|
00557344 . 55 push ebp
00557345 . 68 09765500 push unpacked.00557609
0055734A . 64:FF30 push dword ptr fs:[eax]
0055734D . 64:8920 mov dword ptr fs:[eax],esp
00557350 . 8D55 DC lea edx,dword ptr ss:[ebp-24]
00557353 . 8B45 FC mov eax,dword ptr ss:[ebp-4]
00557356 . 8B80 F40200>mov eax,dword ptr ds:[eax+2F4]
0055735C . E8 4B72EFFF call unpacked.0044E5AC
00557361 . 8B45 DC mov eax,dword ptr ss:[ebp-24]
00557364 . E8 9BD8EAFF call unpacked.00404C04
00557369 . 83F8 08 cmp eax,8 --------用户名是否等于8位
0055736C . 74 25 je short unpacked.00557393 --------不是则提示用户名错误
0055736E . BA 20765500 mov edx,unpacked.00557620
00557373 . B8 30765500 mov eax,unpacked.00557630
00557378 . E8 1797FBFF call unpacked.00510A94
0055737D . 8B45 FC mov eax,dword ptr ss:[ebp-4]
00557380 . 8B80 F40200>mov eax,dword ptr ds:[eax+2F4]
00557386 . 8B10 mov edx,dword ptr ds:[eax]
00557388 . FF92 C00000>call dword ptr ds:[edx+C0]
0055738E . E9 46020000 jmp unpacked.005575D9
00557393 > 33C0 xor eax,eax
00557395 . 55 push ebp
00557396 . 68 C6735500 push unpacked.005573C6
0055739B . 64:FF30 push dword ptr fs:[eax]
0055739E . 64:8920 mov dword ptr fs:[eax],esp
005573A1 . 8D55 D8 lea edx,dword ptr ss:[ebp-28]
005573A4 . 8B45 FC mov eax,dword ptr ss:[ebp-4]
005573A7 . 8B80 F40200>mov eax,dword ptr ds:[eax+2F4]
005573AD . E8 FA71EFFF call unpacked.0044E5AC
005573B2 . 8B45 D8 mov eax,dword ptr ss:[ebp-28]
005573B5 . E8 2A3FEBFF call unpacked.0040B2E4 -----------判断是否为纯数字。不是则提示用户名出错
现在很清楚了可以知道。软件是以8位纯数字当用户名
``````````````````````````````````````````````````````````````````````````````````````````````````````````
软件算法是f1(用户名)=f2(注册码) 这种算法没有明文比较。
0055746D . E8 3A71EFFF call unpacked.0044E5AC -----取用户名
00557472 . 8B45 D0 mov eax,dword ptr ss:[ebp-30] -----用户名入eax
00557475 . E8 1E21EBFF call unpacked.00409598 -----算法call f7跟进
0055747A . 8945 E8 mov dword ptr ss:[ebp-18],eax -----把用户名经过处理后的值入栈
0055747D . 8955 EC mov dword ptr ss:[ebp-14],edx
00557480 . 8D55 CC lea edx,dword ptr ss:[ebp-34]
00557483 . 8B45 FC mov eax,dword ptr ss:[ebp-4]
00557486 . 8B80 FC0200>mov eax,dword ptr ds:[eax+2FC]
0055748C . E8 1B71EFFF call unpacked.0044E5AC -----取注册码
00557491 . 8B45 CC mov eax,dword ptr ss:[ebp-34] -----注册码存入eax
00557494 . E8 FF20EBFF call unpacked.00409598 -----又是算法call跟上面的一样
00557499 . 8945 E0 mov dword ptr ss:[ebp-20],eax -----把注册码经过处理后的值入栈
0055749C . 8955 E4 mov dword ptr ss:[ebp-1C],edx
0055749F . 8B45 E0 mov eax,dword ptr ss:[ebp-20] -----把注册码经过外理后的值存入eax
005574A2 . 8B55 E4 mov edx,dword ptr ss:[ebp-1C]
005574A5 . 81F0 C4B3A2>xor eax,1A2B3C4 -----把注册码经过外理后的值与1a2b3c4异或
005574AB . 81F2 000000>xor edx,0
005574B1 . 8945 E0 mov dword ptr ss:[ebp-20],eax ----- 经过异或后的值入栈
005574B4 . 8955 E4 mov dword ptr ss:[ebp-1C],edx
005574B7 . 6A 00 push 0
005574B9 . 6A 13 push 13
005574BB . 8B45 E8 mov eax,dword ptr ss:[ebp-18] 把用户名经过处理后的值出栈存入eax
005574BE . 8B55 EC mov edx,dword ptr ss:[ebp-14]
005574C1 . E8 CAE4EAFF call unpacked.00405990 eax=eax*13
005574C6 . 8B0D 484557>mov ecx,dword ptr ds:[574548] ; unpacked.00575F0C
005574CC . 0301 add eax,dword ptr ds:[ecx] eax=eax+bc614a 这个bc614a是个常数
005574CE . 1351 04 adc edx,dword ptr ds:[ecx+4]
005574D1 . 3B55 E4 cmp edx,dword ptr ss:[ebp-1C]
005574D4 . 75 03 jnz short unpacked.005574D9
005574D6 . 3B45 E0 cmp eax,dword ptr ss:[ebp-20] ------这里是比较f1(用户名)是不等于f2(注册码)
005574D9 > 74 14 je short unpacked.005574EF ------ 是就跳转到写注册表后再次判断
如果这里爆破会把用户名与注册码存入注册表再次读出判断
因无法TNT，只有追注册码了 :(
005574DB . BA 20765500 mov edx,unpacked.00557620
005574E0 . B8 44765500 mov eax,unpacked.00557644
005574E5 . E8 AA95FBFF call unpacked.00510A94 -----出错提示
005574EA . E9 EA000000 jmp unpacked.005575D9
005574EF > 8D55 F8 lea edx,dword ptr ss:[ebp-8]
005574F2 . 8B45 FC mov eax,dword ptr ss:[ebp-4]
005574F5 . 8B80 F40200>mov eax,dword ptr ds:[eax+2F4]
005574FB . E8 AC70EFFF call unpacked.0044E5AC
00557500 . 8D55 F4 lea edx,dword ptr ss:[ebp-C]
00557503 . 8B45 FC mov eax,dword ptr ss:[ebp-4]
00557506 . 8B80 FC0200>mov eax,dword ptr ds:[eax+2FC]
0055750C . E8 9B70EFFF call unpacked.0044E5AC
00557511 . B2 01 mov dl,1
00557513 . A1 2C0E4700 mov eax,dword ptr ds:[470E2C]
00557518 . E8 0F9AF1FF call unpacked.00470F2C
0055751D . 8BD8 mov ebx,eax
0055751F . BA 02000080 mov edx,80000002
00557524 . 8BC3 mov eax,ebx
00557526 . E8 A19AF1FF call unpacked.00470FCC
0055752B . BA 50765500 mov edx,unpacked.00557650 ; ASCII 10,"Software\Wmsoft\"
00557530 . 8D45 A0 lea eax,dword ptr ss:[ebp-60]
00557533 . E8 94BCEAFF call unpacked.004031CC
00557538 . 8B15 1C4357>mov edx,dword ptr ds:[57431C] ; unpacked.00575EF4
0055753E . 8D45 A0 lea eax,dword ptr ss:[ebp-60]
00557541 . B1 24 mov cl,24
00557543 . E8 54BCEAFF call unpacked.0040319C
00557548 . 8D55 A0 lea edx,dword ptr ss:[ebp-60]
0055754B . 8D45 C8 lea eax,dword ptr ss:[ebp-38]
0055754E . E8 55D6EAFF call unpacked.00404BA8
00557553 . 8B55 C8 mov edx,dword ptr ss:[ebp-38]
00557556 . 33C9 xor ecx,ecx
00557558 . 8BC3 mov eax,ebx
0055755A . E8 AD9BF1FF call unpacked.0047110C
0055755F . 84C0 test al,al
00557561 . 74 1E je short unpacked.00557581
00557563 . 8B4D F8 mov ecx,dword ptr ss:[ebp-8]
00557566 . BA 6C765500 mov edx,unpacked.0055766C ; ASCII "ID1"
0055756B . 8BC3 mov eax,ebx
0055756D . E8 369DF1FF call unpacked.004712A8
00557572 . 8B4D F4 mov ecx,dword ptr ss:[ebp-C]
00557575 . BA 78765500 mov edx,unpacked.00557678 ; ASCII "ID2"
0055757A . 8BC3 mov eax,ebx
0055757C . E8 279DF1FF call unpacked.004712A8
00557581 > 8BC3 mov eax,ebx
00557583 . E8 58C6EAFF call unpacked.00403BE0
00557588 . E8 0392FBFF call unpacked.00510790
0055758D . A1 D03D5700 mov eax,dword ptr ds:[573DD0]
00557592 . 8038 00 cmp byte ptr ds:[eax],0
00557595 . 74 22 je short unpacked.005575B9
00557597 . BA 20765500 mov edx,unpacked.00557620
0055759C . B8 84765500 mov eax,unpacked.00557684
005575A1 . E8 8E94FBFF call unpacked.00510A34
005575A6 . 8B45 FC mov eax,dword ptr ss:[ebp-4]
005575A9 . 8B80 0C0300>mov eax,dword ptr ds:[eax+30C]
005575AF . 8B10 mov edx,dword ptr ds:[eax]
005575B1 . FF92 C00000>call dword ptr ds:[edx+C0]
005575B7 . EB 20 jmp short unpacked.005575D9
005575B9 > BA 20765500 mov edx,unpacked.00557620
005575BE . B8 98765500 mov eax,unpacked.00557698
005575C3 . E8 CC94FBFF call unpacked.00510A94
005575C8 . 8B45 FC mov eax,dword ptr ss:[ebp-4]
005575CB . 8B80 FC0200>mov eax,dword ptr ds:[eax+2FC]
005575D1 . 8B10 mov edx,dword ptr ds:[eax]
005575D3 . FF92 C00000>call dword ptr ds:[edx+C0]
005575D9 > 33C0 xor eax,eax
005575DB . 5A pop edx
005575DC . 59 pop ecx
005575DD . 59 pop ecx
005575DE . 64:8910 mov dword ptr fs:[eax],edx
005575E1 . 68 10765500 push unpacked.00557610
005575E6 > 8D45 C8 lea eax,dword ptr ss:[ebp-38]
005575E9 . E8 5ED3EAFF call unpacked.0040494C
005575EE . 8D45 CC lea eax,dword ptr ss:[ebp-34]
005575F1 . BA 05000000 mov edx,5
005575F6 . E8 75D3EAFF call unpacked.00404970
005575FB . 8D45 F4 lea eax,dword ptr ss:[ebp-C]
005575FE . BA 02000000 mov edx,2
00557603 . E8 68D3EAFF call unpacked.00404970
00557608 . C3 retn
00557609 .^ E9 66CDEAFF jmp unpacked.00404374
0055760E .^ EB D6 jmp short unpacked.005575E6
00557610 . 5F pop edi
00557611 . 5E pop esi
00557612 . 5B pop ebx
00557613 . 8BE5 mov esp,ebp
00557615 . 5D pop ebp
00557616 . C3 retn
```````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````
这是上面00557475处的算法call
00409598 /$ 53 push ebx
00409599 |. 83C4 EC add esp,-14
0040959C |. 8BD8 mov ebx,eax
0040959E |. 8D5424 08 lea edx,dword ptr ss:[esp+8]
004095A2 |. 8BC3 mov eax,ebx
004095A4 |. E8 BBC6FFFF call unpacked.00405C64 ------这才是算法的关建call f7跟进
004095A9 |. 890424 mov dword ptr ss:[esp],eax
004095AC |. 895424 04 mov dword ptr ss:[esp+4],edx
004095B0 |. 837C24 08 0>cmp dword ptr ss:[esp+8],0
004095B5 |. 74 19 je short unpacked.004095D0
004095B7 |. 895C24 0C mov dword ptr ss:[esp+C],ebx
004095BB |. C64424 10 0>mov byte ptr ss:[esp+10],0B
004095C0 |. 8D5424 0C lea edx,dword ptr ss:[esp+C]
004095C4 |. A1 E43E5700 mov eax,dword ptr ds:[573EE4]
004095C9 |. 33C9 xor ecx,ecx
004095CB |. E8 80F8FFFF call unpacked.00408E50
004095D0 |> 8B0424 mov eax,dword ptr ss:[esp]
004095D3 |. 8B5424 04 mov edx,dword ptr ss:[esp+4]
004095D7 |. 83C4 14 add esp,14
004095DA |. 5B pop ebx
004095DB \. C3 retn
`````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````
算法call
00405C64 /$ 53 push ebx
00405C65 |. 56 push esi
00405C66 |. 57 push edi
00405C67 |. 55 push ebp
00405C68 |. 83C4 EC add esp,-14
00405C6B |. 891424 mov dword ptr ss:[esp],edx
00405C6E |. 8BF0 mov esi,eax
00405C70 |. BD 01000000 mov ebp,1
00405C75 |. 33FF xor edi,edi
00405C77 |. C74424 08 0>mov dword ptr ss:[esp+8],0
00405C7F |. C74424 0C 0>mov dword ptr ss:[esp+C],0
00405C87 |. 85F6 test esi,esi
00405C89 |. 75 0B jnz short unpacked.00405C96
00405C8B |. 8B0424 mov eax,dword ptr ss:[esp]
00405C8E |. 8928 mov dword ptr ds:[eax],ebp
00405C90 |. E9 E1010000 jmp unpacked.00405E76
00405C95 |> 45 /inc ebp
00405C96 |> 807C2E FF 2> cmp byte ptr ds:[esi+ebp-1],20
00405C9B |.^ 74 F8 \je short unpacked.00405C95
00405C9D |. C64424 10 0>mov byte ptr ss:[esp+10],0
00405CA2 |. 8A442E FF mov al,byte ptr ds:[esi+ebp-1]
00405CA6 |. 3C 2D cmp al,2D
00405CA8 |. 75 08 jnz short unpacked.00405CB2
00405CAA |. C64424 10 0>mov byte ptr ss:[esp+10],1
00405CAF |. 45 inc ebp
00405CB0 |. EB 05 jmp short unpacked.00405CB7
00405CB2 |> 3C 2B cmp al,2B
00405CB4 |. 75 01 jnz short unpacked.00405CB7
00405CB6 |. 45 inc ebp
00405CB7 |> B3 01 mov bl,1
00405CB9 |. 807C2E FF 2>cmp byte ptr ds:[esi+ebp-1],24
00405CBE |. 74 1B je short unpacked.00405CDB
00405CC0 |. 807C2E FF 3>cmp byte ptr ds:[esi+ebp-1],30
00405CC5 |. 0F85 DA0000>jnz unpacked.00405DA5
00405CCB |. 8A042E mov al,byte ptr ds:[esi+ebp]
00405CCE |. E8 81D0FFFF call unpacked.00402D54
00405CD3 |. 3C 58 cmp al,58
00405CD5 |. 0F85 CA0000>jnz unpacked.00405DA5
00405CDB |> 807C2E FF 3>cmp byte ptr ds:[esi+ebp-1],30
00405CE0 |. 75 01 jnz short unpacked.00405CE3
00405CE2 |. 45 inc ebp
00405CE3 |> 45 inc ebp
00405CE4 |> 8A442E FF /mov al,byte ptr ds:[esi+ebp-1]
00405CE8 |. 8BD0 |mov edx,eax
00405CEA |. 80C2 D0 |add dl,0D0 ; Switch (cases FFFFFD61..FFFFFF39)
00405CED |. 80EA 0A |sub dl,0A
00405CF0 |. 72 12 |jb short unpacked.00405D04
00405CF2 |. 80C2 F9 |add dl,0F9
00405CF5 |. 80EA 06 |sub dl,6
00405CF8 |. 72 17 |jb short unpacked.00405D11
00405CFA |. 80C2 E6 |add dl,0E6
00405CFD |. 80EA 06 |sub dl,6
00405D00 |. 72 1C |jb short unpacked.00405D1E
00405D02 |. EB 7A |jmp short unpacked.00405D7E
00405D04 |> 8BF8 |mov edi,eax ; Cases FFFFFF30,FFFFFF31,FFFFFF32,FFFFFF33,FFFFFF34,FFFFFF35,FFFFFF36,FFFFFF37,FFFFFF38,FFFFFF39 of switch 00405CEA
00405D06 |. 81E7 FF0000>|and edi,0FF
00405D0C |. 83EF 30 |sub edi,30
00405D0F |. EB 18 |jmp short unpacked.00405D29
00405D11 |> 8BF8 |mov edi,eax ; Cases FFFFFE41,FFFFFE42,FFFFFE43,FFFFFE44,FFFFFE45,FFFFFE46 of switch 00405CEA
00405D13 |. 81E7 FF0000>|and edi,0FF
00405D19 |. 83EF 37 |sub edi,37
00405D1C |. EB 0B |jmp short unpacked.00405D29
00405D1E |> 8BF8 |mov edi,eax ; Cases FFFFFD61,FFFFFD62,FFFFFD63,FFFFFD64,FFFFFD65,FFFFFD66 of switch 00405CEA
00405D20 |. 81E7 FF0000>|and edi,0FF
00405D26 |. 83EF 57 |sub edi,57
00405D29 |> 837C24 0C 0>|cmp dword ptr ss:[esp+C],0
00405D2E |. 75 09 |jnz short unpacked.00405D39
00405D30 |. 837C24 08 0>|cmp dword ptr ss:[esp+8],0
00405D35 |. 72 47 |jb short unpacked.00405D7E
00405D37 |. EB 02 |jmp short unpacked.00405D3B
00405D39 |> 7C 43 |jl short unpacked.00405D7E
00405D3B |> 817C24 0C F>|cmp dword ptr ss:[esp+C],0FFFFFFF
00405D43 |. 75 09 |jnz short unpacked.00405D4E
00405D45 |. 837C24 08 F>|cmp dword ptr ss:[esp+8],-1
00405D4A |. 76 04 |jbe short unpacked.00405D50
00405D4C |. EB 30 |jmp short unpacked.00405D7E
00405D4E |> 7F 2E |jg short unpacked.00405D7E
00405D50 |> 8BC7 |mov eax,edi
00405D52 |. 99 |cdq
00405D53 |. 52 |push edx
00405D54 |. 50 |push eax
00405D55 |. 8B4424 10 |mov eax,dword ptr ss:[esp+10]
00405D59 |. 8B5424 14 |mov edx,dword ptr ss:[esp+14]
00405D5D |. 0FA4C2 04 |shld edx,eax,4
00405D61 |. C1E0 04 |shl eax,4
00405D64 |. 030424 |add eax,dword ptr ss:[esp]
00405D67 |. 135424 04 |adc edx,dword ptr ss:[esp+4]
00405D6B |. 83C4 08 |add esp,8
00405D6E |. 894424 08 |mov dword ptr ss:[esp+8],eax
00405D72 |. 895424 0C |mov dword ptr ss:[esp+C],edx
00405D76 |. 45 |inc ebp
00405D77 |. 33DB |xor ebx,ebx
00405D79 |.^ E9 66FFFFFF \jmp unpacked.00405CE4
00405D7E |> 807C24 10 0>cmp byte ptr ss:[esp+10],0 ; Default case of switch 00405CEA
00405D83 |. 0F84 D30000>je unpacked.00405E5C
00405D89 |. 8B4424 08 mov eax,dword ptr ss:[esp+8]
00405D8D |. 8B5424 0C mov edx,dword ptr ss:[esp+C]
00405D91 |. F7D8 neg eax
00405D93 |. 83D2 00 adc edx,0
00405D96 |. F7DA neg edx
00405D98 |. 894424 08 mov dword ptr ss:[esp+8],eax
00405D9C |. 895424 0C mov dword ptr ss:[esp+C],edx
00405DA0 |. E9 B7000000 jmp unpacked.00405E5C
00405DA5 |> 8A442E FF /mov al,byte ptr ds:[esi+ebp-1]
00405DA9 |. 8BD0 |mov edx,eax
00405DAB |. 80C2 D0 |add dl,0D0
00405DAE |. 80EA 0A |sub dl,0A
00405DB1 |. 73 62 |jnb short unpacked.00405E15
00405DB3 |. 8BF8 |mov edi,eax
00405DB5 |. 81E7 FF0000>|and edi,0FF
00405DBB |. 83EF 30 |sub edi,30
00405DBE |. 837C24 0C 0>|cmp dword ptr ss:[esp+C],0
00405DC3 |. 75 09 |jnz short unpacked.00405DCE
00405DC5 |. 837C24 08 0>|cmp dword ptr ss:[esp+8],0
00405DCA |. 72 49 |jb short unpacked.00405E15
00405DCC |. EB 02 |jmp short unpacked.00405DD0
00405DCE |> 7C 45 |jl short unpacked.00405E15
00405DD0 |> 817C24 0C C>|cmp dword ptr ss:[esp+C],0CCCCCCC
00405DD8 |. 75 0C |jnz short unpacked.00405DE6
00405DDA |. 817C24 08 C>|cmp dword ptr ss:[esp+8],CCCCCCCC
00405DE2 |. 76 04 |jbe short unpacked.00405DE8
00405DE4 |. EB 2F |jmp short unpacked.00405E15
00405DE6 |> 7F 2D |jg short unpacked.00405E15
00405DE8 |> 6A 00 |push 0
00405DEA |. 6A 0A |push 0A
00405DEC |. 8B4424 10 |mov eax,dword ptr ss:[esp+10]
00405DF0 |. 8B5424 14 |mov edx,dword ptr ss:[esp+14]
00405DF4 |. E8 97FBFFFF |call unpacked.00405990
00405DF9 |. 52 |push edx
00405DFA |. 50 |push eax
00405DFB |. 8BC7 |mov eax,edi
00405DFD |. 99 |cdq
00405DFE |. 030424 |add eax,dword ptr ss:[esp]
00405E01 |. 135424 04 |adc edx,dword ptr ss:[esp+4]
00405E05 |. 83C4 08 |add esp,8
00405E08 |. 894424 08 |mov dword ptr ss:[esp+8],eax
00405E0C |. 895424 0C |mov dword ptr ss:[esp+C],edx
00405E10 |. 45 |inc ebp
00405E11 |. 33DB |xor ebx,ebx
00405E13 |.^ EB 90 \jmp short unpacked.00405DA5
00405E15 |> 807C24 10 0>cmp byte ptr ss:[esp+10],0
00405E1A |. 74 17 je short unpacked.00405E33
00405E1C |. 8B4424 08 mov eax,dword ptr ss:[esp+8]
00405E20 |. 8B5424 0C mov edx,dword ptr ss:[esp+C]
00405E24 |. F7D8 neg eax
00405E26 |. 83D2 00 adc edx,0
00405E29 |. F7DA neg edx
00405E2B |. 894424 08 mov dword ptr ss:[esp+8],eax
00405E2F |. 895424 0C mov dword ptr ss:[esp+C],edx
00405E33 |> 837C24 0C 0>cmp dword ptr ss:[esp+C],0
00405E38 |. 75 05 jnz short unpacked.00405E3F
00405E3A |. 837C24 08 0>cmp dword ptr ss:[esp+8],0
00405E3F |> 74 1B je short unpacked.00405E5C
00405E41 |. 837C24 0C 0>cmp dword ptr ss:[esp+C],0
00405E46 |. 75 0A jnz short unpacked.00405E52
00405E48 |. 837C24 08 0>cmp dword ptr ss:[esp+8],0
00405E4D |. 0F92C0 setb al
00405E50 |. EB 03 jmp short unpacked.00405E55
00405E52 |> 0F9CC0 setl al
00405E55 |> 3A4424 10 cmp al,byte ptr ss:[esp+10]
00405E59 |. 74 01 je short unpacked.00405E5C
00405E5B |. 4D dec ebp
00405E5C |> 807C2E FF 0>cmp byte ptr ds:[esi+ebp-1],0
00405E61 |. 0F95C0 setne al
00405E64 |. 0AD8 or bl,al
00405E66 |. 74 07 je short unpacked.00405E6F
00405E68 |. 8B0424 mov eax,dword ptr ss:[esp]
00405E6B |. 8928 mov dword ptr ds:[eax],ebp
00405E6D |. EB 07 jmp short unpacked.00405E76
00405E6F |> 8B0424 mov eax,dword ptr ss:[esp]
00405E72 |. 33D2 xor edx,edx
00405E74 |. 8910 mov dword ptr ds:[eax],edx
00405E76 |> 8B4424 08 mov eax,dword ptr ss:[esp+8]
00405E7A |. 8B5424 0C mov edx,dword ptr ss:[esp+C]
00405E7E |. 83C4 14 add esp,14
00405E81 |. 5D pop ebp
00405E82 |. 5F pop edi
00405E83 |. 5E pop esi
00405E84 |. 5B pop ebx
00405E85 \. C3 retn
````````````````````````````````````````````````````````````````````````````````用户名第一位与A相乘再加第二位的和再乘A再加第三位```````
````````````````````````````````````````````````````````````````
用户名:87654321
注册码=((8*a+7)*a+6....+1)*13+bc614a) xor 1a2b3c4 = 65A268A9 = 1705142441
唉。我的表达能力很有限。请多谅解~~~~~~~~~~~~~~~~！
OVER
|
