Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- [ENABLE]
- aobscanmodule(_EnduranceGenes,JWE.exe,66 0F 6E 50 1C) // should be unique
- alloc(newmem25,$1000,JWE.exe)
- alloc(_enableEnduranceGenes,8)
- alloc(_enableLifespan,8)
- alloc(_enableAttack,8)
- alloc(_enableDefense,8)
- alloc(_enableNarcotic,8)
- alloc(_enableTreatment,8)
- alloc(_EnduranceGene,8)
- alloc(_Lifespan,8)
- alloc(_Attack,8)
- alloc(_Defense,8)
- alloc(_Narcotic,8)
- alloc(_Treatment,8)
- alloc(_pGenome,8)
- alloc(_enableGetGenomePointer,8)
- registersymbol(_enableEnduranceGenes)
- registersymbol(_enableLifespan)
- registersymbol(_enableAttack)
- registersymbol(_enableDefense)
- registersymbol(_enableNarcotic)
- registersymbol(_enableTreatment)
- registersymbol(_EnduranceGene)
- registersymbol(_Lifespan)
- registersymbol(_Attack)
- registersymbol(_Defense)
- registersymbol(_Narcotic)
- registersymbol(_Treatment)
- registersymbol(_pGenome)
- registersymbol(_EnduranceGenes)
- registersymbol(_enableGetGenomePointer)
- label(code25)
- label(return25)
- newmem25:
- cmp [_enableGetGenomePointer],1
- jne Lifespan
- mov [_enableGetGenomePointer],0
- mov [_pGenome],rax
- Lifespan:
- cmp [_enableLifespan],1
- jne Attack
- movd xmm1,[_Lifespan]
- movd [rax+18],xmm1
- Attack:
- cmp [_enableAttack],1
- jne Defense
- movd xmm1,[_Attack]
- movd [rax+10],xmm1
- Defense:
- cmp [_enableDefense],1
- jne Endurance
- movd xmm1,[_Attack]
- movd [rax+14],xmm1
- Endurance:
- cmp [_enableEnduranceGenes],1
- jne Narcotic
- movd xmm1,[_EnduranceGene]
- movd [rax+1C],xmm1
- Narcotic:
- cmp [_enableNarcotic],1
- jne Treatment
- movd xmm1,[_Narcotic]
- movd [rax+08],xmm1
- Treatment:
- cmp [_enableTreatment],1
- jne code25
- movd xmm1,[_Treatment]
- movd [rax+0C],xmm1
- code25:
- movd xmm2,[rax+1C]
- jmp return25
- _EnduranceGenes:
- jmp newmem25
- return25:
- _Lifespan:
- dd (int)999
- _Attack:
- dd (int)25
- _Defense:
- dd (int)25
- _EnduranceGene:
- dd (int)150
- _Narcotic:
- dd (int)100
- _Treatment:
- dd (int)100
- _enableEnduranceGenes:
- dq 0
- _enableLifespan:
- dq 0
- _enableAttack:
- dq 0
- _enableDefense:
- dq 0
- _enableNarcotic:
- dq 0
- _enableTreatment:
- dq 0
- _pGenome:
- dq 0
- _enableGetGenomePointer:
- dq 0
- [DISABLE]
- _EnduranceGenes:
- db 66 0F 6E 50 1C
- Unregistersymbol(_enableEnduranceGenes)
- Unregistersymbol(_enableLifespan)
- Unregistersymbol(_enableAttack)
- Unregistersymbol(_enableDefense)
- Unregistersymbol(_enableNarcotic)
- Unregistersymbol(_enableTreatment)
- Unregistersymbol(_EnduranceGene)
- Unregistersymbol(_Lifespan)
- Unregistersymbol(_Attack)
- Unregistersymbol(_Defense)
- Unregistersymbol(_Narcotic)
- Unregistersymbol(_Treatment)
- Unregistersymbol(_EnduranceGenes)
- unregistersymbol(_pGenome)
- unregistersymbol(_enableGetGenomePointer)
- dealloc(_EnduranceGene)
- dealloc(_Lifespan)
- dealloc(_Attack)
- dealloc(_Defense)
- dealloc(_Narcotic)
- dealloc(_Treatment)
- dealloc(_enableLifespan)
- dealloc(_enableAttack)
- dealloc(_enableDefense)
- dealloc(_enableNarcotic)
- dealloc(_enableTreatment)
- dealloc(_enableEnduranceGenes)
- dealloc(newmem25)
- dealloc(_pGenome)
- dealloc(_enableGetGenomePointer)
- {
- // ORIGINAL CODE - INJECTION POINT: "JWE.exe"+5D99393
- "JWE.exe"+5D9936C: 49 8B 06 - mov rax,[r14]
- "JWE.exe"+5D9936F: 48 8D 55 5F - lea rdx,[rbp+5F]
- "JWE.exe"+5D99373: 48 8B 8F 78 02 00 00 - mov rcx,[rdi+00000278]
- "JWE.exe"+5D9937A: F3 0F 10 A7 A8 07 00 00 - movss xmm4,[rdi+000007A8]
- "JWE.exe"+5D99382: E9 79 DC 25 FA - jmp 13FFF7000
- "JWE.exe"+5D99387: 90 - nop
- "JWE.exe"+5D99388: 90 - nop
- "JWE.exe"+5D99389: 90 - nop
- "JWE.exe"+5D9938A: 48 89 45 5F - mov [rbp+5F],rax
- "JWE.exe"+5D9938E: E8 1D 1E 86 FA - call JWE.exe+5FB1B0
- // ---------- INJECTING HERE ----------
- "JWE.exe"+5D99393: 66 0F 6E 50 1C - movd xmm2,[rax+1C]
- // ---------- DONE INJECTING ----------
- "JWE.exe"+5D99398: 0F 5B D2 - cvtdq2ps xmm2,xmm2
- "JWE.exe"+5D9939B: F3 0F 5E 97 2C 08 00 00 - divss xmm2,[rdi+0000082C]
- "JWE.exe"+5D993A3: 44 0F 2F C2 - comiss xmm8,xmm2
- "JWE.exe"+5D993A7: 76 06 - jna JWE.exe+5D993AF
- "JWE.exe"+5D993A9: 41 0F 28 C8 - movaps xmm1,xmm8
- "JWE.exe"+5D993AD: EB 07 - jmp JWE.exe+5D993B6
- "JWE.exe"+5D993AF: 0F 28 CB - movaps xmm1,xmm3
- "JWE.exe"+5D993B2: F3 0F 5D CA - minss xmm1,xmm2
- "JWE.exe"+5D993B6: F3 0F 5C C4 - subss xmm0,xmm4
- "JWE.exe"+5D993BA: F3 0F 59 C1 - mulss xmm0,xmm1
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement