00945910

016c63c4 -> +38 -> +0 -> +c -> value
replace vtab at +0


DWORD value = *(DWORD*)0x016c63c4;
DWORD classy= *(DWORD*)(value + 0x38);
*classy = fakeVT;


mem found at 008073b6
\x3B\xC3\x74\x00\x8B\x48\x00\x3B
xxx?xx?x
-0x4


008073B6    A1 C4636C01              MOV EAX,[16C63C4]
008073BB    3BC3                     CMP EAX,EBX
008073BD    74 0E                    JE SHORT SC2.008073CD
008073BF    8B48 38                  MOV ECX,[EAX+38]
008073C2    3BCB                     CMP ECX,EBX
008073C4    74 07                    JE SHORT SC2.008073CD
008073C6    8B01                     MOV EAX,[ECX]                           ; SC2.01451530
008073C8    8B50 0C                  MOV EDX,[EAX+C]                         ; SC2.00978ED0
008073CB    FFD2                     CALL NEAR EDX                           ; SC2.00978ED0


function is 00978ed0