.686p .mmx .model flat ; --------------------------------------------------------------------------- ; Segment type: Pure code seg000 segment byte public 'CODE' use32 assume cs:seg000 assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing ; eax = luaState ptr ; edx = image base ptr luahack_load proc near 000 53 push ebx 004 56 push esi 008 52 push edx 00C 57 push edi 010 E8 00 00 00 00 call [ luahack_push_eip ] ; Call Procedure luahack_push_eip: ; DATA XREF: luahack_load+4t ; luahack_load+Ao 014 59 pop ecx 010 83 E9 09 sub ecx, offset luahack_push_eip ; Integer Subtraction 010 89 D3 mov ebx, edx 010 89 D6 mov esi, edx 010 89 D7 mov edi, edx 010 81 C3 D5 C1 5C 00 add ebx, 5CC1D5h ; Add 010 81 C6 10 91 5C 00 add esi, 5C9110h ; Add 010 81 C7 FD C1 5C 00 add edi, 5CC1FDh ; Add 010 92 xchg eax, edx ; Exchange Register/Memory with Register 010 83 C6 0C add esi, 0Ch ; Add 010 05 4A 00 00 00 add eax, offset luahack_postreg ; Add 010 50 push eax ; interpreted by retn as return pointer luahack_reg: ; CODE XREF: luahack_load+4Dp ; luahack_load+55p ... 014 53 push ebx 018 52 push edx 01C FF 17 call dword ptr [edi] ; Indirect Call Near Procedure 01C 83 C4 08 add esp, 8 ; Add 014 56 push esi 018 52 push edx 01C FF 57 04 call dword ptr [edi+4] ; Indirect Call Near Procedure 01C 83 C4 08 add esp, 8 ; Add 014 6A 00 push 0 018 6A 01 push 1 01C 52 push edx 020 FF 57 08 call dword ptr [edi+8] ; Indirect Call Near Procedure 020 83 C4 0C add esp, 0Ch ; Add 014 C3 retn ; Return Near from Procedure ; --------------------------------------------------------------------------- luahack_postreg: ; DATA XREF: luahack_load+29o 010 83 C6 0B add esi, 0Bh ; Add 010 E8 DD FF FF FF call luahack_reg ; Call Procedure 010 83 C6 12 add esi, 12h ; Add 010 E8 D5 FF FF FF call luahack_reg ; Call Procedure 010 83 C6 10 add esi, 10h ; Add 010 E8 CD FF FF FF call luahack_reg ; Call Procedure 010 83 C6 0D add esi, 0Dh ; Add 010 E8 C5 FF FF FF call luahack_reg ; Call Procedure 010 83 C6 0D add esi, 0Dh ; Add 010 E8 BD FF FF FF call luahack_reg ; Call Procedure 010 83 C6 11 add esi, 11h ; Add 010 E8 B5 FF FF FF call luahack_reg ; Call Procedure 010 83 C6 0F add esi, 0Fh ; Add 010 E8 AD FF FF FF call luahack_reg ; Call Procedure 010 83 C6 10 add esi, 10h ; Add 010 E8 A5 FF FF FF call luahack_reg ; Call Procedure 010 83 C6 0E add esi, 0Eh ; Add 010 E8 9D FF FF FF call luahack_reg ; Call Procedure 010 92 xchg eax, edx ; restore eax = luaState ptr 010 5F pop edi 00C 5A pop edx 008 5E pop esi 004 5B pop ebx 000 C3 retn ; Return Near from Procedure luahack_load endp seg000 ends end