-----------------------------------------------------------------------------
-RIP HEADER------------------------------------------------------------------
-----------------------------------------------------------------------------
Program:      Website Watcher
Company:      aignes.com software
Version:      3.21
Website:      www.aignes.com
Platform:     WinALL (95/98/ME/NT/2000)
What It Is:   checks websites for content changes
Cost:         $40 for pro version

Protection:   asprotect packed, public-key, self-modding code, all tricked out
Difficulty:   serious and sneaky
Fix Type:     Unpacked then Patched
Date Cracked: 8/15/01
Cracker(s):   flying raichu and zowatt(unpacking&rebuilding)
 also:	       special thanks to RCE board and posts by splaj for rebuilding
               hints for this proggie. Greets to Zor
Tools:        Ollydbg (fantastic new debugger/dissasembler), which is
               w32dasm convenient even when working with smc.  DeDe for once
               again helping me locate delphi callbacks.  PeCompact (thanks
               to amazing Core for releasing this) for being the only packer
               that could succesfully repack the dumped target (and what a
               job it does).  Hexedit for its wonderful binary copy&paste.
-----------------------------------------------------------------------------



-----------------------------------------------------------------------------
-FROM WEB PAGE BLURB---------------------------------------------------------
-----------------------------------------------------------------------------
WebSite-Watcher checks an unlimited number of web-sites for updates and
 changes with a minimum of time and online-costs. When changes in a website
 are detected, WebSite-Watcher saves the last two versions to your hard
 disk and highlights all changes in the text. Supports IE/NS/Opera
 Browser-Integration and also Import and Export.
 
Features:
checks websites with a minimum of time and online cost
saves changed websites to your hard disk
highlights changes in pages that have been modified
stores websites in an archive
export websites to CHM-helpfile
supports Browser-Integration for IE/NS/Opera
Bookmark-Manager for all Browsers
several filters, e.g. to ignore changing banners
supports HTTP- and FTP-protocols
PAD-file support
Import/Export from/to IE, NS and Opera
 
Examples of use:
Webmasters can check hundreds of sites within a few minutes
Journalists can check several websites in minute intervals
Engineers can check discussion forums for new postings
Webmasters of free/sharewaresites can check tools for new versions
Surfers can check their favorite pages with a minimum of time and online cost
-----------------------------------------------------------------------------




-----------------------------------------------------------------------------
-HISTORY AND SOMETHING DIFFEERENT--------------------------------------------
-----------------------------------------------------------------------------
I first stumbled across website watcher in november 2000.  By then it was
already at version 3.02.  It was the best website-change monitor then
and it has only gotten better.  Much much better.  Its really a great
program with some very nice facilities for handling cookies, etc.

So anyway, we were the first (to my knowledge) to crackeit, in novemeber
2000, with an inplace (worm-style) patcher, since the program is packed
(aspack/asrotect).  Back then there was no other protection besides the packer
and it was an easy crack.

Then damn (the brilliant recca) released a keygen for version 3.03 soon after
 the crack and all were happy.

However, the skilled author of this program obiously took the cracking to
heart andset about to craft a more sophisticiated protection scheme.  And
i have to say congrats to him since he did a very nice job.  Also credit must
be given to asprotect which is really very good.  by version 3.10 this program
was well protected.

My memory is that recca said that website watcher had been upgraded to public
 key encryption and was for all intents and purposes not keygennable.

Lots of people ask for updates to website watcher all the time.  I understand
 why, it is a very nice program.  It is also overpriced in my opinion.
 
Then recently i ran into a very skilled fellow named ZoWatt, who seems to be
 able to unpack anything.  Fortunately RCE had a short but sweet post on
 unpacking website-watcher and asprotect programs, and with a description
 of past work by SplAj, ZoWatt was able to do the unpacking in no time.

Now website watcher and asprotect have some very interesting tricks up their
 sleeves on this one, including large sections of code that are dynamically
 modified if the proper key is found during unpacking.  This is not your normal
 job where you unpack and crack.  It's not even your normal self-modifying code
 routine.  The unpacker makes significant modifications to the code.

Even so, i thought it wouldnt be so tough.  Turns out however, that our author
 has spent lots of time with lots of redundant checks and sneaky stuff to make
 the program ill-behaved if it detects bad licenses.  Ill tell you more about
 that stuff later.
 
In the end however, the program is fully cracked.  Like most things, where
 there is a will there is a way.
 
Now i have an interesting proposal for Martin Aignesberger, and given the
 history of the program, i assume he is reading this.  I've not done this
 before so i dont know if this idea is crazy or not.  but here goes:
 Martin, you are a skilled programmer, and you did a good job protecting
 this program.  I dont know why more people aren't using your program, it
 is really an elegant piece of work and i appreciate the work you put into
 it.  Crackers are not your enemy.  There have been arguments that having
 a program cracked can increase sales in general.  So i would like to propose
 the following.  We will encourage people who try the crack and like your
 program to buy it.  You look at your sales.  See if they go up in next
 couple of months due to more customers who are finding out about your
 program through cracking publicity.  If you believe you are losing sales
 due to cracking, just make any change to the protection, however minor, and
 i will not crack the program again.  If you feel like maybe the cracking
 community is not stealing sales, but just letting poor people use programs
 they could never otherwise afford and spreading the word of your program,
 then stop worrying about the protection end of the game. Like i said,
 i've not tried this kind of thing before, and i hope martin you realize
 that i mean you no harm.  I personally believe authors should be able to
 make money from their programs, i just believe it should all be donation
 based, so that those who can afford will pay what they can afford, and
 those that cant wont be denied access to quality software. -FR, 8/2001

-----------------------------------------------------------------------------



-----------------------------------------------------------------------------
-UNPACKING AND REBUILDING----------------------------------------------------
-----------------------------------------------------------------------------
I am pretty bad at this part of the game and thankfully zowatt was able to
 rebuild this target with some help from posts by splaj at the RCE board.
Here is what ZoWatt says:
"I checked the thread at rce forum and appiled pretty much what splaj wrote. 
 Used /TRACEX 560000 570000 to get to the entry point at 565608 (TRACEX is 
 really slow, takes like 5 minutes or so). Thereafter dumped to file using 
 /DUMP 400000 1e3000 c:\temp\wswatch_unp.exe The entry point and sections had 
 to be changed as well as import table pointer. I also changed the 
 characteristicts of some sections containing code so that they were 
 flagged as executable. Imports are messed up but I used the ones supplied by 
 splaj with some modifications.  He used ord_2f for two API:s. I changed those 
 to FreeResource and LockResource and used revirgin to make a new IT for 
 insertion at address 16e000. I have included the IT as a separate file. 
 It should just be to copy & paste given that the file has been dumped 
 using the above method.
 I zeroed the area from 16b430 to 16b4b0 in the file as splaj mentioned. 
 It behaved strangely otherwise.
 In the zip file is the unpacked wswatch.exe, the import table used and 
 the import table in text format which can be loaded in revirgin. Here is 
 how to generate an IT for another address than 16e000
 1. Start revirgin and press "load resolved". Maybe you have to have 
 wswatch running and selected..don't remember
 2. Choose the txt-file wswatch_it.txt
 3. deselect "Autofix+IT paste"
 4. write the it rva in the edit box. (for example 16e000)
 5. press IAT generator button and choose where to save the file.
 6. copy & paste the new IT into wswatch. remember to change the import 
 table pointer in the pe header.
 7. that should be all."

I will just insert a tiny side note. You know i love w32dasm.  It was the
 first disassembler i used since the old ibm debug.com.  Remeber those little
 3 ring binder manuals that came with the original ibm pc.  anyway w32dasm
 just made me love it.  I still think the color scheme, font, run tracing,
 etc. is just an elegant interface.  BUT you've also heard me singing the
 praises of ollydebug recently.  Like w32dasm, it will both dissasemble and
 debug.  But at the core ollydebug dissasembles on the fly, and like many
 tools in the scene, sometimes ollydebug does a better job of deciphering
 code than does w32dasm, and vice versa.  However ollydebug is hands down
 winner when it comes time to dissasembling self-mofidying code.  It simply
 does not skip a beat.  And it is just incredible at letting you peruse
 large chunks of memory, examine the stack, and do in-line assembler changes.
 It is just packed with features.  Its wonderful and i love it.
SO anyway, it was often useful to run ollydebug on the real wswatch.exe.
This is kind of beginner stuff but i thought it might be useful to you:
 to trap the program, given that you know the oep, set a MEMORY bp on the
 oep.  If you try to set an execute BP, it will not trap.
-----------------------------------------------------------------------------




-----------------------------------------------------------------------------
-VERSIONS: TRIAL vs. PERSONAL vs. PRO----------------------------------------
-----------------------------------------------------------------------------
The trial version can do (almost) everything but is limited to 40 days use
 and has a very anoying delayed nag screen with press 1 of 5 random keys.
Actually the trial version has some other limits, like restrictions on
 changing the browser identification string.
The personal version does not let you use the periodic autowatch feature,
 arguably the most important feature of the program, so its PRO we want.

Using Asprotect, this program does something very sneaky, during unpacking
 it makes some significant code changes in about 20 code sections, based on
 the license found.

All of these code sections all have the same form.  they are jumped over
 in the demo version, with random or scrambled bytes in the skipped code
 in demo version, but in regged version the code is executed.  some of
 these code snippets are the core code for some of the pro version
 features (email notification, proxy support).
Very nicely done protection, though hard to say how much work wswatch author\
 had to put in to isolate relevant sections of code.
 
So first thing is, to get ALL features, we will need to replace some of
 the code after the trial version is dumped and rebuilt.
-----------------------------------------------------------------------------




-----------------------------------------------------------------------------
-INSERTING PRO CODE SECTIONS-------------------------------------------------
-----------------------------------------------------------------------------
Well, at first i thought that unpacking this code would be 99% of the
 game.  because of the sophistication of the self-modifying code unpacking
 (its a bit confusing to call this self-modifying, it's more like the
 unpacker is unpacking dynamically based on license read).  very unusual
 and quite clever.
However, it turns out that unpacking is just the tip of the iceberg...

Anyway, so i took the unpacked trial version and set about to reintegrate
 (reconcile) some good pro-version code segments...
 
OEP
	:00565608 55                      push ebp
	:00565609 8BEC                    mov ebp, esp

We know first place where pro version code look different is here
	:004E00A8 E901000000              jmp 004E00AE						// FILE 00DF6AB
	:004E00AD 1DB2018B83              sbb eax, 838B01B2
	:004E00B2 CC                      int 03
	:004E00B3 0400                    add al, 00
	:004E00B5 008B08FF515C            add byte ptr [ebx+5C51FF08], cl
	:004E00BB B201                    mov dl, 01
	:004E00BD 8B83D0040000            mov eax, dword ptr [ebx+000004D0]
	:004E00C3 8B08                    mov ecx, dword ptr [eax]
	:004E00C5 FF515C                  call [ecx+5C]
	:004E00C8 B201                    mov dl, 01
	:004E00CA 8B8380050000            mov eax, dword ptr [ebx+00000580]
	:004E00D0 8B08                    mov ecx, dword ptr [eax]
	:004E00D2 FF515C                  call [ecx+5C]
	:004E00D5 EB04                    jmp 004E00DB
	:004E00D7 314068                  xor dword ptr [eax+68], eax
	:004E00DA 628B068A90A8            bound ecx, dword ptr [ebx+A8908A06]

Looking at preceding unique bytes:
	83CC040000E84C3CF5FF
In my procdumped at 						000DF69E
And searching for in zowatts dump, they are at file location	000E009E
 (ie new code is at old code + 0A00)

End change ends at unique bytes
	8D45D0E88525EA
In pro procdumped at 						00160F73
And searching for in zowatts dump, they are at file location	00161973

SO...
let's copy and past
From pro procdump from file	 00DF69E to 00160F73
To zw				 00E009E to 00161973

SEEMS to work to large degree.
With regged registry key, no more nag, but license info is missing and about
 box causes crash.  Internal debug details show:
 Call stack:
	:00409504 [WSWATCH_RECONCILED1.EXE]
	:00409BED [WSWATCH_RECONCILED1.EXE]
	:0044C60B [WSWATCH_RECONCILED1.EXE]
	:0044C28E [WSWATCH_RECONCILED1.EXE]
	:00453154 [WSWATCH_RECONCILED1.EXE]
	:0052A686 [WSWATCH_RECONCILED1.EXE]
	:0045383C [WSWATCH_RECONCILED1.EXE]
	:00453028 [WSWATCH_RECONCILED1.EXE]
	:00565694 [WSWATCH_RECONCILED1.EXE]
	:BFF7B9E4 [KERNEL32.DLL]
	:BFF7B896 [KERNEL32.DLL]
	:BFF7A24F [KERNEL32.DLL]

About box says "Personal Edition"

Actually, this doesnt seem to care if the valid reg. key is there or not.
Nice.  No nag even when reg key is not present.
SO, looks like just dumping this version is 99% of ballgame.

Sometimes it appears the wswatch config files get corrupted while
 i experiment, causing not crashes but dbl-click action changes, etc.
 so i keep backup copies of config file and recopy over.

On trying to fix it from personal to pro, we can seemingly set flag saying
 pro version:
 
 	0054DF7F    |. 8B07           MOV EAX,DWORD PTR DS:[EDI]
	0054DF81    |. 8B90 F8010000  MOV EDX,DWORD PTR DS:[EAX+1F8]
	0054DF87    |. B8 08E35400    MOV EAX,WSWATCH_.0054E308
	0054DF8C    |. E8 DB64EBFF    CALL WSWATCH_.0040446C			// i tried patching this code to always return eax=1 and i heard sound like rattlesnake!!
	0054DF91    |. 8BF0           MOV ESI,EAX
	0054DF93    |. 8B07           MOV EAX,DWORD PTR DS:[EDI]
	0054DF95    |. 89B0 00020000  MOV DWORD PTR DS:[EAX+200],ESI		// i think this is where it set (we want esi=0F)

BUT what happens is it behaves as if it is checking bookmarks and never
 stops, (menus are disabled, button wont renable after you disable it).

AND it turns out that even the most basic check-bookmark feature is broken
 in reconciled version...  drat.
 
Rather than copying all pro-code sections, we then laborious investigate
 the effect of each.  Some are obvious some are not.  Turns out the
 simplest solution is to use a combo of trial code and pro code.
 Here i list just some of the more interesting reconciled code sections.
 Without some of them, certain features are simply not possible to
 re-enable.  Note the common form.  Begins with a JMP that just skips
 a couple of bytes.  In the trial version this jump skips the entire
 procedure, which is filled with garbage code.
 
// enables ability to change browser ID (WRQ2)
	:004E00A8 E901000000              jmp 004E00AE
	:004E00AD 1DB2018B83              sbb eax, 838B01B2
	:004E00B2 CC                      int 03
	:004E00B3 0400                    add al, 00
	:004E00B5 008B08FF515C            add byte ptr [ebx+5C51FF08], cl
	:004E00BB B201                    mov dl, 01
	:004E00BD 8B83D0040000            mov eax, dword ptr [ebx+000004D0]
	:004E00C3 8B08                    mov ecx, dword ptr [eax]
	:004E00C5 FF515C                  call [ecx+5C]
	:004E00C8 B201                    mov dl, 01
	:004E00CA 8B8380050000            mov eax, dword ptr [ebx+00000580]
	:004E00D0 8B08                    mov ecx, dword ptr [eax]
	:004E00D2 FF515C                  call [ecx+5C]
	:004E00D5 EB04                    jmp 004E00DB
	:004E00D7 314068                  xor dword ptr [eax+68], eax
	:004E00DA 628B068A90A8            bound ecx, dword ptr [ebx+A8908A06]

// ABOUT BOX:
// Looks like memory fault is because it think you have integer overflow # of licenses,
// not becasue name is blank.  See future section for how to fix
	005338EA  55                PUSH EBP
	...
	:005339F2 E901000000              jmp 005339F8
	:005339F7 1C8D                    sbb al, 8D
	:005339F9 55                      push ebp
	:005339FA EC                      in al, dx
	:005339FB B8FD030000              mov eax, 000003FD
	:00533A00 E83B1EF7FF              call 004A5840
	:00533A05 8D45EC                  lea eax, dword ptr [ebp-14]
	:00533A08 BA483D5300              mov edx, 00533D48
	:00533A0D E87607EDFF              call 00404188
	:00533A12 8B55EC                  mov edx, dword ptr [ebp-14]
	:00533A15 8B83F8020000            mov eax, dword ptr [ebx+000002F8]
	:00533A1B E8D402F0FF              call 00433CF4
	:00533A20 A04C3D5300              mov al, byte ptr [00533D4C]
	:00533A25 50                      push eax
	:00533A26 8D45E8                  lea eax, dword ptr [ebp-18]
	:00533A29 50                      push eax
	:00533A2A A134A05600              mov eax, dword ptr [0056A034]
	:00533A2F 8B00                    mov eax, dword ptr [eax]
	:00533A31 8B80EC010000            mov eax, dword ptr [eax+000001EC]
	:00533A37 B9583D5300              mov ecx, 00533D58
	:00533A3C BA643D5300              mov edx, 00533D64
	:00533A41 E8EEA8EDFF              call 0040E334
	:00533A46 8B55E8                  mov edx, dword ptr [ebp-18]
	:00533A49 8B83FC020000            mov eax, dword ptr [ebx+000002FC]
	:00533A4F E8A002F0FF              call 00433CF4
	:00533A54 A04C3D5300              mov al, byte ptr [00533D4C]
	:00533A59 50                      push eax
	:00533A5A 8D45E4                  lea eax, dword ptr [ebp-1C]
	:00533A5D 50                      push eax
	:00533A5E A134A05600              mov eax, dword ptr [0056A034]
	:00533A63 8B00                    mov eax, dword ptr [eax]
	:00533A65 8B80F0010000            mov eax, dword ptr [eax+000001F0]
	:00533A6B B9583D5300              mov ecx, 00533D58
	:00533A70 BA643D5300              mov edx, 00533D64
	:00533A75 E8BAA8EDFF              call 0040E334
	:00533A7A 8B55E4                  mov edx, dword ptr [ebp-1C]
	:00533A7D 8B8300030000            mov eax, dword ptr [ebx+00000300]
	:00533A83 E86C02F0FF              call 00433CF4
	:00533A88 A134A05600              mov eax, dword ptr [0056A034]
	:00533A8D 8B00                    mov eax, dword ptr [eax]
	:00533A8F 83B80002000000          cmp dword ptr [eax+00000200], 00000000
	:00533A96 7F12                    jg 00533AAA
	* Possible StringData Ref from Code Obj ->"Personal Edition / "
	:00533A98 BA703D5300              mov edx, 00533D70
	:00533A9D 8B8304030000            mov eax, dword ptr [ebx+00000304]
	:00533AA3 E84C02F0FF              call 00433CF4
	:00533AA8 EB10                    jmp 00533ABA
	* Referenced by a (U)nconditional or (C)onditional Jump at Address:
	|:00533A96(C)
	* Possible StringData Ref from Code Obj ->"PRO Edition / "
	:00533AAA BA8C3D5300              mov edx, 00533D8C
	:00533AAF 8B8304030000            mov eax, dword ptr [ebx+00000304]
	:00533AB5 E83A02F0FF              call 00433CF4
	* Referenced by a (U)nconditional or (C)onditional Jump at Address:
	|:00533AA8(U)
	:00533ABA 8D45E0                  lea eax, dword ptr [ebp-20]
	:00533ABD 50                      push eax
	:00533ABE A134A05600              mov eax, dword ptr [0056A034]
	:00533AC3 8B00                    mov eax, dword ptr [eax]
	:00533AC5 8B8004010000            mov eax, dword ptr [eax+00000104]
	:00533ACB B902000000              mov ecx, 00000002
	:00533AD0 BA0B000000              mov edx, 0000000B
	:00533AD5 E8AE08EDFF              call 00404388
	:00533ADA 8B45E0                  mov eax, dword ptr [ebp-20]
	:00533ADD BAA43D5300              mov edx, 00533DA4
	:00533AE2 E8A907EDFF              call 00404290
	:00533AE7 752C                    jne 00533B15						// NOP this to make it site license
	:00533AE9 8D55DC                  lea edx, dword ptr [ebp-24]
	:00533AEC 8BB304030000            mov esi, dword ptr [ebx+00000304]
	:00533AF2 8BC6                    mov eax, esi
	:00533AF4 E8CB01F0FF              call 00433CC4
	:00533AF9 8D45DC                  lea eax, dword ptr [ebp-24]
	* Possible StringData Ref from Code Obj ->"Site License"
	...

// Needed to let it load you custom browser id info
	:00535351 E901000000              jmp 00535357
	:00535356 E28D                    loop 005352E5
	:00535358 8564FFFF                test dword ptr [edi+8*edi-01], esp
	:0053535C FF508D                  call [eax-73]
	:0053535F 45                      inc ebp
	:00535360 F0                      lock
	* Possible StringData Ref from Code Obj ->"Mozilla/4.0 (compatible; MSIE "
	                                        ->"5.5; Windows 98; DigExt)"
	:00535361 B9F07B5300              mov ecx, 00537BF0
	* Possible StringData Ref from Code Obj ->"browser_identify_as"
	:00535366 BA307C5300              mov edx, 00537C30
	:0053536B E8C4F2FFFF              call 00534634
	:00535370 8B9564FFFFFF            mov edx, dword ptr [ebp+FFFFFF64]
	:00535376 A134A05600              mov eax, dword ptr [0056A034]
	:0053537B 8B00                    mov eax, dword ptr [eax]
	:0053537D 83C068                  add eax, 00000068
	:00535380 E8CFEBECFF              call 00403F54
	:00535385 EB04                    jmp 0053538B
	:00535387 6E                      outsb
	:00535388 6E                      outsb
	:00535389 827D8D45                cmp byte ptr [ebp-73], 45
	...

// Proxy use routines
	:005370B7 E901000000              jmp 005370BD
	:005370BC 9D                      popfd
	* Referenced by a (U)nconditional or (C)onditional Jump at Address:
	|:005370B7(U)
	:005370BD 6A00                    push 00000000
	* Possible StringData Ref from Code Obj ->"import_data"
	:005370BF B9DC905300              mov ecx, 005390DC
	* Possible StringData Ref from Code Obj ->"Proxy"
	:005370C4 BAF0905300              mov edx, 005390F0
	:005370C9 8B45DC                  mov eax, dword ptr [ebp-24]
	:005370CC 8B18                    mov ebx, dword ptr [eax]
	:005370CE FF5310                  call [ebx+10]
	:005370D1 84C0                    test al, al
	:005370D3 0F848C010000            je 00537265
	:005370D9 6A00                    push 00000000
	:005370DB 8D8558FEFFFF            lea eax, dword ptr [ebp+FFFFFE58]
	:005370E1 50                      push eax
	* Possible StringData Ref from Code Obj ->"http_addr"
	:005370E2 B900915300              mov ecx, 00539100
	* Possible StringData Ref from Code Obj ->"Proxy"
	:005370E7 BAF0905300              mov edx, 005390F0
	:005370EC 8B45DC                  mov eax, dword ptr [ebp-24]
	:005370EF 8B18                    mov ebx, dword ptr [eax]
	:005370F1 FF13                    call dword ptr [ebx]
	:005370F3 8B9558FEFFFF            mov edx, dword ptr [ebp+FFFFFE58]
	:005370F9 A134A05600              mov eax, dword ptr [0056A034]
	:005370FE 8B00                    mov eax, dword ptr [eax]
	:00537100 05B8010000              add eax, 000001B8
	:00537105 E84ACEECFF              call 00403F54
	:0053710A 6A00                    push 00000000
	:0053710C 8D8554FEFFFF            lea eax, dword ptr [ebp+FFFFFE54]
	:00537112 50                      push eax
	* Possible StringData Ref from Code Obj ->"http_port"
	:00537113 B914915300              mov ecx, 00539114
	* Possible StringData Ref from Code Obj ->"Proxy"
	...

// License check code
	0054DEA3  |> 8D55 B4        LEA EDX,DWORD PTR SS:[EBP-4C]
	0054DEA6  |. A1 309F5600    MOV EAX,DWORD PTR DS:[569F30]
	0054DEAB  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	...
	// in here is also some blacklisted licenses checking

// Allows program to load older and real/registered config files
// without this, trial version and others wont load registered config files
// or config files older than 40 days.
	:005618C6 E901000000              jmp 005618CC
	:005618CB 46                      inc esi
	* Referenced by a (U)nconditional or (C)onditional Jump at Address:
	|:005618C6(U)
	:005618CC 8D45EC                  lea eax, dword ptr [ebp-14]
	:005618CF E82C26EAFF              call 00403F00
	:005618D4 8D45D0                  lea eax, dword ptr [ebp-30]
	:005618D7 50                      push eax
	:005618D8 A134A05600              mov eax, dword ptr [0056A034]
	:005618DD 8B00                    mov eax, dword ptr [eax]
	:005618DF FFB0BC020000            push dword ptr [eax+000002BC]
	:005618E5 FFB0B8020000            push dword ptr [eax+000002B8]
	:005618EB 8D9548FFFFFF            lea edx, dword ptr [ebp+FFFFFF48]
	* Possible StringData Ref from Code Obj ->"yyyymmdd"
	:005618F1 B85C2E5600              mov eax, 00562E5C
	:005618F6 E8C1A5EAFF              call 0040BEBC
	:005618FB 8B8548FFFFFF            mov eax, dword ptr [ebp+FFFFFF48]
	:00561901 E8B682EAFF              call 00409BBC
	:00561906 0305A09B5600            add eax, dword ptr [00569BA0]
	:0056190C 89854CFFFFFF            mov dword ptr [ebp+FFFFFF4C], eax
	:00561912 C68550FFFFFF00          mov byte ptr [ebp+FFFFFF50], 00
	:00561919 8D954CFFFFFF            lea edx, dword ptr [ebp+FFFFFF4C]
	:0056191F 33C9                    xor ecx, ecx
	:00561921 B8702E5600              mov eax, 00562E70
	:00561926 E80193EAFF              call 0040AC2C
	:0056192B BE01000000              mov esi, 00000001
	* Referenced by a (U)nconditional or (C)onditional Jump at Address:
	|:0056196B(C)
	:00561930 8D8540FFFFFF            lea eax, dword ptr [ebp+FFFFFF40]
	:00561936 8B55D0                  mov edx, dword ptr [ebp-30]
	:00561939 8A5432FF                mov dl, byte ptr [edx+esi-01]
	:0056193D E86627EAFF              call 004040A8
	:00561942 8B8540FFFFFF            mov eax, dword ptr [ebp+FFFFFF40]
	:00561948 8D8D44FFFFFF            lea ecx, dword ptr [ebp+FFFFFF44]
	:0056194E 8B159C9B5600            mov edx, dword ptr [00569B9C]
	:00561954 E8DFE7FFFF              call 00560138
	:00561959 8B9544FFFFFF            mov edx, dword ptr [ebp+FFFFFF44]
	:0056195F 8D45EC                  lea eax, dword ptr [ebp-14]
	:00561962 E82128EAFF              call 00404188
	:00561967 46                      inc esi
	:00561968 83FE09                  cmp esi, 00000009
	:0056196B 75C3                    jne 00561930
	:0056196D EB04                    jmp 00561973
	:0056196F B6B0                    mov dh, B0
	:00561971 B204                    mov dl, 04
	* Referenced by a (U)nconditional or (C)onditional Jump at Address:
	|:0056196D(U)
	:00561973 8D45D0                  lea eax, dword ptr [ebp-30]

SO, an important point is this: I initially tried to convince the program
 that is was the genuine full pro version.  This turned out to be difficult
 and i found that it was more fruitful to let the program believe it was
 a combination of full and trial version, since there are so many checks of
 license integtrity, etc., and these do not come into play then the program
 thinks it is the trial version.  SO, when easiest i bypass limits of trial
 (expiration date, etc.), and when easiest, i make program think it is pro
 version and free of certain limitations.
-----------------------------------------------------------------------------





-----------------------------------------------------------------------------
-ELIMINTING NAG--------------------------------------------------------------
-----------------------------------------------------------------------------
This is a tough one.  MUCH MUCH more tricky than your normal nag job.
Lots of nags you can see the nag call and then nop it.
Its not so easy to locate, BUT you can here disable the nag.

Patch to return immediately from nag call
CHANGE
	004501AC  55             PUSH EBP
TO
	004501AC  C3             RETN
	
The only problem is that the program becomes completely corrupt if you do.
 So somehow the presence of nag is required to make program work right.  We
 suspect that some imp. code is executed within the nag, and that is indeed
 the case.
This nag is also one of those where the program picks a random letter (one
 of 5: W,A,T,C,H, and you have to press the right one to start the program.
 The important code is also called using a delphi dynamically called
 callback, so it's not so easy for us to find it in code (thanks DeDe).

To get warmed up we make it so you can press W instead of the key it wants
you to.

Making it so you can always hit W:
The tdlginfo refs are to callbacks which were found and beautifully
 incorporated into the w32dasm project files by DeDe.

	* Event Handler: TdlgInfo.pbWEnter()
	:0054CAF0 55                      push ebp					// 14CAf0, ret
	:0054CAF1 8BEC                    mov ebp, esp
	...
	* Event Handler: TdlgInfo.pbWMouseDown()
	:0054D098 55                      push ebp					// 14d098, ret
	:0054D099 8BEC                    mov ebp, esp
	...
	* Event Handler: TdlgInfo.pbWClick()						// the main click procedure
	:0054B874 55                      push ebp
	...
	CHANGE
		:0054B8A2 83B8F402000000          cmp dword ptr [eax+000002F4], 00000000	// 14B8A2
		:0054B8A9 0F85B3020000            jne 0054BB62
	TO
		:0054B8A2 BA00000000              mov edx, 00000000
		:0054B8A7 8990F4020000            mov dword ptr [eax+000002F4], edx
		:0054B8AD 90                      nop
		:0054B8AE 90                      nop
	TO
		:0054B8A2 BA00000000              mov edx, 00000000
		:0054B8A7 909090909090            nops
		:0054B8AD 90                      nop
		:0054B8AE 90                      nop

If we make these changes, pressing W always works to kill nag.
So this is good.  we can skip the Enter and Mousedown, and just force
 the execution of the click.

Now to eliminate the nag, we could SIMULATE an automatic press of the W key.
 we could probably do this more elegantly, which would not require us to
 know eax, by simulating an OS key press.
But here i just force the call to the keypress callback, fixing up eax
 beforehand.
	:004502BC E83BFEFFFF              call 004500FC					// start display nag
	:00450333 8945F8                  mov dword ptr [ebp-08], eax			// correct key press after display nag
	:00450382  /. 33C0                XOR EAX,EAX					// start of safe exit

CHANGE
	:00450326 8B45FC                  mov eax, dword ptr [ebp-04]
	:00450329 8B8034020000            mov eax, dword ptr [eax+00000234]
	:0045032F 85C0                    test eax, eax
	:00450331 74BE                    je 004502F1
	:00450333 8945F8                  mov dword ptr [ebp-08], eax
	:00450336 6A00                    push 00000000
TO
	:00450326 B80CAB2801                    mov eax, 0128AB0C		// FILE 00050326
	:0045032B E844B50F00                    call 0054B874			// jump to correct click code
	:00450330 90                            nop
	:00450331 90                            nop
	:00450332 90                            nop
	:00450333 90                            nop
	:00450334 90                            nop
	:00450335 90                            nop

However, this is a delphi trigger callback and forcing it can cause
 memory faults, as the caller expects a memory address parameter (in eax)
 which is not contant.  So we need to fix this.
-----------------------------------------------------------------------------





-----------------------------------------------------------------------------
-RECOVERING FROM NAG REMOVAL-------------------------------------------------
-----------------------------------------------------------------------------
Ok, so rather than let the nag display, and forcing a call to the routine
 to make it look like you have pressed the right key, lets see if we can
 skip the nag and just reproduce the *effects* of pressing the right key.
TO do this, i traced the code executed when you press the right key.
 actually there is a LOT of code here and it is somewhat inelegantly
 reproduces independently for each key.
Tracing shows the following modifications made to permanent memory locs:

MAKE MEMPORY CHANGES
	01275234  00 00 00 00 		// default, no need to do?
	0127536B  01          		// critical
	0127536C  01          		// critical
	01275230  52 10 00 00 		//
	0127548C  00 10 00 00 		//
	00569B94  88 5F 55 00 		//

PS these are reproducing changes that get made during correct letter click:
	:0054B88B 8B3534A05600            mov esi, dword ptr [0056A034]			// offset into data
	:0054B8AF 8B06                    mov eax, dword ptr [esi]			// eax=127514C
	:0054B8CE 8990E8000000            mov dword ptr [eax+000000E8], edx		//* [+0E8] ; [1275234] (edx=0)					;	01275234  00 00 00 00
	:0054B957 FF80E8000000            inc dword ptr [eax+000000E8]			// not executed?
	:0054B991 C6801F02000001          mov byte ptr [eax+0000021F], 01		//* [+21F] ; [127536B]						;	0127536B  01
	:0054BA2B C6802002000001          mov byte ptr [eax+00000220], 01		//* [+220] ; [127536C]						;	0127536C  01
	:0054BA9F C7803402000001000000    mov dword ptr [eax+00000234], 00000001	//* [+234] ; [12923DC] (eax=12921A8) TRICKY, IGNORE!		;	012923DC  01 00 00 00
	:0054BB47 C780E400000052100000    mov dword ptr [eax+000000E4], 00001052	//* [+0E4] ; [1275230]						;	01275230  52 10 00 00
	:0054BB53 C7804003000000100000    mov dword ptr [eax+00000340], 00001000	//* [+340] ; [127548C]						;	0127548C  00 10 00 00
	:0054BBA5 89980C030000            mov dword ptr [eax+0000030C], ebx		//* [+30C] ; not performed on success

hmm, this one seems to change
	:0054BA9F C7803402000001000000    mov dword ptr [eax+00000234], 00000001	//* [+234] ; [1291CB0] (eax=1291A7C)				;	01291CB0  01 00 00 00
	This eax=[ebp-4] which is set at 0054B888, which is the value of eax on the start of the procedure call; what exactly IS this
	is it some parameter passed to callback functions? the return value?

	0054BA8F  B8 885F5500       MOV EAX,WSW_WKEY.00555F88
	0054BA94  8B15 449C5600     MOV EDX,DWORD PTR DS:[569C44]            		; 
	0054BA9A  8902              MOV DWORD PTR DS:[EDX],EAX               		; [569B94]							;	00569B94  88 5F 55 00

So to fix we do:
	004501AC  /. 56                         PUSH ESI
	004501AD  |. 8B35 34A05600              MOV ESI,DWORD PTR [56A034]            ;  WSWATCH_.0056D03C
	004501B3  |. 8B06                       MOV EAX,DWORD PTR [ESI]
	004501B5  |. C680 1F020000 01           MOV BYTE PTR [EAX+21F],1
	004501BC  |. C680 20020000 01           MOV BYTE PTR [EAX+220],1
	004501C3  |. B8 01000000                MOV EAX,1
	004501C8     5E                         POP ESI

Turns out this looks like it works.  Nag is gone and no fault.
BUT!! the general options become disabled!

This turns out to be because the nag call code at 4501CA is a generic
dialog display hub function. oops.

So we trace parent of the nag-specific call:
	00550269   . FF92 D8000000  CALL DWORD PTR DS:[EDX+D8]			// call to initial nag
	0055026F   . 8B15 34A05600  MOV EDX,DWORD PTR DS:[56A034]            ;  WSWATCH_.0056D03C
	00550275   . 8B12           MOV EDX,DWORD PTR DS:[EDX]
	00550277   . 8982 30020000  MOV DWORD PTR DS:[EDX+230],EAX
	0055027D   . A1 A09C5600    MOV EAX,DWORD PTR DS:[569CA0]
	00550282   . 8B00           MOV EAX,DWORD PTR DS:[EAX]
	00550284   . E8 07FFEFFF    CALL WSWATCH_.00450190
	00550289   . E8 22E6FFFF    CALL WSWATCH_.0054E8B0
	0055028E   . C3             RETN
AND CHANGE TO:
	00550260     8B15 34A05600              MOV EDX,DWORD PTR [56A034]            ;  WSWATCH_.0056D03C
	00550266     8B12                       MOV EDX,DWORD PTR [EDX]
	00550268     C682 1F020000 01           MOV BYTE PTR [EDX+21F],1
	0055026F     C682 20020000 01           MOV BYTE PTR [EDX+220],1
	00550276     40                         INC EAX						// we want eax=1, we only have one byte but eax *seems* to come in at ==0 so this SEEMS to work for now
-----------------------------------------------------------------------------





-----------------------------------------------------------------------------
-REMOVING TITLEBAR TEXT -----------------------------------------------------
-----------------------------------------------------------------------------
The titlebar of window says "License: " and nothing afterward.
In real version it says Licensed users name.

We want to remove this annoying line completely.
But we couldnt find text "Licensed To:"
so how do we find?

In About box, here is where it is referenced
	00533A12  8B55 EC           MOV EDX,DWORD PTR SS:[EBP-14]
	00533A15  8B83 F8020000     MOV EAX,DWORD PTR DS:[EBX+2F8]
	00533A1B  E8 D402F0FF       CALL WSWATCH.00433CF4
	00533A20  A0 4C3D5300       MOV AL,BYTE PTR DS:[533D4C]
	00533A25  50                PUSH EAX
	00533A26  8D45 E8           LEA EAX,DWORD PTR SS:[EBP-18]
	00533A29  50                PUSH EAX
	00533A2A  A1 34A05600       MOV EAX,DWORD PTR DS:[56A034]
	00533A2F  8B00              MOV EAX,DWORD PTR DS:[EAX]
	00533A31  8B80 EC010000     MOV EAX,DWORD PTR DS:[EAX+1EC]			//[[56A034]+1EC] here is licensed users name

SO, now we look for other refs.

Called from:
	00453836  |. FF93 D8000000  CALL DWORD PTR DS:[EBX+D8]						// called here
	0045383C  |> 807D FB 00     CMP BYTE PTR SS:[EBP-5],0
	00453840  |. 74 08          JE SHORT WSWATCH_.0045384A						// no jump

CHANGE:	
	0052A3A0  /. 55             PUSH EBP
	...
	0052A495  |> 68 14A95200    PUSH WSWATCH_.0052A914                   ;  ASCII "     ("		// okay here is where it begins to put titlebar of unregged days left
	0052A49A  |. 8D45 E8        LEA EAX,DWORD PTR SS:[EBP-18]
	0052A49D  |. 50             PUSH EAX
	0052A49E  |. 8D55 E4        LEA EDX,DWORD PTR SS:[EBP-1C]
	0052A4A1  |. B8 FE030000    MOV EAX,3FE
	0052A4A6  |. E8 95B3F7FF    CALL WSWATCH_.004A5840
	0052A4AB  |. 8B45 E4        MOV EAX,DWORD PTR SS:[EBP-1C]
	0052A4AE  |. 8975 DC        MOV DWORD PTR SS:[EBP-24],ESI
	0052A4B1  |. C645 E0 00     MOV BYTE PTR SS:[EBP-20],0
	0052A4B5  |. 8D55 DC        LEA EDX,DWORD PTR SS:[EBP-24]
	0052A4B8  |. 33C9           XOR ECX,ECX
	0052A4BA  |. E8 6D07EEFF    CALL WSWATCH_.0040AC2C
	0052A4BF  |. FF75 E8        PUSH DWORD PTR SS:[EBP-18]
	0052A4C2  |. 68 24A95200    PUSH WSWATCH_.0052A924
	0052A4C7  |. 68 F8A85200    PUSH WSWATCH_.0052A8F8                   ;  ASCII "     "
	0052A4CC  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0052A4D1  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0052A4D3  |. 05 88030000    ADD EAX,388
	0052A4D8  |. BA 04000000    MOV EDX,4
	0052A4DD  |. E8 5E9DEDFF    CALL WSWATCH_.00404240
	0052A4E2  |> E9 01000000    JMP WSWATCH_.0052A4E8						// is this one of our special jumps? yes.
	0052A4E7  |  E9             DB E9								// but if we nop, then we get default unregged titlebar
	0052A4E8  |> 68 F8A85200    PUSH WSWATCH_.0052A8F8                   ;  ASCII "     "
	0052A4ED  |. 8D55 D8        LEA EDX,DWORD PTR SS:[EBP-28]
	0052A4F0  |. B8 FD030000    MOV EAX,3FD
	0052A4F5  |. E8 46B3F7FF    CALL WSWATCH_.004A5840
	0052A4FA  |. FF75 D8        PUSH DWORD PTR SS:[EBP-28]						// pushes "License"
	0052A4FD  |. 68 08A95200    PUSH WSWATCH_.0052A908                   ;  ASCII ": "		// pushes ":"
	0052A502  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0052A507  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0052A509  |. FFB0 EC010000  PUSH DWORD PTR DS:[EAX+1EC]						// pushes user name [blank for crack]
	0052A50F  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0052A514  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0052A516  |. 05 88030000    ADD EAX,388
	0052A51B  |. BA 04000000    MOV EDX,4
	0052A520  |. E8 1B9DEDFF    CALL WSWATCH_.00404240
	0052A525  |. EB 04          JMP SHORT WSWATCH_.0052A52B
TO:
	0052A495     E9 91000000    JMP WSWATCH_.0052A52B

This removes all titlebar text.

Question:
Should we be retting from this entire call??? it looks like it is doing other stuff though.
Actually i think there is a date check and other stuff here, so maybe we should ret from begining...
-----------------------------------------------------------------------------




-----------------------------------------------------------------------------
-ABOUT BOX: FIXING FAULT AND CUSTOMIZING ------------------------------------
-----------------------------------------------------------------------------
If you do about box, ww's own internal exception catcher is triggered with this error:
	Call stack:
	:00409504 [WSWATCH_NOEXPIRENOLIMITS_CUSTOMID_MAKEPRO1.EXE]
	:00409BED [WSWATCH_NOEXPIRENOLIMITS_CUSTOMID_MAKEPRO1.EXE]
	:0044C60B [WSWATCH_NOEXPIRENOLIMITS_CUSTOMID_MAKEPRO1.EXE]
	:0044C28E [WSWATCH_NOEXPIRENOLIMITS_CUSTOMID_MAKEPRO1.EXE]
	:00453154 [WSWATCH_NOEXPIRENOLIMITS_CUSTOMID_MAKEPRO1.EXE]
	:0052A686 [WSWATCH_NOEXPIRENOLIMITS_CUSTOMID_MAKEPRO1.EXE]
	:0045383C [WSWATCH_NOEXPIRENOLIMITS_CUSTOMID_MAKEPRO1.EXE]
	:00453028 [WSWATCH_NOEXPIRENOLIMITS_CUSTOMID_MAKEPRO1.EXE]
	:00565694 [WSWATCH_NOEXPIRENOLIMITS_CUSTOMID_MAKEPRO1.EXE]
And then says pro version.
Obvoiusly it is not happy about lack of user name.  So, we fix.

	00533A12  8B55 EC           MOV EDX,DWORD PTR SS:[EBP-14]
	00533A15  8B83 F8020000     MOV EAX,DWORD PTR DS:[EBX+2F8]
	00533A1B  E8 D402F0FF       CALL WSWATCH.00433CF4
	00533A20  A0 4C3D5300       MOV AL,BYTE PTR DS:[533D4C]
	00533A25  50                PUSH EAX
	00533A26  8D45 E8           LEA EAX,DWORD PTR SS:[EBP-18]
	00533A29  50                PUSH EAX
	00533A2A  A1 34A05600       MOV EAX,DWORD PTR DS:[56A034]
	00533A2F  8B00              MOV EAX,DWORD PTR DS:[EAX]
	00533A31  8B80 EC010000     MOV EAX,DWORD PTR DS:[EAX+1EC]			//[[56A034]+1EC] here is licensed users name
	..
	* Possible StringData Ref from Code Obj ->"Personal Edition / "
	:00533A98 BA703D5300              mov edx, 00533D70
	:00533A9D 8B8304030000            mov eax, dword ptr [ebx+00000304]
	:00533AA3 E84C02F0FF              call 00433CF4
	:00533AA8 EB10                    jmp 00533ABA
	* Referenced by a (U)nconditional or (C)onditional Jump at Address:
	|:00533A96(C)
	* Possible StringData Ref from Code Obj ->"PRO Edition / "
	:00533AAA BA8C3D5300              mov edx, 00533D8C
	:00533AAF 8B8304030000            mov eax, dword ptr [ebx+00000304]
	:00533AB5 E83A02F0FF              call 00433CF4
	* Referenced by a (U)nconditional or (C)onditional Jump at Address:
	|:00533AA8(U)
	:00533ABA 8D45E0                  lea eax, dword ptr [ebp-20]
	:00533ABD 50                      push eax
	:00533ABE A134A05600              mov eax, dword ptr [0056A034]
	:00533AC3 8B00                    mov eax, dword ptr [eax]
	:00533AC5 8B8004010000            mov eax, dword ptr [eax+00000104]
	:00533ACB B902000000              mov ecx, 00000002
	:00533AD0 BA0B000000              mov edx, 0000000B
	:00533AD5 E8AE08EDFF              call 00404388
	:00533ADA 8B45E0                  mov eax, dword ptr [ebp-20]				// nop - we can use this space for our own mods.
	:00533ADD BAA43D5300              mov edx, 00533DA4					// nop
	:00533AE2 E8A907EDFF              call 00404290						// nop
	:00533AE7 752C                    jne 00533B15						// nop
	:00533AE9 8D55DC                  lea edx, dword ptr [ebp-24]
	:00533AEC 8BB304030000            mov esi, dword ptr [ebx+00000304]
	:00533AF2 8BC6                    mov eax, esi
	:00533AF4 E8CB01F0FF              call 00433CC4
	:00533AF9 8D45DC                  lea eax, dword ptr [ebp-24]
	* Possible StringData Ref from Code Obj ->"Site License"
	:00533AFC BAB03D5300              mov edx, 00533DB0
	:00533B01 E88206EDFF              call 00404188
	:00533B06 8B55DC                  mov edx, dword ptr [ebp-24]
	:00533B09 8BC6                    mov eax, esi
	:00533B0B E8E401F0FF              call 00433CF4
	:00533B10 E915010000              jmp 00533C2A
	* Referenced by a (U)nconditional or (C)onditional Jump at Address:
	|:00533AE7(C)
	:00533B15 8D45D8                  lea eax, dword ptr [ebp-28]
	:00533B18 50                      push eax
	:00533B19 A134A05600              mov eax, dword ptr [0056A034]
	:00533B1E 8B00                    mov eax, dword ptr [eax]
	:00533B20 8B8004010000            mov eax, dword ptr [eax+00000104]
	:00533B26 B902000000              mov ecx, 00000002
	:00533B2B BA0B000000              mov edx, 0000000B
	:00533B30 E85308EDFF              call 00404388
	:00533B35 8B45D8                  mov eax, dword ptr [ebp-28]
	:00533B38 BAC83D5300              mov edx, 00533DC8
	:00533B3D E84E07EDFF              call 00404290
	:00533B42 752C                    jne 00533B70
	:00533B44 8D55D4                  lea edx, dword ptr [ebp-2C]
	:00533B47 8BB304030000            mov esi, dword ptr [ebx+00000304]
	:00533B4D 8BC6                    mov eax, esi
	:00533B4F E87001F0FF              call 00433CC4
	:00533B54 8D45D4                  lea eax, dword ptr [ebp-2C]
	* Possible StringData Ref from Code Obj ->"Site License 25-user"

We could just replace manually the data text "Site License" in file with our own custom license text
using a hex editor, BUT for 4 bytes we can just do it programmatically.

CHANGE
	:00533AD5 E8AE08EDFF              call 00404388
	:00533ADA 8B45E0                  mov eax, dword ptr [ebp-20]				// nop - we can use this space for our own mods.
	:00533ADD BAA43D5300              mov edx, 00533DA4					// nop
	:00533AE2 E8A907EDFF              call 00404290						// nop
	:00533AE7 752C                    jne 00533B15						// nop
	:00533AE9 8D55DC                  lea edx, dword ptr [ebp-24]
	:00533AEC 8BB304030000            mov esi, dword ptr [ebx+00000304]
	:00533AF2 8BC6                    mov eax, esi
	:00533AF4 E8CB01F0FF              call 00433CC4
	:00533AF9 8D45DC                  lea eax, dword ptr [ebp-24]
	* Possible StringData Ref from Code Obj ->"Site License"
	:00533AFC BAB03D5300              mov edx, 00533DB0
TO:
	00533ADA     BE B03D5300    MOV ESI,WSWATCH_.00533DB0                ;  ASCII "Site License"
	00533ADF     C706 20454154  MOV DWORD PTR DS:[ESI],54414520
	00533AE5  |. 90             NOP
	00533AE6  |. 90             NOP
	00533AE7  |. 90             NOP
	00533AE8  |. 90             NOP
WHY:
	"EAT" = hex 45 41 54
	as a byteswapped dword with leading space = 54414520
	so we move these bytes over the first 4 bytes (dword) of the "Site License" string.
-----------------------------------------------------------------------------




-----------------------------------------------------------------------------
-ALLOWING CUSTOM BROWSER ID--------------------------------------------------
-----------------------------------------------------------------------------
Elsewhere when we trick program into thinking it is the pro version it will
 then enable the text box so user can change browser id, but it still resets
 this string each time.  Here we fix.

	00534B3C  /$ 55             PUSH EBP
	00534B3D  |. 8BEC           MOV EBP,ESP
	00534B3F  |. B9 3D000000    MOV ECX,3D
	00534B44  |> 6A 00          PUSH 0
	00534B46  |. 6A 00          PUSH 0
	00534B48  |. 49             DEC ECX
	00534B49  |.^75 F9          JNZ SHORT WSWATCH_.00534B44
	00534B4B  |. 53             PUSH EBX
	00534B4C  |. 56             PUSH ESI
	00534B4D  |. 33C0           XOR EAX,EAX
	00534B4F  |. 55             PUSH EBP
	00534B50  |. 68 8F765300    PUSH WSWATCH_.0053768F
	00534B55  |. 64:FF30        PUSH DWORD PTR FS:[EAX]
	00534B58  |. 64:8920        MOV DWORD PTR FS:[EAX],ESP
	00534B5B  |. 8D45 E0        LEA EAX,DWORD PTR SS:[EBP-20]
	00534B5E  |. BA A8765300    MOV EDX,WSWATCH_.005376A8                ;  ASCII "wswatch.cfg"
	00534B63  |. E8 30F4ECFF    CALL WSWATCH_.00403F98
	00534B68  |> 8D45 E8        LEA EAX,DWORD PTR SS:[EBP-18]
	00534B6B  |. E8 90F3ECFF    CALL WSWATCH_.00403F00
	00534B70  |. 8D45 E4        LEA EAX,DWORD PTR SS:[EBP-1C]
	...
	...
	00535342  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	00535344  |. 83C0 68        ADD EAX,68
	00535347  |. BA 847B5300    MOV EDX,WSWATCH_.00537B84                ;  ASCII "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt; WebSite-Watcher (unreg.) http://aignes.net)"
	0053534C  |. E8 03ECECFF    CALL WSWATCH_.00403F54
	00535351  \. E9 35000000    JMP WSWATCH_.0053538B
	00535356     E2             DB E2
	...
	0053533D  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	00535342  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	00535344  |. 83C0 68        ADD EAX,68
	00535347  |. BA 847B5300    MOV EDX,WSWATCH_.00537B84                ;  ASCII "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt; WebSite-Watcher (unreg.) http://aignes.net)"
	0053534C  |. E8 03ECECFF    CALL WSWATCH_.00403F54
	00535351  \. E9 35000000    JMP WSWATCH_.0053538B			// <---------- HERE IS TYPICAL JUMP OVER REGGED VERSION CODE
	00535356     E2             DB E2
	00535357  /. 8D85 64FFFFFF  LEA EAX,DWORD PTR SS:[EBP-9C]		// <---------- make it jump to here
	0053535D  |. 50             PUSH EAX
	0053535E  |. 8D45 F0        LEA EAX,DWORD PTR SS:[EBP-10]
	00535361  |. B9 F07B5300    MOV ECX,WSWATCH_.00537BF0                ;  ASCII "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; DigExt)"
	00535366  |. BA 307C5300    MOV EDX,WSWATCH_.00537C30                ;  ASCII "browser_identify_as"
-----------------------------------------------------------------------------




-----------------------------------------------------------------------------
-FIXING LIMIT ON ONLY CHECKING 5 BOOKMARKS-----------------------------------
-----------------------------------------------------------------------------
This is a tricky one.  After seeming to get the program to checkbookmarks,
 i discovered that the program was refusing to check more than the first 5
 bookmarks.

	00555E2A  |> E8 1DEBFFFF    CALL WQR18EXP.0055494C				// here is our good old bookmark check routine.
	00555E2F  |. 8BD8           MOV EBX,EAX						// eax=bookmark number, or FFFFFFFF on no more
	00555E31  |. 83FB FF        CMP EBX,-1
	00555E34  |. 74 2A          JE SHORT WQR18EXP.00555E60				// taken on 5th bookmark to abort (ebx=FFFFFFFF)

looking inside that procedure we see some code that looks promising.

CHANGE:
	005549CC  |. 8B17           MOV EDX,DWORD PTR DS:[EDI]
	005549CE  |. 0382 AC020000  ADD EAX,DWORD PTR DS:[EDX+2AC]
	005549D4  |. B9 07000000    MOV ECX,7
	005549D9  |. 99             CDQ
	005549DA  |. F7F9           IDIV ECX
	005549DC  |. 83FA 05        CMP EDX,5							// check #1of2
	005549DF  |. 75 0D          JNZ SHORT WQR18EXP.005549EE
	005549E1  |. E8 62BCFFFF    CALL WQR18EXP.00550648
	005549E6  |. 84C0           TEST AL,AL
	005549E8  |. 0F84 47010000  JE WQR18EXP.00554B35
	005549EE  |> EB 04          JMP SHORT WQR18EXP.005549F4
	005549F0  |  3A             DB 3A                                    ;  CHAR ':'
	005549F1  |  C6             DB C6
	005549F2  |  9B             DB 9B
	005549F3  |  63             DB 63                                    ;  CHAR 'c'
	005549F4  |> 8B07           MOV EAX,DWORD PTR DS:[EDI]
	005549F6  |. 83B8 EC010000 >CMP DWORD PTR DS:[EAX+1EC],0
	005549FD  |. 75 34          JNZ SHORT WQR18EXP.00554A33
	005549FF  |. A1 30D05600    MOV EAX,DWORD PTR DS:[56D030]
	00554A04  |. 8B40 08        MOV EAX,DWORD PTR DS:[EAX+8]
	00554A07  |. 8B17           MOV EDX,DWORD PTR DS:[EDI]
	00554A09  |. 2B82 A8020000  SUB EAX,DWORD PTR DS:[EDX+2A8]
	00554A0F  |. 8B17           MOV EDX,DWORD PTR DS:[EDI]
	00554A11  |. 0382 AC020000  ADD EAX,DWORD PTR DS:[EDX+2AC]
	00554A17  |. B9 07000000    MOV ECX,7
	00554A1C  |. 99             CDQ
	00554A1D  |. F7F9           IDIV ECX
	00554A1F  |. 83FA 05        CMP EDX,5							// check #2of
	00554A22  |. 75 0F          JNZ SHORT WQR18EXP.00554A33
TO
	005549DC     83FA FF        CMP EDX,-1
	00554A1F     83FA FF        CMP EDX,-1

OK THIS FIXES 5 LIMIT!!!
But it still stops after maximum simultaneous checks (default 10, set in options, will work up to 28!)
What should happen is it should do max simulteneous at one time, but then move on to rest as the
previous ones finish.  There is another check...

looks like the call to 5549CC is a call to create a THREAD to
check bookbarks.  So 3 simultaneous download creates 3 threads.
And the threads must autonomously move through the list.

	0055B7E3  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
	0055B7E6  |. 8942 30        MOV DWORD PTR DS:[EDX+30],EAX		// eax=0
	0055B7E9  |> 8D85 C4FDFFFF  LEA EAX,DWORD PTR SS:[EBP-23C]
	0055B7EF  |. 8B15 34A05600  MOV EDX,DWORD PTR DS:[56A034]            ;  WSWATCH_.0056D03C
	0055B7F5  |. 8B12           MOV EDX,DWORD PTR DS:[EDX]
	0055B7F7  |. 8B92 2C020000  MOV EDX,DWORD PTR DS:[EDX+22C]
	0055B7FD  |. E8 A688EAFF    CALL WSWATCH_.004040A8
	0055B802  |. 8B85 C4FDFFFF  MOV EAX,DWORD PTR SS:[EBP-23C]
	0055B808  |. 8D95 C8FDFFFF  LEA EDX,DWORD PTR SS:[EBP-238]
	0055B80E  |. E8 99DDEAFF    CALL WSWATCH_.004095AC
	0055B813  |. 8B95 C8FDFFFF  MOV EDX,DWORD PTR SS:[EBP-238]
	0055B819  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B81E  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B820  |. 8B80 80010000  MOV EAX,DWORD PTR DS:[EAX+180]
	0055B826  |. E8 658AEAFF    CALL WSWATCH_.00404290
	0055B82B  |. 74 07          JE SHORT WSWATCH_.0055B834
	0055B82D  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
	0055B830  |. 8368 30 03     SUB DWORD PTR DS:[EAX+30],3			// makes [eax+30] neg
	0055B834  |> A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B839  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B83B  |. 83B8 A8020000 >CMP DWORD PTR DS:[EAX+2A8],0
	0055B842  |. 0F8E 8D000000  JLE WSWATCH_.0055B8D5
	0055B848  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B84D  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B84F  |. 8B80 AC020000  MOV EAX,DWORD PTR DS:[EAX+2AC]
	0055B855  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
	0055B858  |. 3B42 30        CMP EAX,DWORD PTR DS:[EDX+30]
	0055B85B  |. 7D 78          JGE SHORT WSWATCH_.0055B8D5			// jumps on bad (eax==0, [edx+30]=FFFFFFFD
	0055B85D  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B862  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B864  |. 80B8 B1020000 >CMP BYTE PTR DS:[EAX+2B1],0
	0055B86B  |. 75 68          JNZ SHORT WSWATCH_.0055B8D5
	0055B86D  |. 33DB           XOR EBX,EBX
	0055B86F  |. EB 36          JMP SHORT WSWATCH_.0055B8A7
	0055B871  |> E8 D690FFFF    CALL WSWATCH_.0055494C			// call to next thread
	0055B876  |. 8BD8           MOV EBX,EAX
	0055B878  |. 83FB FF        CMP EBX,-1
	0055B87B  |. 74 2A          JE SHORT WSWATCH_.0055B8A7
	0055B87D  |. 8BD3           MOV EDX,EBX
	0055B87F  |. A1 30D05600    MOV EAX,DWORD PTR DS:[56D030]
	0055B884  |. E8 4370EBFF    CALL WSWATCH_.004128CC
	0055B889  |. C640 21 00     MOV BYTE PTR DS:[EAX+21],0
	0055B88D  |. 8B15 34A05600  MOV EDX,DWORD PTR DS:[56A034]            ;  WSWATCH_.0056D03C
	0055B893  |. 8B12           MOV EDX,DWORD PTR DS:[EDX]
	0055B895  |. FF82 AC020000  INC DWORD PTR DS:[EDX+2AC]
	0055B89B  |. 8BCB           MOV ECX,EBX
	0055B89D  |. 8BD0           MOV EDX,EAX
	0055B89F  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
	0055B8A2  |. E8 25ABFFFF    CALL WSWATCH_.005563CC
	0055B8A7  |> 43             INC EBX
	0055B8A8  |. 0F84 87000000  JE WSWATCH_.0055B935
	0055B8AE  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B8B3  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B8B5  |. 8B80 AC020000  MOV EAX,DWORD PTR DS:[EAX+2AC]
	0055B8BB  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
	0055B8BE  |. 3B42 30        CMP EAX,DWORD PTR DS:[EDX+30]		// jumps on bad, [edx+30]=FFFFFFFD
	0055B8C1  |. 7D 72          JGE SHORT WSWATCH_.0055B935
	0055B8C3  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B8C8  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B8CA  |. 80B8 B1020000 >CMP BYTE PTR DS:[EAX+2B1],0
	0055B8D1  |.^74 9E          JE SHORT WSWATCH_.0055B871			// jump above to do next thread
	0055B8D3  |. EB 60          JMP SHORT WSWATCH_.0055B935
	0055B8D5  |> A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B8DA  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B8DC  |. 83B8 AC020000 >CMP DWORD PTR DS:[EAX+2AC],0
	0055B8E3  |. 75 2E          JNZ SHORT WSWATCH_.0055B913

Interesting...
Look what we found.  a *very* cute and clever check.  it looks like he is coming back to
 the nag screen stuff. he checks whether the user really did press the right key, and
 is not trusting that if you got this far you did.  He is actualy checking the
 chars and comparing them.  and if not match, the program puts no error but just
 restricts bookmark checking...

	00404290  /$ 53             PUSH EBX
	00404291  |. 56             PUSH ESI
	00404292  |. 57             PUSH EDI
	00404293  |. 89C6           MOV ESI,EAX
	00404295  |. 89D7           MOV EDI,EDX
	00404297  |. 39D0           CMP EAX,EDX
	00404299  |. 0F84 8F000000  JE WSWATCH_.0040432E
	0040429F  |. 85F6           TEST ESI,ESI
	004042A1  |. 74 68          JE SHORT WSWATCH_.0040430B
	004042A3  |. 85FF           TEST EDI,EDI
	004042A5  |. 74 6B          JE SHORT WSWATCH_.00404312
	004042A7  |. 8B46 FC        MOV EAX,DWORD PTR DS:[ESI-4]
	004042AA  |. 8B57 FC        MOV EDX,DWORD PTR DS:[EDI-4]
	004042AD  |. 29D0           SUB EAX,EDX
	004042AF  |. 77 02          JA SHORT WSWATCH_.004042B3
	004042B1  |. 01C2           ADD EDX,EAX
	004042B3  |> 52             PUSH EDX
	004042B4  |. C1EA 02        SHR EDX,2
	004042B7  |. 74 26          JE SHORT WSWATCH_.004042DF
	004042B9  |> 8B0E           MOV ECX,DWORD PTR DS:[ESI]
	004042BB  |. 8B1F           MOV EBX,DWORD PTR DS:[EDI]
	004042BD  |. 39D9           CMP ECX,EBX
	004042BF  |. 75 58          JNZ SHORT WSWATCH_.00404319
	004042C1  |. 4A             DEC EDX
	004042C2  |. 74 15          JE SHORT WSWATCH_.004042D9
	004042C4  |. 8B4E 04        MOV ECX,DWORD PTR DS:[ESI+4]
	004042C7  |. 8B5F 04        MOV EBX,DWORD PTR DS:[EDI+4]
	004042CA  |. 39D9           CMP ECX,EBX
	004042CC  |. 75 4B          JNZ SHORT WSWATCH_.00404319
	004042CE  |. 83C6 08        ADD ESI,8
	004042D1  |. 83C7 08        ADD EDI,8
	004042D4  |. 4A             DEC EDX
	004042D5  |.^75 E2          JNZ SHORT WSWATCH_.004042B9
	004042D7  |. EB 06          JMP SHORT WSWATCH_.004042DF
	004042D9  |> 83C6 04        ADD ESI,4
	004042DC  |. 83C7 04        ADD EDI,4
	004042DF  |> 5A             POP EDX
	004042E0  |. 83E2 03        AND EDX,3
	004042E3  |. 74 22          JE SHORT WSWATCH_.00404307
	004042E5  |. 8B0E           MOV ECX,DWORD PTR DS:[ESI]		// required Key press ('W' or 'A' or 'T' or 'C' or 'H')
	004042E7  |. 8B1F           MOV EBX,DWORD PTR DS:[EDI]		// real keypress (order above may be reversed)
	004042E9  |. 38D9           CMP CL,BL				//
	004042EB  |. 75 41          JNZ SHORT WSWATCH_.0040432E
	004042ED  |. 4A             DEC EDX
	004042EE  |. 74 17          JE SHORT WSWATCH_.00404307
	004042F0  |. 38FD           CMP CH,BH
	004042F2  |. 75 3A          JNZ SHORT WSWATCH_.0040432E
	004042F4  |. 4A             DEC EDX
	004042F5  |. 74 10          JE SHORT WSWATCH_.00404307
	004042F7  |. 81E3 0000FF00  AND EBX,FF0000
	004042FD  |. 81E1 0000FF00  AND ECX,FF0000
	00404303  |. 39D9           CMP ECX,EBX
	00404305  |. 75 27          JNZ SHORT WSWATCH_.0040432E
	00404307  |> 01C0           ADD EAX,EAX
	00404309  |. EB 23          JMP SHORT WSWATCH_.0040432E
	0040430B  |> 8B57 FC        MOV EDX,DWORD PTR DS:[EDI-4]
	0040430E  |. 29D0           SUB EAX,EDX
	00404310  |. EB 1C          JMP SHORT WSWATCH_.0040432E
	00404312  |> 8B46 FC        MOV EAX,DWORD PTR DS:[ESI-4]
	00404315  |. 29D0           SUB EAX,EDX
	00404317  |. EB 15          JMP SHORT WSWATCH_.0040432E
	00404319  |> 5A             POP EDX
	0040431A  |. 38D9           CMP CL,BL
	0040431C  |. 75 10          JNZ SHORT WSWATCH_.0040432E
	0040431E  |. 38FD           CMP CH,BH
	00404320  |. 75 0C          JNZ SHORT WSWATCH_.0040432E
	00404322  |. C1E9 10        SHR ECX,10
	00404325  |. C1EB 10        SHR EBX,10
	00404328  |. 38D9           CMP CL,BL
	0040432A  |. 75 02          JNZ SHORT WSWATCH_.0040432E
	0040432C  |. 38FD           CMP CH,BH
	0040432E  |> 5F             POP EDI
	0040432F  |. 5E             POP ESI
	00404330  |. 5B             POP EBX
	00404331  \. C3             RETN

To fix this check limit,
(actually this still has a flaw in that only 1 new thread spawns regardless of simultaneous check file):
	0055B7B2  |. 8B12           MOV EDX,DWORD PTR DS:[EDX]
	0055B7B4  |. 8B52 0C        MOV EDX,DWORD PTR DS:[EDX+C]
	0055B7B7  |. E8 EC88EAFF    CALL WSWATCH_.004040A8
	0055B7BC  |. 8B95 CCFDFFFF  MOV EDX,DWORD PTR SS:[EBP-234]
	0055B7C2  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B7C7  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B7C9  |. 8B80 80010000  MOV EAX,DWORD PTR DS:[EAX+180]
	0055B7CF  |. E8 BC8AEAFF    CALL WSWATCH_.00404290
	0055B7D4     EB 13          JMP SHORT WSWATCH_.0055B7E9							// force
	0055B7D6  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
	0055B7D9  |. 8B40 30        MOV EAX,DWORD PTR DS:[EAX+30]
	0055B7DC  |. 99             CDQ
	0055B7DD  |. 33C2           XOR EAX,EDX
	0055B7DF  |. 2BC2           SUB EAX,EDX
	0055B7E1  |. F7D8           NEG EAX
	0055B7E3  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
	0055B7E6  |. 8942 30        MOV DWORD PTR DS:[EDX+30],EAX
	0055B7E9  |> 8D85 C4FDFFFF  LEA EAX,DWORD PTR SS:[EBP-23C]
	0055B7EF  |. 8B15 34A05600  MOV EDX,DWORD PTR DS:[56A034]            ;  WSWATCH_.0056D03C
	0055B7F5  |. 8B12           MOV EDX,DWORD PTR DS:[EDX]
	0055B7F7  |. 8B92 2C020000  MOV EDX,DWORD PTR DS:[EDX+22C]
	0055B7FD  |. E8 A688EAFF    CALL WSWATCH_.004040A8
	0055B802  |. 8B85 C4FDFFFF  MOV EAX,DWORD PTR SS:[EBP-23C]
	0055B808  |. 8D95 C8FDFFFF  LEA EDX,DWORD PTR SS:[EBP-238]
	0055B80E  |. E8 99DDEAFF    CALL WSWATCH_.004095AC
	0055B813  |. 8B95 C8FDFFFF  MOV EDX,DWORD PTR SS:[EBP-238]
	0055B819  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B81E  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B820  |. 8B80 80010000  MOV EAX,DWORD PTR DS:[EAX+180]
	0055B826  |. E8 658AEAFF    CALL WSWATCH_.00404290
	0055B82B     EB 07          JMP SHORT WSWATCH_.0055B834							// force
	0055B82D  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
	0055B830  |. 8368 30 03     SUB DWORD PTR DS:[EAX+30],3
	0055B834  |> A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B839  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B83B  |. 83B8 A8020000 >CMP DWORD PTR DS:[EAX+2A8],0
	0055B842  |. 0F8E 8D000000  JLE WSWATCH_.0055B8D5
	0055B848  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B84D  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B84F  |. 8B80 AC020000  MOV EAX,DWORD PTR DS:[EAX+2AC]
	0055B855  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]						// eax==currently running threads
	0055B858  |. 3B42 30        CMP EAX,DWORD PTR DS:[EDX+30]						// [edx+30]==allowed threads
	0055B85B     7F 78          JG SHORT WSWATCH_.0055B8D5							// can also set to JL
	0055B85D  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B862  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B864  |. 80B8 B1020000 >CMP BYTE PTR DS:[EAX+2B1],0
	0055B86B  |. 75 68          JNZ SHORT WSWATCH_.0055B8D5
	0055B86D  |. 33DB           XOR EBX,EBX
	0055B86F  |. EB 36          JMP SHORT WSWATCH_.0055B8A7
	0055B871  |> E8 D690FFFF    CALL WSWATCH_.0055494C
	0055B876  |. 8BD8           MOV EBX,EAX
	0055B878  |. 83FB FF        CMP EBX,-1
	0055B87B  |. 74 2A          JE SHORT WSWATCH_.0055B8A7
	0055B87D  |. 8BD3           MOV EDX,EBX
	0055B87F  |. A1 30D05600    MOV EAX,DWORD PTR DS:[56D030]
	0055B884  |. E8 4370EBFF    CALL WSWATCH_.004128CC
	0055B889  |. C640 21 00     MOV BYTE PTR DS:[EAX+21],0
	0055B88D  |. 8B15 34A05600  MOV EDX,DWORD PTR DS:[56A034]            ;  WSWATCH_.0056D03C
	0055B893  |. 8B12           MOV EDX,DWORD PTR DS:[EDX]
	0055B895  |. FF82 AC020000  INC DWORD PTR DS:[EDX+2AC]
	0055B89B  |. 8BCB           MOV ECX,EBX
	0055B89D  |. 8BD0           MOV EDX,EAX
	0055B89F  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
	0055B8A2  |. E8 25ABFFFF    CALL WSWATCH_.005563CC
	0055B8A7  |> 43             INC EBX
	0055B8A8  |. 0F84 87000000  JE WSWATCH_.0055B935
	0055B8AE  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B8B3  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B8B5  |. 8B80 AC020000  MOV EAX,DWORD PTR DS:[EAX+2AC]
	0055B8BB  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]
	0055B8BE  |. 3B42 30        CMP EAX,DWORD PTR DS:[EDX+30]
	0055B8C1     7F 72          JG SHORT WSWATCH_.0055B935							// can also set to JL
	0055B8C3  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B8C8  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B8CA  |. 80B8 B1020000 >CMP BYTE PTR DS:[EAX+2B1],0
	0055B8D1  |.^74 9E          JE SHORT WSWATCH_.0055B871
	0055B8D3  |. EB 60          JMP SHORT WSWATCH_.0055B935
	0055B8D5  |> A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055B8DA  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055B8DC  |. 83B8 AC020000 >CMP DWORD PTR DS:[EAX+2AC],0
	0055B8E3  |. 75 2E          JNZ SHORT WSWATCH_.0055B913
	0055B8E5  |. B8 0A000000    MOV EAX,A
	0055B8EA  |. E8 E974EAFF    CALL WSWATCH_.00402DD8
	0055B8EF  |. 8B15 34A05600  MOV EDX,DWORD PTR DS:[56A034]            ;  WSWATCH_.0056D03C
	
with JGs above, after max simulteaneous finsih, one thread continues
with JLs above, fter max simultaneous finish, ALL rest continue at once.

SO
real fix is not above, but rather here where max threads is
 capped if error is detected:
BPW on the [edx+30] storage of max allowed threads is here
	0055A66A  |. 8B95 80FEFFFF  MOV EDX,DWORD PTR SS:[EBP-180]
	0055A670  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]
	0055A675  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055A677  |. 8B80 18020000  MOV EAX,DWORD PTR DS:[EAX+218]						//
	0055A67D  |. E8 0E9CEAFF    CALL WSWATCH_.00404290							// look who it is, our old friend
	0055A682  \. EB 0C          JMP SHORT WSWATCH_.0055A690							// force this
	0055A684  /. A1 689F5600    MOV EAX,DWORD PTR DS:[569F68]
	0055A689  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0055A68B  |. 33D2           XOR EDX,EDX									// 
	0055A68D  |. 8950 30        MOV DWORD PTR DS:[EAX+30],EDX						// max threads set to 0
	0055A690  \> EB 04          JMP SHORT WSWATCH_.0055A696
-----------------------------------------------------------------------------





-----------------------------------------------------------------------------
-TRIAL PERIOD EXPIRED CHECK--------------------------------------------------
-----------------------------------------------------------------------------
PART1: The program expires and stops working 40 days after install.
We find source of problem by backtracing from terminate call.

	0054DED5  /. 5C             POP ESP
	0054DED6  |. 8D45 F8        LEA EAX,DWORD PTR SS:[EBP-8]
	...
	0054E228  |> E8 9B5BEBFF    CALL WQR18.00403DC8			// call to expire

This called from

	00528E33  |. E8 20C4F7FF    CALL WQR18.004A5258
	00528E38  |. 84C0           TEST AL,AL
	00528E3A  |. 75 05          JNZ SHORT WQR18.00528E41
	00528E3C  |. E8 87AFEDFF    CALL WQR18.00403DC8
	00528E41  |> E8 F6BC0000    CALL WQR18.00534B3C
	00528E46  |. E8 054D0200    CALL WQR18.0054DB50
	00528E4B  |. E8 88D1FFFF    CALL WQR18.00525FD8			// call to expire above
	00528E50  |. 833E 00        CMP DWORD PTR DS:[ESI],0
	00528E53  |. 75 6F          JNZ SHORT WQR18.00528EC4

Called from

	0054E1F7  /. EB 04          JMP SHORT WQR18.0054E1FD
	0054E1F9  |  44             DB 44                                    ;  CHAR 'D'
	0054E1FA  |  B9             DB B9
	0054E1FB  |  8D             DB 8D
	0054E1FC  |  F4             DB F4
	0054E1FD  |> E8 26D0EBFF    CALL WQR18.0040B228				// ?
	0054E202  |. 8B07           MOV EAX,DWORD PTR DS:[EDI]
	0054E204  |. DCA0 B8020000  FSUB QWORD PTR DS:[EAX+2B8]			//==37100 (float install date), force to small value to expire, st(0) already equals current date?
	0054E20A  |. E8 014AEBFF    CALL WQR18.00402C10				// sets eax to days past? (but lots of calls here)
	0054E20F  |. 85D2           TEST EDX,EDX				// edx==0 on both
	0054E211  |. 7D 07          JGE SHORT WQR18.0054E21A
	0054E213  |. F7D8           NEG EAX
	0054E215  |. 83D2 00        ADC EDX,0
	0054E218  |. F7DA           NEG EDX
	0054E21A  |> 83FA 00        CMP EDX,0
	0054E21D  |. 75 07          JNZ SHORT WQR18.0054E226
	0054E21F  |. 83F8 32        CMP EAX,32					// eax==8C on expir, 12 on non expir (days past?)
	0054E222  |. 76 09          JBE SHORT WQR18.0054E22D
	0054E224  |. EB 02          JMP SHORT WQR18.0054E228
	0054E226  |> 7E 05          JLE SHORT WQR18.0054E22D
	0054E228  |> E8 9B5BEBFF    CALL WQR18.00403DC8				// EXIT START PROCEDURE
	0054E22D  |> 33C0           XOR EAX,EAX
	0054E22F  |. 5A             POP EDX
	0054E230  |. 59             POP ECX
	0054E231  |. 59             POP ECX
	0054E232  |. 64:8910        MOV DWORD PTR FS:[EAX],EDX
	0054E235  |. 68 52E25400    PUSH WQR18.0054E252
	0054E23A  |> 8D85 70FFFFFF  LEA EAX,DWORD PTR SS:[EBP-90]
	0054E240  |. BA 24000000    MOV EDX,24
	0054E245  |. E8 DA5CEBFF    CALL WQR18.00403F24
	0054E24A  \. C3             RETN

SO, to force it to think that install date = current date:
	0054E1FD  |> E8 26D0EBFF    CALL WQR18.0040B228
	0054E202  |. 8B07           MOV EAX,DWORD PTR DS:[EDI]
	0054E204     DD90 B8020000  FST QWORD PTR DS:[EAX+2B8]
	0054E20A     EB 07          JMP SHORT WQR18.0054E213
	0054E20C     90             NOP
	0054E20D     90             NOP
	0054E20E     90             NOP

The above fix at 0054E1FD works to keep it from exiting immediately on
 launch.  BUT it still exits as expired with no earning after any bookmark is checked.

PART2: Looks at first like that solves it but really there is another check
 when bookmarks have finished being checked.  This is part 2 of the
 expiration fix.
	0052A6D1   .^E9 0292EDFF    JMP WSWATCH_.004038D8
	0052A6D6   .^EB D6          JMP SHORT WSWATCH_.0052A6AE
	0052A6D8  /> A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]				// flag
	0052A6DD  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0052A6DF  |. 80B8 1D020000 >CMP BYTE PTR DS:[EAX+21D],0
	0052A6E6  |. 0F84 B1010000  JE WSWATCH_.0052A89D
	0052A6EC  |. A1 34A05600    MOV EAX,DWORD PTR DS:[56A034]				//
	0052A6F1  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
	0052A6F3  |. 83B8 EC010000 >CMP DWORD PTR DS:[EAX+1EC],0
	0052A6FA  |. 0F85 9D010000  JNZ WSWATCH_.0052A89D
	0052A700  |. 33D2           XOR EDX,EDX
	0052A702  |. 55             PUSH EBP
	0052A703  |. 68 96A85200    PUSH WSWATCH_.0052A896
	0052A708  |. 64:FF32        PUSH DWORD PTR FS:[EDX]
	0052A70B  |. 64:8922        MOV DWORD PTR FS:[EDX],ESP
	0052A70E  |. B2 01          MOV DL,1
	0052A710  |. A1 58A64900    MOV EAX,DWORD PTR DS:[49A658]
	0052A715  |. E8 AA00F7FF    CALL WSWATCH_.0049A7C4
	0052A71A  |. 8945 F8        MOV DWORD PTR SS:[EBP-8],EAX
	0052A71D  |. 33D2           XOR EDX,EDX
	0052A71F  |. 55             PUSH EBP
	0052A720  |. 68 73A85200    PUSH WSWATCH_.0052A873
	0052A725  |. 64:FF32        PUSH DWORD PTR FS:[EDX]
	0052A728  |. 64:8922        MOV DWORD PTR FS:[EDX],ESP
	0052A72B  |. BA 02000080    MOV EDX,80000002
	0052A730  |. 8B45 F8        MOV EAX,DWORD PTR SS:[EBP-8]
	0052A733  |. E8 6801F7FF    CALL WSWATCH_.0049A8A0
	0052A738  |. 8D55 D4        LEA EDX,DWORD PTR SS:[EBP-2C]
	0052A73B  |. B8 30A95200    MOV EAX,WSWATCH_.0052A930
	0052A740  |. E8 DB9BF7FF    CALL WSWATCH_.004A4320
	0052A745  |. FF75 D4        PUSH DWORD PTR SS:[EBP-2C]
	0052A748  |. 8D4D D0        LEA ECX,DWORD PTR SS:[EBP-30]
	0052A74B  |. BA 007D0000    MOV EDX,7D00
	0052A750  |. B8 54A95200    MOV EAX,WSWATCH_.0052A954                ;  ASCII "WebSite-Watcher"
	0052A755  |. E8 6275F7FF    CALL WSWATCH_.004A1CBC
	0052A75A  |. FF75 D0        PUSH DWORD PTR SS:[EBP-30]
	0052A75D  |. 8D55 CC        LEA EDX,DWORD PTR SS:[EBP-34]
	0052A760  |. B8 6CA95200    MOV EAX,WSWATCH_.0052A96C
	0052A765  |. E8 B69BF7FF    CALL WSWATCH_.004A4320
	0052A76A  |. FF75 CC        PUSH DWORD PTR SS:[EBP-34]
	0052A76D  |. 8D45 F4        LEA EAX,DWORD PTR SS:[EBP-C]
	0052A770  |. BA 03000000    MOV EDX,3
	0052A775  |. E8 C69AEDFF    CALL WSWATCH_.00404240
	0052A77A  |. B1 01          MOV CL,1
	0052A77C  |. 8B55 F4        MOV EDX,DWORD PTR SS:[EBP-C]
	0052A77F  |. 8B45 F8        MOV EAX,DWORD PTR SS:[EBP-8]
	0052A782  |. E8 5D02F7FF    CALL WSWATCH_.0049A9E4
	0052A787  |. 84C0           TEST AL,AL
	0052A789  |. 0F84 CE000000  JE WSWATCH_.0052A85D
	0052A78F  |. 8D55 C8        LEA EDX,DWORD PTR SS:[EBP-38]
	0052A792  |. B8 01000000    MOV EAX,1
	0052A797  |. E8 80F3EDFF    CALL WSWATCH_.00409B1C
	0052A79C  |. 8B55 C8        MOV EDX,DWORD PTR SS:[EBP-38]
	0052A79F  |. 8B45 F8        MOV EAX,DWORD PTR SS:[EBP-8]
	0052A7A2  |. E8 7905F7FF    CALL WSWATCH_.0049AD20
	0052A7A7  |. 84C0           TEST AL,AL
	0052A7A9  |. 74 71          JE SHORT WSWATCH_.0052A81C
	0052A7AB  |. 8D55 C0        LEA EDX,DWORD PTR SS:[EBP-40]
	0052A7AE  |. B8 01000000    MOV EAX,1
	0052A7B3  |. E8 64F3EDFF    CALL WSWATCH_.00409B1C
	0052A7B8  |. 8B55 C0        MOV EDX,DWORD PTR SS:[EBP-40]
	0052A7BB  |. 8D4D C4        LEA ECX,DWORD PTR SS:[EBP-3C]
	0052A7BE  |. 8B45 F8        MOV EAX,DWORD PTR SS:[EBP-8]
	0052A7C1  |. E8 0604F7FF    CALL WSWATCH_.0049ABCC
	0052A7C6  |. 8B45 C4        MOV EAX,DWORD PTR SS:[EBP-3C]
	0052A7C9  |. 8D55 F0        LEA EDX,DWORD PTR SS:[EBP-10]
	0052A7CC  |. E8 DB97F7FF    CALL WSWATCH_.004A3FAC
	0052A7D1  |. 8B45 F0        MOV EAX,DWORD PTR SS:[EBP-10]
	0052A7D4  |. E8 A799EDFF    CALL WSWATCH_.00404180
	0052A7D9  |. 83F8 08        CMP EAX,8
	0052A7DC  |. 75 7F          JNZ SHORT WSWATCH_.0052A85D
	0052A7DE  |. 8B45 F0        MOV EAX,DWORD PTR SS:[EBP-10]
	0052A7E1  |. E8 D6F3EDFF    CALL WSWATCH_.00409BBC
	0052A7E6  |. E8 4180F7FF    CALL WSWATCH_.004A282C
	0052A7EB  |. DD5D DC        FSTP QWORD PTR SS:[EBP-24]
	0052A7EE  |. 9B             WAIT
	0052A7EF  |. E8 080AEEFF    CALL WSWATCH_.0040B1FC
	0052A7F4  |. DC65 DC        FSUB QWORD PTR SS:[EBP-24]
	0052A7F7  |. E8 1484EDFF    CALL WSWATCH_.00402C10
	0052A7FC  |. 85D2           TEST EDX,EDX
	0052A7FE  |. 7D 07          JGE SHORT WSWATCH_.0052A807
	0052A800  |. F7D8           NEG EAX
	0052A802  |. 83D2 00        ADC EDX,0
	0052A805  |. F7DA           NEG EDX
	0052A807  |> 83FA 00        CMP EDX,0
	0052A80A  |. 75 07          JNZ SHORT WSWATCH_.0052A813
	0052A80C  |. 83F8 28        CMP EAX,28
	0052A80F  |. 76 4C          JBE SHORT WSWATCH_.0052A85D
	0052A811  |. EB 02          JMP SHORT WSWATCH_.0052A815
	0052A813  |> 7E 48          JLE SHORT WSWATCH_.0052A85D
	0052A815  |> E8 AE95EDFF    CALL WSWATCH_.00403DC8						// call to exit
	0052A81A  |. EB 41          JMP SHORT WSWATCH_.0052A85D
	0052A81C  |> E8 DB09EEFF    CALL WSWATCH_.0040B1FC
	0052A821  |. 83C4 F8        ADD ESP,-8
	0052A824  |. DD1C24         FSTP QWORD PTR SS:[ESP]
	0052A827  |. 9B             WAIT
	0052A828  |. E8 637FF7FF    CALL WSWATCH_.004A2790
	0052A82D  |. 8D55 B8        LEA EDX,DWORD PTR SS:[EBP-48]
	0052A830  |. E8 E7F2EDFF    CALL WSWATCH_.00409B1C
	0052A835  |. 8B45 B8        MOV EAX,DWORD PTR SS:[EBP-48]
	0052A838  |. 8D55 BC        LEA EDX,DWORD PTR SS:[EBP-44]
	0052A83B  |. E8 B896F7FF    CALL WSWATCH_.004A3EF8
	0052A840  |. 8B45 BC        MOV EAX,DWORD PTR SS:[EBP-44]
	0052A843  |. 50             PUSH EAX
	0052A844  |. 8D55 B4        LEA EDX,DWORD PTR SS:[EBP-4C]
	0052A847  |. B8 01000000    MOV EAX,1
	0052A84C  |. E8 CBF2EDFF    CALL WSWATCH_.00409B1C
	0052A851  |. 8B55 B4        MOV EDX,DWORD PTR SS:[EBP-4C]
	0052A854  |. 8B45 F8        MOV EAX,DWORD PTR SS:[EBP-8]
	0052A857  |. 59             POP ECX
	0052A858  |. E8 4303F7FF    CALL WSWATCH_.0049ABA0
	0052A85D  |> 33C0           XOR EAX,EAX
	0052A85F  |. 5A             POP EDX
	0052A860  |. 59             POP ECX
	0052A861  |. 59             POP ECX
	0052A862  |. 64:8910        MOV DWORD PTR FS:[EAX],EDX
	0052A865  |. 68 7AA85200    PUSH WSWATCH_.0052A87A
	0052A86A  |> 8B45 F8        MOV EAX,DWORD PTR SS:[EBP-8]
	0052A86D  |. E8 0689EDFF    CALL WSWATCH_.00403178
	0052A872  \. C3             RETN

CHANGE
	0052A7EF  |. E8 080AEEFF    CALL WSWATCH_.0040B1FC					// might this be file date check or something else?
	0052A7F4  |. DC65 DC        FSUB QWORD PTR SS:[EBP-24]					//
	0052A7F7  |. E8 1484EDFF    CALL WSWATCH_.00402C10					//
	0052A7FC  |. 85D2           TEST EDX,EDX						//
	0052A7FE  |. 7D 07          JGE SHORT WSWATCH_.0052A807					// 
	0052A800  |. F7D8           NEG EAX
	0052A802  |. 83D2 00        ADC EDX,0
	0052A805  |. F7DA           NEG EDX
	0052A807  |> 83FA 00        CMP EDX,0
	0052A80A  |. 75 07          JNZ SHORT WSWATCH_.0052A813
	0052A80C  |. 83F8 28        CMP EAX,28
	0052A80F  |. 76 4C          JBE SHORT WSWATCH_.0052A85D
	0052A811  |. EB 02          JMP SHORT WSWATCH_.0052A815
	0052A813  |> 7E 48          JLE SHORT WSWATCH_.0052A85D
	0052A815  |> E8 AE95EDFF    CALL WSWATCH_.00403DC8					// exit procedure
TO
	0052A80C  83F8 28           CMP EAX,28
	0052A80F  EB 4C             JMP SHORT WSWATCH_.0052A85D
Voilla! This fixes the 2nd expiration exit after bookmark check.
-----------------------------------------------------------------------------




-----------------------------------------------------------------------------
-EPILOGUE--------------------------------------------------------------------
-----------------------------------------------------------------------------
Okay, phew, this was a tough one.  My thanks to zowatt - again without him
 i wouldnt be able to work on this target.  And for all of you who been
 clamouring for this release... enjoy it, may be the last release of
 website watcher you get for a while ;)
I know these 'stories' aren't much help as tutorials, but maybe they serve
 some purpose.  Im note sure what that could be, but i wont worry about that
 stuff now.  Catty said she never heard of akira kurosawa.  is that
 possible?
-----------------------------------------------------------------------------
