好友
阅读权限40
听众
最后登录1970-1-1
|
008F5140 . 837D FC 00 cmp dword ptr ss:[ebp-0x4],0x0 这个很重要
008F5144 0F84 9C000000 je notebook.008F51E6
008F514A . 8D55 F0 lea edx,dword ptr ss:[ebp-0x10]
008F514D . 8B45 FC mov eax,dword ptr ss:[ebp-0x4]
008F5150 . E8 13D8DDFF call notebook.006D2968
008F5155 . 837D F0 00 cmp dword ptr ss:[ebp-0x10],0x0 这个很重要
008F5159 0F84 87000000 je notebook.008F51E6
008F515F . 8D55 E8 lea edx,dword ptr ss:[ebp-0x18]
008F5162 . A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
008F5167 . 8B40 04 mov eax,dword ptr ds:[eax+0x4]
008F516A . E8 1598DDFF call notebook.006CE984
008F516F . FF75 E8 push dword ptr ss:[ebp-0x18]
008F5172 . 68 40528F00 push notebook.008F5240 ; notekey
008F5177 . 68 5C528F00 push notebook.008F525C ; 1
008F517C . 68 6C528F00 push notebook.008F526C ; .bin
008F5181 . 8D45 EC lea eax,dword ptr ss:[ebp-0x14]
008F5184 . BA 04000000 mov edx,0x4
008F5189 . E8 7E38B1FF call notebook.00408A0C
008F518E . 8B45 EC mov eax,dword ptr ss:[ebp-0x14]
008F5191 . 8B55 FC mov edx,dword ptr ss:[ebp-0x4]
008F5194 . E8 FBB8DDFF call notebook.006D0A94
008F5199 . 68 84528F00 push notebook.008F5284 ; Registration complete.
008F519E . A1 3CFABF00 mov eax,dword ptr ds:[0xBFFA3C]
008F51A3 . FF30 push dword ptr ds:[eax]
008F51A5 . 68 C0528F00 push notebook.008F52C0 ; Please restart
008F51AA . 68 EC528F00 push notebook.008F52EC ; AM-Notebook
00B46B5C |. /0F84 7D010000 je notebook.00B46CDF
00B46B62 |. |8D55 E4 lea edx,[local.7]
00B46B65 |. |B8 35080000 mov eax,0x835
00B46B6A |. |E8 9DB4DDFF call notebook.0092200C
00B46B6F |. |8B55 E4 mov edx,[local.7]
00B46B72 |. |8B83 A0030000 mov eax,dword ptr ds:[ebx+0x3A0]
00B46B78 |. |E8 878099FF call notebook.004DEC04
00B46B7D |. |33D2 xor edx,edx
00B46B7F |. |8B83 A4030000 mov eax,dword ptr ds:[ebx+0x3A4]
00B46B85 |. |E8 7A8099FF call notebook.004DEC04
00B46B8A |. |BA 846EB400 mov edx,notebook.00B46E84 ; unregistered
00B46B8F |. |8B83 A8030000 mov eax,dword ptr ds:[ebx+0x3A8]
00B46B95 |. |E8 6A8099FF call notebook.004DEC04
00B46B9A |. |A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
00B46B9F |. |83B8 20010000>cmp dword ptr ds:[eax+0x120],0x0
00B46BA6 |. |0F84 33010000 je notebook.00B46CDF
00B46BAC |. |A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
00B46BB1 |. |80B8 3C010000>cmp byte ptr ds:[eax+0x13C],0x0
00B46BB8 |. |74 42 je Xnotebook.00B46BFC
00B46BBA |. |8B35 FCFEBF00 mov esi,dword ptr ds:[0xBFFEFC] ; notebook.00C079A8
00B46BC0 |. |8BB6 20010000 mov esi,dword ptr ds:[esi+0x120]
00B46BC6 |. |8D55 F8 lea edx,[local.2]
00B46BC9 |. |8975 E0 mov [local.8],esi
00B46BCC |. |8B45 E0 mov eax,[local.8]
00B46BCF |. |E8 404E8CFF call notebook.0040BA14
00B46BD4 |. |6A 01 push 0x1
00B46BD6 |. |8D45 DC lea eax,[local.9]
00B46BD9 |. |50 push eax
00B46BDA |. |B9 AC6EB400 mov ecx,notebook.00B46EAC ; &&
00B46BDF |. |BA C06EB400 mov edx,notebook.00B46EC0 ; &
00B46BE4 |. |8B45 F8 mov eax,[local.2]
00B46BE7 |. |E8 8463B8FF call notebook.006CCF70
00B46BEC |. |8B55 DC mov edx,[local.9]
00B46BEF |. |8B83 A4030000 mov eax,dword ptr ds:[ebx+0x3A4]
00B46BF5 |. |E8 0A8099FF call notebook.004DEC04
00B46BFA |. |EB 3A jmp Xnotebook.00B46C36
00B46BFC |> |6A 01 push 0x1
00B46BFE |. |8D45 D8 lea eax,[local.10]
00B46C01 |. |50 push eax
00B46C02 |. |8D45 D4 lea eax,[local.11]
00B46C05 |. |8B15 FCFEBF00 mov edx,dword ptr ds:[0xBFFEFC] ; notebook.00C079A8
00B46C0B |. |8B92 20010000 mov edx,dword ptr ds:[edx+0x120]
00B46C11 |. |E8 DA1B8CFF call notebook.004087F0
00B46C16 |. |8B45 D4 mov eax,[local.11]
00B46C19 |. |B9 AC6EB400 mov ecx,notebook.00B46EAC ; &&
00B46C1E |. |BA C06EB400 mov edx,notebook.00B46EC0 ; &
00B46C23 |. |E8 4863B8FF call notebook.006CCF70
00B46C28 |. |8B55 D8 mov edx,[local.10]
00B46C2B |. |8B83 A4030000 mov eax,dword ptr ds:[ebx+0x3A4]
00B46C31 |. |E8 CE7F99FF call notebook.004DEC04
00B46C36 |> |A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
00B46C3B |. |80B8 28010000>cmp byte ptr ds:[eax+0x128],0x0
00B46C42 |. |75 2E jnz Xnotebook.00B46C72
00B46C44 |. |A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
00B46C49 |. |8B80 2C010000 mov eax,dword ptr ds:[eax+0x12C]
00B46C4F |. |BA D06EB400 mov edx,notebook.00B46ED0 ; 98
00B46C54 |. |E8 5F148CFF call notebook.004080B8
00B46C59 |. |74 17 je Xnotebook.00B46C72
00B46C5B |. |A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
00B46C60 |. |8B80 2C010000 mov eax,dword ptr ds:[eax+0x12C]
00B46C66 |. |BA E06EB400 mov edx,notebook.00B46EE0 ; 99
00B46C6B |. |E8 48148CFF call notebook.004080B8
00B46C70 |. |75 3B jnz Xnotebook.00B46CAD
00B46C72 |> |A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
00B46C77 |. |8B80 2C010000 mov eax,dword ptr ds:[eax+0x12C]
00B46C7D |. |BA D06EB400 mov edx,notebook.00B46ED0 ; 98
00B46C82 |. |E8 31148CFF call notebook.004080B8
00B46C87 |. |75 12 jnz Xnotebook.00B46C9B
00B46C89 |. |BA F06EB400 mov edx,notebook.00B46EF0 ; Site License (Enterprise Edition)
00B46C8E |. |8B83 A8030000 mov eax,dword ptr ds:[ebx+0x3A8]
00B46C94 |. |E8 6B7F99FF call notebook.004DEC04
00B46C99 |. |EB 44 jmp Xnotebook.00B46CDF
00B46C9B |> |BA 406FB400 mov edx,notebook.00B46F40 ; Site License
00B46CA0 |. |8B83 A8030000 mov eax,dword ptr ds:[ebx+0x3A8]
00B46CA6 |. |E8 597F99FF call notebook.004DEC04
00B46CAB |. |EB 32 jmp Xnotebook.00B46CDF
00B46CAD |> |8D45 CC lea eax,[local.13]
00B46CB0 |. |8B15 FCFEBF00 mov edx,dword ptr ds:[0xBFFEFC] ; notebook.00C079A8
00B46CB6 |. |8B92 2C010000 mov edx,dword ptr ds:[edx+0x12C]
00B46CBC |. |E8 2F1B8CFF call notebook.004087F0
00B46CC1 |. |8B4D CC mov ecx,[local.13]
00B46CC4 |. |8D45 D0 lea eax,[local.12]
00B46CC7 |. |BA 686FB400 mov edx,notebook.00B46F68 ; Number of licenses:
00B46CCC |. |E8 B31C8CFF call notebook.00408984
00B46CD1 |. |8B55 D0 mov edx,[local.12]
00B46CD4 |. |8B83 A8030000 mov eax,dword ptr ds:[ebx+0x3A8]
00B46CDA |. |E8 257F99FF call notebook.004DEC04
00B46CDF |> \8B15 8CF5BF00 mov edx,dword ptr ds:[0xBFF58C] ; notebook.00C07B38
004080B8 /$ 39D0 cmp eax,edx
004080BA |. 74 2B je Xnotebook.004080E7
004080BC |. 85D0 test eax,edx
004080BE |. 74 2C je Xnotebook.004080EC
004080C0 |> 8B48 FC mov ecx,dword ptr ds:[eax-0x4]
004080C3 |. 3B4A FC cmp ecx,dword ptr ds:[edx-0x4]
004080C6 |. 75 1F jnz Xnotebook.004080E7
004080C8 |. 53 push ebx
004080C9 |. 8D5411 FC lea edx,dword ptr ds:[ecx+edx-0x4]
004080CD |. 8D5C01 FC lea ebx,dword ptr ds:[ecx+eax-0x4]
004080D1 |. F7D9 neg ecx
004080D3 |. 8B03 mov eax,dword ptr ds:[ebx]
004080D5 |. 3B02 cmp eax,dword ptr ds:[edx]
004080D7 |. 75 0D jnz Xnotebook.004080E6
004080D9 |> 83C1 04 /add ecx,0x4
004080DC |. 79 0A |jns Xnotebook.004080E8
004080DE |. 8B0419 |mov eax,dword ptr ds:[ecx+ebx]
004080E1 |. 3B0411 |cmp eax,dword ptr ds:[ecx+edx]
004080E4 |.^ 74 F3 \je Xnotebook.004080D9
004080E6 |> 5B pop ebx
004080E7 |> C3 retn
004080E8 |> 31C0 xor eax,eax
004080EA |. 5B pop ebx
004080EB |. C3 retn
004080EC |> 85C0 test eax,eax
004080EE |. 74 08 je Xnotebook.004080F8
004080F0 |. 85D2 test edx,edx
004080F2 |.^ 75 CC jnz Xnotebook.004080C0
004080F4 |. 3950 FC cmp dword ptr ds:[eax-0x4],edx
004080F7 |. C3 retn
004080F8 |> 3B42 FC cmp eax,dword ptr ds:[edx-0x4]
004080FB \. C3 retn
edx=0043AEEC (notebook.0043AEEC), ASCII "SmtpPassword"
eax=0290669C, (ASCII "Enabled")
本地调用来自 0041027A, 004120BF, 0041F4FF, 0041FABC, 0042046F, 0042050C, 00422CA3, 0042694E, 0042695D,
004269A4, 004269CA, 0042CA5C, 0042D1C1, 0042D1DD, 0042D1F9, 0042D215, 0042D7ED, 0042D809, 0042D825, 0042D841, 0042DD51, 0042DF3E, 0042DF67, M)
008F5324=notebook.008F5324 (UNICODE "Sorry, but the entered License is not valid!")
跳转来自 008F5144, 008F5159
本地调用来自 008F4F86, 008F5150, 008F5415, 008FBC1C, 00A0304C, 00A7B33B, 00B37245
008F4E87 |. B8 08508F00 mov eax,notebook.008F5008 ; -----KEY BEGIN KEY-----
008F4EA8 |. B8 44508F00 mov eax,notebook.008F5044 ; -----KEY END KEY-----
008F507A \00005200 dd notebook.00520000 ; UNICODE "arkSalmon"
008F4E58 /$ 55 push ebp
008F4E59 |. 8BEC mov ebp,esp
008F4E5B |. 33C9 xor ecx,ecx
008F4E5D |. 51 push ecx
008F4E5E |. 51 push ecx
008F4E5F |. 51 push ecx
008F4E60 |. 51 push ecx
008F4E61 |. 51 push ecx
008F4E62 |. 51 push ecx
008F4E63 |. 51 push ecx
008F4E64 |. 51 push ecx
008F4E65 |. 53 push ebx
008F4E66 |. 56 push esi
008F4E67 |. 57 push edi
008F4E68 |. 8955 F4 mov [local.3],edx
008F4E6B |. 8945 FC mov [local.1],eax
008F4E6E |. 8B45 FC mov eax,[local.1]
008F4E71 |. E8 3E29B1FF call notebook.004077B4
008F4E76 |. 33C0 xor eax,eax
008F4E78 |. 55 push ebp
008F4E79 |. 68 EE4F8F00 push notebook.008F4FEE
008F4E7E |. 64:FF30 push dword ptr fs:[eax]
008F4E81 |. 64:8920 mov dword ptr fs:[eax],esp
008F4E84 |. 8B55 FC mov edx,[local.1]
008F4E87 |. B8 08508F00 mov eax,notebook.008F5008 ; -----KEY BEGIN KEY-----
008F4E8C |. E8 2F3EB1FF call notebook.00408CC0
008F4E91 |. 85C0 test eax,eax
008F4E93 |. 7E 10 jle Xnotebook.008F4EA5
008F4E95 |. 8D48 17 lea ecx,dword ptr ds:[eax+0x17]
008F4E98 |. 8D45 FC lea eax,[local.1]
008F4E9B |. BA 01000000 mov edx,0x1
008F4EA0 |. E8 F73CB1FF call notebook.00408B9C
008F4EA5 |> 8B55 FC mov edx,[local.1]
008F4EA8 |. B8 44508F00 mov eax,notebook.008F5044 ; -----KEY END KEY-----
008F4EAD |. E8 0E3EB1FF call notebook.00408CC0
008F4EB2 |. 85C0 test eax,eax
008F4EB4 |. 7E 0E jle Xnotebook.008F4EC4
008F4EB6 |. 8D55 FC lea edx,[local.1]
008F4EB9 |. B9 FFFFFF7F mov ecx,0x7FFFFFFF
008F4EBE |. 92 xchg eax,edx
008F4EBF |. E8 D83CB1FF call notebook.00408B9C
008F4EC4 |> 8B55 FC mov edx,[local.1]
008F4EC7 |. B8 7C508F00 mov eax,notebook.008F507C ; REGEDIT4
008F4ECC |. E8 EF3DB1FF call notebook.00408CC0
008F4ED1 |. 85C0 test eax,eax
008F4ED3 |. 7E 10 jle Xnotebook.008F4EE5
008F4ED5 |. 8D48 08 lea ecx,dword ptr ds:[eax+0x8]
008F4ED8 |. 8D45 FC lea eax,[local.1]
008F4EDB |. BA 01000000 mov edx,0x1
008F4EE0 |. E8 B73CB1FF call notebook.00408B9C
008F4EE5 |> 8D55 EC lea edx,[local.5]
008F4EE8 |. 8B45 FC mov eax,[local.1]
008F4EEB |. E8 806EDDFF call notebook.006CBD70
008F4EF0 |. 8B55 EC mov edx,[local.5]
008F4EF3 |. 8D45 FC lea eax,[local.1]
008F4EF6 |. E8 FD2BB1FF call notebook.00407AF8
008F4EFB |. 6A 01 push 0x1
008F4EFD |. 8D45 E8 lea eax,[local.6]
008F4F00 |. 50 push eax
008F4F01 |. 33C9 xor ecx,ecx
008F4F03 |. BA 9C508F00 mov edx,notebook.008F509C
008F4F08 |. 8B45 FC mov eax,[local.1]
008F4F0B |. E8 6080DDFF call notebook.006CCF70
008F4F10 |. 8B55 E8 mov edx,[local.6]
008F4F13 |. 8D45 FC lea eax,[local.1]
008F4F16 |. E8 DD2BB1FF call notebook.00407AF8
008F4F1B |. 8B55 F4 mov edx,[local.3]
008F4F1E |. 8B45 FC mov eax,[local.1]
008F4F21 |. E8 AA2BB8FF call notebook.00477AD0
008F4F26 |. 8B45 F4 mov eax,[local.3]
008F4F29 |. E8 A227B1FF call notebook.004076D0
008F4F2E |. 8B45 FC mov eax,[local.1]
008F4F31 |. 85C0 test eax,eax
008F4F33 |. 74 05 je Xnotebook.008F4F3A
008F4F35 |. 83E8 04 sub eax,0x4
008F4F38 |. 8B00 mov eax,dword ptr ds:[eax]
008F4F3A |> 85C0 test eax,eax
008F4F3C |. 7E 7D jle Xnotebook.008F4FBB
008F4F3E |. 8945 F0 mov [local.4],eax
008F4F41 |. BB 01000000 mov ebx,0x1
008F4F46 |> 8BD3 /mov edx,ebx
008F4F48 |. 8B45 FC |mov eax,[local.1]
008F4F4B |. 85C0 |test eax,eax
008F4F4D |. 74 05 |je Xnotebook.008F4F54
008F4F4F |. 83E8 04 |sub eax,0x4
008F4F52 |. 8B00 |mov eax,dword ptr ds:[eax]
008F4F54 |> 8BF2 |mov esi,edx
008F4F56 |. 8BF8 |mov edi,eax
008F4F58 |. 2BFE |sub edi,esi
008F4F5A |. 7C 59 |jl Xnotebook.008F4FB5
008F4F5C |. 47 |inc edi
008F4F5D |> 8D45 E4 |/lea eax,[local.7]
008F4F60 |. 50 ||push eax
008F4F61 |. 8BCE ||mov ecx,esi
008F4F63 |. 2BCB ||sub ecx,ebx
008F4F65 |. 41 ||inc ecx
008F4F66 |. 8BD3 ||mov edx,ebx
008F4F68 |. 8B45 FC ||mov eax,[local.1]
008F4F6B |. E8 E43BB1FF ||call notebook.00408B54
008F4F70 |. 8B55 E4 ||mov edx,[local.7]
008F4F73 |. 8D45 F8 ||lea eax,[local.2]
008F4F76 |. B9 00000000 ||mov ecx,0x0
008F4F7B |. E8 0C33B1FF ||call notebook.0040828C
008F4F80 |. 8D55 E0 ||lea edx,[local.8]
008F4F83 |. 8B45 F8 ||mov eax,[local.2]
008F4F86 |. E8 DDD9DDFF ||call notebook.006D2968
008F4F8B |. 8B55 E0 ||mov edx,[local.8]
008F4F8E |. 8D45 F8 ||lea eax,[local.2]
008F4F91 |. E8 062CB1FF ||call notebook.00407B9C
008F4F96 |. 837D F8 00 ||cmp [local.2],0x0
008F4F9A |. 74 15 ||je Xnotebook.008F4FB1
008F4F9C |. 8B45 F4 ||mov eax,[local.3]
008F4F9F |. 50 ||push eax
008F4FA0 |. 8BCE ||mov ecx,esi
008F4FA2 |. 2BCB ||sub ecx,ebx
008F4FA4 |. 41 ||inc ecx
008F4FA5 |. 8BD3 ||mov edx,ebx
008F4FA7 |. 8B45 FC ||mov eax,[local.1]
008F4FAA |. E8 A53BB1FF ||call notebook.00408B54
008F4FAF |. EB 0A ||jmp Xnotebook.008F4FBB
008F4FB1 |> 46 ||inc esi
008F4FB2 |. 4F ||dec edi
008F4FB3 |.^ 75 A8 |\jnz Xnotebook.008F4F5D
008F4FB5 |> 43 |inc ebx
008F4FB6 |. FF4D F0 |dec [local.4]
008F4FB9 |.^ 75 8B \jnz Xnotebook.008F4F46
008F4FBB |> 33C0 xor eax,eax
008F4FBD |. 5A pop edx
008F4FBE |. 59 pop ecx
008F4FBF |. 59 pop ecx
008F4FC0 |. 64:8910 mov dword ptr fs:[eax],edx
008F4FC3 |. 68 F54F8F00 push notebook.008F4FF5
008F4FC8 |> 8D45 E0 lea eax,[local.8]
008F4FCB |. E8 2427B1FF call notebook.004076F4
008F4FD0 |. 8D45 E4 lea eax,[local.7]
008F4FD3 |. BA 03000000 mov edx,0x3
008F4FD8 |. E8 5327B1FF call notebook.00407730
008F4FDD |. 8D45 F8 lea eax,[local.2]
008F4FE0 |. E8 0F27B1FF call notebook.004076F4
008F4FE5 |. 8D45 FC lea eax,[local.1]
008F4FE8 |. E8 E326B1FF call notebook.004076D0
008F4FED \. C3 retn
-----KEY BEGIN KEY-----
arkSalmonarkSalmonarkSalmonarkSalmonarkSalmonarkSalmonarkSalmonarkSalmonarkSalmonarkSalmonlmonarkSalmonlmonarkSalmonlmonarkSalmonlmonarkSalmon
-----KEY END KEY-----
ds:[00C079AC]=028D3AE4, (UNICODE "C:\Users\Administrator\AppData\Roaming\aignes\AM-Notebook\config")
eax=00C079A8 (notebook.00C079A8)
=====================================================
启动时,终于在这
00B37245 . E8 1EB7B9FF call notebook.006D2968
发现了读取KEY文件的代码
00B3724A . 8B95 70FFFFFF mov edx,dword ptr ss:[ebp-0x90] 放入KEY文件全部
00B38120 |. 83B8 20010000>cmp dword ptr ds:[eax+0x120],0x0
00B38127 |. 74 25 je Xnotebook.00B3814E
00B38129 |. A1 20FEBF00 mov eax,dword ptr ds:[0xBFFE20]
00B3812E |. C740 08 01000>mov dword ptr ds:[eax+0x8],0x1
00B38135 |. A1 70FABF00 mov eax,dword ptr ds:[0xBFFA70]
00B3813A |. 8B00 mov eax,dword ptr ds:[eax]
00B3813C |. 8B80 C00B0000 mov eax,dword ptr ds:[eax+0xBC0]
00B38142 |. 33D2 xor edx,edx
00B38144 |. E8 DFD6ABFF call notebook.005F5828
00B38149 |. E9 F7000000 jmp notebook.00B38245
00B3814E |> A1 28F8BF00 mov eax,dword ptr ds:[0xBFF828]
00B38153 |. 8038 00 cmp byte ptr ds:[eax],0x0
00B38156 |. 74 73 je Xnotebook.00B381CB
00B38158 |. 68 7882B300 push notebook.00B38278 ; The portable PRO Edition doesn't have a trial period and requires a license key.
00B3815D |. A1 3CFABF00 mov eax,dword ptr ds:[0xBFFA3C]
00B38162 |. FF30 push dword ptr ds:[eax]
00B38164 |. A1 3CFABF00 mov eax,dword ptr ds:[0xBFFA3C]
00B38169 |. FF30 push dword ptr ds:[eax]
00B3816B |. 68 2883B300 push notebook.00B38328 ; If you haven't purchased AM-Notebook yet and want to evaluate the PRO Edition,
00B38170 |. A1 3CFABF00 mov eax,dword ptr ds:[0xBFFA3C]
00B38175 |. FF30 push dword ptr ds:[eax]
00B38177 |. 68 D483B300 push notebook.00B383D4 ; then you can do that by installing the desktop version to your hard disk.
00B38129 |. A1 20FEBF00 mov eax,dword ptr ds:[0xBFFE20]
00B3812E |. C740 08 01000>mov dword ptr ds:[eax+0x8],0x1
00B38135 |. A1 70FABF00 mov eax,dword ptr ds:[0xBFFA70]
00B3813A |. 8B00 mov eax,dword ptr ds:[eax]
00B3813C |. 8B80 C00B0000 mov eax,dword ptr ds:[eax+0xBC0]
00B38142 |. 33D2 xor edx,edx
00B38144 |. E8 DFD6ABFF call notebook.005F5828
00B38149 |. E9 F7000000 jmp notebook.00B38245
00B3814E |> A1 28F8BF00 mov eax,dword ptr ds:[0xBFF828]
00B38153 |. 8038 00 cmp byte ptr ds:[eax],0x0
00B38156 |. 74 73 je Xnotebook.00B381CB
00B38158 |. 68 7882B300 push notebook.00B38278 ; The portable PRO Edition doesn't have a trial period and requires a license key.
00B3815D |. A1 3CFABF00 mov eax,dword ptr ds:[0xBFFA3C]
00B38162 |. FF30 push dword ptr ds:[eax]
00B38164 |. A1 3CFABF00 mov eax,dword ptr ds:[0xBFFA3C]
00B38169 |. FF30 push dword ptr ds:[eax]
00B3816B |. 68 2883B300 push notebook.00B38328 ; If you haven't purchased AM-Notebook yet and want to evaluate the PRO Edition,
00B38170 |. A1 3CFABF00 mov eax,dword ptr ds:[0xBFFA3C]
00B38175 |. FF30 push dword ptr ds:[eax]
00B38177 |. 68 D483B300 push notebook.00B383D4 ; then you can do that by installing the desktop version to your hard disk.
00B3817C |. 8D45 F8 lea eax,[local.2]
00B3817F |. BA 06000000 mov edx,0x6
00B38184 |. E8 83088DFF call notebook.00408A0C
00B38189 |. 8B45 F8 mov eax,[local.2]
00B3818C |. E8 0F2FB9FF call notebook.006CB0A0
00B38191 |. 8B0D 00F6BF00 mov ecx,dword ptr ds:[0xBFF600] ; notebook.00C07970
00B38197 |. A1 B8FCBF00 mov eax,dword ptr ds:[0xBFFCB8]
00B3819C |. 8B00 mov eax,dword ptr ds:[eax]
00B3819E |. 8B15 D84B8F00 mov edx,dword ptr ds:[0x8F4BD8] ; notebook.008F4C30
00B381A4 |. E8 6F68A4FF call notebook.0057EA18
00B381A9 |. A1 00F6BF00 mov eax,dword ptr ds:[0xBFF600]
00B381AE |. 8B00 mov eax,dword ptr ds:[eax]
00B381B0 |. 8B10 mov edx,dword ptr ds:[eax]
00B381B2 |. FF92 14010000 call dword ptr ds:[edx+0x114]
00B381B8 |. A1 00F6BF00 mov eax,dword ptr ds:[0xBFF600]
00B381BD |. 8B00 mov eax,dword ptr ds:[eax]
00B381BF |. E8 0421A4FF call notebook.0057A2C8
00B381C4 |. 33C0 xor eax,eax
00B381C6 |. E8 392DB9FF call notebook.006CAF04
00B381CB |> 68 5B020000 push 0x25B
00B381D0 |. 6A 1E push 0x1E
00B381D2 |. 6A 01 push 0x1
00B381D4 |. B9 02000000 mov ecx,0x2
00B381D9 |. BA 7484B300 mov edx,notebook.00B38474 ; AM-Notebook
00B381DE |. B8 9884B300 mov eax,notebook.00B38498 ; \Software\aignes\amnotebook
00B3719C . 55 push ebp
00B3719D . 68 8A7DB300 push notebook.00B37D8A
00B371A2 . 64:FF30 push dword ptr fs:[eax]
00B371A5 . 64:8920 mov dword ptr fs:[eax],esp
00B371A8 . 8D45 F8 lea eax,dword ptr ss:[ebp-0x8]
00B371AB . E8 44058DFF call notebook.004076F4
00B371B0 . 8D95 7CFFFFFF lea edx,dword ptr ss:[ebp-0x84]
00B371B6 . A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
00B371BB . 8B40 04 mov eax,dword ptr ds:[eax+0x4]
00B371BE . E8 C177B9FF call notebook.006CE984
00B371C3 . FFB5 7CFFFFFF push dword ptr ss:[ebp-0x84]
00B371C9 . 68 A87DB300 push notebook.00B37DA8 ; notekey
00B371CE . 68 C47DB300 push notebook.00B37DC4 ; 1
00B371D3 . 68 D47DB300 push notebook.00B37DD4 ; .bin
00B371D8 . 8D45 C0 lea eax,dword ptr ss:[ebp-0x40]
00B371DB . BA 04000000 mov edx,0x4
00B371E0 . E8 27188DFF call notebook.00408A0C
00B371E5 . 33C9 xor ecx,ecx
00B371E7 . 55 push ebp
00B371E8 . 68 CD7CB300 push notebook.00B37CCD
00B371ED . 64:FF31 push dword ptr fs:[ecx]
00B371F0 . 64:8921 mov dword ptr fs:[ecx],esp
00B371F3 . 8B45 C0 mov eax,dword ptr ss:[ebp-0x40]
00B371F6 . E8 AD8DB9FF call notebook.006CFFA8
00B371FB . 84C0 test al,al
00B371FD . 74 7D je Xnotebook.00B3727C
00B371FF . 8D55 C4 lea edx,dword ptr ss:[ebp-0x3C]
00B37202 . 8B45 C0 mov eax,dword ptr ss:[ebp-0x40]
00B37205 . E8 B295B9FF call notebook.006D07BC
00B3720A . 8D85 74FFFFFF lea eax,dword ptr ss:[ebp-0x8C]
00B37210 . 8B55 C4 mov edx,dword ptr ss:[ebp-0x3C]
00B37213 . E8 D8158DFF call notebook.004087F0
00B37218 . 8B85 74FFFFFF mov eax,dword ptr ss:[ebp-0x8C]
00B3721E . 8D95 78FFFFFF lea edx,dword ptr ss:[ebp-0x88]
00B37224 . E8 A70894FF call notebook.00477AD0
00B37229 . 8B95 78FFFFFF mov edx,dword ptr ss:[ebp-0x88]
00B3722F . 8D45 FC lea eax,dword ptr ss:[ebp-0x4]
00B37232 . B9 00000000 mov ecx,0x0
00B37237 . E8 50108DFF call notebook.0040828C
00B3723C . 8D95 70FFFFFF lea edx,dword ptr ss:[ebp-0x90]
00B37242 . 8B45 FC mov eax,dword ptr ss:[ebp-0x4]
00B37245 . E8 1EB7B9FF call notebook.006D2968
00B3724A . 8B95 70FFFFFF mov edx,dword ptr ss:[ebp-0x90]
00B37250 . 8D45 FC lea eax,dword ptr ss:[ebp-0x4]
00B37253 . E8 44098DFF call notebook.00407B9C
00B37258 . 8D95 6CFFFFFF lea edx,dword ptr ss:[ebp-0x94]
00B3725E . 8D45 FC lea eax,dword ptr ss:[ebp-0x4]
00B37261 . E8 0E52B9FF call notebook.006CC474
00B37266 . 8D55 F4 lea edx,dword ptr ss:[ebp-0xC]
00B37269 . 8D45 FC lea eax,dword ptr ss:[ebp-0x4]
00B3726C . E8 0352B9FF call notebook.006CC474
00B37271 . 8D55 EC lea edx,dword ptr ss:[ebp-0x14]
00B37274 . 8D45 FC lea eax,dword ptr ss:[ebp-0x4]
00B37277 . E8 F851B9FF call notebook.006CC474
00B3727C > 8D45 F8 lea eax,dword ptr ss:[ebp-0x8]
00B3727F . 8B55 EC mov edx,dword ptr ss:[ebp-0x14]
00B37282 . E8 15098DFF call notebook.00407B9C
00B37287 . 837D F8 00 cmp dword ptr ss:[ebp-0x8],0x0
00B3728B 75 20 jnz Xnotebook.00B372AD
00B3728D . A1 28F8BF00 mov eax,dword ptr ds:[0xBFF828]
00B37292 . 8038 00 cmp byte ptr ds:[eax],0x0
00B37295 . 74 09 je Xnotebook.00B372A0
00B37297 . A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
00B3729C . C640 24 00 mov byte ptr ds:[eax+0x24],0x0
00B372A0 > 33C0 xor eax,eax
00B372A2 . 5A pop edx
00B372A3 . 59 pop ecx
00B372A4 . 59 pop ecx
00B372A5 . 64:8910 mov dword ptr fs:[eax],edx
00B372A8 . E9 2A0A0000 jmp notebook.00B37CD7
00B372AD > E8 AAFEFFFF call notebook.00B3715C
00B372B2 . 8D95 68FFFFFF lea edx,dword ptr ss:[ebp-0x98]
00B372B8 . 8B45 F8 mov eax,dword ptr ss:[ebp-0x8]
00B372BB . E8 C453AEFF call notebook.0061C684
00B372C0 . 8B95 68FFFFFF mov edx,dword ptr ss:[ebp-0x98]
00B372C6 . 8D45 F8 lea eax,dword ptr ss:[ebp-0x8]
00B372C9 . E8 CE088DFF call notebook.00407B9C
00B372CE . B2 01 mov dl,0x1
00B372D0 . A1 68534900 mov eax,dword ptr ds:[0x495368]
00B372D5 . E8 7AE88CFF call notebook.00405B54
00B372DA . 8945 B8 mov dword ptr ss:[ebp-0x48],eax
00B372DD . 33C9 xor ecx,ecx
00B372DF . B2 01 mov dl,0x1
00B372E1 . A1 B060B300 mov eax,dword ptr ds:[0xB360B0]
00B372E6 . E8 51F4FFFF call notebook.00B3673C
00B372EB . 8945 B0 mov dword ptr ss:[ebp-0x50],eax
00B372EE . 33C9 xor ecx,ecx
00B372F0 . 55 push ebp
00B372F1 . 68 A773B300 push notebook.00B373A7
00B372F6 . 64:FF31 push dword ptr fs:[ecx]
00B372F9 . 64:8921 mov dword ptr fs:[ecx],esp
00B372FC . 8D45 F8 lea eax,dword ptr ss:[ebp-0x8]
00B372FF . E8 D4098DFF call notebook.00407CD8
00B37304 . 8BD0 mov edx,eax
00B37306 . 8B45 F8 mov eax,dword ptr ss:[ebp-0x8]
00B37309 . 85C0 test eax,eax
00B3730B . 74 05 je Xnotebook.00B37312
00B3730D . 83E8 04 sub eax,0x4
00B37310 . 8B00 mov eax,dword ptr ds:[eax]
00B37312 > 8BC8 mov ecx,eax
00B37314 . 8B45 B8 mov eax,dword ptr ss:[ebp-0x48]
00B37317 . 8B18 mov ebx,dword ptr ds:[eax]
00B37319 . FF53 10 call dword ptr ds:[ebx+0x10]
00B3731C . 8D95 64FFFFFF lea edx,dword ptr ss:[ebp-0x9C]
00B37322 . B8 EC7DB300 mov eax,notebook.00B37DEC ; B7A6C2A1E6B6BEF19DD4C4839CBDFEF08592
00B381FA 83FB 1E cmp ebx,0x1E
00B381FD 7E 46 jle Xnotebook.00B38245 这30天是否过期在这里啦
004B6E9B 837D FC 01 cmp dword ptr ss:[ebp-0x4],0x1
堆栈 ss:[0018FAF8]=0294A78C, (UNICODE "Software\aignes\amnotebook")
00B7F21D 837D FC 01 cmp dword ptr ss:[ebp-0x4],0x1
00B7F12C > \A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
00B7F131 . 8B40 04 mov eax,dword ptr ds:[eax+0x4]
00B7F134 . E8 DBB5AFFF call notebook.0067A714
00B7F139 . 84C0 test al,al
00B7F13B 74 74 jmp Xnotebook.00B7F1B1
00B7F13D . 8D95 BCFEFFFF lea edx,dword ptr ss:[ebp-0x144]
00B7F143 . A1 FCFEBF00 mov eax,dword ptr ds:[0xBFFEFC]
00B7F148 . 8B40 04 mov eax,dword ptr ds:[eax+0x4]
00B7F14B . E8 34F8B4FF call notebook.006CE984
00B7F150 . 8D85 BCFEFFFF lea eax,dword ptr ss:[ebp-0x144]
00B7F156 . BA F803B800 mov edx,notebook.00B803F8 ; notebook.err
006003A8 > $ 55 push ebp
006003A9 . 8BEC mov ebp,esp
006003AB . 83C4 F0 add esp,-0x10
006003AE . B8 50FF5F00 mov eax,16_9原版.005FFF50
006003B3 . E8 BC60E0FF call 16_9原版.00406474
006003B8 . E8 1F83F9FF call 16_9原版.005986DC
006003BD . E8 4A42E0FF call 16_9原版.0040460C
006003A8 > $ 55 push ebp
006003A9 . 8BEC mov ebp,esp
006003AB . 83C4 F0 add esp,-0x10
006003AE . B8 50FF5F00 mov eax,ascii窗?005FFF50
006003B3 . E8 BC60E0FF call ascii窗?00406474
006003B8 . E8 1F83F9FF call ascii窗?005986DC
006003BD . E8 4A42E0FF call ascii窗?0040460C
004CC7E8 >/$ 55 push ebp 558BEC83C4E4535633C08945E48945
004CC7E9 |. 8BEC mov ebp,esp
004CC7EB |. 83C4 E4 add esp,-0x1C
004CC7EE |. 53 push ebx
004CC7EF |. 56 push esi
004CC7F0 |. 33C0 xor eax,eax
004CC7F2 |. 8945 E4 mov [local.7],eax
004CC7F5 |. 8945 EC mov [local.5],eax
004CC7F8 |. 8945 E8 mov [local.6],eax
004CC7FB |. B8 E0C44C00 mov eax,eXeScope.004CC4E0
004CC800 |. E8 77A4F3FF call eXeScope.00406C7C
|
|