然后保存运行,输入假码,发现居然要让我们网络验证了。
::004428A6:: C785 E4FEFFFF 44B64000 MOV DWORD PTR [EBP-11C], 40B644 \->: 提示: 注册时需要访问网络,请让您的防火墙放行本程序,否则不能成功注册
::004428B0:: C785 DCFEFFFF 08000000 MOV DWORD PTR [EBP-124], 8
::004428BA:: 8D95 DCFEFFFF LEA EDX, [EBP-124]
::004428C0:: 8D8D 5CFFFFFF LEA ECX, [EBP-A4]
::004428C6:: FF15 B8124000 CALL [4012B8] >>>: MSVBVM60.DLL:__vbaVarDup
::004428CC:: 8D95 2CFFFFFF LEA EDX, [EBP-D4]
428F7:: 8D8D 3CFFFFFF LEA ECX, [EBP-C4]
::004428FD:: 51 PUSH ECX
::004428FE:: 8D95 4CFFFFFF LEA EDX, [EBP-B4]
::00442904:: 52 PUSH EDX
::00442905:: 8D85 5CFFFFFF LEA EAX, [EBP-A4]
::0044290B:: 50 PUSH EAX
::0044290C:: 6A 04 PUSH 4
::0044290E:: FF15 34104000 CALL [401034] >>>: MSVBVM60.DLL:__vbaFreeVarList
::00442914:: B8 3CA84000 MOV EAX, 40A83C \->: http://www.hzrj88.cn/userrecord/dsxxth/useronline0.asp
::00442919:: 8985 E4FEFFFF MOV [EBP-11C], EAX
00442919:: 8985 E4FEFFFF MOV [EBP-11C], EAX
::0044291F:: B9 08000000 MOV ECX, 8
::00442924:: 898D DCFEFFFF MOV [EBP-124], ECX
::0044292A:: 83C4 04 ADD ESP, 4
::0044292D:: 8BD4 MOV EDX, ESP
::0044292F:: 890A MOV [EDX], ECX
::00442931:: 8B8D E0FEFFFF MOV ECX, [EBP-120]
::00442937:: 894A 04 MOV [EDX+4], ECX
::0044293A:: 8942 08 MOV [EDX+8], EAX
::0044293D:: 8B85 E8FEFFFF MOV EAX, [EBP-118]
::00442943:: 8942 0C MOV [EDX+C], EAX
::00442946:: 6A 01 PUSH 1
::00442948:: 6A 68 PUSH 68
::0044294A:: 8B0F MOV ECX, [EDI]
::0044294C:: 57 PUSH EDI
::0044294D:: FF91 98040000 CALL [ECX+498]
::00442953:: 50 PUSH EAX
::00442954:: 8D95 78FFFFFF LEA EDX, [EBP-88]
::0044295A:: 52 PUSH EDX
::0044295B:: FFD3 CALL EBX
::0044295D:: 50 PUSH EAX
::0044295E:: FF15 2C104000 CALL [40102C] >>>: MSVBVM60.DLL:__vbaLateIdCall
::00442964:: 83C4 1C ADD ESP, 1C
::00442967:: 8D8D 78FFFFFF LEA ECX, [EBP-88]
::0044296D:: FF15 34134000 CALL [401334] >>>: MSVBVM60.DLL:__vbaFreeObj
::00442973:: 8B07 MOV EAX, [EDI]
::00442975:: 57 PUSH EDI
::00442976:: FF90 C4030000 CALL [EAX+3C4]
::0044297C:: 50 PUSH EAX
::0044297D:: 8D8D 78FFFFFF LEA ECX, [EBP-88]
::00442983:: 51 PUSH ECX
::00442984:: FFD3 CALL EBX
::00442986:: 8BF0 MOV ESI, EAX
::00442988:: 8B16 MOV EDX, [ESI]
::0044298A:: 68 ACB44000 PUSH 40B4AC \->: 正在验证,请稍等...
::0044298F:: 56 PUSH ESI
::00442990:: FF52 54 CALL [EDX+54]
::00442993:: DBE2 FCLEX
::00442995:: 85C0 TEST EAX, EAX
::00442997:: 0F8D 1C080000 JGE 004431B9 \:JMPDOWN
::0044299D:: 6A 54 PUSH 54
::0044299F:: 68 BCA74000 PUSH 40A7BC \->: 仙?暙???怀鏓.
::004429A4:: E9 08080000 JMP 004431B1 \:JMPDOWN
::004429A9:: FF90 C4030000 CALL [EAX+3C4] \:BYJMP JmpBy:004425E0,
::004429AF:: 50 PUSH EAX
::004429B0:: 8D8D 78FFFFFF LEA ECX, [EBP-88]
::004429B6:: 51 PUSH ECX
::004429B7:: FFD3 CALL EBX
::004429B9:: 8985 84FEFFFF MOV [EBP-17C], EAX
::004429BF:: 8B10 MOV EDX, [EAX]
::004429C1:: 68 ACA74000 PUSH 40A7AC \->: 错误的注册码!
:004429C6:: 50 PUSH EAX
::004429C7:: FF52 54 CALL [EDX+54]
::004429CA:: DBE2 FCLEX
::004429CC:: 85C0 TEST EAX, EAX
::004429CE:: 7D 15 JGE SHORT 004429E5 \:JMPDOWN
::004429D0:: 6A 54 PUSH 54
::004429D2:: 68 BCA74000 PUSH 40A7BC \->: 仙?暙???怀鏓.
::004429D7:: 8B8D 84FEFFFF MOV ECX, [EBP-17C]
::004429DD:: 51 PUSH ECX
::004429DE:: 50 PUSH EAX
::004429DF:: FF15 78104000 CALL [401078] >>>: MSVBVM60.DLL:__vbaHresultCheckObj
::004429E5:: 8D8D 78FFFFFF LEA ECX, [EBP-88] \:BYJMP JmpBy:004429CE,
::004429EB:: FF15 34134000 CALL [401334] >>>: MSVBVM60.DLL:__vbaFreeObj
::004429F1:: 8B17 MOV EDX, [EDI]
::004429F3:: 57 PUSH EDI
:004429F4:: FF92 70040000 CALL [EDX+470]
::004429FA:: 50 PUSH EAX
::004429FB:: 8D85 78FFFFFF LEA EAX, [EBP-88]
::00442A01:: 50 PUSH EAX
::00442A02:: FFD3 CALL EBX
::00442A04:: 8985 84FEFFFF MOV [EBP-17C], EAX
::00442A0A:: 8B08 MOV ECX, [EAX]
::00442A0C:: 68 D0A74000 PUSH 40A7D0 \->: QQ2009聊天记录远程查看器增强版 未注册
::00442A11:: 50 PUSH EAX
网络验证这里根本没有跳可以跳过去,直接NOP掉回让程序按注册就直接退出...按道理来说就算有网络验证也应该是错误的注册码,结果它却显示账号出现问题``