Untitled
By: a guest | Feb 9th, 2010 | Syntax:
ASM (NASM) | Size: 1.54 KB | Hits: 102 | Expires: Never
0040B4D2 E9 A9C90000 JMP 00417E80 ; Our Hook (where font.gid is loaded into zMap!)
00417E80 8B44E4 04 MOV EAX,DWORD PTR SS:[ESP+4] ; ESP+4 = [MPQFileBlock Struct] +0x00 DWORD DataPointer, +0x04 DWORD FullSize, +0x08 DataSize, +0x0C HeaderSize
00417E84 60 PUSHAD ; Push All Registers
00417E85 E8 00000000 CALL RMAP.00417E8A ; Trick to get address
00417E8A 5A POP EDX ; Trick to get address (puts 00417E8A (currentaddress) into EDX)
00417E8B 83C2 25 ADD EDX,25 ; EDX now contains 00417EAF --> have added 25 to get address of NEW data pointer
00417E8E B9 50000000 MOV ECX,50 ; size of font.gid
00417E93 8B00 MOV EAX,DWORD PTR DS:[EAX] ; DataPointer
00417E95 8B32 MOV ESI,DWORD PTR DS:[EDX] ; Pointer to current DWORD in loop added to font.gid buffer
00417E97 8930 MOV DWORD PTR DS:[EAX],ESI ; Move Pointer into buffer
00417E99 83C2 04 ADD EDX,4 ; Get OUR next DWORD (4 bytes)
00417E9C 83C0 04 ADD EAX,4 ; Get buffer's next DWORD (4 bytes)
00417E9F 83E9 04 SUB ECX,4 ; remove 4 from size of font.gid to be written
00417EA2 85C9 TEST ECX,ECX ; if font.gid buffer size 0
00417EA4 ^75 EF JNZ SHORT RMAP.00417E95 ; Add next bytes (OR exit function)
00417EA6 61 POPAD ; Pop All Registers
00417EA7 B8 01000000 MOV EAX,1 ; Return Function Successful
00417EAC C2 0400 RETN 4
00417EAF ; OUR font.gid