^ I do feel that you're trying to "lure" me into checking this out, but it is not going to happen (any time soon).
I know how much it can take to find these. Just recently, I've added the Hellfire timer to my ACVH table, and that one took me... +2hr... to find it. Just saying...
That said: here is my 50cent approach: (i've checked my doc again to remember what to look for)
1. start the disguise (i would go with that one as i can see a visual change)
2. press ESC and scan for integer
3. return ingame, wait (less then a sec) then ESC again: integer has increased...
4. continue doing this for at least 10 secs here, till resultlist gets down to a few thousands (or more)
(also note that the integer is going to be in the thousands ~ epoch value - pure assumption: the longer the game session is running, the higher that integer_value will be)
5. now the tricky part: (expect crashing the game here, as this timer is controlled by - what i call - the game_clock, which - among others - also control your FPS !)
- bring results to addresslist, and lock all of them
(you do not have a visual timer value + i'm guessing that - with each disguise session - a new object is created ?! <= hopefully not)
- return ingame, and wait out your disguise session: if it does not end, then one of them values controls the timer
=> since no visual counter: unlock 500 entries and see if ends ? etc...
(make printscreens so you have an idea/reference about these values)
=> i'm pretty sure you will need to run several disguise sessions before getting the proper value. if the struct_address changes with every session, it is not going to be a fun ride...
6. next part is finding the proper opcode: if you have problems with that, do pm me...
~> starting to get an idea what you are getting into ?!