这个软件的注册算法比较简单,就随意的分析了一下.
整体的思路是：将注册码的前16位两两相差，得到两者之差再加上0x41，得到后相应位置的值。

不多了，通过常用的方法我们找到程序判断的关键点,整理分析如下:

004099A0    /$  56              push esi
004099A1    |.  8B7424 08       mov esi,dword ptr ss:[esp+8]
004099A5    |.  57              push edi
004099A6    |.  8BFE            mov edi,esi
004099A8    |.  83C9 FF         or ecx,FFFFFFFF
004099AB    |.  33C0            xor eax,eax
004099AD    |.  F2:AE           repne scas byte ptr es:[edi]
004099AF    |.  F7D1            not ecx
004099B1    |.  49              dec ecx                                ;  取注册码的长度
004099B2    |.  83F9 20         cmp ecx,20                             ;  与0x20比较,即注册码的长度应为32位
004099B5    |.  74 07           je short All_To_M.004099BE             ;  相等则继续下一步,否则退出出错
004099B7    |>  5F              pop edi
004099B8    |.  33C0            xor eax,eax
004099BA    |.  5E              pop esi
004099BB    |.  C2 0400         retn 4
004099BE    |>  33C9            xor ecx,ecx                            ;  设注册码为StrCode
004099C0    |>  0FBE5431 01     /movsx edx,byte ptr ds:[ecx+esi+1]     ;  取strCode[i+1]
004099C5    |.  0FBE0431        |movsx eax,byte ptr ds:[ecx+esi]       ;  取strCode[i]
004099C9    |.  2BC2            |sub eax,edx                           ;  int n1=strCode[i]-strCode[i+1]
004099CB    |.  99              |cdq                                   ;  edx清0
004099CC    |.  33C2            |xor eax,edx                           ;  n1=n1 ^ 0
004099CE    |.  2BC2            |sub eax,edx                           ;  n1=n1-0
004099D0    |.  0FBE5431 11     |movsx edx,byte ptr ds:[ecx+esi+11]    ;  取strCode[i+0x11]
004099D5    |.  83C0 41         |add eax,41                            ;  n1+=0x41
004099D8    |.  3BD0            |cmp edx,eax
004099DA    |.^ 75 DB           |jnz short All_To_M.004099B7
004099DC    |.  41              |inc ecx
004099DD    |.  83F9 0F         |cmp ecx,0F
004099E0    |.^ 7C DE           \jl short All_To_M.004099C0
004099E2    |.  0FBE4E 0A       movsx ecx,byte ptr ds:[esi+A]          ;  strCode[10]
004099E6    |.  0FBE46 02       movsx eax,byte ptr ds:[esi+2]          ;  strCode[2]
004099EA    |.  2BC1            sub eax,ecx                            ;  n1=strCode[2]-strCode[10]
004099EC    |.  33C9            xor ecx,ecx
004099EE    |.  99              cdq
004099EF    |.  33C2            xor eax,edx
004099F1    |.  5F              pop edi
004099F2    |.  2BC2            sub eax,edx
004099F4    |.  0FBE56 10       movsx edx,byte ptr ds:[esi+10]         ;  strCode[0x10]
004099F8    |.  83C0 41         add eax,41                             ;  n1+=0X41
004099FB    |.  5E              pop esi
004099FC    |.  3BD0            cmp edx,eax
004099FE    |.  0F94C1          sete cl
00409A01    |.  8BC1            mov eax,ecx
00409A03    \.  C2 0400         retn 4

然后自己用C++写了一个简单的KeyGen:

#include
using namespace std;

int main(){
  char strCode[34]="0123456789ABCDEF0123456789ABCDEF";
  
  int i=0;
  int tmp=0;
  for(;i<0xF;++i){
    if(strCode[i]>strCode[i+1])
      tmp=strCode[i]-strCode[i+1];
    else
      tmp=strCode[i+1]-strCode[i];
    strCode[i+0x11]=tmp+0x41;
  }
  
  if(strCode[2]>strCode[0xA])
      tmp=strCode[2]-strCode[0xA];
    else
      tmp=strCode[0xA]-strCode[2];
    strCode[0x10]=tmp+0x41;
    
    cout<  
  return 0;
}