00404D38 . E8 E1050000 CALL CrocChem.0040531E ; //dans ce call, on recup le nb jour restant en base 16 (4-bytes) 00404D3D . B9 80510100 MOV ECX,15180 ; //15180 (base16)s -> 86400(base10)s -> 24(base10)jours 00404D42 8B00 MOV EAX,DWORD PTR DS:[EAX] ; //charge nb jours en base 16 (4-bytes) restant à partir pointeur EAX (fixer ce pointeur en hard si possible pour bloquer la trial) 00404D44 99 CDQ ; //Convert Double to Quad 00404D45 F7F9 IDIV ECX ; //Signed Integer Division 00404D47 8BF8 MOV EDI,EAX 00404D49 . 85FF TEST EDI,EDI ; //reste-il des jours? 00404D4B . 7F 52 JG SHORT CrocChem.00404D9F ; //le plus simple est de patcher jmp ici, mais c'est pas propre ;p 00404D4D . 6A FF PUSH -1 00404D4F . 56 PUSH ESI 00404D50 . 68 79F00000 PUSH 0F079 00404D55 . E8 10C10900 CALL ; //demo out message box 00404D5A . C645 FC 05 MOV BYTE PTR SS:[EBP-4],5 00404D5E . E8 5A050000 CALL CrocChem.004052BD 00404D63 . C645 FC 04 MOV BYTE PTR SS:[EBP-4],4 00404D67 . E8 59050000 CALL CrocChem.004052C5 00404D6C . C645 FC 03 MOV BYTE PTR SS:[EBP-4],3 00404D70 . E8 58050000 CALL CrocChem.004052CD 00404D75 . C645 FC 02 MOV BYTE PTR SS:[EBP-4],2 00404D79 . E8 57050000 CALL CrocChem.004052D5 00404D7E . C745 FC FFFFFF>MOV DWORD PTR SS:[EBP-4],-1 00404D85 . E8 53050000 CALL CrocChem.004052DD 00404D8A .^E9 52FCFFFF JMP CrocChem.004049E1 00404D8F $ 8D4D F0 LEA ECX,DWORD PTR SS:[EBP-10] 00404D92 . E9 95BF0900 JMP 00404D97 $ 8D4D F0 LEA ECX,DWORD PTR SS:[EBP-10] 00404D9A . E9 8DBF0900 JMP 00404D9F > 83EC 04 SUB ESP,4 00404DA2 . 8D45 A8 LEA EAX,DWORD PTR SS:[EBP-58] 00404DA5 . 8965 F0 MOV DWORD PTR SS:[EBP-10],ESP 00404DA8 . 50 PUSH EAX 00404DA9 . 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10] 00404DAC . E8 60050000 CALL CrocChem.00405311 00404DB1 . 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48] 00404DB4 . E8 95050000 CALL CrocChem.0040534E 00404DB9 . 85C0 TEST EAX,EAX 00404DBB . 74 43 JE SHORT CrocChem.00404E00 ; //patcher jmp ici aussi 00404DBD . 6A FF PUSH -1 00404DBF . 6A 00 PUSH 0 00404DC1 . 68 79F00000 PUSH 0F079 00404DC6 . E8 9FC00900 CALL 00404DCB . C645 FC 05 MOV BYTE PTR SS:[EBP-4],5 00404DCF . E8 E9040000 CALL CrocChem.004052BD 00404DD4 . C645 FC 04 MOV BYTE PTR SS:[EBP-4],4 00404DD8 . E8 E8040000 CALL CrocChem.004052C5 00404DDD . C645 FC 03 MOV BYTE PTR SS:[EBP-4],3 00404DE1 . E8 E7040000 CALL CrocChem.004052CD 00404DE6 . C645 FC 02 MOV BYTE PTR SS:[EBP-4],2 00404DEA . E8 E6040000 CALL CrocChem.004052D5 00404DEF . C745 FC FFFFFF>MOV DWORD PTR SS:[EBP-4],-1 00404DF6 . E8 E2040000 CALL CrocChem.004052DD 00404DFB .^E9 E1FBFFFF JMP CrocChem.004049E1 00404E00 > 83EC 04 SUB ESP,4 00404E03 . 8D45 AC LEA EAX,DWORD PTR SS:[EBP-54] 00404E06 . 8965 F0 MOV DWORD PTR SS:[EBP-10],ESP 00404E09 . 50 PUSH EAX 00404E0A . 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10] 00404E0D . E8 FF040000 CALL CrocChem.00405311 00404E12 . 8D4D B8 LEA ECX,DWORD PTR SS:[EBP-48] 00404E15 . E8 22050000 CALL CrocChem.0040533C 00404E1A . 85C0 TEST EAX,EAX 00404E1C . 74 43 JE SHORT CrocChem.00404E61 00404E1E . 6A FF PUSH -1 00404E20 . 6A 00 PUSH 0 00404E22 . 68 79F00000 PUSH 0F079 00404E27 . E8 3EC00900 CALL 00404E2C . C645 FC 05 MOV BYTE PTR SS:[EBP-4],5 00404E30 . E8 88040000 CALL CrocChem.004052BD 00404E35 . C645 FC 04 MOV BYTE PTR SS:[EBP-4],4 00404E39 . E8 87040000 CALL CrocChem.004052C5 00404E3E . C645 FC 03 MOV BYTE PTR SS:[EBP-4],3 00404E42 . E8 86040000 CALL CrocChem.004052CD 00404E47 . C645 FC 02 MOV BYTE PTR SS:[EBP-4],2 00404E4B . E8 85040000 CALL CrocChem.004052D5 00404E50 . C745 FC FFFFFF>MOV DWORD PTR SS:[EBP-4],-1 00404E57 . E8 81040000 CALL CrocChem.004052DD 00404E5C .^E9 80FBFFFF JMP CrocChem.004049E1 00404E61 > 68 28CC4B00 PUSH CrocChem.004BCC28 ; /s2 = "0" 00404E66 . 893D DCCA4B00 MOV DWORD PTR DS:[4BCADC],EDI ; | 00404E6C . FF75 D4 PUSH DWORD PTR SS:[EBP-2C] ; |s1 00404E6F . FF15 A8954C00 CALL DWORD PTR DS:[<&MSVCRT40._mbscmp>] ; \_mbscmp 00404E75 . 83C4 08 ADD ESP,8 00404E78 . 85C0 TEST EAX,EAX 00404E7A . 74 15 JE SHORT CrocChem.00404E91 00404E7C . 68 C4CA4B00 PUSH CrocChem.004BCAC4 ; /s2 = "" 00404E81 . FF75 D4 PUSH DWORD PTR SS:[EBP-2C] ; |s1 00404E84 . FF15 A8954C00 CALL DWORD PTR DS:[<&MSVCRT40._mbscmp>] ; \_mbscmp 00404E8A . 83C4 08 ADD ESP,8 00404E8D . 85C0 TEST EAX,EAX 00404E8F 75 0A JNZ SHORT CrocChem.00404E9B 00404E91 > C705 D8CA4B00 >MOV DWORD PTR DS:[4BCAD8],1 ; //student version 00404E9B > 68 24CC4B00 PUSH CrocChem.004BCC24 00404EA0 . 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-30] 00404EA3 . 68 D8214A00 PUSH CrocChem.004A21D8 ; ASCII "Drive:" 00404EA8 . 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14] 00404EAB . 68 D0214A00 PUSH CrocChem.004A21D0 ; ASCII "CD-ROM" //call ou le nombre de jours est récupéré 0040531E /$ 8B09 MOV ECX,DWORD PTR DS:[ECX] 00405320 |. 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; //recupere l'adresse du pointeur utilisé ci dessous 00405324 |. 2B4C24 08 SUB ECX,DWORD PTR SS:[ESP+8] ; 00405328 |. 8908 MOV DWORD PTR DS:[EAX],ECX ; //ecrit nb de jour en base16 dans le pointeur adresse EAX 0040532A \. C2 0800 RETN 8