004B79F4 55 push ebp
004B79F5 8BEC mov ebp, esp
004B79F7 B904000000 mov ecx, $00000004
004B79FC 6A00 push $00
004B79FE 6A00 push $00
004B7A00 49 dec ecx
004B7A01 75F9 jnz 004B79FC
004B7A03 51 push ecx
004B7A04 53 push ebx
004B7A05 8BD8 mov ebx, eax
004B7A07 33C0 xor eax, eax
004B7A09 55 push ebp
004B7A0A 68577B4B00 push $004B7B57
***** TRY
|
004B7A0F 64FF30 push dword ptr fs:[eax]
004B7A12 648920 mov fs:[eax], esp
004B7A15 8D55F8 lea edx, [ebp-$08]
* Reference to control RzEditZCM : TRzEdit
|
004B7A18 8B8310030000 mov eax, [ebx+$0310]
* Reference to: ActnMan.TActionListCollection.GetListItem(TActionListCollection;Integer):TActionListItem;
| or: ActnMan.TActionClientsCollection.GetActionClient(TActionClientsCollection;Integer):TActionClient;
| or: ActnMan.TActionBars.GetActionBar(TActionBars;Integer):TActionBarItem;
| or: ActnMan.TActionClients.GetActionClient(TActionClients;Integer):TActionClientItem;
| or: ActnMenus.TMenuList.GetMenu(TMenuList;Integer):TCustomActionMenuBar;
| or: ADODB.TParameters.GetItem(TParameters;Integer):TParameter;
|
004B7A1E E881D5FBFF call 00474FA4
004B7A23 8B45F8 mov eax, [ebp-$08]
004B7A26 8D55FC lea edx, [ebp-$04]
* Reference to: SysUtils.Trim(AnsiString):AnsiString;overload;
|
004B7A29 E82A1CF5FF call 00409658
004B7A2E 837DFC00 cmp dword ptr [ebp-$04], +$00
004B7A32 751E jnz 004B7A52
004B7A34 6A30 push $30
* Possible String Reference to: '提示信息'
|
004B7A36 68647B4B00 push $004B7B64
* Possible String Reference to: '注册码不正确！'
|
004B7A3B 68707B4B00 push $004B7B70
004B7A40 8BC3 mov eax, ebx
* Reference to: Controls.TWinControl.GetHandle(TWinControl):HWND;
| or: QComCtrls.TTrackBar.GetHandle(TTrackBar):QClxSliderH;
| or: QComCtrls.TCustomViewControl.GetHandle(TCustomViewControl):QListViewH;
| or: QComCtrls.TCustomViewControl.ViewportHandle(TCustomViewControl):QWidgetH;
| or: QComCtrls.TCustomHeaderControl.GetHandle(TCustomHeaderControl):QHeaderH;
| or: QComCtrls.TCustomSpinEdit.GetHandle(TCustomSpinEdit):QClxSpinBoxH; 这些东西根本看不懂是什么意思了
|
004B7A42 E8C57CF9FF call 0044F70C
004B7A47 50 push eax
* Reference to: user32.MessageBoxA()
|
004B7A48 E80B04F5FF call 00407E58
004B7A4D E9B2000000 jmp 004B7B04
004B7A52 8D55F0 lea edx, [ebp-$10]
* Reference to control RzEditTAXID : TRzEdit
|
004B7A55 8B8304030000 mov eax, [ebx+$0304]
* Reference to: ActnMan.TActionListCollection.GetListItem(TActionListCollection;Integer):TActionListItem;
| or: ActnMan.TActionClientsCollection.GetActionClient(TActionClientsCollection;Integer):TActionClient;
| or: ActnMan.TActionBars.GetActionBar(TActionBars;Integer):TActionBarItem;
| or: ActnMan.TActionClients.GetActionClient(TActionClients;Integer):TActionClientItem;
| or: ActnMenus.TMenuList.GetMenu(TMenuList;Integer):TCustomActionMenuBar;
| or: ADODB.TParameters.GetItem(TParameters;Integer):TParameter;
|
004B7A5B E844D5FBFF call 00474FA4
004B7A60 8B45F0 mov eax, [ebp-$10]
004B7A63 8D55F4 lea edx, [ebp-$0C]
* Reference to: SysUtils.Trim(AnsiString):AnsiString;overload;
|
004B7A66 E8ED1BF5FF call 00409658
004B7A6B 8B45F4 mov eax, [ebp-$0C]
004B7A6E 50 push eax
004B7A6F 8D55E4 lea edx, [ebp-$1C]
* Reference to control RzEditZCM : TRzEdit
|
004B7A72 8B8310030000 mov eax, [ebx+$0310]
* Reference to: ActnMan.TActionListCollection.GetListItem(TActionListCollection;Integer):TActionListItem;
| or: ActnMan.TActionClientsCollection.GetActionClient(TActionClientsCollection;Integer):TActionClient;
| or: ActnMan.TActionBars.GetActionBar(TActionBars;Integer):TActionBarItem;
| or: ActnMan.TActionClients.GetActionClient(TActionClients;Integer):TActionClientItem;
| or: ActnMenus.TMenuList.GetMenu(TMenuList;Integer):TCustomActionMenuBar;
| or: ADODB.TParameters.GetItem(TParameters;Integer):TParameter;
|
004B7A78 E827D5FBFF call 00474FA4
004B7A7D 8B45E4 mov eax, [ebp-$1C]
004B7A80 8D55E8 lea edx, [ebp-$18]
* Reference to: SysUtils.Trim(AnsiString):AnsiString;overload;
|
004B7A83 E8D01BF5FF call 00409658
004B7A88 8B45E8 mov eax, [ebp-$18]
004B7A8B 8D55EC lea edx, [ebp-$14]
|
004B7A8E E855FBFFFF call 004B75E8
004B7A93 8B55EC mov edx, [ebp-$14]
004B7A96 58 pop eax
* Reference to: System.@LStrCmp;
|
004B7A97 E8FCD5F4FF call 00405098
004B7A9C 754D jnz 004B7AEB
004B7A9E 8D55DC lea edx, [ebp-$24]
* Reference to control RzEditZCM : TRzEdit
|
004B7AA1 8B8310030000 mov eax, [ebx+$0310]
* Reference to: ActnMan.TActionListCollection.GetListItem(TActionListCollection;Integer):TActionListItem;
| or: ActnMan.TActionClientsCollection.GetActionClient(TActionClientsCollection;Integer):TActionClient;
| or: ActnMan.TActionBars.GetActionBar(TActionBars;Integer):TActionBarItem;
| or: ActnMan.TActionClients.GetActionClient(TActionClients;Integer):TActionClientItem;
| or: ActnMenus.TMenuList.GetMenu(TMenuList;Integer):TCustomActionMenuBar;
| or: ADODB.TParameters.GetItem(TParameters;Integer):TParameter;
|
004B7AA7 E8F8D4FBFF call 00474FA4
004B7AAC 8B45DC mov eax, [ebp-$24]
004B7AAF 8D55E0 lea edx, [ebp-$20]
* Reference to: SysUtils.Trim(AnsiString):AnsiString;overload;
|
004B7AB2 E8A11BF5FF call 00409658
004B7AB7 8B4DE0 mov ecx, [ebp-$20]
* Possible String Reference to: 'ZCM'
|
004B7ABA BA887B4B00 mov edx, $004B7B88
* Possible String Reference to: 'SOFTWARE\SUNTAX\KPJK\'
|
004B7ABF B8947B4B00 mov eax, $004B7B94
|
004B7AC4 E827BFFFFF call 004B39F0
004B7AC9 6A30 push $30
* Possible String Reference to: '提示信息'
|
004B7ACB 68647B4B00 push $004B7B64
* Possible String Reference to: '注册成功！'
|
004B7AD0 68AC7B4B00 push $004B7BAC
004B7AD5 8BC3 mov eax, ebx
* Reference to: Controls.TWinControl.GetHandle(TWinControl):HWND;
| or: QComCtrls.TTrackBar.GetHandle(TTrackBar):QClxSliderH;
| or: QComCtrls.TCustomViewControl.GetHandle(TCustomViewControl):QListViewH;
| or: QComCtrls.TCustomViewControl.ViewportHandle(TCustomViewControl):QWidgetH;
| or: QComCtrls.TCustomHeaderControl.GetHandle(TCustomHeaderControl):QHeaderH;
| or: QComCtrls.TCustomSpinEdit.GetHandle(TCustomSpinEdit):QClxSpinBoxH;
|
004B7AD7 E8307CF9FF call 0044F70C
004B7ADC 50 push eax
* Reference to: user32.MessageBoxA()
|
004B7ADD E87603F5FF call 00407E58
004B7AE2 8BC3 mov eax, ebx
* Reference to: Forms.TCustomForm.Close(TCustomForm);
|
004B7AE4 E8BBD4FAFF call 00464FA4
004B7AE9 EB19 jmp 004B7B04
004B7AEB 6A30 push $30
* Possible String Reference to: '提示信息'
|
004B7AED 68647B4B00 push $004B7B64
* Possible String Reference to: '注册码不正确！'
|
004B7AF2 68707B4B00 push $004B7B70
004B7AF7 8BC3 mov eax, ebx
* Reference to: Controls.TWinControl.GetHandle(TWinControl):HWND;
| or: QComCtrls.TTrackBar.GetHandle(TTrackBar):QClxSliderH;
| or: QComCtrls.TCustomViewControl.GetHandle(TCustomViewControl):QListViewH;
| or: QComCtrls.TCustomViewControl.ViewportHandle(TCustomViewControl):QWidgetH;
| or: QComCtrls.TCustomHeaderControl.GetHandle(TCustomHeaderControl):QHeaderH;
| or: QComCtrls.TCustomSpinEdit.GetHandle(TCustomSpinEdit):QClxSpinBoxH;
|
004B7AF9 E80E7CF9FF call 0044F70C
004B7AFE 50 push eax
* Reference to: user32.MessageBoxA()
|
004B7AFF E85403F5FF call 00407E58
004B7B04 33C0 xor eax, eax
004B7B06 5A pop edx
004B7B07 59 pop ecx
004B7B08 59 pop ecx
004B7B09 648910 mov fs:[eax], edx
****** FINALLY
|
* Possible String Reference to: '[嬪]?
|
004B7B0C 685E7B4B00 push $004B7B5E
004B7B11 8D45DC lea eax, [ebp-$24]
* Reference to: System.@LStrClr(void;void);
|
004B7B14 E873D1F4FF call 00404C8C
004B7B19 8D45E0 lea eax, [ebp-$20]
* Reference to: System.@LStrClr(void;void);
|
004B7B1C E86BD1F4FF call 00404C8C
004B7B21 8D45E4 lea eax, [ebp-$1C]
* Reference to: System.@LStrClr(void;void);
|
004B7B24 E863D1F4FF call 00404C8C
004B7B29 8D45E8 lea eax, [ebp-$18]
004B7B2C BA02000000 mov edx, $00000002
* Reference to: System.@LStrArrayClr(void;void;Integer);
|
004B7B31 E87AD1F4FF call 00404CB0
004B7B36 8D45F0 lea eax, [ebp-$10]
* Reference to: System.@LStrClr(void;void);
|
004B7B39 E84ED1F4FF call 00404C8C
004B7B3E 8D45F4 lea eax, [ebp-$0C]
* Reference to: System.@LStrClr(void;void);
|
004B7B41 E846D1F4FF call 00404C8C
004B7B46 8D45F8 lea eax, [ebp-$08]
* Reference to: System.@LStrClr(void;void);
|
004B7B49 E83ED1F4FF call 00404C8C
004B7B4E 8D45FC lea eax, [ebp-$04]
* Reference to: System.@LStrClr(void;void);
|
004B7B51 E836D1F4FF call 00404C8C
004B7B56 C3 ret
* Reference to: System.@HandleFinally;
|
004B7B57 E90CCBF4FF jmp 00404668
004B7B5C EBB3 jmp 004B7B11
****** END
|
004B7B5E 5B pop ebx
004B7B5F 8BE5 mov esp, ebp
004B7B61 5D pop ebp
004B7B62 C3 ret
大家请帮帮忙看看注册码暗藏在何处
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
