AcProtect 1.41 外壳分析[63]

<try way> ; 如果为0则表示没有注册提示 005901cb 80bd 6df74000 0>cmp byte ptr ss:[ebp+40f76d],0 ; 如果为0则表示过期了 005901d2 0f85 8a000000 jnz <try way> 005901d8 > 6a 00 push 0 ; game over 005901da e8 08000000 call <sub_show_expired_msg> ; 过期提示信息 005901df 45 inc ebp 005901e0 78 70 js short 00590252 005901e2 6972 65 64008db>imul esi,dword ptr ds:[edx+65],b58d0064 005901e9 91 xchg eax,ecx 005901ea d240 00 rol byte ptr ds:[eax],cl 005901ed 56 push esi ......... 00590262 > 60 pushad ; 加密代码 00590263 e8 00000000 call 00590268 00590268 5e pop esi 00590269 83ee 06 sub esi,6 0059026c b9 a9000000 mov ecx,0a9 00590271 29ce sub esi,ecx 00590273 ba d244e9ae mov edx,aee944d2 00590278 c1e9 02 shr ecx,2 0059027b 83e9 02 sub ecx,2 0059027e 83f9 00 cmp ecx,0 00590281 7c 1a jl short 0059029d 00590283 8b048e mov eax,dword ptr ds:[esi+ecx*4] 00590286 8b5c8e 04 mov ebx,dword ptr ds:[esi+ecx*4+4] 0059028a 33c3 xor eax,ebx 0059028c c1c0 05 rol eax,5 0059028f 33c2 xor eax,edx 00590291 81f2 5d121221 xor edx,2112125d 00590297 89048e mov dword ptr ds:[esi+ecx*4],eax 0059029a 49 dec ecx 0059029b ^ eb e1 jmp short 0059027e 0059029d 61 popad 0059029e 61 popad 0059029f c3 retn sub_antidebug: 0058d9ec > 60 pushad ; anti_debug 0058d9ed e8 01000000 call 0058d9f3 0058d9f2 9a 83042406 c37>call far 71c3:06240483 ; far call 0058d9f9 05 b8eb51f3 add eax,f351ebb8 0058d9fe 46 inc esi 0058d9ff 74 03 je short 0058da04 ...... 0058db97 e8 64e5ffff call <sub_getebp >
0058db9c e8 2b050000 call <eax=0 do something> 0058dba1 0bc0 or eax,eax 0058dba3 75 50 jnz short <safe way> 0058dba5 90 nop 0058dba6 90 nop 0058dba7 90 nop 0058dba8 90 nop 0058dba9 c685 ec294100 c>mov byte ptr ss:[ebp+4129ec],0c3 0058dbb0 8cc8 mov ax,cs 0058dbb2 a8 04 test al,4 0058dbb4 75 1a jnz short <os is win9x> ; 如 果不是nt系统则跳 0058dbb6 90 nop 0058dbb7 90 nop 0058dbb8 90 nop 0058dbb9 90 nop 0058dbba 64:67:a1 3000 mov eax,dword ptr fs:[30] ; isdebuggerpresent 检测ring3级调试器 0058dbbf 0fb640 02 movzx eax,byte ptr ds:[