regetjr去除广告条

核心提示： :10011D76 FF15A8820310 Call dword ptr [100382A8]:10011D7C 6685C0 test ax, ax:10011D7F 0F84E6000000 je 10011E6B:10011D85 33C0 xor eax, eax:10011D8

:10011D76 FF15A8820310 Call dword ptr [100382A8]
:10011D7C 6685C0 test ax, ax
:10011D7F 0F84E6000000 je 10011E6B
:10011D85 33C0 xor eax, eax
:10011D87 81CB00000040 or ebx, 40000000
:10011D8D 50 push eax 〈---这写push应该是传递给createwindowex
:10011D8E 50 push eax 参数
:10011D8F 50 push eax
:10011D90 FF7604 push [esi+04]
:10011D93 FFB694060000 push dword ptr [esi+00000694]
:10011D99 FFB690060000 push dword ptr [esi+00000690]
:10011D9F FFB68C060000 push dword ptr [esi+0000068C]
:10011DA5 FFB688060000 push dword ptr [esi+00000688]
:10011DAB 53 push ebx
:10011DAC 6818540410 push 10045418
:10011DB1 57 push edi
:10011DB2 6A24 push 00000024
* Reference To: USER32.CreateWindowExA, Ord:0059h
|
:10011DB4 FF15B0820310 Call dword ptr [100382B0]〈—第四次调用
:10011DBA 33FF xor edi, edi
:10011DBC 894608 mov dword ptr [esi+08], eax
:10011DBF 3BC7 cmp eax, edi
:10011DC1 0F84A4000000 je 10011E6B
:10011DC7 8B4E18 mov ecx, dword ptr [esi+18]
:10011DCA F7C100000010 test ecx, 10000000
:10011DD0 7406 je 10011DD8
:10011DD2 83C904 or ecx, 00000004
:10011DD5 894E18 mov dword ptr [esi+18], ecx
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10011DD0(C)
|
:10011DD8 8B4E18 mov ecx, dword ptr [esi+18]
:10011DDB 83E104 and ecx, 00000004
:10011DDE FEC9 dec cl
:10011DE0 F6D9 neg cl
:10011DE2 1AC9 sbb cl, cl
:10011DE4 FEC1 inc cl
:10011DE6 888EA40A0000 mov byte ptr [esi+00000AA4], cl
:10011DEC 7519 jne 10011E07
:10011DEE 8D8E90060000 lea ecx, dword ptr [esi+00000690]
:10011DF4 51 push ecx
:10011DF5 8D4E20 lea ecx, dword ptr [esi+20]
:10011DF8 FF7610 push [esi+10]
:10011DFB FFB660060000 push dword ptr [esi+00000660]
:10011E01 50 push eax
:10011E02 E83AB40000 call 1001D241
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10011DEC(C)
|
:10011E07 57 push edi
:10011E08 6A64 push 00000064
:10011E0A 6A01 push 00000001
:10011E0C FF7608 push [esi+08]
* Reference To: USER32.SetTimer, Ord:0252h
|
:10011E0F FF15AC820310 Call dword ptr [100382AC]〈-此处调用Settimer
:10011E15 F6461808 test [esi+18], 08
:10011E19 8986E4050000 mov dword ptr [esi+000005E4], eax
:10011E1F 7514 jne 10011E35
:10011E21 6A05 push 00000005
:10011E23 FF7608 push [esi+08]
* Reference To: USER32.ShowWindow, Ord:026Ah
|
:10011E26 FF159C820310 Call dword ptr [1003829C]<--此处调用showwindow
:10011E2C FF7608 push [esi+08]
* Reference To: USER32.UpdateWindow, Ord:0291h
|
:10011E2F FF15A4820310 Call dword ptr [100382A4]<--此处调用updatewindow
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10011E1F(C)
|
:10011E35 F6461908 test [esi+19], 08
:10011E39 7530 jne 10011E6B
* Reference To: USER32.GetMessageA, Ord:012Ah
|
:10011E3B 8B35A0820310 mov esi, dword ptr [100382A0]<--此处将sendmessage

的地址传递给esi;

:10011E41 57 push edi
:10011E42 57 push edi
:10011E43 8D45E4 lea eax, dword ptr [ebp-1C]
:10011E46 57 push edi
:10011E47 50 push eax

所以将:10011DB4 FF15B0820310 Call dword ptr [100382B0] nop掉就可以了，或者

将:10011D8D 50 push eax 改为跳转语句跳到:10011E3B这里就行了。

修改之后广告条消息，而且点击之后也没有反应，成功了！！！

（不过我没有测试该软件是否好用）