+---------+
| H O M E |
+---------+
Replacing the trial number with serial number in the program registration box:
The serial number is generated at the call at address 00606881. After that call the serial is moved from the address ebp-C to edx with the command "lea edx, [EBP-C]".
So if you want to replace the trial number on the registration page with your serial number, edit the assembly code on line 00606938 to say "mov edx, [EBP-C]". Make sure you have the button "keep size" and "Fill with NOPs" ticked.
Note: For 6.36 Change the address 00638AA0 to say "mov edx, [ebp-10]". Make sure you have the button "keep size" and "Fill with NOPs" ticked.
For 6.39 Change the address 006383D8 to say "mov ecx, [ebp-10]". Make sure you have the button "keep size" and "Fill with NOPs" ticked.
Skipping past the registration / trial box.
Before the registration box opens, it checks the registry for a key called "RegistrationKey", and if that doesn't exist it executes the jump at 006068D0. If it does exist, it will check what the value of the key is and whether it matches with the serial generated from your GUID key.
If you want to just skip past all of the registration code without checking for a trial or serial number, NOP out the jump at 006068D0. We now need to remove the check to see if the serial number matches the registry value To do that we change 006068DD to say "jmp 0x6069c5", and make sure you have Keep Size and Fill with NOPs checked.
Note: For 6.39 the first jump offset which needs to be NOP'd is "638370" and the second JMP is "63837D."
Note: For 6.42.5 the same process as above applies.
Removing the time from the title bar:
Address 008E6126 loads the time with the command "mov edx, 0x8e62ac". So if you change the value of 0x8e62ac to all 0s it removes the time.
Removing the registration check:
Address 0063836C checks if you have a valid registration code, if you don't it will make you enter one. So to avoid that, just NOP out the command "je 0x638383" at adress 00638370. And then change the command at address 00638370 to "jmp 0x63847a" and it will never ask you to enter a serial number.
I used x32dbg to try test this. It goes without saying you should actually buy the software, and this is for educational purposes only.
+-------+
| E N D |
+-------+