![]() |
|
#14
|
|||
|
|||
|
004BDF78 . 6A 00 PUSH 0 ; /Arg1 = 00000000
004BDF7A . 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10] ; | 004BDF7D . 50 PUSH EAX ; |/Arg1 004BDF7E . A1 F0505800 MOV EAX,DWORD PTR DS:[5850F0] ; || 004BDF83 . 8945 E8 MOV DWORD PTR SS:[EBP-18],EAX ; || 004BDF86 . C645 EC 0B MOV BYTE PTR SS:[EBP-14],0B ; || 004BDF8A . 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18] ; || 004BDF8D . 33C9 XOR ECX,ECX ; || 004BDF8F . B8 70E04B00 MOV EAX,Copy_of_.004BE070 ; ||ASCII "Error 411 - CODE: %s" 004BDF94 . E8 3388F6FF CALL Copy_of_.004267CC ; |\Copy_of_.004267CC 004BDF99 . 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] ; | 004BDF9C . 66:8B0D 88E04B>MOV CX,WORD PTR DS:[4BE088] ; | 004BDFA3 . B2 01 MOV DL,1 ; | 004BDFA5 . E8 5240F9FF CALL Copy_of_.00451FFC ; \Copy_of_.00451FFC If you scroll up, this routine starts at: 004BDEC4 /. 55 PUSH EBP If you search for references to this, you get: References in Copy_of_: to 004BDEC4, item 1 Address=004BE179 Disassembly=PUSH Copy_of_.004BDEC4 Here is the routine: 004BE143 . 73 43 JNB SHORT Copy_of_.004BE188 004BE145 . 33C9 XOR ECX,ECX 004BE147 . B2 01 MOV DL,1 004BE149 . A1 58334500 MOV EAX,DWORD PTR DS:[453358] 004BE14E . E8 8D78F9FF CALL Copy_of_.004559E0 004BE153 . A3 F8F45800 MOV DWORD PTR DS:[58F4F8],EAX 004BE158 . 33D2 XOR EDX,EDX 004BE15A . A1 F8F45800 MOV EAX,DWORD PTR DS:[58F4F8] 004BE15F . E8 047AF9FF CALL Copy_of_.00455B68 004BE164 . BA 60EA0000 MOV EDX,0EA60 004BE169 . A1 F8F45800 MOV EAX,DWORD PTR DS:[58F4F8] 004BE16E . E8 057AF9FF CALL Copy_of_.00455B78 004BE173 . A1 FCF45800 MOV EAX,DWORD PTR DS:[58F4FC] 004BE178 . 50 PUSH EAX ; /Arg2 => 00000000 004BE179 . 68 C4DE4B00 PUSH Copy_of_.004BDEC4 ; |Arg1 = 004BDEC4 004BE17E . A1 F8F45800 MOV EAX,DWORD PTR DS:[58F4F8] ; | 004BE183 . E8 007AF9FF CALL Copy_of_.00455B88 ; \Copy_of_.00455B88 004BE188 > C3 RETN Change this line to: 004BE143 . EB 43 JMP SHORT SystemCl.004BE188 No more code 411 error message!!!! |
| Thread Tools | |
| Display Modes | |
|
|