because the keys in the ini file are leaked MAK and Retail keys ... they were not generated by the algorithm.
Maybe pkey2005 and pkey2009 algo use the same byte table to convert characters. CPU Disasm Address Hex dump Command Comments 64BC9CB7 /$ 0FB7C0 MOVZX EAX,AX 64BC9CBA |. 83C0 D3 ADD EAX,-2D ; Switch (cases 2D..79, 26. exits) 64BC9CBD |. 83F8 4C CMP EAX,4C 64BC9CC0 |. 77 71 JA SHORT 64BC9D33 64BC9CC2 |. 0FB680 9F9DBC MOVZX EAX,BYTE PTR DS:[EAX+64BC9D9F] 64BC9CC9 |. FF2485 379DBC JMP DWORD PTR DS:[EAX*4+64BC9D37] 64BC9CD0 |> 33C0 XOR EAX,EAX ; Cases 42 ('B'), 62 ('b') of switch pidgenx.64BC9CBA 64BC9CD2 |. C3 RETN 64BC9CD3 |> 33C0 XOR EAX,EAX ; Cases 43 ('C'), 63 ('c') of switch pidgenx.64BC9CBA 64BC9CD5 |. 40 INC EAX 64BC9CD6 |. C3 RETN 64BC9CD7 |> 6A 02 PUSH 2 ; Cases 44 ('D'), 64 ('d') of switch pidgenx.64BC9CBA 64BC9CD9 |. 58 POP EAX 64BC9CDA |. C3 RETN 64BC9CDB |> 6A 03 PUSH 3 ; Cases 46 ('F'), 66 ('f') of switch pidgenx.64BC9CBA 64BC9CDD |. 58 POP EAX 64BC9CDE |. C3 RETN 64BC9CDF |> 6A 04 PUSH 4 ; Cases 47 ('G'), 67 ('g') of switch pidgenx.64BC9CBA 64BC9CE1 |. 58 POP EAX 64BC9CE2 |. C3 RETN 64BC9CE3 |> 6A 05 PUSH 5 ; Cases 48 ('H'), 68 ('h') of switch pidgenx.64BC9CBA 64BC9CE5 |. 58 POP EAX 64BC9CE6 |. C3 RETN 64BC9CE7 |> 6A 06 PUSH 6 ; Cases 4A ('J'), 6A ('j') of switch pidgenx.64BC9CBA 64BC9CE9 |. 58 POP EAX 64BC9CEA |. C3 RETN 64BC9CEB |> 6A 07 PUSH 7 ; Cases 4B ('K'), 6B ('k') of switch pidgenx.64BC9CBA 64BC9CED |. 58 POP EAX 64BC9CEE |. C3 RETN 64BC9CEF |> 6A 08 PUSH 8 ; Cases 4D ('M'), 6D ('m') of switch pidgenx.64BC9CBA 64BC9CF1 |. 58 POP EAX 64BC9CF2 |. C3 RETN 64BC9CF3 |> 6A 09 PUSH 9 ; Cases 50 ('P'), 70 ('p') of switch pidgenx.64BC9CBA 64BC9CF5 |. 58 POP EAX 64BC9CF6 |. C3 RETN 64BC9CF7 |> 6A 0A PUSH 0A ; Cases 51 ('Q'), 71 ('q') of switch pidgenx.64BC9CBA 64BC9CF9 |. 58 POP EAX 64BC9CFA |. C3 RETN 64BC9CFB |> 6A 0B PUSH 0B ; Cases 52 ('R'), 72 ('r') of switch pidgenx.64BC9CBA 64BC9CFD |. 58 POP EAX 64BC9CFE |. C3 RETN 64BC9CFF |> 6A 0C PUSH 0C ; Cases 54 ('T'), 74 ('t') of switch pidgenx.64BC9CBA 64BC9D01 |. 58 POP EAX 64BC9D02 |. C3 RETN 64BC9D03 |> 6A 0D PUSH 0D ; Cases 56 ('V'), 76 ('v') of switch pidgenx.64BC9CBA 64BC9D05 |. 58 POP EAX 64BC9D06 |. C3 RETN 64BC9D07 |> 6A 0E PUSH 0E ; Cases 57 ('W'), 77 ('w') of switch pidgenx.64BC9CBA 64BC9D09 |. 58 POP EAX 64BC9D0A |. C3 RETN 64BC9D0B |> 6A 0F PUSH 0F ; Cases 58 ('X'), 78 ('x') of switch pidgenx.64BC9CBA 64BC9D0D |. 58 POP EAX 64BC9D0E |. C3 RETN 64BC9D0F |> 6A 10 PUSH 10 ; Cases 59 ('Y'), 79 ('y') of switch pidgenx.64BC9CBA 64BC9D11 |. 58 POP EAX 64BC9D12 |. C3 RETN 64BC9D13 |> 6A 11 PUSH 11 ; Case 32 ('2') of switch pidgenx.64BC9CBA 64BC9D15 |. 58 POP EAX 64BC9D16 |. C3 RETN 64BC9D17 |> 6A 12 PUSH 12 ; Case 33 ('3') of switch pidgenx.64BC9CBA 64BC9D19 |. 58 POP EAX 64BC9D1A |. C3 RETN 64BC9D1B |> 6A 13 PUSH 13 ; Case 34 ('4') of switch pidgenx.64BC9CBA 64BC9D1D |. 58 POP EAX 64BC9D1E |. C3 RETN 64BC9D1F |> 6A 14 PUSH 14 ; Case 36 ('6') of switch pidgenx.64BC9CBA 64BC9D21 |. 58 POP EAX 64BC9D22 |. C3 RETN 64BC9D23 |> 6A 15 PUSH 15 ; Case 37 ('7') of switch pidgenx.64BC9CBA 64BC9D25 |. 58 POP EAX 64BC9D26 |. C3 RETN 64BC9D27 |> 6A 16 PUSH 16 ; Case 38 ('8') of switch pidgenx.64BC9CBA 64BC9D29 |. 58 POP EAX 64BC9D2A |. C3 RETN 64BC9D2B |> 6A 17 PUSH 17 ; Case 39 ('9') of switch pidgenx.64BC9CBA 64BC9D2D |. 58 POP EAX 64BC9D2E |. C3 RETN 64BC9D2F |> 6A 18 PUSH 18 ; Case 2D ('-') of switch pidgenx.64BC9CBA 64BC9D31 |. 58 POP EAX 64BC9D32 |. C3 RETN 64BC9D33 |> 6A 19 PUSH 19 ; Default case of switch pidgenx.64BC9CBA 64BC9D35 |. 58 POP EAX 64BC9D36 \. C3 RETN
@woot332 Yes it's very likely the same because the characters were choosen to easily differentiate them and they are simply in alphabetical order.
@woot332 Looks like base 24 conversion but I'm not completely sure Code: movzx ecx, byte ptr ss:[edi+ebp-30] // load byte into ecx xor esi, esi // esi = 0 test edx, edx // set ZF to 1 if edx == 0 je short 688a99cf // jump if ZF == 1 movzx eax, byte ptr ss:[esi+ebp-14] // load byte into eax imul eax, eax, 18 // eax *= 18 (dec: 24) add ecx, eax // ecx += eax mov byte ptr ss:[esi+ebp-14], cl // ptr = ecx (8bit) shr ecx, 8 // right shift ecx by 8 inc esi // esi += 1 cmp esi, edx // esi == edx ? jb short 688a99b9 // jump if below test ecx, ecx // set ZF to 1 if ecx == 0 je short 688a99dd // jump if equal cmp edx, 10 // edx == 10 ? jnb short 688a9972 // jump if not below mov byte ptr ss:[edx+ebp-14], cl // ptr = ecx (8bit) inc edx // edx += 1 inc edi // edi += 1 cmp edi, 19 // edi == 19 ? (dec: 25) jb short 688a99ae // jump if below @heldigard It's nearly impossible to find a pattern by looking at confirmationid's
Should be in theory possible to make a CID generator, ignoring validation, even for keygenned keys (I bet you could even phone activate stuff using Deposit CID function that shouldn't be phone activatable, like KMS, sort of how we can KMS ProWMC which is prevented by normal procedure). In practice it may be way too far protected to ever expect one to see the light of day. Someone did make an XP keygen because someone at MS leaked secrets. Such a thing could happen again but is extremely unlikely and illegal as all hell for the guy that leaks it. Those keys still didn't pass validation but worked if you didn't validate. So one would expect no matter what to not fool validation, MS likely has a database of legit keys anyway.
same thing once again a repack of the work Bob has done in this thread. what's with all the grasping at straws? Mods should clean up the crap that has come to this thread in past week !!
I ask myself if it might be usefull to gather secret hashes from valid keys (e.g. dreamspark) in certain keyranges? (Win7 related) In Embedded it is possible to activate completly offline (Volume:BA) ... might it be usefull to gather Extended-PID (Date Based) and Installation IDs? (Same PKEY but different install dates .e.g. 1 month = 30/31 matching data - reverse calculation?) Is there some keygen/keyinfo.exe for Win7 with the same flexibility (group, keyrange, secrehthash)? I also have PIDs that increment by +1 (have 2-3 pairs) if this can help or is usefull. PID: xxxxx668, PID: xxxxx669
@deagles yeah your right its just base 24 conversion I guess just 2 hw breakpoints would be too easy. And this could be the hash check part based on what bob65536 posted key2 and key3. If so then maybe its just a matter of side comparing them one with N char and one without. View attachment 24402 View attachment 24403
Looks very similar Code: memcpy_s(key3,16,key2,16); key3[12]&=0x7f; key3[13]=0; key3[14]&=0xf6; check->uch[0]=(key2[13] << 1) | (key2[12] >> 7); check->uch[1]=((key2[14] << 1) | (key2[13] >> 7)) & 3; Code: MOVS DWORD PTR ES:[EDI], DWORD PTR DS:[ESI] // MOVS DWORD PTR ES:[EDI], DWORD PTR DS:[ESI] // MOVS DWORD PTR ES:[EDI], DWORD PTR DS:[ESI] // MOVS DWORD PTR ES:[EDI], DWORD PTR DS:[ESI] // memcpy_s(key3,16,key2,16) MOV CH, BYTE PTR SS:[EBP-6] // CH = key2[14] MOV DH, BYTE PTR SS:[EBP-8] // DH = key2[12] MOV AL, CH // AL = key2[14] SHR AL, 3 // AL = key2[14] >> 3 AND AL, 01 // AL = (key2[14] >> 3) & 0x01 XOR EDI, EDI // EDI = 0x00000000 MOV DWORD PTR SS:[EBP-18], EDI // key2[-4] = 0x00000000 MOV BYTE PTR SS:[EBP-18], AL // key2[-4] = (key2[14] >> 3) & 0x01 XOR EAX, EAX // EAX = 0x00000000 CMP DWORD PTR SS:[EBP-18], EAX // (key2[14] >> 3) & 0x01 == 0x00 ? MOV CL, DH // CL = key2[12] SETNE AL // Set byte if not equal (ZF=0) AND CH, 0xF7 // CH = key2[14] & 0xF7 SHR CL, 7 // CL = key2[12] >> 7 AND DH, 0x7F // DH = key2[12] & 0x7F PUSH 10 MOV BYTE PTR SS:[EBP-1A], DH // key2[-6] = key2[12] & 0x7F MOV BYTE PTR SS:{EBP-8], DH // key2[12] = key2[12] & 0x7F MOV DWORD PTR SS:[EBP-18], EAX // key2[-4] = ((key2[14] >> 3) & 0x01 == 0x00) MOV AH, BYTE PTR SS:[EBP-7] // AH = key2[13] AND AL, 0x02 // AL = AL & 0x02 SHL AL, 2 // AL = AL << 2 OR CH, AL // CH = CH | AL MOV AL, AH // AL = key2[13] ADD AL, AL // AL = AL + AL OR CL, AL // CL = CL | AL
@woot332: We should compare the hash table Part 2: Code: UINT hash=-1; UINT index; for(UINT i=0;i<16;++i) { index=((hash >> 24) ^ key3) & 0xff; hash=(hash << 8) ^ g_hash_table[index]; } hash=~hash & 0x3ff; Code: OR ESI, 0xFFFFFFFF // UINT hash=-1; MOVZX EAX, BYTE PTR DS:[EDI] // key3 MOV ECX, ESI // ECX = hash SHR ECX, 18 // ECX = (hash >> 24) XOR ECX, EAX // ECX = (hash >> 24) ^ key3 AND ECX, 0x000000FF // ECX = ((hash >> 24) ^ key3) & 0xff SHL ESI, 8 // ESI = hash << 8 XOR ESI, DWORD PTR DS:[ECX*4+649B8878] // ESI = (hash << 8) ^ g_hash_table[index]; INC EDI // EDI += 1 DEC EDX // EDX -= 1 JNE SHORT 649F9ADE // for(UINT i=0;i<16;++i) XOR EDI, EDI // EDI = 0x00000000 NOT ESI // ESI = ~hash PUSH EDI AND ESI, 0x000003FF // ESI = ~hash & 0x3ff;
Now that would be nice but the hash check part in pkey2005 seems to be different. In fact when putting breakpoints on the product key both encoded in byte lookup table and base24 it dosent compute on the bits like pkey2009 .
I set a breakpoint at the beginning of the check hash function and it breaks for pkey2009 only. This routine is not used for pkey2005... 1) Sub Table 2) Decode Base24 3) HW Breakpoint Code: CPU Disasm Address Hex dump Command Comments 71E658EE /$ 8BFF MOV EDI,EDI ; pidgenx.71E658EE(guessed Arg1,Arg2,Arg3,Arg4,Arg5) 71E658F0 |. 55 PUSH EBP 71E658F1 |. 8BEC MOV EBP,ESP 71E658F3 |. 83EC 1C SUB ESP,1C 71E658F6 |. 8B45 14 MOV EAX,DWORD PTR SS:[EBP+14] 71E658F9 |. 53 PUSH EBX 71E658FA |. 56 PUSH ESI 71E658FB |. 33DB XOR EBX,EBX 71E658FD |. 8D70 1F LEA ESI,[EAX+1F] 71E65900 |. 8D48 07 LEA ECX,[EAX+7] 71E65903 |. C1EE 05 SHR ESI,5 71E65906 |. C1E9 03 SHR ECX,3 71E65909 |. 43 INC EBX 71E6590A |. 8975 EC MOV DWORD PTR SS:[EBP-14],ESI 71E6590D |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX 71E65910 |. 85C0 TEST EAX,EAX 71E65912 |.- 0F84 5C010000 JZ 71E65A74 71E65918 |. 57 PUSH EDI 71E65919 |. 8B7D 10 MOV EDI,DWORD PTR SS:[EBP+10] 71E6591C |. 85FF TEST EDI,EDI 71E6591E |.- 0F84 41010000 JZ 71E65A65 71E65924 |. 837D 08 00 CMP DWORD PTR SS:[EBP+8],0 71E65928 |.- 0F84 37010000 JE 71E65A65 71E6592E |. 8BC6 MOV EAX,ESI 71E65930 |. C1E0 02 SHL EAX,2 71E65933 |. 50 PUSH EAX ; /count 71E65934 |. 6A 00 PUSH 0 ; |c = 00 71E65936 |. 57 PUSH EDI ; |dest 71E65937 |. E8 EA51F7FF CALL <JMP.&msvcrt.memset> ; \MSVCRT.memset 71E6593C |. 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0C] 71E6593F |. 83C4 0C ADD ESP,0C 71E65942 |. 83E8 0B SUB EAX,0B ; Switch (cases B..D, 3 exits) 71E65945 |.- 0F84 95000000 JZ 71E659E0 71E6594B |. 48 DEC EAX 71E6594C |. 48 DEC EAX 71E6594D |.- 74 0C JZ SHORT 71E6595B 71E6594F |. FF75 18 PUSH DWORD PTR SS:[EBP+18] 71E65952 |. 6A 00 PUSH 0 71E65954 |. 6A 06 PUSH 6 71E65956 |.- E9 11010000 JMP 71E65A6C 71E6595B |> 85F6 TEST ESI,ESI ; Case D of switch pidgenx.71E65942 71E6595D |.- 0F84 ED000000 JZ 71E65A50 71E65963 |. 8365 0C 00 AND DWORD PTR SS:[EBP+0C],00000000 71E65967 |. 297D 08 SUB DWORD PTR SS:[EBP+8],EDI 71E6596A |. 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8] 71E6596D |. 8BCF MOV ECX,EDI 71E6596F |. 6A 04 PUSH 4 71E65971 |. 8975 F0 MOV DWORD PTR SS:[EBP-10],ESI 71E65974 |. 8B75 FC MOV ESI,DWORD PTR SS:[EBP-4] 71E65977 |. 894D F4 MOV DWORD PTR SS:[EBP-0C],ECX 71E6597A |. 5A POP EDX 71E6597B |> 8BC6 /MOV EAX,ESI 71E6597D |. 2B45 0C |SUB EAX,DWORD PTR SS:[EBP+0C] 71E65980 |. 8945 F8 |MOV DWORD PTR SS:[EBP-8],EAX 71E65983 |. 3BC2 |CMP EAX,EDX 71E65985 |.- 76 05 |JBE SHORT 71E6598C 71E65987 |. 8BC2 |MOV EAX,EDX 71E65989 |. 8955 F8 |MOV DWORD PTR SS:[EBP-8],EDX 71E6598C |> 33FF |XOR EDI,EDI 71E6598E |. 217D E8 |AND DWORD PTR SS:[EBP-18],EDI 71E65991 |. 897D 18 |MOV DWORD PTR SS:[EBP+18],EDI 71E65994 |. 85C0 |TEST EAX,EAX 71E65996 |.- 74 34 |JZ SHORT 71E659CC 71E65998 |. 217D E4 |AND DWORD PTR SS:[EBP-1C],EDI 71E6599B |. 8B7D F8 |MOV EDI,DWORD PTR SS:[EBP-8] 71E6599E |. 8B75 18 |MOV ESI,DWORD PTR SS:[EBP+18] 71E659A1 |. 8D140B |LEA EDX,[ECX+EBX] 71E659A4 |. 8B5D E8 |MOV EBX,DWORD PTR SS:[EBP-18] 71E659A7 |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C] 71E659AA |> 0FB6041A |/MOVZX EAX,BYTE PTR DS:[EBX+EDX] ; HW breaks here 71E659AE |. D3E0 ||SHL EAX,CL 71E659B0 |. 83C1 08 ||ADD ECX,8 71E659B3 |. 33F0 ||XOR ESI,EAX 71E659B5 |. 43 ||INC EBX 71E659B6 |. 3BDF ||CMP EBX,EDI 71E659B8 |.- 75 F0 |\JNE SHORT 71E659AA 71E659BA |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-0C] 71E659BD |. 8B5D 08 |MOV EBX,DWORD PTR SS:[EBP+8] 71E659C0 |. 8975 18 |MOV DWORD PTR SS:[EBP+18],ESI 71E659C3 |. 8B75 FC |MOV ESI,DWORD PTR SS:[EBP-4] 71E659C6 |. 8B7D 18 |MOV EDI,DWORD PTR SS:[EBP+18] 71E659C9 |. 6A 04 |PUSH 4 71E659CB |. 5A |POP EDX 71E659CC |> 0155 0C |ADD DWORD PTR SS:[EBP+0C],EDX 71E659CF |. 8939 |MOV DWORD PTR DS:[ECX],EDI 71E659D1 |. 03CA |ADD ECX,EDX 71E659D3 |. FF4D F0 |DEC DWORD PTR SS:[EBP-10] 71E659D6 |. 894D F4 |MOV DWORD PTR SS:[EBP-0C],ECX 71E659D9 |.- 75 A0 \JNZ SHORT 71E6597B 71E659DB |. 8B7D 10 MOV EDI,DWORD PTR SS:[EBP+10] 71E659DE |.- EB 6A JMP SHORT 71E65A4A 71E659E0 |> 85F6 TEST ESI,ESI ; Case B of switch pidgenx.71E65942 71E659E2 |.- 74 6C JZ SHORT 71E65A50 71E659E4 |. 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+8] 71E659E7 |. 33C9 XOR ECX,ECX 71E659E9 |. 6A 04 PUSH 4 71E659EB |. 8975 F4 MOV DWORD PTR SS:[EBP-0C],ESI 71E659EE |. 8B75 FC MOV ESI,DWORD PTR SS:[EBP-4] 71E659F1 |. 894D F0 MOV DWORD PTR SS:[EBP-10],ECX 71E659F4 |. 5A POP EDX 71E659F5 |> 8BC6 /MOV EAX,ESI 71E659F7 |. 2BC1 |SUB EAX,ECX 71E659F9 |. 8955 18 |MOV DWORD PTR SS:[EBP+18],EDX 71E659FC |. 3BC2 |CMP EAX,EDX 71E659FE |.- 77 03 |JA SHORT 71E65A03 71E65A00 |. 8945 18 |MOV DWORD PTR SS:[EBP+18],EAX 71E65A03 |> 8365 0C 00 |AND DWORD PTR SS:[EBP+0C],00000000 71E65A07 |. 837D 18 00 |CMP DWORD PTR SS:[EBP+18],0 71E65A0B |.- 74 2D |JE SHORT 71E65A3A 71E65A0D |. 8B7D 18 |MOV EDI,DWORD PTR SS:[EBP+18] 71E65A10 |. 8B75 0C |MOV ESI,DWORD PTR SS:[EBP+0C] 71E65A13 |. 4B |DEC EBX 71E65A14 |. 33C9 |XOR ECX,ECX 71E65A16 |. 03C3 |ADD EAX,EBX 71E65A18 |. 8945 E4 |MOV DWORD PTR SS:[EBP-1C],EAX 71E65A1B |. 8BD8 |MOV EBX,EAX 71E65A1D |> 0FB603 |/MOVZX EAX,BYTE PTR DS:[EBX] 71E65A20 |. D3E0 ||SHL EAX,CL 71E65A22 |. 83C1 08 ||ADD ECX,8 71E65A25 |. 33F0 ||XOR ESI,EAX 71E65A27 |. 4B ||DEC EBX 71E65A28 |. 4F ||DEC EDI 71E65A29 |.- 75 F2 |\JNZ SHORT 71E65A1D 71E65A2B |. 8B7D 10 |MOV EDI,DWORD PTR SS:[EBP+10] 71E65A2E |. 8B4D F0 |MOV ECX,DWORD PTR SS:[EBP-10] 71E65A31 |. 8B5D 08 |MOV EBX,DWORD PTR SS:[EBP+8] 71E65A34 |. 8975 0C |MOV DWORD PTR SS:[EBP+0C],ESI 71E65A37 |. 8B75 FC |MOV ESI,DWORD PTR SS:[EBP-4] 71E65A3A |> 8B45 0C |MOV EAX,DWORD PTR SS:[EBP+0C] 71E65A3D |. 890439 |MOV DWORD PTR DS:[EDI+ECX],EAX 71E65A40 |. 03CA |ADD ECX,EDX 71E65A42 |. FF4D F4 |DEC DWORD PTR SS:[EBP-0C] 71E65A45 |. 894D F0 |MOV DWORD PTR SS:[EBP-10],ECX 71E65A48 |.- 75 AB \JNZ SHORT 71E659F5 71E65A4A |> 8B75 EC MOV ESI,DWORD PTR SS:[EBP-14] 71E65A4D |. 33DB XOR EBX,EBX 71E65A4F |. 43 INC EBX 71E65A50 |> 8D14B7 LEA EDX,[ESI*4+EDI] 71E65A53 |. C1E6 05 SHL ESI,5 71E65A56 |. 2B75 14 SUB ESI,DWORD PTR SS:[EBP+14] 71E65A59 |. 83C8 FF OR EAX,FFFFFFFF 71E65A5C |. 8BCE MOV ECX,ESI 71E65A5E |. D3E8 SHR EAX,CL 71E65A60 |. 2142 FC AND DWORD PTR DS:[EDX-4],EAX 71E65A63 |.- EB 0E JMP SHORT 71E65A73 71E65A65 |> FF75 18 PUSH DWORD PTR SS:[EBP+18] 71E65A68 |. 6A 00 PUSH 0 71E65A6A |. 6A 0C PUSH 0C 71E65A6C |> 33DB XOR EBX,EBX ; Default case of switch pidgenx.71E65942 71E65A6E |. E8 793DF7FF CALL 71DD97EC ; \pidgenx.71DD97EC 71E65A73 |> 5F POP EDI 71E65A74 |> 5E POP ESI 71E65A75 |. 8BC3 MOV EAX,EBX 71E65A77 |. 5B POP EBX 71E65A78 |. C9 LEAVE 71E65A79 \. C2 1400 RETN 14