DWORD dwSize = 0, dwBase = 0; void __declspec( naked ) hook_WardenAlloc() { _asm { pushad mov esi, [ esi + 4 ] mov dwSize, esi popad push 4 push 1000 push eax push 0 call VirtualAlloc mov dword ptr ds:[esi], eax mov dwBase, eax } /* 0070A706 > 6A 04 PUSH 4 ; /Protect = PAGE_READWRITE 0070A708 . 68 00100000 PUSH 1000 ; |AllocationType = MEM_COMMIT 0070A70D . 50 PUSH EAX ; |Size 0070A70E . 6A 00 PUSH 0 ; |Address = NULL 0070A710 . FF15 58218300 CALL DWORD PTR DS:[<&KERNEL32.VirtualAlloc>] ; \VirtualAlloc 0070A716 . 8906 MOV DWORD PTR DS:[ESI],EAX */ }