10001961 | 55 | push ebp | 10001962 | 8BEC | mov ebp, esp | 10001964 | 81EC C3000000 | sub esp, C3 | 1000196A | E8 E43E0000 | call magicskin.10005853 | 1000196F | 50 | push eax | 10001970 | 8D4D E8 | lea ecx,dword ptr ss:[ebp-18] | [ebp-18]:EntryPoint 10001973 | E8 EC3D0000 | call <JMP.& Ordinal#6467> | 10001978 | 8B45 0C | mov eax,dword ptr ss:[ebp+C] | 1000197B | 50 | push eax | 1000197C | 8D4D F4 | lea ecx,dword ptr ss:[ebp-C] | 1000197F | E8 F23D0000 | call <JMP.& Ordinal#537> | 10001984 | 8D4D F4 | lea ecx,dword ptr ss:[ebp-C] | 10001987 | E8 44390000 | call magicskin.100052D0 | 1000198C | 83F8 23 | cmp eax,23 | 23:'#' 1000198F | 7D 1F | jge magicskin.100019B0 | 10001991 | C745 D0 00000000 | mov dword ptr ss:[ebp-30],0 | 10001998 | 8D4D F4 | lea ecx,dword ptr ss:[ebp-C] | 1000199B | E8 BE3D0000 | call <JMP.& Ordinal#800> | 100019A0 | 8D4D E8 | lea ecx,dword ptr ss:[ebp-18] | [ebp-18]:EntryPoint 100019A3 | E8 783A0000 | call magicskin.10005420 | 100019A8 | 8B45 D0 | mov eax,dword ptr ss:[ebp-30] | 100019AB | E9 95070000 | jmp magicskin.10002145 | 100019B0 | 68 44700010 | push magicskin.10007044 | 10007044:"MS_CheckSN" 100019B5 | FF15 20600010 | call dword ptr ds:[<&OutputDebugStringA>] | 100019BB | 68 50700010 | push magicskin.10007050 | 10007050:"80108-04184-21851-84292-60217" 100019C0 | 8D4D F4 | lea ecx,dword ptr ss:[ebp-C] | 100019C3 | E8 A83D0000 | call <JMP.& Ordinal#2764> | 100019C8 | 8945 F0 | mov dword ptr ss:[ebp-10], eax | 100019CB | 837D F0 FF | cmp dword ptr ss:[ebp-10], FFFFFFFF | 100019CF | 7E 1F | jle magicskin.100019F0 | 100019D1 | C745 CC 00000000 | mov dword ptr ss:[ebp-34],0 | 100019D8 | 8D4D F4 | lea ecx,dword ptr ss:[ebp-C] | 100019DB | E8 7E3D0000 | call <JMP.& Ordinal#800> | 100019E0 | 8D4D E8 | lea ecx,dword ptr ss:[ebp-18] | [ebp-18]:EntryPoint 100019E3 | E8 383A0000 | call magicskin.10005420 | 100019E8 | 8B45 CC | mov eax,dword ptr ss:[ebp-34] | 100019EB | E9 55070000 | jmp magicskin.10002145 | 100019F0 | 68 70700010 | push magicskin.10007070 | 10007070:"16948-10409-21851-90517-97056" 100019F5 | 8D4D F4 | lea ecx,dword ptr ss:[ebp-C] | 100019F8 | E8 733D0000 | call <JMP.& Ordinal#2764> | 100019FD | 8945 F0 | mov dword ptr ss:[ebp-10], eax | 10001A00 | 837D F0 FF | cmp dword ptr ss:[ebp-10], FFFFFFFF | 10001A04 | 7E 1F | jle magicskin.10001A25 | 10001A06 | C745 C8 00000000 | mov dword ptr ss:[ebp-38],0 | 10001A0D | 8D4D F4 | lea ecx,dword ptr ss:[ebp-C] | 10001A10 | E8 493D0000 | call <JMP.& Ordinal#800> | 10001A15 | 8D4D E8 | lea ecx,dword ptr ss:[ebp-18] | [ebp-18]:EntryPoint 10001A18 | E8 033A0000 | call magicskin.10005420 | 10001A1D | 8B45 C8 | mov eax,dword ptr ss:[ebp-38] | 10001A20 | E9 20070000 | jmp magicskin.10002145 | 10001A25 | 68 90700010 | push magicskin.10007090 | 10007090:"15918-14036-21839-94144-96026" 10001A2A | 8D4D F4 | lea ecx,dword ptr ss:[ebp-C] | 10001A2D | E8 3E3D0000 | call <JMP.& Ordinal#2764> | 10001A32 | 8945 F0 | mov dword ptr ss:[ebp-10], eax | 10001A35 | 837D F0 FF | cmp dword ptr ss:[ebp-10], FFFFFFFF | 10001A39 | 7E 1F | jle magicskin.10001A5A | 10001A3B | C745 C4 00000000 | mov dword ptr ss:[ebp-3C],0 | 10001A42 | 8D4D F4 | lea ecx,dword ptr ss:[ebp-C] | 10001A45 | E8 143D0000 | call <JMP.& Ordinal#800> | 10001A4A | 8D4D E8 | lea ecx,dword ptr ss:[ebp-18] | [ebp-18]:EntryPoint 10001A4D | E8 CE390000 | call magicskin.10005420 | 10001A52 | 8B45 C4 | mov eax,dword ptr ss:[ebp-3C] | 10001A55 | E9 EB060000 | jmp magicskin.10002145 | 10001A5A | 6A 05 | push 5 | 10001A5C | 6A 00 | push 0 | 10001A5E | 8D4D C0 | lea ecx,dword ptr ss:[ebp-40] | [ebp-40]:EntryPoint 10001A61 | 51 | push ecx | 10001A62 | 8D4D F4 | lea ecx,dword ptr ss:[ebp-C] | 10001A65 | E8 003D0000 | call <JMP.& Ordinal#4278> | 10001A6A | 8BC8 | mov ecx, eax | 10001A6C | E8 9F380000 | call magicskin.10005310 | 10001A71 | 50 | push eax | 10001A72 | FF15 4C610010 | call dword ptr ds:[<&atoi>] | 10001A78 | 83C4 04 | add esp,4 |
Address=10001961 Module/Label/Exception=<magicskin. dll MS_CheckSN> Status=Disabled Disassembly=mov eax, 1 Hit=0
Frame 524: 407 bytes on wire (3256 bits), 407 bytes captured (3256 bits) on interface \Device\NPF_{B5335650-0F4B-471E-A4A7-F5A1A5CEDF5C}, id 0 Ethernet II, Src: Micro-St_70:3f:02 (2c:f0:5d:70:3f:02), Dst: Tp-LinkT_d1:35:51 (64:6e:97:d1:35:51) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 208.113.197.77 Transmission Control Protocol, Src Port: 58303, Dst Port: 80, Seq: 1, Ack: 1, Len: 353 Hypertext Transfer Protocol GET /webtools/livecheck/UploadKeyInfo.php?key=11296-33295-21851-83403-61404-37374&mail=root@obaby.org.cn&os=none(64)&lan=chinese(simplified)&mac=4109315518&vnum=4&rand=20220508103639 HTTP/1.1\r\n Host: gilisoft.com\r\n User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1a2pre) Gecko/2008073000 Shredder/3.0a2pre ThunderBrowse/3.2.1.8\r\n Accept: */*\r\n \r\n [Full request URI: http://gilisoft.com/webtools/livecheck/UploadKeyInfo.php?key=11296-33295-21851-83403-61404-37374&mail=root@obaby.org.cn&os=none(64)&lan=chinese(simplified)&mac=4109315518&vnum=4&rand=20220508103639] [HTTP request 1/1] [Response in frame: 527] Address=012CF54D Disassembly=push verify.12CF740 String=L "http://giliso. com/webtools/livecheck/IsValidKey. php? Key="
0070FB22 | E8 05CDFFFF | call videoeditor_rep.70C82C | Pop up error 0070FB27 | 833D 88D37200 00 | cmp dword ptr ds:[72D388],0 | 0070FB2E | 74 0D | je videoeditor_rep.70FB3D | 0070FB30 | 8B87 1C050000 | mov eax,dword ptr ds:[edi+51C] | 0070FB36 | B2 01 | mov dl,1 | 0070FB38 | E8 AB18E7FF | call videoeditor_rep.5813E8 | 0070FB3D | 33C0 | xor eax, eax | 0070FB3F | 5A | pop edx | 0070FB40 | 59 | pop ecx | ecx:&"0HXT Fang VT" 0070FB41 | 59 | pop ecx | ecx:&"0HXT Fang VT" 0070FB42 | 64:8910 | mov dword ptr fs:[eax], edx | 0070FB45 | 68 6CFB7000 | push videoeditor_rep.70FB6C | 0070FB4A | 8D45 AC | lea eax,dword ptr ss:[ebp-54] | [ebp-54]:L"-Music Chinese(Simplified)" 0070FB4D | BA 03000000 | mov edx,3 | 0070FB52 | E8 CDA2CFFF | call videoeditor_rep.409E24 | 0070FB57 | 8D45 F4 | lea eax,dword ptr ss:[ebp-C] | [ebp-C]:L"SubFun.exe" 0070FB5A | BA 03000000 | mov edx,3 | 0070FB5F | E8 C0A2CFFF | call videoeditor_rep.409E24 | 0070FB64 | C3 | ret | 0070FB65 | E9 3A98CFFF | jmp videoeditor_rep.4093A4 | 0070FB6A | EB DE | jmp videoeditor_rep.70FB4A | 0070FB6C | 8BC3 | mov eax, ebx | 0070FB6E | 5F | pop edi | 0070FB6F | 5E | pop esi | 0070FB70 | 5B | pop ebx | 0070FB71 | 8BE5 | mov esp, ebp | 0070C82C | 55 | push ebp | 70C82C function interior 0070C82D | 8BEC | mov ebp, esp | 0070C82F | B9 07000000 | mov ecx, 7 | ecx:&"0HXT Fang VT" 0070C834 | 6A 00 | push 0 | 0070C836 | 6A 00 | push 0 | 0070C838 | 49 | dec ecx | ecx:&"0HXT VT" 0070C839 | 75 F9 | jne videoeditor_rep.70C834 | 0070C83B | 53 | push ebx | 0070C83C | 56 | push esi | 0070C83D | 8BF2 | mov esi, edx | 0070C83F | 8BD8 | mov ebx, eax | 0070C841 | 33C0 | xor eax, eax | 0070C843 | 55 | push ebp | 0070C844 | 68 D6CD7000 | push videoeditor_rep.70CDD6 | 0070C849 | 64:FF30 | push dword ptr fs:[eax] | 0070C84C | 64:8920 | mov dword ptr fs:[eax], esp | 0070C84F | 833D 88D37200 01 | cmp dword ptr ds:[72D388],1 | 0070C856 | 1BD2 | sbb edx, edx | 0070C858 | 42 | inc edx | 0070C859 | 8B83 F0040000 | mov eax,dword ptr ds:[ebx+4F0] | 0070C85F | E8 301BE4FF | call videoeditor_rep.54E394 | 0070C864 | 833D 88D37200 00 | cmp dword ptr ds:[72D388],0 | 0070C86B | 0F84 B9010000 | je videoeditor_rep.70CA2A | 0070C871 | 85F6 | test esi, esi | 0070C873 | 74 32 | je videoeditor_rep.70C8A7 | 0070C875 | 68 F0CD7000 | push videoeditor_rep.70CDF0 | 70CDF0:L"???" 0070C87A | 8D45 F8 | lea eax,dword ptr ss:[ebp-8] | [ebp-8]:L"-Music" 0070C87D | 50 | push eax | 0070C87E | B9 04CE7000 | mov ecx, videoeditor_rep.70CE04 | ecx:&"0HXT Fang VT", 70CE04: L "strVip" 0070C883 | BA 20CE7000 | mov edx,videoeditor_rep.70CE20 | 70CE20:L"msgMain" 0070C888 | A1 58697300 | mov eax,dword ptr ds:[736958] | 00736958:&L"C:\\Users\\obaby\\AppData\\Local\\Temp\\20220509212541547.txt" 0070C88D | E8 BE52F5FF | call videoeditor_rep.661B50 | 0070C892 | 8B83 F0040000 | mov eax,dword ptr ds:[ebx+4F0] | 0070C898 | 8B40 74 | mov eax,dword ptr ds:[eax+74] | 0070C89B | BA FFC60000 | mov edx, C6FF | 0070C8A0 | E8 0B59E1FF | call videoeditor_rep.5221B0 | 0070C8A5 | EB 37 | jmp videoeditor_rep.70C8DE | 0070C8A7 | 68 F0CD7000 | push videoeditor_rep.70CDF0 | 70CDF0:L"???" 0070C8AC | 8D45 F8 | lea eax,dword ptr ss:[ebp-8] | [ebp-8]:L"-Music" 0070C8AF | 50 | push eax | 0070C8B0 | B9 3CCE7000 | mov ecx, videoeditor_rep.70CE3C | ecx:&"0HXT Fang VT", 70CE3C: L "strTrial" 0070C8B5 | BA 20CE7000 | mov edx,videoeditor_rep.70CE20 | 70CE20:L"msgMain" 0070C8BA | A1 58697300 | mov eax,dword ptr ds:[736958] | 00736958:&L"C:\\Users\\obaby\\AppData\\Local\\Temp\\20220509212541547.txt" 0070C8BF | E8 8C52F5FF | call videoeditor_rep.661B50 | 0070C8C4 | 8B83 EC030000 | mov eax,dword ptr ds:[ebx+3EC] | 0070C8CA | 8B40 74 | mov eax,dword ptr ds:[eax+74] |