Detected Memory Base

#include <Windows.h>
#include "XOR.h"
// Encrypted Strings
#define eCShell	/*CShell.dll*/XorStr<0xA0,11,0x4013471B>("\xE3\xF2\xCA\xC6\xC8\xC9\x88\xC3\xC4\xC5"+0x4013471B).s
#define eCrossfire /*Crossfire.exe*/XorStr<0x1A,14,0x53CB51C3>("\x59\x69\x73\x6E\x6D\x79\x49\x53\x47\x0D\x41\x5D\x43"+0x53CB51C3).s


VOID Wall()
{ 
	while(1)
	{
		DWORD CShell = (DWORD)GetModuleHandleA(eCrossfire);
		if(!CShell)
		{
			memcpy((VOID*)0x70BD94, "\x00\x00\x00\x00\x00\x00", 6);
		}
		else 
		{
			memcpy((VOID*)0x70BD94, "\x01\x01\x01\x01\x01\x01", 6);

		}
	}
}

VOID Thread(HINSTANCE hDLL)
{
	
   DWORD CShell = (DWORD)GetModuleHandleA(eCrossfire);
   if(!CShell)
	   {
		Wall();
	   }
}

BOOL WINAPI DllMain(HMODULE hDll,DWORD dwReason,LPVOID lpReserved)
{
	  if(dwReason == DLL_PROCESS_ATTACH)
	{
		DisableThreadLibraryCalls(hDll);
		CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)Thread, hDll, NULL, NULL);
	}
	    return TRUE;
}