I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID.
It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same hardware, same username, same Ethernet MAC addr, both offline (not connected to the outer world).
It shows 2 different UUIDs, unique to each of the machines.
I think that it checks for installation markers made by Windows installer.... Could be MountPoints, Cryptography seeds - something that is unique to every copy of Win.
Tried to trace it with ProcessMonitor (SysInternals), but after applying all filters and eyeballing 8000+ rows of the output, I couldn't find anything relevant.
What tools would you recommend for tracing any API hooks, or the way it enumerates/probes different parts of the system?
WinDBG and other debuggers are out of luck for me, I'm not really good at x86 assembly language yet...
NSA's Ghidra came up with a pile of gibberish because the program has some obfuscation/antidebugging. Thank you!