CMappedModule.cpp

    std::vector<BYTE> CMappedModule::getRemoteJumpEntry() {
        std::vector<BYTE> ret;
        DWORD dwEntryPoint = mParsedModule.getEntryPoint() + (DWORD)mBaseOfDll;

        // push ebp
        ret.push_back(0x55);
        // mov ebp, esp
        ret.push_back(0x8B); ret.push_back(0xEC);

        // push imm8
        ret.push_back(0x68);
        // lpReserved
        ret.push_back(0); ret.push_back(0); ret.push_back(0); ret.push_back(0);
        // push imm8
        ret.push_back(0x68);
        // dwReason
        ret.push_back(1); ret.push_back(0); ret.push_back(0); ret.push_back(0);
        // push imm32
        ret.push_back(0x68);
        // hInstance
        ret.insert(ret.end(), (BYTE*)&mBaseOfDll, ((BYTE*)&mBaseOfDll) + 4);
        // mov eax
        ret.push_back(0xB8);
        // dllEntryPoint
        ret.insert(ret.end(), (BYTE*)&dwEntryPoint, ((BYTE*)&dwEntryPoint) + 4);
        // call eax
        ret.push_back(0xFF); ret.push_back(0xD0);

        // int 3
        ret.push_back(0xCC);

        // pop eax * 3
        ret.push_back(0x5B);
        ret.push_back(0x5B);
        ret.push_back(0x5B);

        // mov esp, ebp
        ret.push_back(0x8B); ret.push_back(0xE5);
        // pop ebp
        ret.push_back(0x5D);
        // retn 4
        ret.push_back(0xC2); ret.push_back(4); ret.push_back(0);

        return ret;
    }