28
"Purchase"
Auto Assembler Script
[ENABLE]
aobscanmodule(Purchase,SC3-WWI.exe,8B 80 84 00 00 00 89 45 14 8B 45 14 39 45 1C)
alloc(newmem,$1000)
alloc(MPP,4)
label(code)
label(return)
MPP:
dd 0
newmem:
code:
mov [MPP],eax
mov eax,[eax+00000084]
jmp return
Purchase:
jmp newmem
nop
return:
registersymbol(Purchase)
registersymbol(MPP)
[DISABLE]
Purchase:
db 8B 80 84 00 00 00
unregistersymbol(Purchase)
unregistersymbol(MPP)
dealloc(newmem)
dealloc(MPP)
29
"MPP"
0
4 Bytes
[MPP]+84