程序的地址是：http://www.jcrystal.com/
程序没有加壳，用PEid查显示为：Microsoft Visual Basic 5.0 / 6.0
由于是来分析算法，所以我还用PEid的插件来分析了一下程序所用的算法是：
CRC32 [poly] :: 0013D96F :: 0053D96F
The reference is above.
73502096 MSVBVM> 55 push ebp
73502097 8BEC mov ebp,esp
73502099 83EC 4C sub esp,4C
7350209C 8B4D 14 mov ecx,dword ptr ss:[ebp+14]
004B8DBD . /0F84 BD000000 je wincnt.004B8E80
004B8DC3 . |8B45 08 mov eax,dword ptr ss:[ebp+8]
004B8DC6 . |8D95 FCFEFFFF lea edx,dword ptr ss:[ebp-104]
004B8DCC . |52 push edx
004B8DCD . |8B55 E8 mov edx,dword ptr ss:[ebp-18]
004B8DD0 . |8B08 mov ecx,dword ptr ds:[eax]
004B8DD2 . |52 push edx
004B8DD3 . |50 push eax
004B8DD4 . |FF91 38090000 call dword ptr ds:[ecx+938] ; 这里就是第一个关键CALL了,F7跟进
004B8DDA . |8B45 E8 mov eax,dword ptr ss:[ebp-18]
004B8DDD . |50 push eax
004B8DDE . |FFD6 call esi ; <&MSVBVM60.__vbaLenBstr>
004B8DE0 . |33C9 xor ecx,ecx
004B8DE2 . |83F8 0D cmp eax,0D
004B8DE5 . |0F9DC1 setge cl
004B8DE8 . |33D2 xor edx,edx
004B8DEA . |66:3995 FCFEFFFF cmp word ptr ss:[ebp-104],dx
004B8DF1 . |0F95C2 setne dl
004B8DF4 . |85CA test edx,ecx
004B8DF6 . |0F85 3D010000 jnz wincnt.004B8F39
004B8DFC . |BE 04000280 mov esi,80020004
004B8E01 . |8D95 50FFFFFF lea edx,dword ptr ss:[ebp-B0]
004B8E07 . |8D4D B0 lea ecx,dword ptr ss:[ebp-50]
004B8E0A . |8975 98 mov dword ptr ss:[ebp-68],esi
004B8E0D . |895D 90 mov dword ptr ss:[ebp-70],ebx
004B8E10 . |8975 A8 mov dword ptr ss:[ebp-58],esi
004B8E13 . |895D A0 mov dword ptr ss:[ebp-60],ebx
004B8E16 . |C785 58FFFFFF 4050>mov dword ptr ss:[ebp-A8],wincnt.00415040 ; UNICODE "Registration failed!"
004B8E20 . |C785 50FFFFFF 0800>mov dword ptr ss:[ebp-B0],8
004B8E2A . |FFD7 call edi ; <&MSVBVM60.__vbaVarDup>
004B8E2C . |8D95 60FFFFFF lea edx,dword ptr ss:[ebp-A0]
004B8E32 . |8D4D C0 lea ecx,dword ptr ss:[ebp-40]
004B8E35 . |C785 68FFFFFF 2450>mov dword ptr ss:[ebp-98],wincnt.00415024 ; UNICODE "Invalid Key"
004B8E3F . |C785 60FFFFFF 0800>mov dword ptr ss:[ebp-A0],8
004B8E49 . |FFD7 call edi ; <&MSVBVM60.__vbaVarDup>
004B8E4B . |8D45 90 lea eax,dword ptr ss:[ebp-70]
004B8E4E . |8D4D A0 lea ecx,dword ptr ss:[ebp-60]
004B8E51 . |50 push eax
004B8E52 . |8D55 B0 lea edx,dword ptr ss:[ebp-50]
004B8E55 . |51 push ecx
004B8E56 . |52 push edx
004B8E57 . |8D45 C0 lea eax,dword ptr ss:[ebp-40]
004B8E5A . |6A 30 push 30
004B8E5C . |50 push eax
004B8E5D . |FF15 B8114000 call dword ptr ds:[<&MSVBVM60.#595>] ; MSVBVM60.rtcMsgBox
004B8E63 . |8D4D 90 lea ecx,dword ptr ss:[ebp-70]
004CBEC9 . 52 push edx
004CBECA . 894D C4 mov dword ptr ss:[ebp-3C],ecx
004CBECD . C745 BC 08400000 mov dword ptr ss:[ebp-44],4008
004CBED4 . FFD7 call edi ; <&MSVBVM60.__vbaLenBstr>
004CBED6 . 83E8 09 sub eax,9 ; 取用户输入的注册长度,与9比较
004CBED9 . 8D4D CC lea ecx,dword ptr ss:[ebp-34]
004CBEDC . 0F80 C5000000 jo wincnt.004CBFA7 ; 小于9则出错返回
//0012F7F8 001DAA84 UNICODE "AAA-_12345678"
004CBEE6 . 50 push eax
004CBEE7 . 51 push ecx
004CBEE8 . FF15 F8134000 call dword ptr ds:[<&MSVBVM60.#617>] ; MSVBVM60.rtcLeftCharVar
004CBEEE . 8D55 CC lea edx,dword ptr ss:[ebp-34] ; 取出左边4个字符
//0012F7E8 0021B104 UNICODE "AAA-"
004CBF14 . 52 push edx
004CBF15 . 8D55 EC lea edx,dword ptr ss:[ebp-14]
004CBF18 . 8B08 mov ecx,dword ptr ds:[eax]
004CBF1A . 52 push edx
004CBF1B . 50 push eax
004CBF1C . FF91 34090000 call dword ptr ds:[ecx+934] ; 关键CALL,F7跟进
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
