acoustica2.25的破解(2)

call 0044B130　　（关键）f8跟进

:0044B130 55                      push ebp
:0044B131 8BEC                    mov ebp, esp
:0044B133 81C4BCFEFFFF            add esp, FFFFFEBC
:0044B139 A184F84900              mov eax, dword ptr [0049F884]
:0044B13E 8B1546E84A00            mov edx, dword ptr [004AE846]
:0044B144 53                      push ebx
:0044B145 56                      push esi
:0044B146 57                      push edi
:0044B147 8945FC                  mov dword ptr [ebp-04], eax
:0044B14A 6A50                    push 00000050
:0044B14C 8D45AC                  lea eax, dword ptr [ebp-54]

* Possible Reference to Dialog: 
                                 |
:0044B14F 6841FD4900              push 0049FD41
:0044B154 50                      push eax

* Possible StringData Ref from Data Obj ->"Name"
                                 |
:0044B155 683CFD4900              push 0049FD3C

* Possible StringData Ref from Data Obj ->"RegisterInfo"
                                 |
:0044B15A 682FFD4900              push 0049FD2F
:0044B15F 52                      push edx
:0044B160 BEC73A0000              mov esi, 00003AC7

                                                    esi=00003ac7(后面要用的）
:0044B165 E8C2A0FCFF              call 0041522C　　　取姓名的chen
:0044B16A 83C418                  add esp, 00000018
:0044B16D 8D8D5CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF5C]
:0044B173 A146E84A00              mov eax, dword ptr [004AE846]
:0044B178 6A50                    push 00000050

* Possible Reference to Dialog: 
                                 |
:0044B17A 6857FD4900              push 0049FD57
:0044B17F 51                      push ecx

* Possible StringData Ref from Data Obj ->"Company"
                                 |
:0044B180 684FFD4900              push 0049FD4F

* Possible StringData Ref from Data Obj ->"RegisterInfo"
                                 |
:0044B185 6842FD4900              push 0049FD42
:0044B18A 50                      push eax
:0044B18B E89CA0FCFF              call 0041522C
:0044B190 83C418                  add esp, 00000018
:0044B193 8D950CFFFFFF            lea edx, dword ptr [ebp+FFFFFF0C]
:0044B199 8B0D46E84A00            mov ecx, dword ptr [004AE846]
:0044B19F 6A50                    push 00000050

* Possible Reference to Dialog: 
                                 |
:0044B1A1 6869FD4900              push 0049FD69
:0044B1A6 52                      push edx

* Possible StringData Ref from Data Obj ->"Key"
                                 |
:0044B1A7 6865FD4900              push 0049FD65

* Possible StringData Ref from Data Obj ->"RegisterInfo"
                                 |
:0044B1AC 6858FD4900              push 0049FD58
:0044B1B1 51                      push ecx
:0044B1B2 E875A0FCFF              call 0041522C
:0044B1B7 83C418                  add esp, 00000018
:0044B1BA 8D45AC                  lea eax, dword ptr [ebp-54]    eax=姓名
:0044B1BD 50                      push eax
:0044B1BE E81DE20300              call 004893E0
:0044B1C3 59                      pop ecx　　　（ecx=姓名
:0044B1C4 8D955CFFFFFF            lea edx, dword ptr [ebp+FFFFFF5C]　（edx=公司名称
:0044B1CA 52                      push edx
:0044B1CB E810E20300              call 004893E0
:0044B1D0 59                      pop ecx

* Possible Ref to Menu: MenuID_0064, Item: "Draw Freehand Volume Curve..."
                                 |

* Possible Reference to String Resource ID=00001: "Enter an arbitary volume curve"
                                 |
:0044B1D1 BB01000000              mov ebx, 00000001        (ebx=1)
:0044B1D6 8D7DAC                  lea edi, dword ptr [ebp-54]
:0044B1D9 EB13                    jmp 0044B1EE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B1FA(C)
|
:0044B1DB 0FBE07                  movsx eax, byte ptr [edi]　edi=姓名chen的每一位的asci码
:0044B1DE 8BD3                    mov edx, ebx　　　　　　 (edx=1
:0044B1E0 83E203                  and edx, 00000003
              (edx and 3当姓名和公司名长度超过3位，edx会处理掉，使edx的数字总是0-3的范围）
　　　　　　　　　　　　　　　　　　　　　　　　　　
:0044B1E3 0FBE4C15FC              movsx ecx, byte ptr [ebp+edx-04]
　　　　　　　　　　　 [ebp－04]是一密码表A4EB7B11
:0044B1E8 F7E9                    imul ecx       
:0044B1EA 03F0                    add esi, eax　（esi的初始数字是00003ac7
:0044B1EC 43                      inc ebx                  ebx来记数
　
:0044B1ED 47                      inc edi　　　　　　　edi每次加一，来取姓名的每一位　　　

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B1D9(U)
|
:0044B1EE 8D45AC                  lea eax, dword ptr [ebp-54]　eax=姓名
:0044B1F1 50                      push eax　　　　　　　　　　　
:0044B1F2 E805570300              call 004808FC　　　获取姓名的长度　eax=姓名的长度　　　　　
:0044B1F7 59                      pop ecx
:0044B1F8 3BD8                    cmp ebx, eax　　　　　　　　取姓名完了吗？
:0044B1FA 76DF                    jbe 0044B1DB

* Possible Ref to Menu: MenuID_0064, Item: "Draw Freehand Volume Curve..."
                                 |

* Possible Reference to String Resource ID=00001: "Enter an arbitary volume curve"
                                 |
:0044B1FC BB01000000              mov ebx, 00000001
:0044B201 8DBD5CFFFFFF            lea edi, dword ptr [ebp+FFFFFF5C]　　edi=公司的名称
:0044B207 EB13                    jmp 0044B21C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B22B(C)　
|
:0044B209 0FBE07                  movsx eax, byte ptr [edi]　
　　　　　　　　　　　　　　　　　　　　　　　 eax=公司xlin的每一位的asci码　　
:0044B20C 8BD3                    mov edx, ebx
:0044B20E 83E203                  and edx, 00000003
:0044B211 0FBE4C15FC              movsx ecx, byte ptr [ebp+edx-04]
:0044B216 F7E9                    imul ecx       eax=eax * ecx
:0044B218 03F0                    add esi, eax  (esi的初始数字是上面运算得到的数字）
:0044B21A 43                      inc ebx
:0044B21B 47                      inc edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B207(U)
|
:0044B21C 8D855CFFFFFF            lea eax, dword ptr [ebp+FFFFFF5C]
:0044B222 50                      push eax
:0044B223 E8D4560300              call 004808FC　　　　获取公司的长度　eax=公司的长度
:0044B228 59                      pop ecx
:0044B229 3BD8                    cmp ebx, eax　　　　
:0044B22B 76DC                    jbe 0044B209　　　　　取姓名完了吗？
:0044B22D 8BC6                    mov eax, esi          (你经过姓名和公司的asci码运算后得到                                                 的esi的数字传给eax)
:0044B22F B9A0860100              mov ecx, 000186A0
:0044B234 33D2                    xor edx, edx
:0044B236 F7F1                    div ecx                eax mod ecx(000186A0)
:0044B238 8BDA                    mov ebx, edx           edx(余数)传给ebx
:0044B23A 8D85BCFEFFFF            lea eax, dword ptr [ebp+FFFFFEBC]
:0044B240 53                      push ebx

* Possible Reference to Dialog: 
                                 |
:0044B241 686AFD4900              push 0049FD6A　　　　   d 0049fd6a可看见AC220-%d
:0044B246 50                      push eax
:0044B247 E8608E0300              call 004840AC　　　　　（关键的运算）
其实好简单的，是把上面的ebx的数字变成十进制数字，并在转换好的数字前加AC220-,这样就得到真的注册吗)

:0044B24C 83C40C                  add esp, 0000000C　　　d ecx看见真的注册吗
:0044B24F 8D950CFFFFFF            lea edx, dword ptr [ebp+FFFFFF0C]　d edx=假码
:0044B255 52                      push edx
:0044B256 8D8DBCFEFFFF            lea ecx, dword ptr [ebp+FFFFFEBC]　ecx=真的注册吗
:0044B25C 51                      push ecx

* Reference To: KERNEL32.lstrcmpA, Ord:0000h
                                 |
:0044B25D E8344C0400              Call 0048FE96　　（KERNEL32.lstrcmpA是比较哟！）
:0044B262 85C0                    test eax, eax
:0044B264 7504                    jne 0044B26A      (不等就跳转)
:0044B266 B001                    mov al, 01         a1=1 (好东西)看看0044BDBC test al, al)
　　　　　　　　　　　　　　　　　　　　　　　　　　
:0044B268 EB32                    jmp 0044B29C     

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B264(C)
|
:0044B26A 53                      push ebx

* Possible StringData Ref from Data Obj ->"AC220-%d" 
                                      (不等时先看看注册码的前6位是否是AC220-)
                                 |
:0044B26B 6873FD4900              push 0049FD73
:0044B270 8D95BCFEFFFF            lea edx, dword ptr [ebp+FFFFFEBC]
:0044B276 52                      push edx
:0044B277 E8308E0300              call 004840AC
:0044B27C 83C40C                  add esp, 0000000C
:0044B27F 8D8D0CFFFFFF            lea ecx, dword ptr [ebp+FFFFFF0C]
:0044B285 51                      push ecx
:0044B286 8D85BCFEFFFF            lea eax, dword ptr [ebp+FFFFFEBC]
:0044B28C 50                      push eax

* Reference To: KERNEL32.lstrcmpA, Ord:0000h
                                 |
:0044B28D E8044C0400              Call 0048FE96   (KERNEL32.lstrcmpA 比较)
:0044B292 85C0                    test eax, eax
:0044B294 7504                    jne 0044B29A    (不等就会跳转）
:0044B296 B001                    mov al, 01
:0044B298 EB02                    jmp 0044B29C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044B294(C)
|
:0044B29A 33C0                    xor eax, eax　　（看看ax=0)

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0044B268(U), :0044B298(U)
|
:0044B29C 5F                      pop edi
:0044B29D 5E                      pop esi
:0044B29E 5B                      pop ebx
:0044B29F 8BE5                    mov esp, ebp
:0044B2A1 5D                      pop ebp
:0044B2A2 C3                      ret

  name:chen
company:xlin