Of course it wouldn't run by a simple yes/no, It would involve the visitors IP and remote address and an encrypted password only valid for that session
...But in the end, somewhere in your program, you do your verification magic and have an "if blahblahblah all checks out then "yes, run it", else "don't run it". Still a matter of simply overwriting a couple of bytes in the .EXE to change the behavious to "if everything checks out then fail, otherwise run."
Also, be careful with the blocking based on IP -- many ISP's use proxy servers, meaning that web requests get routed through a server on the ISP's side first, and then passed along to yours. That means that the IP that your website sees, is not the actual user IP. If you block this IP from running, you will automatically block *every* user routed through the same proxy server, which in the case of the large ISP's like AOL, Earthlink, etc. can potentially mean millions of people. So... Blocking one 'wrong' IP because of a single bad user could mean that a million other people won't be able to run your program either. your call of course, but just be aware of the potential for problems once you start doing that.