Code:
Pattern: 83 F8 FF 0F 84 ?? ?? ?? ?? 56 50 E8
105D1C2A | 83 F8 FF | cmp eax,-01 |
105D1C2D | C7 44 24 14 00 00 00 00 | je 105D1E2A |
105D1C33 | 56 | push esi |
105D1C34 | 50 | push eax |
105D1C35 | E8 86 CD DB FF | call 1038E9C0 | -> function called to check
105D1C3A | 8B F0 | mov esi,eax |
105D1C3C | 83 C4 04 | add esp,04 |
105D1C3F | 85 F6 | test esi,esi |
105D1C41 | 0F 84 E2 01 00 00 | je 105D1E29 | He's here, now change je -> jmp
105D1C4D | D9 86 58 10 00 00 | fld dword ptr [esi+00001058] |
105D1C54 | 0F B6 86 BC 0B 00 00 | movzx eax,byte ptr [esi+00000BBC] |
Code:
Pattern: 53 50 8B 42 2C FF D0
105D261E | 83 C4 08 | add esp,08 |
105D2621 | 85 C0 | test eax,eax |
105D2623 | 74 48 | je 105D266D | He's here, change into "jmp 105D2637 + 4F"
105D2625 | 8B 0D A4 4F C0 10 | mov ecx,[10C04FA4] |
105D262D | 8B 11 | mov edx,[ecx] |
105D2631 | 8D 5C 24 10 | lea ebx,[esp+10] |
105D2636 | 05 70 17 00 00 | add eax,00001770 |
105D2637 | 53 | push ebx | -> Search return here. Value=105D2637+4F
105D2638 | 50 | push eax |
105D1C54 | 8B 42 2C | mov eax,[edx+2C] |
.....////.... | | |
105D2637 + 4F | 5F | pop edi |