Public-Mirror/LunaHook-mirror
1
0
Fork 0
mirror of https://github.com/HIllya51/LunaHook.git synced 2024-11-28 00:04:03 +08:00
Code Issues Projects Releases Wiki Activity
c991462316
LunaHook-mirror/LunaHook/engine32/CMVS.cpp

1525 lines
75 KiB
C++
Raw Normal View History

Initial commit
2024-02-07 20:59:24 +08:00
#include"CMVS.h"
namespace { // unnamed
/********************************************************************************************
CMVS hook:
Process name is cmvs.exe or cnvs.exe or cmvs*.exe. Used by PurpleSoftware games.
Font caching issue. Find call to GetGlyphOutlineA and the function entry.
********************************************************************************************/
// jichi 3/6/2014: This is the original CMVS hook in ITH
// It does not work for パ<>プルソフトウェア games after しあわせ家族部 (2012)
bool InsertCMVS1Hook()
{
const DWORD funcs[] = {
0xec83, // caller pattern: sub esp = 0x83,0xec
0xec8b55,
};
enum { FunctionCount = sizeof(funcs) / sizeof(*funcs) };
ULONG addr = MemDbg::findMultiCallerAddress((ULONG)::GetGlyphOutlineA, funcs, FunctionCount, processStartAddress, processStopAddress);
//初恋サクラメント
//夏に奏でる僕らの詩
if (!addr) {
//例外：
//みはる -あるとアナザーストーリー-
auto entry=Util::FindImportEntry(processStartAddress,(DWORD)GetGlyphOutlineA);
if(entry==0)return false;
BYTE bytes2[]={0x8b,XX,XX4};
memcpy(bytes2+2,&entry,4);
addr = MemDbg::findBytes(bytes2, sizeof(bytes2), processStartAddress, processStopAddress);
if (addr == 0)return false;
addr = MemDbg::findEnclosingAlignedFunction(addr);
if (addr == 0)return false;
}
//クロノクロック
//会提前停止
if(((*(DWORD*)(addr-3))&0xffffff)==0xec8b55 )addr-=3;
HookParam hp;
hp.address = addr;
if(*(BYTE*)addr==0x8b){
//みはる -あるとアナザーストーリー-
//stdcall , mov edx, [esp+arg_0]
hp.offset=get_stack(3);
}
else
hp.offset=get_stack(2);
hp.split =get_reg(regs::esp);
hp.type = CODEC_ANSI_BE|USING_SPLIT;
ConsoleOutput("INSERT CMVS1");
//RegisterEngineType(ENGINE_CMVS);
return NewHook(hp, "CMVS");
}
/**
* CMSV
* Sample games:
* ハピメア: /HAC@48FF3:cmvs32.exe
* ハピメアFD: /HB-1C*0@44EE95
*
* Optional: ハピメアFD: /HB-1C*0@44EE95
* This hook has issue that the text will be split to a large amount of threads
* - length_offset: 1
* - off: 4294967264 = 0xffffffe0 = -0x20
* - type: 8
*
* ハピメア: /HAC@48FF3:cmvs32.exe
* base: 0x400000
* - length_offset: 1
* - off: 12 = 0xc
* - type: 68 = 0x44
*
* 00448fee cc int3
* 00448fef cc int3
* 00448ff0 /$ 55 push ebp
* 00448ff1 |. 8bec mov ebp,esp
* 00448ff3 |. 83ec 68 sub esp,0x68 ; jichi: hook here, it is actually tagTEXTMETRICA
* 00448ff6 |. 8b01 mov eax,dword ptr ds:[ecx]
* 00448ff8 |. 56 push esi
* 00448ff9 |. 33f6 xor esi,esi
* 00448ffb |. 33d2 xor edx,edx
* 00448ffd |. 57 push edi
* 00448ffe |. 894d fc mov dword ptr ss:[ebp-0x4],ecx
* 00449001 |. 3bc6 cmp eax,esi
* 00449003 |. 74 37 je short cmvs32.0044903c
* 00449005 |> 66:8b78 08 /mov di,word ptr ds:[eax+0x8]
* 00449009 |. 66:3b7d 0c |cmp di,word ptr ss:[ebp+0xc]
* 0044900d |. 75 0a |jnz short cmvs32.00449019
* 0044900f |. 66:8b7d 10 |mov di,word ptr ss:[ebp+0x10]
* 00449013 |. 66:3978 0a |cmp word ptr ds:[eax+0xa],di
* 00449017 |. 74 0a |je short cmvs32.00449023
* 00449019 |> 8bd0 |mov edx,eax
* 0044901b |. 8b00 |mov eax,dword ptr ds:[eax]
* 0044901d |. 3bc6 |cmp eax,esi
* 0044901f |.^75 e4 \jnz short cmvs32.00449005
* 00449021 |. eb 19 jmp short cmvs32.0044903c
* 00449023 |> 3bd6 cmp edx,esi
* 00449025 |. 74 0a je short cmvs32.00449031
* 00449027 |. 8b38 mov edi,dword ptr ds:[eax]
* 00449029 |. 893a mov dword ptr ds:[edx],edi
* 0044902b |. 8b11 mov edx,dword ptr ds:[ecx]
* 0044902d |. 8910 mov dword ptr ds:[eax],edx
* 0044902f |. 8901 mov dword ptr ds:[ecx],eax
* 00449031 |> 8b40 04 mov eax,dword ptr ds:[eax+0x4]
* 00449034 |. 3bc6 cmp eax,esi
* 00449036 |. 0f85 64010000 jnz cmvs32.004491a0
* 0044903c |> 8b55 08 mov edx,dword ptr ss:[ebp+0x8]
* 0044903f |. 53 push ebx
* 00449040 |. 0fb75d 0c movzx ebx,word ptr ss:[ebp+0xc]
* 00449044 |. b8 00000100 mov eax,0x10000
* 00449049 |. 8945 e4 mov dword ptr ss:[ebp-0x1c],eax
* 0044904c |. 8945 f0 mov dword ptr ss:[ebp-0x10],eax
* 0044904f |. 8d45 e4 lea eax,dword ptr ss:[ebp-0x1c]
* 00449052 |. 50 push eax ; /pMat2
* 00449053 |. 56 push esi ; |Buffer
* 00449054 |. 56 push esi ; |BufSize
* 00449055 |. 8d4d d0 lea ecx,dword ptr ss:[ebp-0x30] ; |
* 00449058 |. 51 push ecx ; |pMetrics
* 00449059 |. 6a 05 push 0x5 ; |Format = GGO_GRAY4_BITMAP
* 0044905b |. 53 push ebx ; |Char
* 0044905c |. 52 push edx ; |hDC
* 0044905d |. 8975 e8 mov dword ptr ss:[ebp-0x18],esi ; |
* 00449060 |. 8975 ec mov dword ptr ss:[ebp-0x14],esi ; |
* 00449063 |. ff15 5cf05300 call dword ptr ds:[<&gdi32.getglyphoutli>; \GetGlyphOutlineA
* 00449069 |. 8b75 10 mov esi,dword ptr ss:[ebp+0x10]
* 0044906c |. 0faff6 imul esi,esi
* 0044906f |. 8bf8 mov edi,eax
* 00449071 |. 8d04bd 0000000>lea eax,dword ptr ds:[edi*4]
* 00449078 |. 3bc6 cmp eax,esi
* 0044907a |. 76 02 jbe short cmvs32.0044907e
* 0044907c |. 8bf0 mov esi,eax
* 0044907e |> 56 push esi ; /Size
* 0044907f |. 6a 00 push 0x0 ; |Flags = LMEM_FIXED
* 00449081 |. ff15 34f25300 call dword ptr ds:[<&kernel32.localalloc>; \LocalAlloc
*/
bool InsertCMVS2Hook()
{
// There are multiple functions satisfy the pattern below.
// Hook to any one of them is OK.
const BYTE bytes[] = { // function begin
0x55, // 00448ff0 /$ 55 push ebp
0x8b,0xec, // 00448ff1 |. 8bec mov ebp,esp
0x83,0xec, 0x68, // 00448ff3 |. 83ec 68 sub esp,0x68 ; jichi: hook here
0x8b,0x01, // 00448ff6 |. 8b01 mov eax,dword ptr ds:[ecx]
0x56, // 00448ff8 |. 56 push esi
0x33,0xf6, // 00448ff9 |. 33f6 xor esi,esi
0x33,0xd2, // 00448ffb |. 33d2 xor edx,edx
0x57, // 00448ffd |. 57 push edi
0x89,0x4d, 0xfc, // 00448ffe |. 894d fc mov dword ptr ss:[ebp-0x4],ecx
0x3b,0xc6, // 00449001 |. 3bc6 cmp eax,esi
0x74, 0x37 // 00449003 |. 74 37 je short cmvs32.0044903c
};
enum { addr_offset = 3 }; // offset from the beginning of the function
ULONG range = min(processStopAddress - processStartAddress, MAX_REL_ADDR);
ULONG addr = MemDbg::findBytes(bytes, sizeof(bytes), processStartAddress, processStartAddress + range);
// Artikash 11/9/2018: Not sure, but isn't findCallerAddress a better way to do this?
if (!addr) addr = MemDbg::findCallerAddressAfterInt3((DWORD)GetGlyphOutlineA, processStartAddress, processStopAddress);
if (!addr) {
ConsoleOutput("CMVS2: pattern not found");
return false;
}
//reladdr = 0x48ff0;
//reladdr = 0x48ff3;
HookParam hp;
hp.address = addr + addr_offset;
hp.offset=get_stack(3);
hp.type = CODEC_ANSI_BE;
ConsoleOutput("INSERT CMVS2");
return NewHook(hp, "CMVS2");
}
} // unnamed namespace
// jichi 3/7/2014: Insert the old hook first since GetGlyphOutlineA can NOT be found in new games
bool InsertCMVSHook()
{
// Both CMVS1 and CMVS2 exists in new games.
// Insert the CMVS2 first. Since CMVS1 could break CMVS2
// And the CMVS1 games do not have CMVS2 patterns.
//return InsertCMVS2Hook() || InsertCMVS1Hook();
//初恋サクラメント
//夏に奏でる僕らの詩
//まじぷり＼Wonder Cradle
//等等一堆游戏，都能搜索到2，但没文字。
// bool b2=InsertCMVS2Hook();
// //先插入1会崩溃。
// bool b1=InsertCMVS1Hook();
//return b1||b2;
return InsertCMVS1Hook();
}
/**
* Sample game: クロノクロック (CMVS2)
*
* This function is found by back-tracking GetGlyphOutlineA
* Until I found a function with GetDC.
*
* 0045111B CC INT3
* 0045111C CC INT3
* 0045111D CC INT3
* 0045111E CC INT3
* 0045111F CC INT3
* 00451120 55 PUSH EBP
* 00451121 8BEC MOV EBP,ESP
* 00451123 83EC 58 SUB ESP,0x58
* 00451126 53 PUSH EBX
* 00451127 33C0 XOR EAX,EAX
* 00451129 56 PUSH ESI
* 0045112A 8BF1 MOV ESI,ECX
* 0045112C 57 PUSH EDI
* 0045112D 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+0x8]
* 00451130 8945 FC MOV DWORD PTR SS:[EBP-0x4],EAX
* 00451133 8945 F4 MOV DWORD PTR SS:[EBP-0xC],EAX
* 00451136 8945 E8 MOV DWORD PTR SS:[EBP-0x18],EAX
* 00451139 8B86 58010000 MOV EAX,DWORD PTR DS:[ESI+0x158]
* 0045113F 50 PUSH EAX
* 00451140 FF15 C0735400 CALL DWORD PTR DS:[0x5473C0] ; user32.GetDC
* 00451146 68 80000000 PUSH 0x80
* 0045114B 8D9E B8000000 LEA EBX,DWORD PTR DS:[ESI+0xB8]
* 00451151 6A 00 PUSH 0x0
* 00451153 53 PUSH EBX
* 00451154 8945 E4 MOV DWORD PTR SS:[EBP-0x1C],EAX
* 00451157 E8 C4A00D00 CALL .0052B220
* 0045115C 83C4 0C ADD ESP,0xC
* 0045115F 83BE A4000000 00 CMP DWORD PTR DS:[ESI+0xA4],0x0
* 00451166 74 29 JE SHORT .00451191
* 00451168 6A 00 PUSH 0x0
* 0045116A 6A 00 PUSH 0x0
* 0045116C 53 PUSH EBX
* 0045116D 8BCF MOV ECX,EDI
* 0045116F 51 PUSH ECX
* 00451170 8BCE MOV ECX,ESI
* 00451172 E8 29F8FFFF CALL .004509A0
* 00451177 833B 00 CMP DWORD PTR DS:[EBX],0x0
* 0045117A 77 09 JA SHORT .00451185
* 0045117C 83BE AC000000 00 CMP DWORD PTR DS:[ESI+0xAC],0x0
* 00451183 74 0C JE SHORT .00451191
* 00451185 8B96 B0000000 MOV EDX,DWORD PTR DS:[ESI+0xB0]
* 0045118B 0196 9C000000 ADD DWORD PTR DS:[ESI+0x9C],EDX
* 00451191 8B4E 7C MOV ECX,DWORD PTR DS:[ESI+0x7C]
* 00451194 8B56 70 MOV EDX,DWORD PTR DS:[ESI+0x70]
* 00451197 B8 28000000 MOV EAX,0x28
* 0045119C 66:8945 A8 MOV WORD PTR SS:[EBP-0x58],AX
* 004511A0 8B46 74 MOV EAX,DWORD PTR DS:[ESI+0x74]
* 004511A3 894D CC MOV DWORD PTR SS:[EBP-0x34],ECX
* 004511A6 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+0x1C]
* 004511A9 8945 C4 MOV DWORD PTR SS:[EBP-0x3C],EAX
* 004511AC 8B86 80000000 MOV EAX,DWORD PTR DS:[ESI+0x80]
* 004511B2 894D BC MOV DWORD PTR SS:[EBP-0x44],ECX
* 004511B5 33C9 XOR ECX,ECX
* 004511B7 48 DEC EAX
* 004511B8 8955 C0 MOV DWORD PTR SS:[EBP-0x40],EDX
* 004511BB 894D B0 MOV DWORD PTR SS:[EBP-0x50],ECX
* 004511BE 74 18 JE SHORT .004511D8
* 004511C0 48 DEC EAX
* 004511C1 74 0C JE SHORT .004511CF
* 004511C3 48 DEC EAX
* 004511C4 75 19 JNZ SHORT .004511DF
* 004511C6 C745 B0 03000000 MOV DWORD PTR SS:[EBP-0x50],0x3
* 004511CD EB 10 JMP SHORT .004511DF
* 004511CF C745 B0 02000000 MOV DWORD PTR SS:[EBP-0x50],0x2
* 004511D6 EB 07 JMP SHORT .004511DF
* 004511D8 C745 B0 01000000 MOV DWORD PTR SS:[EBP-0x50],0x1
* 004511DF 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0xC]
* 004511E2 3BC1 CMP EAX,ECX
* 004511E4 74 1B JE SHORT .00451201
* 004511E6 8B50 0C MOV EDX,DWORD PTR DS:[EAX+0xC]
* 004511E9 8955 C8 MOV DWORD PTR SS:[EBP-0x38],EDX
* 004511EC 3948 10 CMP DWORD PTR DS:[EAX+0x10],ECX
* 004511EF 74 05 JE SHORT .004511F6
* 004511F1 894D F0 MOV DWORD PTR SS:[EBP-0x10],ECX
* 004511F4 EB 26 JMP SHORT .0045121C
* 004511F6 8B96 8C000000 MOV EDX,DWORD PTR DS:[ESI+0x8C]
* 004511FC 0FAF10 IMUL EDX,DWORD PTR DS:[EAX]
* 004511FF EB 0E JMP SHORT .0045120F
* 00451201 8B46 78 MOV EAX,DWORD PTR DS:[ESI+0x78]
* 00451204 8B96 8C000000 MOV EDX,DWORD PTR DS:[ESI+0x8C]
* 0045120A 8945 C8 MOV DWORD PTR SS:[EBP-0x38],EAX
* 0045120D 03D2 ADD EDX,EDX
* 0045120F B8 CDCCCCCC MOV EAX,0xCCCCCCCD
* 00451214 F7E2 MUL EDX
* 00451216 C1EA 03 SHR EDX,0x3
* 00451219 8955 F0 MOV DWORD PTR SS:[EBP-0x10],EDX
* 0045121C 8BC7 MOV EAX,EDI
* 0045121E 3808 CMP BYTE PTR DS:[EAX],CL
* 00451220 0F84 5A040000 JE .00451680
* 00451226 EB 02 JMP SHORT .0045122A
* 00451228 33C9 XOR ECX,ECX
* 0045122A 0FB607 MOVZX EAX,BYTE PTR DS:[EDI]
* 0045122D 3C 5C CMP AL,0x5C
* 0045122F 0F84 AE030000 JE .004515E3
* 00451235 3C 7B CMP AL,0x7B
* 00451237 0F84 65010000 JE .004513A2
* 0045123D 50 PUSH EAX
* 0045123E E8 DD59FBFF CALL .00406C20
* 00451243 Hook 85C0 TEST EAX,EAX
* 00451245 0F84 A6000000 JE .004512F1
* 0045124B 66:0FBE47 01 MOVSX AX,BYTE PTR DS:[EDI+0x1]
* 00451250 66:0FBE17 MOVSX DX,BYTE PTR DS:[EDI]
* 00451254 B9 FF000000 MOV ECX,0xFF
* 00451259 66:23C1 AND AX,CX
* 0045125C 66:C1E2 08 SHL DX,0x8
* 00451260 66:0BC2 OR AX,DX
* 00451263 B9 4A810000 MOV ECX,0x814A
* 00451268 83C7 02 ADD EDI,0x2
* 0045126B 33DB XOR EBX,EBX
* 0045126D 66:8945 AA MOV WORD PTR SS:[EBP-0x56],AX
* 00451271 66:3BC1 CMP AX,CX
* 00451274 75 05 JNZ SHORT .0045127B
* 00451276 BB 01000000 MOV EBX,0x1
* 0045127B 8B45 AA MOV EAX,DWORD PTR SS:[EBP-0x56]
* 0045127E 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-0xC]
* 00451281 52 PUSH EDX
* 00451282 50 PUSH EAX
* 00451283 6A 00 PUSH 0x0
* 00451285 8BCE MOV ECX,ESI
* 00451287 E8 44F9FFFF CALL .00450BD0
* 0045128C 8B8E 98000000 MOV ECX,DWORD PTR DS:[ESI+0x98]
* 00451292 8B96 9C000000 MOV EDX,DWORD PTR DS:[ESI+0x9C]
* 00451298 894D B4 MOV DWORD PTR SS:[EBP-0x4C],ECX
* 0045129B 8955 B8 MOV DWORD PTR SS:[EBP-0x48],EDX
* 0045129E 85DB TEST EBX,EBX
* 004512A0 74 0E JE SHORT .004512B0
* 004512A2 B8 CDCCCCCC MOV EAX,0xCCCCCCCD
* 004512A7 F766 1C MUL DWORD PTR DS:[ESI+0x1C]
* 004512AA C1EA 02 SHR EDX,0x2
* 004512AD 2955 B4 SUB DWORD PTR SS:[EBP-0x4C],EDX
* 004512B0 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-0x1C]
* 004512B3 8D45 DC LEA EAX,DWORD PTR SS:[EBP-0x24]
* 004512B6 50 PUSH EAX
* 004512B7 8D4D A8 LEA ECX,DWORD PTR SS:[EBP-0x58]
* 004512BA 51 PUSH ECX
* 004512BB 52 PUSH EDX
* 004512BC 8BCE MOV ECX,ESI
* 004512BE E8 EDEEFFFF CALL .004501B0
* 004512C3 8945 F8 MOV DWORD PTR SS:[EBP-0x8],EAX
* 004512C6 85DB TEST EBX,EBX
* 004512C8 75 11 JNZ SHORT .004512DB
* 004512CA 8B46 20 MOV EAX,DWORD PTR DS:[ESI+0x20]
* 004512CD 0346 1C ADD EAX,DWORD PTR DS:[ESI+0x1C]
* 004512D0 0186 98000000 ADD DWORD PTR DS:[ESI+0x98],EAX
* 004512D6 E9 A4000000 JMP .0045137F
* 004512DB 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+0x1C]
* 004512DE B8 CDCCCCCC MOV EAX,0xCCCCCCCD
* 004512E3 F7E1 MUL ECX
* 004512E5 C1EA 02 SHR EDX,0x2
* 004512E8 D1E9 SHR ECX,1
* 004512EA 2BCA SUB ECX,EDX
* 004512EC E9 85000000 JMP .00451376
* 004512F1 66:0FBE0F MOVSX CX,BYTE PTR DS:[EDI]
* 004512F5 8B46 1C MOV EAX,DWORD PTR DS:[ESI+0x1C]
* 004512F8 8B56 14 MOV EDX,DWORD PTR DS:[ESI+0x14]
* 004512FB 2BD0 SUB EDX,EAX
* 004512FD 2B56 20 SUB EDX,DWORD PTR DS:[ESI+0x20]
* 00451300 66:894D AA MOV WORD PTR SS:[EBP-0x56],CX
* 00451304 8B4E 0C MOV ECX,DWORD PTR DS:[ESI+0xC]
* 00451307 03D1 ADD EDX,ECX
* 00451309 47 INC EDI
* 0045130A 3996 98000000 CMP DWORD PTR DS:[ESI+0x98],EDX
* 00451310 72 37 JB SHORT .00451349
* 00451312 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-0xC]
* 00451315 42 INC EDX
* 00451316 83BC96 B8000000 >CMP DWORD PTR DS:[ESI+EDX*4+0xB8],0x0
* 0045131E 8955 F4 MOV DWORD PTR SS:[EBP-0xC],EDX
* 00451321 77 09 JA SHORT .0045132C
* 00451323 83BE AC000000 00 CMP DWORD PTR DS:[ESI+0xAC],0x0
* 0045132A 74 0C JE SHORT .00451338
* 0045132C 8B96 B0000000 MOV EDX,DWORD PTR DS:[ESI+0xB0]
* 00451332 0196 9C000000 ADD DWORD PTR DS:[ESI+0x9C],EDX
* 00451338 898E 98000000 MOV DWORD PTR DS:[ESI+0x98],ECX
* 0045133E 8B4E 24 MOV ECX,DWORD PTR DS:[ESI+0x24]
* 00451341 03C8 ADD ECX,EAX
* 00451343 018E 9C000000 ADD DWORD PTR DS:[ESI+0x9C],ECX
* 00451349 8B96 98000000 MOV EDX,DWORD PTR DS:[ESI+0x98]
* 0045134F 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C]
* 00451355 8D4D DC LEA ECX,DWORD PTR SS:[EBP-0x24]
* 00451358 51 PUSH ECX
* 00451359 8955 B4 MOV DWORD PTR SS:[EBP-0x4C],EDX
* 0045135C 8D55 A8 LEA EDX,DWORD PTR SS:[EBP-0x58]
* 0045135F 8945 B8 MOV DWORD PTR SS:[EBP-0x48],EAX
* 00451362 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-0x1C]
* 00451365 52 PUSH EDX
* 00451366 50 PUSH EAX
* 00451367 8BCE MOV ECX,ESI
* 00451369 E8 42EEFFFF CALL .004501B0
* 0045136E 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+0x1C]
* 00451371 8945 F8 MOV DWORD PTR SS:[EBP-0x8],EAX
* 00451374 D1E9 SHR ECX,1
* 00451376 034E 20 ADD ECX,DWORD PTR DS:[ESI+0x20]
* 00451379 018E 98000000 ADD DWORD PTR DS:[ESI+0x98],ECX
* 0045137F 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-0x10]
* 00451382 8B45 E8 MOV EAX,DWORD PTR SS:[EBP-0x18]
* 00451385 8B4D FC MOV ECX,DWORD PTR SS:[EBP-0x4]
* 00451388 52 PUSH EDX
* 00451389 8B55 0C MOV EDX,DWORD PTR SS:[EBP+0xC]
* 0045138C 50 PUSH EAX
* 0045138D 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-0x8]
* 00451390 51 PUSH ECX
* 00451391 52 PUSH EDX
* 00451392 50 PUSH EAX
* 00451393 8BCE MOV ECX,ESI
* 00451395 E8 36F9FFFF CALL .00450CD0
* 0045139A 8945 FC MOV DWORD PTR SS:[EBP-0x4],EAX
* 0045139D E9 D5020000 JMP .00451677
* 004513A2 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-0xC]
* 004513A5 52 PUSH EDX
* 004513A6 51 PUSH ECX
* 004513A7 51 PUSH ECX
* 004513A8 8BCE MOV ECX,ESI
* 004513AA E8 21F8FFFF CALL .00450BD0
* 004513AF 8B86 98000000 MOV EAX,DWORD PTR DS:[ESI+0x98]
* 004513B5 8B4D FC MOV ECX,DWORD PTR SS:[EBP-0x4]
* 004513B8 8B55 BC MOV EDX,DWORD PTR SS:[EBP-0x44]
* 004513BB 8945 08 MOV DWORD PTR SS:[EBP+0x8],EAX
* 004513BE 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C]
* 004513C4 2B86 B0000000 SUB EAX,DWORD PTR DS:[ESI+0xB0]
* 004513CA 894D D8 MOV DWORD PTR SS:[EBP-0x28],ECX
* 004513CD 8945 D4 MOV DWORD PTR SS:[EBP-0x2C],EAX
* 004513D0 BB 01000000 MOV EBX,0x1
* 004513D5 Hook 47 INC EDI
* 004513D6 8955 D0 MOV DWORD PTR SS:[EBP-0x30],EDX
* 004513D9 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
* 004513E0 0FB607 MOVZX EAX,BYTE PTR DS:[EDI]
* 004513E3 50 PUSH EAX
* 004513E4 E8 3758FBFF CALL .00406C20
* 004513E9 85C0 TEST EAX,EAX
* 004513EB 74 55 JE SHORT .00451442
* 004513ED 66:0FBE4F 01 MOVSX CX,BYTE PTR DS:[EDI+0x1]
* 004513F2 66:0FBE07 MOVSX AX,BYTE PTR DS:[EDI]
* 004513F6 BA FF000000 MOV EDX,0xFF
* 004513FB 66:23CA AND CX,DX
* 004513FE 8B96 9C000000 MOV EDX,DWORD PTR DS:[ESI+0x9C]
* 00451404 66:C1E0 08 SHL AX,0x8
* 00451408 66:0BC8 OR CX,AX
* 0045140B 66:894D AA MOV WORD PTR SS:[EBP-0x56],CX
* 0045140F 8B8E 98000000 MOV ECX,DWORD PTR DS:[ESI+0x98]
* 00451415 894D B4 MOV DWORD PTR SS:[EBP-0x4C],ECX
* 00451418 8D45 DC LEA EAX,DWORD PTR SS:[EBP-0x24]
* 0045141B 50 PUSH EAX
* 0045141C 8D4D A8 LEA ECX,DWORD PTR SS:[EBP-0x58]
* 0045141F 8955 B8 MOV DWORD PTR SS:[EBP-0x48],EDX
* 00451422 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-0x1C]
* 00451425 51 PUSH ECX
* 00451426 52 PUSH EDX
* 00451427 8BCE MOV ECX,ESI
* 00451429 83C7 02 ADD EDI,0x2
* 0045142C E8 7FEDFFFF CALL .004501B0
* 00451431 8945 F8 MOV DWORD PTR SS:[EBP-0x8],EAX
* 00451434 8B46 20 MOV EAX,DWORD PTR DS:[ESI+0x20]
* 00451437 0346 1C ADD EAX,DWORD PTR DS:[ESI+0x1C]
* 0045143A 0186 98000000 ADD DWORD PTR DS:[ESI+0x98],EAX
* 00451440 EB 08 JMP SHORT .0045144A
* 00451442 803F 2F CMP BYTE PTR DS:[EDI],0x2F
* 00451445 75 02 JNZ SHORT .00451449
* 00451447 33DB XOR EBX,EBX
* 00451449 47 INC EDI
* 0045144A 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-0x10]
* 0045144D 8B55 E8 MOV EDX,DWORD PTR SS:[EBP-0x18]
* 00451450 8B45 FC MOV EAX,DWORD PTR SS:[EBP-0x4]
* 00451453 51 PUSH ECX
* 00451454 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0xC]
* 00451457 52 PUSH EDX
* 00451458 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-0x8]
* 0045145B 50 PUSH EAX
* 0045145C 51 PUSH ECX
* 0045145D 52 PUSH EDX
* 0045145E 8BCE MOV ECX,ESI
* 00451460 E8 6BF8FFFF CALL .00450CD0
* 00451465 8945 FC MOV DWORD PTR SS:[EBP-0x4],EAX
* 00451468 85DB TEST EBX,EBX
* 0045146A ^0F85 70FFFFFF JNZ .004513E0
* 00451470 399E A4000000 CMP DWORD PTR DS:[ESI+0xA4],EBX
* 00451476 0F84 3F010000 JE .004515BB
* 0045147C 8BDF MOV EBX,EDI
* 0045147E C745 E0 00000000 MOV DWORD PTR SS:[EBP-0x20],0x0
* 00451485 C745 EC 01000000 MOV DWORD PTR SS:[EBP-0x14],0x1
* 0045148C 8D6424 00 LEA ESP,DWORD PTR SS:[ESP]
* 00451490 0FB603 MOVZX EAX,BYTE PTR DS:[EBX]
* 00451493 50 PUSH EAX
* 00451494 E8 8757FBFF CALL .00406C20
* 00451499 85C0 TEST EAX,EAX
* 0045149B 74 08 JE SHORT .004514A5
* 0045149D FF45 E0 INC DWORD PTR SS:[EBP-0x20]
* 004514A0 83C3 02 ADD EBX,0x2
* 004514A3 EB 0D JMP SHORT .004514B2
* 004514A5 803B 7D CMP BYTE PTR DS:[EBX],0x7D
* 004514A8 75 07 JNZ SHORT .004514B1
* 004514AA C745 EC 00000000 MOV DWORD PTR SS:[EBP-0x14],0x0
* 004514B1 43 INC EBX
* 004514B2 837D EC 00 CMP DWORD PTR SS:[EBP-0x14],0x0
* 004514B6 ^75 D8 JNZ SHORT .00451490
* 004514B8 8B9E B0000000 MOV EBX,DWORD PTR DS:[ESI+0xB0]
* 004514BE 8B4D E0 MOV ECX,DWORD PTR SS:[EBP-0x20]
* 004514C1 8B55 08 MOV EDX,DWORD PTR SS:[EBP+0x8]
* 004514C4 8BC3 MOV EAX,EBX
* 004514C6 0FAFC1 IMUL EAX,ECX
* 004514C9 03C9 ADD ECX,ECX
* 004514CB 894D E0 MOV DWORD PTR SS:[EBP-0x20],ECX
* 004514CE 8B8E 98000000 MOV ECX,DWORD PTR DS:[ESI+0x98]
* 004514D4 2BCA SUB ECX,EDX
* 004514D6 C1E0 0A SHL EAX,0xA
* 004514D9 C1E1 0A SHL ECX,0xA
* 004514DC C1E2 0A SHL EDX,0xA
* 004514DF 895D BC MOV DWORD PTR SS:[EBP-0x44],EBX
* 004514E2 C745 EC 01000000 MOV DWORD PTR SS:[EBP-0x14],0x1
* 004514E9 8955 08 MOV DWORD PTR SS:[EBP+0x8],EDX
* 004514EC 3BC1 CMP EAX,ECX
* 004514EE 76 0F JBE SHORT .004514FF
* 004514F0 2BC1 SUB EAX,ECX
* 004514F2 D1E8 SHR EAX,1
* 004514F4 2945 08 SUB DWORD PTR SS:[EBP+0x8],EAX
* 004514F7 C1E3 0A SHL EBX,0xA
* 004514FA 895D E0 MOV DWORD PTR SS:[EBP-0x20],EBX
* 004514FD EB 21 JMP SHORT .00451520
* 004514FF 2BC8 SUB ECX,EAX
* 00451501 33D2 XOR EDX,EDX
* 00451503 8BC1 MOV EAX,ECX
* 00451505 F775 E0 DIV DWORD PTR SS:[EBP-0x20]
* 00451508 8B96 B4000000 MOV EDX,DWORD PTR DS:[ESI+0xB4]
* 0045150E C1E3 09 SHL EBX,0x9
* 00451511 0145 08 ADD DWORD PTR SS:[EBP+0x8],EAX
* 00451514 03D8 ADD EBX,EAX
* 00451516 8D045A LEA EAX,DWORD PTR DS:[EDX+EBX*2]
* 00451519 8945 E0 MOV DWORD PTR SS:[EBP-0x20],EAX
* 0045151C 8D6424 00 LEA ESP,DWORD PTR SS:[ESP]
* 00451520 0FB60F MOVZX ECX,BYTE PTR DS:[EDI]
* 00451523 51 PUSH ECX
* 00451524 E8 F756FBFF CALL .00406C20
* 00451529 85C0 TEST EAX,EAX
* 0045152B 74 4E JE SHORT .0045157B
* 0045152D 66:0FBE57 01 MOVSX DX,BYTE PTR DS:[EDI+0x1]
* 00451532 66:0FBE0F MOVSX CX,BYTE PTR DS:[EDI]
* 00451536 8B5D 08 MOV EBX,DWORD PTR SS:[EBP+0x8]
* 00451539 B8 FF000000 MOV EAX,0xFF
* 0045153E 66:23D0 AND DX,AX
* 00451541 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-0x2C]
* 00451544 66:C1E1 08 SHL CX,0x8
* 00451548 66:0BD1 OR DX,CX
* 0045154B 66:8955 AA MOV WORD PTR SS:[EBP-0x56],DX
* 0045154F 8BD3 MOV EDX,EBX
* 00451551 C1EA 0A SHR EDX,0xA
* 00451554 8D4D DC LEA ECX,DWORD PTR SS:[EBP-0x24]
* 00451557 51 PUSH ECX
* 00451558 8955 B4 MOV DWORD PTR SS:[EBP-0x4C],EDX
* 0045155B 8D55 A8 LEA EDX,DWORD PTR SS:[EBP-0x58]
* 0045155E 8945 B8 MOV DWORD PTR SS:[EBP-0x48],EAX
* 00451561 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-0x1C]
* 00451564 52 PUSH EDX
* 00451565 50 PUSH EAX
* 00451566 8BCE MOV ECX,ESI
* 00451568 83C7 02 ADD EDI,0x2
* 0045156B E8 40ECFFFF CALL .004501B0
* 00451570 035D E0 ADD EBX,DWORD PTR SS:[EBP-0x20]
* 00451573 8945 F8 MOV DWORD PTR SS:[EBP-0x8],EAX
* 00451576 895D 08 MOV DWORD PTR SS:[EBP+0x8],EBX
* 00451579 EB 0D JMP SHORT .00451588
* 0045157B 803F 7D CMP BYTE PTR DS:[EDI],0x7D
* 0045157E 75 07 JNZ SHORT .00451587
* 00451580 C745 EC 00000000 MOV DWORD PTR SS:[EBP-0x14],0x0
* 00451587 47 INC EDI
* 00451588 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-0x10]
* 0045158B 8B55 E8 MOV EDX,DWORD PTR SS:[EBP-0x18]
* 0045158E 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-0x28]
* 00451591 51 PUSH ECX
* 00451592 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0xC]
* 00451595 52 PUSH EDX
* 00451596 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-0x8]
* 00451599 50 PUSH EAX
* 0045159A 51 PUSH ECX
* 0045159B 52 PUSH EDX
* 0045159C 8BCE MOV ECX,ESI
* 0045159E E8 2DF7FFFF CALL .00450CD0
* 004515A3 837D EC 00 CMP DWORD PTR SS:[EBP-0x14],0x0
* 004515A7 8945 D8 MOV DWORD PTR SS:[EBP-0x28],EAX
* 004515AA ^0F85 70FFFFFF JNZ .00451520
* 004515B0 8B45 D0 MOV EAX,DWORD PTR SS:[EBP-0x30]
* 004515B3 8945 BC MOV DWORD PTR SS:[EBP-0x44],EAX
* 004515B6 E9 BC000000 JMP .00451677
* 004515BB BB 01000000 MOV EBX,0x1
* 004515C0 0FB60F MOVZX ECX,BYTE PTR DS:[EDI]
* 004515C3 51 PUSH ECX
* 004515C4 E8 5756FBFF CALL .00406C20
* 004515C9 85C0 TEST EAX,EAX
* 004515CB 74 05 JE SHORT .004515D2
* 004515CD 83C7 02 ADD EDI,0x2
* 004515D0 EB 08 JMP SHORT .004515DA
* 004515D2 803F 7D CMP BYTE PTR DS:[EDI],0x7D
* 004515D5 75 02 JNZ SHORT .004515D9
* 004515D7 33DB XOR EBX,EBX
* 004515D9 47 INC EDI
* 004515DA 85DB TEST EBX,EBX
* 004515DC ^75 E2 JNZ SHORT .004515C0
* 004515DE E9 94000000 JMP .00451677
* 004515E3 0FBE47 01 MOVSX EAX,BYTE PTR DS:[EDI+0x1]
* 004515E7 83C0 9D ADD EAX,-0x63
* 004515EA 83F8 14 CMP EAX,0x14
* 004515ED 0F87 84000000 JA .00451677
* 004515F3 0FB690 B4164500 MOVZX EDX,BYTE PTR DS:[EAX+0x4516B4]
* 004515FA FF2495 A0164500 JMP DWORD PTR DS:[EDX*4+0x4516A0]
* 00451601 8B46 0C MOV EAX,DWORD PTR DS:[ESI+0xC]
* 00451604 8B4E 24 MOV ECX,DWORD PTR DS:[ESI+0x24]
* 00451607 034E 1C ADD ECX,DWORD PTR DS:[ESI+0x1C]
* 0045160A 8986 98000000 MOV DWORD PTR DS:[ESI+0x98],EAX
* 00451610 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-0xC]
* 00451613 018E 9C000000 ADD DWORD PTR DS:[ESI+0x9C],ECX
* 00451619 8B8E 9C000000 MOV ECX,DWORD PTR DS:[ESI+0x9C]
* 0045161F 40 INC EAX
* 00451620 83BC86 B8000000 >CMP DWORD PTR DS:[ESI+EAX*4+0xB8],0x0
* 00451628 8945 F4 MOV DWORD PTR SS:[EBP-0xC],EAX
* 0045162B 77 09 JA SHORT .00451636
* 0045162D 83BE AC000000 00 CMP DWORD PTR DS:[ESI+0xAC],0x0
* 00451634 74 3E JE SHORT .00451674
* 00451636 8B96 B0000000 MOV EDX,DWORD PTR DS:[ESI+0xB0]
* 0045163C 03D1 ADD EDX,ECX
* 0045163E 8996 9C000000 MOV DWORD PTR DS:[ESI+0x9C],EDX
* 00451644 EB 2E JMP SHORT .00451674
* 00451646 8BCE MOV ECX,ESI
* 00451648 E8 53F0FFFF CALL .004506A0
* 0045164D EB 25 JMP SHORT .00451674
* 0045164F 8A47 02 MOV AL,BYTE PTR DS:[EDI+0x2]
* 00451652 3C 63 CMP AL,0x63
* 00451654 74 0C JE SHORT .00451662
* 00451656 3C 73 CMP AL,0x73
* 00451658 75 12 JNZ SHORT .0045166C
* 0045165A 894D E8 MOV DWORD PTR SS:[EBP-0x18],ECX
* 0045165D 83C7 03 ADD EDI,0x3
* 00451660 EB 15 JMP SHORT .00451677
* 00451662 C745 E8 01000000 MOV DWORD PTR SS:[EBP-0x18],0x1
* 00451669 894D FC MOV DWORD PTR SS:[EBP-0x4],ECX
* 0045166C 83C7 03 ADD EDI,0x3
* 0045166F EB 06 JMP SHORT .00451677
* 00451671 894D FC MOV DWORD PTR SS:[EBP-0x4],ECX
* 00451674 83C7 02 ADD EDI,0x2
* 00451677 803F 00 CMP BYTE PTR DS:[EDI],0x0
* 0045167A ^0F85 A8FBFFFF JNZ .00451228
* 00451680 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-0x1C]
* 00451683 8B8E 58010000 MOV ECX,DWORD PTR DS:[ESI+0x158]
* 00451689 50 PUSH EAX
* 0045168A 51 PUSH ECX
* 0045168B FF15 C4735400 CALL DWORD PTR DS:[0x5473C4] ; user32.ReleaseDC
* 00451691 5F POP EDI
* 00451692 5E POP ESI
* 00451693 B8 01000000 MOV EAX,0x1
* 00451698 5B POP EBX
* 00451699 8BE5 MOV ESP,EBP
* 0045169B 5D POP EBP
* 0045169C C2 0800 RETN 0x8
* 0045169F 90 NOP
* 004516A0 46 INC ESI
* 004516A1 16 PUSH SS
* 004516A2 45 INC EBP
* 004516A3 0001 ADD BYTE PTR DS:[ECX],AL
* 004516A5 16 PUSH SS
* 004516A6 45 INC EBP
* 004516A7 0071 16 ADD BYTE PTR DS:[ECX+0x16],DH
* 004516AA 45 INC EBP
* 004516AB 004F 16 ADD BYTE PTR DS:[EDI+0x16],CL
* 004516AE 45 INC EBP
* 004516AF 0077 16 ADD BYTE PTR DS:[EDI+0x16],DH
* 004516B2 45 INC EBP
* 004516B3 0000 ADD BYTE PTR DS:[EAX],AL
* 004516B5 04 04 ADD AL,0x4
* 004516B7 04 04 ADD AL,0x4
* 004516B9 04 04 ADD AL,0x4
* 004516BB 04 04 ADD AL,0x4
* 004516BD 04 04 ADD AL,0x4
* 004516BF 010404 ADD DWORD PTR SS:[ESP+EAX],EAX
* 004516C2 04 04 ADD AL,0x4
* 004516C4 04 02 ADD AL,0x2
* 004516C6 04 04 ADD AL,0x4
* 004516C8 03CC ADD ECX,ESP
* 004516CA CC INT3
* 004516CB CC INT3
* 004516CC CC INT3
* 004516CD CC INT3
* 004516CE CC INT3
*
* EAX 080E2FFA
* ECX 015A74A0
* EDX 0012FDB4
* EBX 015A78D8
* ESP 0012FD98
* EBP 0012FDCC
* ESI 014F05E8
* EDI 01504BD0
* EIP 00451120 .00451120
*
* 0012FD98 00452439 RETURN to .00452439 from .00451120
* 0012FD9C 080E2FFA ; jichi: text here
* 0012FDA0 0012FDB4
* 0012FDA4 00002004
* 0012FDA8 014F05E8
* 0012FDAC 00000000
* 0012FDB0 00000000
* 0012FDB4 00000002
* 0012FDB8 00000001
* 0012FDBC 00000001
* 0012FDC0 00000001
* 0012FDC4 00000000
*
* Sample game: 未来ノスタルジア (CMVS1)
* 004425DC CC INT3
* 004425DD CC INT3
* 004425DE CC INT3
* 004425DF CC INT3
* 004425E0 83EC 58 SUB ESP,0x58
* 004425E3 53 PUSH EBX
* 004425E4 55 PUSH EBP
* 004425E5 56 PUSH ESI
* 004425E6 8BF1 MOV ESI,ECX
* 004425E8 8B86 58010000 MOV EAX,DWORD PTR DS:[ESI+0x158]
* 004425EE 57 PUSH EDI
* 004425EF 8B7C24 6C MOV EDI,DWORD PTR SS:[ESP+0x6C]
* 004425F3 33ED XOR EBP,EBP
* 004425F5 50 PUSH EAX
* 004425F6 896C24 70 MOV DWORD PTR SS:[ESP+0x70],EBP
* 004425FA 896C24 18 MOV DWORD PTR SS:[ESP+0x18],EBP
* 004425FE Hook 896C24 24 MOV DWORD PTR SS:[ESP+0x24],EBP
* 00442602 FF15 D8335200 CALL DWORD PTR DS:[0x5233D8] ; user32.GetDC
* 00442608 68 80000000 PUSH 0x80
* 0044260D 8D9E B8000000 LEA EBX,DWORD PTR DS:[ESI+0xB8]
* 00442613 55 PUSH EBP
* 00442614 53 PUSH EBX
* 00442615 894424 30 MOV DWORD PTR SS:[ESP+0x30],EAX
* 00442619 E8 82340C00 CALL .00505AA0
* 0044261E 83C4 0C ADD ESP,0xC
* 00442621 39AE A4000000 CMP DWORD PTR DS:[ESI+0xA4],EBP
* 00442627 74 23 JE SHORT .0044264C
* 00442629 55 PUSH EBP
* 0044262A 55 PUSH EBP
* 0044262B 53 PUSH EBX
* 0044262C 57 PUSH EDI
* 0044262D 8BCE MOV ECX,ESI
* 0044262F E8 FCF7FFFF CALL .00441E30
* 00442634 392B CMP DWORD PTR DS:[EBX],EBP
* 00442636 77 08 JA SHORT .00442640
* 00442638 39AE AC000000 CMP DWORD PTR DS:[ESI+0xAC],EBP
* 0044263E 74 0C JE SHORT .0044264C
* 00442640 8B8E B0000000 MOV ECX,DWORD PTR DS:[ESI+0xB0]
* 00442646 018E 9C000000 ADD DWORD PTR DS:[ESI+0x9C],ECX
* 0044264C 8B46 7C MOV EAX,DWORD PTR DS:[ESI+0x7C]
* 0044264F 8B4E 70 MOV ECX,DWORD PTR DS:[ESI+0x70]
* 00442652 894424 64 MOV DWORD PTR SS:[ESP+0x64],EAX
* 00442656 8B46 1C MOV EAX,DWORD PTR DS:[ESI+0x1C]
* 00442659 BA 28000000 MOV EDX,0x28
* 0044265E 894424 54 MOV DWORD PTR SS:[ESP+0x54],EAX
* 00442662 8B86 80000000 MOV EAX,DWORD PTR DS:[ESI+0x80]
* 00442668 83E8 01 SUB EAX,0x1
* 0044266B 66:895424 40 MOV WORD PTR SS:[ESP+0x40],DX
* 00442670 8B56 74 MOV EDX,DWORD PTR DS:[ESI+0x74]
* 00442673 894C24 58 MOV DWORD PTR SS:[ESP+0x58],ECX
* 00442677 895424 5C MOV DWORD PTR SS:[ESP+0x5C],EDX
* 0044267B 896C24 48 MOV DWORD PTR SS:[ESP+0x48],EBP
* 0044267F 74 1E JE SHORT .0044269F
* 00442681 83E8 01 SUB EAX,0x1
* 00442684 74 0F JE SHORT .00442695
* 00442686 83E8 01 SUB EAX,0x1
* 00442689 75 1C JNZ SHORT .004426A7
* 0044268B C74424 48 030000>MOV DWORD PTR SS:[ESP+0x48],0x3
* 00442693 EB 12 JMP SHORT .004426A7
* 00442695 C74424 48 020000>MOV DWORD PTR SS:[ESP+0x48],0x2
* 0044269D EB 08 JMP SHORT .004426A7
* 0044269F C74424 48 010000>MOV DWORD PTR SS:[ESP+0x48],0x1
* 004426A7 8B6C24 70 MOV EBP,DWORD PTR SS:[ESP+0x70]
* 004426AB 33DB XOR EBX,EBX
* 004426AD 3BEB CMP EBP,EBX
* 004426AF 74 25 JE SHORT .004426D6
* 004426B1 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+0xC]
* 004426B4 894C24 60 MOV DWORD PTR SS:[ESP+0x60],ECX
* 004426B8 395D 10 CMP DWORD PTR SS:[EBP+0x10],EBX
* 004426BB 74 06 JE SHORT .004426C3
* 004426BD 895C24 18 MOV DWORD PTR SS:[ESP+0x18],EBX
* 004426C1 EB 30 JMP SHORT .004426F3
* 004426C3 8B96 8C000000 MOV EDX,DWORD PTR DS:[ESI+0x8C]
* 004426C9 0FAF55 00 IMUL EDX,DWORD PTR SS:[EBP]
* 004426CD B8 CDCCCCCC MOV EAX,0xCCCCCCCD
* 004426D2 F7E2 MUL EDX
* 004426D4 EB 16 JMP SHORT .004426EC
* 004426D6 8B46 78 MOV EAX,DWORD PTR DS:[ESI+0x78]
* 004426D9 8B8E 8C000000 MOV ECX,DWORD PTR DS:[ESI+0x8C]
* 004426DF 894424 60 MOV DWORD PTR SS:[ESP+0x60],EAX
* 004426E3 03C9 ADD ECX,ECX
* 004426E5 B8 CDCCCCCC MOV EAX,0xCCCCCCCD
* 004426EA F7E1 MUL ECX
* 004426EC C1EA 03 SHR EDX,0x3
* 004426EF 895424 18 MOV DWORD PTR SS:[ESP+0x18],EDX
* 004426F3 381F CMP BYTE PTR DS:[EDI],BL
* 004426F5 0F84 79040000 JE .00442B74
* 004426FB EB 05 JMP SHORT .00442702
* 004426FD 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
* 00442700 33DB XOR EBX,EBX
* 00442702 0FB607 MOVZX EAX,BYTE PTR DS:[EDI]
* 00442705 3C 5C CMP AL,0x5C
* 00442707 0F84 C6030000 JE .00442AD3
* 0044270D 3C 7B CMP AL,0x7B
* 0044270F 0F84 70010000 JE .00442885
* 00442715 50 PUSH EAX
* 00442716 E8 A50EFCFF CALL .004035C0
* 0044271B 85C0 TEST EAX,EAX
* 0044271D 0F84 A8000000 JE .004427CB
* 00442723 66:0FBE47 01 MOVSX AX,BYTE PTR DS:[EDI+0x1]
* 00442728 66:0FBE0F MOVSX CX,BYTE PTR DS:[EDI]
* 0044272C BA FF000000 MOV EDX,0xFF
* 00442731 66:23C2 AND AX,DX
* 00442734 66:C1E1 08 SHL CX,0x8
* 00442738 66:0BC1 OR AX,CX
* 0044273B BA 4A810000 MOV EDX,0x814A
* 00442740 83C7 02 ADD EDI,0x2
* 00442743 66:894424 42 MOV WORD PTR SS:[ESP+0x42],AX
* 00442748 66:3BC2 CMP AX,DX
* 0044274B 75 05 JNZ SHORT .00442752
* 0044274D BB 01000000 MOV EBX,0x1
* 00442752 8B4C24 42 MOV ECX,DWORD PTR SS:[ESP+0x42]
* 00442756 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+0x14]
* 0044275A 50 PUSH EAX
* 0044275B 51 PUSH ECX
* 0044275C 6A 00 PUSH 0x0
* 0044275E 8BCE MOV ECX,ESI
* 00442760 E8 1BF9FFFF CALL .00442080
* 00442765 8B96 98000000 MOV EDX,DWORD PTR DS:[ESI+0x98]
* 0044276B 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C]
* 00442771 895424 4C MOV DWORD PTR SS:[ESP+0x4C],EDX
* 00442775 894424 50 MOV DWORD PTR SS:[ESP+0x50],EAX
* 00442779 85DB TEST EBX,EBX
* 0044277B 74 0F JE SHORT .0044278C
* 0044277D B8 CDCCCCCC MOV EAX,0xCCCCCCCD
* 00442782 F766 1C MUL DWORD PTR DS:[ESI+0x1C]
* 00442785 C1EA 02 SHR EDX,0x2
* 00442788 295424 4C SUB DWORD PTR SS:[ESP+0x4C],EDX
* 0044278C 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+0x24]
* 00442790 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+0x28]
* 00442794 51 PUSH ECX
* 00442795 8D5424 44 LEA EDX,DWORD PTR SS:[ESP+0x44]
* 00442799 52 PUSH EDX
* 0044279A 50 PUSH EAX
* 0044279B 8BCE MOV ECX,ESI
* 0044279D E8 0EEFFFFF CALL .004416B0
* 004427A2 894424 10 MOV DWORD PTR SS:[ESP+0x10],EAX
* 004427A6 85DB TEST EBX,EBX
* 004427A8 75 0B JNZ SHORT .004427B5
* 004427AA 8B4E 20 MOV ECX,DWORD PTR DS:[ESI+0x20]
* 004427AD 034E 1C ADD ECX,DWORD PTR DS:[ESI+0x1C]
* 004427B0 E9 A5000000 JMP .0044285A
* 004427B5 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+0x1C]
* 004427B8 B8 CDCCCCCC MOV EAX,0xCCCCCCCD
* 004427BD F7E1 MUL ECX
* 004427BF C1EA 02 SHR EDX,0x2
* 004427C2 D1E9 SHR ECX,1
* 004427C4 2BCA SUB ECX,EDX
* 004427C6 E9 8C000000 JMP .00442857
* 004427CB Hook 66:0FBE17 MOVSX DX,BYTE PTR DS:[EDI]
* 004427CF 8B46 1C MOV EAX,DWORD PTR DS:[ESI+0x1C]
* 004427D2 8B4E 0C MOV ECX,DWORD PTR DS:[ESI+0xC]
* 004427D5 66:895424 42 MOV WORD PTR SS:[ESP+0x42],DX
* 004427DA 8B56 14 MOV EDX,DWORD PTR DS:[ESI+0x14]
* 004427DD 2BD0 SUB EDX,EAX
* 004427DF 2B56 20 SUB EDX,DWORD PTR DS:[ESI+0x20]
* 004427E2 47 INC EDI
* 004427E3 03D1 ADD EDX,ECX
* 004427E5 3996 98000000 CMP DWORD PTR DS:[ESI+0x98],EDX
* 004427EB 72 37 JB SHORT .00442824
* 004427ED 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+0x14]
* 004427F1 42 INC EDX
* 004427F2 895424 14 MOV DWORD PTR SS:[ESP+0x14],EDX
* 004427F6 399C96 B8000000 CMP DWORD PTR DS:[ESI+EDX*4+0xB8],EBX
* 004427FD 77 08 JA SHORT .00442807
* 004427FF 399E AC000000 CMP DWORD PTR DS:[ESI+0xAC],EBX
* 00442805 74 0C JE SHORT .00442813
* 00442807 8B96 B0000000 MOV EDX,DWORD PTR DS:[ESI+0xB0]
* 0044280D 0196 9C000000 ADD DWORD PTR DS:[ESI+0x9C],EDX
* 00442813 898E 98000000 MOV DWORD PTR DS:[ESI+0x98],ECX
* 00442819 8B4E 24 MOV ECX,DWORD PTR DS:[ESI+0x24]
* 0044281C 03C8 ADD ECX,EAX
* 0044281E 018E 9C000000 ADD DWORD PTR DS:[ESI+0x9C],ECX
* 00442824 8B96 98000000 MOV EDX,DWORD PTR DS:[ESI+0x98]
* 0044282A 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C]
* 00442830 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+0x28]
* 00442834 51 PUSH ECX
* 00442835 895424 50 MOV DWORD PTR SS:[ESP+0x50],EDX
* 00442839 8D5424 44 LEA EDX,DWORD PTR SS:[ESP+0x44]
* 0044283D 894424 54 MOV DWORD PTR SS:[ESP+0x54],EAX
* 00442841 8B4424 28 MOV EAX,DWORD PTR SS:[ESP+0x28]
* 00442845 52 PUSH EDX
* 00442846 50 PUSH EAX
* 00442847 8BCE MOV ECX,ESI
* 00442849 E8 62EEFFFF CALL .004416B0
* 0044284E 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+0x1C]
* 00442851 894424 10 MOV DWORD PTR SS:[ESP+0x10],EAX
* 00442855 D1E9 SHR ECX,1
* 00442857 034E 20 ADD ECX,DWORD PTR DS:[ESI+0x20]
* 0044285A 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+0x18]
* 0044285E 018E 98000000 ADD DWORD PTR DS:[ESI+0x98],ECX
* 00442864 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+0x20]
* 00442868 8B4C24 6C MOV ECX,DWORD PTR SS:[ESP+0x6C]
* 0044286C 52 PUSH EDX
* 0044286D 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+0x14]
* 00442871 50 PUSH EAX
* 00442872 51 PUSH ECX
* 00442873 55 PUSH EBP
* 00442874 52 PUSH EDX
* 00442875 8BCE MOV ECX,ESI
* 00442877 E8 F4F8FFFF CALL .00442170
* 0044287C 894424 6C MOV DWORD PTR SS:[ESP+0x6C],EAX
* 00442880 E9 E6020000 JMP .00442B6B
* 00442885 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+0x14]
* 00442889 50 PUSH EAX
* 0044288A 53 PUSH EBX
* 0044288B 53 PUSH EBX
* 0044288C 8BCE MOV ECX,ESI
* 0044288E E8 EDF7FFFF CALL .00442080
* 00442893 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C]
* 00442899 2B86 B0000000 SUB EAX,DWORD PTR DS:[ESI+0xB0]
* 0044289F 8B8E 98000000 MOV ECX,DWORD PTR DS:[ESI+0x98]
* 004428A5 8B5424 6C MOV EDX,DWORD PTR SS:[ESP+0x6C]
* 004428A9 894424 38 MOV DWORD PTR SS:[ESP+0x38],EAX
* 004428AD 8B4424 54 MOV EAX,DWORD PTR SS:[ESP+0x54]
* 004428B1 894C24 30 MOV DWORD PTR SS:[ESP+0x30],ECX
* 004428B5 895424 2C MOV DWORD PTR SS:[ESP+0x2C],EDX
* 004428B9 BB 01000000 MOV EBX,0x1
* 004428BE 47 INC EDI
* 004428BF 894424 3C MOV DWORD PTR SS:[ESP+0x3C],EAX
* 004428C3 0FB60F MOVZX ECX,BYTE PTR DS:[EDI]
* 004428C6 51 PUSH ECX
* 004428C7 E8 F40CFCFF CALL .004035C0
* 004428CC 85C0 TEST EAX,EAX
* 004428CE 74 5C JE SHORT .0044292C
* 004428D0 66:0FBE57 01 MOVSX DX,BYTE PTR DS:[EDI+0x1]
* 004428D5 66:0FBE0F MOVSX CX,BYTE PTR DS:[EDI]
* 004428D9 B8 FF000000 MOV EAX,0xFF
* 004428DE 66:23D0 AND DX,AX
* 004428E1 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C]
* 004428E7 66:C1E1 08 SHL CX,0x8
* 004428EB 66:0BD1 OR DX,CX
* 004428EE 66:895424 42 MOV WORD PTR SS:[ESP+0x42],DX
* 004428F3 8B96 98000000 MOV EDX,DWORD PTR DS:[ESI+0x98]
* 004428F9 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+0x28]
* 004428FD 51 PUSH ECX
* 004428FE 895424 50 MOV DWORD PTR SS:[ESP+0x50],EDX
* 00442902 8D5424 44 LEA EDX,DWORD PTR SS:[ESP+0x44]
* 00442906 894424 54 MOV DWORD PTR SS:[ESP+0x54],EAX
* 0044290A 8B4424 28 MOV EAX,DWORD PTR SS:[ESP+0x28]
* 0044290E 52 PUSH EDX
* 0044290F 50 PUSH EAX
* 00442910 8BCE MOV ECX,ESI
* 00442912 83C7 02 ADD EDI,0x2
* 00442915 E8 96EDFFFF CALL .004416B0
* 0044291A 8B4E 20 MOV ECX,DWORD PTR DS:[ESI+0x20]
* 0044291D 034E 1C ADD ECX,DWORD PTR DS:[ESI+0x1C]
* 00442920 894424 10 MOV DWORD PTR SS:[ESP+0x10],EAX
* 00442924 018E 98000000 ADD DWORD PTR DS:[ESI+0x98],ECX
* 0044292A EB 08 JMP SHORT .00442934
* 0044292C 803F 2F CMP BYTE PTR DS:[EDI],0x2F
* 0044292F 75 02 JNZ SHORT .00442933
* 00442931 33DB XOR EBX,EBX
* 00442933 47 INC EDI
* 00442934 8B5424 18 MOV EDX,DWORD PTR SS:[ESP+0x18]
* 00442938 8B4424 20 MOV EAX,DWORD PTR SS:[ESP+0x20]
* 0044293C 8B4C24 6C MOV ECX,DWORD PTR SS:[ESP+0x6C]
* 00442940 52 PUSH EDX
* 00442941 8B5424 14 MOV EDX,DWORD PTR SS:[ESP+0x14]
* 00442945 50 PUSH EAX
* 00442946 51 PUSH ECX
* 00442947 55 PUSH EBP
* 00442948 52 PUSH EDX
* 00442949 8BCE MOV ECX,ESI
* 0044294B E8 20F8FFFF CALL .00442170
* 00442950 894424 6C MOV DWORD PTR SS:[ESP+0x6C],EAX
* 00442954 85DB TEST EBX,EBX
* 00442956 ^0F85 67FFFFFF JNZ .004428C3
* 0044295C 399E A4000000 CMP DWORD PTR DS:[ESI+0xA4],EBX
* 00442962 0F84 42010000 JE .00442AAA
* 00442968 8BDF MOV EBX,EDI
* 0044296A 33ED XOR EBP,EBP
* 0044296C C74424 1C 010000>MOV DWORD PTR SS:[ESP+0x1C],0x1
* 00442974 0FB603 MOVZX EAX,BYTE PTR DS:[EBX]
* 00442977 50 PUSH EAX
* 00442978 E8 430CFCFF CALL .004035C0
* 0044297D 85C0 TEST EAX,EAX
* 0044297F 74 06 JE SHORT .00442987
* 00442981 45 INC EBP
* 00442982 83C3 02 ADD EBX,0x2
* 00442985 EB 0E JMP SHORT .00442995
* 00442987 803B 7D CMP BYTE PTR DS:[EBX],0x7D
* 0044298A 75 08 JNZ SHORT .00442994
* 0044298C C74424 1C 000000>MOV DWORD PTR SS:[ESP+0x1C],0x0
* 00442994 43 INC EBX
* 00442995 837C24 1C 00 CMP DWORD PTR SS:[ESP+0x1C],0x0
* 0044299A ^75 D8 JNZ SHORT .00442974
* 0044299C 8B9E B0000000 MOV EBX,DWORD PTR DS:[ESI+0xB0]
* 004429A2 8BC3 MOV EAX,EBX
* 004429A4 0FAFC5 IMUL EAX,EBP
* 004429A7 8D4C2D 00 LEA ECX,DWORD PTR SS:[EBP+EBP]
* 004429AB 8B6C24 30 MOV EBP,DWORD PTR SS:[ESP+0x30]
* 004429AF 894C24 34 MOV DWORD PTR SS:[ESP+0x34],ECX
* 004429B3 8B8E 98000000 MOV ECX,DWORD PTR DS:[ESI+0x98]
* 004429B9 2BCD SUB ECX,EBP
* 004429BB C1E0 0A SHL EAX,0xA
* 004429BE C1E1 0A SHL ECX,0xA
* 004429C1 C1E5 0A SHL EBP,0xA
* 004429C4 895C24 54 MOV DWORD PTR SS:[ESP+0x54],EBX
* 004429C8 C74424 1C 010000>MOV DWORD PTR SS:[ESP+0x1C],0x1
* 004429D0 3BC1 CMP EAX,ECX
* 004429D2 76 0B JBE SHORT .004429DF
* 004429D4 2BC1 SUB EAX,ECX
* 004429D6 D1E8 SHR EAX,1
* 004429D8 2BE8 SUB EBP,EAX
* 004429DA C1E3 0A SHL EBX,0xA
* 004429DD EB 21 JMP SHORT .00442A00
* 004429DF 2BC8 SUB ECX,EAX
* 004429E1 33D2 XOR EDX,EDX
* 004429E3 8BC1 MOV EAX,ECX
* 004429E5 F77424 34 DIV DWORD PTR SS:[ESP+0x34]
* 004429E9 8B96 B4000000 MOV EDX,DWORD PTR DS:[ESI+0xB4]
* 004429EF C1E3 09 SHL EBX,0x9
* 004429F2 03E8 ADD EBP,EAX
* 004429F4 03D8 ADD EBX,EAX
* 004429F6 8D1C5A LEA EBX,DWORD PTR DS:[EDX+EBX*2]
* 004429F9 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
* 00442A00 0FB607 MOVZX EAX,BYTE PTR DS:[EDI]
* 00442A03 50 PUSH EAX
* 00442A04 E8 B70BFCFF CALL .004035C0
* 00442A09 85C0 TEST EAX,EAX
* 00442A0B 74 4F JE SHORT .00442A5C
* 00442A0D 66:0FBE4F 01 MOVSX CX,BYTE PTR DS:[EDI+0x1]
* 00442A12 66:0FBE07 MOVSX AX,BYTE PTR DS:[EDI]
* 00442A16 BA FF000000 MOV EDX,0xFF
* 00442A1B 66:23CA AND CX,DX
* 00442A1E 8B5424 38 MOV EDX,DWORD PTR SS:[ESP+0x38]
* 00442A22 66:C1E0 08 SHL AX,0x8
* 00442A26 66:0BC8 OR CX,AX
* 00442A29 66:894C24 42 MOV WORD PTR SS:[ESP+0x42],CX
* 00442A2E 8BCD MOV ECX,EBP
* 00442A30 C1E9 0A SHR ECX,0xA
* 00442A33 894C24 4C MOV DWORD PTR SS:[ESP+0x4C],ECX
* 00442A37 8D4424 28 LEA EAX,DWORD PTR SS:[ESP+0x28]
* 00442A3B 50 PUSH EAX
* 00442A3C 8D4C24 44 LEA ECX,DWORD PTR SS:[ESP+0x44]
* 00442A40 895424 54 MOV DWORD PTR SS:[ESP+0x54],EDX
* 00442A44 8B5424 28 MOV EDX,DWORD PTR SS:[ESP+0x28]
* 00442A48 51 PUSH ECX
* 00442A49 52 PUSH EDX
* 00442A4A 8BCE MOV ECX,ESI
* 00442A4C 83C7 02 ADD EDI,0x2
* 00442A4F E8 5CECFFFF CALL .004416B0
* 00442A54 894424 10 MOV DWORD PTR SS:[ESP+0x10],EAX
* 00442A58 03EB ADD EBP,EBX
* 00442A5A EB 0E JMP SHORT .00442A6A
* 00442A5C 803F 7D CMP BYTE PTR DS:[EDI],0x7D
* 00442A5F 75 08 JNZ SHORT .00442A69
* 00442A61 C74424 1C 000000>MOV DWORD PTR SS:[ESP+0x1C],0x0
* 00442A69 47 INC EDI
* 00442A6A 8B4424 18 MOV EAX,DWORD PTR SS:[ESP+0x18]
* 00442A6E 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+0x20]
* 00442A72 8B5424 2C MOV EDX,DWORD PTR SS:[ESP+0x2C]
* 00442A76 50 PUSH EAX
* 00442A77 8B4424 74 MOV EAX,DWORD PTR SS:[ESP+0x74]
* 00442A7B 51 PUSH ECX
* 00442A7C 8B4C24 18 MOV ECX,DWORD PTR SS:[ESP+0x18]
* 00442A80 52 PUSH EDX
* 00442A81 50 PUSH EAX
* 00442A82 51 PUSH ECX
* 00442A83 8BCE MOV ECX,ESI
* 00442A85 E8 E6F6FFFF CALL .00442170
* 00442A8A 837C24 1C 00 CMP DWORD PTR SS:[ESP+0x1C],0x0
* 00442A8F 894424 2C MOV DWORD PTR SS:[ESP+0x2C],EAX
* 00442A93 ^0F85 67FFFFFF JNZ .00442A00
* 00442A99 8B5424 3C MOV EDX,DWORD PTR SS:[ESP+0x3C]
* 00442A9D 8B6C24 70 MOV EBP,DWORD PTR SS:[ESP+0x70]
* 00442AA1 895424 54 MOV DWORD PTR SS:[ESP+0x54],EDX
* 00442AA5 E9 C1000000 JMP .00442B6B
* 00442AAA BB 01000000 MOV EBX,0x1
* 00442AAF 90 NOP
* 00442AB0 0FB607 MOVZX EAX,BYTE PTR DS:[EDI]
* 00442AB3 50 PUSH EAX
* 00442AB4 E8 070BFCFF CALL .004035C0
* 00442AB9 85C0 TEST EAX,EAX
* 00442ABB 74 05 JE SHORT .00442AC2
* 00442ABD 83C7 02 ADD EDI,0x2
* 00442AC0 EB 08 JMP SHORT .00442ACA
* 00442AC2 803F 7D CMP BYTE PTR DS:[EDI],0x7D
* 00442AC5 75 02 JNZ SHORT .00442AC9
* 00442AC7 33DB XOR EBX,EBX
* 00442AC9 47 INC EDI
* 00442ACA 85DB TEST EBX,EBX
* 00442ACC ^75 E2 JNZ SHORT .00442AB0
* 00442ACE E9 98000000 JMP .00442B6B
* 00442AD3 0FBE47 01 MOVSX EAX,BYTE PTR DS:[EDI+0x1]
* 00442AD7 83C0 9D ADD EAX,-0x63
* 00442ADA 83F8 14 CMP EAX,0x14
* 00442ADD 0F87 88000000 JA .00442B6B
* 00442AE3 0FB688 AC2B4400 MOVZX ECX,BYTE PTR DS:[EAX+0x442BAC]
* 00442AEA FF248D 982B4400 JMP DWORD PTR DS:[ECX*4+0x442B98]
* 00442AF1 8B46 24 MOV EAX,DWORD PTR DS:[ESI+0x24]
* 00442AF4 0346 1C ADD EAX,DWORD PTR DS:[ESI+0x1C]
* 00442AF7 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+0x14]
* 00442AFB 8B56 0C MOV EDX,DWORD PTR DS:[ESI+0xC]
* 00442AFE 0186 9C000000 ADD DWORD PTR DS:[ESI+0x9C],EAX
* 00442B04 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C]
* 00442B0A 41 INC ECX
* 00442B0B 8996 98000000 MOV DWORD PTR DS:[ESI+0x98],EDX
* 00442B11 894C24 14 MOV DWORD PTR SS:[ESP+0x14],ECX
* 00442B15 399C8E B8000000 CMP DWORD PTR DS:[ESI+ECX*4+0xB8],EBX
* 00442B1C 77 08 JA SHORT .00442B26
* 00442B1E 399E AC000000 CMP DWORD PTR DS:[ESI+0xAC],EBX
* 00442B24 74 42 JE SHORT .00442B68
* 00442B26 8B8E B0000000 MOV ECX,DWORD PTR DS:[ESI+0xB0]
* 00442B2C 03C8 ADD ECX,EAX
* 00442B2E 898E 9C000000 MOV DWORD PTR DS:[ESI+0x9C],ECX
* 00442B34 EB 32 JMP SHORT .00442B68
* 00442B36 8BCE MOV ECX,ESI
* 00442B38 E8 03F0FFFF CALL .00441B40
* 00442B3D EB 29 JMP SHORT .00442B68
* 00442B3F 8A47 02 MOV AL,BYTE PTR DS:[EDI+0x2]
* 00442B42 3C 63 CMP AL,0x63
* 00442B44 74 0D JE SHORT .00442B53
* 00442B46 3C 73 CMP AL,0x73
* 00442B48 75 15 JNZ SHORT .00442B5F
* 00442B4A 895C24 20 MOV DWORD PTR SS:[ESP+0x20],EBX
* 00442B4E 83C7 03 ADD EDI,0x3
* 00442B51 EB 18 JMP SHORT .00442B6B
* 00442B53 C74424 20 010000>MOV DWORD PTR SS:[ESP+0x20],0x1
* 00442B5B 895C24 6C MOV DWORD PTR SS:[ESP+0x6C],EBX
* 00442B5F 83C7 03 ADD EDI,0x3
* 00442B62 EB 07 JMP SHORT .00442B6B
* 00442B64 895C24 6C MOV DWORD PTR SS:[ESP+0x6C],EBX
* 00442B68 83C7 02 ADD EDI,0x2
* 00442B6B 803F 00 CMP BYTE PTR DS:[EDI],0x0
* 00442B6E ^0F85 8CFBFFFF JNZ .00442700
* 00442B74 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+0x24]
* 00442B78 8B86 58010000 MOV EAX,DWORD PTR DS:[ESI+0x158]
* 00442B7E 52 PUSH EDX
* 00442B7F 50 PUSH EAX
* 00442B80 FF15 DC335200 CALL DWORD PTR DS:[0x5233DC] ; user32.ReleaseDC
* 00442B86 5F POP EDI
* 00442B87 5E POP ESI
* 00442B88 5D POP EBP
* 00442B89 B8 01000000 MOV EAX,0x1
* 00442B8E 5B POP EBX
* 00442B8F 83C4 58 ADD ESP,0x58
* 00442B92 C2 0800 RETN 0x8
* 00442B95 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
* 00442B98 36:2B4400 F1 SUB EAX,DWORD PTR SS:[EAX+EAX-0xF]
* 00442B9D 2A4400 64 SUB AL,BYTE PTR DS:[EAX+EAX+0x64]
* 00442BA1 2B4400 3F SUB EAX,DWORD PTR DS:[EAX+EAX+0x3F]
* 00442BA5 2B4400 6B SUB EAX,DWORD PTR DS:[EAX+EAX+0x6B]
* 00442BA9 2B4400 00 SUB EAX,DWORD PTR DS:[EAX+EAX]
* 00442BAD 04 04 ADD AL,0x4
* 00442BAF 04 04 ADD AL,0x4
* 00442BB1 04 04 ADD AL,0x4
* 00442BB3 04 04 ADD AL,0x4
* 00442BB5 04 04 ADD AL,0x4
* 00442BB7 010404 ADD DWORD PTR SS:[ESP+EAX],EAX
* 00442BBA 04 04 ADD AL,0x4
* 00442BBC 04 02 ADD AL,0x2
* 00442BBE 04 04 ADD AL,0x4
* 00442BC0 03CC ADD ECX,ESP
* 00442BC2 CC INT3
* 00442BC3 CC INT3
* 00442BC4 CC INT3
* 00442BC5 CC INT3
* 00442BC6 CC INT3
* 00442BC7 CC INT3
* 00442BC8 CC INT3
* 00442BC9 CC INT3
* 00442BCA CC INT3
*/
namespace{
bool attach(const uint8_t pattern[],int patternSize,DWORD startAddress,DWORD stopAddress){
ULONG addr = MemDbg::findBytes(pattern, patternSize, startAddress, stopAddress);
if(addr==0)return false;
addr = MemDbg::findEnclosingAlignedFunction_strict(addr);
if(addr==0)return false;
HookParam hp;
hp.address = addr ;
hp.offset=get_stack(1);
hp.type=EMBED_ABLE|USING_STRING|EMBED_BEFORE_SIMPLE|EMBED_AFTER_NEW|EMBED_DYNA_SJIS;
hp.hook_font=F_GetGlyphOutlineA;
hp.filter_fun=[](void* data, size_t* len, HookParam* hp){
auto text = reinterpret_cast<LPSTR>(data);
std::string str = text;
str = str.substr(0, *len);
std::regex reg1("\\{(.*?)/(.*?)\\}");
std::string result1 = std::regex_replace(str, reg1, "$1");
refactor
2024-03-21 17:57:04 +08:00
return write_string_overwrite(text,len,result1);
Initial commit
2024-02-07 20:59:24 +08:00
};
return NewHook(hp, "EmbedCMVS");
};}
bool attachScenarioHook(ULONG startAddress, ULONG stopAddress)
{
// This pattern is selected by comparing two CMVS games
const uint8_t bytes[] = {
0xb8, 0xcd,0xcc,0xcc,0xcc, // 004512de b8 cdcccccc mov eax,0xcccccccd
0xf7,0xe1, // 004512e3 f7e1 mul ecx
0xc1,0xea, 0x02, // 004512e5 c1ea 02 shr edx,0x2
0xd1,0xe9, // 004512e8 d1e9 shr ecx,1
0x2b,0xca // 004512ea 2bca sub ecx,edx
};
//const uint8_t bytes[] = { //青春&国记的人名&选择支
// 0xb8, 0xcd,0xcc,0xcc,0xcc, // 004512de b8 cdcccccc mov eax,0xcccccccd
// 0xf7,0xe1, // 004512e3 f7e1 mul ecx
// 0xd1,0xe9, // 004512e8 d1e9 shr ecx,1
// 0xc1,0xea, 0x02, // 004512e5 c1ea 02 shr edx,0x2
// 0x2b,0xca // 004512ea 2bca sub ecx,edx
//};
const uint8_t bytes_kunado_kukoki[] = {
0xf7,0xe1,
0x8b,0x85,0xd8,0xfd,0xff,0xff,
0xd1,0xe9,
0xc1,0xea, 0x02,
0x2b,0xca
};
return attach(bytes, sizeof(bytes), startAddress, stopAddress)||attach(bytes_kunado_kukoki, sizeof(bytes_kunado_kukoki), startAddress, stopAddress);
}
/**
* FIXME: This function exists but is not called for クロノクロック when painting backlog.
*
* Sample bake: ハピメア
*
* Backlog function, found by tracking all callers of ::GetDC:
*
* 0044ACAE CC INT3
* 0044ACAF CC INT3
* 0044ACB0 55 PUSH EBP
* 0044ACB1 8BEC MOV EBP,ESP
* 0044ACB3 83EC 30 SUB ESP,0x30
* 0044ACB6 56 PUSH ESI
* 0044ACB7 8BF1 MOV ESI,ECX
* 0044ACB9 8B86 58010000 MOV EAX,DWORD PTR DS:[ESI+0x158]
* 0044ACBF 57 PUSH EDI
* 0044ACC0 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+0x8]
* 0044ACC3 50 PUSH EAX
* 0044ACC4 C745 08 00000000 MOV DWORD PTR SS:[EBP+0x8],0x0
* 0044ACCB FF15 D4F35300 CALL DWORD PTR DS:[0x53F3D4] ; user32.GetDC
* 0044ACD1 68 80000000 PUSH 0x80
* 0044ACD6 8D8E B8000000 LEA ECX,DWORD PTR DS:[ESI+0xB8]
* 0044ACDC 6A 00 PUSH 0x0
* 0044ACDE 51 PUSH ECX
* 0044ACDF 8945 FC MOV DWORD PTR SS:[EBP-0x4],EAX
* 0044ACE2 E8 F9870D00 CALL .005234E0
* 0044ACE7 8B46 7C MOV EAX,DWORD PTR DS:[ESI+0x7C]
* 0044ACEA 8B4E 70 MOV ECX,DWORD PTR DS:[ESI+0x70]
* 0044ACED 8945 F4 MOV DWORD PTR SS:[EBP-0xC],EAX
* 0044ACF0 8B46 1C MOV EAX,DWORD PTR DS:[ESI+0x1C]
* 0044ACF3 BA 28000000 MOV EDX,0x28
* 0044ACF8 8945 E4 MOV DWORD PTR SS:[EBP-0x1C],EAX
* 0044ACFB 8B86 80000000 MOV EAX,DWORD PTR DS:[ESI+0x80]
* 0044AD01 66:8955 D0 MOV WORD PTR SS:[EBP-0x30],DX
* 0044AD05 8B56 74 MOV EDX,DWORD PTR DS:[ESI+0x74]
* 0044AD08 83C4 0C ADD ESP,0xC
* 0044AD0B 48 DEC EAX
* 0044AD0C 894D E8 MOV DWORD PTR SS:[EBP-0x18],ECX
* 0044AD0F 8955 EC MOV DWORD PTR SS:[EBP-0x14],EDX
* 0044AD12 C745 D8 00000000 MOV DWORD PTR SS:[EBP-0x28],0x0
* 0044AD19 74 18 JE SHORT .0044AD33
* 0044AD1B 48 DEC EAX
* 0044AD1C 74 0C JE SHORT .0044AD2A
* 0044AD1E 48 DEC EAX
* 0044AD1F 75 19 JNZ SHORT .0044AD3A
* 0044AD21 C745 D8 03000000 MOV DWORD PTR SS:[EBP-0x28],0x3
* 0044AD28 EB 10 JMP SHORT .0044AD3A
* 0044AD2A C745 D8 02000000 MOV DWORD PTR SS:[EBP-0x28],0x2
* 0044AD31 EB 07 JMP SHORT .0044AD3A
* 0044AD33 C745 D8 01000000 MOV DWORD PTR SS:[EBP-0x28],0x1
* 0044AD3A 8B45 0C MOV EAX,DWORD PTR SS:[EBP+0xC]
* 0044AD3D 85C0 TEST EAX,EAX
* 0044AD3F 74 08 JE SHORT .0044AD49
* 0044AD41 8B48 0C MOV ECX,DWORD PTR DS:[EAX+0xC]
* 0044AD44 894D F0 MOV DWORD PTR SS:[EBP-0x10],ECX
* 0044AD47 EB 06 JMP SHORT .0044AD4F
* 0044AD49 8B56 78 MOV EDX,DWORD PTR DS:[ESI+0x78]
* 0044AD4C 8955 F0 MOV DWORD PTR SS:[EBP-0x10],EDX
* 0044AD4F 803F 00 CMP BYTE PTR DS:[EDI],0x0
* 0044AD52 0F84 65020000 JE .0044AFBD
* 0044AD58 53 PUSH EBX
* 0044AD59 8DA424 00000000 LEA ESP,DWORD PTR SS:[ESP]
* 0044AD60 0FB607 MOVZX EAX,BYTE PTR DS:[EDI]
* 0044AD63 3C 5C CMP AL,0x5C
* 0044AD65 0F84 16020000 JE .0044AF81
* 0044AD6B 3C 7B CMP AL,0x7B
* 0044AD6D 0F84 63010000 JE .0044AED6
* 0044AD73 50 PUSH EAX
* 0044AD74 E8 778DFBFF CALL .00403AF0
* 0044AD79 85C0 TEST EAX,EAX
* 0044AD7B 0F84 AC000000 JE .0044AE2D
* 0044AD81 66:0FBE47 01 MOVSX AX,BYTE PTR DS:[EDI+0x1]
* 0044AD86 66:0FBE17 MOVSX DX,BYTE PTR DS:[EDI]
* 0044AD8A B9 FF000000 MOV ECX,0xFF
* 0044AD8F 66:23C1 AND AX,CX
* 0044AD92 66:C1E2 08 SHL DX,0x8
* 0044AD96 66:0BC2 OR AX,DX
* 0044AD99 B9 4A810000 MOV ECX,0x814A
* 0044AD9E 83C7 02 ADD EDI,0x2
* 0044ADA1 33DB XOR EBX,EBX
* 0044ADA3 66:8945 D2 MOV WORD PTR SS:[EBP-0x2E],AX
* 0044ADA7 66:3BC1 CMP AX,CX
* 0044ADAA 75 05 JNZ SHORT .0044ADB1
* 0044ADAC BB 01000000 MOV EBX,0x1
* 0044ADB1 8B45 D2 MOV EAX,DWORD PTR SS:[EBP-0x2E]
* 0044ADB4 8D55 08 LEA EDX,DWORD PTR SS:[EBP+0x8]
* 0044ADB7 52 PUSH EDX
* 0044ADB8 50 PUSH EAX
* 0044ADB9 6A 00 PUSH 0x0
* 0044ADBB 8BCE MOV ECX,ESI
* 0044ADBD E8 FEFCFFFF CALL .0044AAC0
* 0044ADC2 8B8E 98000000 MOV ECX,DWORD PTR DS:[ESI+0x98]
* 0044ADC8 8B96 9C000000 MOV EDX,DWORD PTR DS:[ESI+0x9C]
* 0044ADCE 894D DC MOV DWORD PTR SS:[EBP-0x24],ECX
* 0044ADD1 8955 E0 MOV DWORD PTR SS:[EBP-0x20],EDX
* 0044ADD4 85DB TEST EBX,EBX
* 0044ADD6 74 0E JE SHORT .0044ADE6
* 0044ADD8 B8 CDCCCCCC MOV EAX,0xCCCCCCCD
* 0044ADDD F766 1C MUL DWORD PTR DS:[ESI+0x1C]
* 0044ADE0 C1EA 02 SHR EDX,0x2
* 0044ADE3 2955 DC SUB DWORD PTR SS:[EBP-0x24],EDX
* 0044ADE6 8B55 FC MOV EDX,DWORD PTR SS:[EBP-0x4]
* 0044ADE9 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-0x8]
* 0044ADEC 50 PUSH EAX
* 0044ADED 8D4D D0 LEA ECX,DWORD PTR SS:[EBP-0x30]
* 0044ADF0 51 PUSH ECX
* 0044ADF1 52 PUSH EDX
* 0044ADF2 8BCE MOV ECX,ESI
* 0044ADF4 E8 87F2FFFF CALL .0044A080
* 0044ADF9 85DB TEST EBX,EBX
* 0044ADFB 75 11 JNZ SHORT .0044AE0E
* 0044ADFD 8B46 20 MOV EAX,DWORD PTR DS:[ESI+0x20]
* 0044AE00 0346 1C ADD EAX,DWORD PTR DS:[ESI+0x1C]
* 0044AE03 0186 98000000 ADD DWORD PTR DS:[ESI+0x98],EAX
* 0044AE09 E9 A5010000 JMP .0044AFB3
* 0044AE0E 8B4E 1C MOV ECX,DWORD PTR DS:[ESI+0x1C]
* 0044AE11 B8 CDCCCCCC MOV EAX,0xCCCCCCCD
* 0044AE16 F7E1 MUL ECX
* 0044AE18 D1E9 SHR ECX,1
* 0044AE1A C1EA 02 SHR EDX,0x2
* 0044AE1D 2BCA SUB ECX,EDX
* 0044AE1F 034E 20 ADD ECX,DWORD PTR DS:[ESI+0x20]
* 0044AE22 018E 98000000 ADD DWORD PTR DS:[ESI+0x98],ECX
* 0044AE28 E9 86010000 JMP .0044AFB3
* 0044AE2D 66:0FBE0F MOVSX CX,BYTE PTR DS:[EDI]
* 0044AE31 8B56 14 MOV EDX,DWORD PTR DS:[ESI+0x14]
* 0044AE34 2B56 20 SUB EDX,DWORD PTR DS:[ESI+0x20]
* 0044AE37 8B46 1C MOV EAX,DWORD PTR DS:[ESI+0x1C]
* 0044AE3A 66:894D D2 MOV WORD PTR SS:[EBP-0x2E],CX
* 0044AE3E 8B4E 0C MOV ECX,DWORD PTR DS:[ESI+0xC]
* 0044AE41 2BD0 SUB EDX,EAX
* 0044AE43 03D1 ADD EDX,ECX
* 0044AE45 47 INC EDI
* 0044AE46 3996 98000000 CMP DWORD PTR DS:[ESI+0x98],EDX
* 0044AE4C 72 37 JB SHORT .0044AE85
* 0044AE4E 8B55 08 MOV EDX,DWORD PTR SS:[EBP+0x8]
* 0044AE51 42 INC EDX
* 0044AE52 83BC96 B8000000 >CMP DWORD PTR DS:[ESI+EDX*4+0xB8],0x0
* 0044AE5A 8955 08 MOV DWORD PTR SS:[EBP+0x8],EDX
* 0044AE5D 77 09 JA SHORT .0044AE68
* 0044AE5F 83BE AC000000 00 CMP DWORD PTR DS:[ESI+0xAC],0x0
* 0044AE66 74 0C JE SHORT .0044AE74
* 0044AE68 8B96 B0000000 MOV EDX,DWORD PTR DS:[ESI+0xB0]
* 0044AE6E 0196 9C000000 ADD DWORD PTR DS:[ESI+0x9C],EDX
* 0044AE74 898E 98000000 MOV DWORD PTR DS:[ESI+0x98],ECX
* 0044AE7A 8B4E 24 MOV ECX,DWORD PTR DS:[ESI+0x24]
* 0044AE7D 03C8 ADD ECX,EAX
* 0044AE7F 018E 9C000000 ADD DWORD PTR DS:[ESI+0x9C],ECX
* 0044AE85 8B96 98000000 MOV EDX,DWORD PTR DS:[ESI+0x98]
* 0044AE8B 8B86 9C000000 MOV EAX,DWORD PTR DS:[ESI+0x9C]
* 0044AE91 8D4D F8 LEA ECX,DWORD PTR SS:[EBP-0x8]
* 0044AE94 51 PUSH ECX
* 0044AE95 8955 DC MOV DWORD PTR SS:[EBP-0x24],EDX
* 0044AE98 8D55 D0 LEA EDX,DWORD PTR SS:[EBP-0x30]
* 0044AE9B 8945 E0 MOV DWORD PTR SS:[EBP-0x20],EAX
* 0044AE9E 8B45 FC MOV EAX,DWORD PTR SS:[EBP-0x4]
* 0044AEA1 52 PUSH EDX
* 0044AEA2 50 PUSH EAX
* 0044AEA3 8BCE MOV ECX,ESI
* 0044AEA5 E8 D6F1FFFF CALL .0044A080
* 0044AEAA 8B46 1C MOV EAX,DWORD PTR DS:[ESI+0x1C]
* 0044AEAD 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-0x8]
* 0044AEB0 D1E8 SHR EAX,1
* 0044AEB2 3BC8 CMP ECX,EAX
* 0044AEB4 77 10 JA SHORT .0044AEC6
* 0044AEB6 8B4E 20 MOV ECX,DWORD PTR DS:[ESI+0x20]
* 0044AEB9 03C8 ADD ECX,EAX
* 0044AEBB 018E 98000000 ADD DWORD PTR DS:[ESI+0x98],ECX
* 0044AEC1 E9 ED000000 JMP .0044AFB3
* 0044AEC6 8B56 20 MOV EDX,DWORD PTR DS:[ESI+0x20]
* 0044AEC9 03D1 ADD EDX,ECX
* 0044AECB 0196 98000000 ADD DWORD PTR DS:[ESI+0x98],EDX
* 0044AED1 E9 DD000000 JMP .0044AFB3
* 0044AED6 47 INC EDI
* 0044AED7 BB 01000000 MOV EBX,0x1
* 0044AEDC 8D6424 00 LEA ESP,DWORD PTR SS:[ESP]
* 0044AEE0 0FB607 MOVZX EAX,BYTE PTR DS:[EDI]
* 0044AEE3 50 PUSH EAX
* 0044AEE4 E8 078CFBFF CALL .00403AF0
* 0044AEE9 85C0 TEST EAX,EAX
* 0044AEEB 74 63 JE SHORT .0044AF50
* 0044AEED 66:0FBE4F 01 MOVSX CX,BYTE PTR DS:[EDI+0x1]
* 0044AEF2 66:0FBE07 MOVSX AX,BYTE PTR DS:[EDI]
* 0044AEF6 BA FF000000 MOV EDX,0xFF
* 0044AEFB 66:23CA AND CX,DX
* 0044AEFE 66:C1E0 08 SHL AX,0x8
* 0044AF02 66:0BC8 OR CX,AX
* 0044AF05 66:894D D2 MOV WORD PTR SS:[EBP-0x2E],CX
* 0044AF09 8B55 D2 MOV EDX,DWORD PTR SS:[EBP-0x2E]
* 0044AF0C 8D4D 08 LEA ECX,DWORD PTR SS:[EBP+0x8]
* 0044AF0F 51 PUSH ECX
* 0044AF10 52 PUSH EDX
* 0044AF11 6A 00 PUSH 0x0
* 0044AF13 8BCE MOV ECX,ESI
* 0044AF15 83C7 02 ADD EDI,0x2
* 0044AF18 E8 A3FBFFFF CALL .0044AAC0
* 0044AF1D 8B86 98000000 MOV EAX,DWORD PTR DS:[ESI+0x98]
* 0044AF23 8B8E 9C000000 MOV ECX,DWORD PTR DS:[ESI+0x9C]
* 0044AF29 8D55 F8 LEA EDX,DWORD PTR SS:[EBP-0x8]
* 0044AF2C 8945 DC MOV DWORD PTR SS:[EBP-0x24],EAX
* 0044AF2F 52 PUSH EDX
* 0044AF30 894D E0 MOV DWORD PTR SS:[EBP-0x20],ECX
* 0044AF33 8B4D FC MOV ECX,DWORD PTR SS:[EBP-0x4]
* 0044AF36 8D45 D0 LEA EAX,DWORD PTR SS:[EBP-0x30]
* 0044AF39 50 PUSH EAX
* 0044AF3A 51 PUSH ECX
* 0044AF3B 8BCE MOV ECX,ESI
* 0044AF3D E8 3EF1FFFF CALL .0044A080
* 0044AF42 8B56 20 MOV EDX,DWORD PTR DS:[ESI+0x20]
* 0044AF45 0356 1C ADD EDX,DWORD PTR DS:[ESI+0x1C]
* 0044AF48 0196 98000000 ADD DWORD PTR DS:[ESI+0x98],EDX
* 0044AF4E EB 08 JMP SHORT .0044AF58
* 0044AF50 803F 2F CMP BYTE PTR DS:[EDI],0x2F
* 0044AF53 75 02 JNZ SHORT .0044AF57
* 0044AF55 33DB XOR EBX,EBX
* 0044AF57 47 INC EDI
* 0044AF58 85DB TEST EBX,EBX
* 0044AF5A ^75 84 JNZ SHORT .0044AEE0
* 0044AF5C BB 01000000 MOV EBX,0x1
* 0044AF61 0FB607 MOVZX EAX,BYTE PTR DS:[EDI]
* 0044AF64 50 PUSH EAX
* 0044AF65 E8 868BFBFF CALL .00403AF0
* 0044AF6A 85C0 TEST EAX,EAX
* 0044AF6C 74 05 JE SHORT .0044AF73
* 0044AF6E 83C7 02 ADD EDI,0x2
* 0044AF71 EB 08 JMP SHORT .0044AF7B
* 0044AF73 803F 7D CMP BYTE PTR DS:[EDI],0x7D
* 0044AF76 75 02 JNZ SHORT .0044AF7A
* 0044AF78 33DB XOR EBX,EBX
* 0044AF7A 47 INC EDI
* 0044AF7B 85DB TEST EBX,EBX
* 0044AF7D ^75 E2 JNZ SHORT .0044AF61
* 0044AF7F EB 32 JMP SHORT .0044AFB3
* 0044AF81 0FBE47 01 MOVSX EAX,BYTE PTR DS:[EDI+0x1]
* 0044AF85 83C0 9D ADD EAX,-0x63
* 0044AF88 83F8 14 CMP EAX,0x14
* 0044AF8B 77 26 JA SHORT .0044AFB3
* 0044AF8D 0FB688 F0AF4400 MOVZX ECX,BYTE PTR DS:[EAX+0x44AFF0]
* 0044AF94 FF248D E0AF4400 JMP DWORD PTR DS:[ECX*4+0x44AFE0]
* 0044AF9B 8B46 24 MOV EAX,DWORD PTR DS:[ESI+0x24]
* 0044AF9E 0346 1C ADD EAX,DWORD PTR DS:[ESI+0x1C]
* 0044AFA1 8B56 0C MOV EDX,DWORD PTR DS:[ESI+0xC]
* 0044AFA4 0186 9C000000 ADD DWORD PTR DS:[ESI+0x9C],EAX
* 0044AFAA 8996 98000000 MOV DWORD PTR DS:[ESI+0x98],EDX
* 0044AFB0 83C7 02 ADD EDI,0x2
* 0044AFB3 803F 00 CMP BYTE PTR DS:[EDI],0x0
* 0044AFB6 ^0F85 A4FDFFFF JNZ .0044AD60
* 0044AFBC 5B POP EBX
* 0044AFBD 8B4D FC MOV ECX,DWORD PTR SS:[EBP-0x4]
* 0044AFC0 8B96 58010000 MOV EDX,DWORD PTR DS:[ESI+0x158]
* 0044AFC6 51 PUSH ECX
* 0044AFC7 52 PUSH EDX
* 0044AFC8 FF15 D8F35300 CALL DWORD PTR DS:[0x53F3D8] ; user32.ReleaseDC
* 0044AFCE 5F POP EDI
* 0044AFCF B8 01000000 MOV EAX,0x1
* 0044AFD4 5E POP ESI
* 0044AFD5 8BE5 MOV ESP,EBP
* 0044AFD7 5D POP EBP
* 0044AFD8 C2 0800 RETN 0x8
* 0044AFDB 83C7 03 ADD EDI,0x3
* 0044AFDE ^EB D3 JMP SHORT .0044AFB3
* 0044AFE0 B0 AF MOV AL,0xAF
* 0044AFE2 44 INC ESP
* 0044AFE3 009B AF4400DB ADD BYTE PTR DS:[EBX+0xDB0044AF],BL
* 0044AFE9 AF SCAS DWORD PTR ES:[EDI]
* 0044AFEA 44 INC ESP
* 0044AFEB 00B3 AF440000 ADD BYTE PTR DS:[EBX+0x44AF],DH
* 0044AFF1 0303 ADD EAX,DWORD PTR DS:[EBX]
* 0044AFF3 0303 ADD EAX,DWORD PTR DS:[EBX]
* 0044AFF5 0303 ADD EAX,DWORD PTR DS:[EBX]
* 0044AFF7 0303 ADD EAX,DWORD PTR DS:[EBX]
* 0044AFF9 0303 ADD EAX,DWORD PTR DS:[EBX]
* 0044AFFB 0103 ADD DWORD PTR DS:[EBX],EAX
* 0044AFFD 0303 ADD EAX,DWORD PTR DS:[EBX]
* 0044AFFF 0303 ADD EAX,DWORD PTR DS:[EBX]
* 0044B001 0003 ADD BYTE PTR DS:[EBX],AL
* 0044B003 0302 ADD EAX,DWORD PTR DS:[EDX]
* 0044B005 CC INT3
* 0044B006 CC INT3
* 0044B007 CC INT3
* 0044B008 CC INT3
*/
bool attachHistoryHook(ULONG startAddress, ULONG stopAddress)
{
const uint8_t bytes[] = {
0xb8, 0xcd,0xcc,0xcc,0xcc, // 0044ae11 b8 cdcccccc mov eax,0xcccccccd
0xf7,0xe1, // 0044ae16 f7e1 mul ecx
0xd1,0xe9, // 0044ae18 d1e9 shr ecx,1
0xc1,0xea, 0x02, // 0044ae1a c1ea 02 shr edx,0x2
0x2b,0xca // 0044ae1d 2bca sub ecx,edx
};
return attach(bytes, sizeof(bytes), startAddress, stopAddress);
}
bool CMVS::attach_function() {
bool embed=attachScenarioHook(processStartAddress,processStopAddress);
if(embed)attachHistoryHook(processStartAddress,processStopAddress);
return InsertCMVSHook()||embed;
}
Reference in New Issue Copy Permalink