0 "Gov phase" 1 1 "[$ASM] Food and Coins" C08000 Auto Assembler Script [ENABLE] aobscanmodule(GET_FOOD,DW9Emp.exe,0F BE 48 64 41 8B D5) alloc(newmem,$1000,GET_FOOD) label(code) label(return) newmem: db C7 40 30 7F 96 98 00 //C db C7 40 34 7F 96 98 00 //F code: movsx ecx,byte ptr [rax+64] mov edx,r13d jmp return GET_FOOD: jmp newmem nop 2 return: registersymbol(GET_FOOD) [DISABLE] GET_FOOD: db 0F BE 48 64 41 8B D5 unregistersymbol(GET_FOOD) dealloc(newmem) { Function dump of "DW9Emp.exe+1007C08" ~ Function header aob : "5B C3 CC CC CC 48 8B C4 55 41 54" ~ // [0000/0] DW9Emp.exe+1007000 -- (3) 48 8B C4 -- mov rax,rsp // [0003/3] DW9Emp.exe+1007003 -- (1) 55 -- push rbp // [0004/4] DW9Emp.exe+1007004 -- (2) 41 54 -- push r12 // [0006/6] DW9Emp.exe+1007006 -- (2) 41 55 -- push r13 // [0008/8] DW9Emp.exe+1007008 -- (2) 41 56 -- push r14 // [000A/10] DW9Emp.exe+100700A -- (2) 41 57 -- push r15 // [000C/12] DW9Emp.exe+100700C -- (7) 48 8D A8 98FEFFFF -- lea rbp,[rax-00000168] // [0013/19] DW9Emp.exe+1007013 -- (7) 48 81 EC 40020000 -- sub rsp,00000240 // [001A/26] DW9Emp.exe+100701A -- (8) 48 C7 45 80 FEFFFFFF -- mov qword ptr [rbp-80],FFFFFFFFFFFFFFFE // [0022/34] DW9Emp.exe+1007022 -- (4) 48 89 58 10 -- mov [rax+10],rbx // [0026/38] DW9Emp.exe+1007026 -- (4) 48 89 70 18 -- mov [rax+18],rsi // [002A/42] DW9Emp.exe+100702A -- (4) 48 89 78 20 -- mov [rax+20],rdi // [002E/46] DW9Emp.exe+100702E -- (4) 0F29 70 C8 -- movaps [rax-38],xmm6 // [0032/50] DW9Emp.exe+1007032 -- (4) 0F29 78 B8 -- movaps [rax-48],xmm7 // [0036/54] DW9Emp.exe+1007036 -- (5) 44 0F29 40 A8 -- movaps [rax-58],xmm8 // [003B/59] DW9Emp.exe+100703B -- (7) 48 8B 05 364D2101 -- mov rax,[DW9Emp.exe+221BD78] -- [DA76C8BA] // [0042/66] DW9Emp.exe+1007042 -- (3) 48 33 C4 -- xor rax,rsp // [0045/69] DW9Emp.exe+1007045 -- (7) 48 89 85 00010000 -- mov [rbp+00000100],rax // [004C/76] DW9Emp.exe+100704C -- (3) 48 8B F1 -- mov rsi,rcx // [004F/79] DW9Emp.exe+100704F -- (7) 44 8B 05 66669A01 -- mov r8d,[DW9Emp.exe+29AD6BC] -- [00000001] // [0056/86] DW9Emp.exe+1007056 -- (5) B8 01000000 -- mov eax,00000001 // [005B/91] DW9Emp.exe+100705B -- (4) 41 83 F8 09 -- cmp r8d,09 // ... // [0B8D/2957] DW9Emp.exe+1007B8D -- (3) 0F46 C2 -- cmovbe eax,edx // [0B90/2960] DW9Emp.exe+1007B90 -- (2) 48 98 -- cdqe // [0B92/2962] DW9Emp.exe+1007B92 -- (8) 49 8B 84 C6 50D79601 -- mov rax,[r14+rax*8+0196D750] // [0B9A/2970] DW9Emp.exe+1007B9A -- (3) 48 85 C0 -- test rax,rax // [0B9D/2973] DW9Emp.exe+1007B9D -- (8) 48 0F44 05 B35B9600 -- cmove rax,[DW9Emp.exe+196D758] -- [55ED2220] // [0BA5/2981] DW9Emp.exe+1007BA5 -- (7) 48 8B 80 78520100 -- mov rax,[rax+00015278] // [0BAC/2988] DW9Emp.exe+1007BAC -- (5) 48 89 44 24 40 -- mov [rsp+40],rax // [0BB1/2993] DW9Emp.exe+1007BB1 -- (5) 44 89 6C 24 20 -- mov [rsp+20],r13d // [0BB6/2998] DW9Emp.exe+1007BB6 -- (8) F3 0F10 1D AA11F800 -- movss xmm3,[DW9Emp.exe+1F88D68] -- [(float)1.0000] // [0BBE/3006] DW9Emp.exe+1007BBE -- (5) 4C 8D 44 24 48 -- lea r8,[rsp+48] // [0BC3/3011] DW9Emp.exe+1007BC3 -- (3) 41 8B D1 -- mov edx,r9d // [0BC6/3014] DW9Emp.exe+1007BC6 -- (4) 48 8D 4D 90 -- lea rcx,[rbp-70] // [0BCA/3018] DW9Emp.exe+1007BCA -- (5) E8 F149FDFF -- call DW9Emp.exe+FDC5C0 // [0BCF/3023] DW9Emp.exe+1007BCF -- (4) 48 89 5D C0 -- mov [rbp-40],rbx // [0BD3/3027] DW9Emp.exe+1007BD3 -- (6) F3 0F10 4C 24 4C -- movss xmm1,[rsp+4C] // [0BD9/3033] DW9Emp.exe+1007BD9 -- (6) F3 0F58 4C 24 44 -- addss xmm1,[rsp+44] // [0BDF/3039] DW9Emp.exe+1007BDF -- (6) F3 0F10 44 24 48 -- movss xmm0,[rsp+48] // [0BE5/3045] DW9Emp.exe+1007BE5 -- (6) F3 0F58 44 24 40 -- addss xmm0,[rsp+40] // [0BEB/3051] DW9Emp.exe+1007BEB -- (6) F3 0F11 44 24 40 -- movss [rsp+40],xmm0 // [0BF1/3057] DW9Emp.exe+1007BF1 -- (6) F3 0F11 4C 24 44 -- movss [rsp+44],xmm1 // [0BF7/3063] DW9Emp.exe+1007BF7 -- (5) 48 8B 44 24 40 -- mov rax,[rsp+40] // [0BFC/3068] DW9Emp.exe+1007BFC -- (4) 48 89 45 C8 -- mov [rbp-38],rax // [0C00/3072] DW9Emp.exe+1007C00 -- (3) 8B 4E 58 -- mov ecx,[rsi+58] // [0C03/3075] DW9Emp.exe+1007C03 -- (5) E8 48AE66FF -- call DW9Emp.exe+672A50 // [0C08/3080] DW9Emp.exe+1007C08 -- (4) 0FBE 48 64 -- movsx ecx,byte ptr [rax+64] // [0C0C/3084] DW9Emp.exe+1007C0C -- (3) 41 8B D5 -- mov edx,r13d // [0C0F/3087] DW9Emp.exe+1007C0F -- (3) 83 F9 18 -- cmp ecx,18 // [0C12/3090] DW9Emp.exe+1007C12 -- (3) 0F46 D1 -- cmovbe edx,ecx // [0C15/3093] DW9Emp.exe+1007C15 -- (5) 48 8D 4C 24 48 -- lea rcx,[rsp+48] // [0C1A/3098] DW9Emp.exe+1007C1A -- (5) E8 A151FDFF -- call DW9Emp.exe+FDCDC0 // [0C1F/3103] DW9Emp.exe+1007C1F -- (2) 8B 08 -- mov ecx,[rax] // [0C21/3105] DW9Emp.exe+1007C21 -- (3) 89 4D B8 -- mov [rbp-48],ecx // [0C24/3108] DW9Emp.exe+1007C24 -- (4) 48 8D 45 90 -- lea rax,[rbp-70] // [0C28/3112] DW9Emp.exe+1007C28 -- (2) A8 07 -- test al,07 // [0C2A/3114] DW9Emp.exe+1007C2A -- (6) 0F85 D3000000 -- jne DW9Emp.exe+1007D03 // [0C30/3120] DW9Emp.exe+1007C30 -- (10) 81 3D B67E3F01 FF0F0000 -- cmp [DW9Emp.exe+23FFAF0],00000FFF // [0C3A/3130] DW9Emp.exe+1007C3A -- (6) 0F8D C3000000 -- jnl DW9Emp.exe+1007D03 // [0C40/3136] DW9Emp.exe+1007C40 -- (7) 48 8B 15 D17E3F01 -- mov rdx,[DW9Emp.exe+23FFB18] -- [000F8000] // [0C47/3143] DW9Emp.exe+1007C47 -- (3) 48 8B C2 -- mov rax,rdx // [0C4A/3146] DW9Emp.exe+1007C4A -- (7) 48 8B 0D BF7E3F01 -- mov rcx,[DW9Emp.exe+23FFB10] -- [00000000] // [0C51/3153] DW9Emp.exe+1007C51 -- (3) 48 2B C1 -- sub rax,rcx // [0C54/3156] DW9Emp.exe+1007C54 -- (4) 48 83 F8 48 -- cmp rax,48 // [0C58/3160] DW9Emp.exe+1007C58 -- (2) 73 1A -- jae DW9Emp.exe+1007C74 // [0C5A/3162] DW9Emp.exe+1007C5A -- (7) 48 8D 0D 3F7E3E01 -- lea rcx,[DW9Emp.exe+23EFAA0] -- [C388DEE0] // [0C61/3169] DW9Emp.exe+1007C61 -- (5) E8 AA750C00 -- call DW9Emp.exe+10CF210 // ... 2 "[$ASM] Increase time till next council" C08000 Auto Assembler Script // what has started as single unique access finished as not (in the long run). [ENABLE] aobscanmodule(GET_CO_DATE,DW9Emp.exe,48 89 7C 24 20 41 54 41 56 41 57 48 83 EC 40 44 8B FA 4C) alloc(newmem,$1000,GET_CO_DATE) label(originalcode returnhere exit q t u check_value known allow_dec) registersymbol(GET_CO_DATE check_value known allow_dec) newmem: cmp eax,-01 jne originalcode cmp r10,765F0000 jle originalcode cmp r9,1 jne originalcode cmp [rsp+20],0 je originalcode cmp byte ptr [check_value],0001 je q jmp t q: cmp [r10+18],#0 jne u jmp originalcode u: mov byte ptr [known],0000 t: cmp byte ptr [known],0001 je @f mov [r10+18],#12 mov byte ptr [known],0001 mov byte ptr [check_value],0000 jmp originalcode @@: cmp byte ptr [allow_dec],0001 je @f mov [r10+18],#12 jmp originalcode @@: cmp [r10+18],#0 jne @f mov byte ptr [check_value],0001 originalcode: mov [rsp+20],rdi exit: jmp returnhere known: db 00 check_value: db 00 allow_dec: db 01 GET_CO_DATE: jmp newmem returnhere: [DISABLE] GET_CO_DATE: db 48 89 7C 24 20 unregistersymbol(GET_CO_DATE) dealloc(newmem) { Function dump of "DW9Emp.exe+746DEF" ~ Function header aob : "20 5B C3 CC CC CC CC CC CC CC CC CC CC CC CC CC 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 48 89 7C 24 20 41 54" ~ // [0000/0] DW9Emp.exe+746DE0 -- (5) 48 89 5C 24 08 -- mov [rsp+08],rbx // [0005/5] DW9Emp.exe+746DE5 -- (5) 48 89 6C 24 10 -- mov [rsp+10],rbp // [000A/10] DW9Emp.exe+746DEA -- (5) 48 89 74 24 18 -- mov [rsp+18],rsi // [000F/15] DW9Emp.exe+746DEF -- (5) 48 89 7C 24 20 -- mov [rsp+20],rdi // [0014/20] DW9Emp.exe+746DF4 -- (2) 41 54 -- push r12 // [0016/22] DW9Emp.exe+746DF6 -- (2) 41 56 -- push r14 // [0018/24] DW9Emp.exe+746DF8 -- (2) 41 57 -- push r15 // [001A/26] DW9Emp.exe+746DFA -- (4) 48 83 EC 40 -- sub rsp,40 // ... // [02BB/699] DW9Emp.exe+74709B -- (4) 48 83 C4 40 -- add rsp,40 // [02BF/703] DW9Emp.exe+74709F -- (2) 41 5F -- pop r15 // [02C1/705] DW9Emp.exe+7470A1 -- (2) 41 5E -- pop r14 // [02C3/707] DW9Emp.exe+7470A3 -- (2) 41 5C -- pop r12 // [02C5/709] DW9Emp.exe+7470A5 -- (1) C3 -- ret } 3 "Soc phase" 1 4 "[$ASM] Inf power points (interaction)" C08000 Auto Assembler Script [ENABLE] aobscanmodule(GET_POWER,DW9Emp.exe,0F B6 48 01 85 C9 0F 45 F9) registersymbol(GET_POWER) GET_POWER: db 89 48 01 90 [DISABLE] GET_POWER: db 0F B6 48 01 db 85 C9 unregistersymbol(GET_POWER) { Function dump of "DW9Emp.exe+106C9C5" ~ Function header aob : "48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B F1 E8 89" ~ // [0000/0] DW9Emp.exe+106C850 -- (5) 48 89 5C 24 08 -- mov [rsp+08],rbx // [0005/5] DW9Emp.exe+106C855 -- (5) 48 89 74 24 10 -- mov [rsp+10],rsi // [000A/10] DW9Emp.exe+106C85A -- (1) 57 -- push rdi // [000B/11] DW9Emp.exe+106C85B -- (4) 48 83 EC 20 -- sub rsp,20 // [000F/15] DW9Emp.exe+106C85F -- (3) 48 8B F1 -- mov rsi,rcx // [0012/18] DW9Emp.exe+106C862 -- (5) E8 895160FF -- call DW9Emp.exe+6719F0 // [0017/23] DW9Emp.exe+106C867 -- (5) BB FFFFFFFF -- mov ebx,FFFFFFFF // [001C/28] DW9Emp.exe+106C86C -- (3) 0FBF 10 -- movsx edx,word ptr [rax] // [001F/31] DW9Emp.exe+106C86F -- (2) 8B C3 -- mov eax,ebx // [0021/33] DW9Emp.exe+106C871 -- (6) 81 FA 6B070000 -- cmp edx,0000076B // [0027/39] DW9Emp.exe+106C877 -- (3) 0F46 C2 -- cmovbe eax,edx // [002A/42] DW9Emp.exe+106C87A -- (3) 89 46 50 -- mov [rsi+50],eax // [002D/45] DW9Emp.exe+106C87D -- (5) E8 6E5160FF -- call DW9Emp.exe+6719F0 // [0032/50] DW9Emp.exe+106C882 -- (2) 8B CB -- mov ecx,ebx // [0034/52] DW9Emp.exe+106C884 -- (3) 0FBF 10 -- movsx edx,word ptr [rax] // [0037/55] DW9Emp.exe+106C887 -- (6) 81 FA 6B070000 -- cmp edx,0000076B // [003D/61] DW9Emp.exe+106C88D -- (3) 0F46 CA -- cmovbe ecx,edx // [0040/64] DW9Emp.exe+106C890 -- (6) 81 F9 6B070000 -- cmp ecx,0000076B // [0046/70] DW9Emp.exe+106C896 -- (2) 77 16 -- ja DW9Emp.exe+106C8AE // [0048/72] DW9Emp.exe+106C898 -- (5) E8 939C60FF -- call DW9Emp.exe+676530 // [004D/77] DW9Emp.exe+106C89D -- (7) 0FBE 88 BC000000 -- movsx ecx,byte ptr [rax+000000BC] // [0054/84] DW9Emp.exe+106C8A4 -- (2) 8B C3 -- mov eax,ebx // [0056/86] DW9Emp.exe+106C8A6 -- (3) 83 F9 09 -- cmp ecx,09 // [0059/89] DW9Emp.exe+106C8A9 -- (3) 0F46 C1 -- cmovbe eax,ecx // [005C/92] DW9Emp.exe+106C8AC -- (2) EB 02 -- jmp DW9Emp.exe+106C8B0 // [005E/94] DW9Emp.exe+106C8AE -- (2) 8B C3 -- mov eax,ebx // [0060/96] DW9Emp.exe+106C8B0 -- (3) 89 46 54 -- mov [rsi+54],eax // [0063/99] DW9Emp.exe+106C8B3 -- (5) E8 682C60FF -- call DW9Emp.exe+66F520 // [0068/104] DW9Emp.exe+106C8B8 -- (7) 0FBF 88 B2000000 -- movsx ecx,word ptr [rax+000000B2] // [006F/111] DW9Emp.exe+106C8BF -- (2) 8B C3 -- mov eax,ebx // [0071/113] DW9Emp.exe+106C8C1 -- (6) 81 F9 C7000000 -- cmp ecx,000000C7 // [0077/119] DW9Emp.exe+106C8C7 -- (3) 0F46 C1 -- cmovbe eax,ecx // [007A/122] DW9Emp.exe+106C8CA -- (3) 89 46 5C -- mov [rsi+5C],eax // [007D/125] DW9Emp.exe+106C8CD -- (5) E8 4E2C60FF -- call DW9Emp.exe+66F520 // [0082/130] DW9Emp.exe+106C8D2 -- (2) 8B CB -- mov ecx,ebx // [0084/132] DW9Emp.exe+106C8D4 -- (7) 0FBF 90 B2000000 -- movsx edx,word ptr [rax+000000B2] // [008B/139] DW9Emp.exe+106C8DB -- (6) 81 FA C7000000 -- cmp edx,000000C7 // [0091/145] DW9Emp.exe+106C8E1 -- (3) 0F46 CA -- cmovbe ecx,edx // [0094/148] DW9Emp.exe+106C8E4 -- (6) 81 F9 C7000000 -- cmp ecx,000000C7 // [009A/154] DW9Emp.exe+106C8EA -- (2) 77 13 -- ja DW9Emp.exe+106C8FF // [009C/156] DW9Emp.exe+106C8EC -- (5) E8 0FF460FF -- call DW9Emp.exe+67BD00 // [00A1/161] DW9Emp.exe+106C8F1 -- (4) 0FBE 48 1E -- movsx ecx,byte ptr [rax+1E] // [00A5/165] DW9Emp.exe+106C8F5 -- (2) 8B C3 -- mov eax,ebx // [00A7/167] DW9Emp.exe+106C8F7 -- (3) 83 F9 07 -- cmp ecx,07 // [00AA/170] DW9Emp.exe+106C8FA -- (3) 0F46 C1 -- cmovbe eax,ecx // [00AD/173] DW9Emp.exe+106C8FD -- (2) EB 02 -- jmp DW9Emp.exe+106C901 // [00AF/175] DW9Emp.exe+106C8FF -- (2) 8B C3 -- mov eax,ebx // [00B1/177] DW9Emp.exe+106C901 -- (3) 89 46 60 -- mov [rsi+60],eax // [00B4/180] DW9Emp.exe+106C904 -- (5) E8 E75060FF -- call DW9Emp.exe+6719F0 // [00B9/185] DW9Emp.exe+106C909 -- (2) 8B CB -- mov ecx,ebx // [00BB/187] DW9Emp.exe+106C90B -- (3) 0FBF 10 -- movsx edx,word ptr [rax] // [00BE/190] DW9Emp.exe+106C90E -- (6) 81 FA 6B070000 -- cmp edx,0000076B // [00C4/196] DW9Emp.exe+106C914 -- (3) 0F46 CA -- cmovbe ecx,edx // [00C7/199] DW9Emp.exe+106C917 -- (6) 81 F9 6B070000 -- cmp ecx,0000076B // [00CD/205] DW9Emp.exe+106C91D -- (2) 77 16 -- ja DW9Emp.exe+106C935 // [00CF/207] DW9Emp.exe+106C91F -- (5) E8 0C9C60FF -- call DW9Emp.exe+676530 // [00D4/212] DW9Emp.exe+106C924 -- (7) 0FBE 88 BA000000 -- movsx ecx,byte ptr [rax+000000BA] // [00DB/219] DW9Emp.exe+106C92B -- (2) 8B C3 -- mov eax,ebx // [00DD/221] DW9Emp.exe+106C92D -- (3) 83 F9 27 -- cmp ecx,27 // [00E0/224] DW9Emp.exe+106C930 -- (3) 0F46 C1 -- cmovbe eax,ecx // [00E3/227] DW9Emp.exe+106C933 -- (2) EB 02 -- jmp DW9Emp.exe+106C937 // [00E5/229] DW9Emp.exe+106C935 -- (2) 8B C3 -- mov eax,ebx // [00E7/231] DW9Emp.exe+106C937 -- (3) 89 46 58 -- mov [rsi+58],eax // [00EA/234] DW9Emp.exe+106C93A -- (5) E8 B15060FF -- call DW9Emp.exe+6719F0 // [00EF/239] DW9Emp.exe+106C93F -- (2) 8B CB -- mov ecx,ebx // [00F1/241] DW9Emp.exe+106C941 -- (3) 0FBF 10 -- movsx edx,word ptr [rax] // [00F4/244] DW9Emp.exe+106C944 -- (6) 81 FA 6B070000 -- cmp edx,0000076B // [00FA/250] DW9Emp.exe+106C94A -- (3) 0F46 CA -- cmovbe ecx,edx // [00FD/253] DW9Emp.exe+106C94D -- (6) 81 F9 6B070000 -- cmp ecx,0000076B // [0103/259] DW9Emp.exe+106C953 -- (2) 77 36 -- ja DW9Emp.exe+106C98B // [0105/261] DW9Emp.exe+106C955 -- (5) E8 D69B60FF -- call DW9Emp.exe+676530 // [010A/266] DW9Emp.exe+106C95A -- (7) 0FBE 90 BA000000 -- movsx edx,byte ptr [rax+000000BA] // [0111/273] DW9Emp.exe+106C961 -- (3) 83 FA 27 -- cmp edx,27 // [0114/276] DW9Emp.exe+106C964 -- (3) 0F46 DA -- cmovbe ebx,edx // [0117/279] DW9Emp.exe+106C967 -- (3) 83 FB 27 -- cmp ebx,27 // [011A/282] DW9Emp.exe+106C96A -- (2) 77 1F -- ja DW9Emp.exe+106C98B // [011C/284] DW9Emp.exe+106C96C -- (2) 8B CB -- mov ecx,ebx // [011E/286] DW9Emp.exe+106C96E -- (5) E8 DD6060FF -- call DW9Emp.exe+672A50 // [0123/291] DW9Emp.exe+106C973 -- (2) 33 FF -- xor edi,edi // [0125/293] DW9Emp.exe+106C975 -- (3) 8B 48 34 -- mov ecx,[rax+34] // [0128/296] DW9Emp.exe+106C978 -- (2) 85 C9 -- test ecx,ecx // [012A/298] DW9Emp.exe+106C97A -- (2) 8B C7 -- mov eax,edi // [012C/300] DW9Emp.exe+106C97C -- (3) 0F45 C1 -- cmovne eax,ecx // [012F/303] DW9Emp.exe+106C97F -- (5) B9 7F969800 -- mov ecx,0098967F // [0134/308] DW9Emp.exe+106C984 -- (2) 3B C1 -- cmp eax,ecx // [0136/310] DW9Emp.exe+106C986 -- (3) 0F42 C8 -- cmovb ecx,eax // [0139/313] DW9Emp.exe+106C989 -- (2) EB 04 -- jmp DW9Emp.exe+106C98F // [013B/315] DW9Emp.exe+106C98B -- (2) 33 FF -- xor edi,edi // [013D/317] DW9Emp.exe+106C98D -- (2) 8B CF -- mov ecx,edi // [013F/319] DW9Emp.exe+106C98F -- (3) 89 4E 64 -- mov [rsi+64],ecx // [0142/322] DW9Emp.exe+106C992 -- (5) E8 F9940800 -- call DW9Emp.exe+10F5E90 // [0147/327] DW9Emp.exe+106C997 -- (3) 89 46 68 -- mov [rsi+68],eax // [014A/330] DW9Emp.exe+106C99A -- (5) E8 41970800 -- call DW9Emp.exe+10F60E0 // [014F/335] DW9Emp.exe+106C99F -- (3) 89 46 6C -- mov [rsi+6C],eax // [0152/338] DW9Emp.exe+106C9A2 -- (5) E8 792B60FF -- call DW9Emp.exe+66F520 // [0157/343] DW9Emp.exe+106C9A7 -- (2) 8B D7 -- mov edx,edi // [0159/345] DW9Emp.exe+106C9A9 -- (5) BB C8000000 -- mov ebx,000000C8 // [015E/350] DW9Emp.exe+106C9AE -- (3) 0FB6 08 -- movzx ecx,byte ptr [rax] // [0161/353] DW9Emp.exe+106C9B1 -- (2) 8B C3 -- mov eax,ebx // [0163/355] DW9Emp.exe+106C9B3 -- (2) 85 C9 -- test ecx,ecx // [0165/357] DW9Emp.exe+106C9B5 -- (3) 0F45 D1 -- cmovne edx,ecx // [0168/360] DW9Emp.exe+106C9B8 -- (2) 3B D3 -- cmp edx,ebx // [016A/362] DW9Emp.exe+106C9BA -- (3) 0F42 C2 -- cmovb eax,edx // [016D/365] DW9Emp.exe+106C9BD -- (3) 89 46 70 -- mov [rsi+70],eax // [0170/368] DW9Emp.exe+106C9C0 -- (5) E8 5B2B60FF -- call DW9Emp.exe+66F520 // [0175/373] DW9Emp.exe+106C9C5 -- (4) 0FB6 48 01 -- movzx ecx,byte ptr [rax+01] // [0179/377] DW9Emp.exe+106C9C9 -- (2) 85 C9 -- test ecx,ecx // [017B/379] DW9Emp.exe+106C9CB -- (3) 0F45 F9 -- cmovne edi,ecx // [017E/382] DW9Emp.exe+106C9CE -- (2) 3B FB -- cmp edi,ebx // [0180/384] DW9Emp.exe+106C9D0 -- (3) 0F42 DF -- cmovb ebx,edi // [0183/387] DW9Emp.exe+106C9D3 -- (3) 89 5E 74 -- mov [rsi+74],ebx // [0186/390] DW9Emp.exe+106C9D6 -- (5) E8 A5990800 -- call DW9Emp.exe+10F6380 // [018B/395] DW9Emp.exe+106C9DB -- (5) 48 8B 5C 24 30 -- mov rbx,[rsp+30] // [0190/400] DW9Emp.exe+106C9E0 -- (3) 89 46 78 -- mov [rsi+78],eax // [0193/403] DW9Emp.exe+106C9E3 -- (5) 48 8B 74 24 38 -- mov rsi,[rsp+38] // [0198/408] DW9Emp.exe+106C9E8 -- (4) 48 83 C4 20 -- add rsp,20 // [019C/412] DW9Emp.exe+106C9EC -- (1) 5F -- pop rdi // [019D/413] DW9Emp.exe+106C9ED -- (1) C3 -- ret } 5 "[$ASM] Inf Interaction Tries" C08000 Auto Assembler Script [ENABLE] aobscanmodule(GET_TRY_1,DW9Emp.exe,C6 84 08 54 43 01 00 01 E8) aobscanmodule(GET_TRY_2,DW9Emp.exe,74 02 B3 01 4C 8B 7C 24 20) registersymbol(GET_TRY_1 GET_TRY_2) GET_TRY_1: db C6 84 08 54 43 01 00 00 GET_TRY_2: db eb 02 [DISABLE] GET_TRY_1: db C6 84 08 54 43 01 00 01 db E8 83 1B E0 FF GET_TRY_2: db 74 02 unregistersymbol(GET_TRY_1 GET_TRY_2) { Function dump of "DW9Emp.exe+86FE60" ~ Function header aob : "48 8B C4 88 50 10 57" ~ // [0000/0] DW9Emp.exe+86FE10 -- (3) 48 8B C4 -- mov rax,rsp // [0003/3] DW9Emp.exe+86FE13 -- (3) 88 50 10 -- mov [rax+10],dl // [0006/6] DW9Emp.exe+86FE16 -- (1) 57 -- push rdi // [0007/7] DW9Emp.exe+86FE17 -- (7) 48 81 EC D0010000 -- sub rsp,000001D0 // [000E/14] DW9Emp.exe+86FE1E -- (3) 48 63 F9 -- movsxd rdi,ecx // [0011/17] DW9Emp.exe+86FE21 -- (6) 81 FF 6B070000 -- cmp edi,0000076B // [0017/23] DW9Emp.exe+86FE27 -- (6) 0F87 5A040000 -- ja DW9Emp.exe+870287 // [001D/29] DW9Emp.exe+86FE2D -- (7) 48 8B 0D 5CBFBD01 -- mov rcx,[DW9Emp.exe+244BD90] -- [F2803990] // [0024/36] DW9Emp.exe+86FE34 -- (4) 48 89 58 18 -- mov [rax+18],rbx // [0028/40] DW9Emp.exe+86FE38 -- (4) 48 89 68 F0 -- mov [rax-10],rbp // [002C/44] DW9Emp.exe+86FE3C -- (4) 48 89 70 E8 -- mov [rax-18],rsi // [0030/48] DW9Emp.exe+86FE40 -- (4) 4C 89 60 E0 -- mov [rax-20],r12 // [0034/52] DW9Emp.exe+86FE44 -- (4) 4C 89 68 D8 -- mov [rax-28],r13 // [0038/56] DW9Emp.exe+86FE48 -- (4) 4C 89 78 C8 -- mov [rax-38],r15 // [003C/60] DW9Emp.exe+86FE4C -- (3) 45 33 FF -- xor r15d,r15d // [003F/63] DW9Emp.exe+86FE4F -- (3) 48 85 C9 -- test rcx,rcx // [0042/66] DW9Emp.exe+86FE52 -- (2) 74 37 -- je DW9Emp.exe+86FE8B // [0044/68] DW9Emp.exe+86FE54 -- (6) 3B B9 C04A0100 -- cmp edi,[rcx+00014AC0] // [004A/74] DW9Emp.exe+86FE5A -- (3) 41 8B C7 -- mov eax,r15d // [004D/77] DW9Emp.exe+86FE5D -- (3) 0F42 C7 -- cmovb eax,edi // [0050/80] DW9Emp.exe+86FE60 -- (8) C6 84 08 54430100 01 -- mov byte ptr [rax+rcx+00014354],01 // [0058/88] DW9Emp.exe+86FE68 -- (5) E8 831BE0FF -- call DW9Emp.exe+6719F0 // [005D/93] DW9Emp.exe+86FE6D -- (5) BE FFFFFFFF -- mov esi,FFFFFFFF // [0062/98] DW9Emp.exe+86FE72 -- (3) 44 8B E6 -- mov r12d,esi // [0065/101] DW9Emp.exe+86FE75 -- (3) 0FBF 08 -- movsx ecx,word ptr [rax] // [0068/104] DW9Emp.exe+86FE78 -- (6) 81 F9 6B070000 -- cmp ecx,0000076B // [006E/110] DW9Emp.exe+86FE7E -- (4) 44 0F46 E1 -- cmovbe r12d,ecx // [0072/114] DW9Emp.exe+86FE82 -- (7) 48 8B 0D 07BFBD01 -- mov rcx,[DW9Emp.exe+244BD90] -- [F2803990] // [0079/121] DW9Emp.exe+86FE89 -- (2) EB 08 -- jmp DW9Emp.exe+86FE93 // [007B/123] DW9Emp.exe+86FE8B -- (5) BE 00000000 -- mov esi,00000000 // [0080/128] DW9Emp.exe+86FE90 -- (3) 44 8B E6 -- mov r12d,esi // [0083/131] DW9Emp.exe+86FE93 -- (8) 4C 89 B4 24 A8010000 -- mov [rsp+000001A8],r14 // [008B/139] DW9Emp.exe+86FE9B -- (5) BB 64000000 -- mov ebx,00000064 // [0090/144] DW9Emp.exe+86FEA0 -- (3) 48 85 C9 -- test rcx,rcx // [0093/147] DW9Emp.exe+86FEA3 -- (2) 74 4A -- je DW9Emp.exe+86FEEF // [0095/149] DW9Emp.exe+86FEA5 -- (2) 8B D7 -- mov edx,edi // [0097/151] DW9Emp.exe+86FEA7 -- (5) E8 B4A5FAFF -- call DW9Emp.exe+81A460 // [009C/156] DW9Emp.exe+86FEAC -- (7) 48 8B 0D DDBEBD01 -- mov rcx,[DW9Emp.exe+244BD90] -- [F2803990] // [00A3/163] DW9Emp.exe+86FEB3 -- (3) 48 85 C9 -- test rcx,rcx // [00A6/166] DW9Emp.exe+86FEB6 -- (2) 74 0B -- je DW9Emp.exe+86FEC3 // [00A8/168] DW9Emp.exe+86FEB8 -- (2) 8B D0 -- mov edx,eax // [00AA/170] DW9Emp.exe+86FEBA -- (5) E8 C1EFFAFF -- call DW9Emp.exe+81EE80 // [00AF/175] DW9Emp.exe+86FEBF -- (2) 8B D0 -- mov edx,eax // [00B1/177] DW9Emp.exe+86FEC1 -- (2) EB 03 -- jmp DW9Emp.exe+86FEC6 // [00B3/179] DW9Emp.exe+86FEC3 -- (3) 41 8B D7 -- mov edx,r15d // [00B6/182] DW9Emp.exe+86FEC6 -- (7) 48 8B 05 53C3BC01 -- mov rax,[DW9Emp.exe+243C220] -- [5728E7D0] // [00BD/189] DW9Emp.exe+86FECD -- (3) 48 8B 08 -- mov rcx,[rax] // [00C0/192] DW9Emp.exe+86FED0 -- (5) B8 01000000 -- mov eax,00000001 // [00C5/197] DW9Emp.exe+86FED5 -- (7) 44 8B B1 90000000 -- mov r14d,[rcx+00000090] // [00CC/204] DW9Emp.exe+86FEDC -- (3) 44 03 F2 -- add r14d,edx // [00CF/207] DW9Emp.exe+86FEDF -- (3) 44 3B F0 -- cmp r14d,eax // [00D2/210] DW9Emp.exe+86FEE2 -- (4) 44 0F4C F0 -- cmovl r14d,eax // [00D6/214] DW9Emp.exe+86FEE6 -- (3) 44 3B F3 -- cmp r14d,ebx // [00D9/217] DW9Emp.exe+86FEE9 -- (4) 44 0F4F F3 -- cmovg r14d,ebx // [00DD/221] DW9Emp.exe+86FEED -- (2) EB 03 -- jmp DW9Emp.exe+86FEF2 // [00DF/223] DW9Emp.exe+86FEEF -- (3) 45 8B F7 -- mov r14d,r15d // [00E2/226] DW9Emp.exe+86FEF2 -- (2) 8B CF -- mov ecx,edi // [00E4/228] DW9Emp.exe+86FEF4 -- (5) E8 3766E0FF -- call DW9Emp.exe+676530 // [00E9/233] DW9Emp.exe+86FEF9 -- (5) BD 02000000 -- mov ebp,00000002 // [00EE/238] DW9Emp.exe+86FEFE -- (5) 48 8D 4C 24 20 -- lea rcx,[rsp+20] // [00F3/243] DW9Emp.exe+86FF03 -- (2) 8B D5 -- mov edx,ebp // [00F5/245] DW9Emp.exe+86FF05 -- (11) 66 66 66 0F1F 84 00 00000000 -- nop word ptr [rax+rax+00000000] // [0100/256] DW9Emp.exe+86FF10 -- (7) 48 8D 89 80000000 -- lea rcx,[rcx+00000080] // [0107/263] DW9Emp.exe+86FF17 -- (3) 0F10 00 -- movups xmm0,[rax] // [010A/266] DW9Emp.exe+86FF1A -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [010E/270] DW9Emp.exe+86FF1E -- (7) 48 8D 80 80000000 -- lea rax,[rax+00000080] // [0115/277] DW9Emp.exe+86FF25 -- (4) 0F11 41 80 -- movups [rcx-80],xmm0 // [0119/281] DW9Emp.exe+86FF29 -- (4) 0F10 40 A0 -- movups xmm0,[rax-60] // [011D/285] DW9Emp.exe+86FF2D -- (4) 0F11 49 90 -- movups [rcx-70],xmm1 // [0121/289] DW9Emp.exe+86FF31 -- (4) 0F10 48 B0 -- movups xmm1,[rax-50] // [0125/293] DW9Emp.exe+86FF35 -- (4) 0F11 41 A0 -- movups [rcx-60],xmm0 // [0129/297] DW9Emp.exe+86FF39 -- (4) 0F10 40 C0 -- movups xmm0,[rax-40] // [012D/301] DW9Emp.exe+86FF3D -- (4) 0F11 49 B0 -- movups [rcx-50],xmm1 // [0131/305] DW9Emp.exe+86FF41 -- (4) 0F10 48 D0 -- movups xmm1,[rax-30] // [0135/309] DW9Emp.exe+86FF45 -- (4) 0F11 41 C0 -- movups [rcx-40],xmm0 // [0139/313] DW9Emp.exe+86FF49 -- (4) 0F10 40 E0 -- movups xmm0,[rax-20] // [013D/317] DW9Emp.exe+86FF4D -- (4) 0F11 49 D0 -- movups [rcx-30],xmm1 // [0141/321] DW9Emp.exe+86FF51 -- (4) 0F10 48 F0 -- movups xmm1,[rax-10] // [0145/325] DW9Emp.exe+86FF55 -- (4) 0F11 41 E0 -- movups [rcx-20],xmm0 // [0149/329] DW9Emp.exe+86FF59 -- (4) 0F11 49 F0 -- movups [rcx-10],xmm1 // [014D/333] DW9Emp.exe+86FF5D -- (4) 48 83 EA 01 -- sub rdx,01 // [0151/337] DW9Emp.exe+86FF61 -- (2) 75 AD -- jne DW9Emp.exe+86FF10 // [0153/339] DW9Emp.exe+86FF63 -- (3) 0F10 00 -- movups xmm0,[rax] // [0156/342] DW9Emp.exe+86FF66 -- (3) 44 8B EB -- mov r13d,ebx // [0159/345] DW9Emp.exe+86FF69 -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [015D/349] DW9Emp.exe+86FF6D -- (3) 0F11 01 -- movups [rcx],xmm0 // [0160/352] DW9Emp.exe+86FF70 -- (4) 0F10 40 20 -- movups xmm0,[rax+20] // [0164/356] DW9Emp.exe+86FF74 -- (4) 0F11 49 10 -- movups [rcx+10],xmm1 // [0168/360] DW9Emp.exe+86FF78 -- (4) 0F10 48 30 -- movups xmm1,[rax+30] // [016C/364] DW9Emp.exe+86FF7C -- (4) 0F11 41 20 -- movups [rcx+20],xmm0 // [0170/368] DW9Emp.exe+86FF80 -- (4) 0F10 40 40 -- movups xmm0,[rax+40] // [0174/372] DW9Emp.exe+86FF84 -- (4) 0F11 49 30 -- movups [rcx+30],xmm1 // [0178/376] DW9Emp.exe+86FF88 -- (4) 0F10 48 50 -- movups xmm1,[rax+50] // [017C/380] DW9Emp.exe+86FF8C -- (4) 0F11 41 40 -- movups [rcx+40],xmm0 // [0180/384] DW9Emp.exe+86FF90 -- (4) 0F10 40 60 -- movups xmm0,[rax+60] // [0184/388] DW9Emp.exe+86FF94 -- (4) 48 8B 40 70 -- mov rax,[rax+70] // [0188/392] DW9Emp.exe+86FF98 -- (4) 0F11 49 50 -- movups [rcx+50],xmm1 // [018C/396] DW9Emp.exe+86FF9C -- (4) 0F11 41 60 -- movups [rcx+60],xmm0 // [0190/400] DW9Emp.exe+86FFA0 -- (4) 48 89 41 70 -- mov [rcx+70],rax // [0194/404] DW9Emp.exe+86FFA4 -- (3) 41 8B CF -- mov ecx,r15d // [0197/407] DW9Emp.exe+86FFA7 -- (8) 0FB6 84 24 EB000000 -- movzx eax,byte ptr [rsp+000000EB] // [019F/415] DW9Emp.exe+86FFAF -- (2) 85 C0 -- test eax,eax // [01A1/417] DW9Emp.exe+86FFB1 -- (3) 0F45 C8 -- cmovne ecx,eax // [01A4/420] DW9Emp.exe+86FFB4 -- (2) 3B CB -- cmp ecx,ebx // [01A6/422] DW9Emp.exe+86FFB6 -- (4) 44 0F42 E9 -- cmovb r13d,ecx // [01AA/426] DW9Emp.exe+86FFBA -- (7) 48 8B 0D 3FC2BC01 -- mov rcx,[DW9Emp.exe+243C200] -- [D7CD97D0] // [01B1/433] DW9Emp.exe+86FFC1 -- (8) 44 89 AC 24 E0010000 -- mov [rsp+000001E0],r13d // [01B9/441] DW9Emp.exe+86FFC9 -- (3) 48 85 C9 -- test rcx,rcx // [01BC/444] DW9Emp.exe+86FFCC -- (2) 74 5B -- je DW9Emp.exe+870029 // [01BE/446] DW9Emp.exe+86FFCE -- (6) 3B B9 A0E60A00 -- cmp edi,[rcx+000AE6A0] // [01C4/452] DW9Emp.exe+86FFD4 -- (3) 41 8B C7 -- mov eax,r15d // [01C7/455] DW9Emp.exe+86FFD7 -- (3) 0F42 C7 -- cmovb eax,edi // [01CA/458] DW9Emp.exe+86FFDA -- (7) 4C 69 E8 78010000 -- imul r13,rax,00000178 // [01D1/465] DW9Emp.exe+86FFE1 -- (3) 4C 03 E9 -- add r13,rcx // [01D4/468] DW9Emp.exe+86FFE4 -- (2) 74 3B -- je DW9Emp.exe+870021 // [01D6/470] DW9Emp.exe+86FFE6 -- (8) 41 0FB6 85 CB000000 -- movzx eax,byte ptr [r13+000000CB] // [01DE/478] DW9Emp.exe+86FFEE -- (3) 41 8B DF -- mov ebx,r15d // [01E1/481] DW9Emp.exe+86FFF1 -- (2) 85 C0 -- test eax,eax // [01E3/483] DW9Emp.exe+86FFF3 -- (2) 8B CF -- mov ecx,edi // [01E5/485] DW9Emp.exe+86FFF5 -- (3) 0F45 D8 -- cmovne ebx,eax // [01E8/488] DW9Emp.exe+86FFF8 -- (5) E8 D382FFFF -- call DW9Emp.exe+8682D0 // [01ED/493] DW9Emp.exe+86FFFD -- (5) B9 64000000 -- mov ecx,00000064 // [01F2/498] DW9Emp.exe+870002 -- (2) 3B D9 -- cmp ebx,ecx // [01F4/500] DW9Emp.exe+870004 -- (3) 0F42 CB -- cmovb ecx,ebx // [01F7/503] DW9Emp.exe+870007 -- (3) 41 03 C6 -- add eax,r14d // [01FA/506] DW9Emp.exe+87000A -- (2) 03 C8 -- add ecx,eax // [01FC/508] DW9Emp.exe+87000C -- (5) BB 64000000 -- mov ebx,00000064 // [0201/513] DW9Emp.exe+870011 -- (3) 83 F9 64 -- cmp ecx,64 // [0204/516] DW9Emp.exe+870014 -- (3) 0FB6 C1 -- movzx eax,cl // [0207/519] DW9Emp.exe+870017 -- (3) 0F47 C3 -- cmova eax,ebx // [020A/522] DW9Emp.exe+87001A -- (7) 41 88 85 CB000000 -- mov [r13+000000CB],al // [0211/529] DW9Emp.exe+870021 -- (8) 44 8B AC 24 E0010000 -- mov r13d,[rsp+000001E0] // [0219/537] DW9Emp.exe+870029 -- (2) 8B CF -- mov ecx,edi // [021B/539] DW9Emp.exe+87002B -- (5) E8 0065E0FF -- call DW9Emp.exe+676530 // [0220/544] DW9Emp.exe+870030 -- (8) 4C 8B B4 24 A8010000 -- mov r14,[rsp+000001A8] // [0228/552] DW9Emp.exe+870038 -- (5) 48 8D 4C 24 20 -- lea rcx,[rsp+20] // [022D/557] DW9Emp.exe+87003D -- (3) 48 8B D5 -- mov rdx,rbp // [0230/560] DW9Emp.exe+870040 -- (7) 48 8D 89 80000000 -- lea rcx,[rcx+00000080] // [0237/567] DW9Emp.exe+870047 -- (3) 0F10 00 -- movups xmm0,[rax] // [023A/570] DW9Emp.exe+87004A -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [023E/574] DW9Emp.exe+87004E -- (7) 48 8D 80 80000000 -- lea rax,[rax+00000080] // [0245/581] DW9Emp.exe+870055 -- (4) 0F11 41 80 -- movups [rcx-80],xmm0 // [0249/585] DW9Emp.exe+870059 -- (4) 0F10 40 A0 -- movups xmm0,[rax-60] // [024D/589] DW9Emp.exe+87005D -- (4) 0F11 49 90 -- movups [rcx-70],xmm1 // [0251/593] DW9Emp.exe+870061 -- (4) 0F10 48 B0 -- movups xmm1,[rax-50] // [0255/597] DW9Emp.exe+870065 -- (4) 0F11 41 A0 -- movups [rcx-60],xmm0 // [0259/601] DW9Emp.exe+870069 -- (4) 0F10 40 C0 -- movups xmm0,[rax-40] // [025D/605] DW9Emp.exe+87006D -- (4) 0F11 49 B0 -- movups [rcx-50],xmm1 // [0261/609] DW9Emp.exe+870071 -- (4) 0F10 48 D0 -- movups xmm1,[rax-30] // [0265/613] DW9Emp.exe+870075 -- (4) 0F11 41 C0 -- movups [rcx-40],xmm0 // [0269/617] DW9Emp.exe+870079 -- (4) 0F10 40 E0 -- movups xmm0,[rax-20] // [026D/621] DW9Emp.exe+87007D -- (4) 0F11 49 D0 -- movups [rcx-30],xmm1 // [0271/625] DW9Emp.exe+870081 -- (4) 0F10 48 F0 -- movups xmm1,[rax-10] // [0275/629] DW9Emp.exe+870085 -- (4) 0F11 41 E0 -- movups [rcx-20],xmm0 // [0279/633] DW9Emp.exe+870089 -- (4) 0F11 49 F0 -- movups [rcx-10],xmm1 // [027D/637] DW9Emp.exe+87008D -- (4) 48 83 EA 01 -- sub rdx,01 // [0281/641] DW9Emp.exe+870091 -- (2) 75 AD -- jne DW9Emp.exe+870040 // [0283/643] DW9Emp.exe+870093 -- (3) 0F10 00 -- movups xmm0,[rax] // [0286/646] DW9Emp.exe+870096 -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [028A/650] DW9Emp.exe+87009A -- (3) 0F11 01 -- movups [rcx],xmm0 // [028D/653] DW9Emp.exe+87009D -- (4) 0F10 40 20 -- movups xmm0,[rax+20] // [0291/657] DW9Emp.exe+8700A1 -- (4) 0F11 49 10 -- movups [rcx+10],xmm1 // [0295/661] DW9Emp.exe+8700A5 -- (4) 0F10 48 30 -- movups xmm1,[rax+30] // [0299/665] DW9Emp.exe+8700A9 -- (4) 0F11 41 20 -- movups [rcx+20],xmm0 // [029D/669] DW9Emp.exe+8700AD -- (4) 0F10 40 40 -- movups xmm0,[rax+40] // [02A1/673] DW9Emp.exe+8700B1 -- (4) 0F11 49 30 -- movups [rcx+30],xmm1 // [02A5/677] DW9Emp.exe+8700B5 -- (4) 0F10 48 50 -- movups xmm1,[rax+50] // [02A9/681] DW9Emp.exe+8700B9 -- (4) 0F11 41 40 -- movups [rcx+40],xmm0 // [02AD/685] DW9Emp.exe+8700BD -- (4) 0F10 40 60 -- movups xmm0,[rax+60] // [02B1/689] DW9Emp.exe+8700C1 -- (4) 48 8B 40 70 -- mov rax,[rax+70] // [02B5/693] DW9Emp.exe+8700C5 -- (4) 0F11 49 50 -- movups [rcx+50],xmm1 // [02B9/697] DW9Emp.exe+8700C9 -- (4) 0F11 41 60 -- movups [rcx+60],xmm0 // [02BD/701] DW9Emp.exe+8700CD -- (4) 48 89 41 70 -- mov [rcx+70],rax // [02C1/705] DW9Emp.exe+8700D1 -- (8) 0FB6 84 24 EB000000 -- movzx eax,byte ptr [rsp+000000EB] // [02C9/713] DW9Emp.exe+8700D9 -- (2) 85 C0 -- test eax,eax // [02CB/715] DW9Emp.exe+8700DB -- (4) 44 0F45 F8 -- cmovne r15d,eax // [02CF/719] DW9Emp.exe+8700DF -- (7) 48 8B 05 F2BDBD01 -- mov rax,[DW9Emp.exe+244BED8] -- [F3B1DBC0] // [02D6/726] DW9Emp.exe+8700E6 -- (4) 41 83 FF 64 -- cmp r15d,64 // [02DA/730] DW9Emp.exe+8700EA -- (4) 41 0F42 DF -- cmovb ebx,r15d // [02DE/734] DW9Emp.exe+8700EE -- (8) 4C 8B BC 24 A0010000 -- mov r15,[rsp+000001A0] // [02E6/742] DW9Emp.exe+8700F6 -- (6) 89 98 18910200 -- mov [rax+00029118],ebx // [02EC/748] DW9Emp.exe+8700FC -- (7) 48 8B 1D 8DBCBD01 -- mov rbx,[DW9Emp.exe+244BD90] -- [F2803990] // [02F3/755] DW9Emp.exe+870103 -- (7) 44 89 A8 14910200 -- mov [rax+00029114],r13d // [02FA/762] DW9Emp.exe+87010A -- (8) 4C 8B AC 24 B0010000 -- mov r13,[rsp+000001B0] // [0302/770] DW9Emp.exe+870112 -- (6) 89 B8 10910200 -- mov [rax+00029110],edi // [0308/776] DW9Emp.exe+870118 -- (3) 48 85 DB -- test rbx,rbx // [030B/779] DW9Emp.exe+87011B -- (6) 0F84 24010000 -- je DW9Emp.exe+870245 // [0311/785] DW9Emp.exe+870121 -- (7) 38 94 24 E8010000 -- cmp [rsp+000001E8],dl // [0318/792] DW9Emp.exe+870128 -- (6) 0F85 17010000 -- jne DW9Emp.exe+870245 // [031E/798] DW9Emp.exe+87012E -- (10) C7 83 CC7E0000 1D000000 -- mov [rbx+00007ECC],0000001D // [0328/808] DW9Emp.exe+870138 -- (7) 4C 8D 05 D1D5DE01 -- lea r8,[DW9Emp.exe+265D710] -- [00000000] // [032F/815] DW9Emp.exe+87013F -- (6) 41 0FBF 44 78 18 -- movsx eax,word ptr [r8+rdi*2+18] // [0335/821] DW9Emp.exe+870145 -- (4) 49 8D 14 78 -- lea rdx,[r8+rdi*2] // [0339/825] DW9Emp.exe+870149 -- (5) 3D F5090000 -- cmp eax,000009F5 // [033E/830] DW9Emp.exe+87014E -- (2) 8B CE -- mov ecx,esi // [0340/832] DW9Emp.exe+870150 -- (3) 0F46 C8 -- cmovbe ecx,eax // [0343/835] DW9Emp.exe+870153 -- (6) 89 8B D47E0000 -- mov [rbx+00007ED4],ecx // [0349/841] DW9Emp.exe+870159 -- (7) 41 81 FC 6B070000 -- cmp r12d,0000076B // [0350/848] DW9Emp.exe+870160 -- (2) 77 16 -- ja DW9Emp.exe+870178 // [0352/850] DW9Emp.exe+870162 -- (3) 49 63 C4 -- movsxd rax,r12d // [0355/853] DW9Emp.exe+870165 -- (6) 41 0FBF 4C 40 18 -- movsx ecx,word ptr [r8+rax*2+18] // [035B/859] DW9Emp.exe+87016B -- (2) 8B C6 -- mov eax,esi // [035D/861] DW9Emp.exe+87016D -- (6) 81 F9 F5090000 -- cmp ecx,000009F5 // [0363/867] DW9Emp.exe+870173 -- (3) 0F46 C1 -- cmovbe eax,ecx // [0366/870] DW9Emp.exe+870176 -- (2) EB 02 -- jmp DW9Emp.exe+87017A // [0368/872] DW9Emp.exe+870178 -- (2) 8B C6 -- mov eax,esi // [036A/874] DW9Emp.exe+87017A -- (6) 89 83 D87E0000 -- mov [rbx+00007ED8],eax // [0370/880] DW9Emp.exe+870180 -- (2) 8B CE -- mov ecx,esi // [0372/882] DW9Emp.exe+870182 -- (4) 0FBF 42 18 -- movsx eax,word ptr [rdx+18] // [0376/886] DW9Emp.exe+870186 -- (5) 3D F5090000 -- cmp eax,000009F5 // [037B/891] DW9Emp.exe+87018B -- (3) 0F46 C8 -- cmovbe ecx,eax // [037E/894] DW9Emp.exe+87018E -- (6) 89 8B 007F0000 -- mov [rbx+00007F00],ecx // [0384/900] DW9Emp.exe+870194 -- (2) 8B CF -- mov ecx,edi // [0386/902] DW9Emp.exe+870196 -- (5) E8 9563E0FF -- call DW9Emp.exe+676530 // [038B/907] DW9Emp.exe+87019B -- (5) 48 8D 4C 24 20 -- lea rcx,[rsp+20] // [0390/912] DW9Emp.exe+8701A0 -- (7) 48 8D 89 80000000 -- lea rcx,[rcx+00000080] // [0397/919] DW9Emp.exe+8701A7 -- (3) 0F10 00 -- movups xmm0,[rax] // [039A/922] DW9Emp.exe+8701AA -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [039E/926] DW9Emp.exe+8701AE -- (7) 48 8D 80 80000000 -- lea rax,[rax+00000080] // [03A5/933] DW9Emp.exe+8701B5 -- (4) 0F11 41 80 -- movups [rcx-80],xmm0 // [03A9/937] DW9Emp.exe+8701B9 -- (4) 0F10 40 A0 -- movups xmm0,[rax-60] // [03AD/941] DW9Emp.exe+8701BD -- (4) 0F11 49 90 -- movups [rcx-70],xmm1 // [03B1/945] DW9Emp.exe+8701C1 -- (4) 0F10 48 B0 -- movups xmm1,[rax-50] // [03B5/949] DW9Emp.exe+8701C5 -- (4) 0F11 41 A0 -- movups [rcx-60],xmm0 // [03B9/953] DW9Emp.exe+8701C9 -- (4) 0F10 40 C0 -- movups xmm0,[rax-40] // [03BD/957] DW9Emp.exe+8701CD -- (4) 0F11 49 B0 -- movups [rcx-50],xmm1 // [03C1/961] DW9Emp.exe+8701D1 -- (4) 0F10 48 D0 -- movups xmm1,[rax-30] // [03C5/965] DW9Emp.exe+8701D5 -- (4) 0F11 41 C0 -- movups [rcx-40],xmm0 // [03C9/969] DW9Emp.exe+8701D9 -- (4) 0F10 40 E0 -- movups xmm0,[rax-20] // [03CD/973] DW9Emp.exe+8701DD -- (4) 0F11 49 D0 -- movups [rcx-30],xmm1 // [03D1/977] DW9Emp.exe+8701E1 -- (4) 0F10 48 F0 -- movups xmm1,[rax-10] // [03D5/981] DW9Emp.exe+8701E5 -- (4) 0F11 41 E0 -- movups [rcx-20],xmm0 // [03D9/985] DW9Emp.exe+8701E9 -- (4) 0F11 49 F0 -- movups [rcx-10],xmm1 // [03DD/989] DW9Emp.exe+8701ED -- (4) 48 83 ED 01 -- sub rbp,01 // [03E1/993] DW9Emp.exe+8701F1 -- (2) 75 AD -- jne DW9Emp.exe+8701A0 // [03E3/995] DW9Emp.exe+8701F3 -- (3) 0F10 00 -- movups xmm0,[rax] // [03E6/998] DW9Emp.exe+8701F6 -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [03EA/1002] DW9Emp.exe+8701FA -- (3) 0F11 01 -- movups [rcx],xmm0 // [03ED/1005] DW9Emp.exe+8701FD -- (4) 0F10 40 20 -- movups xmm0,[rax+20] // [03F1/1009] DW9Emp.exe+870201 -- (4) 0F11 49 10 -- movups [rcx+10],xmm1 // [03F5/1013] DW9Emp.exe+870205 -- (4) 0F10 48 30 -- movups xmm1,[rax+30] // [03F9/1017] DW9Emp.exe+870209 -- (4) 0F11 41 20 -- movups [rcx+20],xmm0 // [03FD/1021] DW9Emp.exe+87020D -- (4) 0F10 40 40 -- movups xmm0,[rax+40] // [0401/1025] DW9Emp.exe+870211 -- (4) 0F11 49 30 -- movups [rcx+30],xmm1 // [0405/1029] DW9Emp.exe+870215 -- (4) 0F10 48 50 -- movups xmm1,[rax+50] // [0409/1033] DW9Emp.exe+870219 -- (4) 0F11 41 40 -- movups [rcx+40],xmm0 // [040D/1037] DW9Emp.exe+87021D -- (4) 0F10 40 60 -- movups xmm0,[rax+60] // [0411/1041] DW9Emp.exe+870221 -- (4) 48 8B 40 70 -- mov rax,[rax+70] // [0415/1045] DW9Emp.exe+870225 -- (4) 0F11 49 50 -- movups [rcx+50],xmm1 // [0419/1049] DW9Emp.exe+870229 -- (4) 0F11 41 60 -- movups [rcx+60],xmm0 // [041D/1053] DW9Emp.exe+87022D -- (4) 48 89 41 70 -- mov [rcx+70],rax // [0421/1057] DW9Emp.exe+870231 -- (8) 0FBE 84 24 DB000000 -- movsx eax,byte ptr [rsp+000000DB] // [0429/1065] DW9Emp.exe+870239 -- (3) 83 F8 27 -- cmp eax,27 // [042C/1068] DW9Emp.exe+87023C -- (3) 0F46 F0 -- cmovbe esi,eax // [042F/1071] DW9Emp.exe+87023F -- (6) 89 B3 D07E0000 -- mov [rbx+00007ED0],esi // [0435/1077] DW9Emp.exe+870245 -- (5) B9 0A000000 -- mov ecx,0000000A // [043A/1082] DW9Emp.exe+87024A -- (5) E8 7132FEFF -- call DW9Emp.exe+8534C0 // [043F/1087] DW9Emp.exe+87024F -- (2) 8B CF -- mov ecx,edi // [0441/1089] DW9Emp.exe+870251 -- (5) E8 8A5ADAFF -- call DW9Emp.exe+615CE0 // [0446/1094] DW9Emp.exe+870256 -- (7) 48 8B 0D 33BBBD01 -- mov rcx,[DW9Emp.exe+244BD90] -- [F2803990] // [044D/1101] DW9Emp.exe+87025D -- (8) 4C 8B A4 24 B8010000 -- mov r12,[rsp+000001B8] // [0455/1109] DW9Emp.exe+870265 -- (8) 48 8B B4 24 C0010000 -- mov rsi,[rsp+000001C0] // [045D/1117] DW9Emp.exe+87026D -- (8) 48 8B AC 24 C8010000 -- mov rbp,[rsp+000001C8] // [0465/1125] DW9Emp.exe+870275 -- (8) 48 8B 9C 24 F0010000 -- mov rbx,[rsp+000001F0] // [046D/1133] DW9Emp.exe+87027D -- (3) 48 85 C9 -- test rcx,rcx // [0470/1136] DW9Emp.exe+870280 -- (2) 74 05 -- je DW9Emp.exe+870287 // [0472/1138] DW9Emp.exe+870282 -- (5) E8 4936FBFF -- call DW9Emp.exe+8238D0 // [0477/1143] DW9Emp.exe+870287 -- (7) 48 81 C4 D0010000 -- add rsp,000001D0 // [047E/1150] DW9Emp.exe+87028E -- (1) 5F -- pop rdi // [047F/1151] DW9Emp.exe+87028F -- (1) C3 -- ret } 6 "[$ASM] Max companionship level (after interacting)" C08000 Auto Assembler Script [ENABLE] aobscanmodule(SET_MAX_LEVEL,DW9Emp.exe,44 8B B1 90 00 00 00 44) registersymbol(SET_MAX_LEVEL) SET_MAX_LEVEL: db 44 8B B1 84 00 00 00 [DISABLE] SET_MAX_LEVEL: db 44 8B B1 90 00 00 00 db 44 03 F2 unregistersymbol(SET_MAX_LEVEL) { Function dump of "DW9Emp.exe+86FED5" ~ Function header aob : "48 8B C4 88 50 10 57" ~ // [0000/0] DW9Emp.exe+86FE10 -- (3) 48 8B C4 -- mov rax,rsp // [0003/3] DW9Emp.exe+86FE13 -- (3) 88 50 10 -- mov [rax+10],dl // [0006/6] DW9Emp.exe+86FE16 -- (1) 57 -- push rdi // [0007/7] DW9Emp.exe+86FE17 -- (7) 48 81 EC D0010000 -- sub rsp,000001D0 // [000E/14] DW9Emp.exe+86FE1E -- (3) 48 63 F9 -- movsxd rdi,ecx // [0011/17] DW9Emp.exe+86FE21 -- (6) 81 FF 6B070000 -- cmp edi,0000076B // [0017/23] DW9Emp.exe+86FE27 -- (6) 0F87 5A040000 -- ja DW9Emp.exe+870287 // [001D/29] DW9Emp.exe+86FE2D -- (7) 48 8B 0D 5CBFBD01 -- mov rcx,[DW9Emp.exe+244BD90] -- [D457A990] // [0024/36] DW9Emp.exe+86FE34 -- (4) 48 89 58 18 -- mov [rax+18],rbx // [0028/40] DW9Emp.exe+86FE38 -- (4) 48 89 68 F0 -- mov [rax-10],rbp // [002C/44] DW9Emp.exe+86FE3C -- (4) 48 89 70 E8 -- mov [rax-18],rsi // [0030/48] DW9Emp.exe+86FE40 -- (4) 4C 89 60 E0 -- mov [rax-20],r12 // [0034/52] DW9Emp.exe+86FE44 -- (4) 4C 89 68 D8 -- mov [rax-28],r13 // [0038/56] DW9Emp.exe+86FE48 -- (4) 4C 89 78 C8 -- mov [rax-38],r15 // [003C/60] DW9Emp.exe+86FE4C -- (3) 45 33 FF -- xor r15d,r15d // [003F/63] DW9Emp.exe+86FE4F -- (3) 48 85 C9 -- test rcx,rcx // [0042/66] DW9Emp.exe+86FE52 -- (2) 74 37 -- je DW9Emp.exe+86FE8B // [0044/68] DW9Emp.exe+86FE54 -- (6) 3B B9 C04A0100 -- cmp edi,[rcx+00014AC0] // [004A/74] DW9Emp.exe+86FE5A -- (3) 41 8B C7 -- mov eax,r15d // [004D/77] DW9Emp.exe+86FE5D -- (3) 0F42 C7 -- cmovb eax,edi // [0050/80] DW9Emp.exe+86FE60 -- (8) C6 84 08 54430100 00 -- mov byte ptr [rax+rcx+00014354],00 // [0058/88] DW9Emp.exe+86FE68 -- (5) E8 831BE0FF -- call DW9Emp.exe+6719F0 // [005D/93] DW9Emp.exe+86FE6D -- (5) BE FFFFFFFF -- mov esi,FFFFFFFF // [0062/98] DW9Emp.exe+86FE72 -- (3) 44 8B E6 -- mov r12d,esi // [0065/101] DW9Emp.exe+86FE75 -- (3) 0FBF 08 -- movsx ecx,word ptr [rax] // [0068/104] DW9Emp.exe+86FE78 -- (6) 81 F9 6B070000 -- cmp ecx,0000076B // [006E/110] DW9Emp.exe+86FE7E -- (4) 44 0F46 E1 -- cmovbe r12d,ecx // [0072/114] DW9Emp.exe+86FE82 -- (7) 48 8B 0D 07BFBD01 -- mov rcx,[DW9Emp.exe+244BD90] -- [D457A990] // [0079/121] DW9Emp.exe+86FE89 -- (2) EB 08 -- jmp DW9Emp.exe+86FE93 // [007B/123] DW9Emp.exe+86FE8B -- (5) BE FFFFFFFF -- mov esi,FFFFFFFF // [0080/128] DW9Emp.exe+86FE90 -- (3) 44 8B E6 -- mov r12d,esi // [0083/131] DW9Emp.exe+86FE93 -- (8) 4C 89 B4 24 A8010000 -- mov [rsp+000001A8],r14 // [008B/139] DW9Emp.exe+86FE9B -- (5) BB 64000000 -- mov ebx,00000064 // [0090/144] DW9Emp.exe+86FEA0 -- (3) 48 85 C9 -- test rcx,rcx // [0093/147] DW9Emp.exe+86FEA3 -- (2) 74 4A -- je DW9Emp.exe+86FEEF // [0095/149] DW9Emp.exe+86FEA5 -- (2) 8B D7 -- mov edx,edi // [0097/151] DW9Emp.exe+86FEA7 -- (5) E8 B4A5FAFF -- call DW9Emp.exe+81A460 // [009C/156] DW9Emp.exe+86FEAC -- (7) 48 8B 0D DDBEBD01 -- mov rcx,[DW9Emp.exe+244BD90] -- [D457A990] // [00A3/163] DW9Emp.exe+86FEB3 -- (3) 48 85 C9 -- test rcx,rcx // [00A6/166] DW9Emp.exe+86FEB6 -- (2) EB 0B -- jmp DW9Emp.exe+86FEC3 // [00A8/168] DW9Emp.exe+86FEB8 -- (2) 8B D0 -- mov edx,eax // [00AA/170] DW9Emp.exe+86FEBA -- (5) E8 C1EFFAFF -- call DW9Emp.exe+81EE80 // [00AF/175] DW9Emp.exe+86FEBF -- (2) 8B D0 -- mov edx,eax // [00B1/177] DW9Emp.exe+86FEC1 -- (2) EB 03 -- jmp DW9Emp.exe+86FEC6 // [00B3/179] DW9Emp.exe+86FEC3 -- (3) 41 8B D7 -- mov edx,r15d // [00B6/182] DW9Emp.exe+86FEC6 -- (7) 48 8B 05 53C3BC01 -- mov rax,[DW9Emp.exe+243C220] -- [5728E7D0] // [00BD/189] DW9Emp.exe+86FECD -- (3) 48 8B 08 -- mov rcx,[rax] // [00C0/192] DW9Emp.exe+86FED0 -- (5) B8 01000000 -- mov eax,00000001 // [00C5/197] DW9Emp.exe+86FED5 -- (7) 44 8B B1 90000000 -- mov r14d,[rcx+00000090] // [00CC/204] DW9Emp.exe+86FEDC -- (3) 44 03 F2 -- add r14d,edx // [00CF/207] DW9Emp.exe+86FEDF -- (3) 44 3B F0 -- cmp r14d,eax // [00D2/210] DW9Emp.exe+86FEE2 -- (4) 44 0F4C F0 -- cmovl r14d,eax // [00D6/214] DW9Emp.exe+86FEE6 -- (3) 44 3B F3 -- cmp r14d,ebx // [00D9/217] DW9Emp.exe+86FEE9 -- (4) 44 0F4F F3 -- cmovg r14d,ebx // [00DD/221] DW9Emp.exe+86FEED -- (2) EB 03 -- jmp DW9Emp.exe+86FEF2 // [00DF/223] DW9Emp.exe+86FEEF -- (3) 45 8B F7 -- mov r14d,r15d // [00E2/226] DW9Emp.exe+86FEF2 -- (2) 8B CF -- mov ecx,edi // [00E4/228] DW9Emp.exe+86FEF4 -- (5) E8 3766E0FF -- call DW9Emp.exe+676530 // [00E9/233] DW9Emp.exe+86FEF9 -- (5) BD 02000000 -- mov ebp,00000002 // [00EE/238] DW9Emp.exe+86FEFE -- (5) 48 8D 4C 24 20 -- lea rcx,[rsp+20] // [00F3/243] DW9Emp.exe+86FF03 -- (2) 8B D5 -- mov edx,ebp // [00F5/245] DW9Emp.exe+86FF05 -- (11) 66 66 66 0F1F 84 00 00000000 -- nop word ptr [rax+rax+00000000] // [0100/256] DW9Emp.exe+86FF10 -- (7) 48 8D 89 80000000 -- lea rcx,[rcx+00000080] // [0107/263] DW9Emp.exe+86FF17 -- (3) 0F10 00 -- movups xmm0,[rax] // [010A/266] DW9Emp.exe+86FF1A -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [010E/270] DW9Emp.exe+86FF1E -- (7) 48 8D 80 80000000 -- lea rax,[rax+00000080] // [0115/277] DW9Emp.exe+86FF25 -- (4) 0F11 41 80 -- movups [rcx-80],xmm0 // [0119/281] DW9Emp.exe+86FF29 -- (4) 0F10 40 A0 -- movups xmm0,[rax-60] // [011D/285] DW9Emp.exe+86FF2D -- (4) 0F11 49 90 -- movups [rcx-70],xmm1 // [0121/289] DW9Emp.exe+86FF31 -- (4) 0F10 48 B0 -- movups xmm1,[rax-50] // [0125/293] DW9Emp.exe+86FF35 -- (4) 0F11 41 A0 -- movups [rcx-60],xmm0 // [0129/297] DW9Emp.exe+86FF39 -- (4) 0F10 40 C0 -- movups xmm0,[rax-40] // [012D/301] DW9Emp.exe+86FF3D -- (4) 0F11 49 B0 -- movups [rcx-50],xmm1 // [0131/305] DW9Emp.exe+86FF41 -- (4) 0F10 48 D0 -- movups xmm1,[rax-30] // [0135/309] DW9Emp.exe+86FF45 -- (4) 0F11 49 D0 -- movups [rcx-30],xmm1 // [0139/313] DW9Emp.exe+86FF49 -- (4) 0F10 40 E0 -- movups xmm0,[rax-20] // [013D/317] DW9Emp.exe+86FF4D -- (4) 0F11 49 C0 -- movups [rcx-40],xmm1 // [0141/321] DW9Emp.exe+86FF51 -- (4) 0F10 48 F0 -- movups xmm1,[rax-10] // [0145/325] DW9Emp.exe+86FF55 -- (4) 0F11 41 E0 -- movups [rcx-20],xmm0 // [0149/329] DW9Emp.exe+86FF59 -- (4) 0F11 49 F0 -- movups [rcx-10],xmm1 // [014D/333] DW9Emp.exe+86FF5D -- (4) 48 83 EA 01 -- sub rdx,01 // [0151/337] DW9Emp.exe+86FF61 -- (2) 75 AD -- jne DW9Emp.exe+86FF10 // [0153/339] DW9Emp.exe+86FF63 -- (3) 0F10 00 -- movups xmm0,[rax] // [0156/342] DW9Emp.exe+86FF66 -- (3) 44 8B EB -- mov r13d,ebx // [0159/345] DW9Emp.exe+86FF69 -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [015D/349] DW9Emp.exe+86FF6D -- (3) 0F11 01 -- movups [rcx],xmm0 // [0160/352] DW9Emp.exe+86FF70 -- (4) 0F10 40 20 -- movups xmm0,[rax+20] // [0164/356] DW9Emp.exe+86FF74 -- (4) 0F11 49 10 -- movups [rcx+10],xmm1 // [0168/360] DW9Emp.exe+86FF78 -- (4) 0F10 48 30 -- movups xmm1,[rax+30] // [016C/364] DW9Emp.exe+86FF7C -- (4) 0F11 41 20 -- movups [rcx+20],xmm0 // [0170/368] DW9Emp.exe+86FF80 -- (4) 0F10 40 40 -- movups xmm0,[rax+40] // [0174/372] DW9Emp.exe+86FF84 -- (4) 0F11 49 30 -- movups [rcx+30],xmm1 // [0178/376] DW9Emp.exe+86FF88 -- (4) 0F10 48 50 -- movups xmm1,[rax+50] // [017C/380] DW9Emp.exe+86FF8C -- (4) 0F11 41 40 -- movups [rcx+40],xmm0 // [0180/384] DW9Emp.exe+86FF90 -- (4) 0F10 40 60 -- movups xmm0,[rax+60] // [0184/388] DW9Emp.exe+86FF94 -- (4) 48 8B 40 70 -- mov rax,[rax+70] // [0188/392] DW9Emp.exe+86FF98 -- (4) 0F11 49 50 -- movups [rcx+50],xmm1 // [018C/396] DW9Emp.exe+86FF9C -- (4) 0F11 41 60 -- movups [rcx+60],xmm0 // [0190/400] DW9Emp.exe+86FFA0 -- (4) 48 89 41 70 -- mov [rcx+70],rax // [0194/404] DW9Emp.exe+86FFA4 -- (3) 41 8B CF -- mov ecx,r15d // [0197/407] DW9Emp.exe+86FFA7 -- (8) 0FB6 84 24 EB000000 -- movzx eax,byte ptr [rsp+000000EB] // [019F/415] DW9Emp.exe+86FFAF -- (2) 85 C0 -- test eax,eax // [01A1/417] DW9Emp.exe+86FFB1 -- (3) 0F45 C8 -- cmovne ecx,eax // [01A4/420] DW9Emp.exe+86FFB4 -- (2) 3B CB -- cmp ecx,ebx // [01A6/422] DW9Emp.exe+86FFB6 -- (4) 44 0F42 E9 -- cmovb r13d,ecx // [01AA/426] DW9Emp.exe+86FFBA -- (7) 48 8B 0D 3FC2BC01 -- mov rcx,[DW9Emp.exe+243C200] -- [B9A507D0] // [01B1/433] DW9Emp.exe+86FFC1 -- (8) 44 89 AC 24 E0010000 -- mov [rsp+000001E0],r13d // [01B9/441] DW9Emp.exe+86FFC9 -- (3) 48 85 C9 -- test rcx,rcx // [01BC/444] DW9Emp.exe+86FFCC -- (2) 74 5B -- je DW9Emp.exe+870029 // [01BE/446] DW9Emp.exe+86FFCE -- (6) 3B B9 A0E60A00 -- cmp edi,[rcx+000AE6A0] // [01C4/452] DW9Emp.exe+86FFD4 -- (3) 41 8B C7 -- mov eax,r15d // [01C7/455] DW9Emp.exe+86FFD7 -- (3) 0F42 C7 -- cmovb eax,edi // [01CA/458] DW9Emp.exe+86FFDA -- (7) 4C 69 E8 78010000 -- imul r13,rax,00000178 // [01D1/465] DW9Emp.exe+86FFE1 -- (3) 4C 03 E9 -- add r13,rcx // [01D4/468] DW9Emp.exe+86FFE4 -- (2) 74 3B -- je DW9Emp.exe+870021 // [01D6/470] DW9Emp.exe+86FFE6 -- (8) 41 0FB6 85 CB000000 -- movzx eax,byte ptr [r13+000000CB] // [01DE/478] DW9Emp.exe+86FFEE -- (3) 41 8B DF -- mov ebx,r15d // [01E1/481] DW9Emp.exe+86FFF1 -- (2) 85 C0 -- test eax,eax // [01E3/483] DW9Emp.exe+86FFF3 -- (2) 8B CF -- mov ecx,edi // [01E5/485] DW9Emp.exe+86FFF5 -- (3) 0F45 D8 -- cmovne ebx,eax // [01E8/488] DW9Emp.exe+86FFF8 -- (5) E8 D382FFFF -- call DW9Emp.exe+8682D0 // [01ED/493] DW9Emp.exe+86FFFD -- (5) B9 64000000 -- mov ecx,00000064 // [01F2/498] DW9Emp.exe+870002 -- (2) 3B D9 -- cmp ebx,ecx // [01F4/500] DW9Emp.exe+870004 -- (3) 0F42 CB -- cmovb ecx,ebx // [01F7/503] DW9Emp.exe+870007 -- (3) 41 03 C6 -- add eax,r14d // [01FA/506] DW9Emp.exe+87000A -- (2) 03 C8 -- add ecx,eax // [01FC/508] DW9Emp.exe+87000C -- (5) BB 64000000 -- mov ebx,00000064 // [0201/513] DW9Emp.exe+870011 -- (3) 83 F9 64 -- cmp ecx,64 // [0204/516] DW9Emp.exe+870014 -- (3) 0FB6 C1 -- movzx eax,cl // [0207/519] DW9Emp.exe+870017 -- (3) 0F47 C3 -- cmova eax,ebx // [020A/522] DW9Emp.exe+87001A -- (7) 41 88 85 CB000000 -- mov [r13+000000CB],al // [0211/529] DW9Emp.exe+870021 -- (8) 44 8B AC 24 E0010000 -- mov r13d,[rsp+000001E0] // [0219/537] DW9Emp.exe+870029 -- (2) 8B CF -- mov ecx,edi // [021B/539] DW9Emp.exe+87002B -- (5) E8 0065E0FF -- call DW9Emp.exe+676530 // [0220/544] DW9Emp.exe+870030 -- (8) 4C 8B B4 24 A8010000 -- mov r14,[rsp+000001A8] // [0228/552] DW9Emp.exe+870038 -- (5) 48 8D 4C 24 20 -- lea rcx,[rsp+20] // [022D/557] DW9Emp.exe+87003D -- (3) 48 8B D5 -- mov rdx,rbp // [0230/560] DW9Emp.exe+870040 -- (7) 48 8D 89 80000000 -- lea rcx,[rcx+00000080] // [0237/567] DW9Emp.exe+870047 -- (3) 0F10 00 -- movups xmm0,[rax] // [023A/570] DW9Emp.exe+87004A -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [023E/574] DW9Emp.exe+87004E -- (7) 48 8D 80 80000000 -- lea rax,[rax+00000080] // [0245/581] DW9Emp.exe+870055 -- (4) 0F11 41 80 -- movups [rcx-80],xmm0 // [0249/585] DW9Emp.exe+870059 -- (4) 0F10 40 A0 -- movups xmm0,[rax-60] // [024D/589] DW9Emp.exe+87005D -- (4) 0F11 49 90 -- movups [rcx-70],xmm1 // [0251/593] DW9Emp.exe+870061 -- (4) 0F10 48 B0 -- movups xmm1,[rax-50] // [0255/597] DW9Emp.exe+870065 -- (4) 0F11 41 A0 -- movups [rcx-60],xmm0 // [0259/601] DW9Emp.exe+870069 -- (4) 0F10 40 C0 -- movups xmm0,[rax-40] // [025D/605] DW9Emp.exe+87006D -- (4) 0F11 49 B0 -- movups [rcx-50],xmm1 // [0261/609] DW9Emp.exe+870071 -- (4) 0F10 48 D0 -- movups xmm1,[rax-30] // [0265/613] DW9Emp.exe+870075 -- (4) 0F11 41 C0 -- movups [rcx-40],xmm0 // [0269/617] DW9Emp.exe+870079 -- (4) 0F10 40 E0 -- movups xmm0,[rax-20] // [026D/621] DW9Emp.exe+87007D -- (4) 0F11 49 D0 -- movups [rcx-30],xmm1 // [0271/625] DW9Emp.exe+870081 -- (4) 0F10 48 F0 -- movups xmm1,[rax-10] // [0275/629] DW9Emp.exe+870085 -- (4) 0F11 41 E0 -- movups [rcx-20],xmm0 // [0279/633] DW9Emp.exe+870089 -- (4) 0F11 49 F0 -- movups [rcx-10],xmm1 // [027D/637] DW9Emp.exe+87008D -- (4) 48 83 EA 01 -- sub rdx,01 // [0281/641] DW9Emp.exe+870091 -- (2) 75 AD -- jne DW9Emp.exe+870040 // [0283/643] DW9Emp.exe+870093 -- (3) 0F10 00 -- movups xmm0,[rax] // [0286/646] DW9Emp.exe+870096 -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [028A/650] DW9Emp.exe+87009A -- (3) 0F11 01 -- movups [rcx],xmm0 // [028D/653] DW9Emp.exe+87009D -- (4) 0F10 40 20 -- movups xmm0,[rax+20] // [0291/657] DW9Emp.exe+8700A1 -- (4) 0F11 49 10 -- movups [rcx+10],xmm1 // [0295/661] DW9Emp.exe+8700A5 -- (4) 0F10 48 30 -- movups xmm1,[rax+30] // [0299/665] DW9Emp.exe+8700A9 -- (4) 0F11 41 20 -- movups [rcx+20],xmm0 // [029D/669] DW9Emp.exe+8700AD -- (4) 0F10 40 40 -- movups xmm0,[rax+40] // [02A1/673] DW9Emp.exe+8700B1 -- (4) 0F11 49 30 -- movups [rcx+30],xmm1 // [02A5/677] DW9Emp.exe+8700B5 -- (4) 0F10 48 50 -- movups xmm1,[rax+50] // [02A9/681] DW9Emp.exe+8700B9 -- (4) 0F11 41 40 -- movups [rcx+40],xmm0 // [02AD/685] DW9Emp.exe+8700BD -- (4) 0F10 40 60 -- movups xmm0,[rax+60] // [02B1/689] DW9Emp.exe+8700C1 -- (4) 48 8B 40 70 -- mov rax,[rax+70] // [02B5/693] DW9Emp.exe+8700C5 -- (4) 0F11 49 50 -- movups [rcx+50],xmm1 // [02B9/697] DW9Emp.exe+8700C9 -- (4) 0F11 41 60 -- movups [rcx+60],xmm0 // [02BD/701] DW9Emp.exe+8700CD -- (4) 48 89 41 70 -- mov [rcx+70],rax // [02C1/705] DW9Emp.exe+8700D1 -- (8) 0FB6 84 24 EB000000 -- movzx eax,byte ptr [rsp+000000EB] // [02C9/713] DW9Emp.exe+8700D9 -- (2) 85 C0 -- test eax,eax // [02CB/715] DW9Emp.exe+8700DB -- (4) 44 0F45 F8 -- cmovne r15d,eax // [02CF/719] DW9Emp.exe+8700DF -- (7) 48 8B 05 F2BDBD01 -- mov rax,[DW9Emp.exe+244BED8] -- [D5894BC0] // [02D6/726] DW9Emp.exe+8700E6 -- (4) 41 83 FF 64 -- cmp r15d,64 // [02DA/730] DW9Emp.exe+8700EA -- (4) 41 0F42 DF -- cmovb ebx,r15d // [02DE/734] DW9Emp.exe+8700EE -- (8) 4C 8B BC 24 A0010000 -- mov r15,[rsp+000001A0] // [02E6/742] DW9Emp.exe+8700F6 -- (6) 89 98 18910200 -- mov [rax+00029118],ebx // [02EC/748] DW9Emp.exe+8700FC -- (7) 48 8B 1D 8DBCBD01 -- mov rbx,[DW9Emp.exe+244BD90] -- [D457A990] // [02F3/755] DW9Emp.exe+870103 -- (7) 44 89 A8 14910200 -- mov [rax+00029114],r13d // [02FA/762] DW9Emp.exe+87010A -- (8) 4C 8B AC 24 B0010000 -- mov r13,[rsp+000001B0] // [0302/770] DW9Emp.exe+870112 -- (6) 89 B8 10910200 -- mov [rax+00029110],edi // [0308/776] DW9Emp.exe+870118 -- (3) 48 85 DB -- test rbx,rbx // [030B/779] DW9Emp.exe+87011B -- (6) 0F84 24010000 -- je DW9Emp.exe+870245 // [0311/785] DW9Emp.exe+870121 -- (7) 38 94 24 E8010000 -- cmp [rsp+000001E8],dl // [0318/792] DW9Emp.exe+870128 -- (6) 0F85 17010000 -- jne DW9Emp.exe+870245 // [031E/798] DW9Emp.exe+87012E -- (10) C7 83 CC7E0000 1D000000 -- mov [rbx+00007ECC],0000001D // [0328/808] DW9Emp.exe+870138 -- (7) 4C 8D 05 D1D5DE01 -- lea r8,[DW9Emp.exe+265D710] -- [00000000] // [032F/815] DW9Emp.exe+87013F -- (6) 41 0FBF 44 78 18 -- movsx eax,word ptr [r8+rdi*2+18] // [0335/821] DW9Emp.exe+870145 -- (4) 49 8D 14 78 -- lea rdx,[r8+rdi*2] // [0339/825] DW9Emp.exe+870149 -- (5) 3D F5090000 -- cmp eax,000009F5 // [033E/830] DW9Emp.exe+87014E -- (2) 8B CE -- mov ecx,esi // [0340/832] DW9Emp.exe+870150 -- (3) 0F46 C8 -- cmovbe ecx,eax // [0343/835] DW9Emp.exe+870153 -- (6) 89 8B D47E0000 -- mov [rbx+00007ED4],ecx // [0349/841] DW9Emp.exe+870159 -- (7) 41 81 FC 6B070000 -- cmp r12d,0000076B // [0350/848] DW9Emp.exe+870160 -- (2) 77 16 -- ja DW9Emp.exe+870178 // [0352/850] DW9Emp.exe+870162 -- (3) 49 63 C4 -- movsxd rax,r12d // [0355/853] DW9Emp.exe+870165 -- (6) 41 0FBF 4C 40 18 -- movsx ecx,word ptr [r8+rax*2+18] // [035B/859] DW9Emp.exe+87016B -- (2) 8B C6 -- mov eax,esi // [035D/861] DW9Emp.exe+87016D -- (6) 81 F9 F5090000 -- cmp ecx,000009F5 // [0363/867] DW9Emp.exe+870173 -- (3) 0F46 C1 -- cmovbe eax,ecx // [0366/870] DW9Emp.exe+870176 -- (2) EB 02 -- jmp DW9Emp.exe+87017A // [0368/872] DW9Emp.exe+870178 -- (2) 8B C6 -- mov eax,esi // [036A/874] DW9Emp.exe+87017A -- (6) 89 83 D87E0000 -- mov [rbx+00007ED8],eax // [0370/880] DW9Emp.exe+870180 -- (2) 8B CE -- mov ecx,esi // [0372/882] DW9Emp.exe+870182 -- (4) 0FBF 42 18 -- movsx eax,word ptr [rdx+18] // [0376/886] DW9Emp.exe+870186 -- (5) 3D F5090000 -- cmp eax,000009F5 // [037B/891] DW9Emp.exe+87018B -- (3) 0F46 C8 -- cmovbe ecx,eax // [037E/894] DW9Emp.exe+87018E -- (6) 89 8B 007F0000 -- mov [rbx+00007F00],ecx // [0384/900] DW9Emp.exe+870194 -- (2) 8B CF -- mov ecx,edi // [0386/902] DW9Emp.exe+870196 -- (5) E8 9563E0FF -- call DW9Emp.exe+676530 // [038B/907] DW9Emp.exe+87019B -- (5) 48 8D 4C 24 20 -- lea rcx,[rsp+20] // [0390/912] DW9Emp.exe+8701A0 -- (7) 48 8D 89 80000000 -- lea rcx,[rcx+00000080] // [0397/919] DW9Emp.exe+8701A7 -- (3) 0F10 00 -- movups xmm0,[rax] // [039A/922] DW9Emp.exe+8701AA -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [039E/926] DW9Emp.exe+8701AE -- (7) 48 8D 80 80000000 -- lea rax,[rax+00000080] // [03A5/933] DW9Emp.exe+8701B5 -- (4) 0F11 41 80 -- movups [rcx-80],xmm0 // [03A9/937] DW9Emp.exe+8701B9 -- (4) 0F10 40 A0 -- movups xmm0,[rax-60] // [03AD/941] DW9Emp.exe+8701BD -- (4) 0F11 49 90 -- movups [rcx-70],xmm1 // [03B1/945] DW9Emp.exe+8701C1 -- (4) 0F10 48 B0 -- movups xmm1,[rax-50] // [03B5/949] DW9Emp.exe+8701C5 -- (4) 0F11 41 A0 -- movups [rcx-60],xmm0 // [03B9/953] DW9Emp.exe+8701C9 -- (4) 0F10 40 C0 -- movups xmm0,[rax-40] // [03BD/957] DW9Emp.exe+8701CD -- (4) 0F11 49 B0 -- movups [rcx-50],xmm1 // [03C1/961] DW9Emp.exe+8701D1 -- (4) 0F10 48 D0 -- movups xmm1,[rax-30] // [03C5/965] DW9Emp.exe+8701D5 -- (4) 0F11 41 C0 -- movups [rcx-40],xmm0 // [03C9/969] DW9Emp.exe+8701D9 -- (4) 0F10 40 E0 -- movups xmm0,[rax-20] // [03CD/973] DW9Emp.exe+8701DD -- (4) 0F11 49 D0 -- movups [rcx-30],xmm1 // [03D1/977] DW9Emp.exe+8701E1 -- (4) 0F10 48 F0 -- movups xmm1,[rax-10] // [03D5/981] DW9Emp.exe+8701E5 -- (4) 0F11 41 E0 -- movups [rcx-20],xmm0 // [03D9/985] DW9Emp.exe+8701E9 -- (4) 0F11 49 F0 -- movups [rcx-10],xmm1 // [03DD/989] DW9Emp.exe+8701ED -- (4) 48 83 ED 01 -- sub rbp,01 // [03E1/993] DW9Emp.exe+8701F1 -- (2) 75 AD -- jne DW9Emp.exe+8701A0 // [03E3/995] DW9Emp.exe+8701F3 -- (3) 0F10 00 -- movups xmm0,[rax] // [03E6/998] DW9Emp.exe+8701F6 -- (4) 0F10 48 10 -- movups xmm1,[rax+10] // [03EA/1002] DW9Emp.exe+8701FA -- (3) 0F11 01 -- movups [rcx],xmm0 // [03ED/1005] DW9Emp.exe+8701FD -- (4) 0F10 40 20 -- movups xmm0,[rax+20] // [03F1/1009] DW9Emp.exe+870201 -- (4) 0F11 49 10 -- movups [rcx+10],xmm1 // [03F5/1013] DW9Emp.exe+870205 -- (4) 0F10 48 30 -- movups xmm1,[rax+30] // [03F9/1017] DW9Emp.exe+870209 -- (4) 0F11 41 20 -- movups [rcx+20],xmm0 // [03FD/1021] DW9Emp.exe+87020D -- (4) 0F10 40 40 -- movups xmm0,[rax+40] // [0401/1025] DW9Emp.exe+870211 -- (4) 0F11 49 30 -- movups [rcx+30],xmm1 // [0405/1029] DW9Emp.exe+870215 -- (4) 0F10 48 50 -- movups xmm1,[rax+50] // [0409/1033] DW9Emp.exe+870219 -- (4) 0F11 41 40 -- movups [rcx+40],xmm0 // [040D/1037] DW9Emp.exe+87021D -- (4) 0F10 40 60 -- movups xmm0,[rax+60] // [0411/1041] DW9Emp.exe+870221 -- (4) 48 8B 40 70 -- mov rax,[rax+70] // [0415/1045] DW9Emp.exe+870225 -- (4) 0F11 49 50 -- movups [rcx+50],xmm1 // [0419/1049] DW9Emp.exe+870229 -- (4) 0F11 41 60 -- movups [rcx+60],xmm0 // [041D/1053] DW9Emp.exe+87022D -- (4) 48 89 41 70 -- mov [rcx+70],rax // [0421/1057] DW9Emp.exe+870231 -- (8) 0FBE 84 24 DB000000 -- movsx eax,byte ptr [rsp+000000DB] // [0429/1065] DW9Emp.exe+870239 -- (3) 83 F8 27 -- cmp eax,27 // [042C/1068] DW9Emp.exe+87023C -- (3) 0F46 F0 -- cmovbe esi,eax // [042F/1071] DW9Emp.exe+87023F -- (6) 89 B3 D07E0000 -- mov [rbx+00007ED0],esi // [0435/1077] DW9Emp.exe+870245 -- (5) B9 0A000000 -- mov ecx,0000000A // [043A/1082] DW9Emp.exe+87024A -- (5) E8 7132FEFF -- call DW9Emp.exe+8534C0 // [043F/1087] DW9Emp.exe+87024F -- (2) 8B CF -- mov ecx,edi // [0441/1089] DW9Emp.exe+870251 -- (5) E8 8A5ADAFF -- call DW9Emp.exe+615CE0 // [0446/1094] DW9Emp.exe+870256 -- (7) 48 8B 0D 33BBBD01 -- mov rcx,[DW9Emp.exe+244BD90] -- [D457A990] // [044D/1101] DW9Emp.exe+87025D -- (8) 4C 8B A4 24 B8010000 -- mov r12,[rsp+000001B8] // [0455/1109] DW9Emp.exe+870265 -- (8) 48 8B B4 24 C0010000 -- mov rsi,[rsp+000001C0] // [045D/1117] DW9Emp.exe+87026D -- (8) 48 8B AC 24 C8010000 -- mov rbp,[rsp+000001C8] // [0465/1125] DW9Emp.exe+870275 -- (8) 48 8B 9C 24 F0010000 -- mov rbx,[rsp+000001F0] // [046D/1133] DW9Emp.exe+87027D -- (3) 48 85 C9 -- test rcx,rcx // [0470/1136] DW9Emp.exe+870280 -- (2) 74 05 -- je DW9Emp.exe+870287 // [0472/1138] DW9Emp.exe+870282 -- (5) E8 4936FBFF -- call DW9Emp.exe+8238D0 // [0477/1143] DW9Emp.exe+870287 -- (7) 48 81 C4 D0010000 -- add rsp,000001D0 // [047E/1150] DW9Emp.exe+87028E -- (1) 5F -- pop rdi // [047F/1151] DW9Emp.exe+87028F -- (1) C3 -- ret } 7 "[$ASM] Max Reputation" C08000 Auto Assembler Script [ENABLE] aobscanmodule(GET_REP,DW9Emp.exe,00 0F B7 44 48 04) alloc(newmem,$1000,GET_REP) label(code) label(return) newmem: // left for // specific rep types (0-5), prevent evil from rising and so on mov [rax+rcx*2+04],#320 // SET #0 to reset rep code: movzx eax,word ptr [rax+rcx*2+04] jmp return GET_REP+01: jmp newmem return: registersymbol(GET_REP) [DISABLE] GET_REP+01: db 0F B7 44 48 04 unregistersymbol(GET_REP) dealloc(newmem) { Function dump of "DW9Emp.exe+F93ADA" ~ Function header aob : "F9 00 CC CC CC CC CC CC CC CC 48 89 5C 24 08" ~ // [0000/0] DW9Emp.exe+F93AA0 -- (5) 48 89 5C 24 08 -- mov [rsp+08],rbx // [0005/5] DW9Emp.exe+F93AA5 -- (5) 48 89 74 24 10 -- mov [rsp+10],rsi // [000A/10] DW9Emp.exe+F93AAA -- (1) 57 -- push rdi // [000B/11] DW9Emp.exe+F93AAB -- (4) 48 83 EC 20 -- sub rsp,20 // [000F/15] DW9Emp.exe+F93AAF -- (7) 4C 8B 0D 6A874A01 -- mov r9,[DW9Emp.exe+243C220] -- [5728E7D0] // [0016/22] DW9Emp.exe+F93AB6 -- (2) 33 F6 -- xor esi,esi // [0018/24] DW9Emp.exe+F93AB8 -- (2) 8B DE -- mov ebx,esi // [001A/26] DW9Emp.exe+F93ABA -- (3) 48 8B F9 -- mov rdi,rcx // [001D/29] DW9Emp.exe+F93ABD -- (3) 0F1F 00 -- nop dword ptr [rax] // [0020/32] DW9Emp.exe+F93AC0 -- (3) 83 FB 09 -- cmp ebx,09 // [0023/35] DW9Emp.exe+F93AC3 -- (2) 76 04 -- jna DW9Emp.exe+F93AC9 // [0025/37] DW9Emp.exe+F93AC5 -- (2) 8B D6 -- mov edx,esi // [0027/39] DW9Emp.exe+F93AC7 -- (2) EB 2D -- jmp DW9Emp.exe+F93AF6 // [0029/41] DW9Emp.exe+F93AC9 -- (5) E8 52BA6DFF -- call DW9Emp.exe+66F520 // [002E/46] DW9Emp.exe+F93ACE -- (3) 83 FB 0A -- cmp ebx,0A // [0031/49] DW9Emp.exe+F93AD1 -- (2) 73 1A -- jae DW9Emp.exe+F93AED // [0033/51] DW9Emp.exe+F93AD3 -- (2) 8B CB -- mov ecx,ebx // [0035/53] DW9Emp.exe+F93AD5 -- (5) BA 0F270000 -- mov edx,0000270F // [003A/58] DW9Emp.exe+F93ADA -- (5) 0FB7 44 48 04 -- movzx eax,word ptr [rax+rcx*2+04] // [003F/63] DW9Emp.exe+F93ADF -- (2) 8B CE -- mov ecx,esi // [0041/65] DW9Emp.exe+F93AE1 -- (2) 85 C0 -- test eax,eax // [0043/67] DW9Emp.exe+F93AE3 -- (3) 0F45 C8 -- cmovne ecx,eax // [0046/70] DW9Emp.exe+F93AE6 -- (2) 3B CA -- cmp ecx,edx // [0048/72] DW9Emp.exe+F93AE8 -- (3) 0F42 D1 -- cmovb edx,ecx // [004B/75] DW9Emp.exe+F93AEB -- (2) EB 02 -- jmp DW9Emp.exe+F93AEF // [004D/77] DW9Emp.exe+F93AED -- (2) 8B D6 -- mov edx,esi // [004F/79] DW9Emp.exe+F93AEF -- (7) 4C 8B 0D 2A874A01 -- mov r9,[DW9Emp.exe+243C220] -- [5728E7D0] // [0056/86] DW9Emp.exe+F93AF6 -- (3) 3B 5F 6C -- cmp ebx,[rdi+6C] // [0059/89] DW9Emp.exe+F93AF9 -- (2) 8B C6 -- mov eax,esi // [005B/91] DW9Emp.exe+F93AFB -- (2) 8B CE -- mov ecx,esi // [005D/93] DW9Emp.exe+F93AFD -- (3) 0F57 C0 -- xorps xmm0,xmm0 // [0060/96] DW9Emp.exe+F93B00 -- (3) 0F42 C3 -- cmovb eax,ebx // [0063/99] DW9Emp.exe+F93B03 -- (4) 89 54 87 54 -- mov [rdi+rax*4+54],edx // [0067/103] DW9Emp.exe+F93B07 -- (2) 8B C6 -- mov eax,esi // [0069/105] DW9Emp.exe+F93B09 -- (3) 3B 5F 6C -- cmp ebx,[rdi+6C] // [006C/108] DW9Emp.exe+F93B0C -- (3) 0F42 C3 -- cmovb eax,ebx // [006F/111] DW9Emp.exe+F93B0F -- (6) 3B 9F 88000000 -- cmp ebx,[rdi+00000088] // [0075/117] DW9Emp.exe+F93B15 -- (3) 0F42 CB -- cmovb ecx,ebx // [0078/120] DW9Emp.exe+F93B18 -- (4) 8B 44 87 54 -- mov eax,[rdi+rax*4+54] // [007C/124] DW9Emp.exe+F93B1C -- (4) 89 44 8F 70 -- mov [rdi+rcx*4+70],eax // [0080/128] DW9Emp.exe+F93B20 -- (2) 8B C6 -- mov eax,esi // [0082/130] DW9Emp.exe+F93B22 -- (3) 3B 5F 6C -- cmp ebx,[rdi+6C] // [0085/133] DW9Emp.exe+F93B25 -- (3) 0F42 C3 -- cmovb eax,ebx // [0088/136] DW9Emp.exe+F93B28 -- (6) 3B 9F A4000000 -- cmp ebx,[rdi+000000A4] // [008E/142] DW9Emp.exe+F93B2E -- (4) 8B 4C 87 54 -- mov ecx,[rdi+rax*4+54] // [0092/146] DW9Emp.exe+F93B32 -- (2) 8B C6 -- mov eax,esi // [0094/148] DW9Emp.exe+F93B34 -- (3) 0F42 C3 -- cmovb eax,ebx // [0097/151] DW9Emp.exe+F93B37 -- (5) F3 48 0F2A C1 -- cvtsi2ss xmm0,rcx // [009C/156] DW9Emp.exe+F93B3C -- (9) F3 0F11 84 87 8C000000 -- movss [rdi+rax*4+0000008C],xmm0 // [00A5/165] DW9Emp.exe+F93B45 -- (2) 8B C6 -- mov eax,esi // [00A7/167] DW9Emp.exe+F93B47 -- (6) 3B 9F C0000000 -- cmp ebx,[rdi+000000C0] // [00AD/173] DW9Emp.exe+F93B4D -- (3) 0F42 C3 -- cmovb eax,ebx // [00B0/176] DW9Emp.exe+F93B50 -- (7) 89 B4 87 A8000000 -- mov [rdi+rax*4+000000A8],esi // [00B7/183] DW9Emp.exe+F93B57 -- (3) 83 FB 09 -- cmp ebx,09 // [00BA/186] DW9Emp.exe+F93B5A -- (2) 76 04 -- jna DW9Emp.exe+F93B60 // [00BC/188] DW9Emp.exe+F93B5C -- (2) 8B C6 -- mov eax,esi // [00BE/190] DW9Emp.exe+F93B5E -- (2) EB 3D -- jmp DW9Emp.exe+F93B9D // [00C0/192] DW9Emp.exe+F93B60 -- (3) 83 FB FF -- cmp ebx,-01 // [00C3/195] DW9Emp.exe+F93B63 -- (2) 75 04 -- jne DW9Emp.exe+F93B69 // [00C5/197] DW9Emp.exe+F93B65 -- (2) 8B C6 -- mov eax,esi // [00C7/199] DW9Emp.exe+F93B67 -- (2) EB 34 -- jmp DW9Emp.exe+F93B9D // [00C9/201] DW9Emp.exe+F93B69 -- (5) E8 B2B96DFF -- call DW9Emp.exe+66F520 // [00CE/206] DW9Emp.exe+F93B6E -- (3) 83 FB 0A -- cmp ebx,0A // [00D1/209] DW9Emp.exe+F93B71 -- (2) 73 1A -- jae DW9Emp.exe+F93B8D // [00D3/211] DW9Emp.exe+F93B73 -- (2) 8B CB -- mov ecx,ebx // [00D5/213] DW9Emp.exe+F93B75 -- (5) 0FB7 44 48 04 -- movzx eax,word ptr [rax+rcx*2+04] // [00DA/218] DW9Emp.exe+F93B7A -- (2) 8B CE -- mov ecx,esi // [00DC/220] DW9Emp.exe+F93B7C -- (2) 85 C0 -- test eax,eax // [00DE/222] DW9Emp.exe+F93B7E -- (3) 0F45 C8 -- cmovne ecx,eax // [00E1/225] DW9Emp.exe+F93B81 -- (5) B8 0F270000 -- mov eax,0000270F // [00E6/230] DW9Emp.exe+F93B86 -- (2) 3B C8 -- cmp ecx,eax // [00E8/232] DW9Emp.exe+F93B88 -- (3) 0F42 C1 -- cmovb eax,ecx // [00EB/235] DW9Emp.exe+F93B8B -- (2) EB 02 -- jmp DW9Emp.exe+F93B8F // [00ED/237] DW9Emp.exe+F93B8D -- (2) 8B C6 -- mov eax,esi // [00EF/239] DW9Emp.exe+F93B8F -- (2) 8B C8 -- mov ecx,eax // [00F1/241] DW9Emp.exe+F93B91 -- (5) E8 5A1D8DFF -- call DW9Emp.exe+8658F0 // [00F6/246] DW9Emp.exe+F93B96 -- (7) 4C 8B 0D 83864A01 -- mov r9,[DW9Emp.exe+243C220] -- [5728E7D0] // [00FD/253] DW9Emp.exe+F93B9D -- (6) 3B 9F DC000000 -- cmp ebx,[rdi+000000DC] // [0103/259] DW9Emp.exe+F93BA3 -- (2) 8B CE -- mov ecx,esi // [0105/261] DW9Emp.exe+F93BA5 -- (3) 0F42 CB -- cmovb ecx,ebx // [0108/264] DW9Emp.exe+F93BA8 -- (7) 89 84 8F C4000000 -- mov [rdi+rcx*4+000000C4],eax // [010F/271] DW9Emp.exe+F93BAF -- (2) 8B C6 -- mov eax,esi // [0111/273] DW9Emp.exe+F93BB1 -- (6) 3B 9F DC000000 -- cmp ebx,[rdi+000000DC] // [0117/279] DW9Emp.exe+F93BB7 -- (2) 8B CE -- mov ecx,esi // [0119/281] DW9Emp.exe+F93BB9 -- (3) 0F42 C3 -- cmovb eax,ebx // [011C/284] DW9Emp.exe+F93BBC -- (6) 3B 9F F8000000 -- cmp ebx,[rdi+000000F8] // [0122/290] DW9Emp.exe+F93BC2 -- (3) 0F42 CB -- cmovb ecx,ebx // [0125/293] DW9Emp.exe+F93BC5 -- (7) 8B 84 87 C4000000 -- mov eax,[rdi+rax*4+000000C4] // [012C/300] DW9Emp.exe+F93BCC -- (7) 89 84 8F E0000000 -- mov [rdi+rcx*4+000000E0],eax // [0133/307] DW9Emp.exe+F93BD3 -- (2) 8B C6 -- mov eax,esi // [0135/309] DW9Emp.exe+F93BD5 -- (6) 3B 9F DC000000 -- cmp ebx,[rdi+000000DC] // [013B/315] DW9Emp.exe+F93BDB -- (2) 8B CE -- mov ecx,esi // [013D/317] DW9Emp.exe+F93BDD -- (3) 0F42 C3 -- cmovb eax,ebx // [0140/320] DW9Emp.exe+F93BE0 -- (6) 3B 9F 14010000 -- cmp ebx,[rdi+00000114] // [0146/326] DW9Emp.exe+F93BE6 -- (3) 0F42 CB -- cmovb ecx,ebx // [0149/329] DW9Emp.exe+F93BE9 -- (7) 8B 84 87 C4000000 -- mov eax,[rdi+rax*4+000000C4] // [0150/336] DW9Emp.exe+F93BF0 -- (7) 89 84 8F FC000000 -- mov [rdi+rcx*4+000000FC],eax // [0157/343] DW9Emp.exe+F93BF7 -- (2) 8B C6 -- mov eax,esi // [0159/345] DW9Emp.exe+F93BF9 -- (3) 3B 5F 6C -- cmp ebx,[rdi+6C] // [015C/348] DW9Emp.exe+F93BFC -- (3) 0F42 C3 -- cmovb eax,ebx // [015F/351] DW9Emp.exe+F93BFF -- (4) 8B 54 87 54 -- mov edx,[rdi+rax*4+54] // [0163/355] DW9Emp.exe+F93C03 -- (3) 49 8B 01 -- mov rax,[r9] // [0166/358] DW9Emp.exe+F93C06 -- (6) 8B 88 38040000 -- mov ecx,[rax+00000438] // [016C/364] DW9Emp.exe+F93C0C -- (2) 3B D1 -- cmp edx,ecx // [016E/366] DW9Emp.exe+F93C0E -- (2) 73 04 -- jae DW9Emp.exe+F93C14 // [0170/368] DW9Emp.exe+F93C10 -- (2) 8B CE -- mov ecx,esi // [0172/370] DW9Emp.exe+F93C12 -- (2) EB 75 -- jmp DW9Emp.exe+F93C89 // [0174/372] DW9Emp.exe+F93C14 -- (7) 44 8B 80 3C040000 -- mov r8d,[rax+0000043C] // [017B/379] DW9Emp.exe+F93C1B -- (3) 41 3B D0 -- cmp edx,r8d // [017E/382] DW9Emp.exe+F93C1E -- (2) 72 69 -- jb DW9Emp.exe+F93C89 // [0180/384] DW9Emp.exe+F93C20 -- (6) 8B 88 40040000 -- mov ecx,[rax+00000440] // [0186/390] DW9Emp.exe+F93C26 -- (2) 3B D1 -- cmp edx,ecx // [0188/392] DW9Emp.exe+F93C28 -- (2) 73 05 -- jae DW9Emp.exe+F93C2F // [018A/394] DW9Emp.exe+F93C2A -- (3) 41 8B C8 -- mov ecx,r8d // [018D/397] DW9Emp.exe+F93C2D -- (2) EB 5A -- jmp DW9Emp.exe+F93C89 // [018F/399] DW9Emp.exe+F93C2F -- (7) 44 8B 80 44040000 -- mov r8d,[rax+00000444] // [0196/406] DW9Emp.exe+F93C36 -- (3) 41 3B D0 -- cmp edx,r8d // [0199/409] DW9Emp.exe+F93C39 -- (2) 72 4E -- jb DW9Emp.exe+F93C89 // [019B/411] DW9Emp.exe+F93C3B -- (6) 8B 88 48040000 -- mov ecx,[rax+00000448] // [01A1/417] DW9Emp.exe+F93C41 -- (2) 3B D1 -- cmp edx,ecx // [01A3/419] DW9Emp.exe+F93C43 -- (2) 73 05 -- jae DW9Emp.exe+F93C4A // [01A5/421] DW9Emp.exe+F93C45 -- (3) 41 8B C8 -- mov ecx,r8d // [01A8/424] DW9Emp.exe+F93C48 -- (2) EB 3F -- jmp DW9Emp.exe+F93C89 // [01AA/426] DW9Emp.exe+F93C4A -- (7) 44 8B 80 4C040000 -- mov r8d,[rax+0000044C] // [01B1/433] DW9Emp.exe+F93C51 -- (3) 41 3B D0 -- cmp edx,r8d // [01B4/436] DW9Emp.exe+F93C54 -- (2) 72 33 -- jb DW9Emp.exe+F93C89 // [01B6/438] DW9Emp.exe+F93C56 -- (6) 8B 88 50040000 -- mov ecx,[rax+00000450] // [01BC/444] DW9Emp.exe+F93C5C -- (2) 3B D1 -- cmp edx,ecx // [01BE/446] DW9Emp.exe+F93C5E -- (2) 73 05 -- jae DW9Emp.exe+F93C65 // [01C0/448] DW9Emp.exe+F93C60 -- (3) 41 8B C8 -- mov ecx,r8d // [01C3/451] DW9Emp.exe+F93C63 -- (2) EB 24 -- jmp DW9Emp.exe+F93C89 // [01C5/453] DW9Emp.exe+F93C65 -- (7) 44 8B 80 54040000 -- mov r8d,[rax+00000454] // [01CC/460] DW9Emp.exe+F93C6C -- (3) 41 3B D0 -- cmp edx,r8d // [01CF/463] DW9Emp.exe+F93C6F -- (2) 72 18 -- jb DW9Emp.exe+F93C89 // [01D1/465] DW9Emp.exe+F93C71 -- (6) 8B 88 58040000 -- mov ecx,[rax+00000458] // [01D7/471] DW9Emp.exe+F93C77 -- (2) 3B D1 -- cmp edx,ecx // [01D9/473] DW9Emp.exe+F93C79 -- (2) 73 05 -- jae DW9Emp.exe+F93C80 // [01DB/475] DW9Emp.exe+F93C7B -- (3) 41 8B C8 -- mov ecx,r8d // [01DE/478] DW9Emp.exe+F93C7E -- (2) EB 09 -- jmp DW9Emp.exe+F93C89 // [01E0/480] DW9Emp.exe+F93C80 -- (2) 74 07 -- je DW9Emp.exe+F93C89 // [01E2/482] DW9Emp.exe+F93C82 -- (2) 3B CA -- cmp ecx,edx // [01E4/484] DW9Emp.exe+F93C84 -- (2) 1B C9 -- sbb ecx,ecx // [01E6/486] DW9Emp.exe+F93C86 -- (3) 83 E1 0A -- and ecx,0A // [01E9/489] DW9Emp.exe+F93C89 -- (6) 3B 9F 30010000 -- cmp ebx,[rdi+00000130] // [01EF/495] DW9Emp.exe+F93C8F -- (2) 8B C6 -- mov eax,esi // [01F1/497] DW9Emp.exe+F93C91 -- (3) 0F42 C3 -- cmovb eax,ebx // [01F4/500] DW9Emp.exe+F93C94 -- (7) 89 8C 87 18010000 -- mov [rdi+rax*4+00000118],ecx // [01FB/507] DW9Emp.exe+F93C9B -- (2) 8B C6 -- mov eax,esi // [01FD/509] DW9Emp.exe+F93C9D -- (3) 3B 5F 6C -- cmp ebx,[rdi+6C] // [0200/512] DW9Emp.exe+F93CA0 -- (3) 0F42 C3 -- cmovb eax,ebx // [0203/515] DW9Emp.exe+F93CA3 -- (4) 8B 54 87 54 -- mov edx,[rdi+rax*4+54] // [0207/519] DW9Emp.exe+F93CA7 -- (3) 49 8B 01 -- mov rax,[r9] // [020A/522] DW9Emp.exe+F93CAA -- (6) 8B 88 38040000 -- mov ecx,[rax+00000438] // [0210/528] DW9Emp.exe+F93CB0 -- (2) 3B D1 -- cmp edx,ecx // [0212/530] DW9Emp.exe+F93CB2 -- (2) 73 04 -- jae DW9Emp.exe+F93CB8 // [0214/532] DW9Emp.exe+F93CB4 -- (2) FF C9 -- dec ecx // [0216/534] DW9Emp.exe+F93CB6 -- (2) EB 79 -- jmp DW9Emp.exe+F93D31 // [0218/536] DW9Emp.exe+F93CB8 -- (6) 8B 88 3C040000 -- mov ecx,[rax+0000043C] // [021E/542] DW9Emp.exe+F93CBE -- (2) 3B D1 -- cmp edx,ecx // [0220/544] DW9Emp.exe+F93CC0 -- (2) 73 04 -- jae DW9Emp.exe+F93CC6 // [0222/546] DW9Emp.exe+F93CC2 -- (2) FF C9 -- dec ecx // [0224/548] DW9Emp.exe+F93CC4 -- (2) EB 6B -- jmp DW9Emp.exe+F93D31 // [0226/550] DW9Emp.exe+F93CC6 -- (6) 8B 88 40040000 -- mov ecx,[rax+00000440] // [022C/556] DW9Emp.exe+F93CCC -- (2) 3B D1 -- cmp edx,ecx // [022E/558] DW9Emp.exe+F93CCE -- (2) 73 04 -- jae DW9Emp.exe+F93CD4 // [0230/560] DW9Emp.exe+F93CD0 -- (2) FF C9 -- dec ecx // [0232/562] DW9Emp.exe+F93CD2 -- (2) EB 5D -- jmp DW9Emp.exe+F93D31 // [0234/564] DW9Emp.exe+F93CD4 -- (6) 8B 88 44040000 -- mov ecx,[rax+00000444] // [023A/570] DW9Emp.exe+F93CDA -- (2) 3B D1 -- cmp edx,ecx // [023C/572] DW9Emp.exe+F93CDC -- (2) 73 04 -- jae DW9Emp.exe+F93CE2 // [023E/574] DW9Emp.exe+F93CDE -- (2) FF C9 -- dec ecx // [0240/576] DW9Emp.exe+F93CE0 -- (2) EB 4F -- jmp DW9Emp.exe+F93D31 // [0242/578] DW9Emp.exe+F93CE2 -- (6) 8B 88 48040000 -- mov ecx,[rax+00000448] // [0248/584] DW9Emp.exe+F93CE8 -- (2) 3B D1 -- cmp edx,ecx // [024A/586] DW9Emp.exe+F93CEA -- (2) 73 04 -- jae DW9Emp.exe+F93CF0 // [024C/588] DW9Emp.exe+F93CEC -- (2) FF C9 -- dec ecx // [024E/590] DW9Emp.exe+F93CEE -- (2) EB 41 -- jmp DW9Emp.exe+F93D31 // [0250/592] DW9Emp.exe+F93CF0 -- (6) 8B 88 4C040000 -- mov ecx,[rax+0000044C] // [0256/598] DW9Emp.exe+F93CF6 -- (2) 3B D1 -- cmp edx,ecx // [0258/600] DW9Emp.exe+F93CF8 -- (2) 73 04 -- jae DW9Emp.exe+F93CFE // [025A/602] DW9Emp.exe+F93CFA -- (2) FF C9 -- dec ecx // [025C/604] DW9Emp.exe+F93CFC -- (2) EB 33 -- jmp DW9Emp.exe+F93D31 // [025E/606] DW9Emp.exe+F93CFE -- (6) 8B 88 50040000 -- mov ecx,[rax+00000450] // [0264/612] DW9Emp.exe+F93D04 -- (2) 3B D1 -- cmp edx,ecx // [0266/614] DW9Emp.exe+F93D06 -- (2) 73 04 -- jae DW9Emp.exe+F93D0C // [0268/616] DW9Emp.exe+F93D08 -- (2) FF C9 -- dec ecx // [026A/618] DW9Emp.exe+F93D0A -- (2) EB 25 -- jmp DW9Emp.exe+F93D31 // [026C/620] DW9Emp.exe+F93D0C -- (6) 8B 88 54040000 -- mov ecx,[rax+00000454] // [0272/626] DW9Emp.exe+F93D12 -- (2) 3B D1 -- cmp edx,ecx // [0274/628] DW9Emp.exe+F93D14 -- (2) 73 04 -- jae DW9Emp.exe+F93D1A // [0276/630] DW9Emp.exe+F93D16 -- (2) FF C9 -- dec ecx // [0278/632] DW9Emp.exe+F93D18 -- (2) EB 17 -- jmp DW9Emp.exe+F93D31 // [027A/634] DW9Emp.exe+F93D1A -- (6) 8B 88 58040000 -- mov ecx,[rax+00000458] // [0280/640] DW9Emp.exe+F93D20 -- (2) 3B D1 -- cmp edx,ecx // [0282/642] DW9Emp.exe+F93D22 -- (2) 73 04 -- jae DW9Emp.exe+F93D28 // [0284/644] DW9Emp.exe+F93D24 -- (2) FF C9 -- dec ecx // [0286/646] DW9Emp.exe+F93D26 -- (2) EB 09 -- jmp DW9Emp.exe+F93D31 // [0288/648] DW9Emp.exe+F93D28 -- (2) 74 07 -- je DW9Emp.exe+F93D31 // [028A/650] DW9Emp.exe+F93D2A -- (2) 3B CA -- cmp ecx,edx // [028C/652] DW9Emp.exe+F93D2C -- (2) 1B C9 -- sbb ecx,ecx // [028E/654] DW9Emp.exe+F93D2E -- (3) 83 E1 0A -- and ecx,0A // [0291/657] DW9Emp.exe+F93D31 -- (6) 3B 9F 4C010000 -- cmp ebx,[rdi+0000014C] // [0297/663] DW9Emp.exe+F93D37 -- (2) 8B C6 -- mov eax,esi // [0299/665] DW9Emp.exe+F93D39 -- (2) 8B D6 -- mov edx,esi // [029B/667] DW9Emp.exe+F93D3B -- (3) 0F42 C3 -- cmovb eax,ebx // [029E/670] DW9Emp.exe+F93D3E -- (7) 89 8C 87 34010000 -- mov [rdi+rax*4+00000134],ecx // [02A5/677] DW9Emp.exe+F93D45 -- (3) 3B 5F 6C -- cmp ebx,[rdi+6C] // [02A8/680] DW9Emp.exe+F93D48 -- (3) 49 8B 01 -- mov rax,[r9] // [02AB/683] DW9Emp.exe+F93D4B -- (3) 0F42 D3 -- cmovb edx,ebx // [02AE/686] DW9Emp.exe+F93D4E -- (6) 8B 88 58040000 -- mov ecx,[rax+00000458] // [02B4/692] DW9Emp.exe+F93D54 -- (2) 8B C6 -- mov eax,esi // [02B6/694] DW9Emp.exe+F93D56 -- (4) 39 4C 97 54 -- cmp [rdi+rdx*4+54],ecx // [02BA/698] DW9Emp.exe+F93D5A -- (3) 0F93 C1 -- setae cl // [02BD/701] DW9Emp.exe+F93D5D -- (6) 3B 9F 58010000 -- cmp ebx,[rdi+00000158] // [02C3/707] DW9Emp.exe+F93D63 -- (3) 0F42 C3 -- cmovb eax,ebx // [02C6/710] DW9Emp.exe+F93D66 -- (7) 88 8C 38 50010000 -- mov [rax+rdi+00000150],cl // [02CD/717] DW9Emp.exe+F93D6D -- (2) 8B C6 -- mov eax,esi // [02CF/719] DW9Emp.exe+F93D6F -- (6) 3B 9F 78010000 -- cmp ebx,[rdi+00000178] // [02D5/725] DW9Emp.exe+F93D75 -- (3) 0F42 C3 -- cmovb eax,ebx // [02D8/728] DW9Emp.exe+F93D78 -- (2) FF C3 -- inc ebx // [02DA/730] DW9Emp.exe+F93D7A -- (11) C7 84 87 60010000 1E000000 -- mov [rdi+rax*4+00000160],0000001E // [02E5/741] DW9Emp.exe+F93D85 -- (3) 83 FB 06 -- cmp ebx,06 // [02E8/744] DW9Emp.exe+F93D88 -- (6) 0F82 32FDFFFF -- jb DW9Emp.exe+F93AC0 // [02EE/750] DW9Emp.exe+F93D8E -- (5) 48 8B 5C 24 30 -- mov rbx,[rsp+30] // [02F3/755] DW9Emp.exe+F93D93 -- (6) 89 B7 5C010000 -- mov [rdi+0000015C],esi // [02F9/761] DW9Emp.exe+F93D99 -- (5) 48 8B 74 24 38 -- mov rsi,[rsp+38] // [02FE/766] DW9Emp.exe+F93D9E -- (4) 48 83 C4 20 -- add rsp,20 // [0302/770] DW9Emp.exe+F93DA2 -- (1) 5F -- pop rdi // [0303/771] DW9Emp.exe+F93DA3 -- (1) C3 -- ret } 8 "Battle phase" 1 9 "[$ASM] Increase run speed" C08000 Auto Assembler Script [ENABLE] aobscanmodule(GET_RUN,DW9Emp.exe,0F 4C F1 8B C6) registersymbol(GET_RUN) GET_RUN: mov eax,(float)1327 [DISABLE] GET_RUN: db 0F 4C F1 8B C6 unregistersymbol(GET_RUN) { Function dump of "DW9Emp.exe+6752A9" ~ Function header aob : "ERROR: Could not find unique AOB, tried code "48 89 5C 24 08"" ~ // CC's... // [0000/0] DW9Emp.exe+675120 -- (5) 48 89 5C 24 08 -- mov [rsp+08],rbx // [0005/5] DW9Emp.exe+675125 -- (5) 48 89 6C 24 10 -- mov [rsp+10],rbp // [000A/10] DW9Emp.exe+67512A -- (5) 48 89 74 24 18 -- mov [rsp+18],rsi // [000F/15] DW9Emp.exe+67512F -- (1) 57 -- push rdi // [0010/16] DW9Emp.exe+675130 -- (2) 41 54 -- push r12 // [0012/18] DW9Emp.exe+675132 -- (2) 41 55 -- push r13 // [0014/20] DW9Emp.exe+675134 -- (2) 41 56 -- push r14 // [0016/22] DW9Emp.exe+675136 -- (2) 41 57 -- push r15 // [0018/24] DW9Emp.exe+675138 -- (4) 48 83 EC 20 -- sub rsp,20 // [001C/28] DW9Emp.exe+67513C -- (4) 0FB7 41 0C -- movzx eax,word ptr [rcx+0C] // [0020/32] DW9Emp.exe+675140 -- (3) 45 33 ED -- xor r13d,r13d // [0023/35] DW9Emp.exe+675143 -- (2) 85 C0 -- test eax,eax // [0025/37] DW9Emp.exe+675145 -- (5) BE F4010000 -- mov esi,000001F4 // [002A/42] DW9Emp.exe+67514A -- (3) 45 8B CD -- mov r9d,r13d // [002D/45] DW9Emp.exe+67514D -- (3) 45 8B C5 -- mov r8d,r13d // [0030/48] DW9Emp.exe+675150 -- (4) 44 0F45 C8 -- cmovne r9d,eax // [0034/52] DW9Emp.exe+675154 -- (2) 8B EE -- mov ebp,esi // [0036/54] DW9Emp.exe+675156 -- (7) 0FB7 81 B8000000 -- movzx eax,word ptr [rcx+000000B8] // [003D/61] DW9Emp.exe+67515D -- (4) 44 0FB6 FA -- movzx r15d,dl // [0041/65] DW9Emp.exe+675161 -- (4) 0FBF 51 5C -- movsx edx,word ptr [rcx+5C] // [0045/69] DW9Emp.exe+675165 -- (2) 85 C0 -- test eax,eax // [0047/71] DW9Emp.exe+675167 -- (5) BB FFFFFFFF -- mov ebx,FFFFFFFF // [004C/76] DW9Emp.exe+67516C -- (3) 4C 8B F1 -- mov r14,rcx // [004F/79] DW9Emp.exe+67516F -- (4) 44 0F45 C0 -- cmovne r8d,eax // [0053/83] DW9Emp.exe+675173 -- (3) 44 3B CE -- cmp r9d,esi // [0056/86] DW9Emp.exe+675176 -- (5) B8 FFFF0000 -- mov eax,0000FFFF // [005B/91] DW9Emp.exe+67517B -- (4) 41 0F42 E9 -- cmovb ebp,r9d // [005F/95] DW9Emp.exe+67517F -- (3) 44 3B C0 -- cmp r8d,eax // [0062/98] DW9Emp.exe+675182 -- (6) 41 B9 01040000 -- mov r9d,00000401 // [0068/104] DW9Emp.exe+675188 -- (4) 41 0F42 C0 -- cmovb eax,r8d // [006C/108] DW9Emp.exe+67518C -- (3) 44 8B C2 -- mov r8d,edx // [006F/111] DW9Emp.exe+67518F -- (2) 03 E8 -- add ebp,eax // [0071/113] DW9Emp.exe+675191 -- (2) 8B C3 -- mov eax,ebx // [0073/115] DW9Emp.exe+675193 -- (4) 66 41 3B D1 -- cmp dx,r9w // [0077/119] DW9Emp.exe+675197 -- (2) 8B FD -- mov edi,ebp // [0079/121] DW9Emp.exe+675199 -- (3) 0F46 C2 -- cmovbe eax,edx // [007C/124] DW9Emp.exe+67519C -- (3) 41 3B C1 -- cmp eax,r9d // [007F/127] DW9Emp.exe+67519F -- (2) 77 25 -- ja DW9Emp.exe+6751C6 // [0081/129] DW9Emp.exe+6751A1 -- (4) 66 41 3B D1 -- cmp dx,r9w // [0085/133] DW9Emp.exe+6751A5 -- (2) 8B C3 -- mov eax,ebx // [0087/135] DW9Emp.exe+6751A7 -- (3) 0F46 C2 -- cmovbe eax,edx // [008A/138] DW9Emp.exe+6751AA -- (3) 41 3B C1 -- cmp eax,r9d // [008D/141] DW9Emp.exe+6751AD -- (2) 76 05 -- jna DW9Emp.exe+6751B4 // [008F/143] DW9Emp.exe+6751AF -- (3) 41 8B CD -- mov ecx,r13d // [0092/146] DW9Emp.exe+6751B2 -- (2) EB 0D -- jmp DW9Emp.exe+6751C1 // [0094/148] DW9Emp.exe+6751B4 -- (4) 66 41 3B D1 -- cmp dx,r9w // [0098/152] DW9Emp.exe+6751B8 -- (5) B9 FFFFFFFF -- mov ecx,FFFFFFFF // [009D/157] DW9Emp.exe+6751BD -- (4) 41 0F46 C8 -- cmovbe ecx,r8d // [00A1/161] DW9Emp.exe+6751C1 -- (5) E8 BA30FDFF -- call DW9Emp.exe+648280 // [00A6/166] DW9Emp.exe+6751C6 -- (7) 4C 39 2D C36BDD01 -- cmp [DW9Emp.exe+244BD90],r13 -- P->2A5FFC36990 // [00AD/173] DW9Emp.exe+6751CD -- (7) 41 8B 8E E4000000 -- mov ecx,[r14+000000E4] // [00B4/180] DW9Emp.exe+6751D4 -- (2) 74 5D -- je DW9Emp.exe+675233 // [00B6/182] DW9Emp.exe+6751D6 -- (6) 81 F9 6B070000 -- cmp ecx,0000076B // [00BC/188] DW9Emp.exe+6751DC -- (2) 76 04 -- jna DW9Emp.exe+6751E2 // [00BE/190] DW9Emp.exe+6751DE -- (2) 32 C0 -- xor al,al // [00C0/192] DW9Emp.exe+6751E0 -- (2) EB 10 -- jmp DW9Emp.exe+6751F2 // [00C2/194] DW9Emp.exe+6751E2 -- (7) 48 8B 05 576DDC01 -- mov rax,[DW9Emp.exe+243BF40] -- [56E435C0] // [00C9/201] DW9Emp.exe+6751E9 -- (6) 39 88 C8030000 -- cmp [rax+000003C8],ecx // [00CF/207] DW9Emp.exe+6751EF -- (3) 0F94 C0 -- sete al // [00D2/210] DW9Emp.exe+6751F2 -- (2) 84 C0 -- test al,al // [00D4/212] DW9Emp.exe+6751F4 -- (2) 74 3D -- je DW9Emp.exe+675233 // [00D6/214] DW9Emp.exe+6751F6 -- (5) E8 25A3FFFF -- call DW9Emp.exe+66F520 // [00DB/219] DW9Emp.exe+6751FB -- (7) 0FBE 88 B5000000 -- movsx ecx,byte ptr [rax+000000B5] // [00E2/226] DW9Emp.exe+675202 -- (3) 83 F9 22 -- cmp ecx,22 // [00E5/229] DW9Emp.exe+675205 -- (3) 0F46 D9 -- cmovbe ebx,ecx // [00E8/232] DW9Emp.exe+675208 -- (3) 83 FB 22 -- cmp ebx,22 // [00EB/235] DW9Emp.exe+67520B -- (2) 77 26 -- ja DW9Emp.exe+675233 // [00ED/237] DW9Emp.exe+67520D -- (5) E8 0EA3FFFF -- call DW9Emp.exe+66F520 // [00F2/242] DW9Emp.exe+675212 -- (5) B9 FFFFFFFF -- mov ecx,FFFFFFFF // [00F7/247] DW9Emp.exe+675217 -- (7) 0FBE 90 B5000000 -- movsx edx,byte ptr [rax+000000B5] // [00FE/254] DW9Emp.exe+67521E -- (3) 83 FA 22 -- cmp edx,22 // [0101/257] DW9Emp.exe+675221 -- (3) 0F46 CA -- cmovbe ecx,edx // [0104/260] DW9Emp.exe+675224 -- (5) E8 D7A30000 -- call DW9Emp.exe+67F600 // [0109/265] DW9Emp.exe+675229 -- (2) 8B D5 -- mov edx,ebp // [010B/267] DW9Emp.exe+67522B -- (5) E8 C0850000 -- call DW9Emp.exe+67D7F0 // [0110/272] DW9Emp.exe+675230 -- (3) 8D 3C 28 -- lea edi,[rax+rbp] // [0113/275] DW9Emp.exe+675233 -- (3) 41 8B DD -- mov ebx,r13d // [0116/278] DW9Emp.exe+675236 -- (6) 41 BC C7000000 -- mov r12d,000000C7 // [011C/284] DW9Emp.exe+67523C -- (3) 83 FB 04 -- cmp ebx,04 // [011F/287] DW9Emp.exe+67523F -- (2) 73 4B -- jae DW9Emp.exe+67528C // [0121/289] DW9Emp.exe+675241 -- (2) 8B C3 -- mov eax,ebx // [0123/291] DW9Emp.exe+675243 -- (6) 41 0FBF 54 46 64 -- movsx edx,word ptr [r14+rax*2+64] // [0129/297] DW9Emp.exe+675249 -- (5) B8 FFFFFFFF -- mov eax,FFFFFFFF // [012E/302] DW9Emp.exe+67524E -- (4) 66 41 3B D4 -- cmp dx,r12w // [0132/306] DW9Emp.exe+675252 -- (3) 44 8B C2 -- mov r8d,edx // [0135/309] DW9Emp.exe+675255 -- (3) 0F46 C2 -- cmovbe eax,edx // [0138/312] DW9Emp.exe+675258 -- (3) 41 3B C4 -- cmp eax,r12d // [013B/315] DW9Emp.exe+67525B -- (2) 77 2F -- ja DW9Emp.exe+67528C // [013D/317] DW9Emp.exe+67525D -- (3) 83 FB 03 -- cmp ebx,03 // [0140/320] DW9Emp.exe+675260 -- (2) 76 05 -- jna DW9Emp.exe+675267 // [0142/322] DW9Emp.exe+675262 -- (3) 41 8B CD -- mov ecx,r13d // [0145/325] DW9Emp.exe+675265 -- (2) EB 14 -- jmp DW9Emp.exe+67527B // [0147/327] DW9Emp.exe+675267 -- (4) 66 41 3B D4 -- cmp dx,r12w // [014B/331] DW9Emp.exe+67526B -- (5) B9 FFFFFFFF -- mov ecx,FFFFFFFF // [0150/336] DW9Emp.exe+675270 -- (4) 41 0F46 C8 -- cmovbe ecx,r8d // [0154/340] DW9Emp.exe+675274 -- (3) 41 3B CC -- cmp ecx,r12d // [0157/343] DW9Emp.exe+675277 -- (4) 41 0F47 CD -- cmova ecx,r13d // [015B/347] DW9Emp.exe+67527B -- (5) E8 10A6FCFF -- call DW9Emp.exe+63F890 // [0160/352] DW9Emp.exe+675280 -- (3) 48 8B C8 -- mov rcx,rax // [0163/355] DW9Emp.exe+675283 -- (2) 8B D5 -- mov edx,ebp // [0165/357] DW9Emp.exe+675285 -- (5) E8 0687FCFF -- call DW9Emp.exe+63D990 // [016A/362] DW9Emp.exe+67528A -- (2) 03 F8 -- add edi,eax // [016C/364] DW9Emp.exe+67528C -- (2) FF C3 -- inc ebx // [016E/366] DW9Emp.exe+67528E -- (3) 83 FB 04 -- cmp ebx,04 // [0171/369] DW9Emp.exe+675291 -- (2) 72 AE -- jb DW9Emp.exe+675241 // [0173/371] DW9Emp.exe+675293 -- (3) 45 84 FF -- test r15b,r15b // [0176/374] DW9Emp.exe+675296 -- (2) 74 18 -- je DW9Emp.exe+6752B0 // [0178/376] DW9Emp.exe+675298 -- (2) 3B FE -- cmp edi,esi // [017A/378] DW9Emp.exe+67529A -- (5) B9 1E000000 -- mov ecx,0000001E // [017F/383] DW9Emp.exe+67529F -- (3) 0F4F FE -- cmovg edi,esi // [0182/386] DW9Emp.exe+6752A2 -- (2) 3B F9 -- cmp edi,ecx // [0184/388] DW9Emp.exe+6752A4 -- (3) 0F4F CF -- cmovg ecx,edi // [0187/391] DW9Emp.exe+6752A7 -- (2) 3B CE -- cmp ecx,esi // [0189/393] DW9Emp.exe+6752A9 -- (3) 0F4C F1 -- cmovl esi,ecx // [018C/396] DW9Emp.exe+6752AC -- (2) 8B C6 -- mov eax,esi // [018E/398] DW9Emp.exe+6752AE -- (2) EB 02 -- jmp DW9Emp.exe+6752B2 // [0190/400] DW9Emp.exe+6752B0 -- (2) 8B C7 -- mov eax,edi // [0192/402] DW9Emp.exe+6752B2 -- (5) 48 8B 5C 24 50 -- mov rbx,[rsp+50] // [0197/407] DW9Emp.exe+6752B7 -- (5) 48 8B 6C 24 58 -- mov rbp,[rsp+58] // [019C/412] DW9Emp.exe+6752BC -- (5) 48 8B 74 24 60 -- mov rsi,[rsp+60] // [01A1/417] DW9Emp.exe+6752C1 -- (4) 48 83 C4 20 -- add rsp,20 // [01A5/421] DW9Emp.exe+6752C5 -- (2) 41 5F -- pop r15 // [01A7/423] DW9Emp.exe+6752C7 -- (2) 41 5E -- pop r14 // [01A9/425] DW9Emp.exe+6752C9 -- (2) 41 5D -- pop r13 // [01AB/427] DW9Emp.exe+6752CB -- (2) 41 5C -- pop r12 // [01AD/429] DW9Emp.exe+6752CD -- (1) 5F -- pop rdi // [01AE/430] DW9Emp.exe+6752CE -- (1) C3 -- ret // init // next func_ } 10 "[$ASM] One Hit kill" C08000 Auto Assembler Script // I could look for better spot Tho... there is at least 3 more locations (yet byte space varies) ... // just change rbx into high negative value before pushing as arg to stack // zigzag/Spaghetti without alloc [ENABLE] aobscanmodule(GET_PLAYER_DMG,DW9Emp.exe,48 89 5C 24 08 57 48 83 EC 20 48 8B D9 E8 EE 2A) registersymbol(GET_PLAYER_DMG) GET_PLAYER_DMG-B: db F7 E3 F7 DB db 48 89 5C 24 08 db EB 05 GET_PLAYER_DMG: db EB F3 90 90 90 [DISABLE] GET_PLAYER_DMG: db 48 89 5C 24 08 unregistersymbol(GET_PLAYER_DMG) { Function dump of "DW9Emp.exe+49FA60" // bunch of cc's ~ Function header aob : "48 89 5C 24 08 57 48 83 EC 20 48 8B D9 E8 EE 2A" ~ // [0000/0] DW9Emp.exe+49FA60 -- (5) 48 89 5C 24 08 -- mov [rsp+08],rbx // [0005/5] DW9Emp.exe+49FA65 -- (1) 57 -- push rdi // [0006/6] DW9Emp.exe+49FA66 -- (4) 48 83 EC 20 -- sub rsp,20 // [000A/10] DW9Emp.exe+49FA6A -- (3) 48 8B D9 -- mov rbx,rcx // [000D/13] DW9Emp.exe+49FA6D -- (5) E8 EE2A0000 -- call DW9Emp.exe+4A2560 // [0012/18] DW9Emp.exe+49FA72 -- (2) 33 FF -- xor edi,edi // [0014/20] DW9Emp.exe+49FA74 -- (3) 44 8B C0 -- mov r8d,eax // [0017/23] DW9Emp.exe+49FA77 -- (6) 39 BB 84040000 -- cmp [rbx+00000484],edi // [001D/29] DW9Emp.exe+49FA7D -- (2) 7E 2F -- jle DW9Emp.exe+49FAAE // [001F/31] DW9Emp.exe+49FA7F -- (6) 8B 8B 80040000 -- mov ecx,[rbx+00000480] // [0025/37] DW9Emp.exe+49FA85 -- (2) 85 C9 -- test ecx,ecx // [0027/39] DW9Emp.exe+49FA87 -- (2) 74 25 -- je DW9Emp.exe+49FAAE // [0029/41] DW9Emp.exe+49FA89 -- (3) 0F57 C9 -- xorps xmm1,xmm1 // [002C/44] DW9Emp.exe+49FA8C -- (3) 83 C1 9C -- add ecx,-64 // [002F/47] DW9Emp.exe+49FA8F -- (2) 8B D1 -- mov edx,ecx // [0031/49] DW9Emp.exe+49FA91 -- (3) 0F57 C0 -- xorps xmm0,xmm0 // [0034/52] DW9Emp.exe+49FA94 -- (5) F3 49 0F2A C0 -- cvtsi2ss xmm0,r8 // [0039/57] DW9Emp.exe+49FA99 -- (5) F3 48 0F2A CA -- cvtsi2ss xmm1,rdx // [003E/62] DW9Emp.exe+49FA9E -- (4) F3 0F59 C8 -- mulss xmm1,xmm0 // [0042/66] DW9Emp.exe+49FAA2 -- (8) F3 0F5E 0D 6697AE01 -- divss xmm1,[DW9Emp.exe+1F89210] -- [(float)100.0000] // [004A/74] DW9Emp.exe+49FAAA -- (4) F3 0F2C F9 -- cvttss2si edi,xmm1 // [004E/78] DW9Emp.exe+49FAAE -- (7) 48 8D 8B C0040000 -- lea rcx,[rbx+000004C0] // [0055/85] DW9Emp.exe+49FAB5 -- (3) 41 8B D0 -- mov edx,r8d // [0058/88] DW9Emp.exe+49FAB8 -- (5) E8 C30E0000 -- call DW9Emp.exe+4A0980 // [005D/93] DW9Emp.exe+49FABD -- (5) 48 8B 5C 24 30 -- mov rbx,[rsp+30] // [0062/98] DW9Emp.exe+49FAC2 -- (2) 03 C7 -- add eax,edi // [0064/100] DW9Emp.exe+49FAC4 -- (4) 48 83 C4 20 -- add rsp,20 // [0068/104] DW9Emp.exe+49FAC8 -- (1) 5F -- pop rdi // [0069/105] DW9Emp.exe+49FAC9 -- (1) C3 -- ret } 11 "[$ASM] Invincible" C08000 Auto Assembler Script // keep loading max health into current health -- one of possible methods. [ENABLE] aobscanmodule(GET_PLAYA_HP,DW9Emp.exe,48 63 08 81 F9 A5 10 00 00 77 36) alloc(newmem,$1000,GET_PLAYA_HP) label(code return) newmem: code: movsxd rcx,dword ptr [rax] nop [rax+10] mov r8,[rax+18] mov [rax+10],r8 cmp ecx,000010A5 jmp return GET_PLAYA_HP: jmp newmem nop 4 return: registersymbol(GET_PLAYA_HP) [DISABLE] GET_PLAYA_HP: db 48 63 08 81 F9 A5 10 00 00 unregistersymbol(GET_PLAYA_HP) dealloc(newmem) { Function dump of "DW9Emp.exe+49E719" ~ Function header aob : "40 53 48 83 EC 20 48 8B DA 45 33 C0" ~ // [0000/0] DW9Emp.exe+49E6C0 -- (2) 40 53 -- push rbx // [0002/2] DW9Emp.exe+49E6C2 -- (4) 48 83 EC 20 -- sub rsp,20 // [0006/6] DW9Emp.exe+49E6C6 -- (3) 48 8B DA -- mov rbx,rdx // [0009/9] DW9Emp.exe+49E6C9 -- (3) 45 33 C0 -- xor r8d,r8d // [000C/12] DW9Emp.exe+49E6CC -- (7) 48 8B 15 75D8F901 -- mov rdx,[DW9Emp.exe+243BF48] -- [E3663170] // [0013/19] DW9Emp.exe+49E6D3 -- (3) 48 85 D2 -- test rdx,rdx // [0016/22] DW9Emp.exe+49E6D6 -- (2) 74 2B -- je DW9Emp.exe+49E703 // [0018/24] DW9Emp.exe+49E6D8 -- (6) 8B 89 E0030000 -- mov ecx,[rcx+000003E0] // [001E/30] DW9Emp.exe+49E6DE -- (6) 81 F9 90010000 -- cmp ecx,00000190 // [0024/36] DW9Emp.exe+49E6E4 -- (2) 73 1D -- jae DW9Emp.exe+49E703 // [0026/38] DW9Emp.exe+49E6E6 -- (6) 3B 8A 60FF3900 -- cmp ecx,[rdx+0039FF60] // [002C/44] DW9Emp.exe+49E6EC -- (3) 41 8B C0 -- mov eax,r8d // [002F/47] DW9Emp.exe+49E6EF -- (3) 0F42 C1 -- cmovb eax,ecx // [0032/50] DW9Emp.exe+49E6F2 -- (4) 48 8D 04 C0 -- lea rax,[rax+rax*8] // [0036/54] DW9Emp.exe+49E6F6 -- (7) 48 8D 80 DC310700 -- lea rax,[rax+000731DC] // [003D/61] DW9Emp.exe+49E6FD -- (4) 48 8D 04 C2 -- lea rax,[rdx+rax*8] // [0041/65] DW9Emp.exe+49E701 -- (2) EB 07 -- jmp DW9Emp.exe+49E70A // [0043/67] DW9Emp.exe+49E703 -- (7) 48 8D 05 F647E401 -- lea rax,[DW9Emp.exe+22E2F00] -- [00000190] // [004A/74] DW9Emp.exe+49E70A -- (7) 81 78 08 DC050000 -- cmp [rax+08],000005DC // [0051/81] DW9Emp.exe+49E711 -- (2) 73 65 -- jae DW9Emp.exe+49E778 // [0053/83] DW9Emp.exe+49E713 -- (4) 83 78 04 3B -- cmp dword ptr [rax+04],3B // [0057/87] DW9Emp.exe+49E717 -- (2) 73 5F -- jae DW9Emp.exe+49E778 // [0059/89] DW9Emp.exe+49E719 -- (3) 48 63 08 -- movsxd rcx,dword ptr [rax] // [005C/92] DW9Emp.exe+49E71C -- (6) 81 F9 A5100000 -- cmp ecx,000010A5 // [0062/98] DW9Emp.exe+49E722 -- (2) 77 36 -- ja DW9Emp.exe+49E75A // [0064/100] DW9Emp.exe+49E724 -- (7) 48 8B 05 35C4F901 -- mov rax,[DW9Emp.exe+243AB60] -- [E2B65B40] // [006B/107] DW9Emp.exe+49E72B -- (8) 48 8B 8C C8 10020000 -- mov rcx,[rax+rcx*8+00000210] // [0073/115] DW9Emp.exe+49E733 -- (3) 48 85 C9 -- test rcx,rcx // [0076/118] DW9Emp.exe+49E736 -- (2) 74 22 -- je DW9Emp.exe+49E75A // [0078/120] DW9Emp.exe+49E738 -- (3) 48 8B 01 -- mov rax,[rcx] // [007B/123] DW9Emp.exe+49E73B -- (3) FF 50 30 -- call qword ptr [rax+30] // [007E/126] DW9Emp.exe+49E73E -- (4) 0F28 40 20 -- movaps xmm0,[rax+20] // [0082/130] DW9Emp.exe+49E742 -- (4) 48 83 C0 20 -- add rax,20 // [0086/134] DW9Emp.exe+49E746 -- (4) 66 0F7F 03 -- movdqa [rbx],xmm0 // [008A/138] DW9Emp.exe+49E74A -- (3) 48 8B C3 -- mov rax,rbx // [008D/141] DW9Emp.exe+49E74D -- (7) C7 43 0C 0000803F -- mov [rbx+0C],3F800000 // [0094/148] DW9Emp.exe+49E754 -- (4) 48 83 C4 20 -- add rsp,20 // [0098/152] DW9Emp.exe+49E758 -- (1) 5B -- pop rbx // [0099/153] DW9Emp.exe+49E759 -- (1) C3 -- ret } 12 "[$ASM] Quick capture base (on walk in)" C08000 Auto Assembler Script [ENABLE] aobscanmodule(GET_CAPTURE_POINTS,DW9Emp.exe,41 8B 81 D0 03 00 00 89) alloc(newmem,2048,GET_CAPTURE_POINTS) label(returnhere) label(originalcode) newmem: cmp [r9+3C8],#0 // a je Ally cmp [r9+3C8],#1 // o je O O: mov [r9+3D0],#0 jmp originalcode Ally: mov [r9+3D0],#1327 originalcode: mov eax,[r9+000003D0] jmp returnhere GET_CAPTURE_POINTS: jmp newmem nop 2 returnhere: [DISABLE] dealloc(newmem) GET_CAPTURE_POINTS: db 41 8B 81 D0 03 00 00 //mov eax,[r9+000003D0] { Function dump of "DW9Emp.exe+CB7CF6" ~ Function header aob : "8B 43 2C BA FF FF FF FF" ~ // [0000/0] DW9Emp.exe+CB7C26 -- (3) 8B 43 2C -- mov eax,[rbx+2C] // [0003/3] DW9Emp.exe+CB7C29 -- (5) BA FFFFFFFF -- mov edx,FFFFFFFF // [0008/8] DW9Emp.exe+CB7C2E -- (5) 48 89 6C 24 30 -- mov [rsp+30],rbp // [000D/13] DW9Emp.exe+CB7C33 -- (5) 48 89 74 24 38 -- mov [rsp+38],rsi // [0012/18] DW9Emp.exe+CB7C38 -- (5) 48 89 7C 24 40 -- mov [rsp+40],rdi // [0017/23] DW9Emp.exe+CB7C3D -- (5) 4C 89 74 24 48 -- mov [rsp+48],r14 // [001C/28] DW9Emp.exe+CB7C42 -- (2) 85 C0 -- test eax,eax // [001E/30] DW9Emp.exe+CB7C44 -- (2) 78 13 -- js DW9Emp.exe+CB7C59 // [0020/32] DW9Emp.exe+CB7C46 -- (2) 03 C1 -- add eax,ecx // [0022/34] DW9Emp.exe+CB7C48 -- (3) 89 43 2C -- mov [rbx+2C],eax // [0025/37] DW9Emp.exe+CB7C4B -- (3) 83 F8 0A -- cmp eax,0A // [0028/40] DW9Emp.exe+CB7C4E -- (2) 7C 3B -- jl DW9Emp.exe+CB7C8B // [002A/42] DW9Emp.exe+CB7C50 -- (3) 89 53 2C -- mov [rbx+2C],edx // [002D/45] DW9Emp.exe+CB7C53 -- (4) 44 89 43 30 -- mov [rbx+30],r8d // [0031/49] DW9Emp.exe+CB7C57 -- (2) EB 32 -- jmp DW9Emp.exe+CB7C8B // ... // [00BC/188] DW9Emp.exe+CB7CE2 -- (5) 44 0FB6 53 29 -- movzx r10d,byte ptr [rbx+29] // [00C1/193] DW9Emp.exe+CB7CE7 -- (4) 44 8B 73 10 -- mov r14d,[rbx+10] // [00C5/197] DW9Emp.exe+CB7CEB -- (3) 8B 6B 04 -- mov ebp,[rbx+04] // [00C8/200] DW9Emp.exe+CB7CEE -- (4) 44 8B 5B 08 -- mov r11d,[rbx+08] // [00CC/204] DW9Emp.exe+CB7CF2 -- (4) C6 43 28 01 -- mov byte ptr [rbx+28],01 // [00D0/208] DW9Emp.exe+CB7CF6 -- (7) 41 8B 81 D0030000 -- mov eax,[r9+000003D0] // [00D7/215] DW9Emp.exe+CB7CFD -- (3) 89 43 10 -- mov [rbx+10],eax // [00DA/218] DW9Emp.exe+CB7D00 -- (4) 44 88 43 29 -- mov [rbx+29],r8b // [00DE/222] DW9Emp.exe+CB7D04 -- (4) 41 8B 41 08 -- mov eax,[r9+08] // [00E2/226] DW9Emp.exe+CB7D08 -- (3) 89 43 04 -- mov [rbx+04],eax // [00E5/229] DW9Emp.exe+CB7D0B -- (7) 41 8B 81 C8030000 -- mov eax,[r9+000003C8] // [00EC/236] DW9Emp.exe+CB7D12 -- (3) 89 43 08 -- mov [rbx+08],eax // [00EF/239] DW9Emp.exe+CB7D15 -- (7) 41 8B 81 E8030000 -- mov eax,[r9+000003E8] // [00F6/246] DW9Emp.exe+CB7D1C -- (2) F7 D0 -- not eax // [00F8/248] DW9Emp.exe+CB7D1E -- (3) C1 E8 1F -- shr eax,1F // [00FB/251] DW9Emp.exe+CB7D21 -- (7) 45 39 81 EC030000 -- cmp [r9+000003EC],r8d // [0102/258] DW9Emp.exe+CB7D28 -- (3) 8D 48 01 -- lea ecx,[rax+01] // ... // [022A/554] DW9Emp.exe+CB7E50 -- (4) 48 83 C4 20 -- add rsp,20 // [022E/558] DW9Emp.exe+CB7E54 -- (1) 5B -- pop rbx // [022F/559] DW9Emp.exe+CB7E55 -- (1) C3 -- ret } 13 "Statics" 1 14 "Game speed (don't zero this)" 360: [ x6 phase ] 180: [ x3 phase ] 120: [ x2 phase ] 60: [ Normal phase ] 30: [ Slowed phase ] 0 0000FF Double

DW9Emp.exe+1F88FB0

15 "[$ASM] No mouse lock" C08000 Auto Assembler Script // Actually traced from DINPUT8 sys module while from process traces showed for this case nothing. bad odd approach. [ENABLE] aobscanmodule(MOUSE_LOCK_AOB,DW9Emp.exe,FF 50 68 85 C0 78 04 C6 43 19 01 48 8B 4B 10 48 8B 01 FF) registersymbol(MOUSE_LOCK_AOB) MOUSE_LOCK_AOB: db 0F 1F 00 [DISABLE] MOUSE_LOCK_AOB: db FF 50 68 85 C0 unregistersymbol(MOUSE_LOCK_AOB) { Function dump of "DW9Emp.exe+A0FDDE" ~ Function header aob : "41 8D 40 FF 66 83 F8 01" ~ // [0000/0] DW9Emp.exe+A0FAE0 -- (4) 41 8D 40 FF -- lea eax,[r8-01] // [0004/4] DW9Emp.exe+A0FAE4 -- (4) 66 83 F8 01 -- cmp ax,01 // [0008/8] DW9Emp.exe+A0FAE8 -- (2) 76 70 -- jna DW9Emp.exe+A0FB5A // [000A/10] DW9Emp.exe+A0FAEA -- (5) E8 A1690000 -- call DW9Emp.exe+A16490 // [000F/15] DW9Emp.exe+A0FAEF -- (7) C6 80 74030000 00 -- mov byte ptr [rax+00000374],00 // [0016/22] DW9Emp.exe+A0FAF6 -- (7) 48 8B 1D CBFCF901 -- mov rbx,[DW9Emp.exe+29AF7C8] -- [63E3D580] // ... // [0116/278] DW9Emp.exe+A0FBF6 -- (4) 48 83 C1 10 -- add rcx,10 // [011A/282] DW9Emp.exe+A0FBFA -- (6) FF 15 F854EB00 -- call qword ptr [DW9Emp.exe+18C50F8] -- P->ntdll.RtlLeaveCriticalSection // [0120/288] DW9Emp.exe+A0FC00 -- (5) BA 09000000 -- mov edx,00000009 // [0125/293] DW9Emp.exe+A0FC05 -- (3) 49 8B CE -- mov rcx,r14 // [0128/296] DW9Emp.exe+A0FC08 -- (6) FF 15 E25BEB00 -- call qword ptr [DW9Emp.exe+18C57F0] -- P->USER32.ShowWindow // [012E/302] DW9Emp.exe+A0FC0E -- (5) E9 FC010000 -- jmp DW9Emp.exe+A0FE0F // [0133/307] DW9Emp.exe+A0FC13 -- (5) E8 78680000 -- call DW9Emp.exe+A16490 // ... // [022B/555] DW9Emp.exe+A0FD0B -- (6) 88 0D BFD9F901 -- mov [DW9Emp.exe+29AD6D0],cl // [0231/561] DW9Emp.exe+A0FD11 -- (2) 33 C9 -- xor ecx,ecx // [0233/563] DW9Emp.exe+A0FD13 -- (6) FF 15 AF5AEB00 -- call qword ptr [DW9Emp.exe+18C57C8] -- P->USER32.PostQuitMessage // [0239/569] DW9Emp.exe+A0FD19 -- (3) 8D 4B 63 -- lea ecx,[rbx+63] // [023C/572] DW9Emp.exe+A0FD1C -- (6) FF 15 0654EB00 -- call qword ptr [DW9Emp.exe+18C5128] -- P->KERNEL32.Sleep // [0242/578] DW9Emp.exe+A0FD22 -- (5) E9 E8000000 -- jmp DW9Emp.exe+A0FE0F // [0247/583] DW9Emp.exe+A0FD27 -- (3) 49 8B DF -- mov rbx,r15 // ... // [02EB/747] DW9Emp.exe+A0FDCB -- (3) FF 50 40 -- call qword ptr [rax+40] // [02EE/750] DW9Emp.exe+A0FDCE -- (4) 48 8B 4B 10 -- mov rcx,[rbx+10] // [02F2/754] DW9Emp.exe+A0FDD2 -- (6) 41 B8 05000000 -- mov r8d,00000005 // [02F8/760] DW9Emp.exe+A0FDD8 -- (3) 48 8B 13 -- mov rdx,[rbx] // [02FB/763] DW9Emp.exe+A0FDDB -- (3) 48 8B 01 -- mov rax,[rcx] // [02FE/766] DW9Emp.exe+A0FDDE -- (3) FF 50 68 -- call qword ptr [rax+68] // [0301/769] DW9Emp.exe+A0FDE1 -- (2) 85 C0 -- test eax,eax // [0303/771] DW9Emp.exe+A0FDE3 -- (2) 78 04 -- js DW9Emp.exe+A0FDE9 // [0305/773] DW9Emp.exe+A0FDE5 -- (4) C6 43 19 01 -- mov byte ptr [rbx+19],01 // [0309/777] DW9Emp.exe+A0FDE9 -- (4) 48 8B 4B 10 -- mov rcx,[rbx+10] // [030D/781] DW9Emp.exe+A0FDED -- (3) 48 8B 01 -- mov rax,[rcx] // ... // [037F/895] DW9Emp.exe+A0FE5F -- (1) 06 -- push es // [0380/896] DW9Emp.exe+A0FE60 -- (1) 06 -- push es // [0381/897] DW9Emp.exe+A0FE61 -- (1) 06 -- push es // [0382/898] DW9Emp.exe+A0FE62 -- (5) 05 CCCCCCCC -- add eax,CCCCCCCC // [0387/903] DW9Emp.exe+A0FE67 -- (1) CC -- int 3 } 16 "[$ASM] Prevent loading Battle Info scene" C08000 Auto Assembler Script // 3 - pause scene , 6 battle ,.., // scenes loading code is not identical but has commonalities with dynasty warriors origins... // (meant loading is based on ID -- if I can call that for example 16 - init cutscene 17 - keep showing cutscene 18 - end cutscene) [ENABLE] aobscanmodule(GET_PAUSE_SCENE,DW9Emp.exe,0F 85 89 00 00 00 89) registersymbol(GET_PAUSE_SCENE) GET_PAUSE_SCENE: db 0F 84 89 00 00 00 [DISABLE] GET_PAUSE_SCENE: db 0F 85 89 00 00 00 unregistersymbol(GET_PAUSE_SCENE) { Function dump of "DW9Emp.exe+9AE0CC" ~ Function header aob : "83 79 20 FF 44 8B C2" ~ // [0000/0] DW9Emp.exe+9AE0B0 -- (4) 83 79 20 FF -- cmp dword ptr [rcx+20],-01 // [0004/4] DW9Emp.exe+9AE0B4 -- (3) 44 8B C2 -- mov r8d,edx // [0007/7] DW9Emp.exe+9AE0B7 -- (6) 0F85 9E000000 -- jne DW9Emp.exe+9AE15B // [000D/13] DW9Emp.exe+9AE0BD -- (3) 8B 41 18 -- mov eax,[rcx+18] // [0010/16] DW9Emp.exe+9AE0C0 -- (3) 39 41 1C -- cmp [rcx+1C],eax // [0013/19] DW9Emp.exe+9AE0C3 -- (6) 0F85 92000000 -- jne DW9Emp.exe+9AE15B // [0019/25] DW9Emp.exe+9AE0C9 -- (3) 83 F8 03 -- cmp eax,03 // [001C/28] DW9Emp.exe+9AE0CC -- (6) 0F85 89000000 -- jne DW9Emp.exe+9AE15B // [0022/34] DW9Emp.exe+9AE0D2 -- (3) 89 51 20 -- mov [rcx+20],edx // [0025/37] DW9Emp.exe+9AE0D5 -- (6) 8B 15 01F6FF01 -- mov edx,[DW9Emp.exe+29AD6DC] -- [00000003] // [002B/43] DW9Emp.exe+9AE0DB -- (2) 3B D0 -- cmp edx,eax // [002D/45] DW9Emp.exe+9AE0DD -- (2) 76 09 -- jna DW9Emp.exe+9AE0E8 // [002F/47] DW9Emp.exe+9AE0DF -- (7) C6 05 F5F5FF01 01 -- mov byte ptr [DW9Emp.exe+29AD6DB],01 // [0036/54] DW9Emp.exe+9AE0E6 -- (2) EB 30 -- jmp DW9Emp.exe+9AE118 // [0038/56] DW9Emp.exe+9AE0E8 -- (2) 33 C9 -- xor ecx,ecx // [003A/58] DW9Emp.exe+9AE0EA -- (2) 85 D2 -- test edx,edx // [003C/60] DW9Emp.exe+9AE0EC -- (2) 74 2A -- je DW9Emp.exe+9AE118 // [003E/62] DW9Emp.exe+9AE0EE -- (7) 4C 8D 0D E3F5FF01 -- lea r9,[DW9Emp.exe+29AD6D8] -- [00000000] // [0045/69] DW9Emp.exe+9AE0F5 -- (11) 66 66 66 0F1F 84 00 00000000 -- nop word ptr [rax+rax+00000000] // [0050/80] DW9Emp.exe+9AE100 -- (2) 33 C0 -- xor eax,eax // [0052/82] DW9Emp.exe+9AE102 -- (2) 3B CA -- cmp ecx,edx // [0054/84] DW9Emp.exe+9AE104 -- (3) 0F42 C1 -- cmovb eax,ecx // [0057/87] DW9Emp.exe+9AE107 -- (2) FF C1 -- inc ecx // [0059/89] DW9Emp.exe+9AE109 -- (5) 42 C6 04 08 01 -- mov byte ptr [rax+r9],01 // [005E/94] DW9Emp.exe+9AE10E -- (6) 8B 15 C8F5FF01 -- mov edx,[DW9Emp.exe+29AD6DC] -- [00000003] // [0064/100] DW9Emp.exe+9AE114 -- (2) 3B CA -- cmp ecx,edx // [0066/102] DW9Emp.exe+9AE116 -- (2) 72 E8 -- jb DW9Emp.exe+9AE100 // [0068/104] DW9Emp.exe+9AE118 -- (4) 41 83 F8 06 -- cmp r8d,06 // [006C/108] DW9Emp.exe+9AE11C -- (2) 75 1C -- jne DW9Emp.exe+9AE13A // [006E/110] DW9Emp.exe+9AE11E -- (10) 81 0D F8C9A801 00100000 -- or [DW9Emp.exe+243AB20],00001000 // [0078/120] DW9Emp.exe+9AE128 -- (10) 81 0D FEC9A801 00100000 -- or [DW9Emp.exe+243AB30],00001000 // [0082/130] DW9Emp.exe+9AE132 -- (7) C6 05 A7F5FF01 01 -- mov byte ptr [DW9Emp.exe+29AD6E0],01 // [0089/137] DW9Emp.exe+9AE139 -- (1) C3 -- ret }