__declspec(naked)
VOID
ClientConnection__CharacterLogout_Hook(
    VOID
    )
{
    __asm {
        push    ebp
        mov     ebp,esp
        sub     esp,18h                         ; Allocate space for local variables

        pushfd
        pushad

;
; Get player base address
;
        push    90h
        mov     eax,00468550h
        call    eax                             ; ClntObjMgrGetActivePlayer

        push    edx                             ; Player's GUID (HighPart)
        push    eax                             ; Player's GUID (LowPart)
        mov     edx,008364B4h                   ; '..\Object/ObjectClient/Player_C.h'
        mov     ecx,10h                         ; TYPEMASK_PLAYER
        mov     eax,00468460h
        call    eax
;
; (eax) = player base

;
; Check player faction
;
        add     eax,8
        mov     eax,[eax]
        add     eax,8Ch                         ; UNIT_FIELD_FACTIONTEMPLATE
        cmp     byte ptr [eax],1                ; Is the player alliance?
        jz      PlayerIsAlliance                ; If so, use Stormwind as the zone for CMSG_ZONEUPDATE; otherwise use Orgrimmar

        mov     edx,665h                        ; (edx) = Orgrimmar zone ID
        jmp     $+10

PlayerIsAlliance:
        mov     edx,5EFh                        ; (edx) = Stormwind zone ID

        push    edx

;
; Initialize CDataStore structure
;
        xor     esi,esi
        mov     [ebp-14h],esi                   ; m_data
        mov     [ebp-10h],esi                   ; m_base
        mov     [ebp-0Ch],esi                   ; m_alloc
        mov     [ebp-8],esi                     ; m_size
        mov     dword ptr [ebp-4],0FFFFFFFFh    ; m_read
        mov     dword ptr [ebp-18h],007FF9E4h   ; CDataStore___vftable_

;
; Put CMSG_ZONEUPDATE opcode
;
        push    1F4h                            ; CMSG_ZONEUPDATE
        lea     ecx,[ebp-18h]
        mov     eax,00418190h
        call    eax                             ; CDataStore__PutInt32

;
; Put the zone ID
;
        pop     edx
        push    edx                             ; Zone ID
        lea     ecx,[ebp-18h]
        mov     eax,00418190h
        call    eax                             ; CDataStore__PutInt32

;
; Send the packet
;
        lea     ecx,[ebp-18h]
        mov     [ebp-4],esi
        mov     eax,005AB630h
        call    eax                             ; ClientServices_Send

;
; CleanUp
;
        cmp     dword ptr [ebp-0Ch],0FFFFFFFFh
        mov     dword ptr [ebp-18h],007FF9E4h   ; CDataStore___vftable_
        jz      Exit

        lea     eax,[ebp-0Ch]
        push    eax
        lea     ecx,[ebp-10h]
        push    ecx
        lea     edx,[ebp-14h]
        push    edx
        lea     ecx,[ebp-18h]
        mov     eax,007FF9E8h
        call    [eax]                           ; CDataStore__Release
Exit:
        popad
        popfd

        mov     eax,005AB006h
        jmp     eax                             ; ClientConnection__CharacterLogout + 6
    }
}

VOID
InstallCharacterLogoutHook(
    VOID
    )
{
    CharacterLogoutOriginalCode = DetourFunction((PVOID)FUNCTION_CLIENTCONNECTION_CHARACTERLOGOUT, ClientConnection__CharacterLogout_Hook);
}