某起名软件逆向分析

阿捏利

已于 2025-04-16 09:30:45 修改

阅读量1.4k

点赞数 24

分类专栏：软件逆向文章标签：逆向 c# .net dnspy

于 2025-04-15 15:04:08 首次发布

本文链接：https://blog.csdn.net/geesehoward20000/article/details/147249441

版权

软件逆向专栏收录该内容

2 篇文章

订阅专栏

本文仅用于编程学习，不提供任何破解版或注册机。

今天在52pojie论坛看到一个人发了个求助，简单说就是想练习做一个某起名软件的注册机，但有一出乱码的地方看不懂，代码如下

		public static void FuncWriteRegFile(ref string pcn, ref string psw, ref string tyear, ref string tmonth, ref string tday)
		{
			string tmpstr = "格\u0003  ?\u0001  媀\bSW?聥\a吚\u000f咘   h @  瑜\t  吚塃黸\bj\u000eX轾   奛`婩D€?鲑\u001b蓙 ?伭 p  嬞\u000f痌??儵   +?葔M鴕\u0003塃鴍 岶bP\u0015\u0018\u0010罿凐塃\btO鯢`\bt%伱 \u0010  SP柁\u0015  吚t8u?u?u\b鑼\u0015  吚t&險岾 QP杓\u0015  吚t\u0016u鴭5lP罿Vu\b鑖\u0015  吚u\u001fu?\u0015\u0010\u0010罿儅\bt\tu\b\u0015\u0014\u0010罿给\u0003  隓h?罿Vu?u鳶鑇?u\b\u0015\u0014\u0010罿婨鼆g\u0004 ";
			string tmpstr2 = string.Concat(new string[]
			{
				pcn,
				"|",
				psw,
				"|",
				tyear,
				"|",
				tmonth,
				"|",
				tday
			});
			string contents = ModPCAndRegcode.GetEncrypt(tmpstr) + "\r\n" + ModPCAndRegcode.GetEncrypt(tmpstr2) + "\r\nMZ \u0003   \u0004            @                                      \u000e\u001f? ???L?This program cannot be run in DOS mode.$       轊\r\n#?dp?dp?dp?ep?dp`\a}p?dp`\a[p?dp\r\n\a!p?dp@\axp?dp`\aYp?dpRich?dp                        PE  L\u0001\u0004 P\u0017?         \u000e!\v\u0001\a  \r\n>   \b      ?   \u0010   P    罿 \u0010   \u0002  \u0005 \u0001 \u0005 \u0001 \u0004        €   \u0004    \u0003     \u0004  \u0010    \u0010  \u0010      \u0010   `K  a\u0002  DI  P    `  ?                   p  X\u0001  p\u0010  \u001c                                   x\u0002  D    \u0010  d                           .text   ?   \u0010   >   \u0004                 `.data       P   \u0002   B              @  ?rsrc   ?   `   \u0004   D              @  @.reloc  ?   p   \u0002   H \r\n             @  B\u001e鄛;    ??*   ??5           ntdll.dll USER32.dll KERNEL32.dll                                                                                                                                                                                                                                                                                     \r\n                                                  rF鍂鋡浶鋡蠕鋡E氬w.沅w1撶w蔈鍂\u001a射w?鍂(6鍂g1鍂?鍂q袖w獿鍂W\u0003鎤\u001f射w仒鍂X4鍂彲鋡    \bK褀    e\u0011鴚                    E噠;    \u0002   \u001d   ?  ?  .\\  SOFTWARE\\CLASSES    .DEFAULT    reg NB10    E\r\n噠;\u0001   vmmreg32.pdb  婦$\b冭 t\u0012Hu\u0014j ?\u001a  吚t\t3离\b楮\u0019  3繞? V媡$\b?吚W?\u0010\u0010罿t\u0006P變& 婩\u0004吚t\aP變f\u0004 _^? 婽$\u0004SVW媧\u00043拦   螳婤\b?j Y+羣-?9咑媆9\u0004t*;饂&凔t\u0010f侞 s\u001a\u000f敷媄\u0004?硧49\u0003?苪?繽^[? 格\u0003  塍婦$\b婰$\u0004k?\u0003A\u0018﨟\u0019億$\f t\b€H\u0018\u0004€I`\u0001? U嬱冹\u0010S媇\bW?婳\u0010凒u\a3篱   婼\bV?9?\u0003?驂U餽\r\n儀\bu\a3篱   j 3蒦;謮M魤M黺i?>塢\u0010儃\u0004t\u000e\u00033?>塃鴭?騬靸} t\u001f+]鬝u?u?\u0015\\\u0010罿婾饍?\u0001]鼖]鴭\r\nM鼌蓇\u0005塢鼖?騭\u0018?>儀\u0004u\b\u00030;騬耠\u0003塃?騬殝]\b嬃+菈G\u0010婥\f僆\u0004僆\bS?璧?3繞^_[陕\u0004 婦$\u0004婰$\fV媡$\fk?\u0003p\u0018婩\f;羠\u00043离s媀\bS+袓?\u000f  併 ?侞   Wv\u0005j\u000eX隤S6?*  孁?t鞻?柙?婫\u0010凐u\u0012婩\b塆\u0010\u0003莾H\u0004僅\b?\u0003菋?N\b\u0001N\f婲\f?婦$\u0010€N\u0018\f塣\b€H`\u00053繽[^? 婦$\u0004V媡$\u0010W媩$\u0010k\u001c\u0003x\u0018;w\fv\u0005j\u000eX隡SW鑟??婹\u0010?\r\n?;髒\u0005j\u000eX?+迌?r\u0018\u0003謮Q\u0010婬\b?僉0\u0004塋0\b?0?婸\b?塓\u0010)w\f婰$\u001c?3繹_^? 婰$\u0004婣\u0010V?W\u000f穨\u0014;菎P\u0001v\u0006f塅\u0014?S媃\r\n\u0004?撾? t\f\u000f穨\u0014B兠\u0004;譾颷_塓\u0010^? U嬱Q婨\f婱\bk?\u0003A\u0018S媇\u0014?V?W?\u001e孃+?x\b塎黶i儂\u0004uc婱\u0010+螊2;蝫X+駜?塽\fr\u001d?9塽\b?\u0011婻\b僋\u0004塚\b婾\f?婾\b?婻\b\u0003?\v)H\f婱鼖A\u0010;莡\u000f塓\u0010??\b婩\b;莟\a凐u耠\u0003塚\b3离\u0003j\u000eX_^[陕\u0010 婰$\b婽$\u0004?僆\u0004V媝\u0010塹\b嬹+饓p\u0010?\u0001B\f^? 婦$\u0004婰$\b9H\u0010v\u0003塇\u0010婡\u0004? ? U嬱Q僥 S媇\bf儃0 V媠\u0018W媨(墋\b\u000f唨   奆\u0018?tH儅\fu\u0004?tZ婩\b?u\b塆\u0004婩\fu\u0010塆\bf婩\u0010€g\f鹒塆\u0016?4  吚tOv\bWu\u0010?4  吚t?媫\b?儅\ft\u0016\r\nv\bWu\u0010v\u0014u\f瑁(  吚u\u001e\u0003~\b\u000f稢0E鼉?9E鼔}\br€3繽^[陕\f 给\u0003  腧婰$\u0004婣\u0018婹(V3鰂9q0v\u001a兝\u0018W€ 麎P?P?穣0F兝\u001c;鱮隷^? 婦$\u0004\u000f稨0吷V媝\u0018v'W孂奆\u0018$\a<\u0001u\u0010€~\u0019 u\r\nV鑆?€f\u0018 €f\u0018齼?Ou輄^? 婦$\u0004?RGDBu\ff儀\u0006 u\u00053繞?3缆\u0004 U嬱冹 V媢\bW\u000f穨0岹\u0004k?P墋\b钃&  嬓呉u\bj\u000eX閯   嬒k?S嬞灵\u00023缷珛藡]\b僥\b 冡\u0003呟螵岰\u0004塚\u0018塅\u001c媣(vR峼\fVu\f桧2  吚tKj 岴郟u\f铔2  吚t9岴郟鑍吚t3墂\b婨鋲G鼖E?w?E\b?\u000f稥鰤\r\nG\u0004兦\u001c9]\br?繹_^陕\b 给\u0003  腧格\u0003  腚V媡$\bv\b栲%  吚?t\u001bh?  栊%  吚塅\u0004t\u00043离\tV??j\u000eX^? V媡$\fW媩$\f\u000f稧0;餽\r\n格\u0003  閾   k?\u0003w\u0018S鯢\u0018\u0001u|V铚嬝呟u_P兦bW\u0015\u0018\u0010罿孁?t\u001cv\u0014W?2  吚t\u000fv\b6W杓1  吚u\a圾\u0003  ?6鑩?吚u\a获\u0003  ?V柚?嬝呟t\u0016?t\aW\u0015\u0014\u0010罿V钃?嬅?W\u0015\u0014\u0010罿€N\u0018\u0003﨔\u00193繹_^? U嬱Vu\f媢\bV?吚u3婱\f\u000f禪\u0010k?\u0003N\u0018W媦\u0004?梾襙u\u0011Ru\fV枞?格\u0003  ??\u0003蕥U\u0014?^]? U嬱VW媫\b\u000f\r\n穡0侢?  塽\bs\u0018;w\u001cr岶\u0004k?Pw\u0018栳$  吚u\bj\u000eX閼   僄\u001c\u0004塆\u0018k?\u0003w\u0018S媇\f伱\u001f\u0010  併 ?V塣\b鑞?吚t\u0005j\u000eX隺僨\u0010 僋\u0014艶\u0018\a艶\u0019\u0001岰鄩F\f? RGDB塜\u0004婲\ff僠\u0014 塇\bf婱\bf茾\f\b f塇\u000e茾\u0010    婲\f僅$僅(塇 fG0僌2\u0001€O`\u0005V钁?[_^]? U嬱S媇\bf儃0 VW\u000f剨   僥\b \u000f穥0嬿k?\u0003s\u0018隿冾\u001cO亊\u0010   sV儅\b t\u0010婩\b+F\f\u0003E\f=   ?婨\f;F\fw8WS柃?吚u-9E\bt\u000eu\fWS鑤?吚u\u0011u\u0010u\fWS桫?吚tIj WS鑌??u?}\bu\f荅\b\u0001   閦\r\nu\fS鑻?吚uN\u000f穥0u\u0010Ou\f嬿k?\u0003s\u0018WS璇?吚u'V??\u000f纷\u000f啡菱\u0010\v褘M\u0010?塛\u0004?+\u000e媀\u0004??离\fj WS桁?j\u000eX_^[]? U嬱W媫\b岴\bPu\u0010u\fW杼?吚u(V媢\fu\bk?\u0003w\u0018V鑾?u\u0010V瑾?j\u0001u\fW锠?^_]? U嬱冹\u0010W媫\b婫\b峂黁w\f塃\bP鐰\u001f  吚\u000f呇\u0001  婨黃媂\b Vj w\f? u\b#?迚]鴫E痂?  岴黀Su\b?\u001f  吚\u000f厰\u0001  Su\b?!  吚t\u0004€`\u0002飲M鼖Y\u0004#?_\fu\u001a吚t\t婱饓H\u0010婱鼖A\u00043E??A\u0004隑j u?u\b鑕\u0019  ;\r\n迚]?兂   岴黀Su\b琛\u001e  吚\u000f?\u0001  婨鼖\u0018#?_\fu菋\b3M??\bj\u0001u?u\b?\u0019  \u000f禛\u0016P\u000f稧\u0014Pu\b杩?w\fu\b棹\u001a  媉\u0010€O\u0002\u0002;?冞   岴鬚Su\b?\u001e  吚\u000f吺   婨魤]鴫E鼖X\u0004#?辳3岴鬚Su\b?\u001e  吚u婨?p\u0004j\u0001u?u\b璎\u0018  閲   格\u0003  閲   婨鼖\u0018#?辳\u0011岴鬚Su\b栀\u001d  吚t!婨鼖X\b#?_\ft\u0011岴鬚Su\b杌\u001d  吚t\u0003兯u?u\b枥\u001f  吚t\u0004€H\u0002\u0002婨?禜\v\u000f稝\fQPu\b桄?j\u0001u?u\b?\u0018  u?u\b?\u001a  ;??3繼[_陕\u0004 U嬱Q僥 岴黀u\fu\b鑄\r\n\u0014  吚u.婱鼖A\b婹\f;PHVt\u0013鯜`€uQ柘?婱鼖痣\u0003j\u0005^Q?\u0014  嬈^陕\b 婦$\b\u000f稨\r\n\u000f稰\bV媡$\bfN\u000ef儈\u000e W峾\u0011\ft\u0016媀\b?\a+?諶QP\u0015\\\u0010罿兡\f)~\b_^? U嬱QQ儅\f t\u0014ju\f\u0015\u001c\u0010罿吚t\u0005jWX隸V岴\bP璧\u001d  嬸咑uM岴黀岴鳳u\fu\b鑳$  嬸咑u4婨\b€x\u0017\u0006t\u0019婬\b鯝`€u\u0010u?u\\婨\b?j\u0005^\u000f稨\u0014j\u0001Qp\b钘?嬈^陕\b U嬱冹\u0010SV媢\b鯢\u0002\u0010婩\b塃鴭E\fW塃\bt\u0011婲 ;羠\r\n+翂E\b婩$?婩\u0010? ;脡E黶:岴餚u?u\a\u001c  吚\u000f呡   9E\bt3婨饗8j \r\nu??u?  M\b;麎}黵砌F\u0002 \u000f劔   婩\b媝\u0004闇   岴鬚婨?蓨H\v\u000f稝\fQPu犍吚塃\buS媇\u0010呟媫\u0014t.婱?稟\f9\aw\t荅\b   ?P兞\u0014QS\u0015\\\u0010罿婨?稝\f兡\f€$\u0018 婨?稝\f?婨?稝\fj Pu忬媫黬 Wu?  婨\f€N\u0002\u0010塅 墌$隩儅\b t\u0015?M\b咑u窀\u0003\u0001  _^[陕\u0010 媫\u0010僥\b ?媇\u0014t&婩\b9\u0003w\t荅\b   ?P岶PW\u0015\\\u0010罿婩\b兡\f€$\a 婩\b?婨\b牖U嬱u\u0014u\u0010\u0015 \u0010罿吚t\u0005jWX?岴\bP杳\u001b  吚u\u0012岴\u0014Pu\u0010u\fu\b鑂?]? \r\nU嬱V媢\bf婩\u0014f=t7峂\bQ3蓨N\u0016\u000f防QPv\b韪?吚uN婨\b\u000f稰\u000e婱\f;蕆\u0016\u000f稦\u0014j Pv\b钖??\u0001  ?\u000f稰\u0010\u000f穚\f\u0003聟蓫D\u0006\u0014t\u0011\u000f穚\b\u000f稰\r\n\u0003餓岲\u0016\fu飲M\u0010?3繼]? U嬱V? \u0010罿W媫\u0014j\u0004W謪纔07u\u0010謪纔%媫\u001c?t\u0012j\u0004W謪纔\u0015j\u0004W謪纔\f儅$ u\u000f儅  t\u0014jWX_^]? j\u0004u$謪纔鞃E\bP枨\u001a  嬸咑uA岴\u001cPu\fu\b?嬸咑u,u$u Wu\u0014u\u0010u\u001cu\b?  嬸婨\b\u000f稨\u0014j Qp\b璧?嬈霙婦$\u0004?CREGu*婬\u0004侚  \u0001 t\b侚  \u0002 u\u0017鯜\u0012\u0004t\fj \r\nP?\u001d  吚u\u00053繞?3缆\u0004 SUV媡$\u0010WjV铔\u001b  P罿3呻\b;苩\r\n嬋 吚u綦\u000f吷 u\aP罿??媬\u0004?\u0010\u0010罿?w\u0004璺嬊?P諈u韹F\b吚t 3?^\f孁v\u0012?吚t\u0003P誄兦\b;^\fr?v\b諎F\u0018吚t!3f9~0嬝v\u0012S鑎?\u000f稦0G兠\u001c;鴕?v\u0018誚誣^]3繹? U嬱侅\b\u0001  V媢\bf婩`?t\u0004≒t\a3篱?  SWj f\u0010 崀bWf塅`荅\u0003  兯\u00150\u0010罿吚\u000f刼\u0001  鯢`\u0004t{W\u0015 \u0010罿嬝侞\u0004\u0001  \u000f僒\u0001  W?,\u0010罿崊P譑t\r\n€?\\u髤踭€? ?h?罿崊P讔咗?P鑃  凐塃\b\u000f?\u0001  j 崀bW\u0015\u0018\u0010罿嬝凔tx?j\u0001W\u0015\u0018\u0010罿凐塃\b\u000f勝   凔u\u0006鯢2\u0001t(鯢`\b婩\u0014t\a\u0005 \u0010  ?兝 塅(j 岶 Pu\b鐱  吚tu\bSV鑿\u0015  吚塃黸\u0011u\bSV璐?吚塃黷/凔t\aS\u0015\u0014\u0010罿儅\btr凔t崊P\u0015(\u0010罿j\aW\u00150\u0010罿險u\b?\u0014\u0010罿變?t-S讔FbP荅\u0003  \u0015(\u0010罿吚t-岶bP崊P\u0015$\u0010罿吚t\u0018V桧?V栳\u0015  僨2f`鷥e j\a岶bP\u00150\u0010罿€f`飲E黖[^陕\u0004 V媡$\bf婩`≒u\u0018f  Vf塅`\r\n枨\u0015  V柩?€f`?繼? V?hP罿?嬈?PT$\f咑u骬? U嬱V媢\b婩\b婬HW峌\bRQP塏\f鑉\u0016  孁?u4婨\b€f\u0002閒?HK婬\u0004佱 Wv\f塏\u0010f婬\fv\bf塏\u0014夽\v團\u0016柰\u0010  ?v\b栎?嬊_^]? U嬱QQSVWu\f\u0015 \u0010罿兝dP?\u0019  嬸咑u\bj\u000e[?\u0001  j\u0019Yu\f3缷珝FbP\u0015,\u0010罿媇\u0010塢\u0010僥\u0010\u0002u!j u\f\u00154\u0010罿凐u\r\n圾\u0003  轲   P\u0015\u0014\u0010罿儅\u0010 f荈`\u0003 t\u0006f荈`C 雒\u0004荈 CREGt€N`\b荈$  \u0002 ?荈$  \u0001 3€?G鲔V墌2荈@RGKN荈P\t   \u001b蹆NH僋L冦\u007fCf\r\n塣6瑕\u0014  嬝呟uq鯢`\bu\a荈\u0014    jV瓒?嬝呟uV岴黀岴鳳V桎\u000f  嬝呟uB婨鴫FH婱 \tA\b婱?\u0001婱?A\u0004婨黤!X\u000e婨黤丠\fWu鳹鑲\u000f  V鐴?嬝呟t\u0019儅\u0010 u\tu\f\u0015(\u0010罿V鑬?嬅?P罿?婨\b?hP罿?3繽^[陕\f U嬱QSVWu\f\u0015 \u0010罿兝dP杈\u0017  嬸咑u\f荅?   椋   j\u0019Yu\f3缷珝FbP\u0015,\u0010罿j u\f荅\u0003  \u0015\u0018\u0010罿孁?tnj 峖 SW柙#  吚tWS璞?吚t)僨2鷣~$  \u0002 u\u0004€N`\bj 峖@SW瑭#  吚t,?RGKNt\t\r\n荅\u0003  ?V鐿\u0013  吚塃黸\u000eWV鑜?吚塃黷\u0012W\u0015\u0014\u0010罿V鑾?婨;W\u0015\u0014\u0010罿u\f\u00158\u0010罿凐t\u0012Pu\f\u00150\u0010罿吚u\u0004€N`€P罿?婨\b?hP罿?3繽^[陕\b U嬱侅\u0004\u0001  亇\b\u0002  €t 亇\b\u0003  €t\u0017亇\b\u0001  €u\u0006儅\u0014 u\bjWX閼   V媢\f咑t\u0012jV\u0015\u001c\u0010罿吚t\u0005jWX雟岴\bP?\u0014  婨\b鯜\u0002\u0004u\bp\b栳?咑u\u00043离Tj 崊Ph\u0004\u0001  V\u0015<\u0010罿吚t\u0006嵉婨\u0010?t\u0015冟\u0002燕P婨\bV兝\bP杷??婨\bV兝\bP??吚u\bu\b鐹?^陕\u0010 j t$\u0010t$\u0010t$\u0010?\r\n? 岲$\u0004P琛\u0013  吚u\f婦$\u0004p\b??? U嬱QQ儅\b t5u\b鑤\u0004  吚u)u\f岴黀u\b璁\u0004  吚v\u0016岴鳳岴黀j 铔\u0004  吚u\u0003@?3郎? U嬱QQju\u0010\u0015\u001c\u0010罿吚t\bjWX樗   亇\b\u0002  €t\u0013亇\b\u0003  €t\r\n蛤\u0003  榀   W岴\bP?\u0013  孁?\u000f厴   媫\f岴黀W鑑吚t\u001bj 岴鳳Wu\b鑧\u0004  吚u\u000fuv\u0012  框\u0003  雃婨黇兝\u0010P桷\u0014  嬸咑u\u0005j\u000e_隠W岶P\u0015,\u0010罿婨鼔F\bu黈铻\u0015  u\u0010團\f岶\u0004P桦?孁?u\u0016婨\b婡\b婡\u0004?婨\b婡\b塸\u0004?V\u0015\u0010\u0010罿^嬊_陕\f U嬱Q\b\u0002  €t\u0013亇\b\u0003  €t\r\n蛤\u0003  閴   S岴\bP?\u0012  嬝呟uv岴黀u\f或\u0003  鑾?吚ta婨\b婡\bV媝\u0004W3?婨?F\bu\u0011P岶Pu\f?\u0015  吚t孇?咑u唠-?u婨\b婡\b?塇\u0004???媬\u0004W??W鑱?V\u0015\u0010\u0010罿3踎^嬅[陕\b U嬱冹\fSV媢\bW岴鬚3跾V桀? \u0001  雖岴黀5|P罿岴鳳岴\bP5€P罿Cu魤}\bV荅?@  ?\u0019  吚u#儅?u\u0003M?u?5|P罿u?5€P罿u\f?\u001c  \u000f稦\u0014j Pv\b鑓?岴鬚SV鑪?吚t弮=xP罿 w}\u0005xP罿岴\bP5€P罿3跾險j 岴黀5€P罿CV鑹\u0002  \r\n吚u3j\u0001岴鳳5€P罿u\f鑡\u0002  吚u\u0013u?u\u0017ue\u0010  u]\u0010  岴\bP5€P罿SV墋\b鐷?吚t?xP罿_^[陕\b VWh \u0001  枥\u0012  吚?\u0010\u0010罿P罿u\u0005j\u000e^?h\u0001@  琚\u0012  吚P罿u\u0005j\u000e^?媡$\u0010?xP罿 Vt$\u0010钑?v\b璜?嬸5€P罿?5|P罿譥嬈^? SW鑣\u000f  孁?u\u0005j\u000e[隸VW?\u0011  j\u0001t$\u0018峸\bV桄?嬝呟u=W鑤?嬝呟u\u0010Wt$\u0014鐽嬝呟t\u001a?j 兝bP\u00150\u0010罿?兝bP\u0015(\u0010罿6鑨?W鑉\u000f  ^_嬅[? jt$\f\u0015\u001c\u0010罿吚\r\nt\u0005jWX?岲$\u0004P鑼\u000f  吚ut$\bt$\b鑇? V媡$\b鯢\u0002\u0004u\fv\b??€N\u0002\u0004^? h?罿杞?h P罿柩h(P罿枨鑘\u000e  P罿吚t\aP\u0015\u0010\u0010罿胔 p  鑉\u0011  吚P罿u\r\n璐j\u000eX?3缆\u0004 V媡$\b咑t9jV\u0015\u001c\u0010罿吚u0?嬑3译 <\\u\f呉u\u0004;蝩\u001c3译< r\u0014B侜 \u0001  s\vA?劺u?离\u00033繞^? U嬱婨\b吚t\aP罿?P罿?勆u\u0010婨\f? 婨\u0010? 3离%€鵟u\u0001@婾\f??€鵟t\a@?勆u魦M\u0010P罿+\u0002?]? U嬱冹(僥 儅\f SVW\u000f勣\u0003  岴鬚岴霵u\f鑴\r\n吚\u000f勂\u0003  婨\b鯜\u0002 婬\u0010媂\b媥\f塎\f? \u000f剝   婥\u0004吚塃鑤y?婨鑻M?H\bu\u0014Q兝Pu扈.\u0011  吚婨鑤\v 吚塃鑥仉M媂\u0004婥H峂黁PS塃\f枨\f  吚塃?卙\u0003  岴鬚岴霵j 楮?吚\u000f労\u0002  媫\f婨鼖@\u0004j W#芐塃\f?\a  僥 u?u扈?  9u\f塃?凖   岴黀u\fS鑖\f  吚塃??\u0003  婨?稨\u000e;M豼e峂鳴3蓨H\v\u000f稝\fQPS鑧?吚塃?厾   婨?稨\f9M魎\u001cu魞?Pu扈U\u0010  吚u\t荅?   ?僥 婨?稝\fj PS??儅 u&婨鼖}\f j W#芐荅?   塃\f鑭\u0006  9u\f\u000f\r\n俆9u\fsL岴鬚岴霵j  ?吚t0媫\f婨鼖@\u0004僥 j W#芐塃\f鐯\u0006  ?j u\fS?\u0006  ?\u0002  9u\f\u000f倠\u0001  鯡\u0014\u0001u\u0004j\u0002?婨\b€x\u0017\u0006u\u0006鯡\u0014\u0002t\u0006鯟`€t\bj\u0005X辂\u0001  岴黀WS鐳\v  吚\u000f呰\u0001  WS鐻  塃\u0014岴餚岴\fPS桷\u0005  吚塃?卍\u0001  婨魨M鳴兝\u0014PS鑏?3?翂E??\u0001  9M鋴E餿塎鋲M\u0014婱鼖I\b3H\b#?H\b婨鼖\b3M\f#?\b?婸\b3??P\b婨鼖P\u00043U\f#?P\u00049M\u0014t\u0011婨\u00149p\u0010r\u0006婾\f塒\u0010塎\u0014婨?0婨?p\u0004婨鴉婡\u0006婱?u鬴堿\f婨鴬@\u0004婱?u靾A\v鑱\u000e  婱餱堿\u000e婱鴭E魞?\r\n堿\b婨魦M鳳u靎堿\f婨鴥?P\u0015\\\u0010罿婱?纼?f堿\u000e婱鴍\u0001f堿\u0010婱鳺Sf堿\u0012栉\u0004  婨饗}\f塃鼖E?稝\u0006j\u0001PS鐴?岴鬚岴霵j 荅?   鐯?吚\u000f吂?u\fS棂\v  孁?ua?\r\n  孁?u%荅?   隡Qu\fS鑚\u0004  u\fS鑉\u0006  u郬??塤\b婨\f塆\f婨鼖@\u0004#茐G\u0010婨黤婡\ff塆\u0014婨鼕@\v圙\u0016婨\b夽\u0017圙\u0017u?u\fS?\u0004  ?t\u0014?媫\bW鑎\v  婨\u0010僥 ?婨鑏^[陕\u0010 U嬱u\f鐱?吚t\t蛤\u0003  ]? j\u0004u\u0010\u0015 \u0010罿吚t\u0005jWX腓岴\bP?  吚u踋榘?j\u0001t$\u0010t$\u0010\r\nt$\u0010璁? j t$\u0010t$\u0010t$\u0010铇? 岲$\u0004P柽\t  吚t\a=?  u\vt$\u0004鑡\t  3缆\u0004 婦$\u0004凐u\u0004\v离\aj\u001c3襓黢? 婦$\u0004= r\u0005內?=$\u0001  r#k?兝\u001bV嬋j\u001c%\u000f  3襘黯佱 ?^k?\u0003岭\aHk?兝 ? V媡$\b€f\u0003 W媩$\u0010?吚u\\S艶\u0003\u0001w\f鑴婲\b3然 #?N\bw\u0014鑝?3??\u000ew\u0010鑍婲\u00043??N\u0004奊\u0018團\vf婫\u001af塅\ff婫\u0004f塅\u000e[3繽^? =   €t\u0005凐u韹G\u0004塅\bw\b??3葋? 1\u000e儈\b8v?繞胧V媡$\b鯢\u0003\u0001W媩$\u0010tZ? 婩\bS? #肞梓?塆\f?#肞桕?塆\u0014婩\u0004#肞柢?塆\u0010\u000f稦\u000e塆\u0004f婩\ff=[u\u0005內?\u000f禢\v\u000f防拎\u0010\v翂G\u0018??   €婩\b\r\n塆\u0004?% P铇?塆\b_3繼? U嬱婱\b婾\u0014嬃髫\u001b纼噜兝 SV?\b?\u0010婨\f\u0003?駢M\u0014seWV鐶?孁佺\u0003  羚\u0004\u0003}\u0010岶\u001c塃\b;u\u0014s\b髌 ?t\f婨\b3譬 ?u\u0018SWU\u0018吚u'僂\b\u001c兤\u001c兠\u001c兦\u0010胂嬑佱\u000f   \u0010  +???u\u0014r漘^[]? U嬱QQ婱\f嬃V媢\b凌\r\n;F\f塃鴙\r\n格\u0003  ?\u0001  媀\bSW?聥\a吚\u000f咘   h @  瑜\t  吚塃黸\bj\u000eX轾   奛`婩D€?鲑\u001b蓙 ?伭 p  嬞\u000f痌??儵   +?葔M鴕\u0003塃鴍 岶bP\u0015\u0018\u0010罿凐塃\btO鯢`\bt%伱 \u0010  SP柁\u0015  吚t8u?u?u\b鑼\u0015  吚t&險岾 QP杓\u0015  吚t\u0016u鴭5lP罿Vu\b鑖\u0015  吚u\u001fu?\u0015\u0010\u0010罿儅\bt\tu\b\u0015\u0014\u0010罿给\u0003  隓h?罿Vu?u鳶鑇?u\b\u0015\u0014\u0010罿婨鼆g\u0004 \r\n€g\u0005 婱\f?佱\u0003  玲\u0004\u0003葖E\u0010?€O\u0004\u0001礼\u00053繽[^陕\f 婦$\b婰$\u0004婹\b凌\r\n?漫H\u0005億$\f t\b€H\u0004\u0002€I`\u0003? U嬱冹\fSV媢\b婩L= W塃\b\u000f?\u0001  鯢`\bt\u001f婩\u0014\u0005\u000f  凌\f拎\f凌\u0004塃\b荅 \u0010  3垭J婲\u0014j X;萿\t荅\u000f  ?崄\u000f  凌\f拎\f嬝+賰? \u0010  塙黽\u0004;聈伱 \u0010  塢鼖?跴桄?塃\b嬋灵\r\n;N\u0010塎鴕W峺\u0004嬊拎\u0003Pv\b?\b  嬓呉塙魎\bj\u000eX?\u0001  婩\u0010嬒媬\u0010+攘??鷭蚜?3荔珛蕛?螵婨魦M鴫F\b婨鴥?塅\u0010婨\b;N\fr\u0004A塏\f婱鼆N`\u0004\u0003?^\u0014峂鳴PV塅L鑩?吚\u000f叞   媫鴣\u000f  G\u0003婨鼔G\b?峂鳴PV鑂?吚\u000f厜   媫鴬F`?$\b併 鲐\u001b纼圄兝\u001c塃??G\br<婨\b峂鬛@PV??吚u)婨魦\b3藡]\b佱 \r\n1\b€`\u0003 婳\b+M鴍\u0001CSV塇\b??婱\b塣L€O\u0003\u0001媀\b嬃凌?聙H\u0004\u0002€N`\u0003婨\f?婨\u0010?3繽^[陕\f U嬱SV媢\bW媫\f岴\fPWV瑁?嬝呟u3婨\f€`\u0003NL3\bj\u0001佱 1\b奛`€?鲑WV\u001b蓛狒兞\u001c塇\b墌L韪?_^嬅[]? U嬱VW媫\b鯣`\bt)婾\f婳\u0014嬄拎\u0004嵏 @  ; @  v\u0004+葖駦 \u0001  拎\u0004?婨\f吚 p  u\r\nj 楮?兤郟??婳\u0014?0;裿\u0004+葖駜?婱\u0010?婱\u0014_?^]? U嬱岴\fP岴\bPu\fu\b鑦u\bu\fu\u0014u\fu\u0010桄\u0006  ]? U嬱QV媢\bW岴黀岴\bPu\fV鐳u?  u\u0010?\u0012  吚tJ鯢`\b婨\u0014t\au\b0??lP罿h\u007f1罿V0婨\fu\bk?P栊?儅\f 嬈u\u0003岶 u\bPu\u0010璩\u0011  吚t\u00023嬊_^陕\u0010 U嬱\r\n儅\fV媢\bu鯢`\u0002u\a3篱   j u\u0010琛\u0011  吚u给\u0003  楂   鯢`\b婩DS媈L塃\b婩\u0014W媬H塅Du\u0012W桤?S塅H柁?塅Lj 岶@Pu\u0010?\u0011  婱\b塣L3?脡ND墌Hu\a给\u0003  隫9^\f媬\b塢\bvI? t\u0019儅\fu\u0006鯣\u0004\u0002t$Wu\u0010SV柙??儅\ft\u0011u\u0010u\fSV钁?吚u?E\b婨\b伱 \u0004  兦\b;F\fr?繽[^]? 婦$\u0004婬\u0014€``龎HD婬\f吷婡\bv\f兝\u0004€ 齼?Iu髀\u0004 婦$\u0004婬\f吷V媝\bv*W孂?吚t\u001a鯢\u0004\u0003u\u0010€~\u0005 u\r\nP\u0015\u0010\u0010罿? €f\u0004?Ou赺^? U嬱QSV媢\b奛`婩D€?鲑W\u001b蓙 ?伭 p  岲\b3吟駦X\u0004孄羚\u0003W塃?  吚塃\bu\u0005j\u000eX隠嬒媫\b嬔灵\u00023荔珛蕛?螵婨\b僨PF`\b塅\b婨鼔F\f塣\u0010u\u0016vH鑎?vL塅H鑃?塅L婩D塅\u00143繽^[\r\n陕\u0004 U嬱V媢\u0010Vu\fu\b鐺?吚u\u0019?鯝\u0003\u0001u\u0011Pu\fu\b鑱?格\u0003  ^]? V?tP罿咑t\u0014嬈媣\u0018P\u0015\u0010\u0010罿;5tP罿u靸%tP罿 ^胘(栎\u0002  吚tDf僠\u0002 僠\u0004 f HK?tP罿吷u\b堾\u001c堾\u0018?;羣\u001b塇\u0018?tP罿婭\u001c塇\u001c堿\u0018?tP罿堿\u001cP罿脣D$\u0004婬\u00043?蕍\u0004I塇\u00049P\u0004uA鯜\u0002乽;婬\u0018;羥\b?tP罿?V媝\u001c塏\u0018媝\u001c婬\u0018塹\u001c;\u0005tP罿^u\t婬\u0018?tP罿Pf?\u0015\u0010\u0010罿? U嬱QQ婨\b =   €SVW塃?偆   =\u0006  €\u000f儥   崢   €?漃P罿?吚塃黷\u0006鯜\u0002\u0002th呟u\u000e P罿荅鴲\u0010罿?凔\u0001uL?P罿荅\u0010罿吚t\u000f? €`\u0002?u.鯣\u0002\u0004umj\u0001岴黀u鳺??吚uZ婨鼔\u0006€H\u0002\u0001婨鼒X\u0017婨\u0005凔\u0003uA婱\b?夽\u0002$\u0004鲐\u001b??  ?j(P\u0015@\u0010罿吚u\u001f婨黤?HKu\u0015f婡\u0002?u$\u0002鲐\r\n\u001b??  ?蛤\u0003  _^[陕\u0004 婦$\u0004婬\u0004凒t\u0006A塇\u0004?€H\u0002€? V媡$\fW媩$\fj\u0006Z筆P罿?吚t\u00109x\bu\v9p\fu\u0006鯜\u0002\u0006t-J兞\u0004呉w鈰tP罿嬃吚t\u00179p\fu\v9x\bu\u0006鯜\u0002\u0002t\t婡\u0018;羥?繽^? 奣$\bVW媩$\fj\u0006筆P罿^?吚t\u000e9x\bt\u00058P\u0017u\u0004€H\u0002\u0006兞\u0004Nu妗tP罿吚t\u00199x\bt\u00058P\u0017u\u0004€H\u0002\u0006婡\u0018;\u0005tP罿u鏮^? U嬱Q岴\bP??吚塃黸b婨\f=\u0001  €S媇\bu\u0006€{\u0017\u0003t=\u0005  €u?€{\u0017\u0002u9\u0005   €V?匬P罿W??t\u0015\u000f独Pj鑉€g\u0002鑻?€K\u0002\u0001S枰?_?^?荅\u0003  [婨? S媆$\bV?D\u0010罿Sj 謪纔:W繄罿W??Sj 謪纔$W ?Sj 謪纔\u0015h?罿桧?W桤?Sj 謃^[? S媆$\fU媗$\fV?H\u0010罿j\u0002SU謪纔=W繄罿W璧?j\u0002SU謪纔&W\r\n瑗?j\u0002SU謪纔\u0016h?罿钁?W鑻?j\u0002SU謃^][? 婽$\b陵\u0002婰$\u0004j Xt\b\u0003\u0001兞\u0004Ju\b S媆$\fW3呟t V媡$\u0010\u000f?F=€   s\f\u000f独P\u0015T\u0010罿\u0003鳮u鎊嬊_[? U嬱儅\u0010 SVWt'?T\u0010罿媇\b\u000f?P讒饗E\f\u000f P?饀\u0012CE\fM\u0010u?繽^[]? 嬈膈U嬱QSu\f?lP罿u\b荅\u0003  鐵\v  吚tLu\u0014u\u0010?\v  吚t=儅\u0018 Vt1媢\u0018侢 p  r\u0005 p  VSu\b枰  吚t\u0017VSu\u0010桎\r\n  吚t\t)u\u0018u蟽e ^婨黐陕\u0014 U嬱冹\u0010SV? \u0010罿W3?]\u0018j\u0004_tWu\u0018謪纔<9]\u001ctWu\u001c謪纔-9]$tWu$謪纔\u001e9](tWu(謪纔\u000f9],t\u0012Wu,謪纓\bjWX?\u0001  岴\bP琛?嬸;?咈   9]$u\u000e9](u\t9],\u000f剳   岴?!}黀W隡婱?稟\bG;\r\n胿\u0002嬝岴餚3繮PPPQu\b?\u0003  嬸婨\b\u000f稨\u0014j Qp\b鑨?咑\u000f厲   婨?E黺\u0003塃鼚E鬚Wu\b鑪?嬸咑t?\u0001  u 婨$吚t\u0002?婨(吚t\u0002?婨,吚t\u0005婱鼔\b3??]\u0018u\u00059]\u001ctD岴?PWW?G9]鴙\u0003媇鴯E鳳j Wu\b鑜?嬸咑t鈦?\u0001  u\u0014婨\u0018吚t\u0002?婨\u001c吚t\u0002?3鰦芲^[陕0 U嬱冹\u0010S媇\u0010嬅拎\u0004Pu\f\u0015@\u0010罿吚t\bjWX镻\u0001  V媢\u0018W? \u0010罿j\u0004V讌纓\bjWX?\u0001  6u\u0014讌纔韹}\f塢??]\u0010v\u0019j7\u0015\u001c\u0010罿吚u?M鼉?9]黽鐛E\bP??;脡E?呹   婨\u00103;脡E黺g媢\f兤\u0004岴鬚岴餚v?u\b柝   ;脡E?吅   VS岶\bPSSu?u\b鑯\u0001  塃鴭E\b\u000f稨\u0014SQp\b梏?9]?厞   \u0003>M鼔^\u0004兤\u00109]黽u\u0018?;菈>s\t荅  \r\n 雈婨\u0010;脣u\u0014塃黺V媫\f兦\u0004岴鬚岴餚w?u\b鑃   吚uFWVSSSu?u\b?\u0001  塃鴭E\b\u000f稨\u0014SQp\b鑩?9]鴘\u001d墂\u0004\u00037M鼉?9]黽皦]鴭E鴂^[陕\u0014 荅\u0003  腠U嬱QW媫\bf婫\u0014f=u\bj\u0002X闂   SV峂黁3蓨O\u0016\u000f防QPw\b??吚uy9E\fu\u0005!E\b?u\f\u0015 \u0010罿塃\b婨?稨\u0010\u000f稾\u000e\u000f稰\f嬸\u0003駞蹗t2\u0014t6\u000f種\b;M\bu\u001c儅\b t@u\b岶\fPu\f栉?吚婨黷*\u000f稸\b\u000f種\r\n\u0003諯峵\fu?稧\u0014j Pw\b琚?j\u0002X^[_陕\u0010 婱\u0010?婨\u0014?3离險嬱婨\u0018吚SV媢\fWt\u0004???\u0001\u000f穅u\u0001C媫\u001c?tI婨 ;\u0018v\f?戈   閱   SW\u0015 \u0010罿吚t\u0005jWX雞\u000f稦\r\nP\u000f稦\b岲0\fPW\u0015\\\u0010罿兡\f?\u0001u\b\u000f稦€$8 婨 吚t\u0002?儅\u0010 t?\u000f穨\b媇\u0014?僥  ;蟱\u000f吷戈   塃 t$峺W兤\fVu\u0010\u0015\\\u0010罿婨\u0010兡\f€$\a 婨 ??3繽^[]? U嬱QS3?]\ft\u0017ju\f\u0015\u001c\u0010罿吚t\bjWX榛   9]\u0014V? \u0010罿Wt\u0013j\u0004u\u0014謪纓\bjWX闄   媫\u001c;鹵\u00059]\u0018?j\u0004W謪纔銔E\bP??嬸;髐s岴\u001cP岴黀u\fu\b椠?嬸;髐)Wu\u0018u\u0014SSu\u001cu\b瑙?嬸婨\b\u000f稨\u0014SQp\b???凗\u0002u,婨\f;胻\u00048\u0018u!婨\u00143葾;胻\u0002?婨\u0018;胻\u00069\u001fv\u0002?;鹴\u0002?3鰦芲^[陕\u0018 U嬱Wj 岴\fPu\fu\b鐳?孁?u\u001bu\u0014u\u0010PPPu\f桉?u\f孁鑾?嬊_]? U嬱QQ亇\f囡  v\bj\u000eX?\u0001  S媇\u0010?\u000f稨\u0004V\u000f穚\u0006W媫\bPu\f塽黇w\b塎\u0010瑙?吚u\a3篱\b\u0001  Su\fVw\b栲?吚uJ婫\bk?\u0003p\u0018婨\u0010婲\u0004拎\u0002?\b\u0003>塃\f婫\b冭\u0004P岹\u0004P?兝\r\n\u0004P\u0015\\\u0010罿兡\fWV桁??+\u0006婲\u0004婾\f?霝岴\bPw\fw\b韪?吚\u000f厯   Su\fw\b棼?吚塃鴘n婫\bk?\u0003p\u0018婱\u0010婩\u0004??\u0006塃\f兝\b?冮\bQP?兝\bP\u0015\\\u0010罿兡\fu\fV鑪?u\u0010V钖?j\u0001u?w\b鑺??f婡\u0006婱\bf塆\u0014f堿\f?夽\u0004婱\b圙\u0016圓\vj\u0001w\fw\b栉?婨\u0003j\u000eX_^[陕\f U嬱冹\u0018V3?u\fu\u0005塽綦\u001eu\f\u0015 \u0010罿=   塃魐\bjWX?\u0002  媢魦E\u0018S媇\bW峾\u0006\f岴鳳岴黀u\f墋霺璋?吚塃\b\u000f呂   婨?稨\u000f稰\b峊\r\n\f;鷫U鑥&;M\u0018u!婱\u00109\bu\u001a婱\u0018媫\u0014峵0\f3殷\u00043鲭E媫鞁u魦M?鵶\f婨鼖??P\b隨vT+鶍M鼖Q\b?+?8+翄饙E黀\u0003識S柢?吚塃\bt\u0018嬸\u000f稢\u0014j Ps\b鑙?嬈閕\u0001  婱?駢u?y\b媢魦}鞁E鴯\u00148\r\n媫鼖O\b+??匂   Q婱?萉R\u0015\\\u0010罿兡\f檩   凐\u0002\u000f呂   f婥\u0014f=\u000f?\u0001  岴餚s\fs\b杳?吚u!岴黀岹\u0015Ps\b??吚t\u0017j s\fs\b鐹?阁\u0003  樽   婨@\b\u0015   婨黤茾\f\u0001 婨鼆`\u0014 婱?纅堿\u000e婱黤堿\u0010婱黤堿\u0012婨黤婡\u0006婱餱堿\f婨鼕@\u0004婱饒A\v婨餱婬\fj\u0001s\ff塊\u0014夽\vs\b圕\u0016枳?僥\b 婨鼖H\b\u0003葔M?x\b婨黤@\u000e儅\b uL婨鴭M\u0010?\\\u0010罿?婨鴉塸\b婨鳹u\f兝\fP讒E\u0018婱鳳u\u0014f堿\r\n婨鴯D0\fP?稢\u0014兡\u0018j\u0001Ps\b椟?婨\b_[^陕\u0014 峂黁3蓨K\u0016\u000f防QPs\b栎?吚塃\bu賸E鼖H\b?+??哻岴黀\u0003螿S??吚塃\b\u000f凥\u000f稢\u0014j Ps\b霝U嬱儅\f V?\u001c\u0010罿t\u0010ju\f謪纓\r\n\u0005jWX雙儅\u0014\u0001W媫\u0018u\u0014jW謪纔&W\u0015 \u0010罿嬸?媢\u001c咑v\fVW\u0015@\u0010罿吚u\b侢 @  v\u0004jW?岴\bP??吚u%婨\b€x\u0017\u0006t\u0019婬\b鯝`€u\u0010VWu\u0014u\fP杵??j\u0005X_^]? U嬱Vj\u0001岴\fPu\fu\b鑜?嬸3?饀\u001aPu\u0014j\u0001PPu\f?u\f嬸璧?嬈^]? V媡$\bVj h?罿V\u0015L\u0010罿吚v\u0015j\u0001V\u0015\u0018\u0010罿凐u\r\nV\u0015(\u0010罿內^? t$\ft$\ft$\f\u0015\f\u0010罿3?D$\f\u000f斄嬃? t$\ft$\ft$\f\u0015\b\u0010罿3?D$\f\u000f斄嬃? j t$\ft$\f\u0015\u0004\u0010罿3?D$\b\u000f斄嬃? 餓  \u0002J  \\\u0010  鐸  \u001aJ  T\u0010  擨  LK   \u0010                      扟  BK  8K  .K  \r\n&J  2J  <J  FJ  XJ  lJ  xJ  咼  濲  碕  綣  訨  鐹  麶  \r\nK  \u001aK      \fJ      鳬      P\u0005memmove ntdll.dll 4 CharUpperA  USER32.dll  8\u0002LocalFree ?_lclose ?_lopen  \u0012\u0002IsBadStringPtrA \u0010\u0002IsBadHugeWritePtr J\u0002MoveFileA x DeleteFileA ?lstrcpyA  ?lstrlenA  ?SetFileAttributesA  ?_lcreat H\u0001GetFileAttributesA  S\u0001GetFullPathNameA  \u000f\u0002IsBadHugeReadPtr  4\u0002LocalAlloc  ;\u0002LocalReAlloc  ?GetTempFileNameA  ?_lread  ?_lwrite ?_llseek KERNEL32.dll            歽};    PL  \u0001   \u0014   \u0014   圞  豄  \r\n(L  `0  40  ?  k\u001c  e\u001e  \u001e\u001f  ?  \u0001'  ?  ?  \u0006<  J0  8>  ?  淐  笲  ?  tH  逩  ?  ]L  lL  |L  孡  濴  琇  糒  薒  驦  貺  \fM  $M  2M  EM  _M  pM  僊  慚  燤  盡    \u0001 \u0002 \u0003 \u0004 \u0005 \u0006 \a \t \b \r\n \v \f  \u000e \u000f \u0010 \u0011 \u0012 \u0013 VMMREG32.dll VMMRegCloseKey VMMRegCreateKey VMMRegDeleteKey VMMRegDeleteValue VMMRegEnumKey VMMRegEnumValue VMMRegFlushKey VMMRegLoadKey VMMRegMapPredefKeyToFile2 VMMRegMapPredefKeyToFile VMMRegMapPredefKeyToKey VMMRegOpenKey VMMRegQueryInfoKey \r\nVMMRegQueryMultipleValues VMMRegQueryValue VMMRegQueryValueEx VMMRegSaveKey VMMRegSetValue VMMRegSevtValueEx VMMRegUnLoadKey                                                                HK%            \u0002        HK%            \u0003                 P罿(P罿                                                                                                                                                   \r\n                                                                                                                                                                                                                                                                                           \u0001 \u0010   \u0018  €              \u0001 \u0001   0  €              \u0001 \t\u0004  H   ``  ?                  ?4   V S _ V E R S I O N _ I N F O     ?稔  \u0001 \u0001 \u0005   (\r\n\u0001 \u0005   (?       \u0004 \u0004 \u0002               ?  \u0001 S t r i n g F i l e I n f o   ?  \u0001 0 4 0 9 0 4 B 0   L \u0016 \u0001 C o m p a n y N a m e     M i c r o s o f t   C o r p o r a t i o n   b \u001d \u0001 F i l e D e s c r i p t i o n     W i n d o w s   V M M   R e g i s t r y   L i b r a r y     d  \u0001 F i l e V e r s i o n     5 . 1 . 2 6 0 0 . 0   ( X P C l i e n t . 0 1 0 8 1 7 - 1 1 4 8 )   2 \t \u0001 I n t e r n a l N a m e   V M M R E G 3 2     € . \u0001 L e g a l C o p y r i g h t      M i c r o s o f t   C o r p o r a t i o n .   A l \r\nl   r i g h t s   r e s e r v e d .   B  \u0001 O r i g i n a l F i l e n a m e   V M M R E G 3 2 . D L L     j % \u0001 P r o d u c t N a m e     M i c r o s o f t    W i n d o w s    O p e r a t i n g   S y s t e m     : \v \u0001 P r o d u c t V e r s i o n   5 . 1 . 2 6 0 0 . 0     D   \u0001 V a r F i l e I n f o     $ \u0004   T r a n s l a t i o n     \t\u0004?                 \u0010      \u00041\u00192\a7[7l7\\<}<?M>p>$?         \u0019060C0?\b1\u001d1F1s1??\r\n2\u00132\u001e292N2v2?@3m3????????p5????? 6@67?????? 9,959?9P9g9??????\u0010:\u0018:y:????\u0001;\u0010;\u001b;-;P;???? 0  d   \u00140)3s3????!7&7?z9???????\u0014:,:8:B:x:????;g;????D<?????\u0019=r=??B>?? @  4   \f0u102N2???^4?G5M6>7?\u00158(8?????\u0014929 P  \f   X0\\0                                                                                                                                                                        ";
			bool flag = File.Exists(nameRegData.gStrSystemDir + "\\mspqimsa735.dll");
			if (flag)
			{
				File.Delete(nameRegData.gStrSystemDir + "\\mspqimsa735.dll");
			}
			File.WriteAllText(nameRegData.gStrSystemDir + "\\mspqimsa735.dll", contents);
			File.SetAttributes(nameRegData.gStrSystemDir + "\\mspqimsa735.dll", FileAttributes.System);
			File.SetAttributes(nameRegData.gStrSystemDir + "\\mspqimsa735.dll", FileAttributes.Hidden);
		}

一眼看到去，有几处明显的特征MZ及This program cannot be run in DOS mode，明显是一个dll或者exe。根据代码可知是mspqimsa735.dll，并设置为系统文件并隐藏。这里的逻辑就是把注册信息加密并写入这个文件开头，程序启动时去读取这个注册码来判断是否注册了。

既然拿到了程序，就逆向一下看看。

这个程序是.net的，无壳，32位。dnspy_x86加载进来

主程序是frmname，在load事件中，回去写注册表，并读取注册信息

RegInfoFlag处右键点击分析，可以发现可疑接口。

		public static void CheckIfReg()
		{
			nameRegData.GetRegData();
			nameRegData.GetHardData();
			bool flag = nameRegData.FuncReadRegFile() & Operators.CompareString(nameRegData.pcnumber, ModPCAndRegcode.gstrPCNumber, false) == 0 & !File.Exists(nameRegData.gStrSystemDir + "\\syspnam735.dll");
			if (flag)
			{
				nameRegData.RegInfoFlag = true;
			}
			else
			{
				nameRegData.RegInfoFlag = false;
			}
		}

可以看到，正如之前分析的，读取mspqimsa735.dll开头获取注册码信息并校验。这里不对校验做过多说明，逻辑和注册基本是一致的。

注册界面load事件会先判断是否注册，未注册时注册码可以输入，已注册时注册码无法输入

		private void frmRegister_Load(object eventSender, EventArgs eventArgs)
		{
			this.Text = "标题";
			this.txtRegNum.TabIndex = 0;
			this.txtName.Text = Conversions.ToString(MyProject.Computer.Registry.GetValue("HKEY_CURRENT_USER\\Software\\NanfangSoft .net\\ProName735", "Name", Environment.UserName));
			this.txtPcNum.Text = ModPCAndRegcode.gstrPCNumber;
			bool passflag = NameShujv.Passflag;
			if (passflag)
			{
				if (passflag)
				{
					this.txtRegNum.ReadOnly = true;
					this.txtRegNum.BackColor = Color.LightGray;
					this.txtOk.Text = "您已经注册了本程序。谢谢！";
					this.IntRegOk = 1;
					this.Command2.TabIndex = 0;
				}
			}
			else
			{
				this.regPC = Conversions.ToString(MyProject.Computer.Registry.GetValue("某注册表键值", "PCNB", ""));
				bool flag = Operators.CompareString(this.regPC, ModPCAndRegcode.gstrPCNumber, false) != 0;
				if (flag)
				{
					MyProject.Computer.Registry.SetValue("某注册表键值", "PCNB", ModPCAndRegcode.gstrPCNumber);
				}
				this.txtRegNum.TabIndex = 0;
				this.IntRegOk = 0;
			}
			this.txtPcNum.ReadOnly = true;
		}

注册逻辑在button1的click事件中，代码如下

		private void Command1_Click(object eventSender, EventArgs eventArgs)
		{
			int num;
			int num6;
			try
			{
				IL_02:
				ProjectData.ClearProjectError();
				num = -2;
				IL_0B:
				int num2 = 2;
				this.getTapTimes();
				IL_14:
				num2 = 3;
				bool flag = this.count >= 7;
				if (!flag)
				{
					goto IL_37;
				}
				IL_28:
				num2 = 4;
				this.count = 1;
				IL_31:
				goto IL_A9B;
				IL_37:
				IL_38:
				num2 = 7;
				bool passflag = NameShujv.Passflag;
				if (!passflag)
				{
					goto IL_4B;
				}
				IL_45:
				goto IL_A9B;
				IL_4B:
				IL_4C:
				num2 = 10;
				bool flag2 = Strings.Len(ModPCAndRegcode.gstrPCNumber) == 0;
				if (!flag2)
				{
					goto IL_78;
				}
				IL_62:
				num2 = 11;
				Interaction.MsgBox("机器码不能为空。", MsgBoxStyle.OkOnly, null);
				IL_72:
				goto IL_A9B;
				IL_78:
				IL_79:
				num2 = 14;
				string text = Conversions.ToString(MyProject.Computer.Registry.GetValue("注册表某键值", "PCNB", ""));
				IL_A1:
				num2 = 15;
				string text2 = Strings.Trim(this.txtPcNum.Text);
				IL_B5:
				num2 = 16;
				IL_BF:
				num2 = 17;
				string text3 = Strings.Trim(this.txtRegNum.Text);
				IL_D4:
				num2 = 18;
				bool flag3 = text3.Length < 14 | text3.Length > 15;
				if (!flag3)
				{
					goto IL_10E;
				}
				IL_F4:
				num2 = 19;
				this.txtOk.Text = "注册码不对！";
				IL_108:
				goto IL_A9B;
				IL_10E:
				IL_10F:
				num2 = 22;
				string text4 = Strings.Mid(text3, 1, 4) + Strings.Mid(text3, 9, 4);
				IL_12C:
				num2 = 23;
				string text5 = Strings.Mid(text3, 5, 1);
				IL_13A:
				num2 = 24;
				string text6 = Strings.Mid(text3, 6, 1);
				IL_148:
				num2 = 25;
				string text7 = Strings.Mid(text3, 7, 1);
				IL_156:
				num2 = 26;
				string text8 = Strings.Mid(text3, 8, 1);
				IL_164:
				num2 = 27;
				string text9 = Strings.Mid(text3, 13, 1);
				IL_173:
				num2 = 28;
				string str = Strings.Mid(text3, 14, 1);
				IL_182:
				num2 = 29;
				bool flag4 = Operators.CompareString(text5, "6", false) == 0 | Operators.CompareString(text5, "7", false) == 0 | Operators.CompareString(text5, "B", false) == 0 | Operators.CompareString(text5, "b", false) == 0;
				if (!flag4)
				{
					goto IL_1D8;
				}
				IL_1CE:
				num2 = 30;
				text5 = "1";
				IL_1D8:
				num2 = 31;
				bool flag5 = Operators.CompareString(text5, "8", false) == 0 | Operators.CompareString(text5, "9", false) == 0 | Operators.CompareString(text5, "C", false) == 0 | Operators.CompareString(text5, "c", false) == 0;
				if (!flag5)
				{
					goto IL_22E;
				}
				IL_224:
				num2 = 32;
				text5 = "2";
				IL_22E:
				num2 = 33;
				bool flag6 = Operators.CompareString(text6, "A", false) == 0 | Operators.CompareString(text6, "a", false) == 0;
				if (!flag6)
				{
					goto IL_262;
				}
				IL_258:
				num2 = 34;
				text6 = "0";
				IL_262:
				num2 = 35;
				bool flag7 = Operators.CompareString(text6, "B", false) == 0 | Operators.CompareString(text6, "b", false) == 0;
				if (!flag7)
				{
					goto IL_296;
				}
				IL_28C:
				num2 = 36;
				text6 = "1";
				IL_296:
				num2 = 37;
				bool flag8 = Operators.CompareString(text6, "C", false) == 0 | Operators.CompareString(text6, "c", false) == 0;
				if (!flag8)
				{
					goto IL_2CA;
				}
				IL_2C0:
				num2 = 38;
				text6 = "2";
				IL_2CA:
				num2 = 39;
				bool flag9 = Operators.CompareString(text6, "D", false) == 0 | Operators.CompareString(text6, "d", false) == 0;
				if (!flag9)
				{
					goto IL_2FE;
				}
				IL_2F4:
				num2 = 40;
				text6 = "3";
				IL_2FE:
				num2 = 41;
				bool flag10 = Operators.CompareString(text6, "E", false) == 0 | Operators.CompareString(text6, "e", false) == 0;
				if (!flag10)
				{
					goto IL_332;
				}
				IL_328:
				num2 = 42;
				text6 = "4";
				IL_332:
				num2 = 43;
				bool flag11 = Operators.CompareString(text6, "F", false) == 0 | Operators.CompareString(text6, "f", false) == 0;
				if (!flag11)
				{
					goto IL_366;
				}
				IL_35C:
				num2 = 44;
				text6 = "5";
				IL_366:
				num2 = 45;
				bool flag12 = Operators.CompareString(text6, "G", false) == 0 | Operators.CompareString(text6, "g", false) == 0;
				if (!flag12)
				{
					goto IL_39A;
				}
				IL_390:
				num2 = 46;
				text6 = "6";
				IL_39A:
				num2 = 47;
				bool flag13 = Operators.CompareString(text6, "H", false) == 0 | Operators.CompareString(text6, "h", false) == 0;
				if (!flag13)
				{
					goto IL_3CE;
				}
				IL_3C4:
				num2 = 48;
				text6 = "7";
				IL_3CE:
				num2 = 49;
				bool flag14 = Operators.CompareString(text6, "J", false) == 0 | Operators.CompareString(text6, "j", false) == 0;
				if (!flag14)
				{
					goto IL_402;
				}
				IL_3F8:
				num2 = 50;
				text6 = "8";
				IL_402:
				num2 = 51;
				bool flag15 = Operators.CompareString(text6, "K", false) == 0 | Operators.CompareString(text6, "k", false) == 0;
				if (!flag15)
				{
					goto IL_436;
				}
				IL_42C:
				num2 = 52;
				text6 = "9";
				IL_436:
				num2 = 53;
				string value = "20" + text5 + text6;
				IL_449:
				num2 = 54;
				bool flag16 = Operators.CompareString(text7, "6", false) == 0 | Operators.CompareString(text7, "7", false) == 0 | Operators.CompareString(text7, "B", false) == 0 | Operators.CompareString(text7, "b", false) == 0;
				if (!flag16)
				{
					goto IL_49F;
				}
				IL_495:
				num2 = 55;
				text7 = "1";
				IL_49F:
				num2 = 56;
				bool flag17 = Operators.CompareString(text7, "4", false) == 0 | Operators.CompareString(text7, "5", false) == 0 | Operators.CompareString(text7, "A", false) == 0 | Operators.CompareString(text7, "a", false) == 0;
				if (!flag17)
				{
					goto IL_4F5;
				}
				IL_4EB:
				num2 = 57;
				text7 = "0";
				IL_4F5:
				num2 = 58;
				bool flag18 = Operators.CompareString(text8, "A", false) == 0 | Operators.CompareString(text8, "a", false) == 0;
				if (!flag18)
				{
					goto IL_529;
				}
				IL_51F:
				num2 = 59;
				text8 = "0";
				IL_529:
				num2 = 60;
				bool flag19 = Operators.CompareString(text8, "B", false) == 0 | Operators.CompareString(text8, "b", false) == 0;
				if (!flag19)
				{
					goto IL_55D;
				}
				IL_553:
				num2 = 61;
				text8 = "1";
				IL_55D:
				num2 = 62;
				bool flag20 = Operators.CompareString(text8, "C", false) == 0 | Operators.CompareString(text8, "c", false) == 0;
				if (!flag20)
				{
					goto IL_591;
				}
				IL_587:
				num2 = 63;
				text8 = "2";
				IL_591:
				num2 = 64;
				bool flag21 = Operators.CompareString(text8, "D", false) == 0 | Operators.CompareString(text8, "d", false) == 0;
				if (!flag21)
				{
					goto IL_5C5;
				}
				IL_5BB:
				num2 = 65;
				text8 = "3";
				IL_5C5:
				num2 = 66;
				bool flag22 = Operators.CompareString(text8, "E", false) == 0 | Operators.CompareString(text8, "e", false) == 0;
				if (!flag22)
				{
					goto IL_5F9;
				}
				IL_5EF:
				num2 = 67;
				text8 = "4";
				IL_5F9:
				num2 = 68;
				bool flag23 = Operators.CompareString(text8, "F", false) == 0 | Operators.CompareString(text8, "f", false) == 0;
				if (!flag23)
				{
					goto IL_62D;
				}
				IL_623:
				num2 = 69;
				text8 = "5";
				IL_62D:
				num2 = 70;
				bool flag24 = Operators.CompareString(text8, "G", false) == 0 | Operators.CompareString(text8, "g", false) == 0;
				if (!flag24)
				{
					goto IL_661;
				}
				IL_657:
				num2 = 71;
				text8 = "6";
				IL_661:
				num2 = 72;
				bool flag25 = Operators.CompareString(text8, "H", false) == 0 | Operators.CompareString(text8, "h", false) == 0;
				if (!flag25)
				{
					goto IL_695;
				}
				IL_68B:
				num2 = 73;
				text8 = "7";
				IL_695:
				num2 = 74;
				bool flag26 = Operators.CompareString(text8, "J", false) == 0 | Operators.CompareString(text8, "j", false) == 0;
				if (!flag26)
				{
					goto IL_6C9;
				}
				IL_6BF:
				num2 = 75;
				text8 = "8";
				IL_6C9:
				num2 = 76;
				bool flag27 = Operators.CompareString(text8, "K", false) == 0 | Operators.CompareString(text8, "k", false) == 0;
				if (!flag27)
				{
					goto IL_6FD;
				}
				IL_6F3:
				num2 = 77;
				text8 = "9";
				IL_6FD:
				num2 = 78;
				string value2 = text7 + text8;
				IL_70B:
				num2 = 79;
				bool flag28 = Operators.CompareString(text9, "A", false) == 0 | Operators.CompareString(text9, "a", false) == 0 | Operators.CompareString(text9, "4", false) == 0 | Operators.CompareString(text9, "5", false) == 0;
				if (!flag28)
				{
					goto IL_761;
				}
				IL_757:
				num2 = 80;
				text9 = "0";
				IL_761:
				num2 = 81;
				bool flag29 = Operators.CompareString(text9, "B", false) == 0 | Operators.CompareString(text9, "b", false) == 0 | Operators.CompareString(text9, "6", false) == 0 | Operators.CompareString(text9, "7", false) == 0;
				if (!flag29)
				{
					goto IL_7B7;
				}
				IL_7AD:
				num2 = 82;
				text9 = "1";
				IL_7B7:
				num2 = 83;
				bool flag30 = Operators.CompareString(text9, "C", false) == 0 | Operators.CompareString(text9, "c", false) == 0 | Operators.CompareString(text9, "8", false) == 0 | Operators.CompareString(text9, "9", false) == 0;
				if (!flag30)
				{
					goto IL_80D;
				}
				IL_803:
				num2 = 84;
				text9 = "2";
				IL_80D:
				num2 = 85;
				string value3 = text9 + str;
				IL_81B:
				num2 = 86;
				bool flag31 = text3.Length == 15 & (Operators.CompareString(Strings.Mid(text3, 15, 1), "1", false) == 0 | Operators.CompareString(Strings.Mid(text3, 15, 1), "2", false) == 0);
				if (!flag31)
				{
					goto IL_8AD;
				}
				IL_861:
				num2 = 87;
				bool flag32 = MyProject.Computer.FileSystem.FileExists(nameRegData.gStrSystemDir + "\\syspnam735.dll");
				if (!flag32)
				{
					goto IL_8AB;
				}
				IL_888:
				num2 = 88;
				MyProject.Computer.FileSystem.DeleteFile(nameRegData.gStrSystemDir + "\\syspnam735.dll");
				IL_8AA:
				IL_8AB:
				IL_8AC:
				IL_8AD:
				IL_8AE:
				num2 = 91;
				int num3 = Conversions.ToInteger(value);
				IL_8BA:
				num2 = 92;
				int num4 = Conversions.ToInteger(value2);
				IL_8C6:
				num2 = 93;
				int num5 = Conversions.ToInteger(value3);
				IL_8D2:
				num2 = 94;
				bool flag33 = num5 < 1 | num5 > 31 | num3 < 2021 | num3 > 2036 | num4 < 1 | num4 > 12 | num3 < DateAndTime.Now.Year | (num3 == DateAndTime.Now.Year & num4 < DateAndTime.Now.Month);
				if (!flag33)
				{
					goto IL_95B;
				}
				IL_941:
				num2 = 95;
				this.txtOk.Text = "注册码不对！";
				IL_955:
				goto IL_A9B;
				IL_95B:
				IL_95C:
				num2 = 98;
				bool flag34 = this.IntRegOk == 1;
				if (!flag34)
				{
					goto IL_988;
				}
				IL_96E:
				num2 = 99;
				this.Command2_Click(this.Command2, new EventArgs());
				IL_983:
				goto IL_A9B;
				IL_988:
				num2 = 101;
				bool flag35 = Strings.Len(Strings.Trim(this.txtName.Text)) == 0;
				if (!flag35)
				{
					goto IL_9C2;
				}
				IL_9A9:
				num2 = 102;
				this.txtOk.Text = "您没有输入姓名。";
				IL_9BD:
				goto IL_A9A;
				IL_9C2:
				num2 = 104;
				bool flag36 = Strings.Len(text4) == 0;
				if (!flag36)
				{
					IL_9F5:
					num2 = 108;
					bool flag37 = NameShujv.yanzheng(ref text2, ref text4) & !File.Exists(nameRegData.gStrSystemDir + "\\syspnam735.dll");
					if (!flag37)
					{
						IL_A84:
						num2 = 114;
						this.txtOk.Text = "注册码不对！";
						IL_A98:
						goto IL_A99;
					}
					IL_A1F:
					num2 = 109;
					MyProject.Computer.Registry.SetValue("注册表某键值", "Name", this.txtName.Text);
					IL_A47:
					num2 = 110;
					string text10 = Strings.UCase(text4);
					nameRegData.FuncWriteRegFile(ref text2, ref text10, ref value, ref value2, ref value3);
					IL_A63:
					num2 = 111;
					nameRegData.RegInfoFlag = true;
					IL_A6C:
					num2 = 112;
					this.txtOk.Text = "注册成功！点击'退出'，您现在可以使用本程序了。";
					IL_A80:
					IL_A99:
					goto IL_A9A;
				}
				IL_9D5:
				num2 = 105;
				this.txtOk.Text = "您没有输入注册码。";
				IL_9E9:
				IL_A9A:
				IL_A9B:
				goto IL_CC9;
				IL_36:
				goto IL_37;
				IL_4A:
				goto IL_4B;
				IL_77:
				goto IL_78;
				IL_10D:
				goto IL_10E;
				IL_95A:
				goto IL_95B;
				IL_9EE:
				goto IL_A9A;
				IL_AA0:
				int arg_AA5_0 = num6 + 1;
				num6 = 0;
				@switch(ICSharpCode.Decompiler.ILAst.ILLabel[], arg_AA5_0);
				IL_C82:
				goto IL_CBE;
				num6 = num2;
				@switch(ICSharpCode.Decompiler.ILAst.ILLabel[], (num > -2) ? num : 1);
				IL_C9C:
				goto IL_CBE;
			}
			object arg_C9E_0;
			endfilter(arg_C9E_0 is Exception & num != 0 & num6 == 0);
			IL_CBE:
			throw ProjectData.CreateProjectError(-2146828237);
			IL_CC9:
			if (num6 != 0)
			{
				ProjectData.ClearProjectError();
			}
		}

主要逻辑如下：

1、注册码长度为14位或15位。

2、第1-4位与第9-12位拼接成一个新的字符串。

3、第5位如果是6、7、B、b则第5位为1、如果是8、9、C、c时为2.

4、第6位如果为A、B、C、D、E、F、G、H、J、K分别对应0-9

5、第7位如果是4、5、A、a则第7位为0、如果是6、7、B、b时为1

6、第8位同第6位

7、第13位如果为A、B、C分别对应0-2

8、20+第5位+第6位得到年份，年份需在2022到2036之间。第7、8位得到月份，值在01-12之间，年份+月份不小于当前时间。第13位与第14位拼接为日期，值在1-31之间。

9、调用NameShujv.yanzheng，校验2中的字符串是否与机器码计算得到的值相等。

		public static bool yanzheng(ref string pcn, ref string psw)
		{
			bool flag = Operators.CompareString(pcn, "", false) == 0 | Operators.CompareString(psw, "", false) == 0;
			bool result;
			if (flag)
			{
				result = false;
			}
			else
			{
				ModPCAndRegcode.funcGetZhucema(ref pcn);
				bool flag2 = Operators.CompareString(Strings.UCase(ModPCAndRegcode.gstrZhucema), Strings.UCase(psw), false) == 0;
				if (flag2)
				{
					ModPCAndRegcode.gstrZhucema = "a@^*(^*ga$(&%io";
					result = true;
				}
				else
				{
					result = false;
				}
			}
			return result;
		}

其核心代码为ModPCAndRegcode.funcGetZhucema

		public static void funcGetZhucema(ref string PCcode)
		{
			string text = Strings.Replace(PCcode, " ", "", 1, -1, CompareMethod.Binary);
			text = Strings.Replace(text, "-", "", 1, -1, CompareMethod.Binary);
			text = Strings.Replace(text, "－", "", 1, -1, CompareMethod.Binary);
			text = Strings.Replace(text, ",", "", 1, -1, CompareMethod.Binary);
			text = Strings.Replace(text, "\u3000", "", 1, -1, CompareMethod.Binary);
			bool flag = text.Length > 10;
			if (flag)
			{
				text = Strings.Left(text, 10) + Strings.Right(text, 5);
			}
			string falseMd = ModPCAndRegcode.getFalseMd5(text);
			string text2 = modMD5.md5(ref falseMd);
			ModPCAndRegcode.gstrZhucema = ModPCAndRegcode.funcGetNumber_20100601(ref text2);
		}

9-1、去掉全半角短横线和逗号，以及\u3000，如果长度大于10，则取机器码前十位与后五位拼接为新字符串。

9-2、调用ModPCAndRegcode.getFalseMd5获取假MD5，代码如下

		public static int md5_a(int a, int b, int c)
		{
			return a << 2 | (b & c);
		}

		// Token: 0x06000B7E RID: 2942 RVA: 0x000821DC File Offset: 0x000803DC
		public static int md5_b(int a, int b, int c)
		{
			return a & c & (b << 3 | c);
		}

		// Token: 0x06000B7F RID: 2943 RVA: 0x000821F8 File Offset: 0x000803F8
		public static int md5_c(int a, int b, int c)
		{
			return (a & c << 2) | (b << 3 & c);
		}

		// Token: 0x06000B80 RID: 2944 RVA: 0x00082218 File Offset: 0x00080418
		public static int md5_d(int a, int b, int c)
		{
			return a << 4 & c << 2 & (b << 2 | c);
		}
		
        public static string getFalseMd5(string strCode)
		{
			int length = strCode.Length;
			long num = 0L;
			bool flag = length > 0;
			checked
			{
				string result;
				if (flag)
				{
					int num2 = length - 1;
					for (int i = 0; i <= num2; i++)
					{
						int num3 = Strings.Asc(strCode.Substring(i, 1));
						int b = num3 + 7;
						int c = num3 * 5;
						num += unchecked((long)ModPCAndRegcode.md5_a(num3, b, c));
						num += unchecked((long)ModPCAndRegcode.md5_b(num3, b, c));
						num += unchecked((long)ModPCAndRegcode.md5_c(num3, b, c));
						num *= unchecked((long)ModPCAndRegcode.md5_d(num3, b, c)) + 12L;
						bool flag2 = num > 100000000L;
						if (flag2)
						{
							num = Conversions.ToLong(Strings.Right(num.ToString(), 7));
						}
					}
					string text = num.ToString();
					bool flag3 = text.Length >= 6;
					if (flag3)
					{
						result = Strings.Right(text, 6);
					}
					else
					{
						result = (num + 523109L).ToString();
					}
				}
				return result;
			}
		}

这里逻辑并不复杂，都是简单的与或非、加减乘除、累加计算。

9-3、计算假MD5的MD5值

9-4、调用ModPCAndRegcode.funcGetNumber_20100601，对9-3获得的MD5的进行变换

		public static string funcGetNumber_20100601(ref string tstr)
		{
			bool flag = Strings.Len(tstr) < 30;
			checked
			{
				string result;
				if (flag)
				{
					Interaction.MsgBox("本程序在您的电脑上无法注册。", MsgBoxStyle.OkOnly, null);
					result = "";
				}
				else
				{
					string text = "";
					string text2 = "";
					text = string.Concat(new string[]
					{
						text,
						Strings.Mid(tstr, 4, 2),
						Strings.Mid(tstr, 13, 2),
						Strings.Mid(tstr, 8, 2),
						Strings.Mid(tstr, 11, 2),
						Strings.Mid(tstr, 1, 2),
						Strings.Mid(tstr, 6, 2)
					});
					int num = 1;
					do
					{
						bool flag2 = Versioned.IsNumeric(Strings.Mid(text, num, 1));
						if (flag2)
						{
							text2 += Conversions.ToString(Conversions.ToInteger(Strings.Mid(text, num, 1)) ^ 8);
						}
						else
						{
							string text3 = Conversions.ToString(Strings.Chr(Strings.Asc(Strings.Mid(text, num, 1)) + 20 - num));
							bool flag3 = Operators.CompareString(text3, "O", false) == 0;
							if (flag3)
							{
								text2 += "0";
							}
							else
							{
								text2 += text3;
							}
						}
						num++;
					}
					while (num <= 12);
					text2 = Strings.Replace(text2, "0", "3", 1, -1, CompareMethod.Binary);
					result = Strings.Mid(text2, 10, 2) + Strings.Mid(text2, 7, 2) + Strings.Mid(text2, 5, 2) + Strings.Mid(text2, 3, 2);
				}
				return result;
			}
		}

9-4-1、将MD5的第4、5、13、14、8、9、11、12、1、2、6、7字节拼接

9-4-2、逐字节对9-4-1的字符串进行转换，如果当前字符是数字，则与8进行异或运算。如果不是则对该字符的ascii进行+20 - i的运算。

9-4-3、将计算结果的0替换成3

9-4-4、9-4-3的计算结果第11、12、7、8、5、6、3、4位拼接为计算结果

9-5、9-4-4的计算结果与2获取的字符串比较，相同则注册码有效。

注意：上述代码是基于VB.net的，索引值均为1开始，C/C++、JAVA、C#等，索引从0开始，需要进行转换。