00418146 . 0F85 B9000000 JNZ WarRock.00418205 ///This is JNZ If this is a jmp it just skips the check: // Youll have to make this 00418146 jump to 00418205 0041814C . A1 64C4AB00 MOV EAX,DWORD PTR DS:[ABC464] 00418151 . 8D5424 18 LEA EDX,DWORD PTR SS:[ESP+18] 00418155 . 52 PUSH EDX 00418156 . 68 9CEC8800 PUSH WarRock.0088EC9C ; ASCII "[Engine Loading::ReadDone] %s " 0041815B . 50 PUSH EAX 0041815C . E8 522C3E00 CALL WarRock.007FADB3 00418161 . 8B0D 64C4AB00 MOV ECX,DWORD PTR DS:[ABC464] 00418167 . 51 PUSH ECX 00418168 . E8 B0293E00 CALL WarRock.007FAB1D 0041816D . 8D5424 28 LEA EDX,DWORD PTR SS:[ESP+28] 00418171 . 52 PUSH EDX 00418172 . 8D8424 3401000>LEA EAX,DWORD PTR SS:[ESP+134] 00418179 . 68 6CEC8800 PUSH WarRock.0088EC6C ; ASCII "%s file is cracked. Process will be terminated." 0041817E . 50 PUSH EAX 0041817F . E8 461E3E00 CALL WarRock.007F9FCA 00418184 . 83C4 1C ADD ESP,1C 00418187 . 6A 00 PUSH 0 00418189 . 68 64EC8800 PUSH WarRock.0088EC64 ; ASCII "Error" 0041818E . 8D8C24 2801000>LEA ECX,DWORD PTR SS:[ESP+128] 00418195 . 51 PUSH ECX 00418196 . 6A 00 PUSH 0 00418198 . FFD6 CALL ESI 0041819A . 8B15 2842AD00 MOV EDX,DWORD PTR DS:[AD4228] 004181A0 . 6A 00 PUSH 0 004181A2 . 6A 00 PUSH 0 004181A4 . 6A 10 PUSH 10 004181A6 . 52 PUSH EDX 004181A7 . EB 56 JMP SHORT WarRock.004181FF 004181A9 > 8B0D 64C4AB00 MOV ECX,DWORD PTR DS:[ABC464] 004181AF . 68 44EC8800 PUSH WarRock.0088EC44 ; ASCII "[Engine Loading::ReadError] %s " 004181B4 . 51 PUSH ECX 004181B5 . E8 F92B3E00 CALL WarRock.007FADB3 004181BA . 8B15 64C4AB00 MOV EDX,DWORD PTR DS:[ABC464] 004181C0 . 52 PUSH EDX 004181C1 . E8 57293E00 CALL WarRock.007FAB1D 004181C6 . 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+28] 004181CA . 50 PUSH EAX 004181CB . 8D8C24 4403000>LEA ECX,DWORD PTR SS:[ESP+344] 004181D2 . 68 10EC8800 PUSH WarRock.0088EC10 ; ASCII "File not found. - %s Process will be terminated." 004181D7 . 51 PUSH ECX 004181D8 . E8 ED1D3E00 CALL WarRock.007F9FCA 004181DD . 83C4 1C ADD ESP,1C 004181E0 . 6A 00 PUSH 0 004181E2 . 68 64EC8800 PUSH WarRock.0088EC64 ; ASCII "Error" 004181E7 . 8D9424 3803000>LEA EDX,DWORD PTR SS:[ESP+338] 004181EE . 52 PUSH EDX 004181EF . 6A 00 PUSH 0 004181F1 . FFD6 CALL ESI 004181F3 . A1 2842AD00 MOV EAX,DWORD PTR DS:[AD4228] 004181F8 . 6A 00 PUSH 0 ; /lParam = 0 004181FA . 6A 00 PUSH 0 ; |wParam = 0 004181FC . 6A 10 PUSH 10 ; |Message = WM_CLOSE 004181FE . 50 PUSH EAX ; |hWnd 004181FF > FF15 40D48800 CALL DWORD PTR DS:[<&USER32.SendMessageA>; SendMessageA 00418205 > 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] You see the ">" in front of the function, that means there is a jmp coming in at this address
00418146 . /0F85 B9000000 JNZ Warrock.00418205
00418146 /0F84 B9000000 JE Warrock.00418205