Open the dumped Engine.exe in IDA, or just simply attach olly to Engine.exe, after you stopped HS with a simply messagebox. Injct after hackshield loaded half.
Then, search for the following string: "ILTDrawPrim.Default".
You will get near an XREF, doubleclick on it.
Then you will jump to a new function, the device pointer (drawprim pointer) get pushed into the stack!
The addy is from EU, sorry dont have current Engine dump, but this tutorial should be so easy that you can find the addy yourselfCode:push offset off_804974