AL=2注册版，何时改？最佳时机与定位技法讨论学习探讨交流大会
来，各位道友，请作答吧。{:301_974:}；要是你的话，哪行（里）去修改？为什么？ 科学依据是什么？可有更高效的方法 或 技巧 ？
00007FF6B4984370 | 48:895C24 18 | mov qword ptr ss:,rbx |
00007FF6B4984375 | 55 | push rbp |
00007FF6B4984376 | 56 | push rsi |
00007FF6B4984377 | 57 | push rdi |
00007FF6B4984378 | 48:8DAC24 40F0FFFF | lea rbp,qword ptr ss: |
00007FF6B4984380 | B8 C0100000 | mov eax,10C0 |
00007FF6B4984385 | E8 F6851100 | call <filelocatorpro.sub_7FF6B4A9C980 |
00007FF6B498438A | 48:2BE0 | sub rsp,rax | rax:EntryPoint
00007FF6B498438D | 48:8B05 8C9C3800 | mov rax,qword ptr ds: | rax:EntryPoint
00007FF6B4984394 | 48:33C4 | xor rax,rsp | rax:EntryPoint
00007FF6B4984397 | 48:8985 B00F0000 | mov qword ptr ss:,rax | rax:EntryPoint
00007FF6B498439E | 48:8BDA | mov rbx,rdx | rdx:EntryPoint
00007FF6B49843A1 | 48:8BF9 | mov rdi,rcx |
00007FF6B49843A4 | 0F57C0 | xorps xmm0,xmm0 |
00007FF6B49843A7 | F3:0F7F4424 20 | movdqu xmmword ptr ss:,xmm0 |
00007FF6B49843AD | 33F6 | xor esi,esi |
00007FF6B49843AF | 48:897424 30 | mov qword ptr ss:,rsi | :RtlUserThreadStart+21
00007FF6B49843B4 | 48:8D5424 20 | lea rdx,qword ptr ss: | rdx:EntryPoint
00007FF6B49843B9 | E8 92010000 | call <filelocatorpro.sub_7FF6B4984550 |
00007FF6B49843BE | 85C0 | test eax,eax |
00007FF6B49843C0 | 0F88 2C010000 | js7FF6B49844F2 |
00007FF6B49843C6 | 48:897424 50 | mov qword ptr ss:,rsi |
00007FF6B49843CB | 48:897424 58 | mov qword ptr ss:,rsi |
00007FF6B49843D0 | 48:897424 50 | mov qword ptr ss:,rsi |
00007FF6B49843D5 | 48:C74424 58 07000000 | mov qword ptr ss:,7 |
00007FF6B49843DE | 66:897424 40 | mov word ptr ss:,si |
00007FF6B49843E3 | 44:8D46 13 | lea r8d,qword ptr ds: |
00007FF6B49843E7 | 48:8D15 9A362500 | lea rdx,qword ptr ds: | rdx:EntryPoint, 00007FF6B4BD7A88:L"InstallationOptions"
00007FF6B49843EE | 48:8D4C24 40 | lea rcx,qword ptr ss: |
00007FF6B49843F3 | E8 C8FDFEFF | call7FF6B49741C0 |
00007FF6B49843F8 | 90 | nop |
00007FF6B49843F9 | 48:8B4F 58 | mov rcx,qword ptr ds: |
00007FF6B49843FD | 48:8B01 | mov rax,qword ptr ds: | rax:EntryPoint
00007FF6B4984400 | 48:8D57 08 | lea rdx,qword ptr ds: | rdx:EntryPoint
00007FF6B4984404 | 45:33C9 | xor r9d,r9d |
00007FF6B4984407 | 4C:8D4424 40 | lea r8,qword ptr ss: |
00007FF6B498440C | FF90 F0000000 | call qword ptr ds: | rax+F0:sub_7FF6B4A95EB4+64
00007FF6B4984412 | 48:894424 38 | mov qword ptr ss:,rax | rax:EntryPoint
00007FF6B4984417 | 48:8B5424 58 | mov rdx,qword ptr ss: | rdx:EntryPoint
00007FF6B498441C | 48:83FA 08 | cmp rdx,8 | rdx:EntryPoint
00007FF6B4984420 | 72 12 | jb7FF6B4984434 |
00007FF6B4984422 | 48:8D1455 02000000 | lea rdx,qword ptr ds: | rdx:EntryPoint
00007FF6B498442A | 48:8B4C24 40 | mov rcx,qword ptr ss: |
00007FF6B498442F | E8 0C00FFFF | call7FF6B4974440 |
00007FF6B4984434 | 48:897424 50 | mov qword ptr ss:,rsi |
00007FF6B4984439 | 48:C74424 58 07000000 | mov qword ptr ss:,7 |
00007FF6B4984442 | 66:897424 40 | mov word ptr ss:,si |
00007FF6B4984447 | 48:837C24 38 00 | cmp qword ptr ss:,0 |
00007FF6B498444D | 0F84 9F000000 | je7FF6B49844F2 |
00007FF6B4984453 | 48:8D3D 06352500 | lea rdi,qword ptr ds:[<&sub_7FF6B498D |
00007FF6B498445A | 48:897C24 40 | mov qword ptr ss:,rdi |
00007FF6B498445F | 8B4424 28 | mov eax,dword ptr ss: |
00007FF6B4984463 | 48:8B5424 20 | mov rdx,qword ptr ss: | rdx:EntryPoint
00007FF6B4984468 | 2BC2 | sub eax,edx |
00007FF6B498446A | 0F57C0 | xorps xmm0,xmm0 |
00007FF6B498446D | 0F114424 48 | movups xmmword ptr ss:,xmm0 |
00007FF6B4984472 | C64424 58 01 | mov byte ptr ss:,1 |
00007FF6B4984477 | B9 10000000 | mov ecx,10 |
00007FF6B498447C | 3BC1 | cmp eax,ecx |
00007FF6B498447E | 0F4FC1 | cmovg eax,ecx |
00007FF6B4984481 | 4C:63C0 | movsxd r8,eax |
00007FF6B4984484 | 48:8D4C24 48 | lea rcx,qword ptr ss: |
00007FF6B4984489 | E8 1D861100 | call <JMP.&memmove> |
00007FF6B498448E | C64424 58 00 | mov byte ptr ss:,0 |
00007FF6B4984493 | 48:8D4C24 60 | lea rcx,qword ptr ss: |
00007FF6B4984498 | E8 73890200 | call <filelocatorpro.sub_7FF6B49ACE10 |
00007FF6B498449D | 90 | nop |
00007FF6B498449E | 48:8D5424 40 | lea rdx,qword ptr ss: | rdx:EntryPoint
00007FF6B49844A3 | 48:8D4C24 60 | lea rcx,qword ptr ss: |
00007FF6B49844A8 | E8 537D0200 | call <filelocatorpro.sub_7FF6B49AC200 |
00007FF6B49844AD | 48:8D5424 38 | lea rdx,qword ptr ss: | rdx:EntryPoint
00007FF6B49844B2 | 48:8D4C24 60 | lea rcx,qword ptr ss: |
00007FF6B49844B7 | E8 548B0200 | call <filelocatorpro.sub_7FF6B49AD010 |
00007FF6B49844BC | 48:8B4424 38 | mov rax,qword ptr ss: | rax:EntryPoint
00007FF6B49844C1 | 48:A9 0000FFFF | test rax,FFFFFFFFFFFF0000 | rax:EntryPoint
00007FF6B49844C7 | 75 19 | jne7FF6B49844E2 |
00007FF6B49844C9 | 25 FF030000 | and eax,3FF |
00007FF6B49844CE | 8903 | mov dword ptr ds:,eax |
00007FF6B49844D0 | 48:8D4C24 60 | lea rcx,qword ptr ss: |
00007FF6B49844D5 | E8 56890200 | call <filelocatorpro.sub_7FF6B49ACE30 | 与注册码有关
00007FF6B49844DA | 90 | nop |
00007FF6B49844DB | 48:897C24 40 | mov qword ptr ss:,rdi |
00007FF6B49844E0 | EB 16 | jmp7FF6B49844F8 |
00007FF6B49844E2 | 48:8D4C24 60 | lea rcx,qword ptr ss: |
00007FF6B49844E7 | E8 44890200 | call <filelocatorpro.sub_7FF6B49ACE30 | 与注册码有关
00007FF6B49844EC | 90 | nop |
00007FF6B49844ED | 48:897C24 40 | mov qword ptr ss:,rdi |
00007FF6B49844F2 | C703 00020000 | mov dword ptr ds:,200 |
00007FF6B49844F8 | 48:8B4C24 20 | mov rcx,qword ptr ss: |
00007FF6B49844FD | 48:85C9 | test rcx,rcx |
00007FF6B4984500 | 74 1B | je7FF6B498451D |
00007FF6B4984502 | 48:8B5424 30 | mov rdx,qword ptr ss: | rdx:EntryPoint, :RtlUserThreadStart+21
00007FF6B4984507 | 48:2BD1 | sub rdx,rcx | rdx:EntryPoint
00007FF6B498450A | E8 31FFFEFF | call7FF6B4974440 |
00007FF6B498450F | 0F57C0 | xorps xmm0,xmm0 |
00007FF6B4984512 | 48:897424 30 | mov qword ptr ss:,rsi | :RtlUserThreadStart+21
00007FF6B4984517 | F3:0F7F4424 20 | movdqu xmmword ptr ss:,xmm0 |
00007FF6B498451D | 48:8BC3 | mov rax,rbx | rax:EntryPoint
00007FF6B4984520 | 48:8B8D B00F0000 | mov rcx,qword ptr ss: |
00007FF6B4984527 | 48:33CC | xor rcx,rsp |
00007FF6B498452A | E8 21191100 | call7FF6B4A95E50 |
00007FF6B498452F | 48:8B9C24 F0100000 | mov rbx,qword ptr ss: |
00007FF6B4984537 | 48:81C4 C0100000 | add rsp,10C0 |
00007FF6B498453E | 5F | pop rdi |
00007FF6B498453F | 5E | pop rsi |
00007FF6B4984540 | 5D | pop rbp |
00007FF6B4984541 | C3 | ret |
页:
[1]