和009 一样,进入循环后,取出每一个字母,加0xA,然后变回字符,组成一个新的串
lea edx, [ebp+pSrc]
lea eax, [ebp+pCounter]
push edx ; pLenth
push eax ; pValue
mov [ebp+pSrc.Data], 1
mov dword ptr [ebp+pSrc.varType], 2
call ds:__vbaI4Var
lea ecx, [ebp+pDst]
push eax ; nStart
lea edx, [ebp+pTitle]
push ecx ; pSrc
push edx ; pDst
call ds:rtcMidCharVar ;取出第n位字母
lea eax, [ebp+pTitle]
lea ecx, [ebp+var_58]
push eax ; pSrc
push ecx ; pDst
call ds:__vbaStrVarVal
push eax ; Str
call ds:rtcAnsiValueBstr ;变成ascii
add ax, 0Ah ;加0xa
jo loc_40226A
movsx edx, ax
push edx ; MultiByteStr
call ds:rtcBstrFromAnsi ;变回字母
mov [ebp+pvarSrc.Data], eax
lea eax, [ebp+pvarg]
lea ecx, [ebp+pvarSrc]
push eax ; pvarg
lea edx, [ebp+pRet]
push ecx ; pvarSrc
push edx ; pRet
mov dword ptr [ebp+pvarSrc.varType], 8
call ebx ; __vbaVarCat ;连在一起
mov edx, eax ; pSrc
lea ecx, [ebp+pvarg] ; pDst
call esi ; __vbaVarMove
lea ecx, [ebp+var_58] ; Str
call ds:__vbaFreeStr
lea eax, [ebp+pvarSrc]
lea ecx, [ebp+pTitle]
push eax
lea edx, [ebp+pSrc]
然后比较,发现一个字符串
loc_40202B:
lea eax, [ebp+pvarg]
lea ecx, [ebp+pStep]
push eax ; pValue2
push ecx ; pValue1
mov [ebp+pStep.Data], offset aKxyRoYxoMKmuon ; "kXy^rO|*yXo*m\\kMuOn*+"
mov dword ptr [ebp+pStep.varType], 8008h
call ds:__vbaVarTstEq
test ax, ax
jz loc_402119 ;不等有就跳失败
注册机
那就倒过来反推,计算出来发现是 aNoThEr oNe cRaCkEd !
static string RegCode(string name)
{
StringBuilder sb = new StringBuilder();
foreach (char item in name)
{
sb.Append((char)(item - 0xa));
}
return sb.ToString();
}
