I never tried the program, so actually I don't know its purpose. It was just another victim program to crack :-) The protection: 10 day-trial and a nag. It has a registration option built in.

Run the program, click on "Registration", fill in what you like and click 
the OK button. The program displays: "Your Registration Data is Incorrect!"
Open W32DSM and disassemble. Search for the string above. You should see
this: 

-------------------------Start of partial code------------------------------
* Reference To: USER32.GetDlgItemTextA, Ord:0000h
                                  |
:00416DA8 E827D70000              Call 004244D4
:00416DAD E8AE000000              call 00416E60 <- [call where serial is processed] 
:00416DB2 85C0                    test eax, eax <- [if serial is ok then...] 
:00416DB4 7412                    je 00416DC8   <- [jump to "good boy"] 

* Possible StringData Ref from Data Obj ->"Your Registration Data is Incorrect!"

:00416DB6 683C1C4300              push 00431C3C
:00416DBB 6A30                    push 00000030
:00416DBD 56                      push esi
:00416DBE E8A51B0000              call 00418968
:00416DC3 83C40C                  add esp, 0000000C
:00416DC6 EB47                    jmp 00416E0F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416DB4(C)
|
:00416DC8 6801000080              push 80000001 <- [good boy]

* Possible Indirect StringData Ref from Data Obj ->"username"
                                  |
:00416DCD 689C0A4300              push 00430A9C
:00416DD2 56                      push esi
:00416DD3 E8C0B30000              call 00422198

* Possible StringData Ref from Data Obj ->"You Have Been Successfully Registered."
 
-------------------------End of partial code--------------------------------

I hear you say: "Okay, that's easy. Just change the je 00416DC8 in 
jmp 00416DC8, so it always jumps to the 'good boy' ". Well I also did, but
it didn't work. Why? Let's take a look at the call where the serial is
processed:

-------------------------Start of partial code------------------------------
* Referenced by a CALL at Addresses:
|:00416DAD   , :0041A156   , :0042367A   , :00423811   
|
:00416E60 53                      push ebx
:00416E61 56                      push esi
:00416E62 57                      push edi
:00416E63 55                      push ebp
:00416E64 81C4FCFEFFFF            add esp, FFFFFEFC
:00416E6A 33F6                    xor esi, esi
:00416E6C 8BC4                    mov eax, esp
:00416E6E BB780A4300              mov ebx, 00430A78
:00416E73 33FF                    xor edi, edi
:00416E75 EB66                    jmp 00416EDD
	etc...

-------------------------End of partial code--------------------------------

As you can see, the procedure is called 4 times. Now you could go and patch
all those locations, but there's a better way :) 
I found out that if eax=0 the program is registered. If eax=1 it is 
unregistered. How you can know? -> 
	1. Run the program
	2. Click Registration
	3. Fill in you want
	4. Open SoftIce (ctrl+D)
	5. bpx getdlgitemtexta
	6. Click OK
	7. SoftIce pops up
	8. Press CTRL-D then F12 then twice F10 (hope u understand how and why)
	9. You are now on the "test eax, eax" instruction
	10.Look at the value of eax. Yup it equals "1"
Knowing that you entered a wrong serial this implies that if eax=1 the
program is unregistered.
It also implies that the eax register is set somewhere in the serial 
processing call (=call 00416E60 at :00416DAD)	
Simplified: to crack the program we have to search in the call where eax
is set to 1 or mov eax, 00000001 is executed. Then you'll have to change
that mov instruction to mov eax, 00000000.

In the serial number processing call the "mov eax, 00000001" is found
3 times:

:00416EB1 B801000000              mov eax, 00000001 <- first time
:00416ECE B801000000              mov eax, 00000001 <- second time
:00416F00 B801000000              mov eax, 00000001 <- third time

After cracking:

:00416EB1 B800000000              mov eax, 00000000 <- first time
:00416ECE B800000000              mov eax, 00000000 <- second time
:00416F00 B800000000              mov eax, 00000000 <- third time

Run XFerPro 32 and......program cracked! ;-)

Thanks goto: +ORC, tKC, Qapla and all other fantastic tutorial writers who teached me cracking! :-)

BlackB