View Single Post
  #6  
Old 11-26-2011, 15:43
PhreakAccident
 
Posts: n/a
It does look like a form of WinLicense. I used the demo of the latest one to protect the RegisterMe.exe file from Lena's tutorial. While the first part of the code at EP is different, the decrypt is identical.

Code:
005EB05C     85C9               TEST ECX,ECX
005EB05E     74 0A              JE SHORT Register.005EB06A
005EB060     3106               XOR DWORD PTR DS:[ESI],EAX
005EB062     011E               ADD DWORD PTR DS:[ESI],EBX
005EB064     83C6 04           ADD ESI,4
005EB067     49                  DEC ECX
005EB068   ^ EB F2             JMP SHORT Register.005EB05C
The decrypt routine starts at 005EB05C and the decrypted code sits starting at 0051A000. The routine is spot on. Now I just have to work on the manual unpack. Much thanks for the lead!
Reply With Quote