|
maybe you are wrong? i see really no difference and came to the following:
OEP: 4EB139
Stolen bytes:
004EB139 >/$ 55 PUSH EBP
004EB13A |. 8BEC MOV EBP,ESP
004EB13C |. 83EC 14 SUB ESP,14
004EB13F |. 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
004EB142 |. 51 PUSH ECX
004EB143 |. B8 C8AB4E00 MOV EAX,dumped_.004EABC8
IAT is attached.
The program works fully registered then (Registered to tA, don't ask why).
Edit:
i was wrong, it only works registered with filename "dumped_.exe"
Last edited by MaRKuS-DJM; 01-17-2004 at 19:25.
|