.text:004174B3 sub_4174B3 proc near ; CODE XREF: sub_41E2F9+35p .text:004174B3 ; sub_41E3E4+7Ap ... .text:004174B3 .text:004174B3 arg_0 = dword ptr 8 .text:004174B3 arg_4 = dword ptr 0Ch .text:004174B3 .text:004174B3 push esi .text:004174B4 mov esi, [esp+arg_0] .text:004174B8 sub esi, ecx .text:004174BA mov ecx, [esp+arg_4] .text:004174BE sub ecx, edx ;snip .text:00417514 pop esi .text:00417515 retn 8 .text:00417515 sub_4174B3 endp ;Here's the call. .text:0041E310 push dword_4B8CC8 .text:0041E316 imul eax, 54D8h ;size of player struct .text:0041E31C push dword_4B8CC4 .text:0041E322 mov edx, dword_686484[eax] .text:0041E328 mov ecx, dword_686480[eax] .text:0041E32E call sub_4174B3 ;I don't know why this doesn't work. typedef int (__stdcall* Teleport_t)(int i1, int i2); Teleport_t pTeleport = (Teleport_t)0x4174B3; Teleport_t pTramp_Teleport = NULL; pTramp_Teleport = (Teleport_t)DetourFunction((PBYTE)pTeleport, (PBYTE)det_Teleport);