��CHMUnpacker!! (14ǧ��) �㷨�� -pc6��Ѷ

��λ�ã��ҳ��ƽ�� CHMUnpacker!! (14ǧ��) �㷨��

��CHMUnpacker!! (14ǧ��) �㷨�� ʱ�䣺2004/10/15 0:55:00��Դ��վ��ߣ����Ҫ��(0): ��

�� CHMUnpacker ��汾 1.3��
�� Ȩ��ʽ ��
Ӧ��ƽ̨ WIN9X/WINNT/WIN2K/WINXP��
�� Ƿ�ѩ �� ϴ�� 2002-3-8 ��
http://www.hanzify.org/download.asp?SOFT_ID=4228&SITE=1��
Ŀ�꣺��ע��
��ߣ�ultraedit, pw32dasm8.93
�Ѷ�: �� ߣ�zyw[BCG]
--------------------------------------------------------------
��
�� CHMUnpacker [CHM��]��һ��԰��CHM�ļ��ļ��CHM��.
CHMUnpacker [CHM��]�ܹ��ѱ��Windows��ļ�(*.chm)��κ��
��ļ�.��ZIP�ļ�һ��CHM,��CHM�е��ļ��WinZipһ��
չ��.��ͨ��˫��ļ��鿴HTML�ı��ͼƬ.��ZIP�ļ�һ��ʹ��CHM�ļ�,
��֪��һ��? �˰汾��1.3�ĺ��汾.
��pw32dasm8.93��CHMUnpacker.exe
........

* Possible Reference to Dialog: DialogID_008F, CONTROL_ID:03F1, ""
|
:00405A79 68F1030000 push 000003F1
:00405A7E E8D0CC0100 call 00422753
:00405A83 8D4C2408 lea ecx, dword ptr [esp+08]
:00405A87 51 push ecx
* Possible Reference to Dialog: DialogID_0067, CONTROL_ID:03E9, "/��>:��/(&S)"
|
:00405A88 68E9030000 push 000003E9
:00405A8D 8BCE mov ecx, esi
:00405A8F E8BFCC0100 call 00422753
:00405A94 8B54240C mov edx, dword ptr [esp+0C]
:00405A98 6850CA4400 push 0044CA50
:00405A9D 52 push edx
:00405A9E E883910000 call 0040EC26
:00405AA3 83C408 add esp, 00000008
:00405AA6 85C0 test eax, eax
:00405AA8 750C jne 00405AB6
:00405AAA 53 push ebx
:00405AAB 53 push ebx
* Possible StringData Ref from Data Obj ->"�û��ǿհ׵�!"
|
:00405AAC 6854A64400 push 0044A654
:00405AB1 E93B010000 jmp 00405BF1
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405AA8(C)
|
:00405AB6 8B442408 mov eax, dword ptr [esp+08]
:00405ABA 6850CA4400 push 0044CA50
:00405ABF 50 push eax
:00405AC0 E861910000 call 0040EC26
:00405AC5 83C408 add esp, 00000008
:00405AC8 85C0 test eax, eax
:00405ACA 750C jne 00405AD8
:00405ACC 53 push ebx
:00405ACD 53 push ebx
* Possible StringData Ref from Data Obj ->"ע��Կ�ǿհ׵�!"
|
:00405ACE 683CA64400 push 0044A63C
:00405AD3 E919010000 jmp 00405BF1
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405ACA(C)
|
* Possible StringData Ref from Data Obj ->" "
|
:00405AD8 6838A64400 push 0044A638
:00405ADD 8D4C240C lea ecx, dword ptr [esp+0C]
:00405AE1 E8EC6F0100 call 0041CAD2
* Possible StringData Ref from Data Obj ->" "
|
:00405AE6 6838A64400 push 0044A638
:00405AEB 8D4C240C lea ecx, dword ptr [esp+0C]
:00405AEF E83F6F0100 call 0041CA33
:00405AF4 8B442408 mov eax, dword ptr [esp+08]
:00405AF8 8378F810 cmp dword ptr [eax-08], 00000010
:00405AFC 740C je 00405B0A
:00405AFE 53 push ebx
:00405AFF 53 push ebx
* Possible StringData Ref from Data Obj ->"ע��Կ�Ǵ��!"
|
:00405B00 6820A64400 push 0044A620
:00405B05 E9E7000000 jmp 00405BF1
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405AFC(C)
|
* Possible StringData Ref from Data Obj ->"eLRYdMs7IhHiObJg"
|
:00405B0A 680CA64400 push 0044A60C
:00405B0F 50 push eax
:00405B10 E811910000 call 0040EC26
:00405B15 83C408 add esp, 00000008
:00405B18 85C0 test eax, eax
:00405B1A 0F84CA000000 je 00405BEA
:00405B20 8B4C2408 mov ecx, dword ptr [esp+08]
* Possible StringData Ref from Data Obj ->"FkZQYRjGoBNcgJVU"
|
:00405B24 68F8A54400 push 0044A5F8
:00405B29 51 push ecx
:00405B2A E8F7900000 call 0040EC26
:00405B2F 83C408 add esp, 00000008
:00405B32 85C0 test eax, eax
:00405B34 0F84B0000000 je 00405BEA
:00405B3A 8D542410 lea edx, dword ptr [esp+10]
:00405B3E 57 push edi
:00405B3F 52 push edx
* Possible StringData Ref from Data Obj ->"Software\YBSoft\CHMUnpacker"
|
:00405B40 68DCA54400 push 0044A5DC
:00405B45 6802000080 push 80000002
* Reference To: ADVAPI32.RegCreateKeyA, Ord:015Eh
|
:00405B4A FF1518B04300 Call dword ptr [0043B018]
:00405B50 8B44240C mov eax, dword ptr [esp+0C]
:00405B54 8D4C240C lea ecx, dword ptr [esp+0C]
:00405B58 8B40F8 mov eax, dword ptr [eax-08]
:00405B5B 50 push eax
:00405B5C 6A01 push 00000001
:00405B5E E85DA10100 call 0041FCC0
:00405B63 8B4C2418 mov ecx, dword ptr [esp+18]
* Reference To: ADVAPI32.RegSetValueExA, Ord:0186h
|
:00405B67 8B3D14B04300 mov edi, dword ptr [0043B014]
:00405B6D 50 push eax
:00405B6E 6A01 push 00000001
:00405B70 53 push ebx
* Possible StringData Ref from Data Obj ->"�汾"
|
:00405B71 68D0A24400 push 0044A2D0
:00405B76 51 push ecx
:00405B77 FFD7 call edi
:00405B79 8B542410 mov edx, dword ptr [esp+10]
:00405B7D 8D4C2410 lea ecx, dword ptr [esp+10]
:00405B81 8B42F8 mov eax, dword ptr [edx-08]
:00405B84 50 push eax
:00405B85 6A01 push 00000001
:00405B87 E834A10100 call 0041FCC0
:00405B8C 50 push eax
:00405B8D 8B44241C mov eax, dword ptr [esp+1C]
:00405B91 6A01 push 00000001
:00405B93 53 push ebx
* Possible StringData Ref from Data Obj ->"�û�"
|
:00405B94 68D4A54400 push 0044A5D4
:00405B99 50 push eax
:00405B9A FFD7 call edi
:00405B9C 8B4C2414 mov ecx, dword ptr [esp+14]
:00405BA0 51 push ecx
* Reference To: ADVAPI32.RegCloseKey, Ord:015Bh
|
:00405BA1 FF1508B04300 Call dword ptr [0043B008]
:00405BA7 8BCE mov ecx, esi
:00405BA9 E8D1AA0100 call 0042067F
:00405BAE 53 push ebx
:00405BAF 53 push ebx
* Possible StringData Ref from Data Obj ->"��л��ע��.
CHMUnpacker��ٴ�ʹ��ʱ��?
->"�ע��?"
|
:00405BB0 6878A54400 push 0044A578
:00405BB5 E8C73B0200 call 00429781
:00405BBA 8D4C240C lea ecx, dword ptr [esp+0C]
:00405BBE 885C2420 mov byte ptr [esp+20], bl
:00405BC2 E8C99C0100 call 0041F890
:00405BC7 8D4C2410 lea ecx, dword ptr [esp+10]
:00405BCB C7442420FFFFFFFF mov [esp+20], FFFFFFFF
:00405BD3 E8B89C0100 call 0041F890
:00405BD8 5F pop edi
:00405BD9 5E pop esi
:00405BDA 5B pop ebx
:00405BDB 8B4C240C mov ecx, dword ptr [esp+0C]
:00405BDF 64890D00000000 mov dword ptr fs:[00000000], ecx
:00405BE6 83C418 add esp, 00000018
:00405BE9 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405B1A(C), :00405B34(C)
|
:00405BEA 53 push ebx
:00405BEB 53 push ebx
* Possible StringData Ref from Data Obj ->"�Բ��,��һ��ƽ��ע��!"
|
:00405BEC 6854A54400 push 0044A554

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405AB1(U), :00405AD3(U), :00405B05(U)
|
:00405BF1 E88B3B0200 call 00429781
:00405BF6 8D4C2408 lea ecx, dword ptr [esp+08]
:00405BFA 885C241C mov byte ptr [esp+1C], bl
:00405BFE E88D9C0100 call 0041F890
:00405C03 8D4C240C lea ecx, dword ptr [esp+0C]
:00405C07 C744241CFFFFFFFF mov [esp+1C], FFFFFFFF
:00405C0F E87C9C0100 call 0041F890
:00405C14 8B4C2414 mov ecx, dword ptr [esp+14]
:00405C18 5E pop esi
:00405C19 5B pop ebx
:00405C1A 64890D00000000 mov dword ptr fs:[00000000], ecx
:00405C21 83C418 add esp, 00000018
:00405C24 C3 ret
.........
* Referenced by a CALL at Address:
|:0040232D
|
:00405C30 81EC0C010000 sub esp, 0000010C
:00405C36 8D442404 lea eax, dword ptr [esp+04]
:00405C3A 56 push esi
:00405C3B 50 push eax
* Possible StringData Ref from Data Obj ->"SOFTWARE\YBSoft\CHMUnpacker"
|
:00405C3C 68D8A24400 push 0044A2D8
:00405C41 6802000080 push 80000002
:00405C46 C744241000000000 mov [esp+10], 00000000
* Reference To: ADVAPI32.RegOpenKeyA, Ord:0171h
|
:00405C4E FF1510B04300 Call dword ptr [0043B010]
:00405C54 85C0 test eax, eax
:00405C56 741D je 00405C75
:00405C58 8BB42414010000 mov esi, dword ptr [esp+00000114]
* Possible StringData Ref from Data Obj ->"δע��"
|
:00405C5F 6868A64400 push 0044A668
:00405C64 8BCE mov ecx, esi
:00405C66 E8939C0100 call 0041F8FE
:00405C6B 8BC6 mov eax, esi
:00405C6D 5E pop esi
:00405C6E 81C40C010000 add esp, 0000010C
:00405C74 C3 ret
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405C56(C)
|
:00405C75 8D4C2404 lea ecx, dword ptr [esp+04]
:00405C79 8D542410 lea edx, dword ptr [esp+10]
:00405C7D 51 push ecx
:00405C7E 8B4C240C mov ecx, dword ptr [esp+0C]
:00405C82 8D442410 lea eax, dword ptr [esp+10]
:00405C86 52 push edx
:00405C87 50 push eax
:00405C88 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"�û�"
|
:00405C8A 68D4A54400 push 0044A5D4
:00405C8F 51 push ecx
:00405C90 C744241CFF000000 mov [esp+1C], 000000FF
* Reference To: ADVAPI32.RegQueryValueExA, Ord:017Bh
|
:00405C98 FF150CB04300 Call dword ptr [0043B00C]
:00405C9E 85C0 test eax, eax
:00405CA0 741D je 00405CBF
:00405CA2 8BB42414010000 mov esi, dword ptr [esp+00000114]
* Possible StringData Ref from Data Obj ->"δע��"
|
:00405CA9 6868A64400 push 0044A668
:00405CAE 8BCE mov ecx, esi
:00405CB0 E8499C0100 call 0041F8FE
:00405CB5 8BC6 mov eax, esi
:00405CB7 5E pop esi
:00405CB8 81C40C010000 add esp, 0000010C
:00405CBE C3 ret

.......

* Reference To: ADVAPI32.RegQueryValueExA, Ord:017Bh
|
:00405D8A 8B350CB04300 mov esi, dword ptr [0043B00C]
:00405D90 8D54240C lea edx, dword ptr [esp+0C]
:00405D94 8D442410 lea eax, dword ptr [esp+10]
:00405D98 52 push edx
:00405D99 8B542408 mov edx, dword ptr [esp+08]
:00405D9D 8D4C2418 lea ecx, dword ptr [esp+18]
:00405DA1 50 push eax
:00405DA2 51 push ecx
:00405DA3 6A00 push 00000000

.......

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00405E05(C), :00405E0F(C)
|
:00405E9A 8B4C2404 mov ecx, dword ptr [esp+04]
:00405E9E 51 push ecx
* Reference To: ADVAPI32.RegCloseKey, Ord:015Bh
|
:00405E9F FF1508B04300 Call dword ptr [0043B008]
:00405EA5 6A00 push 00000000
:00405EA7 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"��ϵͳʱ��Ǵ��,�벻Ҫ��ʹ�ñ��ʱ��?
->"��ϵͳʱ�?
"
|
:00405EA9 6888A64400 push 0044A688
:00405EAE E8CE380200 call 00429781
:00405EB3 83C8FF or eax, FFFFFFFF

-----------------------------------------------------------------
��00405B05------00405B24��Կ��2��ַ�� "eLRYdMs7IhHiObJg"
"FkZQYRjGoBNcgJVU"

��00405BEC��һ��ַ��
Possible StringData Ref from Data Obj ->"�Բ��,��һ��ƽ��ע��!"
��ô��Ǻ��ˣ��ultraedit��CHMUnpacker.exe ��ȱ��ԭ�ļ��
�� eLRYdMs7IhHiObJg �� FkZQYRjGoBNcgJVU ��һ�£��˳��һ��
��ע�ᣨ�û��㣩��ɹ��ԭ��ļ��У�û�г��չ��

zyw[BCG]
Beginner's Cracking Group
2002.03.23 20:19

��
��
��
��
��
��