Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 000000003B416000 | 50 | push rax | rax:EntryPoint
- 000000003B416001 | 53 | push rbx |
- 000000003B416002 | 51 | push rcx |
- 000000003B416003 | 52 | push rdx |
- 000000003B416004 | 55 | push rbp |
- 000000003B416005 | 54 | push rsp |
- 000000003B416006 | 56 | push rsi |
- 000000003B416007 | 57 | push rdi |
- 000000003B416008 | 41:50 | push r8 |
- 000000003B41600A | 41:51 | push r9 |
- 000000003B41600C | 41:52 | push r10 |
- 000000003B41600E | 41:53 | push r11 |
- 000000003B416010 | 41:54 | push r12 | r12:EntryPoint
- 000000003B416012 | 41:55 | push r13 |
- 000000003B416014 | 41:56 | push r14 |
- 000000003B416016 | 41:57 | push r15 |
- 000000003B416018 | 48:81EC 08010000 | sub rsp,108 |
- 000000003B41601F | E8 00000000 | call steam_api64.3B416024 | call $0
- 000000003B416024 | 5D | pop rbp |
- 000000003B416025 | 48:B9 0010004001000000 | mov rcx,140001000 |
- 000000003B41602F | 48:C7C2 00D00503 | mov rdx,305D000 |
- 000000003B416036 | 49:C7C0 40000000 | mov r8,40 | 40:'@'
- 000000003B41603D | 49:89E1 | mov r9,rsp |
- 000000003B416040 | FF15 8EC3FFFF | call qword ptr ds:[<&VirtualProtect>] |
- 000000003B416046 | 48:B8 B861E14201000000 | mov rax,142E161B8 | rax:EntryPoint
- 000000003B416050 | 48:8D5D 74 | lea rbx,qword ptr ss:[rbp+74] |
- 000000003B416054 | 66:C700 48C7 | mov word ptr ds:[rax],C748 | PATCH GAME OEp
- 000000003B416059 | C640 02 C0 | mov byte ptr ds:[rax+2],C0 |
- 000000003B41605D | 8958 03 | mov dword ptr ds:[rax+3],ebx |
- 000000003B416060 | 66:C740 07 FFE0 | mov word ptr ds:[rax+7],E0FF |
- 000000003B416066 | 48:8D45 DC | lea rax,qword ptr ss:[rbp-24] | rax:EntryPoint
- 000000003B41606A | C700 E9FBB3FE | mov dword ptr ds:[rax],FEB3FBE9 | rax:EntryPoint
- 000000003B416070 | C640 04 FF | mov byte ptr ds:[rax+4],FF |
- 000000003B416074 | 48:81C4 08010000 | add rsp,108 |
- 000000003B41607B | 41:5F | pop r15 |
- 000000003B41607D | 41:5E | pop r14 |
- 000000003B41607F | 41:5D | pop r13 |
- 000000003B416081 | 41:5C | pop r12 | r12:EntryPoint
- 000000003B416083 | 41:5B | pop r11 |
- 000000003B416085 | 41:5A | pop r10 |
- 000000003B416087 | 41:59 | pop r9 |
- 000000003B416089 | 41:58 | pop r8 |
- 000000003B41608B | 5F | pop rdi |
- 000000003B41608C | 5E | pop rsi |
- 000000003B41608D | 5C | pop rsp |
- 000000003B41608E | 5D | pop rbp |
- 000000003B41608F | 5A | pop rdx |
- 000000003B416090 | 59 | pop rcx |
- 000000003B416091 | 5B | pop rbx |
- 000000003B416092 | 58 | pop rax | rax:EntryPoint
- 000000003B416093 | E9 68FFFFFF | jmp <steam_api64.EntryPoint> |
- 000000003B416098 | 50 | push rax | rax:EntryPoint
- 000000003B416099 | 53 | push rbx |
- 000000003B41609A | 51 | push rcx |
- 000000003B41609B | 52 | push rdx |
- 000000003B41609C | 55 | push rbp |
- 000000003B41609D | 54 | push rsp |
- 000000003B41609E | 56 | push rsi |
- 000000003B41609F | 57 | push rdi |
- 000000003B4160A0 | 41:50 | push r8 |
- 000000003B4160A2 | 41:51 | push r9 |
- 000000003B4160A4 | 41:52 | push r10 |
- 000000003B4160A6 | 41:53 | push r11 |
- 000000003B4160A8 | 41:54 | push r12 | r12:EntryPoint
- 000000003B4160AA | 41:55 | push r13 |
- 000000003B4160AC | 41:56 | push r14 |
- 000000003B4160AE | 41:57 | push r15 |
- 000000003B4160B0 | 48:81EC 08010000 | sub rsp,108 |
- 000000003B4160B7 | 48:B8 B861E14201000000 | mov rax,142E161B8 | rax:EntryPoint
- 000000003B4160C1 | C700 4883EC28 | mov dword ptr ds:[rax],28EC8348 | Return Game OEP to normal code
- 000000003B4160C7 | C740 04 E8470700 | mov dword ptr ds:[rax+4],747E8 |
- 000000003B4160CE | C740 08 004883C4 | mov dword ptr ds:[rax+8],C4834800 |
- 000000003B4160D5 | 48:B9 B8FD054301000000 | mov rcx,14305FDB8 |
- 000000003B4160DF | 48:C7C2 00020000 | mov rdx,200 |
- 000000003B4160E6 | 49:C7C0 04000000 | mov r8,4 |
- 000000003B4160ED | 49:89E1 | mov r9,rsp |
- 000000003B4160F0 | FF15 DEC2FFFF | call qword ptr ds:[<&VirtualProtect>] |
- 000000003B4160F6 | E8 00000000 | call steam_api64.3B4160FB | call $0
- 000000003B4160FB | 5D | pop rbp |
- 000000003B4160FC | 48:8D8D FB0E0000 | lea rcx,qword ptr ss:[rbp+EFB] |
- 000000003B416103 | 45:31C0 | xor r8d,r8d |
- 000000003B416106 | 31D2 | xor edx,edx |
- 000000003B416108 | FF15 5EC2FFFF | call qword ptr ds:[<&LoadLibraryExA>] | load CODEXAPI
- 000000003B41610E | 48:BB B8FD054301000000 | mov rbx,14305FDB8 |
- 000000003B416118 | 48:05 002B0000 | add rax,2B00 | REDIRECT HERE BELOW ALL FUNCTIONS
- 000000003B41611E | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416121 | 48:83C3 08 | add rbx,8 |
- 000000003B416125 | 48:05 60010000 | add rax,160 | rax:EntryPoint
- 000000003B41612B | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B41612E | 48:83C3 08 | add rbx,8 |
- 000000003B416132 | 48:05 20FFFFFF | add rax,FFFFFFFFFFFFFF20 | rax:EntryPoint
- 000000003B416138 | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B41613B | 48:83C3 08 | add rbx,8 |
- 000000003B41613F | 48:05 60010000 | add rax,160 | rax:EntryPoint
- 000000003B416145 | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416148 | 48:83C3 08 | add rbx,8 |
- 000000003B41614C | 48:05 D0FDFFFF | add rax,FFFFFFFFFFFFFDD0 | rax:EntryPoint
- 000000003B416152 | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416155 | 48:83C3 08 | add rbx,8 |
- 000000003B416159 | 48:83C0 10 | add rax,10 | rax:EntryPoint
- 000000003B41615D | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416160 | 48:83C3 08 | add rbx,8 |
- 000000003B416164 | 48:05 10030000 | add rax,310 | rax:EntryPoint
- 000000003B41616A | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B41616D | 48:83C3 08 | add rbx,8 |
- 000000003B416171 | 48:83C0 A0 | add rax,FFFFFFFFFFFFFFA0 | rax:EntryPoint
- 000000003B416175 | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416178 | 48:83C3 08 | add rbx,8 |
- 000000003B41617C | 48:83C3 08 | add rbx,8 |
- 000000003B416180 | 48:83C3 08 | add rbx,8 |
- 000000003B416184 | 48:83C3 08 | add rbx,8 |
- 000000003B416188 | 48:05 70FDFFFF | add rax,FFFFFFFFFFFFFD70 | rax:EntryPoint
- 000000003B41618E | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416191 | 48:83C3 08 | add rbx,8 |
- 000000003B416195 | 48:05 60010000 | add rax,160 | rax:EntryPoint
- 000000003B41619B | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B41619E | 48:83C3 08 | add rbx,8 |
- 000000003B4161A2 | 48:05 50010000 | add rax,150 | rax:EntryPoint
- 000000003B4161A8 | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B4161AB | 48:B9 B8FD054301000000 | mov rcx,14305FDB8 |
- 000000003B4161B5 | 48:C7C2 00020000 | mov rdx,200 |
- 000000003B4161BC | 49:C7C0 02000000 | mov r8,2 |
- 000000003B4161C3 | 49:89E1 | mov r9,rsp |
- 000000003B4161C6 | FF15 08C2FFFF | call qword ptr ds:[<&VirtualProtect>] |
- 000000003B4161CC | 48:B9 5010C24F01000000 | mov rcx,14FC21050 |
- 000000003B4161D6 | 48:C7C2 00020000 | mov rdx,200 |
- 000000003B4161DD | 49:C7C0 04000000 | mov r8,4 |
- 000000003B4161E4 | 49:89E1 | mov r9,rsp |
- 000000003B4161E7 | FF15 E7C1FFFF | call qword ptr ds:[<&VirtualProtect>] |
- 000000003B4161ED | 48:BB 5010C24F01000000 | mov rbx,14FC21050 |
- 000000003B4161F7 | 48:8D8D FB0E0000 | lea rcx,qword ptr ss:[rbp+EFB] |
- 000000003B4161FE | 45:31C0 | xor r8d,r8d |
- 000000003B416201 | 31D2 | xor edx,edx |
- 000000003B416203 | FF15 63C1FFFF | call qword ptr ds:[<&LoadLibraryExA>] |
- 000000003B416209 | 48:05 B02A0000 | add rax,2AB0 | rax:EntryPoint
- 000000003B41620F | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416212 | 48:83C3 08 | add rbx,8 |
- 000000003B416216 | 48:83C0 30 | add rax,30 | rax:EntryPoint
- 000000003B41621A | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B41621D | 48:83C3 08 | add rbx,8 |
- 000000003B416221 | 48:83C0 20 | add rax,20 | rax:EntryPoint
- 000000003B416225 | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416228 | 48:83C3 08 | add rbx,8 |
- 000000003B41622C | 48:05 80000000 | add rax,80 | rax:EntryPoint
- 000000003B416232 | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416235 | 48:83C3 08 | add rbx,8 |
- 000000003B416239 | 48:83C3 08 | add rbx,8 |
- 000000003B41623D | 48:05 C0000000 | add rax,C0 | rax:EntryPoint
- 000000003B416243 | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416246 | 48:83C3 08 | add rbx,8 |
- 000000003B41624A | 48:83C0 20 | add rax,20 | rax:EntryPoint
- 000000003B41624E | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B416251 | 48:83C3 08 | add rbx,8 |
- 000000003B416255 | 48:05 80000000 | add rax,80 | rax:EntryPoint
- 000000003B41625B | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B41625E | 48:83C3 08 | add rbx,8 |
- 000000003B416262 | 48:05 F0000000 | add rax,F0 | rax:EntryPoint
- 000000003B416268 | 48:8903 | mov qword ptr ds:[rbx],rax | rax:EntryPoint
- 000000003B41626B | 48:8D8D 0B100000 | lea rcx,qword ptr ss:[rbp+100B] |
- 000000003B416272 | 48:8D51 F0 | lea rdx,qword ptr ds:[rcx-10] |
- 000000003B416276 | C702 00030000 | mov dword ptr ds:[rdx],300 |
- 000000003B41627C | FF15 124E0000 | call qword ptr ds:[<&GetUserNameA>] |
- 000000003B416282 | 48:8D85 0B100000 | lea rax,qword ptr ss:[rbp+100B] | From here below patch CODEX API and change save section
- 000000003B416289 | 48:8D9D 13140000 | lea rbx,qword ptr ss:[rbp+1413] |
- 000000003B416290 | C603 5C | mov byte ptr ds:[rbx],5C | 5C:'\\'
- 000000003B416293 | 48:FFC3 | inc rbx |
- 000000003B416296 | 8A08 | mov cl,byte ptr ds:[rax] | rax:EntryPoint
- 000000003B416298 | 880B | mov byte ptr ds:[rbx],cl |
- 000000003B41629A | 48:FFC0 | inc rax | rax:EntryPoint
- 000000003B41629D | 48:FFC3 | inc rbx |
- 000000003B4162A0 | 8038 00 | cmp byte ptr ds:[rax],0 | rax:EntryPoint
- 000000003B4162A3 | 75 F1 | jne steam_api64.3B416296 |
- 000000003B4162A5 | C603 5C | mov byte ptr ds:[rbx],5C | 5C:'\\'
- 000000003B4162A8 | 48:FFC3 | inc rbx |
- 000000003B4162AB | 48:8D85 5B130000 | lea rax,qword ptr ss:[rbp+135B] | rax:EntryPoint
- 000000003B4162B2 | 8A08 | mov cl,byte ptr ds:[rax] | rax:EntryPoint
- 000000003B4162B4 | 880B | mov byte ptr ds:[rbx],cl |
- 000000003B4162B6 | 48:FFC0 | inc rax | rax:EntryPoint
- 000000003B4162B9 | 48:FFC3 | inc rbx |
- 000000003B4162BC | 8038 00 | cmp byte ptr ds:[rax],0 | rax:EntryPoint
- 000000003B4162BF | 75 F1 | jne steam_api64.3B4162B2 |
- 000000003B4162C1 | C603 5C | mov byte ptr ds:[rbx],5C | 5C:'\\'
- 000000003B4162C4 | 48:FFC3 | inc rbx |
- 000000003B4162C7 | 48:8D85 9B130000 | lea rax,qword ptr ss:[rbp+139B] | rax:EntryPoint
- 000000003B4162CE | 8A08 | mov cl,byte ptr ds:[rax] | rax:EntryPoint
- 000000003B4162D0 | 880B | mov byte ptr ds:[rbx],cl |
- 000000003B4162D2 | 48:FFC0 | inc rax | rax:EntryPoint
- 000000003B4162D5 | 48:FFC3 | inc rbx |
- 000000003B4162D8 | 8038 00 | cmp byte ptr ds:[rax],0 | rax:EntryPoint
- 000000003B4162DB | 75 F1 | jne steam_api64.3B4162CE |
- 000000003B4162DD | 48:8D85 0B100000 | lea rax,qword ptr ss:[rbp+100B] | rax:EntryPoint
- 000000003B4162E4 | 48:8D9D 93160000 | lea rbx,qword ptr ss:[rbp+1693] |
- 000000003B4162EB | C603 5C | mov byte ptr ds:[rbx],5C | 5C:'\\'
- 000000003B4162EE | 48:FFC3 | inc rbx |
- 000000003B4162F1 | 8A08 | mov cl,byte ptr ds:[rax] | rax:EntryPoint
- 000000003B4162F3 | 880B | mov byte ptr ds:[rbx],cl |
- 000000003B4162F5 | 48:FFC0 | inc rax | rax:EntryPoint
- 000000003B4162F8 | 48:FFC3 | inc rbx |
- 000000003B4162FB | 8038 00 | cmp byte ptr ds:[rax],0 | rax:EntryPoint
- 000000003B4162FE | 75 F1 | jne steam_api64.3B4162F1 |
- 000000003B416300 | C603 5C | mov byte ptr ds:[rbx],5C | 5C:'\\'
- 000000003B416303 | 48:FFC3 | inc rbx |
- 000000003B416306 | 48:8D85 5B130000 | lea rax,qword ptr ss:[rbp+135B] | rax:EntryPoint
- 000000003B41630D | 8A08 | mov cl,byte ptr ds:[rax] | rax:EntryPoint
- 000000003B41630F | 880B | mov byte ptr ds:[rbx],cl |
- 000000003B416311 | 48:FFC0 | inc rax | rax:EntryPoint
- 000000003B416314 | 48:FFC3 | inc rbx |
- 000000003B416317 | 8038 00 | cmp byte ptr ds:[rax],0 | rax:EntryPoint
- 000000003B41631A | 75 F1 | jne steam_api64.3B41630D |
- 000000003B41631C | C603 5C | mov byte ptr ds:[rbx],5C | 5C:'\\'
- 000000003B41631F | 48:FFC3 | inc rbx |
- 000000003B416322 | 48:8D85 9B130000 | lea rax,qword ptr ss:[rbp+139B] | rax:EntryPoint
- 000000003B416329 | 8A08 | mov cl,byte ptr ds:[rax] | rax:EntryPoint
- 000000003B41632B | 880B | mov byte ptr ds:[rbx],cl |
- 000000003B41632D | 48:FFC0 | inc rax | rax:EntryPoint
- 000000003B416330 | 48:FFC3 | inc rbx |
- 000000003B416333 | 8038 00 | cmp byte ptr ds:[rax],0 | rax:EntryPoint
- 000000003B416336 | 75 F1 | jne steam_api64.3B416329 |
- 000000003B416338 | C603 5C | mov byte ptr ds:[rbx],5C | 5C:'\\'
- 000000003B41633B | 48:FFC3 | inc rbx |
- 000000003B41633E | 48:8D85 C3130000 | lea rax,qword ptr ss:[rbp+13C3] | rax:EntryPoint
- 000000003B416345 | 8A08 | mov cl,byte ptr ds:[rax] | rax:EntryPoint
- 000000003B416347 | 880B | mov byte ptr ds:[rbx],cl |
- 000000003B416349 | 48:FFC0 | inc rax | rax:EntryPoint
- 000000003B41634C | 48:FFC3 | inc rbx |
- 000000003B41634F | 8038 00 | cmp byte ptr ds:[rax],0 | rax:EntryPoint
- 000000003B416352 | 75 F1 | jne steam_api64.3B416345 |
- 000000003B416354 | 48:8D8D 0B0F0000 | lea rcx,qword ptr ss:[rbp+F0B] |
- 000000003B41635B | FF15 C3BFFFFF | call qword ptr ds:[<&GetModuleHandleA>] |
- 000000003B416361 | 48:05 00B20C00 | add rax,CB200 | rax:EntryPoint
- 000000003B416367 | 48:8D9D 8B160000 | lea rbx,qword ptr ss:[rbp+168B] |
- 000000003B41636E | 8A0B | mov cl,byte ptr ds:[rbx] |
- 000000003B416370 | 8808 | mov byte ptr ds:[rax],cl | rax:EntryPoint
- 000000003B416372 | 48:FFC0 | inc rax | rax:EntryPoint
- 000000003B416375 | 48:FFC3 | inc rbx |
- 000000003B416378 | 803B 00 | cmp byte ptr ds:[rbx],0 |
- 000000003B41637B | 75 F1 | jne steam_api64.3B41636E |
- 000000003B41637D | C700 00000000 | mov dword ptr ds:[rax],0 | rax:EntryPoint
- 000000003B416383 | 48:8D8D 0B0F0000 | lea rcx,qword ptr ss:[rbp+F0B] |
- 000000003B41638A | FF15 94BFFFFF | call qword ptr ds:[<&GetModuleHandleA>] |
- 000000003B416390 | 48:05 20B40C00 | add rax,CB420 | rax:EntryPoint
- 000000003B416396 | 48:8D9D 0B140000 | lea rbx,qword ptr ss:[rbp+140B] |
- 000000003B41639D | 8A0B | mov cl,byte ptr ds:[rbx] |
- 000000003B41639F | 8808 | mov byte ptr ds:[rax],cl | rax:EntryPoint
- 000000003B4163A1 | 48:FFC0 | inc rax | rax:EntryPoint
- 000000003B4163A4 | 48:FFC3 | inc rbx |
- 000000003B4163A7 | 803B 00 | cmp byte ptr ds:[rbx],0 |
- 000000003B4163AA | 75 F1 | jne steam_api64.3B41639D |
- 000000003B4163AC | C700 00000000 | mov dword ptr ds:[rax],0 | rax:EntryPoint
- 000000003B4163B2 | 48:8D8D 0B0F0000 | lea rcx,qword ptr ss:[rbp+F0B] |
- 000000003B4163B9 | FF15 65BFFFFF | call qword ptr ds:[<&GetModuleHandleA>] |
- 000000003B4163BF | 48:05 10B30C00 | add rax,CB310 | rax:EntryPoint
- 000000003B4163C5 | 48:8D9D 0B140000 | lea rbx,qword ptr ss:[rbp+140B] |
- 000000003B4163CC | 8A0B | mov cl,byte ptr ds:[rbx] |
- 000000003B4163CE | 8808 | mov byte ptr ds:[rax],cl | rax:EntryPoint
- 000000003B4163D0 | 48:FFC0 | inc rax | rax:EntryPoint
- 000000003B4163D3 | 48:FFC3 | inc rbx |
- 000000003B4163D6 | 803B 00 | cmp byte ptr ds:[rbx],0 |
- 000000003B4163D9 | 75 F1 | jne steam_api64.3B4163CC |
- 000000003B4163DB | C700 00000000 | mov dword ptr ds:[rax],0 | rax:EntryPoint
- 000000003B4163E1 | 48:81C4 08010000 | add rsp,108 |
- 000000003B4163E8 | 41:5F | pop r15 |
- 000000003B4163EA | 41:5E | pop r14 |
- 000000003B4163EC | 41:5D | pop r13 |
- 000000003B4163EE | 41:5C | pop r12 | r12:EntryPoint
- 000000003B4163F0 | 41:5B | pop r11 |
- 000000003B4163F2 | 41:5A | pop r10 |
- 000000003B4163F4 | 41:59 | pop r9 |
- 000000003B4163F6 | 41:58 | pop r8 |
- 000000003B4163F8 | 5F | pop rdi |
- 000000003B4163F9 | 5E | pop rsi |
- 000000003B4163FA | 5C | pop rsp |
- 000000003B4163FB | 5D | pop rbp |
- 000000003B4163FC | 5A | pop rdx |
- 000000003B4163FD | 59 | pop rcx |
- 000000003B4163FE | 5B | pop rbx |
- 000000003B4163FF | 58 | pop rax | rax:EntryPoint
- 000000003B416400 | 48:B8 B861E14201000000 | mov rax,142E161B8 | rax:EntryPoint
- 000000003B41640A | FFE0 | jmp rax | rax:EntryPoint
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement