mov eax, dword ptr[HashAddress] ; Move hash address into EAX mov byte ptr ds:[eax], 0E9h ; Move E9 byte (Long jump used for code-cave) into value of EAX (Hash address) inc eax ; Incriment EAX (So that we move past E9 byte we just wrote) sub edx, dword ptr[HashAddress] ; Adjust offset for E9 jump sub edx, 5 ; Adjust offset for E9 jump mov dword ptr ds:[eax], edx ; Move location of CRC bypass codecave into EAX (Hash address+1) to complete jump add eax, 4 ; Add 4 bytes onto EAX (pointing it to the return address) mov dword ptr[HashAddress], eax ; Now move EAX into hash address so code-cave can use it. retn 0Ch