Syser Debugger v1.92 CRACKING PROCESS

Question: [original] Syser Debugger v1.92 CRACKING PROCESS
Author: xee
Time: 2007-07-29,21: 15
Chain: http://bbs.pediy.com/showthread.php? T = 48741

After reading the introduction of this software, I felt quite good. I started to contact v1.6 and tried it several times on and off. Occasionally, I tried it for a while,
This time, the algorithm that can crack its registration code relies entirely on luck.

As the writing is poor, you can join me and see it. In fact, I can't understand it myself.

It was assumed that the algorithm should be registered in the program syserapp.exe, so the od was followed in,
. Text: 004025E9 mov [ecx], al
. Text: 004025EB jnz short loc_4025E0
. Text: 004025ED
. Text: 004025ED loc_4025ED:; code xref: sub_402580 + 5B j
. Text: 004025ED push 0; int
. Text: 004025EF push 1; dwType
. Text: 004025F1 lea eax, [esp + 114 h + Data]
. Text: 004025F5 push eax; lpData
. Text: 004025F6 push offset aHklmSystemCu_2; "HKLM \ SYSTEM \ CurrentControlSet \ Services \"... // write the registration name to the Registry
. Text: 004025FB call sub_43F4F0
. Text: 00402600 mov WideCharStr, 0
. Text: 00402609 mov esi, [edi + 4B4h]
. Text: 0040260F add esp, 10 h
. Text: 00402612 test esi, esi
. Text: 00402614 jnz short loc_40261B
. Text: 00402616 mov esi, offset WideCharStr
. Text: 0040261B
. Text: 0040261B loc_40261B:; code xref: sub_402580 + 94 j
. Text: 0040261B mov al, [esi]
. Text: 0040261D test al, al
. Text: 0040261F mov edx, esi
. Text: 00402621 lea ecx, [esp + 10Ch + Data]
. Text: 00402625 mov [esp + 10Ch + Data], al
. Text: 00402629 pop esi
. Text: 0040262A jz short loc_40263D
. Text: 0040262C lea esp, [esp + 0]
. Text: 00402630
. Text: 00402630 loc_402630:; code xref: sub_402580 + BB j
. Text: 00402630 mov al, [edx + 2]
. Text: 00402633 add edx, 2
. Text: 00402636 inc ecx
. Text: 00402637 test al, al
. Text: 00402639 mov [ecx], al
. Text: 0040263B jnz short loc_402630
. Text: 0040263D
. Text: 0040263D loc_40263D:; code xref: sub_402580 + AA j
. Text: 0040263D push 0; int
. Text: 0040263F push 1; dwType
. Text: 00402641 lea ecx, [esp + 110 h + Data]
. Text: 00402645 push ecx; lpData
. Text: 00402646 push offset aHklmSystemCu_3; "HKLM \ SYSTEM \ CurrentControlSet \ Services \"...
// Write the registration code to the registry, and the length of the registration code must be 16 bytes.
. Text: 0040264B call sub_43F4F0
. Text: 00402650 & nb