文件分割器的算法

软件介绍：一机一码性，注册成功后在注册表中写入标志。

下断点:HMEMCPY 按F12共12次来到下面。。。。。。。

:00483E54 8B45FC mov eax, dword ptr [ebp-04]----->机器码BN

:00483E57 8B15B8DE4800 mov edx, dword ptr [0048DEB8]--->输入的SN

:00483E5D E8C2000000 call 00483F24------------------->算法的关键CALL

:00483E62 84C0 test al, al--------------------->注册标志位AL=1时为注册

:00483E64 7429 je 00483E8F--------------------->跳就死

===========================================================================================

:00483F24 55 push ebp

:00483F25 8BEC mov ebp, esp

:00483F27 83C4F4 add esp, FFFFFFF4

:00483F2A 53 push ebx

:00483F2B 56 push esi

:00483F2C 57 push edi

:00483F2D 8955F8 mov dword ptr [ebp-08], edx

:00483F30 8945FC mov dword ptr [ebp-04], eax

:00483F33 8B45FC mov eax, dword ptr [ebp-04]

:00483F36 E8F5FFF7FF call 00403F30

:00483F3B 8B45F8 mov eax, dword ptr [ebp-08]

:00483F3E E8EDFFF7FF call 00403F30

:00483F43 33C0 xor eax, eax

:00483F45 55 push ebp

:00483F46 688C434800 push 0048438C

:00483F4B 64FF30 push dword ptr fs:[eax]

:00483F4E 648920 mov dword ptr fs:[eax], esp

:00483F51 33DB xor ebx, ebx

:00483F53 33F6 xor esi, esi

:00483F55 C645F700 mov [ebp-09], 00

:00483F59 8B45F8 mov eax, dword ptr [ebp-08]

:00483F5C E81BFEF7FF call 00403D7C

:00483F61 83F80E cmp eax, 0000000E

:00483F64 0F8507040000 jne 00484371

:00483F6A 8B45F8 mov eax, dword ptr [ebp-08]------------>EAX=BN

:00483F6D 0FB638 movzx edi, byte ptr [eax]-------------->EDI取BN的第1位，设为BN1

:00483F70 6683EF41 sub di, 0041--------------------------->EDI=EDI-0x41

:00483F74 8B45F8 mov eax, dword ptr [ebp-08]

:00483F77 8A5001 mov dl, byte ptr [eax+01]-------------->DL=BN2

:00483F7A 80FA39 cmp dl, 39----------------------------->DL与“9”比较

:00483F7D 7507 jne 00483F86--------------------------->不等则跳

:00483F7F B809000000 mov eax, 00000009

:00483F84 EB0A jmp 00483F90

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00483F7D(C)

|

:00483F86 33C0 xor eax, eax-------------------------->EAX=0

:00483F88 8AC2 mov al, dl---------------------------->AL=DL

:00483F8A 83E841 sub eax, 00000041--------------------->EAX=EAX-0x41

:00483F8D 83C00A add eax, 0000000A--------------------->EAX=EAX+0xA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00483F84(U)

|

:00483F90 80FA5A cmp dl, 5A---------------------------->将DL与0x5A

:00483F93 7501 jne 00483F96-------------------------->不等则跳

:00483F95 40 inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00483F93(C)

|

:00483F96 8BD0 mov edx, eax-------------------------->EDX=EAX

:00483F98 83E201 and edx, 00000001--------------------->EDX=EDX AND 1

:00483F9B 4A dec edx------------------------------->EDX=EDX-1

:00483F9C 750E jne 00483FAC-------------------------->比较EDX是否为0,不为0则跳

:00483F9E 8B55F8 mov edx, dword ptr [ebp-08]----------->EDX=BN

:00483FA1 33DB xor ebx, ebx-------------------------->EBX=0

:00483FA3 8A5A02 mov bl, byte ptr [edx+02]------------->EBX=BN3

:00483FA6 6683EB30 sub bx, 0030-------------------------->EBX=EBX-0x30

:00483FAA EB36 jmp 00483FE2-------------------------->跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00483F9C(C)

|

:00483FAC 8BD0 mov edx, eax-------------------------->EDX=EAX

:00483FAE 83E202 and edx, 00000002--------------------->EDX=EDX AND 2

:00483FB1 83FA02 cmp edx, 00000002--------------------->将EDX与2比较

:00483FB4 7512 jne 00483FC8-------------------------->不等就跳

:00483FB6 8B55F8 mov edx, dword ptr [ebp-08]----------->EDX=BN

:00483FB9 33DB xor ebx, ebx-------------------------->EBX=0

:00483FBB 8A5A02 mov bl, byte ptr [edx+02]------------->EBX=BN3

:00483FBE 6683EB41 sub bx, 0041-------------------------->EBX=EBX-0x41

:00483FC2 6683C30A add bx, 000A-------------------------->EBX=EBX+0xA

:00483FC6 EB1A jmp 00483FE2-------------------------->跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00483FB4(C)

|

:00483FC8 8BD0 mov edx, eax-------------------------->EDX=EAX

:00483FCA 83E204 and edx, 00000004--------------------->EDX=EDX AND 4

:00483FCD 83FA04 cmp edx, 00000004--------------------->比较EDX和4

:00483FD0 7510 jne 00483FE2-------------------------->不等则跳

:00483FD2 8B55F8 mov edx, dword ptr [ebp-08]----------->EDX=BN

:00483FD5 33DB xor ebx, ebx-------------------------->EBX=0

:00483FD7 8A5A02 mov bl, byte ptr [edx+02]------------->EBX=BN3

:00483FDA 6683EB41 sub bx, 0041-------------------------->EBX=EBX-0x41

:00483FDE 6683C324 add bx, 0024-------------------------->EBX=EBX+0x24

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00483FAA(U), :00483FC6(U), :00483FD0(C)

|

:00483FE2 8BD0 mov edx, eax-------------------------->EDX=EAX

:00483FE4 83E208 and edx, 00000008--------------------->EDX=EDX AND 8

:00483FE7 83FA08 cmp edx, 00000008--------------------->比较EDX 与 8

:00483FEA 750D jne 00483FF9-------------------------->不等则跳

:00483FEC 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN

:00483FEF 0FB67003 movzx esi, byte ptr [eax+03]---------->ESI=BN4

:00483FF3 6683EE30 sub si, 0030-------------------------->ESI=ESI-0x30

:00483FF7 EB32 jmp 0048402B-------------------------->跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00483FEA(C)

|

:00483FF9 8BD0 mov edx, eax-------------------------->EDX=EAX

:00483FFB 83E210 and edx, 00000010--------------------->EDX=EDX AND 10

:00483FFE 83FA10 cmp edx, 00000010--------------------->比较EDX 与 10

:00484001 7511 jne 00484014-------------------------->不等则跳

:00484003 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN

:00484006 0FB67003 movzx esi, byte ptr [eax+03]---------->ESI=BN4

:0048400A 6683EE41 sub si, 0041-------------------------->ESI=ESI-0x41

:0048400E 6683C60A add si, 000A-------------------------->ESI=ESI-0xA

:00484012 EB17 jmp 0048402B-------------------------->跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00484001(C)

|

:00484014 83E020 and eax, 00000020--------------------->EDX=EAX

:00484017 83F820 cmp eax, 00000020--------------------->比较EDX 与 20

:0048401A 750F jne 0048402B-------------------------->不等则跳

:0048401C 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN

:0048401F 0FB67003 movzx esi, byte ptr [eax+03]---------->ESI=BN4

:00484023 6683EE41 sub si, 0041-------------------------->ESI=ESI-0x41

:00484027 6683C624 add si, 0024-------------------------->ESI=ESI+0x24

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00483FF7(U), :00484012(U), :0048401A(C)

|

:0048402B 0FB7C7 movzx eax, di------------------------->EAX=EDI

:0048402E 83C030 add eax, 00000030--------------------->EAX=EAX+0x30

:00484031 E8C6FEFFFF call 00483EFC------------------------->根据EAX的值进行计算

:00484036 8B55FC mov edx, dword ptr [ebp-04]----------->EDX=SN

:00484039 3A02 cmp al, byte ptr [edx]---------------->比较SN1和计算后的EAX

:0048403B 0F8530030000 jne 00484371-------------------------->不等则跳，跳则死

:00484041 0FB7C3 movzx eax, bx------------------------->EAX=EBX

:00484044 83C030 add eax, 00000030--------------------->EAX=EAX+0x30

:00484047 E8B0FEFFFF call 00483EFC------------------------->根据EAX的值进行计算

:0048404C 8B55FC mov edx, dword ptr [ebp-04]----------->

:0048404F 3A4201 cmp al, byte ptr [edx+01]------------->比较SN2和计算后的EAX

:00484052 0F8519030000 jne 00484371-------------------------->不等则跳，跳则死

:00484058 0FB7C6 movzx eax, si------------------------->EAX=ESI

:0048405B 83C030 add eax, 00000030--------------------->EAX=EAX+0x30

:0048405E E899FEFFFF call 00483EFC------------------------->根据EAX的值进行计算

:00484063 8B55FC mov edx, dword ptr [ebp-04]----------->

:00484066 3A4202 cmp al, byte ptr [edx+02]------------->比较SN3和计算后的EAX

:00484069 0F8502030000 jne 00484371-------------------------->不等则跳，跳则死

:0048406F 0FB7C7 movzx eax, di------------------------->EAX=EDI

:00484072 83C030 add eax, 00000030--------------------->EAX=EAX+0x30

:00484075 83C006 add eax, 00000006--------------------->EAX=EAX+0x6

:00484078 E87FFEFFFF call 00483EFC------------------------->根据EAX的值进行计算

:0048407D 8B55FC mov edx, dword ptr [ebp-04]----------->

:00484080 3A4203 cmp al, byte ptr [edx+03]------------->比较SN4和计算后的EAX

:00484083 0F85E8020000 jne 00484371-------------------------->不等则跳，跳则死

:00484089 0FB7C3 movzx eax, bx------------------------->EAX=EBX

:0048408C 83C030 add eax, 00000030--------------------->EAX=EAX+0x30

:0048408F 83C002 add eax, 00000002--------------------->EAX=EAX+0x2

:00484092 E865FEFFFF call 00483EFC------------------------->根据EAX的值进行计算

:00484097 8B55FC mov edx, dword ptr [ebp-04]----------->

:0048409A 3A4204 cmp al, byte ptr [edx+04]------------->比较SN5和计算后的EAX

:0048409D 0F85CE020000 jne 00484371-------------------------->不等则跳，跳则死

:004840A3 0FB7C6 movzx eax, si------------------------->EAX=ESI

:004840A6 83C030 add eax, 00000030--------------------->EAX=EAX+0x30

:004840A9 40 inc eax------------------------------->EAX=EAX+1

:004840AA E84DFEFFFF call 00483EFC------------------------->根据EAX的值进行计算

:004840AF 8B55FC mov edx, dword ptr [ebp-04]----------->

:004840B2 3A4205 cmp al, byte ptr [edx+05]------------->比较SN6和计算后的EAX

:004840B5 0F85B6020000 jne 00484371-------------------------->不等则跳，跳则死

以上为根据BN的1～4位计算得SN的前1～6位

:004840BB 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN

:004840BE 8078042D cmp byte ptr [eax+04], 2D------------->比较BN5是不是2D("-")

:004840C2 0F85A9020000 jne 00484371-------------------------->不等则跳，跳则死

:004840C8 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN

:004840CB 0FB67805 movzx edi, byte ptr [eax+05]---------->EDI=BN6

:004840CF 6683EF41 sub di, 0041-------------------------->EDI=EDI-0x41

:004840D3 8B45F8 mov eax, dword ptr [ebp-08]----------->EAX=BN

:004840D6 8A4006 mov al, byte ptr [eax+06]------------->AL=BN7

:004840D9 3C39 cmp al, 39---------------------------->将AL与0x39进行比较

:004840DB 7507 jne 004840E4-------------------------->不等则跳

:004840DD B809000000 mov eax, 00000009

:004840E2 EB0B jmp 004840EF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004840DB(C)

|

:004840E4 25FF000000 and eax, 000000FF--------------------->EAX=EAX AND 0xFF

:004840E9 83E841 sub eax, 00000041--------------------->EAX=EAX-0x41

:004840EC 83C00A add eax, 0000000A--------------------->EAX=EAX+0xA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004840E2(U)

|

:004840EF 8B55F8 mov edx, dword ptr [ebp-08]----------->EDX=BN

:004840F2 807A015A cmp byte ptr [edx+01], 5A------------->将SN2与0x5A进行比较

:004840F6 7501 jne 004840F9-------------------------->不等则跳

:004840F8 40 inc eax------------------------------->EAX=EAX+1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004840F6(C)

|

:004840F9 8BD0 mov edx, eax------------------------->EDX=EAX

:004840FB 83E201 and edx, 00000001-------------------->EDX=EDX AND 1

:004840FE 4A dec edx------------------------------>EDX=EDX-1

:004840FF 750E jne 0048410F------------------------->不等0则跳

:00484101 8B55F8 mov edx, dword ptr [ebp-08]---------->EDX=BN

:00484104 33DB xor ebx, ebx------------------------->EBX=0

:00484106 8A5A07 mov bl, byte ptr [edx+07]------------>EBX=BN8

:00484109 6683EB30 sub bx, 0030------------------------->EBX=EBX-0x30

:0048410D EB36 jmp 00484145------------------------->跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004840FF(C)

|

:0048410F 8BD0 mov edx, eax------------------------->EDX=EAX

:00484111 83E202 and edx, 00000002-------------------->EDX=EDX AND 2

:00484114 83FA02 cmp edx, 00000002-------------------->比较EDX和2

:00484117 7512 jne 0048412B------------------------->不等则跳

:00484119 8B55F8 mov edx, dword ptr [ebp-08]---------->EDX=BN

:0048411C 33DB xor ebx, ebx------------------------->EBX=0

:0048411E 8A5A07 mov bl, byte ptr [edx+07]------------>EBX=BN8

:00484121 6683EB41 sub bx, 0041------------------------->EBX=EBX-0x41

:00484125 6683C30A add bx, 000A------------------------->EBX=EBX+0xA

:00484129 EB1A jmp 00484145------------------------->跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00484117(C)

|

:0048412B 8BD0 mov edx, eax------------------------->EDX=EAX

:0048412D 83E204 and edx, 00000004-------------------->EDX=EDX AND 4

:00484130 83FA04 cmp edx, 00000004-------------------->比较EDX和4

:00484133 7510 jne 00484145------------------------->不等则跳

:00484135 8B55F8 mov edx, dword ptr [ebp-08]---------->EDX=BN

:00484138 33DB xor ebx, ebx------------------------->EBX=0

:0048413A 8A5A07 mov bl, byte ptr [edx+07]------------>EBX=BN8

:0048413D 6683EB41 sub bx, 0041------------------------->EBX=EBX-0x41

:00484141 6683C324 add bx, 0024------------------------->EBX=EBX+0x24

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:0048410D(U), :00484129(U), :00484133(C)

|

:00484145 8BD0 mov edx, eax------------------------->EDX=EAX

:00484147 83E208 and edx, 00000008-------------------->EDX=EDX AND 8

:0048414A 83FA08 cmp edx, 00000008-------------------->比较EDX和8

:0048414D 750D jne 0048415C------------------------->不等则跳

:0048414F 8B45F8 mov eax, dword ptr [ebp-08]---------->EAX=BN

:00484152 0FB67008 movzx esi, byte ptr [eax+08]--------->ESI=BN9

:00484156 6683EE30 sub si, 0030------------------------->ESI=ESI-0x30

:0048415A EB32 jmp 0048418E------------------------->跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048414D(C)

|

:0048415C 8BD0 mov edx, eax------------------------->EDX=EAX

:0048415E 83E210 and edx, 00000010-------------------->EDX=EDX AND 10

:00484161 83FA10 cmp edx, 00000010-------------------->比较EDX和10

:00484164 7511 jne 00484177------------------------->不等则跳

:00484166 8B45F8 mov eax, dword ptr [ebp-08]---------->EAX=BN

:00484169 0FB67008 movzx esi, byte ptr [eax+08]--------->ESI=BN9

:0048416D 6683EE41 sub si, 0041------------------------->ESI=ESI-0x41

:00484171 6683C60A add si, 000A------------------------->ESI=ESI+0xA

:00484175 EB17 jmp 0048418E------------------------->跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00484164(C)

|

:00484177 83E020 and eax, 00000020-------------------->EAX=EAX AND 20

:0048417A 83F820 cmp eax, 00000020-------------------->比较EDX和20

:0048417D 750F jne 0048418E------------------------->不等则跳

:0048417F 8B45F8 mov eax, dword ptr [ebp-08]---------->EAX=BN

:00484182 0FB67008 movzx esi, byte ptr [eax+08]--------->ESI=BN9

:00484186 6683EE41 sub si, 0041------------------------->ESI=ESI-0x41

:0048418A 6683C624 add si, 0024------------------------->ESI=ESI+0x24

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:0048415A(U), :00484175(U), :0048417D(C)

|

:0048418E 0FB7C7 movzx eax, di----------------------->EAX=EDI

:00484191 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:00484194 E863FDFFFF call 00483EFC----------------------->根据EAX的值进行计算

:00484199 8B55FC mov edx, dword ptr [ebp-04]--------->EDX=SN

:0048419C 3A4207 cmp al, byte ptr [edx+07]----------->比较EAX和SN8

:0048419F 0F85CC010000 jne 00484371------------------------>不等则跳，跳则死

:004841A5 0FB7C3 movzx eax, bx----------------------->EAX=EBX

:004841A8 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:004841AB E84CFDFFFF call 00483EFC----------------------->根据EAX的值进行计算

:004841B0 8B55FC mov edx, dword ptr [ebp-04]--------->

:004841B3 3A4208 cmp al, byte ptr [edx+08]----------->比较EAX和SN9

:004841B6 0F85B5010000 jne 00484371------------------------>不等则跳，跳则死

:004841BC 0FB7C6 movzx eax, si----------------------->EAX=ESI

:004841BF 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:004841C2 E835FDFFFF call 00483EFC----------------------->根据EAX的值进行计算

:004841C7 8B55FC mov edx, dword ptr [ebp-04]--------->

:004841CA 3A4209 cmp al, byte ptr [edx+09]----------->比较EAX和SN10

:004841CD 0F859E010000 jne 00484371------------------------>不等则跳，跳则死

:004841D3 0FB7C7 movzx eax, di----------------------->EAX=EDI

:004841D6 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:004841D9 83C008 add eax, 00000008------------------->EAX=EAX+0x8

:004841DC E81BFDFFFF call 00483EFC----------------------->根据EAX的值进行计算

:004841E1 8B55FC mov edx, dword ptr [ebp-04]--------->

:004841E4 3A420A cmp al, byte ptr [edx+0A]----------->比较EAX和SN11

:004841E7 0F8584010000 jne 00484371------------------------>不等则跳，跳则死

:004841ED 0FB7C3 movzx eax, bx----------------------->EAX=EBX

:004841F0 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:004841F3 40 inc eax----------------------------->EAX=EAX+1

:004841F4 E803FDFFFF call 00483EFC----------------------->根据EAX的值进行计算

:004841F9 8B55FC mov edx, dword ptr [ebp-04]--------->

:004841FC 3A420B cmp al, byte ptr [edx+0B]----------->比较EAX和SN12

:004841FF 0F856C010000 jne 00484371------------------------>不等则跳，跳则死

:00484205 0FB7C6 movzx eax, si----------------------->EAX=ESI

:00484208 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:0048420B 83C002 add eax, 00000002------------------->EAX=EAX+0x2

:0048420E E8E9FCFFFF call 00483EFC----------------------->根据EAX的值进行计算

:00484213 8B55FC mov edx, dword ptr [ebp-04]--------->

:00484216 3A420C cmp al, byte ptr [edx+0C]----------->比较EAX和SN13

:00484219 0F8552010000 jne 00484371------------------------>不等则跳，跳则死

以上为根据BN的6～9位计算得SN的8～13位

:0048421F 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN

:00484222 8078092D cmp byte ptr [eax+09], 2D----------->比较BN10是不是2D("-")

:00484226 0F8545010000 jne 00484371------------------------>不等则跳，跳则死

:0048422C 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN

:0048422F 0FB6780A movzx edi, byte ptr [eax+0A]-------->EDI=BN11

:00484233 6683EF41 sub di, 0041------------------------>EDI=EDI-0x41

:00484237 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN

:0048423A 8A400B mov al, byte ptr [eax+0B]----------->AL=BN12

:0048423D 3C39 cmp al, 39-------------------------->比较AL是否等于0x39

:0048423F 7507 jne 00484248------------------------>不等则跳

:00484241 B809000000 mov eax, 00000009------------------->EAX=9

:00484246 EB0B jmp 00484253------------------------>跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048423F(C)

|

:00484248 25FF000000 and eax, 000000FF------------------->EAX=EAX AND FF

:0048424D 83E841 sub eax, 00000041------------------->EAX=EAX-0x41

:00484250 83C00A add eax, 0000000A------------------->EAX=EAX+0xA

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00484246(U)

|

:00484253 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN

:00484256 807A015A cmp byte ptr [edx+01], 5A----------->比较BN2是否等于0x5A

:0048425A 7501 jne 0048425D------------------------>不等则跳

:0048425C 40 inc eax----------------------------->EAX=EAX+1

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048425A(C)

|

:0048425D 8BD0 mov edx, eax------------------------>EDX=EAX

:0048425F 83E201 and edx, 00000001------------------->EDX=EDX AND 1

:00484262 4A dec edx----------------------------->EDX=EDX-1

:00484263 750E jne 00484273------------------------>EDX不为0就跳

:00484265 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN

:00484268 33DB xor ebx, ebx------------------------>EBX=0

:0048426A 8A5A0C mov bl, byte ptr [edx+0C]----------->EBX=BN13

:0048426D 6683EB30 sub bx, 0030------------------------>EBX=EBX-0x30

:00484271 EB36 jmp 004842A9------------------------>跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00484263(C)

|

:00484273 8BD0 mov edx, eax------------------------>EDX=EAX

:00484275 83E202 and edx, 00000002------------------->EDX=EDX AND 2

:00484278 83FA02 cmp edx, 00000002------------------->比较EDX和2

:0048427B 7512 jne 0048428F------------------------>不等则跳

:0048427D 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN

:00484280 33DB xor ebx, ebx------------------------>EBX=0

:00484282 8A5A0C mov bl, byte ptr [edx+0C]----------->EBX=BN13

:00484285 6683EB41 sub bx, 0041------------------------>EBX=EBX-0x41

:00484289 6683C30A add bx, 000A------------------------>EBX=EBX+0xA

:0048428D EB1A jmp 004842A9------------------------>跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:0048427B(C)

|

:0048428F 8BD0 mov edx, eax------------------------>EDX=EAX

:00484291 83E204 and edx, 00000004------------------->EDX=EDX AND 4

:00484294 83FA04 cmp edx, 00000004------------------->比较EDX和4

:00484297 7510 jne 004842A9------------------------>不等则跳

:00484299 8B55F8 mov edx, dword ptr [ebp-08]--------->EDX=BN

:0048429C 33DB xor ebx, ebx------------------------>EBX=0

:0048429E 8A5A0C mov bl, byte ptr [edx+0C]----------->EBX=BN13

:004842A1 6683EB41 sub bx, 0041------------------------>EBX=EBX-0x41

:004842A5 6683C324 add bx, 0024------------------------>EBX=EBX+0x24

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00484271(U), :0048428D(U), :00484297(C)

|

:004842A9 8BD0 mov edx, eax------------------------>EDX=EAX

:004842AB 83E208 and edx, 00000008------------------->EDX=EDX AND 8

:004842AE 83FA08 cmp edx, 00000008------------------->比较EDX和8

:004842B1 750D jne 004842C0------------------------>不等则跳

:004842B3 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN

:004842B6 0FB6700D movzx esi, byte ptr [eax+0D]-------->ESI=BN14

:004842BA 6683EE30 sub si, 0030------------------------>ESI=ESI-0x30

:004842BE EB32 jmp 004842F2------------------------>跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004842B1(C)

|

:004842C0 8BD0 mov edx, eax------------------------>EDX=EAX

:004842C2 83E210 and edx, 00000010------------------->EDX=EDX AND 10

:004842C5 83FA10 cmp edx, 00000010------------------->比较EDX和10

:004842C8 7511 jne 004842DB------------------------>不等则跳

:004842CA 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN

:004842CD 0FB6700D movzx esi, byte ptr [eax+0D]-------->ESI=BN14

:004842D1 6683EE41 sub si, 0041------------------------>ESI=ESI-0x41

:004842D5 6683C60A add si, 000A------------------------>ESI=ESI+0xA

:004842D9 EB17 jmp 004842F2------------------------>跳转

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:004842C8(C)

|

:004842DB 83E020 and eax, 00000020------------------->EAX=EAX AND 20

:004842DE 83F820 cmp eax, 00000020------------------->比较EAX和20

:004842E1 750F jne 004842F2------------------------>不等则跳

:004842E3 8B45F8 mov eax, dword ptr [ebp-08]--------->EAX=BN

:004842E6 0FB6700D movzx esi, byte ptr [eax+0D]-------->ESI=BN14

:004842EA 6683EE41 sub si, 0041------------------------>ESI=ESI-0x41

:004842EE 6683C624 add si, 0024------------------------>ESI=ESI+0x24

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:004842BE(U), :004842D9(U), :004842E1(C)

|

:004842F2 0FB7C7 movzx eax, di----------------------->EAX=EDI

:004842F5 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:004842F8 E8FFFBFFFF call 00483EFC----------------------->根据EAX的值进行计算

:004842FD 8B55FC mov edx, dword ptr [ebp-04]--------->EDX=SN

:00484300 3A420E cmp al, byte ptr [edx+0E]----------->比较EAX和SN15

:00484303 756C jne 00484371------------------------>不等则跳，跳则死

:00484305 0FB7C3 movzx eax, bx----------------------->EAX=EBX

:00484308 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:0048430B E8ECFBFFFF call 00483EFC----------------------->根据EAX的值进行计算

:00484310 8B55FC mov edx, dword ptr [ebp-04]--------->

:00484313 3A420F cmp al, byte ptr [edx+0F]----------->比较EAX和SN16

:00484316 7559 jne 00484371------------------------>不等则跳，跳则死

:00484318 0FB7C6 movzx eax, si----------------------->EAX=ESI

:0048431B 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:0048431E E8D9FBFFFF call 00483EFC----------------------->根据EAX的值进行计算

:00484323 8B55FC mov edx, dword ptr [ebp-04]--------->

:00484326 3A4210 cmp al, byte ptr [edx+10]----------->比较EAX和SN17

:00484329 7546 jne 00484371------------------------>不等则跳，跳则死

:0048432B 0FB7C7 movzx eax, di----------------------->EAX=EDI

:0048432E 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:00484331 83C00D add eax, 0000000D------------------->EAX=EAX+0xD

:00484334 E8C3FBFFFF call 00483EFC----------------------->根据EAX的值进行计算

:00484339 8B55FC mov edx, dword ptr [ebp-04]--------->

:0048433C 3A4211 cmp al, byte ptr [edx+11]----------->比较EAX和SN18

:0048433F 7530 jne 00484371------------------------>不等则跳，跳则死

:00484341 0FB7C3 movzx eax, bx----------------------->EAX=EBX

:00484344 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:00484347 83C002 add eax, 00000002------------------->EAX=EAX+0x2

:0048434A E8ADFBFFFF call 00483EFC----------------------->根据EAX的值进行计算

:0048434F 8B55FC mov edx, dword ptr [ebp-04]--------->

:00484352 3A4212 cmp al, byte ptr [edx+12]----------->比较EAX和SN19

:00484355 751A jne 00484371------------------------>不等则跳，跳则死

:00484357 0FB7C6 movzx eax, si----------------------->EAX=ESI

:0048435A 83C030 add eax, 00000030------------------->EAX=EAX+0x30

:0048435D 83C002 add eax, 00000002------------------->EAX=EAX+0x2

:00484360 E897FBFFFF call 00483EFC----------------------->根据EAX的值进行计算

:00484365 8B55FC mov edx, dword ptr [ebp-04]--------->

:00484368 3A4213 cmp al, byte ptr [edx+13]----------->比较EAX和SN20

:0048436B 7504 jne 00484371------------------------>不等则跳，跳则死

:0048436D C645F701 mov [ebp-09], 01-------------------->注册成功的标志位，到这里就成功了！！^_^

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00483F64(C), :0048403B(C), :00484052(C), :00484069(C), :00484083(C)

|:0048409D(C), :004840B5(C), :004840C2(C), :0048419F(C), :004841B6(C)

|:004841CD(C), :004841E7(C), :004841FF(C), :00484219(C), :00484226(C)

|:00484303(C), :00484316(C), :00484329(C), :0048433F(C), :00484355(C)

|:0048436B(C)

|

:00484371 33C0 xor eax, eax

:00484373 5A pop edx

:00484374 59 pop ecx

:00484375 59 pop ecx

:00484376 648910 mov dword ptr fs:[eax], edx

:00484379 6893434800 push 00484393

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|:00484391(U)

|

:0048437E 8D45F8 lea eax, dword ptr [ebp-08]

:00484381 BA02000000 mov edx, 00000002

:00484386 E895F7F7FF call 00403B20

:0048438B C3 ret

===========================================================================================

以下为根据EAX的值进行计算CALL的具体算法

:00483EFC 8BD0 mov edx, eax-------------->EDX=EAX

:00483EFE 3C3A cmp al, 3A---------------->将EAX与0x3A进行比较

:00483F00 720E jb 00483F10--------------->小于则跳

:00483F02 3C40 cmp al, 40---------------->将EAX与0x40进行比较

:00483F04 770A ja 00483F10--------------->大于则跳

:00483F06 33D2 xor edx, edx-------------->EDX=0

:00483F08 8AD0 mov dl, al---------------->EAX=EDX

:00483F0A 83C232 add edx, 00000032--------->EDX=EDX+0x32

:00483F0D 8BC2 mov eax, edx-------------->EAX=EDX

:00483F0F C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00483F00(C), :00483F04(C)

|

:00483F10 3C5B cmp al, 5B---------------->将EAX与0x5B进行比较

:00483F12 720B jb 00483F1F--------------->小于则跳

:00483F14 3C60 cmp al, 60---------------->将EAX与0x60进行比较

:00483F16 7707 ja 00483F1F--------------->大于则跳

:00483F18 33D2 xor edx, edx-------------->EDX=0

:00483F1A 8AD0 mov dl, al---------------->EDX=EAX

:00483F1C 83C218 add edx, 00000018--------->EDX=EDX+0x18

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:

|:00483F12(C), :00483F16(C)

|

:00483F1F 8BC2 mov eax, edx-------------->EAX=EDX

:00483F21 C3 ret

========================================================================================

算法整理：

以我的机器码为例：MCN9-SKKC-CCA4

1.BN1=0x4D "M"

EDI=BN1

EDI=EDI-0x41=0xC

2.BN2=0x43 "C"

EDX=BN2

EDX!=0x39

EDX=EDX-0x41+0xA=0xC

3.BN3=0x4E "N"

EBX=BN3

EBX=EBX-0x41+0x24=0x31

4.BN4=0x39 "9"

ESI=BN4

ESI=ESI-0x30=0x9

------------------------------

5.BN6=0x53 "S"

EDI=BN6

EDI=EDI-0x41=0x12

6.BN7=0x4B "K"

EDX=BN7

EDX!=0x39

SN2!=0x5A

EDX=EDX-0x41+0xA=0x14

7.BN8=0x4B "K"

EBX=BN8

EBX=EBX-0x41+0x24=0x2E

8.BN9=0x43 "C"

ESI=BN9

ESI=ESI-0x41+0x24=0x26

------------------------------

9.BN11=0x43 "C"

EDI=BN11

EDI=EDI-0x41=0x2

10.BN12=0x43 "C"

EDX=BN12

EDX!=0x39

SN2!=0x5A

EDX=EDX-0x41+0xA=0xC

11.BN13=0x41 "A"

EBX=BN13

EBX=EBX-0x41+0x24=0x24

12.BN14=0x34 "4"

ESI=BN14

ESI=ESI-0x30=0x4

=============================================

1.EAX=EDI

EAX=EAX+0x30=0x3C

因为：0x3A<EAX<0x40

所以：SN1=EAX+0x32=0x6E "n"

2.EAX=EBX

EAX=EAX+0x30=0x61

因为：EAX>0x40 & EAX>0x60

所以：SN2=EAX=0x61 "a"

3.EAX=ESI

EAX=EAX+0x30=0x39

因为：0x3A<EAX & 0x5B<EAX

所以：SN3=EAX=0x39 "9"

4.EAX=EDI

EAX=EAX+0x30+0x6=0x42

因为：0x3A<EAX<0x40

所以：SN4=EAX=EAX+0x32=0x42 "B"

5.EAX=EBX

EAX=EAX+0x30+0x2=0x63

因为：EAX>0x40 & EAX>0x60

所以：SN5=EAX=0x63 "c"

6.EAX=ESI

EAX=EAX+0x30+1=0x3A

因为：0x40>EAX>0x3A

所以：SN6=EAX+0x32=0x6C "l"

7.SN7为任意字符 "-"

---------------------------------------------

8.EAX=EDI

EAX=EAX+0x30=0x42

因为：0x3A<EAX<0x40

所以：SN8=EAX=0x42 "B"

9.EAX=EBX

EAX=EAX+0x30=0x5E

因为：0x40<EAX & EAX<60

所以：SN9=EAX+0x18=0x76 "v"

10.EAX=ESI

EAX=EAX+0x30=0x56

因为：EAX>0x40 & 0x60>EAX

所以：SN10=EAX+0x18=0x6E "n"

11.EAX=EDI

EAX=EAX+0x30+0x8=0x4A

因为：EAX>0x40 & EAX<0x5B

所以：SN11=EAX=0x4A "J"

12.EAX=EBX

EAX=EAX+0x30+1=0x5F

因为：0x40<EAX & EAX<60

所以：SN12=EAX+0x18=0x77 "w"

13.EAX=ESI

EAX=EAX+0x30+0x2=0x58

因为：0x40<EAX & EAX<60

所以：SN13=EAX+0x18=0x70 "p"

14.SN14为任意字符 "-"

---------------------------------------------

15.EAX=EDI

EAX=EAX+0x30=0x32

因为：0x3A<EAX<0x40

所以：SN15=EAX=0x32 "2"

16.EAX=EBX

EAX=EAX+0x30=0x54

因为：0x40<EAX & EAX<5B

所以：SN16=EAX=0x54 "T"

17.EAX=ESI

EAX=EAX+0x30=0x34

因为：0x3A>EAX & EAX<5B

所以：SN17=EAX=0x34 "4"

18.EAX=EDI

EAX=EAX+0x30+0xD=0x3F

因为：0x3A<EAX<0x40

所以：SN18=EAX+0x32=0x71 "q"

19.EAX=EBX

EAX=EAX+0x30+0x2=0x56

因为：0x40<EAX & EAX<5B

所以：SN19=EAX=0x56 "V"

20.EAX=ESI

EAX=EAX+0x30+0x2=0x36

因为：0x3A>EAX & EAX<5B

所以：SN20=EAX=0x36 "6"

整理:BN="MCN9-SKKC-CCA4"

SN="na9Bcl-BvnJwp-2T4qV6

（出处：赢政天下整理收藏）

相关文章：

·语音界面2.0算法分析及注册机源码！

·侠客系统修改器1.21破解手记--算法分析

·中文拨号上网计时计费器 V4.12注册算法分析

·ClockWise 3.22e注册码算法分析

·CoolClock V1.02注册算法分析

·Directory Scanner v1.5 注册算法分析

·Disk Chief 1.2 简单注册算法分析

·EffeTech HTTP Sniffer 3.2注册算法分析

·eLib2.01算法分析

·EZ MP3 Recorder 1.15 注册算法分析

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net