Preface
This program requires us to write the correct KEY.
Open programs or even garbled.
Because it's too simple, let's blog.
Give you an expression of your own experience.
Analysis
00401CD0 > \55 push ebp 00401CD1 . 8BEC mov ebp, esp 00401D70 > 8B4D D8 mov ecx, dword ptr [ebp-28] 00401D73 . 51 push ecx 00401D74 . 68 541A4000 push 00401A54 ; UNICODE "SynTaX 2oo1" 00401D79 . FF15 08314000 call dword ptr [<&MSVBVM50.__vbaStrCm>; MSVBVM50.__vbaStrCmp 00401D7F . 8BF8 mov edi, eax 00401D81 . 8D4D D8 lea ecx, dword ptr [ebp-28] 00401D84 . F7DF neg edi 00401D86 . 1BFF sbb edi, edi 00401D88 . 47 inc edi 00401D89 . F7DF neg edi 00401D9A . 66:3BFE cmp di, si 00401D9D . 0F84 A0000000 je 00401E43 00401DA3 . FF15 2C314000 call dword ptr [<&MSVBVM50.#534>] ; MSVBVM50.rtcBeep 00401DA9 . 8B3D 48314000 mov edi, dword ptr [<&MSVBVM50.__vba>; MSVBVM50.__vbaVarDup 00401DAF . B9 04000280 mov ecx, 80020004 00401DB4 . 894D 9C mov dword ptr [ebp-64], ecx 00401DB7 . B8 0A000000 mov eax, 0A 00401DBC . 894D AC mov dword ptr [ebp-54], ecx 00401DBF . BB 08000000 mov ebx, 8 00401DC4 . 8D95 74FFFFFF lea edx, dword ptr [ebp-8C] 00401DCA . 8D4D B4 lea ecx, dword ptr [ebp-4C] 00401DCD . 8945 94 mov dword ptr [ebp-6C], eax 00401DD0 . 8945 A4 mov dword ptr [ebp-5C], eax 00401DD3 . C785 7CFFFFFF>mov dword ptr [ebp-84], 00401AC4 ; UNICODE "SuCCESFul !" 00401DDD . 899D 74FFFFFF mov dword ptr [ebp-8C], ebx 00401DE3 . FFD7 call edi ; <&MSVBVM50.__vbaVarDup> 00401DE5 . 8D55 84 lea edx, dword ptr [ebp-7C] 00401DE8 . 8D4D C4 lea ecx, dword ptr [ebp-3C] 00401DEB . C745 8C 701A4>mov dword ptr [ebp-74], 00401A70 ; UNICODE "RiCHtiG ! ...nun weiter zu CrackMe 2 !" 00401E6D . C785 7CFFFFFF>mov dword ptr [ebp-84], 00401B44 ; UNICODE "leider NeiN !" 00401E77 . 899D 74FFFFFF mov dword ptr [ebp-8C], ebx 00401E7D . FFD7 call edi ; <&MSVBVM50.__vbaVarDup> 00401E7F . 8D55 84 lea edx, dword ptr [ebp-7C] 00401E82 . 8D4D C4 lea ecx, dword ptr [ebp-3C] 00401E85 . C745 8C E01A4>mov dword ptr [ebp-74], 00401AE0 ; UNICODE "Leider Falsch ! Schau noch mal genau nach ..." 00401F41 . C2 0400 retn 4
In fact, by comparing the string "SynTaX 2oo1" with the input character, the equivalent will pop out of the Successful pop-up window.
Published 29 original articles, won praise 1, visited 6669