; RE_ENGE Code Finder
; Cimatron v11.1
; (c) CrackZ, in 2001

codesg segment
  assume cs:codesg
  assume ds:codesg
  org 100h

.386

start:	jmp begin

code dd 0
counter dd 0
dong_id dd 1C261234h
loopcnt dd 0
re_enge_table 	db 00h,00h,00h,00h,46h,0CAh,0A7h,55h,58h,3Bh,0Fh,4Bh,2Ch,0D3h,17h,1Eh,3Ch,0DCh,0BCh,03h
		db 0B2h,0D1h,33h,0Fh,87h,68h,0A9h,0BAh,0C3h,0F0h,74h,0E8h,0A6h,0C5h,55h,69h
		db 0C1h,0F0h,94h,0E8h,87h,69h,0A9h,0BBh,46h,0CCh,0A7h,35h,2Ch,0D2h,17h,2Eh,00,0
temp1 dd 0
temp2 dd 0
temp3 dd 0
temp4 dd 0
temp5 dd 0
temp6 dd 0
temp7 dd 0
result dd 0

begin:	mov eax, [loopcnt]
	mov [code], eax
	mov edi, offset re_enge_table.4
	call sub_1C00A653
	call sub_1C00A3DD
	test eax, eax
	jz ValidCode
	mov [temp1], 0
	mov [temp2], 0
	mov [temp3], 0
	mov [temp4], 0
	mov [temp5], 0
	mov [temp6], 0
	mov [temp7], 0
	mov [result], 0
	inc dword ptr [loopcnt]
	cmp dword ptr [loopcnt], 0ffffffffh
	jz endprg
	jmp begin

ValidCode:
	mov eax, [loopcnt]
	jmp endprg

; -------- Functions -------- ;

sub_1C00A653:
	push ebp
	mov ebp, esp
	mov [counter], 1
	jmp loc_1C00A66B

loc_1C00A662:
	mov eax, [counter]
	add eax, 1
	mov [counter], eax

loc_1C00A66B:
	cmp [counter], 0Ch
	jg loc_1C00A6D1
	mov [temp1], 0
	mov ecx, [code]
	and ecx, 0FFFFh
	mov [temp1], ecx
	mov [temp2], 0
	mov edx, [code]
	and edx, 0FFFF0000h
	mov [temp2], edx
	mov [code], 0
	mov eax, [temp1]
	shl eax, 10h
	mov ecx, [code]
	or ecx, eax
	mov [code], ecx
	mov edx, [temp2]
	shr edx, 10h
	mov eax, [code]
	or eax, edx
	mov [code], eax
	mov ecx, 0Ch
	sub ecx, [counter]
	mov edx, [code]
	xor edx, [edi+ecx*4]
	mov [code], edx
	jmp loc_1C00A662

loc_1C00A6D1:
	mov eax, [code]
	and eax, 0F0000h
	xor edx, edx
	mov ecx, 7
	div ecx
	mov [temp3], edx
	mov edx, [temp3]
	mov eax, [edi+edx*4]
	and eax, 0FFF0FFFFh
	mov ecx, [code]
	xor ecx, eax
	mov [code], ecx
	mov eax, [code]
	and eax, 0F0h
	xor edx, edx
	mov ecx, 6
	div ecx
	mov [temp3], edx
	mov edx, [temp3]
	mov eax, [edi+edx*4]
	and al, 0Fh
	mov ecx, [code]
	xor ecx, eax
	mov [code], ecx
	mov eax, [code]
	and eax, 0Fh
	xor edx, edx
	mov ecx, 0Ah
	div ecx
	mov [temp3], edx
	mov edx, [temp3]
	mov eax, [edi+edx*4]
	and al, 0F0h
	mov ecx, [code]
	xor ecx, eax
	mov [code], ecx
	mov edx, [code]
	and edx, 0F00000h
	shr edx, 14h
	sub edx, 1
	mov [temp3], edx
	mov eax, [temp3]
	mov ecx, [edi+eax*4]
	and ecx, 0FF0FFFFFh
	mov edx, [code]
	xor edx, ecx
	mov [code], edx
	mov ecx, [code]
	mov [result], ecx
	xor eax, eax
	mov esp, ebp
	pop ebp
	ret

sub_1C00A3DD:
	push ebp
	mov ebp, esp
	mov ecx, [result]
	and ecx, 0FFFFh
	mov edx, [dong_id]
	and edx, 0FFFFh
	cmp ecx, edx
	jz loc_1C00A461
	mov eax, 7Ch ; Doesn't match dongle ID.
	mov esp, ebp
	pop ebp
	ret

loc_1C00A461:
	mov ecx, [result]
	and ecx, 0F00000h
	shr ecx, 14h
	mov [temp4], ecx
	mov edx, [dong_id]
	and edx, 0F00000h
	shr edx, 14h
	mov [temp5], edx
	mov eax, [result]
	and eax, 0F0000h
	shr eax, 10h
	add eax, 7CBh
	mov [temp6], eax
	mov ecx, [dong_id]
	and ecx, 0F0000h
	shr ecx, 10h
	add ecx, 7CBh
	mov [temp7], ecx
	mov edx, [temp7]
	cmp edx, [temp6]
	jle loc_1C00A4B8
	mov eax, 7Ch ; Current year is greater than expiry year.
	mov esp, ebp
	pop ebp
	ret

loc_1C00A4B8:
	mov eax, [temp7]
	cmp eax, [temp6]
	jge loc_1C00A4C9
	xor eax, eax ; Expiry year is next year or more.
	mov esp, ebp
	pop ebp
	ret

loc_1C00A4C9:
	mov eax, 7Ch ; Expiry year is this year.
	mov esp, ebp
	pop ebp
	ret

endprg:	mov ax, 4c00h
	int 21h

codesg ends
end start