lesson14042.htm

为所有对破解感兴趣的朋友准备的礼物。希望大家能够喜欢。

  'Save softice history as,...'. Save this file as Log1.txt . If you <br>
  load this file into a text editor like wordpad or notepad, you will <br>
  see that it has logged the command windows activity from softice. This <br>
  is our 'First Call Flow' file. Get the idea :-)..... <br>
  <br>
  <br>
  Step 7 : Set the date forward and do it all again. <br>
  ************************************************** <br>
  What you need to do now is to create a second call log file, but <br>
  this time you need to set the date of your system forwards so that <br>
  the time trial will show the expired message. :-). This will force <br>
  the flow of the program to take a different path sometime after the <br>
  'GetSystemTime' Function, but before the nag screen appears. </span></p>
<p><span class="p9">Step 8 : Compare the two log files. <br>
  *********************************** <br>
  After you have completed all the steps again and saved a second log <br>
  file, you need to compare them. Below, I have included two sample <br>
  log files from a new Micro$oft drawing package that supposedly is <br>
  well protected. : <br>
  <br>
  LOG FILE 1. ( You have % days left ) <br>
  *********** <br>
  Break due to BPX KERNEL32!GetSystemTime&nbsp; (ET=33.15 milliseconds) <br>
  Break due to G (ET=383.02 microseconds) <br>
  015F:78026B90&nbsp; 663B0512870378&nbsp; &nbsp; &nbsp; CMP&nbsp; &nbsp; AX,[78038712] 
  <br>
  015F:78026B97&nbsp; 756B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JNZ&nbsp; &nbsp; 78026C04&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; (JUMP ) <br>
  015F:78026C04&nbsp; 8D8534FFFFFF&nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; &nbsp; 
  EAX,[EBP-00CC] <br>
  015F:78026C0A&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EAX <br>
  015F:78026C0B&nbsp; FF1540D10278&nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; &nbsp; 
  [KERNEL32!GetTimeZoneInformation] <br>
  015F:78026C11&nbsp; 83F8FF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CMP&nbsp; 
  &nbsp; EAX,-01 <br>
  015F:78026C14&nbsp; 7430&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JZ&nbsp; &nbsp; &nbsp; 78026C46&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; &nbsp; (NO JUMP) <br>
  015F:78026C16&nbsp; 83F802&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CMP&nbsp; 
  &nbsp; EAX,02 <br>
  015F:78026C19&nbsp; 7527&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JNZ&nbsp; &nbsp; 78026C42&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; (NO JUMP) <br>
  015F:78026C1B&nbsp; 66837DCE00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CMP&nbsp; &nbsp; 
  WORD PTR [EBP-32],00 <br>
  015F:78026C20&nbsp; 7420&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JZ&nbsp; &nbsp; &nbsp; 78026C42&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; &nbsp; (NO JUMP) <br>
  015F:78026C22&nbsp; 837DDC00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CMP&nbsp; 
  &nbsp; DWORD PTR [EBP-24],00 <br>
  015F:78026C26&nbsp; 741A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JZ&nbsp; &nbsp; &nbsp; 78026C42&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; &nbsp; (NO JUMP) <br>
  015F:78026C28&nbsp; 6A01&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  PUSH&nbsp; &nbsp; 01 <br>
  015F:78026C2A&nbsp; 58&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; POP&nbsp; &nbsp; EAX <br>
  015F:78026C2B&nbsp; 56&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; ESI <br>
  015F:78026C2C&nbsp; 57&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EDI <br>
  015F:78026C2D&nbsp; 8D75E0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; ESI,[EBP-20] <br>
  015F:78026C30&nbsp; BF08870378&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  EDI,78038708 <br>
  015F:78026C35&nbsp; A5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; MOVSD <br>
  015F:78026C36&nbsp; A5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; MOVSD <br>
  015F:78026C37&nbsp; A5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; MOVSD <br>
  015F:78026C38&nbsp; A5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; MOVSD <br>
  015F:78026C39&nbsp; 5F&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; POP&nbsp; &nbsp; EDI <br>
  015F:78026C3A&nbsp; A300870378&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  [78038700],EAX <br>
  015F:78026C3F&nbsp; 5E&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; POP&nbsp; &nbsp; ESI <br>
  015F:78026C40&nbsp; EB90&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JMP&nbsp; &nbsp; 78026CD2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; (JUMP ) <br>
  015F:78026BD2&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EAX <br>
  015F:78026BD3&nbsp; 0FB745FC&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOVZX&nbsp; 
  EAX,WORD PTR [EBP-04] <br>
  015F:78026BD7&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EAX <br>
  015F:78026BD8&nbsp; 0FB745FA&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOVZX&nbsp; 
  EAX,WORD PTR [EBP-06] <br>
  015F:78026BDC&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EAX <br>
  015F:78026BDD&nbsp; 0FB745F8&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOVZX&nbsp; 
  EAX,WORD PTR [EBP-08] <br>
  015F:78026BE1&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EAX <br>
  015F:78026BE2&nbsp; 0FB745F6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOVZX&nbsp; 
  EAX,WORD PTR [EBP-0A] <br>
  015F:78026BE6&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EAX <br>
  015F:78026BE7&nbsp; 0FB745F2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOVZX&nbsp; 
  EAX,WORD PTR [EBP-0E] <br>
  015F:78026BEB&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EAX <br>
  015F:78026BEC&nbsp; 0FB745F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOVZX&nbsp; 
  EAX,WORD PTR [EBP-10] <br>
  015F:78026BF0&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EAX <br>
  015F:78026BF1&nbsp; E8EE000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 78026CE4 <br>
  015F:78026BF6&nbsp; 8B4D08&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
  &nbsp; ECX,[EBP+08] <br>
  015F:78026BF9&nbsp; 83C41C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,1C <br>
  015F:78026BFC&nbsp; 85C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  TEST&nbsp; &nbsp; ECX,ECX <br>
  015F:78026BFE&nbsp; 7402&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JZ&nbsp; &nbsp; &nbsp; 78026C02&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; &nbsp; (NO JUMP) <br>
  015F:78026C00&nbsp; 8901&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  MOV&nbsp; &nbsp; [ECX],EAX <br>
  015F:78026C02&nbsp; C9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; LEAVE <br>
  015F:78026C03&nbsp; C3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; RET <br>
  015F:300D2072&nbsp; 83C404&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,04 <br>
  015F:300D2075&nbsp; 8D4C2410&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; ECX,[ESP+10] <br>
  015F:300D2079&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; ECX <br>
  015F:300D207A&nbsp; FF15B4841030&nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; &nbsp; 
  [301084B4] <br>
  015F:300D2080&nbsp; 83C404&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,04 <br>
  015F:300D2083&nbsp; 8BF0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  MOV&nbsp; &nbsp; ESI,EAX <br>
  015F:300D2085&nbsp; 8D54243C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; EDX,[ESP+3C] <br>
  015F:300D2089&nbsp; B909000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  ECX,00000009 <br>
  015F:300D208E&nbsp; 8D7C2418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; EDI,[ESP+18] <br>
  015F:300D2092&nbsp; 8D442418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; EAX,[ESP+18] <br>
  015F:300D2096&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EDX <br>
  015F:300D2097&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EAX <br>
  015F:300D2098&nbsp; F3A5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  REPZ MOVSD <br>
  015F:300D209A&nbsp; E8E1FDFFFF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 300D1E80 <br>
  015F:300D209F&nbsp; 83C408&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,08 <br>
  015F:300D20A2&nbsp; 85C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  TEST&nbsp; &nbsp; EAX,EAX <br>
  015F:300D20A4&nbsp; 7E19&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JLE&nbsp; &nbsp; 300D20BF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; (JUMP ) <br>
  015F:300D20BF&nbsp; 8D442460&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; EAX,[ESP+60] <br>
  015F:300D20C3&nbsp; 8D4C2418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; ECX,[ESP+18] <br>
  015F:300D20C7&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EAX <br>
  015F:300D20C8&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; ECX <br>
  015F:300D20C9&nbsp; E8B2FDFFFF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 300D1E80 <br>
  015F:300D20CE&nbsp; 83C408&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,08 <br>
  015F:300D20D1&nbsp; 85C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  TEST&nbsp; &nbsp; EAX,EAX <br>
  015F:300D20D3&nbsp; 7E33&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JLE&nbsp; &nbsp; 300D2108&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; (JUMP ) <br>
  015F:300D2108&nbsp; 6820D91630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
  &nbsp; 3016D920 <br>
  015F:300D210D&nbsp; E83EFCFFFF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 300D1D50 <br>
  015F:300D2112&nbsp; 83C404&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,04 <br>
  015F:300D2115&nbsp; 85C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  TEST&nbsp; &nbsp; EAX,EAX <br>
  015F:300D2117&nbsp; 7410&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JZ&nbsp; &nbsp; &nbsp; 300D2129&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; &nbsp; (JUMP ) <br>
  015F:300D2129&nbsp; 391D20D91630&nbsp; &nbsp; &nbsp; &nbsp; CMP&nbsp; &nbsp; 
  [3016D920],EBX <br>
  015F:300D212F&nbsp; 0F85D6010000&nbsp; &nbsp; &nbsp; &nbsp; JNZ&nbsp; &nbsp; 
  300D230B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (JUMP 
  ) <br>
  015F:300D230B&nbsp; 6A4C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  PUSH&nbsp; &nbsp; 4C <br>
  015F:300D230D&nbsp; 6824D91630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
  &nbsp; 3016D924 <br>
  015F:300D2312&nbsp; E8E9F9FFFF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 300D1D00 <br>
  015F:300D2317&nbsp; 8B0D20D91630&nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  ECX,[3016D920] <br>
  015F:300D231D&nbsp; 83C408&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,08 <br>
  015F:300D2320&nbsp; 3BC1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  CMP&nbsp; &nbsp; EAX,ECX <br>
  015F:300D2322&nbsp; 0F841DFEFFFF&nbsp; &nbsp; &nbsp; &nbsp; JZ&nbsp; &nbsp; 
  &nbsp; 300D2145&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  (JUMP ) <br>
  015F:300D2145&nbsp; 8D542418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; EDX,[ESP+18] <br>
  015F:300D2149&nbsp; 6848D91630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
  &nbsp; 3016D948 <br>
  015F:300D214E&nbsp; 52&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; EDX <br>
  015F:300D214F&nbsp; E82CFDFFFF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 300D1E80 <br>
  015F:300D2154&nbsp; 83C408&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,08 <br>
  015F:300D2157&nbsp; 85C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  TEST&nbsp; &nbsp; EAX,EAX <br>
  015F:300D2159&nbsp; 7D26&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JGE&nbsp; &nbsp; 300D2181&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; (JUMP ) <br>
  015F:300D2181&nbsp; 803DA480163003&nbsp; &nbsp; &nbsp; CMP&nbsp; &nbsp; BYTE 
  PTR [301680A4],03 <br>
  015F:300D2188&nbsp; 0F876D010000&nbsp; &nbsp; &nbsp; &nbsp; JA&nbsp; &nbsp; 
  &nbsp; 300D22FB&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  (NO JUMP) <br>
  015F:300D218E&nbsp; 8BAC24D0000000&nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; EBP,[ESP+000000D0] 
  <br>
  015F:300D2195&nbsp; C745009F860100&nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; DWORD 
  PTR [EBP+00],0001869F <br>
  015F:300D219C&nbsp; A0A4801630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  AL,[301680A4] <br>
  015F:300D21A1&nbsp; A801&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  TEST&nbsp; &nbsp; AL,01 <br>
  015F:300D21A3&nbsp; 744B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  JZ&nbsp; &nbsp; &nbsp; 300D21F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; &nbsp; (NO JUMP) <br>
  015F:300D21A5&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  XOR&nbsp; &nbsp; EAX,EAX <br>
  015F:300D21A7&nbsp; 8D4C2418&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; ECX,[ESP+18] <br>
  015F:300D21AB&nbsp; A0A5801630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; &nbsp; 
  AL,[301680A5] <br>
  015F:300D21B0&nbsp; 51&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
  &nbsp; PUSH&nbsp; &nbsp; ECX <br>
  015F:300D21B1&nbsp; 6824D91630&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
  &nbsp; 3016D924 <br>
  015F:300D21B6&nbsp; 8D3440&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LEA&nbsp; 
  &nbsp; ESI,[EAX*2+EAX] <br>
  015F:300D21B9&nbsp; C1E603&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SHL&nbsp; 
  &nbsp; ESI,03 <br>
  015F:300D21BC&nbsp; E85FFDFFFF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
  &nbsp; 300D1F20 <br>
  015F:300D21C1&nbsp; 83C408&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD&nbsp; 
  &nbsp; ESP,08 <br>