Share Pastebin
Guest
Public paste!

Untitled

By: a guest | Feb 9th, 2010 | Syntax: ASM (NASM) | Size: 1.54 KB | Hits: 102 | Expires: Never
This paste has a previous version, view the difference. Copy text to clipboard
  1. 0040B4D2   E9 A9C90000      JMP 00417E80                 ; Our Hook (where font.gid is loaded into zMap!)
  2.  
  3. 00417E80   8B44E4 04        MOV EAX,DWORD PTR SS:[ESP+4] ; ESP+4 = [MPQFileBlock Struct] +0x00 DWORD DataPointer, +0x04 DWORD FullSize, +0x08 DataSize, +0x0C HeaderSize
  4. 00417E84   60               PUSHAD                       ; Push All Registers
  5. 00417E85   E8 00000000      CALL RMAP.00417E8A           ; Trick to get address
  6. 00417E8A   5A               POP EDX                      ; Trick to get address (puts 00417E8A (currentaddress) into EDX)
  7. 00417E8B   83C2 25          ADD EDX,25                   ; EDX now contains 00417EAF --> have added 25 to get address of NEW data pointer
  8. 00417E8E   B9 50000000      MOV ECX,50                   ; size of font.gid
  9. 00417E93   8B00             MOV EAX,DWORD PTR DS:[EAX]   ; DataPointer
  10. 00417E95   8B32             MOV ESI,DWORD PTR DS:[EDX]   ; Pointer to current DWORD in loop added to font.gid buffer
  11. 00417E97   8930             MOV DWORD PTR DS:[EAX],ESI   ; Move Pointer into buffer
  12. 00417E99   83C2 04          ADD EDX,4                    ; Get OUR next DWORD (4 bytes)
  13. 00417E9C   83C0 04          ADD EAX,4                    ; Get buffer's next DWORD (4 bytes)
  14. 00417E9F   83E9 04          SUB ECX,4                    ; remove 4 from size of font.gid to be written
  15. 00417EA2   85C9             TEST ECX,ECX                 ; if font.gid buffer size 0
  16. 00417EA4  ^75 EF            JNZ SHORT RMAP.00417E95      ; Add next bytes (OR exit function)
  17. 00417EA6   61               POPAD                        ; Pop All Registers
  18. 00417EA7   B8 01000000      MOV EAX,1                    ; Return Function Successful
  19. 00417EAC   C2 0400          RETN 4
  20.  
  21. 00417EAF                                                 ; OUR font.gid