1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

004220ED   .  6A 01         push    1
004220EF   .  52            push    edx
004220F0   .  50            push    eax
004220F1   .  8B4424 3C     mov     eax, dword ptr [esp+3C]
004220F5   .  8B50 28       mov     edx, dword ptr [eax+28]
004220F8   .  8D4C24 3C     lea     ecx, dword ptr [esp+3C]
004220FC   .  FFD2          call    edx
004220FE   .  01B424 700100>add     dword ptr [esp+170], esi
00422105   .  8D4424 28     lea     eax, dword ptr [esp+28]
00422109   .  E8 E2F6FEFF   call    004117F0
0042210E   .  8DBD CC000000 lea     edi, dword ptr [ebp+CC]
00422114   .  8BDF          mov     ebx, edi
00422116   .  E8 656EFEFF   call    00408F80
0042211B   .  8BD8          mov     ebx, eax
0042211D   .  E8 DE6EFEFF   call    00409000
00422122   .  50            push    eax
00422123   .  8BCF          mov     ecx, edi
00422125   .  E8 E6F9FDFF   call    00401B10                         ;  用户名
0042212A   .  57            push    edi
0042212B   .  8D8C24 880100>lea     ecx, dword ptr [esp+188]
00422132   .  E8 D9F9FDFF   call    00401B10                         ;  机器码
00422137   .  8B45 74       mov     eax, dword ptr [ebp+74]
0042213A   .  51            push    ecx
0042213B   .  83E8 10       sub     eax, 10
0042213E   .  896424 24     mov     dword ptr [esp+24], esp
00422142   .  8BF4          mov     esi, esp
00422144   .  50            push    eax
00422145   .  E8 56F9FDFF   call    00401AA0
0042214A   .  83C0 10       add     eax, 10
0042214D   .  8906          mov     dword ptr [esi], eax
0042214F   .  83C4 04       add     esp, 4
00422152   .  8D7424 24     lea     esi, dword ptr [esp+24]
00422156   .  E8 75FCFFFF   call    00421DD0
0042215B   .  50            push    eax
0042215C   .  C68424 A00100>mov     byte ptr [esp+1A0], 2
00422164   .  BB 01000000   mov     ebx, 1
00422169   .  57            push    edi
0042216A   .  895C24 30     mov     dword ptr [esp+30], ebx
0042216E   .  E8 ADEEFEFF   call    00411020                         ;  关键call
00422173   .  83C4 0C       add     esp, 0C
00422176   .  84C0          test    al, al
00422178   .  74 23         je      short 0042219D                   ;  关键跳
0042217A   .  8B8424 780100>mov     eax, dword ptr [esp+178]
00422181   .  85C0          test    eax, eax
00422183   .  74 18         je      short 0042219D
00422185   .  398424 700100>cmp     dword ptr [esp+170], eax
0042218C   .  74 0F         je      short 0042219D
0042218E   .  8D4424 28     lea     eax, dword ptr [esp+28]
00422192   .  E8 C9F6FEFF   call    00411860
00422197   .  885C24 17     mov     byte ptr [esp+17], bl
0042219B   .  EB 05         jmp     short 004221A2
0042219D   >  C64424 17 00  mov     byte ptr [esp+17], 0
004221A2   >  899C24 980100>mov     dword ptr [esp+198], ebx
004221A9   .  8B4424 20     mov     eax, dword ptr [esp+20]
004221AD   .  83C0 F0       add     eax, -10
004221B0   .  8D48 0C       lea     ecx, dword ptr [eax+C]
004221B3   .  83CA FF       or      edx, FFFFFFFF

004220ED . 6A 01 push 1 004220EF . 52 push edx 004220F0 . 50 push eax 004220F1 . 8B4424 3C mov eax, dword ptr [esp+3C] 004220F5 . 8B50 28 mov edx, dword ptr [eax+28] 004220F8 . 8D4C24 3C lea ecx, dword ptr [esp+3C] 004220FC . FFD2 call edx 004220FE . 01B424 700100>add dword ptr [esp+170], esi 00422105 . 8D4424 28 lea eax, dword ptr [esp+28] 00422109 . E8 E2F6FEFF call 004117F0 0042210E . 8DBD CC000000 lea edi, dword ptr [ebp+CC] 00422114 . 8BDF mov ebx, edi 00422116 . E8 656EFEFF call 00408F80 0042211B . 8BD8 mov ebx, eax 0042211D . E8 DE6EFEFF call 00409000 00422122 . 50 push eax 00422123 . 8BCF mov ecx, edi 00422125 . E8 E6F9FDFF call 00401B10 ; 用户名 0042212A . 57 push edi 0042212B . 8D8C24 880100>lea ecx, dword ptr [esp+188] 00422132 . E8 D9F9FDFF call 00401B10 ; 机器码 00422137 . 8B45 74 mov eax, dword ptr [ebp+74] 0042213A . 51 push ecx 0042213B . 83E8 10 sub eax, 10 0042213E . 896424 24 mov dword ptr [esp+24], esp 00422142 . 8BF4 mov esi, esp 00422144 . 50 push eax 00422145 . E8 56F9FDFF call 00401AA0 0042214A . 83C0 10 add eax, 10 0042214D . 8906 mov dword ptr [esi], eax 0042214F . 83C4 04 add esp, 4 00422152 . 8D7424 24 lea esi, dword ptr [esp+24] 00422156 . E8 75FCFFFF call 00421DD0 0042215B . 50 push eax 0042215C . C68424 A00100>mov byte ptr [esp+1A0], 2 00422164 . BB 01000000 mov ebx, 1 00422169 . 57 push edi 0042216A . 895C24 30 mov dword ptr [esp+30], ebx 0042216E . E8 ADEEFEFF call 00411020 ; 关键call 00422173 . 83C4 0C add esp, 0C 00422176 . 84C0 test al, al 00422178 . 74 23 je short 0042219D ; 关键跳 0042217A . 8B8424 780100>mov eax, dword ptr [esp+178] 00422181 . 85C0 test eax, eax 00422183 . 74 18 je short 0042219D 00422185 . 398424 700100>cmp dword ptr [esp+170], eax 0042218C . 74 0F je short 0042219D 0042218E . 8D4424 28 lea eax, dword ptr [esp+28] 00422192 . E8 C9F6FEFF call 00411860 00422197 . 885C24 17 mov byte ptr [esp+17], bl 0042219B . EB 05 jmp short 004221A2 0042219D > C64424 17 00 mov byte ptr [esp+17], 0 004221A2 > 899C24 980100>mov dword ptr [esp+198], ebx 004221A9 . 8B4424 20 mov eax, dword ptr [esp+20] 004221AD . 83C0 F0 add eax, -10 004221B0 . 8D48 0C lea ecx, dword ptr [eax+C] 004221B3 . 83CA FF or edx, FFFFFFFF