wintools premium 24.10.1 注册分析

wintools premium 24.10.1

目录

• wintools premium 24.10.1
  • NAGSCREEN_proc_472350
  • check_472BF0
• py
• ps

win32 程序，程序注册逻辑简单，关注窗口事件、控件id可快速定位到关键逻辑。

NAGSCREEN_proc_472350

INT_PTR __thiscall NAGSCREEN_proc_472350(void *this, HWND hDlg, UINT a3, WPARAM id, LPARAM a5)
{// [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]if ( a3 == 272 ){memset(String, 0, 520);v17 = GetDlgItem;DlgItem = GetDlgItem(hDlg, 10006);GetWindowTextW(DlgItem, String, 260);WritePrivateProfileStringW(L"o", L"c", String, &FileName);i_time = _time64(0);switch ( Edition_4CC1D8 ){case 100:ImageW = LoadImageW(hInst, (LPCWSTR)0x4F21, 0, 79, 264, 0x1000u);break;case 200:ImageW = LoadImageW(hInst, (LPCWSTR)0x4F22, 0, 79, 264, 0x1000u);break;case 300:ImageW = LoadImageW(hInst, (LPCWSTR)0x4F23, 0, 79, 264, 0x1000u);break;default:
LABEL_38:PrivateProfileIntW = GetPrivateProfileIntW(L"OPTIONS", L"Transparent", 5, &FileName);sub_480B00(hDlg, 100 - PrivateProfileIntW);psz1 = 0;memset(v65, 0, sizeof(v65));if ( !SHGetSpecialFolderLocation(0, 26, &ppidl) ){SHGetPathFromIDListW(ppidl, &psz1);StrCatW(&psz1, L"\\WinTools");CreateDirectoryW(&psz1, 0);}StrCatW(&psz1, &xx_dll_4E4F50);memset(&mbp, 0, sizeof(mbp));memset(data_str, 0, sizeof(data_str));GetPrivateProfileStringW(L"OPTIONS", L"Data", &pszFaceName, (LPWSTR)&mbp, 0x14u, &psz1);if ( !LOWORD(mbp.cbSize) ){if ( GetPrivateProfileIntW(L"OPTIONS", L"Data", 0, &FileName) ){set_reg_4722D0(v22, &word_4B32E4);}else{Buffer = 0;v60 = 0;v61 = 0;v58 = 0i64;v59 = 0i64;swprintf_s(&Buffer, 0x14u, L"%I64i", i_time);WritePrivateProfileStringW(L"OPTIONS", L"Data", &Buffer, &psz1);WritePrivateProfileStringW(L"OPTIONS", L"Data", &Buffer, &FileName);}}GetPrivateProfileStringW(L"OPTIONS", L"Data", &pszFaceName, data_str, 0x14u, &FileName);GetPrivateProfileStringW(L"OPTIONS", L"Data", &pszFaceName, (LPWSTR)&mbp, 0x14u, &psz1);if ( StrCmpW(data_str, (PCWSTR)&mbp) )set_reg_4722D0(v23, &word_4B32E4);*(_QWORD *)&qword_4CB9B8 = (i_time - (unsigned int)toint_35((int)data_str)) / 86400;v24 = GetDlgItem(hDlg, 19989);SendMessageW(v24, 0x402u, 0, 0);v25 = GetDlgItem(hDlg, 19989);SendMessageW(v25, 0x401u, 0, 1376256);v42 = qword_4CB9B8;v26 = GetDlgItem(hDlg, 19989);SendMessageW(v26, 0x402u, v42, 0);v27 = sub_478640(L"NAG", L"0");SetWindowTextW(hDlg, v27);v45 = sub_478640(L"NAG", &word_4B32E4);v28 = GetDlgItem(hDlg, 19991);SetWindowTextW(v28, v45);v46 = sub_478640(L"NAG", L"2");v29 = GetDlgItem(hDlg, 19990);SetWindowTextW(v29, v46);v47 = sub_478640(L"NAG", L"3");v30 = GetDlgItem(hDlg, 19992);SetWindowTextW(v30, v47);v48 = sub_478640(L"NAG", L"4");v31 = GetDlgItem(hDlg, 10235);SetWindowTextW(v31, v48);v49 = sub_478640(L"NAG", &word_4B32CC);v32 = GetDlgItem(hDlg, 19994);SetWindowTextW(v32, v49);v50 = sub_478640(L"NAG", L"6");v33 = GetDlgItem(hDlg, 19995);SetWindowTextW(v33, v50);memset(code, 0, 300);v34 = *(&qword_4CB9B8 + 1);if ( (*(&qword_4CB9B8 + 1) & 0x80000000) != 0 ){v35 = qword_4CB9B8;}else if ( (int)*(&qword_4CB9B8 + 1) > 0 || (v35 = qword_4CB9B8, qword_4CB9B8 > 0x15) ){v35 = 21;v34 = 0;*(_QWORD *)&qword_4CB9B8 = 21i64;}v51 = v34;v43 = v35;v36 = sub_478640(L"NAG", L"7");swprintf_s(code, 0x96u, v36, v43, v51);v37 = GetDlgItem(hDlg, 10005);SetWindowTextW(v37, code);memset(v66, 0, 1000);if ( dword_4E4F40 ){dword_4E4F40 = 0;v38 = L"9";}else{v38 = L"8";}v39 = sub_478640(L"NAG", v38);StrCpyW(v66, v39);v40 = 0;if ( lstrlenW(v66) > 0 ){do{if ( v66[v40] == 64 )v66[v40] = 10;++v40;}while ( v40 < lstrlenW(v66) );v17 = GetDlgItem;}v41 = v17(hDlg, 19998);SetWindowTextW(v41, v66);return 1;}v44 = (LPARAM)ImageW;v20 = GetDlgItem(hDlg, 19999);SendMessageW(v20, 0x172u, 0, v44);goto LABEL_38;}if ( a3 != WM_COMMAND )return 0;if ( (unsigned __int16)id > 19991u ){if ( (unsigned __int16)id == 19992 )HtmlHelpW(hDlg, &pszFile, 0xFu, 1u);}else{switch ( (unsigned __int16)id ){case 19991u:HtmlHelpW(hDlg, &pszFile, 0xFu, 0x13u);break;case 2u:EndDialog(hDlg, 1);break;case 19990u:ArgList = 0;if ( *(__int64 *)&qword_4CB9B8 > 20 ){ArgList = 1;set_reg_4722D0((int)this, &word_4B32E4);}memset(code, 0, sizeof(code));v6 = GetDlgItem(hDlg, 10006);           // codeGetWindowTextW(v6, code, 260);v7 = (void (__stdcall *)(HWND, INT_PTR))EndDialog;if ( code[0] ){if ( lstrlenW(code) <= 20 )goto LABEL_22;v8 = -1;code_len = lstrlenW(code);//内存布局//  -000013E0 data_str        dw 20 dup(?)//  -000013B8 code            dw 260 dup(?)// len(code)-20d +4crc32 = &data_str[code_len + 4];      // data_str 0x14  for ( i = lstrlenW(&data_str[code_len + 4]);i > 0;v8 = CRC32_table_4BB070[(unsigned __int8)(v8 ^ v11)] ^ (v8 >> 8) ){v11 = *crc32++;--i;}psz1 = 0;memset(v65, 0, sizeof(v65));StrCpyW(&psz1, code);if ( (unsigned int)(code_len * 2 - 0x20) >= 0x208 ){sub_48EBA6((int)crc32, (int)hDlg, v8);JUMPOUT(0x472BE4);}*(WCHAR *)((char *)&psz1 + code_len * 2 - 0x20) = 0;if ( ~v8 == (unsigned int)_wtoi64(&psz1) ){v12 = code;if ( code[0] ){v13 = code[0];do{*v12++ = v13 ^ 1;v13 = *v12;}while ( *v12 );}WritePrivateProfileStringW(L"o", L"c", code, &FileName);v7 = (void (__stdcall *)(HWND, INT_PTR))EndDialog;EndDialog(hDlg, 0);if ( sub_472210() ){set_reg_4722D0(v14, L"0");check_472BF0();//check2}v15 = sub_478640(L"NAG", L"10");StrCpyW(String, v15);v16 = sub_478640(L"NAG", L"11");StrCpyW(v66, v16);mbp.hInstance = hInst;mbp.hwndOwner = ::hDlg;mbp.lpszCaption = v66;mbp.lpszText = String;mbp.cbSize = 40;mbp.dwStyle = 262272;mbp.lpszIcon = (LPCWSTR)107;MessageBoxIndirectW(&mbp);}else{
LABEL_22:v7 = (void (__stdcall *)(HWND, INT_PTR))EndDialog;}}if ( sub_472210() || ArgList )v7(hDlg, 1);elsev7(hDlg, 0);break;}}return 1;
}

check_472BF0

int check_472BF0()
{// [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]j___free_base((void *)lpString);lpString = (LPCWSTR)calloc(0x32u, 2u);result = GetPrivateProfileStringW(L"o", L"c", &pszFaceName, (LPWSTR)lpString, 0x32u, &FileName);if ( result ){result = lstrlenW(lpString);if ( result >= 20 ){v1 = lstrlenW(lpString);// Professionalqmemcpy(psz1,L"UYFA8Y5FMG9A84Y57Y4O789YGURIYHKKJGTIX48E57YX47JY5IXK734YJSYH4G78TH47Y7J84SY5S8IYW234I87YS28IJY78YS1J7YJ178YTISJ7""YI81YJ87TY187YJ17YTI8S7TY3JI78Y4TK78TY7YH1J7YHF714YK74Y174YHYUHTR5FG1E5D5413ES154GD541DTF56D3RG543F1G56FRG651F2""3T1GD63TG1F543DE5475F73JDJK846T1TDF34515641D6541DG546RD1654EW65RF6516D4FYJ47YI847J1Y8IY41JK78Y4FK871YJ8I7Y3DIK8""173YJ871IDY478TYG1J7Y48IK7YJDK47YJ71Y187YJ418Y4J8I7Y1GJ7Y47ETM85LKA84357WF74IK5G7W948573FLKVE51IUM18U18Y389Y1UI""Y187Y871Y71R1FR1D56G1DRT65RD363D787138IDH18I3YJ813YJD781Y3I87Y1J7DY31K7438AT83476KI873YD18I74Y781TY78TYJ78TY174""Y178YJ1Y487YK17YJGFHU4JHDK4GFNH481JK7FNY4Y17NY174FYN71NFY47814YJD17Y4JF17YR7Y4H78DYH81IYG1H74YIJD7Y431I87JYD48I""YJ14Y7IJG17DY4781Y4J87YI81JDFY4178YJ47J1Y47J1HY478YHT784YTJ1874HYG14J7YD1J487YF18748MFK34574S42YH871GYJ4Y1JI87Y""4FJ817Y4GJ817J4Y1GI8J74Y781YTJ4",0x654u);memset(&psz1[810], 0, 0x1ACu);StrCpyW(&word_4E4F98, L"prowt");StrCpyW(&xx_dll_4E4F50, L"\\prowt.dll");if ( Edition_4CC1D8 == 100 ){// ClassicStrCpyW(&word_4E4F98, L"clscwt");StrCpyW(&xx_dll_4E4F50, L"\\clscwt.dll");StrCpyW(psz1,L"M1890U198Y171917809179H1789J1719HDYJF7Y1FHJYF173Y78RY783RY18YHR871YR3H871YJF3YF178H3YF718JFY3178SYJHY3FH1J7YG7""YG7JY17G3YN178Y3G7Y178T3YH178YR78Y1J87R3HY18Y3J71YI387TYH1738YJD1H7Y3RJ871Y38RYJF7HYI3TGH7YI81YH87YH318Y3J71Y""73HY17I3Y8YE7YE7HY1D873YJFTA87K437783217Y474YH73Y178YTH73Y78JRYH47814J71YJ784Y1J874FH7814J7HY64T87YJ87Y1871Y3""87YJF87Y781Y87J3YT781YH817Y3TH781Y38716Y781YTJ8H3Y87JYR3178Y3TH87J48R7JF47H387JDKUFR734HW25TPYN5373178YG178YG""J8Y71487YHT7Y8F1JU7YDJ87Y487IYH478Y178YD748Y178Y187RY18Y781Y7Y178TY48J1FUY4NF743847583F187YH781YH471Y78YJ7DEY""4781YE87Y4R87Y1TGJ87Y4H871Y4TJ7841YI81Y74G71Y1D7UY4178Y4871HG7Y78FY4871Y4JG71Y4I871Y8RY78Y6H1T73Y8JT73Y8J71YT""31J7Y87YD73Y178Y3781Y3H781YT3781YH6T78YT78Y784JD45F78748F3Y17YU47Y187Y41784YH17YT47Y4T71Y874Y17HY47H1YJ4D7Y17""YH71Y4781Y4T87H1Y7Y1784DHY17Y4J17Y471Y578Y");}else if ( Edition_4CC1D8 == 300 ){// PremiumStrCpyW(&word_4E4F98, L"remwt");StrCpyW(&xx_dll_4E4F50, L"\\remwt.dll");StrCpyW(psz1,L"N7W934GJ2746J9827456T8O97YH5I4YGWTJ5DRYHTNU4Y56N78Y8Y34O879Y4O879YN4587Y3N9O73N75Y3UY435UYH345FTCX5TREX4TRE35X""3TREX5T435XDCGTB34XV5TC34BT5RDXC4TB5FCT34534YUI5YM34UY5MKI34NY5KI34NUY5K34UMY5NI8374JY5UI4353F45CT3C54T3CT53C""4T5XC3TB45FC34BGF5CB34RB5CT3G4BF5T3FT54V345KHJMI3YUMYI346HIM3Y48IY58H734U53J4C5TF34T5T34JH5T3DF4JT534JH5T34D5""CJT34FD5T34CD5TXC34TFC5D34TG5CVTG3454KJHM34N5YHLIK3U4MYN5IUY43MI5Y45NU443JH4KNJH3Y5NUY4HK5IUNY4H32MKLI4HLM2JH""34L2M3UH4N2L3KYN5H43RKUS45OG434S39472J34FHSF38274K28394FHYNHLIU4Y5LIU3Y4ML5I8Y73L4895YJL89347Y6O8Y3JIK546UHUK""45YJKH6U8Y4JIHKUTY56I8JK4H7Y5678YGJ4576YH487IJ5H6Y4875YH6I45YJ684YH5KI876YF4K5J7H6YF4H75Y6HK457Y6TK54JY6TKH4Y""56JTHY456HJTK4756IJ78T4658IKJTY45IH67Y4J856YG8I4H7Y564JT56HI847YH6ITK4Y5KIJ6H7G46YJG4I857H6YGJ4756YHK4IJT6HYT""475J6H4Y757674UJ5Y6T84Y75K6JT4HY567HJ4");}v2 = psz1;if ( psz1[0] ){v3 = psz1[0];do{*v2++ = v3 ^ 1;v3 = *v2;}while ( *v2 );}if ( StrStrW(psz1, &lpString[v1 - 12]) ){if ( !SHGetSpecialFolderLocation(0, 26, &ppidl) ){SHGetPathFromIDListW(ppidl, pszPath);StrCatW(pszPath, L"\\WinTools");CreateDirectoryW(pszPath, 0);}StrCatW(pszPath, &xx_dll_4E4F50);DeleteFileW(pszPath);v5 = L"0";}else{result = sub_472210();if ( result ){dword_4E4F34 = 1;dword_4E4F38 = 1;dword_4E4F3C = 1;dword_4E4F44 = 1;dword_4E4F48 = 1;dword_4E4F30 = 1;return result;}v5 = &word_4B32E4;}return set_reg_4722D0(v4, v5);}}return result;
}

py

ss

'''
premium
7876632734272G7VYMOX87YVJ
3005207633516OX87YVJMXC7Y
1629819872181497JYDFKJ7YJE
prof
28583290066947JGKWE49J57GJ
16967628558681F9VSDF78SWT7
6003987853474HT8IJR6GY76R
19339473533736W8E7RT98ST89
'''
import binascii
import random# 100d
Classic='M1890U198Y171917809179H1789J1719HDYJF7Y1FHJYF173Y78RY783RY18YHR871YR3H871YJF3YF178H3YF718JFY3178SYJHY3FH1J7YG7YG7JY17G3YN178Y3G7Y178T3YH178YR78Y1J87R3HY18Y3J71YI387TYH1738YJD1H7Y3RJ871Y38RYJF7HYI3TGH7YI81YH87YH318Y3J71Y73HY17I3Y8YE7YE7HY1D873YJFTA87K437783217Y474YH73Y178YTH73Y78JRYH47814J71YJ784Y1J874FH7814J7HY64T87YJ87Y1871Y387YJF87Y781Y87J3YT781YH817Y3TH781Y38716Y781YTJ8H3Y87JYR3178Y3TH87J48R7JF47H387JDKUFR734HW25TPYN5373178YG178YGJ8Y71487YHT7Y8F1JU7YDJ87Y487IYH478Y178YD748Y178Y187RY18Y781Y7Y178TY48J1FUY4NF743847583F187YH781YH471Y78YJ7DEY4781YE87Y4R87Y1TGJ87Y4H871Y4TJ7841YI81Y74G71Y1D7UY4178Y4871HG7Y78FY4871Y4JG71Y4I871Y8RY78Y6H1T73Y8JT73Y8J71YT31J7Y87YD73Y178Y3781Y3H781YT3781YH6T78YT78Y784JD45F78748F3Y17YU47Y187Y41784YH17YT47Y4T71Y874Y17HY47H1YJ4D7Y17YH71Y4781Y4T87H1Y7Y1784DHY17Y4J17Y471Y578Y'# 200d
Professional='UYFA8Y5FMG9A84Y57Y4O789YGURIYHKKJGTIX48E57YX47JY5IXK734YJSYH4G78TH47Y7J84SY5S8IYW234I87YS28IJY78YS1J7YJ178YTISJ7YI81YJ87TY187YJ17YTI8S7TY3JI78Y4TK78TY7YH1J7YHF714YK74Y174YHYUHTR5FG1E5D5413ES154GD541DTF56D3RG543F1G56FRG651F23T1GD63TG1F543DE5475F73JDJK846T1TDF34515641D6541DG546RD1654EW65RF6516D4FYJ47YI847J1Y8IY41JK78Y4FK871YJ8I7Y3DIK8173YJ871IDY478TYG1J7Y48IK7YJDK47YJ71Y187YJ418Y4J8I7Y1GJ7Y47ETM85LKA84357WF74IK5G7W948573FLKVE51IUM18U18Y389Y1UIY187Y871Y71R1FR1D56G1DRT65RD363D787138IDH18I3YJ813YJD781Y3I87Y1J7DY31K7438AT83476KI873YD18I74Y781TY78TYJ78TY174Y178YJ1Y487YK17YJGFHU4JHDK4GFNH481JK7FNY4Y17NY174FYN71NFY47814YJD17Y4JF17YR7Y4H78DYH81IYG1H74YIJD7Y431I87JYD48IYJ14Y7IJG17DY4781Y4J87YI81JDFY4178YJ47J1Y47J1HY478YHT784YTJ1874HYG14J7YD1J487YF18748MFK34574S42YH871GYJ4Y1JI87Y4FJ817Y4GJ817J4Y1GI8J74Y781YTJ4'# 300d
Premium='N7W934GJ2746J9827456T8O97YH5I4YGWTJ5DRYHTNU4Y56N78Y8Y34O879Y4O879YN4587Y3N9O73N75Y3UY435UYH345FTCX5TREX4TRE35X3TREX5T435XDCGTB34XV5TC34BT5RDXC4TB5FCT34534YUI5YM34UY5MKI34NY5KI34NUY5K34UMY5NI8374JY5UI4353F45CT3C54T3CT53C4T5XC3TB45FC34BGF5CB34RB5CT3G4BF5T3FT54V345KHJMI3YUMYI346HIM3Y48IY58H734U53J4C5TF34T5T34JH5T3DF4JT534JH5T34D5CJT34FD5T34CD5TXC34TFC5D34TG5CVTG3454KJHM34N5YHLIK3U4MYN5IUY43MI5Y45NU443JH4KNJH3Y5NUY4HK5IUNY4H32MKLI4HLM2JH34L2M3UH4N2L3KYN5H43RKUS45OG434S39472J34FHSF38274K28394FHYNHLIU4Y5LIU3Y4ML5I8Y73L4895YJL89347Y6O8Y3JIK546UHUK45YJKH6U8Y4JIHKUTY56I8JK4H7Y5678YGJ4576YH487IJ5H6Y4875YH6I45YJ684YH5KI876YF4K5J7H6YF4H75Y6HK457Y6TK54JY6TKH4Y56JTHY456HJTK4756IJ78T4658IKJTY45IH67Y4J856YG8I4H7Y564JT56HI847YH6ITK4Y5KIJ6H7G46YJG4I857H6YGJ4756YHK4IJT6HYT475J6H4Y757674UJ5Y6T84Y75K6JT4HY567HJ4'def generate(Edition:str=Premium):n=random.randint(0,len(Edition)-16)t_code=Edition[n:n+16]i_crc=binascii.crc32(t_code.encode(),0)code=str(i_crc)+t_code# print(code)return codedef check(x:bytes):# x=b'7876632734272G7VYMOX87YVJ'# x=b'1629819872181497JYDFKJ7YJE'n=len(x)-16# print(n)y=int(x[:n])print('code crc32:',y,y.to_bytes(4,'little').hex())ret=binascii.crc32(x[n:],0)print('calc crc32:',ret,ret.to_bytes(4,'little').hex())print('result:',y==ret)if __name__=="__main__":x=generate()print(x)# check(x.encode())

ps