 7C F0 |\jl short 屏录专家.00450967
00450977 |. 8B85 2CFFFFFF |mov eax,dword ptr ss:[ebp-D4]
0045097D |. B9 0A000000 |mov ecx,0A
00450982 |. 99 |cdq
00450983 |. F7F9 |idiv ecx
00450985 |. 83C2 30 |add edx,30
00450988 |. 8995 2CFFFFFF |mov dword ptr ss:[ebp-D4],edx
0045098E |> 43 |inc ebx
0045098F |. FF85 20FFFFFF |inc dword ptr ss:[ebp-E0]
00450995 |. 46 |inc esi
00450996 |. 83FB 05 |cmp ebx,5
00450999 |.^ 0F8C 69FFFFFF \jl 屏录专家.00450908
0045099F |> 83FB 05 cmp ebx,5
004509A2 |. 0F8C BB090000 jl 屏录专家.00451363 ; 跳向失败
004509A8 |. 0FBE85 BFFEFFFF movsx eax,byte ptr ss:[ebp-141]
004509AF |. 3B85 2CFFFFFF cmp eax,dword ptr ss:[ebp-D4]
004509B5 |. 74 09 je short 屏录专家.004509C0
004509B7 |. 83F8 41 cmp eax,41
004509BA |. 0F8C A3090000 jl 屏录专家.00451363 ; 跳向：注册失败。不能跳
004509C0 |> 8BC7 mov eax,edi
004509C2 |. B9 0A000000 mov ecx,0A
004509C7 |. 99 cdq
004509C8 |. F7F9 idiv ecx
004509CA |. 0FBEB41D ACFEFFF>movsx esi,byte ptr ss:[ebp+ebx-154] ; 取字节扩展
004509D2 |. 83C6 BF add esi,-41 ; esi加上-41
004509D5 |. 2BF2 sub esi,edx ; esi中的数值要等于edx中的数值
004509D7 |. 85F6 test esi,esi ; esi为零则跳
004509D9 |. 74 09 je short 屏录专家.004509E4 ; 关键跳
004509DB |. 83FE 09 cmp esi,9
004509DE |. 0F85 F8080000 jnz 屏录专家.004512DC
004509E4 |> 66:C785 44FFFFFF>mov word ptr ss:[ebp-BC],8C
004509ED |. BA 15645500 mov edx,屏录专家.00556415 ; 注册成功
[课程]Android-CTF解题方法汇总！
