SoftAny WinCHM 5.496 注册码笔记 by ZeNiX
(编辑：jimmy 日期: 2024/11/17 浏览：3 次 )
先说结论：
这软件其实存在 3 种注册码。
一种是 Standard 标准版本
一种是 Pro 专业版
另一种是 Upgrade 升级版本。
专业版注册码长度必须是 24，29，31，34。 其中 24
不知道是官方写错代码，或是刻意作废的。
底下是刚刚临时做的笔记。
[Asm] 纯文本查看 复制代码
0058C9E4 55 push ebp0058C9E5 8BEC mov ebp,esp0058C9E7 83C4 D8 add esp,-0x280058C9EA 53 push ebx0058C9EB 33C9 xor ecx,ecx0058C9ED 894D F4 mov dword ptr ss:[ebp-0xC],ecx0058C9F0 894D F0 mov dword ptr ss:[ebp-0x10],ecx0058C9F3 894D EC mov dword ptr ss:[ebp-0x14],ecx0058C9F6 894D E8 mov dword ptr ss:[ebp-0x18],ecx0058C9F9 894D E4 mov dword ptr ss:[ebp-0x1C],ecx0058C9FC 8955 F8 mov dword ptr ss:[ebp-0x8],edx0058C9FF 8945 FC mov dword ptr ss:[ebp-0x4],eax0058CA02 8B45 FC mov eax,dword ptr ss:[ebp-0x4]0058CA05 E8 BAA3E7FF call 00406DC40058CA0A 8B45 F8 mov eax,dword ptr ss:[ebp-0x8]0058CA0D E8 B2A3E7FF call 00406DC40058CA12 33C0 xor eax,eax0058CA14 55 push ebp0058CA15 68 B0D25800 push 0058D2B00058CA1A 64:FF30 push dword ptr fs:[eax]0058CA1D 64:8920 mov dword ptr fs:[eax],esp0058CA20 8D45 F4 lea eax,dword ptr ss:[ebp-0xC]0058CA23 8B55 F8 mov edx,dword ptr ss:[ebp-0x8]0058CA26 E8 05A4E7FF call 00406E300058CA2B 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058CA2E 85C0 test eax,eax0058CA30 74 16 je short 0058CA480058CA32 8BD0 mov edx,eax0058CA34 83EA 0A sub edx,0xA0058CA37 66:833A 02 cmp word ptr ds:[edx],0x20058CA3B 74 0B je short 0058CA480058CA3D 8D45 F4 lea eax,dword ptr ss:[ebp-0xC]0058CA40 8B55 F4 mov edx,dword ptr ss:[ebp-0xC]0058CA43 E8 6499E7FF call 004063AC0058CA48 85C0 test eax,eax0058CA4A 74 05 je short 0058CA510058CA4C 83E8 04 sub eax,0x40058CA4F 8B00 mov eax,dword ptr ds:[eax] ; 获取注册码长度，保存到 ebx0058CA51 8BD8 mov ebx,eax0058CA53 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CA58 C700 FFFFFFFF mov dword ptr ds:[eax],-0x1 ; 这里是注册标记，先给它填值为 -10058CA5E 8B45 F4 mov eax,dword ptr ss:[ebp-0xC] ; eax 指向注册码0058CA61 E8 12F6FFFF call <授权的第一套算法> ; 授权第一套算法0058CA66 8945 D8 mov dword ptr ss:[ebp-0x28],eax ; edx:eax 是计算结果0058CA69 8955 DC mov dword ptr ss:[ebp-0x24],edx0058CA6C 837D DC 00 cmp dword ptr ss:[ebp-0x24],0x00058CA70 75 13 jnz short 0058CA850058CA72 817D D8 EE35000>cmp dword ptr ss:[ebp-0x28],0x35EE0058CA79 75 0A jnz short 0058CA850058CA7B BB 01000000 mov ebx,0x1 ; 单用户授权0058CA80 E9 10080000 jmp 0058D2950058CA85 837D DC 00 cmp dword ptr ss:[ebp-0x24],0x00058CA89 75 13 jnz short 0058CA9E0058CA8B 817D D8 CD39000>cmp dword ptr ss:[ebp-0x28],0x39CD0058CA92 75 0A jnz short 0058CA9E0058CA94 BB 02000000 mov ebx,0x2 ; 2 用户授权0058CA99 E9 F7070000 jmp 0058D2950058CA9E 837D DC 00 cmp dword ptr ss:[ebp-0x24],0x00058CAA2 75 13 jnz short 0058CAB70058CAA4 817D D8 6F2E000>cmp dword ptr ss:[ebp-0x28],0x2E6F0058CAAB 75 0A jnz short 0058CAB70058CAAD BB 03000000 mov ebx,0x3 ; 3 用户授权0058CAB2 E9 DE070000 jmp 0058D2950058CAB7 837D DC 00 cmp dword ptr ss:[ebp-0x24],0x00058CABB 75 13 jnz short 0058CAD00058CABD 817D D8 832F000>cmp dword ptr ss:[ebp-0x28],0x2F830058CAC4 75 0A jnz short 0058CAD00058CAC6 BB 05000000 mov ebx,0x5 ; 5 用户授权0058CACB E9 C5070000 jmp 0058D2950058CAD0 837D DC 00 cmp dword ptr ss:[ebp-0x24],0x00058CAD4 75 13 jnz short 0058CAE90058CAD6 817D D8 922E000>cmp dword ptr ss:[ebp-0x28],0x2E920058CADD 75 0A jnz short 0058CAE90058CADF BB 0A000000 mov ebx,0xA ; 10 用户授权0058CAE4 E9 AC070000 jmp 0058D2950058CAE9 837D DC 00 cmp dword ptr ss:[ebp-0x24],0x00058CAED 75 13 jnz short 0058CB020058CAEF 817D D8 5524000>cmp dword ptr ss:[ebp-0x28],0x24550058CAF6 75 0A jnz short 0058CB020058CAF8 BB 14000000 mov ebx,0x14 ; 20 用户授权0058CAFD E9 93070000 jmp 0058D2950058CB02 837D DC 00 cmp dword ptr ss:[ebp-0x24],0x00058CB06 75 13 jnz short 0058CB1B0058CB08 817D D8 502F000>cmp dword ptr ss:[ebp-0x28],0x2F500058CB0F 75 0A jnz short 0058CB1B0058CB11 BB 32000000 mov ebx,0x32 ; 50 用户授权0058CB16 E9 7A070000 jmp 0058D2950058CB1B 837D DC 00 cmp dword ptr ss:[ebp-0x24],0x00058CB1F 75 13 jnz short 0058CB340058CB21 817D D8 A62F000>cmp dword ptr ss:[ebp-0x28],0x2FA60058CB28 75 0A jnz short 0058CB340058CB2A BB 0F270000 mov ebx,0x270F ; 9999 用户，也就是无限用户授权0058CB2F E9 61070000 jmp 0058D2950058CB34 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CB39 C700 FFFFFFFF mov dword ptr ds:[eax],-0x10058CB3F 83FB 1A cmp ebx,0x1A ; 注册码长度 26 的情况0058CB42 0F85 09010000 jnz 0058CC510058CB48 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CB4D 33D2 xor edx,edx0058CB4F 8910 mov dword ptr ds:[eax],edx0058CB51 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058CB54 E8 9FFDFFFF call <授权的第二套算法函数> ; 授权第二套算法0058CB59 8945 D8 mov dword ptr ss:[ebp-0x28],eax0058CB5C 8955 DC mov dword ptr ss:[ebp-0x24],edx0058CB5F 817D DC 3428340>cmp dword ptr ss:[ebp-0x24],0x13428340058CB66 75 13 jnz short 0058CB7B0058CB68 817D D8 74B4843>cmp dword ptr ss:[ebp-0x28],0x3784B4740058CB6F 75 0A jnz short 0058CB7B0058CB71 BB 01000000 mov ebx,0x1 ; 单用户授权0058CB76 E9 1A070000 jmp 0058D2950058CB7B 817D DC 35DEA00>cmp dword ptr ss:[ebp-0x24],0x1A0DE350058CB82 75 13 jnz short 0058CB970058CB84 817D D8 45796B3>cmp dword ptr ss:[ebp-0x28],0x386B79450058CB8B 75 0A jnz short 0058CB970058CB8D BB 02000000 mov ebx,0x2 ; 2 用户授权0058CB92 E9 FE060000 jmp 0058D2950058CB97 817D DC ED48560>cmp dword ptr ss:[ebp-0x24],0x15648ED0058CB9E 75 13 jnz short 0058CBB30058CBA0 817D D8 3988BF7>cmp dword ptr ss:[ebp-0x28],0x78BF88390058CBA7 75 0A jnz short 0058CBB30058CBA9 BB 03000000 mov ebx,0x3 ; 3 用户授权0058CBAE E9 E2060000 jmp 0058D2950058CBB3 817D DC 504C2C0>cmp dword ptr ss:[ebp-0x24],0x12C4C500058CBBA 75 13 jnz short 0058CBCF0058CBBC 817D D8 EBBD027>cmp dword ptr ss:[ebp-0x28],0x7302BDEB0058CBC3 75 0A jnz short 0058CBCF0058CBC5 BB 05000000 mov ebx,0x5 ; 5 用户授权0058CBCA E9 C6060000 jmp 0058D2950058CBCF 817D DC 1226180>cmp dword ptr ss:[ebp-0x24],0x11826120058CBD6 75 13 jnz short 0058CBEB0058CBD8 817D D8 3D61B93>cmp dword ptr ss:[ebp-0x28],0x32B9613D0058CBDF 75 0A jnz short 0058CBEB0058CBE1 BB 0A000000 mov ebx,0xA ; 10 用户授权0058CBE6 E9 AA060000 jmp 0058D2950058CBEB 817D DC EFCC690>cmp dword ptr ss:[ebp-0x24],0x169CCEF0058CBF2 75 13 jnz short 0058CC070058CBF4 817D D8 964EC34>cmp dword ptr ss:[ebp-0x28],0x47C34E960058CBFB 75 0A jnz short 0058CC070058CBFD BB 14000000 mov ebx,0x14 ; 20 用户授权0058CC02 E9 8E060000 jmp 0058D2950058CC07 817D DC 2F98520>cmp dword ptr ss:[ebp-0x24],0x152982F0058CC0E 75 13 jnz short 0058CC230058CC10 817D D8 08391FD>cmp dword ptr ss:[ebp-0x28],0xD61F39080058CC17 75 0A jnz short 0058CC230058CC19 BB 32000000 mov ebx,0x32 ; 50 用户授权0058CC1E E9 72060000 jmp 0058D2950058CC23 817D DC D211720>cmp dword ptr ss:[ebp-0x24],0x17211D20058CC2A 75 13 jnz short 0058CC3F0058CC2C 817D D8 D4FC05B>cmp dword ptr ss:[ebp-0x28],0xB605FCD40058CC33 75 0A jnz short 0058CC3F0058CC35 BB 0F270000 mov ebx,0x270F ; 9999 用户，也就是无限用户授权0058CC3A E9 56060000 jmp 0058D2950058CC3F 33DB xor ebx,ebx0058CC41 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CC46 C700 FFFFFFFF mov dword ptr ds:[eax],-0x10058CC4C E9 44060000 jmp 0058D2950058CC51 83FB 1F cmp ebx,0x1F ; *** 注册码长度 31位的情况 ***0058CC54 0F85 56010000 jnz 0058CDB00058CC5A 8D45 F0 lea eax,dword ptr ss:[ebp-0x10]0058CC5D 50 push eax0058CC5E B9 1A000000 mov ecx,0x1A ; 从注册码第一位开始取 0x1A 位，其实就是最开始的26位。0058CC63 BA 01000000 mov edx,0x10058CC68 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058CC6B E8 601DE8FF call 0040E9D00058CC70 8D45 EC lea eax,dword ptr ss:[ebp-0x14]0058CC73 50 push eax0058CC74 B9 04000000 mov ecx,0x4 ; 从注册码 0x1C 位开始取四位，其实就是最后4位。0058CC79 BA 1C000000 mov edx,0x1C0058CC7E 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058CC81 E8 4A1DE8FF call 0040E9D00058CC86 8B45 EC mov eax,dword ptr ss:[ebp-0x14] ; 先取最后四位做计算0058CC89 E8 6AFCFFFF call <授权的第二套算法函数> ; 授权的第二套算法函数0058CC8E 83FA 00 cmp edx,0x00058CC91 75 14 jnz short 0058CCA70058CC93 3D 903F0000 cmp eax,0x3F90 ; *** 正确的计算结果是 0x3F90 ， 这是专业版的关键 ***0058CC98 75 0D jnz short 0058CCA70058CC9A A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CC9F C700 01000000 mov dword ptr ds:[eax],0x1 ; 这里设置了专业版的注册标记0058CCA5 EB 09 jmp short 0058CCB00058CCA7 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CCAC 33D2 xor edx,edx0058CCAE 8910 mov dword ptr ds:[eax],edx ; 不是 0x3F90 的话，就设定为标准版0058CCB0 8B45 F0 mov eax,dword ptr ss:[ebp-0x10]0058CCB3 E8 40FCFFFF call <授权的第二套算法函数> ; 授权的第二套算法函数0058CCB8 8945 D8 mov dword ptr ss:[ebp-0x28],eax0058CCBB 8955 DC mov dword ptr ss:[ebp-0x24],edx0058CCBE 817D DC 3428340>cmp dword ptr ss:[ebp-0x24],0x13428340058CCC5 75 13 jnz short 0058CCDA0058CCC7 817D D8 74B4843>cmp dword ptr ss:[ebp-0x28],0x3784B4740058CCCE 75 0A jnz short 0058CCDA0058CCD0 BB 01000000 mov ebx,0x1 ; 单用户授权0058CCD5 E9 BB050000 jmp 0058D2950058CCDA 817D DC 35DEA00>cmp dword ptr ss:[ebp-0x24],0x1A0DE350058CCE1 75 13 jnz short 0058CCF60058CCE3 817D D8 45796B3>cmp dword ptr ss:[ebp-0x28],0x386B79450058CCEA 75 0A jnz short 0058CCF60058CCEC BB 02000000 mov ebx,0x2 ; 2 用户授权0058CCF1 E9 9F050000 jmp 0058D2950058CCF6 817D DC ED48560>cmp dword ptr ss:[ebp-0x24],0x15648ED0058CCFD 75 13 jnz short 0058CD120058CCFF 817D D8 3988BF7>cmp dword ptr ss:[ebp-0x28],0x78BF88390058CD06 75 0A jnz short 0058CD120058CD08 BB 03000000 mov ebx,0x3 ; 3 用户授权0058CD0D E9 83050000 jmp 0058D2950058CD12 817D DC 504C2C0>cmp dword ptr ss:[ebp-0x24],0x12C4C500058CD19 75 13 jnz short 0058CD2E0058CD1B 817D D8 EBBD027>cmp dword ptr ss:[ebp-0x28],0x7302BDEB0058CD22 75 0A jnz short 0058CD2E0058CD24 BB 05000000 mov ebx,0x5 ; 5 用户授权0058CD29 E9 67050000 jmp 0058D2950058CD2E 817D DC 1226180>cmp dword ptr ss:[ebp-0x24],0x11826120058CD35 75 13 jnz short 0058CD4A0058CD37 817D D8 3D61B93>cmp dword ptr ss:[ebp-0x28],0x32B9613D0058CD3E 75 0A jnz short 0058CD4A0058CD40 BB 0A000000 mov ebx,0xA ; 10 用户授权0058CD45 E9 4B050000 jmp 0058D2950058CD4A 817D DC EFCC690>cmp dword ptr ss:[ebp-0x24],0x169CCEF0058CD51 75 13 jnz short 0058CD660058CD53 817D D8 964EC34>cmp dword ptr ss:[ebp-0x28],0x47C34E960058CD5A 75 0A jnz short 0058CD660058CD5C BB 14000000 mov ebx,0x14 ; 20 用户授权0058CD61 E9 2F050000 jmp 0058D2950058CD66 817D DC 2F98520>cmp dword ptr ss:[ebp-0x24],0x152982F0058CD6D 75 13 jnz short 0058CD820058CD6F 817D D8 08391FD>cmp dword ptr ss:[ebp-0x28],0xD61F39080058CD76 75 0A jnz short 0058CD820058CD78 BB 32000000 mov ebx,0x32 ; 50 用户授权0058CD7D E9 13050000 jmp 0058D2950058CD82 817D DC D211720>cmp dword ptr ss:[ebp-0x24],0x17211D20058CD89 75 13 jnz short 0058CD9E0058CD8B 817D D8 D4FC05B>cmp dword ptr ss:[ebp-0x28],0xB605FCD40058CD92 75 0A jnz short 0058CD9E0058CD94 BB 0F270000 mov ebx,0x270F ; 9999 用户，也就是无限用户授权0058CD99 E9 F7040000 jmp 0058D2950058CD9E 33DB xor ebx,ebx0058CDA0 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CDA5 C700 FFFFFFFF mov dword ptr ds:[eax],-0x10058CDAB E9 E5040000 jmp 0058D2950058CDB0 83FB 14 cmp ebx,0x14 ; 注册码长度为 20 的情况0058CDB3 0F85 0B010000 jnz 0058CEC40058CDB9 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CDBE C700 03000000 mov dword ptr ds:[eax],0x3 ; 这个授权可能是需要升级用的吧？ 没深入研究0058CDC4 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058CDC7 E8 40FAFFFF call <授权的第三套算法>0058CDCC 8945 D8 mov dword ptr ss:[ebp-0x28],eax0058CDCF 8955 DC mov dword ptr ss:[ebp-0x24],edx0058CDD2 817D DC 8C00000>cmp dword ptr ss:[ebp-0x24],0x8C0058CDD9 75 13 jnz short 0058CDEE0058CDDB 817D D8 3783789>cmp dword ptr ss:[ebp-0x28],0x9E7883370058CDE2 75 0A jnz short 0058CDEE0058CDE4 BB 01000000 mov ebx,0x1 ; 单用户授权0058CDE9 E9 A7040000 jmp 0058D2950058CDEE 817D DC BC00000>cmp dword ptr ss:[ebp-0x24],0xBC0058CDF5 75 13 jnz short 0058CE0A0058CDF7 817D D8 7E9F96D>cmp dword ptr ss:[ebp-0x28],0xD5969F7E0058CDFE 75 0A jnz short 0058CE0A0058CE00 BB 02000000 mov ebx,0x2 ; 2 用户授权0058CE05 E9 8B040000 jmp 0058D2950058CE0A 817D DC 9D00000>cmp dword ptr ss:[ebp-0x24],0x9D0058CE11 75 13 jnz short 0058CE260058CE13 817D D8 28776E3>cmp dword ptr ss:[ebp-0x28],0x306E77280058CE1A 75 0A jnz short 0058CE260058CE1C BB 03000000 mov ebx,0x3 ; 3 用户授权0058CE21 E9 6F040000 jmp 0058D2950058CE26 817D DC 8C00000>cmp dword ptr ss:[ebp-0x24],0x8C0058CE2D 75 13 jnz short 0058CE420058CE2F 817D D8 C6C114A>cmp dword ptr ss:[ebp-0x28],0xA314C1C60058CE36 75 0A jnz short 0058CE420058CE38 BB 05000000 mov ebx,0x5 ; 5 用户授权0058CE3D E9 53040000 jmp 0058D2950058CE42 817D DC 8100000>cmp dword ptr ss:[ebp-0x24],0x810058CE49 75 13 jnz short 0058CE5E0058CE4B 817D D8 8DBECEC>cmp dword ptr ss:[ebp-0x28],0xC0CEBE8D0058CE52 75 0A jnz short 0058CE5E0058CE54 BB 0A000000 mov ebx,0xA ; 10 用户授权0058CE59 E9 37040000 jmp 0058D2950058CE5E 817D DC A500000>cmp dword ptr ss:[ebp-0x24],0xA50058CE65 75 13 jnz short 0058CE7A0058CE67 817D D8 15CE047>cmp dword ptr ss:[ebp-0x28],0x7104CE150058CE6E 75 0A jnz short 0058CE7A0058CE70 BB 14000000 mov ebx,0x14 ; 20 用户授权0058CE75 E9 1B040000 jmp 0058D2950058CE7A 817D DC 9B00000>cmp dword ptr ss:[ebp-0x24],0x9B0058CE81 75 13 jnz short 0058CE960058CE83 817D D8 7A2D114>cmp dword ptr ss:[ebp-0x28],0x4F112D7A0058CE8A 75 0A jnz short 0058CE960058CE8C BB 32000000 mov ebx,0x32 ; 50 用户授权0058CE91 E9 FF030000 jmp 0058D2950058CE96 817D DC AA00000>cmp dword ptr ss:[ebp-0x24],0xAA0058CE9D 75 13 jnz short 0058CEB20058CE9F 817D D8 0C11C7D>cmp dword ptr ss:[ebp-0x28],0xDBC7110C0058CEA6 75 0A jnz short 0058CEB20058CEA8 BB 0F270000 mov ebx,0x270F ; 9999 用户，也就是无限用户授权0058CEAD E9 E3030000 jmp 0058D2950058CEB2 33DB xor ebx,ebx0058CEB4 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CEB9 C700 FFFFFFFF mov dword ptr ds:[eax],-0x10058CEBF E9 D1030000 jmp 0058D2950058CEC4 83FB 19 cmp ebx,0x19 ; 注册码长度为 25 的情况， 以下参考上面的注释0058CEC7 0F85 56010000 jnz 0058D0230058CECD 8D45 F0 lea eax,dword ptr ss:[ebp-0x10]0058CED0 50 push eax0058CED1 B9 14000000 mov ecx,0x140058CED6 BA 01000000 mov edx,0x10058CEDB 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058CEDE E8 ED1AE8FF call 0040E9D00058CEE3 8D45 EC lea eax,dword ptr ss:[ebp-0x14]0058CEE6 50 push eax0058CEE7 B9 04000000 mov ecx,0x40058CEEC BA 16000000 mov edx,0x160058CEF1 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058CEF4 E8 D71AE8FF call 0040E9D00058CEF9 8B45 EC mov eax,dword ptr ss:[ebp-0x14]0058CEFC E8 0BF9FFFF call <授权的第三套算法>0058CF01 83FA 00 cmp edx,0x00058CF04 75 14 jnz short 0058CF1A0058CF06 3D 731F0000 cmp eax,0x1F730058CF0B 75 0D jnz short 0058CF1A0058CF0D A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CF12 C700 03000000 mov dword ptr ds:[eax],0x30058CF18 EB 09 jmp short 0058CF230058CF1A A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058CF1F 33D2 xor edx,edx0058CF21 8910 mov dword ptr ds:[eax],edx0058CF23 8B45 F0 mov eax,dword ptr ss:[ebp-0x10]0058CF26 E8 E1F8FFFF call <授权的第三套算法>0058CF2B 8945 D8 mov dword ptr ss:[ebp-0x28],eax0058CF2E 8955 DC mov dword ptr ss:[ebp-0x24],edx0058CF31 817D DC 8C00000>cmp dword ptr ss:[ebp-0x24],0x8C0058CF38 75 13 jnz short 0058CF4D0058CF3A 817D D8 3783789>cmp dword ptr ss:[ebp-0x28],0x9E7883370058CF41 75 0A jnz short 0058CF4D0058CF43 BB 01000000 mov ebx,0x10058CF48 E9 48030000 jmp 0058D2950058CF4D 817D DC BC00000>cmp dword ptr ss:[ebp-0x24],0xBC0058CF54 75 13 jnz short 0058CF690058CF56 817D D8 7E9F96D>cmp dword ptr ss:[ebp-0x28],0xD5969F7E0058CF5D 75 0A jnz short 0058CF690058CF5F BB 02000000 mov ebx,0x20058CF64 E9 2C030000 jmp 0058D2950058CF69 817D DC 9D00000>cmp dword ptr ss:[ebp-0x24],0x9D0058CF70 75 13 jnz short 0058CF850058CF72 817D D8 28776E3>cmp dword ptr ss:[ebp-0x28],0x306E77280058CF79 75 0A jnz short 0058CF850058CF7B BB 03000000 mov ebx,0x30058CF80 E9 10030000 jmp 0058D2950058CF85 817D DC 8C00000>cmp dword ptr ss:[ebp-0x24],0x8C0058CF8C 75 13 jnz short 0058CFA10058CF8E 817D D8 C6C114A>cmp dword ptr ss:[ebp-0x28],0xA314C1C60058CF95 75 0A jnz short 0058CFA10058CF97 BB 05000000 mov ebx,0x50058CF9C E9 F4020000 jmp 0058D2950058CFA1 817D DC 8100000>cmp dword ptr ss:[ebp-0x24],0x810058CFA8 75 13 jnz short 0058CFBD0058CFAA 817D D8 8DBECEC>cmp dword ptr ss:[ebp-0x28],0xC0CEBE8D0058CFB1 75 0A jnz short 0058CFBD0058CFB3 BB 0A000000 mov ebx,0xA0058CFB8 E9 D8020000 jmp 0058D2950058CFBD 817D DC A500000>cmp dword ptr ss:[ebp-0x24],0xA50058CFC4 75 13 jnz short 0058CFD90058CFC6 817D D8 15CE047>cmp dword ptr ss:[ebp-0x28],0x7104CE150058CFCD 75 0A jnz short 0058CFD90058CFCF BB 14000000 mov ebx,0x140058CFD4 E9 BC020000 jmp 0058D2950058CFD9 817D DC 9B00000>cmp dword ptr ss:[ebp-0x24],0x9B0058CFE0 75 13 jnz short 0058CFF50058CFE2 817D D8 7A2D114>cmp dword ptr ss:[ebp-0x28],0x4F112D7A0058CFE9 75 0A jnz short 0058CFF50058CFEB BB 32000000 mov ebx,0x320058CFF0 E9 A0020000 jmp 0058D2950058CFF5 817D DC AA00000>cmp dword ptr ss:[ebp-0x24],0xAA0058CFFC 75 13 jnz short 0058D0110058CFFE 817D D8 0C11C7D>cmp dword ptr ss:[ebp-0x28],0xDBC7110C0058D005 75 0A jnz short 0058D0110058D007 BB 0F270000 mov ebx,0x270F0058D00C E9 84020000 jmp 0058D2950058D011 33DB xor ebx,ebx0058D013 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058D018 C700 FFFFFFFF mov dword ptr ds:[eax],-0x10058D01E E9 72020000 jmp 0058D2950058D023 83FB 1D cmp ebx,0x1D ; 注册码长度为 29 的情况， 以下参考上面的注释0058D026 0F85 EF000000 jnz 0058D11B0058D02C A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058D031 33D2 xor edx,edx0058D033 8910 mov dword ptr ds:[eax],edx0058D035 8D45 F0 lea eax,dword ptr ss:[ebp-0x10]0058D038 50 push eax0058D039 B9 13000000 mov ecx,0x130058D03E BA 01000000 mov edx,0x10058D043 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058D046 E8 8519E8FF call 0040E9D00058D04B 8D45 EC lea eax,dword ptr ss:[ebp-0x14]0058D04E 50 push eax0058D04F B9 04000000 mov ecx,0x40058D054 BA 15000000 mov edx,0x150058D059 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058D05C E8 6F19E8FF call 0040E9D00058D061 8D45 E8 lea eax,dword ptr ss:[ebp-0x18]0058D064 50 push eax0058D065 B9 04000000 mov ecx,0x40058D06A BA 1A000000 mov edx,0x1A0058D06F 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058D072 E8 5919E8FF call 0040E9D00058D077 8B45 F0 mov eax,dword ptr ss:[ebp-0x10]0058D07A E8 79F8FFFF call <授权的第二套算法函数>0058D07F 81FA 82080000 cmp edx,0x8820058D085 75 2C jnz short 0058D0B30058D087 3D 95146C25 cmp eax,0x256C14950058D08C 75 25 jnz short 0058D0B30058D08E 8B55 EC mov edx,dword ptr ss:[ebp-0x14]0058D091 8B45 FC mov eax,dword ptr ss:[ebp-0x4]0058D094 E8 23F6FFFF call 0058C6BC0058D099 84C0 test al,al0058D09B 74 0F je short 0058D0AC0058D09D 8B45 E8 mov eax,dword ptr ss:[ebp-0x18]0058D0A0 E8 97F0FFFF call 0058C13C0058D0A5 8BD8 mov ebx,eax0058D0A7 E9 E9010000 jmp 0058D2950058D0AC 33DB xor ebx,ebx0058D0AE E9 E2010000 jmp 0058D2950058D0B3 8B45 F0 mov eax,dword ptr ss:[ebp-0x10]0058D0B6 E8 3DF8FFFF call <授权的第二套算法函数>0058D0BB 81FA EB070000 cmp edx,0x7EB0058D0C1 75 51 jnz short 0058D1140058D0C3 3D 70EF40E1 cmp eax,0xE140EF700058D0C8 75 4A jnz short 0058D1140058D0CA 8B45 E8 mov eax,dword ptr ss:[ebp-0x18]0058D0CD E8 26F8FFFF call <授权的第二套算法函数>0058D0D2 83FA 00 cmp edx,0x00058D0D5 75 14 jnz short 0058D0EB0058D0D7 3D 903F0000 cmp eax,0x3F900058D0DC 75 0D jnz short 0058D0EB0058D0DE A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058D0E3 C700 01000000 mov dword ptr ds:[eax],0x1 ; 专业版授权0058D0E9 EB 09 jmp short 0058D0F40058D0EB A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058D0F0 33D2 xor edx,edx0058D0F2 8910 mov dword ptr ds:[eax],edx ; 标准版授权0058D0F4 8B55 EC mov edx,dword ptr ss:[ebp-0x14]0058D0F7 8B45 FC mov eax,dword ptr ss:[ebp-0x4]0058D0FA E8 BDF5FFFF call 0058C6BC0058D0FF 84C0 test al,al0058D101 74 0A je short 0058D10D0058D103 BB 0F270000 mov ebx,0x270F0058D108 E9 88010000 jmp 0058D2950058D10D 33DB xor ebx,ebx0058D10F E9 81010000 jmp 0058D2950058D114 33DB xor ebx,ebx0058D116 E9 7A010000 jmp 0058D2950058D11B 83FB 22 cmp ebx,0x22 ; 注册码长度为 34 的情况， 以下参考上面的注释0058D11E 0F85 C5000000 jnz 0058D1E90058D124 8D45 F0 lea eax,dword ptr ss:[ebp-0x10]0058D127 50 push eax0058D128 B9 13000000 mov ecx,0x130058D12D BA 01000000 mov edx,0x10058D132 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058D135 E8 9618E8FF call 0040E9D00058D13A 8D45 EC lea eax,dword ptr ss:[ebp-0x14]0058D13D 50 push eax0058D13E B9 04000000 mov ecx,0x40058D143 BA 15000000 mov edx,0x150058D148 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058D14B E8 8018E8FF call 0040E9D00058D150 8D45 E8 lea eax,dword ptr ss:[ebp-0x18]0058D153 50 push eax0058D154 B9 04000000 mov ecx,0x40058D159 BA 1A000000 mov edx,0x1A0058D15E 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058D161 E8 6A18E8FF call 0040E9D00058D166 8D45 E4 lea eax,dword ptr ss:[ebp-0x1C]0058D169 50 push eax0058D16A B9 04000000 mov ecx,0x40058D16F BA 1F000000 mov edx,0x1F0058D174 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058D177 E8 5418E8FF call 0040E9D00058D17C 8B45 E4 mov eax,dword ptr ss:[ebp-0x1C]0058D17F E8 74F7FFFF call <授权的第二套算法函数>0058D184 83FA 00 cmp edx,0x00058D187 75 14 jnz short 0058D19D0058D189 3D 903F0000 cmp eax,0x3F900058D18E 75 0D jnz short 0058D19D0058D190 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058D195 C700 01000000 mov dword ptr ds:[eax],0x1 ; 专业版授权0058D19B EB 09 jmp short 0058D1A60058D19D A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058D1A2 33D2 xor edx,edx0058D1A4 8910 mov dword ptr ds:[eax],edx ; 标准版授权0058D1A6 8B45 F0 mov eax,dword ptr ss:[ebp-0x10]0058D1A9 E8 4AF7FFFF call <授权的第二套算法函数>0058D1AE 81FA 82080000 cmp edx,0x8820058D1B4 75 2C jnz short 0058D1E20058D1B6 3D 95146C25 cmp eax,0x256C14950058D1BB 75 25 jnz short 0058D1E20058D1BD 8B55 EC mov edx,dword ptr ss:[ebp-0x14]0058D1C0 8B45 FC mov eax,dword ptr ss:[ebp-0x4]0058D1C3 E8 F4F4FFFF call 0058C6BC0058D1C8 84C0 test al,al0058D1CA 74 0F je short 0058D1DB0058D1CC 8B45 E8 mov eax,dword ptr ss:[ebp-0x18]0058D1CF E8 68EFFFFF call 0058C13C0058D1D4 8BD8 mov ebx,eax0058D1D6 E9 BA000000 jmp 0058D2950058D1DB 33DB xor ebx,ebx0058D1DD E9 B3000000 jmp 0058D2950058D1E2 33DB xor ebx,ebx0058D1E4 E9 AC000000 jmp 0058D2950058D1E9 83FB 18 cmp ebx,0x18 ; 注册码长度为 24 的情况， 以下参考上面的注释0058D1EC 0F85 A1000000 jnz 0058D2930058D1F2 8D45 F0 lea eax,dword ptr ss:[ebp-0x10]0058D1F5 50 push eax0058D1F6 B9 13000000 mov ecx,0x130058D1FB BA 01000000 mov edx,0x10058D200 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058D203 E8 C817E8FF call 0040E9D00058D208 8D45 EC lea eax,dword ptr ss:[ebp-0x14]0058D20B 50 push eax0058D20C B9 04000000 mov ecx,0x40058D211 BA 15000000 mov edx,0x150058D216 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058D219 E8 B217E8FF call 0040E9D00058D21E 8D45 E8 lea eax,dword ptr ss:[ebp-0x18]0058D221 50 push eax0058D222 B9 04000000 mov ecx,0x40058D227 BA 1A000000 mov edx,0x1A ; 明显这里超过长度的 24，可以说是官方写错代码了。0058D22C 8B45 F4 mov eax,dword ptr ss:[ebp-0xC]0058D22F E8 9C17E8FF call 0040E9D00058D234 8B45 E8 mov eax,dword ptr ss:[ebp-0x18]0058D237 E8 BCF6FFFF call <授权的第二套算法函数>0058D23C 83FA 00 cmp edx,0x00058D23F 75 14 jnz short 0058D2550058D241 3D 903F0000 cmp eax,0x3F900058D246 75 0D jnz short 0058D2550058D248 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058D24D C700 01000000 mov dword ptr ds:[eax],0x1 ; 专业版授权0058D253 EB 09 jmp short 0058D25E0058D255 A1 B02F6000 mov eax,dword ptr ds:[<版本类别标志位>]0058D25A 33D2 xor edx,edx0058D25C 8910 mov dword ptr ds:[eax],edx ; 标准版授权0058D25E 8B45 F0 mov eax,dword ptr ss:[ebp-0x10]0058D261 E8 92F6FFFF call <授权的第二套算法函数>0058D266 81FA EB070000 cmp edx,0x7EB0058D26C 75 21 jnz short 0058D28F0058D26E 3D 70EF40E1 cmp eax,0xE140EF700058D273 75 1A jnz short 0058D28F0058D275 8B55 EC mov edx,dword ptr ss:[ebp-0x14]0058D278 8B45 FC mov eax,dword ptr ss:[ebp-0x4]0058D27B E8 3CF4FFFF call 0058C6BC0058D280 84C0 test al,al0058D282 74 07 je short 0058D28B0058D284 BB 0F270000 mov ebx,0x270F0058D289 EB 0A jmp short 0058D2950058D28B 33DB xor ebx,ebx0058D28D EB 06 jmp short 0058D2950058D28F 33DB xor ebx,ebx0058D291 EB 02 jmp short 0058D2950058D293 33DB xor ebx,ebx0058D295 33C0 xor eax,eax0058D297 5A pop edx0058D298 59 pop ecx0058D299 59 pop ecx0058D29A 64:8910 mov dword ptr fs:[eax],edx0058D29D 68 B7D25800 push 0058D2B70058D2A2 8D45 E4 lea eax,dword ptr ss:[ebp-0x1C]0058D2A5 BA 07000000 mov edx,0x70058D2AA E8 259BE7FF call 00406DD40058D2AF C3 retn0058D2B0 ^ E9 4386E7FF jmp 004058F80058D2B5 ^ EB EB jmp short 0058D2A20058D2B7 8BC3 mov eax,ebx0058D2B9 5B pop ebx0058D2BA 8BE5 mov esp,ebp0058D2BC 5D pop ebp0058D2BD C3 retn
REG.png
至于只想要成果的朋友，截图里面的两套注册码可以直接拿去享用。
Standard.png
Pro.png
下一篇：【非华为电脑实现一碰传】华为一碰传标签制作