WARNING: With 1.351 Ebenezers, the codecave is already in use - you can move it to an unused codecave yourself, just remember to adjust the jumps accordingly!- 0049D8B9 E9 024A0600 JMP 005022C0
- 0049D8BE 90 NOP
- 005022C0 ^0F8D 61C0F9FF JGE 0049E327
- 005022C6 60 PUSHAD
- 005022C7 66:0FB755 F8 MOVZX DX,WORD PTR SS:[EBP-8]
- 005022CC 66:0FB77D FA MOVZX DI,WORD PTR SS:[EBP-6]
- 005022D1 66:0FB74D FC MOVZX CX,WORD PTR SS:[EBP-4]
- 005022D6 66:3BF9 CMP DI,CX
- 005022D9 74 68 JE SHORT 00502343
- 005022DB 66:3BFA CMP DI,DX
- 005022DE 74 63 JE SHORT 00502343
- 005022E0 66:3BD1 CMP DX,CX
- 005022E3 74 5E JE SHORT 00502343
- 005022E5 8BB6 98800000 MOV ESI,DWORD PTR DS:[ESI+8098]
- 005022EB 8DB6 90000000 LEA ESI,DWORD PTR DS:[ESI+88]
- 005022F1 81C6 50010000 ADD ESI,150
- 005022F7 66:B8 1800 MOV AX,18
- 005022FB 8B5D D0 MOV EBX,DWORD PTR SS:[EBP-20]
- 005022FE 56 PUSH ESI
- 005022FF 50 PUSH EAX
- 00502300 52 PUSH EDX
- 00502301 57 PUSH EDI
- 00502302 66:F7E7 MUL DI
- 00502305 5A POP EDX
- 00502306 0FB7F8 MOVZX EDI,AX
- 00502309 03F7 ADD ESI,EDI
- 0050230B 391E CMP DWORD PTR DS:[ESI],EBX
- 0050230D 5F POP EDI
- 0050230E 58 POP EAX
- 0050230F 5E POP ESI
- 00502310 75 31 JNZ SHORT 00502343
- 00502312 56 PUSH ESI
- 00502313 50 PUSH EAX
- 00502314 51 PUSH ECX
- 00502315 52 PUSH EDX
- 00502316 66:F7E1 MUL CX
- 00502319 5A POP EDX
- 0050231A 0FB7C8 MOVZX ECX,AX
- 0050231D 03F1 ADD ESI,ECX
- 0050231F 391E CMP DWORD PTR DS:[ESI],EBX
- 00502321 59 POP ECX
- 00502322 58 POP EAX
- 00502323 5E POP ESI
- 00502324 75 1D JNZ SHORT 00502343
- 00502326 56 PUSH ESI
- 00502327 50 PUSH EAX
- 00502328 51 PUSH ECX
- 00502329 52 PUSH EDX
- 0050232A 66:8BCA MOV CX,DX
- 0050232D 66:F7E1 MUL CX
- 00502330 5A POP EDX
- 00502331 0FB7C8 MOVZX ECX,AX
- 00502334 03F1 ADD ESI,ECX
- 00502336 391E CMP DWORD PTR DS:[ESI],EBX
- 00502338 59 POP ECX
- 00502339 58 POP EAX
- 0050233A 5E POP ESI
- 0050233B 75 06 JNZ SHORT 00502343
- 0050233D 61 POPAD
- 0050233E ^E9 7CB5F9FF JMP 0049D8BF
- 00502343 61 POPAD
- 00502344 ^E9 DEBFF9FF JMP 0049E327
|
