halIfax
Re: Completely beyond help :)
Fri Nov 13 17:29:57 1998


The reg code call is at

:0045C02D E8E6F8FFFF call 0045B918

If you follow 45b918 to 45b9c4 (in W32Dasm), you will come across the XORs

:0045B99E 81F389000000 xor ebx, 00000089 <-- XOR sum with 89
:0045B9A4 83F333 xor ebx, 00000033 <-- XOR new sum with 33
:0045B9A7 43 inc ebx <-- add 1 to sum
:0045B9A8 8D55F8 lea edx, dword ptr [ebp-08]
:0045B9AB 8B8610020000 mov eax, dword ptr [esi+00000210]
:0045B9B1 E8D23FFCFF call 0041F988
:0045B9B6 8B45F8 mov eax, dword ptr [ebp-08]
:0045B9B9 E876BAFAFF call 00407434
:0045B9BE 3BD8 cmp ebx, eax <-- ebx is name hex sum, eax is regcode in hex
:0045B9C0 7504 jne 0045B9C6 <-- if diferent, bye cracker
:0045B9C2 B301 mov bl, 01 <-- otherwise, reg this babe
:0045B9C4 EB02 jmp 0045B9C8