Cracking process of a font software

Target Program: font Fitting Room v3.2.2 deluxe edition

1. Remove the NAG window

Load and run the program. After the trial box appears, the F12 pause the program and find it in the stack.
0012F90C/0012FCD4
0012F910 | 004445F2 returned to ffr.004445F2 from <jmp. & MFC80U. #2011>
0012F914 | 9713812D

Coming
004445AC 391D 60075100 cmp dword ptr ds: [510760], ebx; [510760] = 0
004445B2 75 08 jnz short 004445BC
004445B4 3BFB cmp edi, ebx
004445B6 0F84 D8010000 je 00444794
004445BC E8 53BD0700 call <jmp. & MFC80U. #1086>
004445C1 3BC3 cmp eax, ebx
004445C3 74 0B je short 004445D0
004445C5 8B10 mov edx, dword ptr ds: [eax]
004445C7 8BC8 mov ecx, eax
004445C9 8B42 7C mov eax, dword ptr ds: [edx + 7C]
004445CC FFD0 call eax
004445CE EB 02 jmp short 004445D2
004445D0 33C0 xor eax, eax
004445D2 50 push eax
004445D3 8D8C24 9C010000 lea ecx, dword ptr ss: [esp + 19C]
004445DA E8 8149 FEFF call 00428F60
004445DF 8D8C24 98010000 lea ecx, dword ptr ss: [esp + 198]
004445E6 899C24 10030000 mov dword ptr ss: [esp + 310], ebx
004445ED E8 0AC00700 call <jmp. & MFC80U. #2011>
004445F2 83F8 02 cmp eax, 2
004445F5 8B2D 84245100 mov ebp, dword ptr ds: [512484]; USER32.PostMessageW
004445FB 75 34 jnz short 00444631

Up
00444570 6A FF push-1; F2 disconnects
00444572 68 C67F4C00 push 004C7FC6
00444577 64: A1 00000000 mov eax, dword ptr fs: [0]
0044457D 50 push eax
0044457E 81EC F4020000 sub esp, 2F4

Re-load and run the task. Check the stack after the task is disconnected.
0012FC28 7831338D returned to MFC80U. 7831338D
0012FC2C 00000000
0012FC30 00000000
0012FC34 10977f39
0012FC38 0000047A; the value is the message ID of the PostMessageW that calls the NAG window.
0012FC3C 00D3B274
0012FC40 00000111

Find the constant 47A and find
003667ba push 47A
00451347 push 47A
0045457D push 47A
00464251 push 47A

All F2 instances are disconnected and loaded again.
00451347 68 7A040000 push 47A
0045134C 50 push eax
0045134D FF15 84245100 call dword ptr ds: [512484]; USER32.PostMessageW

Up
00451307 813D 50085100 1A300A00 cmp dword ptr ds: [510850], 0A301A; key comparison
00451311 0F87 E7000000 ja 004513FE; Skip here

Search for constant 00510850 and find the next
0045B425> 85C0 test eax, eax
0045B427. 75 23 jnz short 0045B44C; Skip
0045B429. 8B45 EC mov eax, dword ptr ss: [ebp-14]
0045B42C. 50 push eax;/<% s>
0045B42D. 68 A85A4D00 push 0