crack me160题 第十五题（序号11）Andrénalin 分析

取序列号开头最多4位（遇到符号就停止），作为一个基数，然后整个序列的ascii加上这个基数，再把这些数字按16进制转化成字符串。(开头固定加0)

比如 74*3  转化为 0817E747D

但是最后关键比较的地方我实在没搞懂，猜测有些假序列号是蒙蔽用的。但是感觉比较像的那个也还是通不过。

加密代码：（这是一个VB的循环格式）

0040A571   > 85C0           TEST EAX,EAX0040A573   . 0F84 29010000  JE Andréna.0040A6A20040A579   . 8D4D BC        LEA ECX,DWORD PTR SS:[EBP-44]0040A57C   . 6A 05          PUSH 50040A57E   . 8D55 8C        LEA EDX,DWORD PTR SS:[EBP-74]0040A581   . 51             PUSH ECX0040A582   . 52             PUSH EDX0040A583   . FFD3           CALL EBX0040A585   . 8D45 8C        LEA EAX,DWORD PTR SS:[EBP-74]0040A588   . 8D4D B0        LEA ECX,DWORD PTR SS:[EBP-50]0040A58B   . 50             PUSH EAX0040A58C   . 51             PUSH ECX0040A58D   . FFD6           CALL ESI0040A58F   . 50             PUSH EAX0040A590   . FF15 D8104000  CALL DWORD PTR DS:[<&MSVBVM60.#581>]     ;  MSVBVM60.rtcR8ValFromBstr0040A596   . DD9D 34FFFFFF  FSTP QWORD PTR SS:[EBP-CC]0040A59C   . 8D55 9C        LEA EDX,DWORD PTR SS:[EBP-64]0040A59F   . 8D45 DC        LEA EAX,DWORD PTR SS:[EBP-24]0040A5A2   . 52             PUSH EDX0040A5A3   . 50             PUSH EAX0040A5A4   . C745 A4 010000>MOV DWORD PTR SS:[EBP-5C],10040A5AB   . C745 9C 020000>MOV DWORD PTR SS:[EBP-64],20040A5B2   . FF15 AC104000  CALL DWORD PTR DS:[<&MSVBVM60.__vbaI4Var>;  MSVBVM60.__vbaI4Var0040A5B8   . 8D4D BC        LEA ECX,DWORD PTR SS:[EBP-44]0040A5BB   . 50             PUSH EAX0040A5BC   . 8D55 B8        LEA EDX,DWORD PTR SS:[EBP-48]0040A5BF   . 51             PUSH ECX0040A5C0   . 52             PUSH EDX0040A5C1   . FFD6           CALL ESI0040A5C3   . 50             PUSH EAX0040A5C4   . FF15 4C104000  CALL DWORD PTR DS:[<&MSVBVM60.#631>]     ;  MSVBVM60.rtcMidCharBstr0040A5CA   . 8BD0           MOV EDX,EAX0040A5CC   . 8D4D B4        LEA ECX,DWORD PTR SS:[EBP-4C]0040A5CF   . FF15 BC104000  CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>;  MSVBVM60.__vbaStrMove0040A5D5   . 50             PUSH EAX0040A5D6   . FF15 20104000  CALL DWORD PTR DS:[<&MSVBVM60.#516>]     ;  MSVBVM60.rtcAnsiValueBstr0040A5DC   . 0FBFC0         MOVSX EAX,AX0040A5DF   . 8985 84FCFFFF  MOV DWORD PTR SS:[EBP-37C],EAX0040A5E5   . 8D8D 7CFFFFFF  LEA ECX,DWORD PTR SS:[EBP-84]0040A5EB   . DB85 84FCFFFF  FILD DWORD PTR SS:[EBP-37C]0040A5F1   . 51             PUSH ECX0040A5F2   . C785 7CFFFFFF >MOV DWORD PTR SS:[EBP-84],50040A5FC   . DD9D 7CFCFFFF  FSTP QWORD PTR SS:[EBP-384]0040A602   . DD85 7CFCFFFF  FLD QWORD PTR SS:[EBP-384]0040A608   . DC85 34FFFFFF  FADD QWORD PTR SS:[EBP-CC]0040A60E   . DD5D 84        FSTP QWORD PTR SS:[EBP-7C]0040A611   . DFE0           FSTSW AX0040A613   . A8 0D          TEST AL,0D0040A615   . 0F85 D10A0000  JNZ Andréna.0040B0EC0040A61B   . FF15 94104000  CALL DWORD PTR DS:[<&MSVBVM60.#572>]     ;  MSVBVM60.rtcHexBstrFromVar0040A621   . 8985 74FFFFFF  MOV DWORD PTR SS:[EBP-8C],EAX0040A627   . 8D55 CC        LEA EDX,DWORD PTR SS:[EBP-34]0040A62A   . 8D85 6CFFFFFF  LEA EAX,DWORD PTR SS:[EBP-94]0040A630   . 52             PUSH EDX0040A631   . 8D8D 5CFFFFFF  LEA ECX,DWORD PTR SS:[EBP-A4]0040A637   . 50             PUSH EAX0040A638   . 51             PUSH ECX0040A639   . C785 6CFFFFFF >MOV DWORD PTR SS:[EBP-94],80040A643   . FF15 84104000  CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarCa>;  MSVBVM60.__vbaVarCat0040A649   . 8BD0           MOV EDX,EAX0040A64B   . 8D4D CC        LEA ECX,DWORD PTR SS:[EBP-34]0040A64E   . FFD7           CALL EDI0040A650   . 8D55 B0        LEA EDX,DWORD PTR SS:[EBP-50]0040A653   . 8D45 B4        LEA EAX,DWORD PTR SS:[EBP-4C]0040A656   . 52             PUSH EDX0040A657   . 8D4D B8        LEA ECX,DWORD PTR SS:[EBP-48]0040A65A   . 50             PUSH EAX0040A65B   . 51             PUSH ECX0040A65C   . 6A 03          PUSH 30040A65E   . FF15 9C104000  CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>;  MSVBVM60.__vbaFreeStrList0040A664   . 8D95 6CFFFFFF  LEA EDX,DWORD PTR SS:[EBP-94]0040A66A   . 8D85 7CFFFFFF  LEA EAX,DWORD PTR SS:[EBP-84]0040A670   . 52             PUSH EDX0040A671   . 8D4D 8C        LEA ECX,DWORD PTR SS:[EBP-74]0040A674   . 50             PUSH EAX0040A675   . 8D55 9C        LEA EDX,DWORD PTR SS:[EBP-64]0040A678   . 51             PUSH ECX0040A679   . 52             PUSH EDX0040A67A   . 6A 04          PUSH 40040A67C   . FF15 14104000  CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>;  MSVBVM60.__vbaFreeVarList0040A682   . 83C4 24        ADD ESP,240040A685   . 8D85 C8FDFFFF  LEA EAX,DWORD PTR SS:[EBP-238]0040A68B   . 50             PUSH EAX0040A68C   . 8D8D D8FDFFFF  LEA ECX,DWORD PTR SS:[EBP-228]0040A692   . 8D55 DC        LEA EDX,DWORD PTR SS:[EBP-24]0040A695   . 51             PUSH ECX0040A696   . 52             PUSH EDX0040A697   . FF15 C8104000  CALL DWORD PTR DS:[<&MSVBVM60.__vbaVarFo>;  MSVBVM60.__vbaVarForNext0040A69D   .^E9 CFFEFFFF    JMP Andréna.0040A571

收获：

几个VB函数，一些浮点数有关的命令。