批量檔案設定器 V2.2a (18千字)

標題: 剛剛寫完破解過程請大家指教!寫錯了應該是Caspr1.010,請問如何知道是用什麼版本的Aspack加的殼,我只能檢測到是Aspack加的殼,但不知道是什麼版本的!

內容:
軟體名稱: 批量檔案設定器 V2.2a
檔案大小: 1228KB
下載地址: http://www.cnvnet.com/download/d/fo22a.exe
除錯工具：SoftICE 4.05 Caspr1.1 DeDe fi
除錯平臺：Win98、W32dsm89
軟體簡介：
    在WINDOWS的使用中，經常要用到對批量的檔案進行屬性更改，例如從盤複製過來的檔案，要去了只讀屬性；又有時要對某些檔案，如自寫的程式，某些特殊用途的檔案等的建立日期進行設定，以保持文件與檔案的時間一致性；又有時要將某些檔案按要求一一改名，而且方法、要求奇特，數量巨大。所有的這些，《批量檔案設定器》均能幫你一一搞定。

該軟體用Delphi5編寫，執行檔案有Aspack加密（版本不清楚），用Caspr1.1版本可直接脫殼。脫殼後用DeDe反編譯可找到註冊窗體，註冊部分程式碼如下：

procedure TFormReg.BtnOKClick(Sender: TObject);
begin

004AA8A0 55 push ebp
004AA8A1 8BEC mov ebp, esp
004AA8A3 B90D000000 mov ecx, $0000000D
004AA8A8 6A00 push $00
004AA8AA 6A00 push $00
004AA8AC 49 dec ecx
004AA8AD 75F9 jnz 004AA8A8
004AA8AF 51 push ecx
004AA8B0 53 push ebx
004AA8B1 56 push esi
004AA8B2 57 push edi
004AA8B3 8945FC mov [ebp-$04], eax
004AA8B6 8D7DE6 lea edi, [ebp-$1A]
004AA8B9 33C0 xor eax, eax
004AA8BB 55 push ebp

* Possible String Reference to: '?腚_^[]門課募柚悶?
|
004AA8BC 68D2AC4A00 push $004AACD2

***** TRY
|
004AA8C1 64FF30 push dword ptr fs:[eax]
004AA8C4 648920 mov fs:[eax], esp
004AA8C7 8D55E0 lea edx, [ebp-$20]

* Reference to FormReg
|
004AA8CA 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AA8CD 8B80DC020000 mov eax, [eax+$02DC]

|
004AA8D3 E81483F8FF call 00432BEC
004AA8D8 8B45E0 mov eax, [ebp-$20]

|
004AA8DB E80897F5FF call 00403FE8
004AA8E0 83F802 cmp eax, +$02
004AA8E3 7C1E jl 004AA903
004AA8E5 8D55DC lea edx, [ebp-$24]

* Reference to FormReg
|
004AA8E8 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AA8EB 8B80E0020000 mov eax, [eax+$02E0]

|
004AA8F1 E8F682F8FF call 00432BEC
004AA8F6 8B45DC mov eax, [ebp-$24]

|
004AA8F9 E8EA96F5FF call 00403FE8
004AA8FE 83F802 cmp eax, +$02
004AA901 7D1F jnl 004AA922
004AA903 6A10 push $10

* Possible String Reference to: '批量檔案設定器'
|
004AA905 68E0AC4A00 push $004AACE0

* Possible String Reference to: '使用者名稱或公司名，請不短於兩位（一個?
| 鶴鄭?
|
004AA90A 68F0AC4A00 push $004AACF0

* Reference to FormReg
|
004AA90F 8B45FC mov eax, [ebp-$04]

|
004AA912 E8E9E4F8FF call 00438E00
004AA917 50 push eax

* Reference to: user32.MessageBoxA()
|
004AA918 E8B7CAF5FF call 004073D4
004AA91D E995030000 jmp 004AACB7
004AA922 B301 mov bl, $01
004AA924 8BF7 mov esi, edi
004AA926 8D45D8 lea eax, [ebp-$28]
004AA929 50 push eax
004AA92A 8D55D4 lea edx, [ebp-$2C]

* Reference to FormReg
|
004AA92D 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditCode : TEdit
|
004AA930 8B80E8020000 mov eax, [eax+$02E8]

|
004AA936 E8B182F8FF call 00432BEC
004AA93B 8B45D4 mov eax, [ebp-$2C]
004AA93E 33D2 xor edx, edx
004AA940 8AD3 mov dl, bl
004AA942 8D1452 lea edx, [edx+edx*2]
004AA945 83EA02 sub edx, +$02
004AA948 B903000000 mov ecx, $00000003

|
004AA94D E89E98F5FF call 004041F0
004AA952 8B45D8 mov eax, [ebp-$28]
004AA955 33D2 xor edx, edx

| 依次取得3位註冊碼
004AA957 E814E2F5FF call 00408B70  //將取得的3位註冊碼轉換成數值
004AA95C 668906 mov [esi], ax      //講轉換結果存於esi所指記憶體
004AA95F 43 inc ebx
004AA960 83C602 add esi, +$02
004AA963 80FB09 cmp bl, $09      //是否取得8次
004AA966 75BE jnz 004AA926        //未到這跳轉
004AA968 33F6 xor esi, esi        //esi清0
004AA96A 8D55D0 lea edx, [ebp-$30]

* Reference to FormReg
|
004AA96D 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AA970 8B80DC020000 mov eax, [eax+$02DC]

|
004AA976 E87182F8FF call 00432BEC
004AA97B 8B45D0 mov eax, [ebp-$30]

|
004AA97E E86596F5FF call 00403FE8  //取得使用者名稱長度
004AA983 84C0 test al, al
004AA985 765F jbe 004AA9E6
004AA987 8845F7 mov [ebp-$09], al //存於[ebp-$09]
004AA98A B301 mov bl, $01
004AA98C 8D55CC lea edx, [ebp-$34]

* Reference to FormReg
|
004AA98F 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AA992 8B80DC020000 mov eax, [eax+$02DC]

|
004AA998 E84F82F8FF call 00432BEC
004AA99D 8B45CC mov eax, [ebp-$34]
004AA9A0 33D2 xor edx, edx
004AA9A2 8AD3 mov dl, bl
004AA9A4 0FB64410FF movzx eax, byte ptr [eax+edx-$01] //依次取得使用者名稱
004AA9A9 B914000000 mov ecx, $00000014
004AA9AE 33D2 xor edx, edx
004AA9B0 F7F1 div ecx
004AA9B2 50 push eax  //保留商
004AA9B3 8D55C8 lea edx, [ebp-$38]

* Reference to FormReg
|
004AA9B6 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AA9B9 8B80DC020000 mov eax, [eax+$02DC]

|
004AA9BF E82882F8FF call 00432BEC
004AA9C4 8B45C8 mov eax, [ebp-$38]
004AA9C7 33D2 xor edx, edx
004AA9C9 8AD3 mov dl, bl
004AA9CB 0FB64410FF movzx eax, byte ptr [eax+edx-$01] //取相同使用者名稱
004AA9D0 B90D000000 mov ecx, $0000000D
004AA9D5 33D2 xor edx, edx
004AA9D7 F7F1 div ecx  //保留餘數在edx中
004AA9D9 58 pop eax    //彈出保留的商
004AA9DA 6603C2 add ax, dx  //餘數+商
004AA9DD 6603F0 add si, ax  //加到si
004AA9E0 43 inc ebx
004AA9E1 FE4DF7 dec byte ptr [ebp-$09] //使用者名稱是否讀完
004AA9E4 75A6 jnz 004AA98C //否，繼續累加
004AA9E6 6683FE6F cmp si, +$6F  //累加值是否大於$6f
004AA9EA 7604 jbe 004AA9F0      //小於則跳過 
004AA9EC 66BE6F00 mov si, $006F //大於則 si=$6f
004AA9F0 8D55C4 lea edx, [ebp-$3C]  //si將和第五組註冊碼比較
                                    //下面程式不影響si的值
* Reference to FormReg
|
004AA9F3 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AA9F6 8B80DC020000 mov eax, [eax+$02DC]

|
004AA9FC E8EB81F8FF call 00432BEC
004AAA01 8B45C4 mov eax, [ebp-$3C]
004AAA04 33DB xor ebx, ebx

* Reference to field TEdit.OFFS_0001
|
004AAA06 8A5801 mov bl, byte ptr [eax+$01]  //取第二位使用者名稱
004AAA09 8D55C0 lea edx, [ebp-$40]

* Reference to FormReg
|
004AAA0C 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AAA0F 8B80E0020000 mov eax, [eax+$02E0]

|
004AAA15 E8D281F8FF call 00432BEC
004AAA1A 8B45C0 mov eax, [ebp-$40]
004AAA1D 0FB64001 movzx eax, byte ptr [eax+$01] /取第二位公司名
004AAA21 03D8 add ebx, eax  //相加
004AAA23 0FB707 movzx eax, word ptr [edi] //取頭三位註冊碼的值
004AAA26 3BD8 cmp ebx, eax    //是否相等
004AAA28 0F8502010000 jnz 004AAB30 //不等就完了
004AAA2E 8D55BC lea edx, [ebp-$44]

* Reference to FormReg
|
004AAA31 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AAA34 8B80DC020000 mov eax, [eax+$02DC]

|
004AAA3A E8AD81F8FF call 00432BEC
004AAA3F 8B45BC mov eax, [ebp-$44]
004AAA42 33DB xor ebx, ebx
004AAA44 8A18 mov bl, byte ptr [eax]  //取第一位使用者名稱
004AAA46 8D55B8 lea edx, [ebp-$48]

* Reference to FormReg
|
004AAA49 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AAA4C 8B80E0020000 mov eax, [eax+$02E0]

|
004AAA52 E89581F8FF call 00432BEC
004AAA57 8B45B8 mov eax, [ebp-$48]
004AAA5A 0FB600 movzx eax, byte ptr [eax] //取第一位公司名
004AAA5D 03D8 add ebx, eax //相加
004AAA5F 0FB74702 movzx eax, word ptr [edi+$02] //取下面三位註冊碼的值
004AAA63 3BD8 cmp ebx, eax  //比腳
004AAA65 0F85C5000000 jnz 004AAB30 //同上
004AAA6B 8D55B4 lea edx, [ebp-$4C]

* Reference to FormReg
|
004AAA6E 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AAA71 8B80DC020000 mov eax, [eax+$02DC]

|
004AAA77 E87081F8FF call 00432BEC
004AAA7C 8B45B4 mov eax, [ebp-$4C]
004AAA7F 33DB xor ebx, ebx
004AAA81 8A18 mov bl, byte ptr [eax] //取第一位使用者名稱
004AAA83 8D55B0 lea edx, [ebp-$50]

* Reference to FormReg
|
004AAA86 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AAA89 8B80DC020000 mov eax, [eax+$02DC]

|
004AAA8F E85881F8FF call 00432BEC
004AAA94 8B45B0 mov eax, [ebp-$50]
004AAA97 0FB64001 movzx eax, byte ptr [eax+$01] //取第二位使用者名稱
004AAA9B 03D8 add ebx, eax //相加
004AAA9D 0FB74704 movzx eax, word ptr [edi+$04]  //和下一組註冊碼比較
004AAAA1 3BD8 cmp ebx, eax
004AAAA3 0F8587000000 jnz 004AAB30
004AAAA9 8D55AC lea edx, [ebp-$54]

* Reference to FormReg
|
004AAAAC 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AAAAF 8B80E0020000 mov eax, [eax+$02E0]

|
004AAAB5 E83281F8FF call 00432BEC
004AAABA 8B45AC mov eax, [ebp-$54]
004AAABD 33DB xor ebx, ebx
004AAABF 8A18 mov bl, byte ptr [eax] //取第一位公司名
004AAAC1 8D55A8 lea edx, [ebp-$58]

* Reference to FormReg
|
004AAAC4 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AAAC7 8B80E0020000 mov eax, [eax+$02E0]

|
004AAACD E81A81F8FF call 00432BEC
004AAAD2 8B45A8 mov eax, [ebp-$58]
004AAAD5 0FB64001 movzx eax, byte ptr [eax+$01] //取第二位公司名
004AAAD9 03D8 add ebx, eax
004AAADB 0FB74706 movzx eax, word ptr [edi+$06]
004AAADF 3BD8 cmp ebx, eax
004AAAE1 754D jnz 004AAB30                      //這裡同上
004AAAE3 0FB707 movzx eax, word ptr [edi] //edi指向轉換過的註冊碼
004AAAE6 0FB75702 movzx edx, word ptr [edi+$02]
004AAAEA 03C2 add eax, edx
004AAAEC 0FB75704 movzx edx, word ptr [edi+$04]
004AAAF0 03C2 add eax, edx
004AAAF2 0FB75706 movzx edx, word ptr [edi+$06]
004AAAF6 03C2 add eax, edx    //前四組相加
004AAAF8 0FB75708 movzx edx, word ptr [edi+$08]
004AAAFC 0FB74F0A movzx ecx, word ptr [edi+$0A]
004AAB00 03D1 add edx, ecx
004AAB02 0FB74F0C movzx ecx, word ptr [edi+$0C]
004AAB06 03D1 add edx, ecx
004AAB08 0FB74F0E movzx ecx, word ptr [edi+$0E]
004AAB0C 03D1 add edx, ecx  //後四組相加
004AAB0E 3BC2 cmp eax, edx
004AAB10 751E jnz 004AAB30
004AAB12 663B7708 cmp si, word ptr [edi+$08]  //比較si和第5組是否相等
004AAB16 7518 jnz 004AAB30
004AAB18 0FB74708 movzx eax, word ptr [edi+$08] //取第五組
004AAB1C 0FB717 movzx edx, word ptr [edi]  //取第四組
004AAB1F 03C2 add eax, edx  //相加
004AAB21 0FB7570A movzx edx, word ptr [edi+$0A] //取第七組
004AAB25 3BC2 cmp eax, edx  //四組+五組 是否等於 七組
004AAB27 7507 jnz 004AAB30
004AAB29 66837F0C64 cmp word ptr [edi+$0C], +$64 //第六組應等於$64
004AAB2E 743B jz 004AAB6B        //跳轉就OK了！
004AAB30 6A10 push $10

* Possible String Reference to: '批量檔案設定器'
|
004AAB32 68E0AC4A00 push $004AACE0

* Possible String Reference to: '您的註冊碼不正確。如果該註冊碼是從?
| 髡唚搶鐗玫降模胗胱髡吡怠?
|
004AAB37 681CAD4A00 push $004AAD1C

* Reference to FormReg
|
004AAB3C 8B45FC mov eax, [ebp-$04]

|
004AAB3F E8BCE2F8FF call 00438E00
004AAB44 50 push eax

* Reference to: user32.MessageBoxA()
|
004AAB45 E88AC8F5FF call 004073D4
004AAB4A 803D58C94C0003 cmp byte ptr [$4CC958], $03
004AAB51 730B jnb 004AAB5E
004AAB53 FE0558C94C00 inc byte ptr [$4CC958]
004AAB59 E959010000 jmp 004AACB7

* Reference to FormReg
|
004AAB5E 8B45FC mov eax, [ebp-$04]

|
004AAB61 E84635FAFF call 0044E0AC
004AAB66 E94C010000 jmp 004AACB7
004AAB6B 6A40 push $40

* Possible String Reference to: '批量檔案設定器'
|
004AAB6D 68E0AC4A00 push $004AACE0

* Possible String Reference to: '感謝您！您已經成功地註冊了！'
|
004AAB72 6860AD4A00 push $004AAD60

* Reference to FormReg
|
004AAB77 8B45FC mov eax, [ebp-$04]

|
004AAB7A E881E2F8FF call 00438E00
004AAB7F 50 push eax

* Reference to: user32.MessageBoxA()
|
004AAB80 E84FC8F5FF call 004073D4

* Reference to TMainForm instance
|
004AAB85 A1B0B14C00 mov eax, dword ptr [$4CB1B0]
004AAB8A 8B00 mov eax, [eax]

* Possible String Reference to: '批量檔案設定器'
|
004AAB8C BA88AD4A00 mov edx, $004AAD88

|
004AAB91 E88680F8FF call 00432C1C

* Reference to TMainForm instance
|
004AAB96 A1B0B14C00 mov eax, dword ptr [$4CB1B0]
004AAB9B 8B00 mov eax, [eax]

* Reference to control TMainForm.MenuReg : TMenuItem
|
004AAB9D 8B80F0030000 mov eax, [eax+$03F0]
004AABA3 33D2 xor edx, edx

|
004AABA5 E8728DF9FF call 0044391C
004AABAA 8D55A4 lea edx, [ebp-$5C]

* Reference to FormReg
|
004AABAD 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AABB0 8B80DC020000 mov eax, [eax+$02DC]

|
004AABB6 E83180F8FF call 00432BEC
004AABBB 8B55A4 mov edx, [ebp-$5C]

* Reference to TAboutBox instance
|
004AABBE A1BCB14C00 mov eax, dword ptr [$4CB1BC]
004AABC3 8B00 mov eax, [eax]

* Reference to control TAboutBox.LabelUser : TLabel
|
004AABC5 8B80E0020000 mov eax, [eax+$02E0]

|
004AABCB E84C80F8FF call 00432C1C
004AABD0 8D55A0 lea edx, [ebp-$60]

* Reference to FormReg
|
004AABD3 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AABD6 8B80E0020000 mov eax, [eax+$02E0]

|
004AABDC E80B80F8FF call 00432BEC
004AABE1 8B55A0 mov edx, [ebp-$60]

* Reference to TAboutBox instance
|
004AABE4 A1BCB14C00 mov eax, dword ptr [$4CB1BC]
004AABE9 8B00 mov eax, [eax]

* Reference to control TAboutBox.LabelComp : TLabel
|
004AABEB 8B80E4020000 mov eax, [eax+$02E4]

|
004AABF1 E82680F8FF call 00432C1C
004AABF6 8B0DCCB04C00 mov ecx, [$4CB0CC]
004AABFC 8B09 mov ecx, [ecx]
004AABFE B201 mov dl, $01

* Reference to class TIniFile
|
004AAC00 A1846A4700 mov eax, dword ptr [$476A84]

|
004AAC05 E822BFFCFF call 00476B2C
004AAC0A 8945F8 mov [ebp-$08], eax
004AAC0D 33C0 xor eax, eax
004AAC0F 55 push ebp
004AAC10 68A8AC4A00 push $004AACA8

***** TRY
|
004AAC15 64FF30 push dword ptr fs:[eax]
004AAC18 648920 mov fs:[eax], esp
004AAC1B 8D559C lea edx, [ebp-$64]

* Reference to FormReg
|
004AAC1E 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditUser : TEdit
|
004AAC21 8B80DC020000 mov eax, [eax+$02DC]

|
004AAC27 E8C07FF8FF call 00432BEC
004AAC2C 8B459C mov eax, [ebp-$64]
004AAC2F 50 push eax

* Possible String Reference to: 'RegUserName'
|
004AAC30 B9A0AD4A00 mov ecx, $004AADA0

* Possible String Reference to: 'RegData'
|
004AAC35 BAB4AD4A00 mov edx, $004AADB4
004AAC3A 8B45F8 mov eax, [ebp-$08]
004AAC3D 8B18 mov ebx, [eax]

* Possible reference to virtual method TIniFile.OFFS_04
|
004AAC3F FF5304 call dword ptr [ebx+$04]
004AAC42 8D5598 lea edx, [ebp-$68]

* Reference to FormReg
|
004AAC45 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditComp : TEdit
|
004AAC48 8B80E0020000 mov eax, [eax+$02E0]

|
004AAC4E E8997FF8FF call 00432BEC
004AAC53 8B4598 mov eax, [ebp-$68]
004AAC56 50 push eax

* Possible String Reference to: 'RegCompant'
|
004AAC57 B9C4AD4A00 mov ecx, $004AADC4

* Possible String Reference to: 'RegData'
|
004AAC5C BAB4AD4A00 mov edx, $004AADB4
004AAC61 8B45F8 mov eax, [ebp-$08]
004AAC64 8B18 mov ebx, [eax]

* Possible reference to virtual method TIniFile.OFFS_04
|
004AAC66 FF5304 call dword ptr [ebx+$04]
004AAC69 8D5594 lea edx, [ebp-$6C]

* Reference to FormReg
|
004AAC6C 8B45FC mov eax, [ebp-$04]

* Reference to control TFormReg.EditCode : TEdit
|
004AAC6F 8B80E8020000 mov eax, [eax+$02E8]

|
004AAC75 E8727FF8FF call 00432BEC
004AAC7A 8B4594 mov eax, [ebp-$6C]
004AAC7D 50 push eax

* Possible String Reference to: 'RegCode'
|
004AAC7E B9D8AD4A00 mov ecx, $004AADD8

* Possible String Reference to: 'RegData'
|
004AAC83 BAB4AD4A00 mov edx, $004AADB4
004AAC88 8B45F8 mov eax, [ebp-$08]
004AAC8B 8B18 mov ebx, [eax]

* Possible reference to virtual method TIniFile.OFFS_04
|
004AAC8D FF5304 call dword ptr [ebx+$04]
004AAC90 33C0 xor eax, eax
004AAC92 5A pop edx
004AAC93 59 pop ecx
004AAC94 59 pop ecx
004AAC95 648910 mov fs:[eax], edx

****** FINALLY
|
004AAC98 68AFAC4A00 push $004AACAF
004AAC9D B201 mov dl, $01
004AAC9F 8B45F8 mov eax, [ebp-$08]
004AACA2 8B08 mov ecx, [eax]

* Possible reference to virtual method TIniFile.OFFS_04
|
004AACA4 FF51FC call dword ptr [ecx-$04]
004AACA7 C3 ret

004AACA8 E9B38AF5FF jmp 00403760
004AACAD EBEE jmp 004AAC9D

****** END
|
* Reference to FormReg
|
004AACAF 8B45FC mov eax, [ebp-$04]

|
004AACB2 E8F533FAFF call 0044E0AC
004AACB7 33C0 xor eax, eax
004AACB9 5A pop edx
004AACBA 59 pop ecx
004AACBB 59 pop ecx
004AACBC 648910 mov fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '_^[]門課募柚悶?
|
004AACBF 68D9AC4A00 p