[ENABLE]

aobscanmodule(GetCoins,sekiro.exe,8B 41 7C C3 CC CC CC CC CC CC CC CC CC CC CC CC 32)
alloc(newmem,$1000,"sekiro.exe"+66B4F0)

label(code)
label(return)
label(CBase)
registersymbol(CBase)

newmem:


code:
mov [CBase],rcx
  mov eax,[rcx+7C]
  ret
  int 3
  jmp return

CBase:
dq 0

GetCoins:
  jmp newmem
return:
registersymbol(GetCoins)

[DISABLE]

GetCoins:
  db 8B 41 7C C3 CC

unregistersymbol(GetCoins)
unregistersymbol(CBase)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "sekiro.exe"+66B4F0

"sekiro.exe"+66B4E6: CC                       -  int 3
"sekiro.exe"+66B4E7: CC                       -  int 3
"sekiro.exe"+66B4E8: CC                       -  int 3
"sekiro.exe"+66B4E9: CC                       -  int 3
"sekiro.exe"+66B4EA: CC                       -  int 3
"sekiro.exe"+66B4EB: CC                       -  int 3
"sekiro.exe"+66B4EC: CC                       -  int 3
"sekiro.exe"+66B4ED: CC                       -  int 3
"sekiro.exe"+66B4EE: CC                       -  int 3
"sekiro.exe"+66B4EF: CC                       -  int 3
// ---------- INJECTING HERE ----------
"sekiro.exe"+66B4F0: 8B 41 7C                 -  mov eax,[rcx+7C]
"sekiro.exe"+66B4F3: C3                       -  ret
"sekiro.exe"+66B4F4: CC                       -  int 3
// ---------- DONE INJECTING  ----------
"sekiro.exe"+66B4F5: CC                       -  int 3
"sekiro.exe"+66B4F6: CC                       -  int 3
"sekiro.exe"+66B4F7: CC                       -  int 3
"sekiro.exe"+66B4F8: CC                       -  int 3
"sekiro.exe"+66B4F9: CC                       -  int 3
"sekiro.exe"+66B4FA: CC                       -  int 3
"sekiro.exe"+66B4FB: CC                       -  int 3
"sekiro.exe"+66B4FC: CC                       -  int 3
"sekiro.exe"+66B4FD: CC                       -  int 3
"sekiro.exe"+66B4FE: CC                       -  int 3
}