Code: Select all
{ Game : ASTLIBRA.exe
Version:
Date : 2023-12-19
Author : Bliseer
This script does blah blah blah
}
[ENABLE]
aobscanmodule(infSt,ASTLIBRA.exe,F3 0F 11 15 E6 98 6C 00) // should be unique
aobscanmodule(infSt2,ASTLIBRA.exe,F3 0F 5C DA 0F 2F F3) // should be unique
aobscanmodule(infSt3,ASTLIBRA.exe,F3 0F 11 05 CE 8E 78 00) // should be unique
//alloc(newmem,$1000,infSP)
//
//label(code)
//label(return)
//
//newmem:
//
//code:
// movss [ASTLIBRA.exe+AE1C30],xmm2
// jmp return
infSt:
// jmp newmem
// nop 3
nop 8
//return:
registersymbol(infSt)
//code2:
// subss xmm3,xmm2
// comiss xmm6,xmm3
// jmp return2
infSt2:
// jmp newmem2
// nop 2
nop 4
//return2:
registersymbol(infSt2)
//code3:
// movss [ASTLIBRA.exe+AE1C30],xmm0
// jmp return3
infSt3:
// jmp newmem3
// nop 3
nop 8
//return3:
registersymbol(infSt3)
[DISABLE]
infSt3:
db F3 0F 11 05 CE 8E 78 00
infSt2:
db F3 0F 5C DA 0F 2F F3
infSt:
db F3 0F 11 15 E6 98 6C 00
unregistersymbol(infSt infSt2 infSt3)
//dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: ASTLIBRA.exe+418342
ASTLIBRA.exe+41830C: 84 C0 - test al,al
ASTLIBRA.exe+41830E: 74 08 - je ASTLIBRA.exe+418318
ASTLIBRA.exe+418310: F3 0F 59 35 0C D0 5C 00 - mulss xmm6,[ASTLIBRA.exe+9E5324]
ASTLIBRA.exe+418318: F3 0F 5C D6 - subss xmm2,xmm6
ASTLIBRA.exe+41831C: 44 88 2D 7F 1E 78 01 - mov [ASTLIBRA.exe+1B9A1A2],r13b
ASTLIBRA.exe+418323: 44 88 3D 21 6E 8E 01 - mov [ASTLIBRA.exe+1CFF14B],r15b
ASTLIBRA.exe+41832A: 49 8B C7 - mov rax,r15
ASTLIBRA.exe+41832D: 44 89 3D 20 78 72 01 - mov [ASTLIBRA.exe+1B3FB54],r15d
ASTLIBRA.exe+418334: 44 89 3D 55 77 72 01 - mov [ASTLIBRA.exe+1B3FA90],r15d
ASTLIBRA.exe+41833B: 44 88 3D D9 4C 8E 01 - mov [ASTLIBRA.exe+1CFD01B],r15b
// ---------- INJECTING HERE ----------
ASTLIBRA.exe+418342: F3 0F 11 15 E6 98 6C 00 - movss [ASTLIBRA.exe+AE1C30],xmm2
// ---------- DONE INJECTING ----------
ASTLIBRA.exe+41834A: 4C 89 3D 97 33 78 01 - mov [ASTLIBRA.exe+1B9B6E8],r15
ASTLIBRA.exe+418351: 66 44 89 3D 97 33 78 01 - mov [ASTLIBRA.exe+1B9B6F0],r15w
ASTLIBRA.exe+418359: 44 88 3D CA 31 71 01 - mov [ASTLIBRA.exe+1B2B52A],r15b
ASTLIBRA.exe+418360: 48 83 F8 32 - cmp rax,32
ASTLIBRA.exe+418364: 0F 83 9A 01 00 00 - jae ASTLIBRA.exe+418504
ASTLIBRA.exe+41836A: 46 88 BC 30 08 C0 B9 01 - mov [rax+r14+01B9C008],r15b
ASTLIBRA.exe+418372: 48 FF C0 - inc rax
ASTLIBRA.exe+418375: 48 83 F8 28 - cmp rax,28
ASTLIBRA.exe+418379: 7C E5 - jl ASTLIBRA.exe+418360
ASTLIBRA.exe+41837B: B9 3A 00 00 00 - mov ecx,0000003A
}
{
// ORIGINAL CODE - INJECTION POINT: ASTLIBRA.exe+40CACE
ASTLIBRA.exe+40CA9C: 03 D0 - add edx,eax
ASTLIBRA.exe+40CA9E: 0F 85 AC 00 00 00 - jne ASTLIBRA.exe+40CB50
ASTLIBRA.exe+40CAA4: F3 0F 10 1D 84 51 6D 00 - movss xmm3,[ASTLIBRA.exe+AE1C30]
ASTLIBRA.exe+40CAAC: 66 0F 6E 05 30 4B 7B 01 - movd xmm0,[ASTLIBRA.exe+1BC15E4]
ASTLIBRA.exe+40CAB4: 41 0F BE C1 - movsx eax,r9b
ASTLIBRA.exe+40CAB8: 0F 5B C0 - cvtdq2ps xmm0,xmm0
ASTLIBRA.exe+40CABB: 66 0F 6E D0 - movd xmm2,eax
ASTLIBRA.exe+40CABF: 0F 5B D2 - cvtdq2ps xmm2,xmm2
ASTLIBRA.exe+40CAC2: F3 0F 59 15 FA 85 5D 00 - mulss xmm2,[ASTLIBRA.exe+9E50C4]
ASTLIBRA.exe+40CACA: F3 0F 59 D0 - mulss xmm2,xmm0
// ---------- INJECTING HERE ----------
ASTLIBRA.exe+40CACE: F3 0F 5C DA - subss xmm3,xmm2
// ---------- DONE INJECTING ----------
ASTLIBRA.exe+40CAD2: 0F 2F F3 - comiss xmm6,xmm3
ASTLIBRA.exe+40CAD5: F3 0F 11 1D 53 51 6D 00 - movss [ASTLIBRA.exe+AE1C30],xmm3
ASTLIBRA.exe+40CADD: 76 0B - jna ASTLIBRA.exe+40CAEA
ASTLIBRA.exe+40CADF: 0F 57 DB - xorps xmm3,xmm3
ASTLIBRA.exe+40CAE2: F3 0F 11 1D 46 51 6D 00 - movss [ASTLIBRA.exe+AE1C30],xmm3
ASTLIBRA.exe+40CAEA: B9 5E 00 00 00 - mov ecx,0000005E
ASTLIBRA.exe+40CAEF: E8 2C 8B 00 00 - call ASTLIBRA.exe+415620
ASTLIBRA.exe+40CAF4: 84 C0 - test al,al
ASTLIBRA.exe+40CAF6: 74 58 - je ASTLIBRA.exe+40CB50
ASTLIBRA.exe+40CAF8: 0F 2F DE - comiss xmm3,xmm6
}
{
// ORIGINAL CODE - INJECTION POINT: ASTLIBRA.exe+358D5A
ASTLIBRA.exe+358D2A: 0F 2F C1 - comiss xmm0,xmm1
ASTLIBRA.exe+358D2D: 72 33 - jb ASTLIBRA.exe+358D62
ASTLIBRA.exe+358D2F: 40 84 FF - test dil,dil
ASTLIBRA.exe+358D32: 75 2E - jne ASTLIBRA.exe+358D62
ASTLIBRA.exe+358D34: F3 0F 5C C1 - subss xmm0,xmm1
ASTLIBRA.exe+358D38: C7 05 62 05 7E 01 BC 02 00 00 - mov [ASTLIBRA.exe+1B392A4],000002BC
ASTLIBRA.exe+358D42: 40 0F B6 DD - movzx ebx,bpl
ASTLIBRA.exe+358D46: 40 88 3D C1 3F 29 01 - mov [ASTLIBRA.exe+15ECD0E],dil
ASTLIBRA.exe+358D4D: 88 1D 9A 21 87 01 - mov [ASTLIBRA.exe+1BCAEED],bl
ASTLIBRA.exe+358D53: 40 88 3D DD 3F 29 01 - mov [ASTLIBRA.exe+15ECD37],dil
// ---------- INJECTING HERE ----------
ASTLIBRA.exe+358D5A: F3 0F 11 05 CE 8E 78 00 - movss [ASTLIBRA.exe+AE1C30],xmm0
// ---------- DONE INJECTING ----------
ASTLIBRA.exe+358D62: 8B 8C 24 38 01 00 00 - mov ecx,[rsp+00000138]
ASTLIBRA.exe+358D69: 32 C0 - xor al,al
ASTLIBRA.exe+358D6B: 85 C9 - test ecx,ecx
ASTLIBRA.exe+358D6D: 78 7B - js ASTLIBRA.exe+358DEA
ASTLIBRA.exe+358D6F: 83 3D A2 21 87 01 00 - cmp dword ptr [ASTLIBRA.exe+1BCAF18],00
ASTLIBRA.exe+358D76: 74 72 - je ASTLIBRA.exe+358DEA
ASTLIBRA.exe+358D78: 84 DB - test bl,bl
ASTLIBRA.exe+358D7A: 74 0D - je ASTLIBRA.exe+358D89
ASTLIBRA.exe+358D7C: 80 3D B3 3F 29 01 00 - cmp byte ptr [ASTLIBRA.exe+15ECD36],00
ASTLIBRA.exe+358D83: 0F B6 C0 - movzx eax,al
}