var OEP_start
var A1
var codeB
var B1
var B2
var B3
var API_L
var H1
var G1
var pointer
var K1
var L1
var D1
var A3
var A4
var C1
var M1
var T1
var temp2
var new1
var R1
var HH
var II
var codeB2

var r1
var r2
var r3
var r4
var r5
var r6
var r7
var r8

mov r1,eax
mov r2,ecx
mov r3,edx
mov r4,ebx
mov r5,esp
mov r6,ebp
mov r7,esi
mov r8,edi


dbh
lc

mov OEP_start,eip             

GMI eip,MODULEBASE                                
mov A1, $RESULT
gmemi A1, MEMORYSIZE
add A1, $RESULT             // A1    401000

mov codeB, A1               // codeB 401000
mov new1 , A1
mov codeB2,A1
/////////////////////////////////////////////
gmemi new1,MEMORYSIZE
add new1, $RESULT

//////////////////////////////////////////////

Z2:


find codeB, #ff25????????#               //suche API JMP        cmp $RESULT,0
cmp $RESULT,0
je ende_full


mov HH,$RESULT+2
mov codeB,HH
mov II,[HH]
cmp [II],40000000

jb Z2

Z3:

cmp [II],80000000
ja Z2


Z1:

mov B1, [$RESULT+2]                     //
gmemi B1, MEMORYBASE          //Section von JMP FF25
mov B2, $RESULT               //In B2
gmemi B2, MEMORYSIZE          //Size von JMP FF25 Section
mov B3, $RESULT               //In B3

/////////////////////////////////////////////

gpa "LoadLibraryA", "kernel32.dll"
mov API_L, $RESULT
/////////////////////////////////////////////
start:

BP API_L
run                                  //LoadLibraryA Break

mov H1,[esp+250]                     //
sub H1,5                             //Adresse 1. Mem Call
mov G1,eip
mov eip,H1

mov K1,esp

mov pointer, $RESULT
add $RESULT, [$RESULT]
add $RESULT, 4
mov temp, $RESULT

sti
mov esp,K1

mov L1,eip                   //Adrees von Mem Section 012D0000
mov eip,G1

BC API_L
rtu
/////////////////////////////////////////////

find eip, #C20400#              //00AC0000 Section
go $RESULT
sti

mov D1,eip                          //Test,Test
////////////////////////////////////////////
start2:

bphwc D1                         //Test,Test

mov A4, [ebp-10]


find eip,#8B45FC508B45F8#
go $RESULT
sti
mov A3, eax                      //Api 77xxxxxx

fkk:
mov eip, A4
////////////////////////////////////////////

find B2,#0000000000000000#
mov C1,$RESULT
mov [C1],A3
mov [eip],#ff15#
mov [eip+2],C1
add C1,4


mov M1,eip
///////////////////////////////////////////
W1:

find codeB2,#E8#                     //Suche Call
cmp $RESULT,0
je ende2

mov R1, $RESULT
cmp R1, new1
ja ende2

W4:
mov T1, $RESULT                     //Gefundene Call Adresse
inc $RESULT                         //Erhöhe um eins
mov pointer, $RESULT
add $RESULT, [$RESULT]             //
add $RESULT, 4
mov temp2, $RESULT
cmp temp2,L1                    //Vergleiche ob 0012D0000 in Call Adresse
je W2
jne W3
///////////////////////////////////////////
ende2:

jmp ende_full_2


//////////////////////////////////////////
W2:

mov codeB2,T1+1
mov eip,T1
bphws D1, "x"
run

jmp start2
/////////////////////////////////////////
W3:

mov codeB2,pointer+1
jmp W1

///////////////////////////////////


///////////////////////////////////
ende_full_2:
mov eip, OEP_start     //OEP
mov eax,r1
mov ecx,r2
mov edx,r3
mov ebx,r4
mov esp,r5
mov ebp,r6
mov esi,r7
mov edi,r8

MSG "All calls fixed now"
ret