00526648 /. 55 push ebp
00526649 |. 8BEC mov ebp,esp
0052664B |. 6A 00 push 0
0052664D |. 53 push ebx
0052664E |. 8BD8 mov ebx,eax
00526650 |. 33C0 xor eax,eax
00526652 |. 55 push ebp
00526653 |. 68 8A665200 push 11_.0052668A
00526658 |. 64:FF30 push dword ptr fs:[eax]
0052665B |. 64:8920 mov dword ptr fs:[eax],esp
0052665E |. 8D45 FC lea eax,[local.1]
00526661 |. E8 DEFEFFFF call 11_.00526544
00526666 |. 8B55 FC mov edx,[local.1]
00526669 |. 8B83 1C030000 mov eax,dword ptr ds:[ebx+31C]
0052666F |. E8 F08FF4FF call 11_.0046F664
00526674 |. 33C0 xor eax,eax
00526676 |. 5A pop edx
00526677 |. 59 pop ecx
00526678 |. 59 pop ecx
00526679 |. 64:8910 mov dword ptr fs:[eax],edx
0052667C |. 68 91665200 push 11_.00526691
00526681 |> 8D45 FC lea eax,[local.1]
00526684 |. E8 F7E4EDFF call 11_.00404B80
00526689 \. C3 retn
0052668A .^ E9 D9DEEDFF jmp 11_.00404568
0052668F .^ EB F0 jmp short 11_.00526681
00526691 . 5B pop ebx
00526692 . 59 pop ecx
00526693 . 5D pop ebp
00526694 . C3 retn
00526695 8D40 00 lea eax,dword ptr ds:[eax]
00526698 . A1 B4FF5400 mov eax,dword ptr ds:[54FFB4]
0052669D . E8 1A5FF6FF call 11_.0048C5BC
005266A2 . C3 retn
005266A3 90 nop
005266A4 . 53 push ebx
005266A5 . 8BD8 mov ebx,eax
005266A7 . 6A 05 push 5
005266A9 . 6A 00 push 0
005266AB . 6A 00 push 0
005266AD . 68 C8665200 push 11_.005266C8 ;
86bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4y4G2k6Y4c8J5k6h3N6Q4x3X3g2U0L8$3#2Q4x3X3g2U0L8W2)9J5c8Y4y4Z5j5i4u0W2N6$3q4J5k6g2)9#2k6Y4k6A6k6i4N6Q4x3X3g2S2M7%4m8Q4x3@1k6A6k6q4)9K6c8q4)9J5c8V1p5H3b7e0c8o6z5o6S2m8i4K6u0V1y4e0c8o6y4q4)9J5k6o6b7J5y4f1u0Q4x3X3b7^5x3o6x3%4i4K6u0V1x3K6u0r3x3K6m8o6x3K6b7K6x3p5j5I4i4K6u0r3i4K6t1K6M7X3g2Y4k6X3!0J5L8b7`.`.
005266B2 . 68 28675200 push 11_.00526728 ; open
005266B7 . 8BC3 mov eax,ebx
005266B9 . E8 B6F8F4FF call 11_.00475F74
005266BE . 50 push eax ; |hWnd
005266BF . E8 B4BEF0FF call <jmp.&shell32.ShellExecuteA> ; \ShellExecuteA
005266C4 . 5B pop ebx
005266C5 . C3 retn
005266C6 00 db 00
005266C7 00 db 00
005266C8 . 68 74 74 70 3>ascii "
7c5K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4y4G2k6Y4c8J5"
005266D8 . 65 67 2E 63 6>ascii "eg.com.cn/sharew"
005266E8 . 61 72 65 5F 7>ascii "are_view.asp?id="
005266F8 . 2F 41 30 41 3>ascii "/A0A4C88A-54C4-4"
00526708 . 32 35 42 2D 3>ascii "25B-8037-32F30C3"
00526718 . 34 33 30 46 3>ascii "430F1/#regform",0
00526727 00 db 00
00526728 . 6F 70 65 6E 0>ascii "open",0
0052672D 00 db 00
0052672E 00 db 00
0052672F 00 db 00
00526730 . 53 push ebx
00526731 . 8BD8 mov ebx,eax
00526733 . 6A 05 push 5
00526735 . 6A 00 push 0
00526737 . 6A 00 push 0
00526739 . 68 54675200 push 11_.00526754 ;
94dK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4y4G2k6Y4c8J5k6h3N6Q4x3X3g2U0L8$3#2Q4x3X3g2U0L8W2)9J5c8Y4y4Z5j5i4u0W2N6$3q4J5k6g2)9#2k6Y4k6A6k6i4N6Q4x3X3g2S2M7%4m8Q4x3@1k6A6k6q4)9K6c8q4)9J5c8U0f1@1c8e0y4n7x3e0b7H3i4K6u0V1y4f1x3K6z5g2)9J5k6o6c8p5x3f1q4Q4x3X3b7&6x3o6W2o6i4K6u0V1z5f1t1^5x3e0R3J5z5o6c8p5x3@1f1H3i4K6u0r3i4K6t1K6M7X3g2Y4k6X3!0J5L8b7`.`.
0052673E . 68 B4675200 push 11_.005267B4 ; open
00526743 . 8BC3 mov eax,ebx
00526745 . E8 2AF8F4FF call 11_.00475F74
0052674A . 50 push eax ; |hWnd
0052674B . E8 28BEF0FF call <jmp.&shell32.ShellExecuteA> ; \ShellExecuteA
00526750 . 5B pop ebx
00526751 . C3 retn
00526752 00 db 00
00526753 00 db 00
00526754 . 68 74 74 70 3>ascii "
46fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4y4G2k6Y4c8J5"
00526764 . 65 67 2E 63 6>ascii "eg.com.cn/sharew"
00526774 . 61 72 65 5F 7>ascii "are_view.asp?id="
00526784 . 2F 35 34 45 3>ascii "/54E3B140-5C39-4"
00526794 . 44 31 41 2D 3>ascii "D1A-909C-9B81828"
005267A4 . 34 44 33 45 3>ascii "4D3E0/#regform",0
005267B3 00 db 00
005267B4 . 6F 70 65 6E 0>ascii "open",0
005267B9 00 db 00
005267BA 00 db 00
005267BB 00 db 00
005267BC . B8 D0675200 mov eax,11_.005267D0 ; 注册码错误
找不到注册错误的判断模块在那,请问下是那个模块，怎么看出这个模块是判断注册码的呢？谢谢
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
