OfficeMan-V2.1 SIMPLE algorithm analysis-cainiao

[Author]: tzl
[Author's email]: None
[Name]: OfficeMan-V2.1
[Software size]: 1.57 MB
[]: Html "> http://down.downreg.com/Software/View-Software-6929.html
[Shelling method]: None
[Protection method]: Registration Code
[Language]: Borland Delphi 6.0-7.0
[Tools]: OD PEID
[Operating platform]: XP SP2
[Software introduction ]:
1. Flexible import methods:
You only need to click batch import documents in the database management to import one or more original documents.
2. Convenient Document Communication Management:
You can use the Office manager to create xxk files. All the attributes of the imported documents are stored in this file. Your colleagues and friends can also use the Office manager to open this file, you can view all the information in it. Of course, if the information you collect does not want others to see, you can add password protection.
3. Tree Classification directory arrangement:
If so many documents are imported to a xxk file, they must be sorted by category. In the Office manager, you can create directories on a layer-by-layer basis. You can drag directories or documents and sort them at will.

A very simple algorithm is suitable for me, cainiao. I would like to share with you that cainiao is making progress together.

I. Shell check, no.

2. Based on the string information, we can start the analysis by discontinuing here. Part 1 Trial code: 123456789; Part 2 trial code: 987654321

004E0B89 |. 55 push ebp
004E0B8A |. 68 7F0E4E00 push OfficeMa.004E0E7F
004E0B8F |. 64: FF30 push dword ptr fs: [eax]
004E0B92 |. 64: 8920 mov dword ptr fs: [eax], esp
004E0B95 |. 8D55 FC lea edx, dword ptr ss: [ebp-4]
004E0B98 |. 8B83 14030000 mov eax, dword ptr ds: [ebx + 314]
004E0B9E |. E8 39E6F6FF call OfficeMa.0044F1DC
004E0BA3 |. 837D FC 00 cmp dword ptr ss: [ebp-4], 0; trial code the second part cannot be 0
004E0BA7 |. 75 2C jnz short OfficeMa.004E0BD5
004E0BA9 |. 6A 00 push 0
004E0BAB |. 68 900E4E00 push OfficeMa.004E0E90; endo prompt
004E0BB0 |. 68 9C0E4E00 push OfficeMa.004E0E9C; enter the complete registration code!
004E0BB5 |. 8BC3 mov eax, ebx
004E0BB7 |. E8 release ef7ff call OfficeMa.004559CC
004E0BBC |. 50 push eax; | hOwner
004E0BBD |. E8 6E73F2FF call <jmp. & user32.MessageBoxA>; MessageBoxA
004E0BC2 |. 8B83 14030000 mov eax, dword ptr ds: [ebx + 314]
004E0BC8 |. 8B10 mov edx, dword ptr ds: [eax]
004E0BCA |. FF92 C0000000 call dword ptr ds: [edx + C0]
004E0BD0 |. E9 0C020000 jmp OfficeMa.004E0DE1
004E0BD5 |> 8D55 F4 lea edx, dword ptr ss: [ebp-C]
004E0BD8 |. 8B83 14030000 mov eax, dword ptr ds: [ebx + 314]
004E0BDE |. E8 F9E5F6FF call OfficeMa.0044F1DC
004E0BE3 |. 8B45 F4 mov eax, dword ptr ss: [ebp-C]; trial code Part 2 987654321 send eax
004E0BE6 |. 8D55 F8 lea edx, dword ptr ss: [ebp-8]
004E0BE9 |. E8 4E8AF2FF call OfficeMa.0040963C
004E0BEE |. 8B45 F8 mov eax, dword ptr ss: [ebp-8]
004E0BF1 |. 50 push eax; eax = 987654321
004E0BF2 |. 8D55 EC lea edx, dword ptr ss: [ebp-14]
004E0BF5 |. 8B83 0C030000 mov eax, dword ptr ds: [ebx + 30C]
004E0BFB |. E8 DCE5F6FF call OfficeMa.0044F1DC
004E0C00 |. 8B45 EC mov eax, dword ptr ss: [ebp-14]; trial code Part 1 123456789 send eax
004E0C03 |. 8D55 F0 lea edx, dword ptr ss: [ebp-10]
004E0C06 |. E8 318AF2FF call OfficeMa.0040963C
004E0C0B |. 8B45 F0 mov eax, dword ptr ss: [ebp-10]
004E0C0E |. 50 push eax; eax = 123456789
004E0C0F |. 8D55 E4 lea edx, dword ptr ss: [ebp-1C]
004E0C12 |. 8B83 08030000 mov eax, dword ptr ds: [ebx + 308]
004e0c6 |. E8 BFE5F6FF call OfficeMa.0044F1DC
004E0C1D |. 8B45 E4 mov eax, dword ptr ss: [ebp-1C]; machine code "WD-WCAD19885326" appears, send eax
004E0C20 |. 8D55 E8 lea edx, dword ptr ss: [ebp-18]; eax = WD-WCAD19885326
004E0C23 |. E8 148AF2FF call OfficeMa.0040963C
004E0C28 |. 8B45 E8 mov eax, dword ptr ss: [ebp-18]
004E0C2B |. 5A pop edx
004E0C2C |. 59 pop ecx
004E0C2D |. E8 02070000 call OfficeMa.004E1334; algorithm analysis call
004E0C32 |. 3C 01 cmp al, 1
004E0C34 |. 0F85 80010000 jnz OfficeMa.004E0DBA; when the flag bit is determined, the jump fails.
004E0C3A |. 8D55 DC lea edx, dword ptr ss: [ebp-24]
004E0C3D |. 8B83 0C030000 mov eax, dword ptr ds: [ebx + 30C]
004E0C43 |. E8 94E5F6FF call OfficeMa.0044F1DC
004E0C48 |. 8B45 DC mov eax, dword ptr ss: [ebp-24]
004E0C4B |. 8D55 E0 lea edx, dword ptr ss: [ebp-20]
004E0C4E |. E8 E989F2FF call OfficeMa.0040963C
004E0C53 |. 8B55 E0 mov edx, dword ptr ss: [ebp-20]
004E0C56 |. A1 A0865700 mov eax, dword ptr ds: [5786A0]
004E0C5B |. 8B00 mov eax, dword ptr ds: [eax]
004E0