This question has no particular string, use DeDeDark analysis written in Delphi bit to find a few special events
One is the KeyUp
One is chkcode
There is a middle-click or double-click the event area
Directly with the inside of these functions, then find compare and jump instructions, it is easy to find, the final decision whether to jump the middle area in the picture, where the panel's click event
The JNE jump directly into JE blasting can be achieved
Then can be seen from the above comparison instruction, the comparison is a value ESI + 30C and at a size of 85
Then with the inside of each function can be found in the chkcode, if the registration code is correct, memory [ESI + 30C] is assigned 0x3E, or memory [ESI + 30C] is equal to 0, the memory [ESI + 30C] initial value is 0; if the registration code is correct, in chkcode event, the memory [ESI + 30C] is assigned 0x3E, (trigger double-click the rectangle shadow) in Panel1DblClick incident was further assigned 0x85, so (trigger click or double-click the rectangle shadow) in the event Panel1Click 0x0045803B instruction at the jump does not occur, so that feedback successful registration information, rectangle shadow last interface will be replaced by a photograph.
Tracking directly chkcode then find its registration number can be found directly on the stack, it is easy to guess a few simple test is the following string, where the user name is the name
黑头Sun Bird"+str(len(name)+5)+"dseloffc-012-OK"+name