他的註冊名註冊碼序列號資訊放在登錄檔裡HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Fileprot\Parameters
和
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\vftd
呼叫regqueryvalue 三次,為什麼d *(esp+4)看不到鍵名,如何看呢,不會吧,還有最後一次呼叫的時候彷彿在系統程式碼裡就跳出註冊對話方塊,總找不到關鍵部分,哪位高手可以指點?
;Generate by Txt2Asm V1.0
esp_10 db 0 ;儲存ecx+5
esp_04 db 0 ;儲存高4位
esp_08 db 0 ;儲存低4位
lea ecx, addr Serial
mov al, 2D
mov dl, byte ptr [ecx+4]
cmp dl, al
je @sn_07
mov byte ptr [ecx+4],al
@sn_07: cmp byte ptr [ecx+7],al
je @sn_0B:
mov byte ptr [ecx+7],al
@sn_0B: cmp byte ptr [ecx+0Bh],al
je @sn_0D
mov byte ptr [ecx+0Bh],al
@sn_0D: cmp byte ptr [ecx+0Dh],al
je @sn_1C
mov byte ptr [ecx+0dh],al
@sn_1C: cmp byte ptr [ecx+1Ch],al
je @sn_over
mov byte ptr [ecx+1ch],al
@sn_over:
mov al, byte ptr [ecx+0Fh] ;取Ecx+f，10，11，12，15，16，17，19
處字元
;必須在30～46之間取值
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+10h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+11h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+12h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+15h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+16h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+17h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
mov al, byte ptr [ecx+19h]
cmp al, 30
jl 0040E4FF
cmp al, 46
jg 0040E4FF
cmp byte ptr [ecx], 46 ;前4位必須為FP18-
jne 0040E4FF
cmp byte ptr [ecx+01], 50
jne 0040E4FF
cmp byte ptr [ecx+02], 31
jne 0040E4FF
cmp byte ptr [ecx+03], 38
jne 0040E4FF
mov dl, byte ptr [ecx+05] ;dl<-ecx+5
mov bl, byte ptr [ecx+08] ;bl<-ecx+8
mov byte ptr esp_10, dl ;save to esp_10
mov dl, byte ptr [ecx+17] ;al=ecx+19 add 17,16,15,12,11,10,F
add al, dl
mov dl, byte ptr [ecx+16]
add al, dl
mov dl, byte ptr [ecx+15]
add al, dl
mov dl, byte ptr [ecx+12]
add al, dl
mov dl, byte ptr [ecx+11]
add al, dl
mov dl, byte ptr [ecx+10]
add al, dl
mov dl, byte ptr [ecx+0F]
add al, dl
mov dl, byte ptr esp_10 ;dl=saved ecx+5
(al xor dl)
xor al, dl
mov dl, byte ptr [ecx+0C] ;剛才的運算結果al與5,0C,8,5位依次xor,再與23h
xor
xor al, bl
;bl=ecx+8
xor al, dl
xor al, 23
mov dl, al
;校驗結果存為al,dl
shr dl, 04
;去掉低4位,將其轉化為0~F的字元
add dl, 30
cmp dl, 39
mov byte ptr esp_04, dl ;存放去掉低4位的高四位結果
jbe RA_0E38C
add dl, 07
mov byte ptr esp_04, dl
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E383(C)
;|
RA_0E38C:
and al, 0F
;0040E38E:
add al, 30
cmp al, 39
mov byte ptr esp_08, al ;存放低四位轉化為0~F字元
jbe RA_0E39E
add al, 07
mov byte ptr esp_08, al
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E396(C)
;|
RA_0E39E:
movsx eax, byte ptr [ecx+13h] ;取ecx+13
標誌1***********
;0040E3A2:
mov edx, dword ptr esp_04 ;高4位轉化為的0~F字元
and edx, 000000FF
cmp eax, edx
je @flg_cmp1
mov byte ptr [ecx+13h],dl
@flg_cmp1:
mov dl, byte ptr [ecx+14] ;ecx+14
標誌2************
push esi
mov esi, dword ptr esp_0c ;因為push esi esp_0c=esp+8
movsx eax, dl
and esi, 000000FF
cmp eax, esi
pop esi
je @flg_cmp1:
PUSH EAX
MOV EAX,dword ptr esp_0c
mov byte ptr [ecx+14h],al
POP EAX
@flg_cmp2:
mov al, byte ptr [ecx+0A] ;(ECX+0A) +'-',XOR ECX+9
XOR ECX+14 XOR ECX+13
add al, 46
xor al, byte ptr [ecx+09]
xor al, dl
mov dl, byte ptr [ecx+13]
xor al, dl
xor al, bl
;XOR BL=ECX+8 與41h 異或得到結果
xor al, 41
mov dl, al
shr dl, 04
;高位轉化為0~f字元 ->esp_04
add dl, 30
cmp dl, 39
mov byte ptr esp_04, dl
jbe RA_0E3F9
add dl, 07
mov byte ptr esp_04, dl
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E3F0(C)
;|
RA_0E3F9:
and al, 0F
;0040E3FB:
add al, 30
cmp al, 39
mov byte ptr esp_08, al ;低位化為0~f字元 ->esp_08
jbe RA_0E40B
add al, 07
mov byte ptr [esp+08], al
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E403(C)
;|
RA_0E40B:
movsx edx, byte ptr [ecx+1A] ;ecx+1A 標誌3******************
;0040E40F:
mov eax, dword ptr [esp+04] ;高位與ecx+1A 對比
and eax, 000000FF
cmp edx, eax
je @sn_flgcmp3
mov byte ptr [ecx+1A],al
@sn_flgcmp3:
mov bl, byte ptr [ecx+1B] ;ecx+1bh 標誌4*************
mov eax, dword ptr esp_8
movsx edx, bl
and eax, 000000FF
cmp edx, eax
jne @sn_flgcmp3:
mov byte ptr [ecx+1B],al
@sn_flgcmp3:
mov al, byte ptr [ecx+06] ;ecx+06 xor
ecx+14 xor 13 xor ecx+5
;與ABh數字異或得到結果
mov dl, byte ptr [ecx+14]
xor al, dl
mov dl, byte ptr [ecx+13]
xor al, dl
mov dl, byte ptr esp_10 ;esp_10=ecx+5
xor al, dl
xor al, AB
mov dl, al
shr dl, 04
add dl, 30
cmp dl, 39
mov byte ptr esp_04, dl ;高4位
jbe RA_0E464
add dl, 07
mov byte ptr esp_04, dl
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E45B(C)
;|
RA_0E464:
and al, 0F
;0040E466:
add al, 30
cmp al, 39
mov byte ptr esp_08, al ;低4位
jbe RA_0E476
add al, 07
mov byte ptr esp_08, al
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E46E(C)
;|
RA_0E476:
movsx edx, byte ptr [ecx+0E] ;ecx+0E 標誌5******************
;0040E47A:
mov eax, dword ptr [esp+04]
and eax, 000000FF
cmp edx, eax
jne 0040E4FF
movsx edx, byte ptr [ecx+18] ;ecx+18 標誌6********************
mov eax, dword ptr [esp+08]
and eax, 000000FF
cmp edx, eax
jne 0040E4FF
mov al, byte ptr [ecx+1A] ;1a,1c
mov dl, byte ptr [ecx+0C]
xor bl, al
;ecx+8 xor 1A xor 1C xor 數字63h最後結果
xor bl, dl
xor bl, 63
mov dl, bl
mov al, dl
shr al, 04
;高四位
add al, 30
cmp al, 39
mov byte ptr [esp+04], al
jbe RA_0E4BC
add al, 07
mov byte ptr [esp+04], al
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E4B4(C)
;|
RA_0E4BC:
and dl, 0F
;低四位
;0040E4BF:
add dl, 30
cmp dl, 39
mov byte ptr [esp+08], dl
jbe RA_0E4D2
add dl, 07
mov byte ptr [esp+08], dl
;* Referenced by a (U)nconditional or (C)onditional Jump at Address
;|0040E4C9(C)
;|
RA_0E4D2:
movsx edx, byte ptr [ecx+1D] ;ecx+1D 標誌7*************
;0040E4D6:
mov eax, dword ptr [esp+04]
and eax, 000000FF
cmp edx, eax
jne 0040E4FF
movsx ecx, byte ptr [ecx+1E] ;ecx+1E
標誌8************
mov edx, dword ptr [esp+08]
xor eax, eax
and edx, 000000FF
pop ebx
cmp ecx, edx
sete al
add esp, 00000008
ret 0004
;* Referenced by a (U)nconditional or (C)onditional Jump at Addresses
;|0040E24F(C), 0040E258(C), 0040E261(C), 0040E26A(C), 0040E273(C)
;|0040E27E(C), 0040E286(C), 0040E291(C), 0040E299(C), 0040E2A4(C)
;|0040E2AC(C), 0040E2B7(C), 0040E2BF(C), 0040E2CA(C), 0040E2D2(C)
;|0040E2DD(C), 0040E2E5(C), 0040E2F0(C), 0040E2F8(C), 0040E303(C)
;|0040E30B(C), 0040E314(C), 0040E31E(C), 0040E328(C), 0040E332(C)
;|0040E3AE(C), 0040E3C8(C), 0040E41A(C), 0040E431(C), 0040E485(C)
;|0040E496(C), 0040E4E1(C)
;|
RA_0E4FF:
xor eax, eax
;0040E501:
ret 0004
nop