004013D2 /$ 56                PUSH ESI                                    ; ESI入栈
004013D3 |. 33C0              XOR EAX,EAX                                 ; EAX清零
004013D5 |. 8D35 C4334000     LEA ESI,DWORD PTR DS:[4033C4]               ; 把注册码框中的数值送到ESI
004013DB |. 33C9              XOR ECX,ECX                                 ; ECX清零
004013DD |. 33D2              XOR EDX,EDX                                 ; EDX清零
004013DF |. 8A06              MOV AL,BYTE PTR DS:[ESI]                    ; 把注册码中的每个字符送到AL
004013E1 |. 46                INC ESI                                     ; 指针加1，指向下一个字符
004013E2 |. 3C 2D             CMP AL,2D                                   ; 把取得的字符与16进制值为2D的字符(即“-”)比较，这里主要用于判断输入的是不是负数
004013E4 |. 75 08             JNZ SHORT CrackHea.004013EE                 ; 不等则跳
004013E6 |. BA FFFFFFFF       MOV EDX,-1                                  ; 如果输入的是负数，则把-1送到EDX，即16进制FFFFFFFF
004013EB |. 8A06              MOV AL,BYTE PTR DS:[ESI]                    ; 取“-”号后的第一个字符
004013ED |. 46                INC ESI                                     ; 指针加1，指向再下一个字符
004013EE |> EB 0B             JMP SHORT CrackHea.004013FB
004013F0 |> 2C 30             SUB AL,30                                   ; 每位字符减16进制的30，因为这里都是数字，如1的ASCII码是“31H”，减30H后为1，即我们平时看到的数值
004013F2 |. 8D0C89            LEA ECX,DWORD PTR DS:[ECX+ECX*4]            ; 把前面运算后保存在ECX中的结果乘5再送到ECX
004013F5 |. 8D0C48            LEA ECX,DWORD PTR DS:[EAX+ECX*2]            ; 每位字符运算后的值与2倍上一位字符运算后值相加后送ECX
004013F8 |. 8A06              MOV AL,BYTE PTR DS:[ESI]                    ; 取下一个字符
004013FA |. 46                INC ESI                                     ; 指针加1，指向再下一个字符
004013FB |> 0AC0              OR AL,AL
004013FD |.^ 75 F1            JNZ SHORT CrackHea.004013F0                 ; 上面一条和这一条指令主要是用来判断是否已把用户输入的注册码计算完
004013FF |. 8D040A            LEA EAX,DWORD PTR DS:[EDX+ECX]              ; 把EDX中的值与经过上面运算后的ECX中值相加送到EAX
00401402 |. 33C2              XOR EAX,EDX                                 ; 把EAX与EDX异或。如果我们输入的是负数，则此处功能就是把EAX中的值取反
00401404 |. 5E                POP ESI                                     ; ESI出栈。看到这条和下一条指令，我们要考虑一下这个ESI的值是哪里运算得出的呢？
00401405 |. 81F6 53757A79     XOR ESI,797A7553                            ; 把ESI中的值与797A7553H异或
0040140B \. C3                RETN
-------------------------------------------------------------------------------------------

0040140C /$ 60                 PUSHAD
0040140D |. 6A 00              PUSH 0                                      ; /RootPathName = NULL
0040140F |. E8 B4000000        CALL <JMP.&KERNEL32.GetDriveTypeA>          ; \GetDriveTypeA
00401414 |. A2 EC334000        MOV BYTE PTR DS:[4033EC],AL                 ; 磁盘类型参数送内存地址4033EC
00401419 |. 6A 00              PUSH 0                                      ; /pFileSystemNameSize = NULL
0040141B |. 6A 00              PUSH 0                                      ; |pFileSystemNameBuffer = NULL
0040141D |. 6A 00              PUSH 0                                      ; |pFileSystemFlags = NULL
0040141F |. 6A 00              PUSH 0                                      ; |pMaxFilenameLength = NULL
00401421 |. 6A 00              PUSH 0                                      ; |pVolumeSerialNumber = NULL
00401423 |. 6A 0B              PUSH 0B                                     ; |MaxVolumeNameSize = B (11.)
00401425 |. 68 9C334000        PUSH CrackHea.0040339C                      ; |VolumeNameBuffer = CrackHea.0040339C
0040142A |. 6A 00              PUSH 0                                      ; |RootPathName = NULL
0040142C |. E8 A3000000        CALL <JMP.&KERNEL32.GetVolumeInformationA>  ; \GetVolumeInformationA
00401431 |. 8D35 9C334000      LEA ESI,DWORD PTR DS:[40339C]               ; 把crackme程序所在分区的卷标名称送到ESI
00401437 |. 0FB60D EC334000    MOVZX ECX,BYTE PTR DS:[4033EC]              ; 磁盘类型参数送ECX
0040143E |. 33FF               XOR EDI,EDI                                 ; 把EDI清零
00401440 |> 8BC1               MOV EAX,ECX                                 ; 磁盘类型参数送EAX
00401442 |. 8B1E               MOV EBX,DWORD PTR DS:[ESI]                  ; 把卷标名作为数值送到 EBX
00401444 |. F7E3               MUL EBX                                     ; 循环递减取磁盘类型参数值与卷标名值相乘
00401446 |. 03F8               ADD EDI,EAX                                 ; 每次计算结果再加上上次计算结果保存在EDI中
00401448 |. 49                 DEC ECX                                     ; 把磁盘类型参数作为循环次数，依次递减
00401449 |. 83F9 00            CMP ECX,0                                   ; 判断是否计算完
0040144C |.^ 75 F2             JNZ SHORT CrackHea.00401440                 ; 没完继续
0040144E |. 893D 9C334000      MOV DWORD PTR DS:[40339C],EDI               ; 把计算后值送到内存地址40339C，这就是我们后来在ESI中看到的值
00401454 |. 61                 POPAD
00401455 \. C3                 RETN