[ENABLE]

aobscanmodule(AiCantDetectYou,CrysisRemastered.exe,39 2D AE A7 5C 01)
alloc(newmem,$1000,"CrysisRemastered.exe"+61A83C)
alloc(ActivateAiCantDetectYou,8)

label(code)
label(return)

registersymbol(AiCantDetectYou ActivateAiCantDetectYou)

newmem:
cmp byte ptr [ActivateAiCantDetectYou],1
jne runnormally

mov [CrysisRemastered.exe+1BE4FF0],1

jmp code

runnormally:
mov [CrysisRemastered.exe+1BE4FF0],0

code:
  cmp [CrysisRemastered.exe+1BE4FF0],ebp
   jmp return

AiCantDetectYou:
  jmp newmem
  nop
return:


ActivateAiCantDetectYou:
dq 0

[DISABLE]

AiCantDetectYou:
  db 39 2D AE A7 5C 01

unregistersymbol(AiCantDetectYou ActivateAiCantDetectYou)
dealloc(newmem)
dealloc(ActivateAiCantDetectYou)

{
// ORIGINAL CODE - INJECTION POINT: "CrysisRemastered.exe"+61A83C

"CrysisRemastered.exe"+61A81C: 48 C1 E0 04           -  shl rax,04
"CrysisRemastered.exe"+61A820: 4A 8B 0C 00           -  mov rcx,[rax+r8]
"CrysisRemastered.exe"+61A824: EB 03                 -  jmp CrysisRemastered.exe+61A829
"CrysisRemastered.exe"+61A826: 48 8B CD              -  mov rcx,rbp
"CrysisRemastered.exe"+61A829: 48 85 C9              -  test rcx,rcx
"CrysisRemastered.exe"+61A82C: 48 0F 45 F9           -  cmovne rdi,rcx
"CrysisRemastered.exe"+61A830: 45 84 FF              -  test r15l,r15l
"CrysisRemastered.exe"+61A833: 74 16                 -  je CrysisRemastered.exe+61A84B
"CrysisRemastered.exe"+61A835: 66 83 7F 12 64        -  cmp word ptr [rdi+12],64
"CrysisRemastered.exe"+61A83A: 75 0F                 -  jne CrysisRemastered.exe+61A84B
// ---------- INJECTING HERE ----------
"CrysisRemastered.exe"+61A83C: 39 2D AE A7 5C 01     -  cmp [CrysisRemastered.exe+1BE4FF0],ebp
// ---------- DONE INJECTING  ----------
"CrysisRemastered.exe"+61A842: 74 07                 -  je CrysisRemastered.exe+61A84B
"CrysisRemastered.exe"+61A844: 32 C0                 -  xor al,al
"CrysisRemastered.exe"+61A846: E9 0E 01 00 00        -  jmp CrysisRemastered.exe+61A959
"CrysisRemastered.exe"+61A84B: 49 8B 06              -  mov rax,[r14]
"CrysisRemastered.exe"+61A84E: 49 8B CE              -  mov rcx,r14
"CrysisRemastered.exe"+61A851: FF 90 48 01 00 00     -  call qword ptr [rax+00000148]
"CrysisRemastered.exe"+61A857: 48 8B 17              -  mov rdx,[rdi]
"CrysisRemastered.exe"+61A85A: 48 8B CF              -  mov rcx,rdi
"CrysisRemastered.exe"+61A85D: 0F B6 D8              -  movzx ebx,al
"CrysisRemastered.exe"+61A860: FF 92 48 01 00 00     -  call qword ptr [rdx+00000148]
}