[ENABLE]

aobscanmodule(GetCoin,sekiro.exe,CC CC 8B 41 7C C3 CC CC CC CC CC CC CC CC CC CC CC CC 32)
alloc(newmem,$1000,"sekiro.exe"+66B4EE)
alloc(CBase, 8)

label(code)
label(return)

registersymbol(CBase)

newmem:

mov [CBase],rcx

code:
  int 3
  int 3
  mov eax,[rcx+7C]
  jmp return

GetCoin+2:
  jmp newmem
return:
registersymbol(GetCoin)

CBase:
dq 0

[DISABLE]

GetCoin:
  db CC CC 8B 41 7C

unregistersymbol(GetCoin)
unregistersymbol(CBase)
dealloc(CBase)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "sekiro.exe"+66B4EE

"sekiro.exe"+66B4E4: CC                       -  int 3
"sekiro.exe"+66B4E5: CC                       -  int 3
"sekiro.exe"+66B4E6: CC                       -  int 3
"sekiro.exe"+66B4E7: CC                       -  int 3
"sekiro.exe"+66B4E8: CC                       -  int 3
"sekiro.exe"+66B4E9: CC                       -  int 3
"sekiro.exe"+66B4EA: CC                       -  int 3
"sekiro.exe"+66B4EB: CC                       -  int 3
"sekiro.exe"+66B4EC: CC                       -  int 3
"sekiro.exe"+66B4ED: CC                       -  int 3
// ---------- INJECTING HERE ----------
"sekiro.exe"+66B4EE: CC                       -  int 3
"sekiro.exe"+66B4EF: CC                       -  int 3
"sekiro.exe"+66B4F0: 8B 41 7C                 -  mov eax,[rcx+7C]
// ---------- DONE INJECTING  ----------
"sekiro.exe"+66B4F3: C3                       -  ret
"sekiro.exe"+66B4F4: CC                       -  int 3
"sekiro.exe"+66B4F5: CC                       -  int 3
"sekiro.exe"+66B4F6: CC                       -  int 3
"sekiro.exe"+66B4F7: CC                       -  int 3
"sekiro.exe"+66B4F8: CC                       -  int 3
"sekiro.exe"+66B4F9: CC                       -  int 3
"sekiro.exe"+66B4FA: CC                       -  int 3
"sekiro.exe"+66B4FB: CC                       -  int 3
"sekiro.exe"+66B4FC: CC                       -  int 3
}