[Enable]
Alloc(IAT_Hook_GetLastError, 256)
Label(Return)
Label(IAT)
Label(ModifyGMFlag)

IAT_Hook_GetLastError:
// Return Address Filter
cmp [esp],03182616
jne Return
cmp [esp+C],0316B355
jne Return
cmp [esp+10],02F76072
jne Return
mov [esp+10],ModifyGMFlag
Return:
jmp dword ptr [IAT]

ModifyGMFlag:
mov ecx,[edi+00002230]
mov edx,00009A65
mov [ecx+01],al
mov ecx,[edi+00002230]
mov al,[ecx+01]
mov [ecx+04],dx
test al,al
movzx ebx,al
mov edx,0000002A
cmove ebx,edx
mov al,bl
mov byte ptr [ebp+0C],01
xor al,[ebp+0C]
mov [ecx],al
jmp 02F760A1

IAT:
dd KERNEL32.GetLastError


037430FC:
dd IAT_Hook_GetLastError

[Disable]
037430FC:
dd KERNEL32.GetLastError

DeAlloc(IAT_Hook_GetLastError)