Analysis on registration algorithms of landlords 4.0

========================================================== ========================================================== ====
004991B1 call rtcRandomNext
004991B7 fmul dbl_403920
004991BD call _ vbaFpI4
004991C3 mov dword_4D1030, eax; random number R1
004991C8 lea ecx, [ebp-98h]
004991CE call _ vbaFreeVar
004991D4 mov dword ptr [ebp-4], 0Eh
004991DB mov dword ptr [ebp-90h], 80020004 h
004991E5 mov dword ptr [ebp-98h], 0Ah
004991EF lea ecx, [ebp-98h]
004991F5 push ecx
004991F6 call rtcRandomize
004991FC lea ecx, [ebp-98h]
00499202 call _ vbaFreeVar
00499208 mov dword ptr [ebp-4], 0Fh
0049920F mov dword ptr [ebp-90h], 3
00499219 mov dword ptr [ebp-98h], 2
00499223 lea edx, [ebp-98h]
00499229 push edx
0049922A call rtcRandomNext
00499230 fmul dbl_403920
00499236 call _ vbaFpI4
0049923C mov dword_4D1044, eax; random number R2
00499241 lea ecx, [ebp-98h]
00499247 call _ vbaFreeVar
0049924D mov dword ptr [ebp-4], 10 h
00499254 mov eax, dword_4D1030
00499259 xor eax, 9DB7h
0049925E mov dword_4D11EC, eax; R3 = R1 xor 9DB7h
00499263 mov dword ptr [ebp-4], 11 h
0049926A mov ecx, dword_4D1044
00499270 xor ecx, 10A7Bh
00499276 mov dword_4D10D8, ecx; R4 = R2 xor 10A7Bh
========================================================== ========================================================== ====
004BD57B lea ecx, [ebp-54h]
004BD57E push ecx
004BD57F push 4
004BD581 lea edx, [ebp-74h]
004BD584 push edx
004BD585 lea eax, [ebp-64h]
004BD588 push eax
004BD589 mov dword ptr [ebp-4Ch], 5
004BD590 mov dword ptr [ebp-54h], 2
004BD597 mov [ebp-6Ch], edi
004BD59A mov dword ptr [ebp-74h], 4008 h
004BD5A1 call rtcMidCharVar
004BD5A7 lea ecx, [ebp-64h]; str1 = machine code 4th to 8 consisting of 5-bit strings
004BD5AA push ecx
004BD5AB lea edx, [ebp-18h]
004BD5AE push edx
004BD5AF call _ vbaStrVarVal
004BD5B5 push eax; str1
004BD5B6 call sub_4A8290; H1 = invoke sub_4A8290, str1
004BD5BB mov ecx, dword_4D1030; R1
004BD5C1 xor ecx, dword_4D11EC; ecx = R1 xor R3 = 9DB7h
004BD5C7 push ecx; 9DB7h
004BD5C8 push eax; H1
004BD5C9 call sub_4A83F0; X1 = invoke sub_4A83F0, H1, 9DB7h
004BD5CE mov edx, [esi + 48 h]
004BD5D1 push edx
004BD5D2 push eax; X1
004BD5D3 call sub_4A83F0;
004BD5D8 lea ecx, [ebp-18h]
004BD5DB mov [esi + 34 h], eax; A1 = invoke sub_4A83F0, X1, [esi + 48 h]

========================================================== ========================================================== ====
004BDE78 lea eax, [ebp-2Ch]
004BDE7B push eax
004BDE7C lea ecx, [ebp-3Ch]
004BDE7F push ecx
004BDE80 mov dword ptr [ebp-2Ch], 9
004BDE87 call edi; rtcTrimVar
004BDE89 mov edx, [esi + 44 h]
004BDE8C push 5
004BDE8E lea eax, [ebp-0BCh]
004BDE94 push eax
004BDE95 lea ecx, [ebp-3Ch]; Registration Name
004BDE98 mov [ebp-0B4h], edx
004BDE9E push ecx
004BDE9F lea edx, [ebp-4Ch]; right 3-bit of machine code
004BDEA2 push edx
004BDEA3 mov dword ptr [ebp-0BCh], 8
004 BDEAD call _ vbaVarCat; str0 = right three digits of the machine code + Registration Name
004BDEB3 push eax
004BDEB4 lea eax, [ebp-5Ch]
004BDEB7 push eax
004BDEB8 call rtcRightCharVar
004 BDEBE lea ecx, [ebp-5Ch]; str2 = right 5 digits of str0
004BDEC1 push ecx
004BDEC2 lea edx, [ebp-18h]
004BDEC5 push edx
004BDEC6 call _ vbaStrVarVal
004 BDECC push eax; str2
004 BDECD call sub_4A8290; H2 = invoke sub_4A8290, str2
004BDED2 mov ecx, dword_4D1044; R2
004BDED8 xor ecx, dword_4D10D8; ecx = R2 xor R4 = 10A7Bh
004 BDEDE push ecx; 10A7Bh
004 BDEDF push eax; H2
004BDEE0 call sub_4A83F0; X2 = invoke sub_4A83F0, H2, 10A7Bh
004BDEE5 mov edx, [esi + 4Ch]
004BDEE8 push edx
004BDEE9 push eax; X2
004 BDEEA call sub_4A83F0;
004 BDEEF lea ecx, [ebp-18h]
004BDEF2 mov [esi + 38 h], eax; A2 = invoke sub_4A83F0, X2, [esi + 4Ch]

========================================================== ========================================================== ====
004BD9B2 lea edx, [ebp-28h]
004BD9B5 mov [ebp-20h], eax
004BD9B8 push edx
004BD9B9 lea eax, [ebp-38h]
004BD9BC push eax
004BD9BD mov dword ptr [ebp-28h], 9
004BD9C4 call edi; rtcTrimVar
004BD9C6 push 5
004BD9C8 lea ecx, [ebp-38h]; SN = entered registration code
004BD9CB push ecx
004BD9CC lea edx, [ebp-48h]
004BD9CF push edx
004BD9D0 call rtcLeftCharVar
004BD9D6 mov eax, [esi + 48 h]
004BD9D9 push eax
004BD9DA lea ecx, [ebp-48h]; first 5 digits of snl5 = SN
004BD9DD push ecx
004BD9DE call _ v1_4errvar
004BD9E4 push eax; Y1 = hex (snl5)
004BD9E5 call sub_4A83F0;
004BD9EA lea edx, [ebp-48h]
004BD9ED push edx
004BD9EE mov [esi + 3Ch], eax; B1 = invoke sub_4A83F0, Y1, [esi + 48 h]

========================================================== ========================================================== ====
004BDAE5 lea ecx, [ebp-28h]
004BDAE8 push ecx
004BDAE9 lea edx, [ebp-38h]
004 BDAEC push edx
004 BDAED mov [ebp-20h], eax
004BDAF0 mov dword ptr [ebp-28h], 9
004BDAF7 call edi; rtcTrimVar
004BDAF9 push 5
004 BDAFB lea eax, [ebp-38h]; SN = entered registration code
004 BDAFE push eax
004 BDAFF lea ecx, [ebp-48h]
004BDB02 push ecx
004BDB03 call rtcRightCharVar
004BDB09 mov edx, [esi + 4Ch]
004BDB0C push edx
004BDB0D lea eax, [ebp-48h]; last 5 digits of snr5 = SN
004BDB10 push eax
004BDB11 call _ v1_4errvar
004BDB17 push eax; Y2 = hex (snr5)
004BDB18 call sub_4A83F0;
004BDB1D lea ecx, [ebp-48h]
004BDB20 push ecx
004BDB21 lea edx, [ebp-48h]
004BDB24 push edx
004BDB25 mov [esi + 40 h], eax; B2 = invoke sub_4A83F0, Y2, [esi + 4Ch]

========================================================== ========================================================== ====
004 BCAAC mov eax, [esi + 3Ch]
004 BCAAF mov ecx, [esi + 40 h]
004BCAB2 mov edx, dword_4D1030
004BCAB8 add esp, 1Ch
004 BCABB mov [ebp-0C4h], eax
004BCAC1 mov [ebp-0C8h], ecx
004BCAC7 push edx; R1
004BCAC8 push eax; B1
004BCAC9 call sub_4A83F0;
004 BCACE mov ecx, [ebp-0C8h]
004BCAD4 mov [esi + 3Ch], eax; N1 = invoke sub_4A83F0, B1, R1
004BCAD7 mov eax, dword_4D1044
004 BCADC push eax; R2
004 BCADD push ecx; B2
004 BCADE call sub_4A83F0;
004BCAE3 mov [esi + 40 h], eax; N2 = invoke sub_4A83F0, B2, R2
004BCAE6 call rtcGetTimer
004 BCAEC fsub dword ptr [esi + 50 h]
004 BCAEF fcomp flt_403914
004BCAF5 fnstsw ax
004BCAF7 test ah, 41 h
004 BCAFA jnz short loc_4BCB52
004 BCAFC cmp dword_4D1F98, edi
004BCB02 jnz short loc_4BCB14
004BCB04 push offset dword_4D1F98
004BCB09 push offset dword_416764
004BCB0E call _ vbaNew2
004BCB14
004BCB14 loc_4BCB14:
004BCB14 mov edi, dword_4D1F98
004BCB1A mov ebx, [edi]
004BCB1C push esi
004BCB1D lea edx, [ebp-34h]
004BCB20 push edx
004BCB21 call _ vbaObjSetAddref
004BCB27 push eax
004BCB28 push edi
004BCB29 call