Advertisement
Guest User

Untitled

a guest
May 28th, 2017
61
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. [ENABLE]
  2. alloc(YoYoDupe, 1024)
  3. alloc(RunFlag, 4)
  4. alloc(ESIValue, 4)
  5. alloc(EDIValue, 4)
  6. alloc(ESIAddy,4)
  7.  
  8. alloc(hookit,128)
  9.  
  10. registersymbol(YoYoDupe)
  11.  
  12. registersymbol(hookit)
  13.  
  14. registersymbol(ESIAddy)
  15. label(NoVac)
  16.  
  17. label(DupeXVac)
  18.  
  19. label(DoNormal)
  20.  
  21.  
  22. YoYoDupe: //6A3088 @ EMS032 was 6998E0
  23.  
  24. push eax
  25.  
  26. push ecx
  27.  
  28. cmp [RunFlag], 2
  29.  
  30. je DupeXVac
  31.  
  32. mov eax, 006E7AE0 // 89 45 EC 8D 45 D4 50
  33.  
  34. mov eax, [eax]
  35.  
  36. add eax, 61C
  37.  
  38. mov eax, [eax]
  39.  
  40. sub eax, C
  41.  
  42. mov [ESIValue],eax
  43.  
  44. mov eax,[eax+114]
  45.  
  46. mov [EDIValue],eax
  47.  
  48. inc [RunFlag]
  49.  
  50. inc [RunFlag]
  51.  
  52.  
  53. DupeXVac:
  54.  
  55. cmp esi,[ESIValue]
  56.  
  57. je DoNormal
  58.  
  59. push ecx
  60.  
  61. mov ecx,ESIAddy
  62.  
  63. mov [ecx],esi
  64.  
  65. pop ecx
  66.  
  67.  
  68. DoNormal:
  69.  
  70. mov [esi+00000110],edi
  71.  
  72. pop ecx
  73.  
  74. pop eax
  75.  
  76. jmp 6A3418
  77.  
  78.  
  79. ESIAddy:
  80.  
  81. db 00 00 00 00
  82.  
  83.  
  84. RunFlag:
  85.  
  86. db 00 00 00 00
  87.  
  88.  
  89. ESIValue:
  90.  
  91. db 00 00 00 00
  92.  
  93.  
  94. EDIValue:
  95.  
  96. db 00 00 00 00
  97.  
  98.  
  99. hookit: //5250D6 @ EMS033 was 520591
  100.  
  101. cmp [ESIAddy], 0
  102.  
  103. je NoVac
  104.  
  105. push eax
  106.  
  107. push ebx
  108.  
  109. mov eax,[ESIAddy]
  110.  
  111. mov ebx,[EDIValue]
  112.  
  113. mov [eax+110],ebx
  114.  
  115. mov eax,[eax+110]
  116.  
  117. mov [eax+4c],ebx
  118.  
  119. mov [eax+50],ebx
  120.  
  121. pop ebx
  122.  
  123. pop eax
  124.  
  125.  
  126. NoVac:
  127.  
  128. mov [ebx+00000400],eax
  129.  
  130. jmp 525437
  131.  
  132.  
  133. 006A6319:
  134.  
  135. jmp YoYoDupe
  136.  
  137.  
  138. 00527DD3:
  139.  
  140. jmp hookit
  141.  
  142.  
  143. [DISABLE]
  144. 006A6319: //89 BE 10 01 00 00 E8 98
  145.  
  146. db 89 BE 10 01 00
  147.  
  148.  
  149. 00527DD3: //89 83 00 04 00 00 8D 85
  150.  
  151. db 89 83 00 04 00
  152.  
  153.  
  154. unregistersymbol(YoYoDupe)
  155.  
  156. dealloc(YoYoDupe)
  157.  
  158. dealloc(RunFlag)
  159.  
  160. dealloc(ESIValue)
  161.  
  162. dealloc(EDIValue)
  163.  
  164. dealloc(ESIAddy)
  165.  
  166. dealloc(hookit)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement