http://www.4shared.com/file/45088828/40b27b0e/ScrewMe_1_by_Dynasty.html?dirPwdVerified=c4951f3f

int __cdecl sub_401290()
{
  HWND v1; // eax@1
  int v2; // [sp+14h] [bp-4h]@1
  HWND v3; // [sp+10h] [bp-8h]@1

  v2 = 0;
  v1 = FindWindowA("OllyDBG", 0);
  v3 = v1;
  if ( v1 )
    GetWindowThreadProcessId(v3, (DWORD *)&v2);
  ++dword_405014;
  return v2;
}

]sy$Wgvi{ih$qi$222$Xlerow$jsv$vikmwxivmrk$xlmw$gvegoqi$%$

Mrzepmh$Wivmep$$

You Screwed me ... Thanks for registering this crackme !

Invalid Serial

0040179D  |. E8 AE0A0000    CALL <JMP.&msvcrt.strlen>                ; |\strlen
004017A2  |. 83F8 0B        CMP EAX,0B                               ; |
004017A5  |. 0F87 ED020000  JA ScrewMe_.00401A98                     ; |
004017AB  |. 807D E8 00     CMP BYTE PTR SS:[EBP-18],0               ; |
004017AF  |. 0F84 CD020000  JE ScrewMe_.00401A82                     ; |
004017B5  |. 8D45 E8        LEA EAX,DWORD PTR SS:[EBP-18]            ; |
004017B8  |. 890424         MOV DWORD PTR SS:[ESP],EAX               ; |
004017BB  |. E8 900A0000    CALL <JMP.&msvcrt.strlen>                ; \strlen
004017C0  |. 83F8 10        CMP EAX,10

004017C9  |. C785 38FFFFFF >MOV DWORD PTR SS:[EBP-C8],0
004017D3  |> 8D45 D8        /LEA EAX,DWORD PTR SS:[EBP-28]           ; |
004017D6  |. 890424         |MOV DWORD PTR SS:[ESP],EAX              ; |
004017D9  |. E8 720A0000    |CALL <JMP.&msvcrt.strlen>               ; \strlen
004017DE  |. 3985 38FFFFFF  |CMP DWORD PTR SS:[EBP-C8],EAX
004017E4  |. 73 1E          |JNB SHORT ScrewMe_.00401804
004017E6  |. 8D45 F8        |LEA EAX,DWORD PTR SS:[EBP-8]
004017E9  |. 0385 38FFFFFF  |ADD EAX,DWORD PTR SS:[EBP-C8]
004017EF  |. 83E8 20        |SUB EAX,20
004017F2  |. 0FBE10         |MOVSX EDX,BYTE PTR DS:[EAX]
004017F5  |. 8D45 D4        |LEA EAX,DWORD PTR SS:[EBP-2C]
004017F8  |. 0110           |ADD DWORD PTR DS:[EAX],EDX
004017FA  |. 8D85 38FFFFFF  |LEA EAX,DWORD PTR SS:[EBP-C8]
00401800  |. FF00           |INC DWORD PTR DS:[EAX]
00401802  |.^EB CF          \JMP SHORT ScrewMe_.004017D3

00401804  |> 8B55 D4        MOV EDX,DWORD PTR SS:[EBP-2C]                     ; |||
00401807  |. 89D0           MOV EAX,EDX                                       ; |||
00401809  |. C1E0 02        SHL EAX,2                                         ; |||
0040180C  |. 01D0           ADD EAX,EDX                                       ; |||
0040180E  |. 01C0           ADD EAX,EAX                                       ; |||

0040182C  |. E8 0F0A0000    CALL <JMP.&msvcrt.sprintf>                        ; ||\sprintf

0040184D  |. C645 EC 2D     MOV BYTE PTR SS:[EBP-14],2D                       ; |

00401868  |. 05 C0070000    ADD EAX,7C0                                       ; |

v11 = v9 * (v24 + v22 + v23 + 1984);

0022FED0   004041A1  |RootPathName = "C:\"
0022FED4   00405024  |VolumeNameBuffer = ScrewMe_.00405024
0022FED8   0000000C  |MaxVolumeNameSize = C (12.)
0022FEDC   00405040  |pVolumeSerialNumber = ScrewMe_.00405040
0022FEE0   00000000  |pMaxFilenameLength = NULL
0022FEE4   00000000  |pFileSystemFlags = NULL
0022FEE8   00405030  |pFileSystemNameBuffer = ScrewMe_.00405030
0022FEEC   00000010  \pFileSystemNameSize = 00000010

00401989  |. 890424         MOV DWORD PTR SS:[ESP],EAX                        ; |
0040198C  |. E8 6F020000    CALL <JMP.&KERNEL32.CreateFileA>                  ; \CreateFileA
00401991  |. 83EC 1C        SUB ESP,1C

0022F9D0   0022FA50  |FileName = "EarnUrRight.dat"
0022F9D4   80000000  |Access = GENERIC_READ
0022F9D8   00000001  |ShareMode = FILE_SHARE_READ
0022F9DC   00000000  |pSecurity = NULL
0022F9E0   00000003  |Mode = OPEN_EXISTING
0022F9E4   00000080  |Attributes = NORMAL
0022F9E8   00000000  \hTemplateFile = NULL

00401A0B  |. 8D45 F8        |LEA EAX,DWORD PTR SS:[EBP-8]

ECX 0022FA00 ASCII "Allow Me to Retort!"

// BOOL __stdcall GetVolumeInformationA(LPCSTR lpRootPathName, LPSTR lpVolumeNameBuffer, DWORD nVolumeNameSize, LPDWORD lpVolumeSerialNumber, LPDWORD lpMaximumComponentLength, LPDWORD lpFileSystemFlags, LPSTR lpFileSystemNameBuffer, DWORD nFileSystemNameSize); 

extern DWORD VolumeSerialNumber;
extern char FileSystemNameBuffer[];

BOOL GetHDDSerial()
{
  return GetVolumeInformationA("C:\\", 0, 0, &VolumeSerialNumber, 0, (LPDWORD)0x14, FileSystemNameBuffer, 0x14u);
}

G.data

Volume		dd	0
sMl		dd	0
sFs		dd	0
sResult		dd	MAX_PATH dup(?)

.data?
hWnd		dd	?

.code
start:

INVOKE GetVolumeInformation, SADD("C:\"), NULL, NULL, ADDR Volume, ADDR sMl, ADDR sFs, NULL, NULL
INVOKE dw2hex, [Volume], ADDR sResult

INVOKE MessageBox, hWnd, ADDR sResult, SADD("Info"), MB_ICONINFORMATION OR MB_OK
INVOKE ExitProcess, NULL

End start

extern DWORD NumberOfBytesWritten;
extern char FileName[];
extern HANDLE hFile;
extern char FileName[];

BOOL CreateKeyFile()
{
  int tmp;

  GetCurrentDirectoryA(0xC8u, FileName);
  lstrcatA(FileName, "\\EarnUrRight.dat");
  hFile = CreateFileA(FileName, 0x40000000u, 0, 0, 2u, 0x80u, 0);
  tmp = lstrlenA("Allow Me to Retort!");
  WriteFile(hFile, "Allow Me to Retort!", tmp, &NumberOfBytesWritten, 0);
  return CloseHandle(hFile);
}

004012A5     C70424 0040400>MOV DWORD PTR SS:[ESP],ScrewMe_.00404000 ;  ASCII "OllyDBG"
004012AC     E8 9F080000    CALL <JMP.&USER32.FindWindowA>
004012B1     83EC 08        SUB ESP,8
004012B4     8945 F8        MOV DWORD PTR SS:[EBP-8],EAX

BOOL GenerateSerial(HWND hwnd)
{
	
	char szName[9]={0};
	char szSerial[16]={0};

	int i=0,LenUser=0,iSumAcsiiResult=0,iTemp=0;

	char *lpRootPathName="C:\\";	// address of root directory of the file system 
	char lpVolumeNameBuffer[100];	// address of name of the volume 
	DWORD lpVolumeSerialNumber;	// address of volume serial number 
	DWORD lpMaximumComponentLength;	// address of system's maximum filename length
	DWORD lpFileSystemFlags;	// address of file system flags 
	char lpFileSystemNameBuffer[500];	// address of name of file system 

	char *lpFileName="EarnUrRight.dat";
	HANDLE hFile;
	char *lpBuffer="Allow Me to Retort!";
	DWORD lpBytesWritten;


	GetVolumeInformation(lpRootPathName, lpVolumeNameBuffer, sizeof lpVolumeNameBuffer, &lpVolumeSerialNumber, &lpMaximumComponentLength,&lpFileSystemFlags,lpFileSystemNameBuffer,sizeof lpFileSystemNameBuffer);

	LenUser=GetDlgItemText(hwnd,IDC_NAME,szName,70);

	if (LenUser < 1 || LenUser > 9)
	{
		MessageBox(hwnd,"----------===== Your name atleast 1 chart ====---------- \n\n   ----------===== But not over 9 charts ====---------- ","Hey !! Please input your name again !! ",MB_OK);
		
	}
	else
	{
		hFile = CreateFile(lpFileName,GENERIC_WRITE,FILE_SHARE_WRITE,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);
		WriteFile(hFile,lpBuffer,19, &lpBytesWritten,0);
		CloseHandle(hFile);
		
		i = 0;
		while (i < LenUser)
		{
			iSumAcsiiResult = iSumAcsiiResult + szName[i];
			i++;
		}
		iTemp = iSumAcsiiResult;
		iTemp = iTemp * 4;
		iTemp = iTemp + iSumAcsiiResult;
		iTemp = iTemp * 2;
		iSumAcsiiResult = iTemp;
		
		iTemp = 0x7C0;
		iTemp = iTemp * iSumAcsiiResult;
		lpVolumeSerialNumber = lpVolumeSerialNumber ^ iTemp;
		
		wsprintf(szSerial,"%d-%d",iSumAcsiiResult,lpVolumeSerialNumber);
		SetDlgItemText(hwnd,IDC_SERIAL,szSerial); 
	}

	return TRUE;
}

Ejgem"vjg"Ugtkcn

Ejgem"vjg"Pcog"Hkgnf

Check the Serial

Check the Name Field

Name : a
Serial : 970-206090841 (trên máy em)