. C3 RETN
------------------------RC2加密CALL---------------------------------
0043C9A0 $ 55 PUSH EBP
0043C9A1 . 8BEC MOV EBP,ESP
0043C9A3 . 6A FF PUSH -1
0043C9A5 . 68 B0074A00 PUSH IDMAN.004A07B0 ; SE handler installation
0043C9AA . 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0043C9B0 . 50 PUSH EAX
0043C9B1 . 64:8925 000000>MOV DWORD PTR FS:[0],ESP
0043C9B8 . 81EC 84010000 SUB ESP,184
0043C9BE . 53 PUSH EBX
0043C9BF . 56 PUSH ESI
0043C9C0 . 57 PUSH EDI
0043C9C1 . 8D85 70FEFFFF LEA EAX,DWORD PTR SS:[EBP-190]
0043C9C7 . 8965 F0 MOV DWORD PTR SS:[EBP-10],ESP
0043C9CA . 33F6 XOR ESI,ESI
0043C9CC . 8BD9 MOV EBX,ECX
0043C9CE . 50 PUSH EAX
0043C9CF . 8975 FC MOV DWORD PTR SS:[EBP-4],ESI
0043C9D2 . E8 79FCFFFF CALL IDMAN.0043C650
0043C9D7 . 8B45 14 MOV EAX,DWORD PTR SS:[EBP+14]
0043C9DA . 8D8D 70FEFFFF LEA ECX,DWORD PTR SS:[EBP-190]
0043C9E0 . 8D95 70FFFFFF LEA EDX,DWORD PTR SS:[EBP-90]
0043C9E6 . 51 PUSH ECX
0043C9E7 . 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10] <==="506938841"为内定的密钥
0043C9EA . 52 PUSH EDX
0043C9EB . 50 PUSH EAX
0043C9EC . 51 PUSH ECX
0043C9ED . 8BCB MOV ECX,EBX
0043C9EF . E8 9CFCFFFF CALL IDMAN.0043C690 <===跟进
0043C9F4 . 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8] <==="ABCDE-GHIJK-MNOPQ-STUVW"
0043C9F7 > 3B75 0C CMP ESI,DWORD PTR SS:[EBP+C]
0043C9FA . 7D 2A JGE SHORT IDMAN.0043CA26 <===循环结束就这里跳出
0043C9FC . 8D95 70FFFFFF LEA EDX,DWORD PTR SS:[EBP-90]
0043CA02 . 8BCB MOV ECX,EBX
0043CA04 . 52 PUSH EDX
0043CA05 . 57 PUSH EDI
0043CA06 . E8 F5FCFFFF CALL IDMAN.0043C700 <===加密CALL
0043CA0B . 83C6 08 ADD ESI,8 <===可以看得出，在这里是每8位一处理
0043CA0E . 83C7 08 ADD EDI,8
0043CA11 .^EB E4 JMP SHORT IDMAN.0043C9F7 <===从这里向上跳构成一个循环结构，主要每8位加密：
**************这里就是注册表加密后的列表********************
0074DD98 A1 A3 4B 70 DB C5 05 22 。Kp叟"
0074DDA0 DE 26 A7 BB 53 3E A9 9D ?ЩS>
0074DDA8 24 3D 45 42 91 B3 9D 06 $=EB懗?
************************************************************
0043CA13 . 68 E4064D00 PUSH IDMAN.004D06E4
<===CProtection::rrc2_encrypt(byte* data,int length_of_data, char* key, int length_of_key)很明显这就是一个加密算法的CALL(RC2加密算法)
0043CA18 . E8 D37AFEFF CALL IDMAN.004244F0
0043CA1D . 83C4 04 ADD ESP,4
0043CA20 . B8 26CA4300 MOV EAX,IDMAN.0043CA26
0043CA25 . C3 RETN
0043CA26 > 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] <===直接就跳到这里了
0043CA29 . 5F POP EDI
0043CA2A . 5E POP ESI
0043CA2B . 64:890D 000000>MOV DWORD PTR FS:[0],ECX
0043CA32 . 5B POP EBX
0043CA33 . 8BE5 MOV ESP,EBP
0043CA35 . 5D POP EBP
0043CA36 . C2 1000 RETN 10
---------------0043C9EF CALL IDMAN.0043C690 跟进(对"506938841"密钥的预处理)-------------------
0043C690 /$ 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
0043C694
关键词：与RC加密算法的首次亲密接触