var prevadrr
var first
var oldaddr
var zero1
var zero2
var IAT

LABEL_03:
esto
bpwm 401000, AA000		// Size of imports + code section

LABEL_02:
esto
cmp eip, 00463494		// oep don't forget to hw bp this. 
je END
mov temp, eip
mov temp, [temp]
and temp, 0ffff

cmp temp, 09D8B			// Mov ebx detection, can be changed as lon as eax holds the api.
jne LABEL_04
mov IAT, eax
jmp LABEL_02

LABEL_04:
cmp temp, 0028f			// pop detection.
je LABEL_01
jmp LABEL_02

LABEL_01:
cmp [edx], 0			// IAT is 00 API's 90909090
jne LABEL_07
sti
mov [edx],IAT			// write the api into the IAT
jmp LABEL_02
LABEL_07:
sti
mov oldaddr, IAT		// calculation of api location.. 
sub oldaddr, edx
sub oldaddr, 4
mov [edx],oldaddr		// write the api into an direct jmp/call
jmp LABEL_02

END:
ret