Bypass ASM Memory Updated By : Tayp.Anonymous

005381D9   . 0F84 B4000000  JE EngineCA.00538293
005381DF   . 3D 03010000    CMP EAX,103
005381E4   . 75 0D          JNZ SHORT EngineCA.005381F3
005381E6   . 53             PUSH EBX
005381E7   . 68 C8AE7400    PUSH EngineCA.0074AEC8                   ;  ASCII "CombatArms"
005381EC   . 68 E8AD7400    PUSH EngineCA.0074ADE8                   ;  ASCII "Another instance of this game is running.  
The program is shutting down."
005381F1   . EB 75          JMP SHORT EngineCA.00538268
005381F3   > 3D 01010000    CMP EAX,101
005381F8   . 75 0D          JNZ SHORT EngineCA.00538207
005381FA   . 53             PUSH EBX
005381FB   . 68 C8AE7400    PUSH EngineCA.0074AEC8                   ;  ASCII "CombatArms"
00538200   . 68 A0AD7400    PUSH EngineCA.0074ADA0                   ;  ASCII "An invalid file has been installed.  
Please reinstall the file."
00538205   . EB 61          JMP SHORT EngineCA.00538268
00538207   > 3D 05010000    CMP EAX,105
0053820C   . 75 0D          JNZ SHORT EngineCA.0053821B
0053820E   . 53             PUSH EBX
0053820F   . 68 C8AE7400    PUSH EngineCA.0074AEC8                   ;  ASCII "CombatArms"
00538214   . 68 40AD7400    PUSH EngineCA.0074AD40                   ;  ASCII "Debugger activity has been detected.  
Close the debugger first, then run the program again."
00538219   . EB 4D          JMP SHORT EngineCA.00538268
0053821B   > 3D 07010000    CMP EAX,107
00538220   . 75 0D          JNZ SHORT EngineCA.0053822F
00538222   . 53             PUSH EBX
00538223   . 68 C8AE7400    PUSH EngineCA.0074AEC8                   ;  ASCII "CombatArms"
00538228   . 68 F0AC7400    PUSH EngineCA.0074ACF0                   ;  ASCII "You need Administrative authority to run this.  
The program is shutting down."
0053822D   . EB 39          JMP SHORT EngineCA.00538268
0053822F   > 83F8 04        CMP EAX,4
00538232   . 75 0D          JNZ SHORT EngineCA.00538241
00538234   . 53             PUSH EBX
00538235   . 68 C8AE7400    PUSH EngineCA.0074AEC8                   ;  ASCII "CombatArms"
0053823A   . 68 A0AC7400    PUSH EngineCA.0074ACA0                   ;  ASCII "The program is running on compatibility mode.  
The program is shutting down."
0053823F   . EB 27          JMP SHORT EngineCA.00538268
00538241   > 8BD0           MOV EDX,EAX
00538243   . 52             PUSH EDX
00538244   . 8D8424 2003000>LEA EAX,DWORD PTR SS:[ESP+320]
0053824B   . 68 30AC7400    PUSH EngineCA.0074AC30                   ;  ASCII "An error has occurred with the hack prevention function.  (Error Code = %x)
The program is shutting down."
00538250   . 50             PUSH EAX
00538251   . FF15 34A57300  CALL DWORD PTR DS:[73A534]               ;  EngineCA.00B7121F
00538257   . 83C4 0C        ADD ESP,0C
0053825A   . 53             PUSH EBX
0053825B   . 68 C8AE7400    PUSH EngineCA.0074AEC8                   ;  ASCII "CombatArms"
00538260   . 8D8C24 2403000>LEA ECX,DWORD PTR SS:[ESP+324]
00538267   . 51             PUSH ECX
00538268   > 53             PUSH EBX                                 ; |hOwner
00538269   . FF15 ECA47300  CALL DWORD PTR DS:[73A4EC]               ; \MessageBoxA
0053826F   . 8B15 689A7D00  MOV EDX,DWORD PTR DS:[7D9A68]
00538275   . 8B42 04        MOV EAX,DWORD PTR DS:[EDX+4]
00538278   . 50             PUSH EAX
00538279   . 68 0CAC7400    PUSH EngineCA.0074AC0C                   ;  ASCII "Failed to _AhnHS_Initialize [%d]"
0053827E   . E8 DD451700    CALL EngineCA.006AC860
00538283   . 50             PUSH EAX
00538284   . E8 17471700    CALL EngineCA.006AC9A0
00538289   . 83C4 0C        ADD ESP,0C
0053828C   . 32C0           XOR AL,AL
0053828E   . E9 85000000    JMP EngineCA.00538318
00538293   > E8 7A951B00    CALL EngineCA.006F1812
00538298   . 8B0D 689A7D00  MOV ECX,DWORD PTR DS:[7D9A68]
0053829E   . 8941 04        MOV DWORD PTR DS:[ECX+4],EAX
005382A1   . A1 689A7D00    MOV EAX,DWORD PTR DS:[7D9A68]
005382A6   . 3958 04        CMP DWORD PTR DS:[EAX+4],EBX
005382A9   . 74 4C          JE SHORT EngineCA.005382F7
005382AB   . 8B50 04        MOV EDX,DWORD PTR DS:[EAX+4]
005382AE   . 52             PUSH EDX
005382AF   . 68 E8AB7400    PUSH EngineCA.0074ABE8                   ;  ASCII "Failed to _AhnHS_StartService [%d]"
005382B4   . E8 A7451700    CALL EngineCA.006AC860
005382B9   . 50             PUSH EAX
005382BA   . E8 E1461700    CALL EngineCA.006AC9A0
005382BF   . A1 689A7D00    MOV EAX,DWORD PTR DS:[7D9A68]
005382C4   . 8B48 04        MOV ECX,DWORD PTR DS:[EAX+4]
005382C7   . 51             PUSH ECX
005382C8   . 8D9424 2C03000>LEA EDX,DWORD PTR SS:[ESP+32C]
005382CF   . 68 30AC7400    PUSH EngineCA.0074AC30                   ;  ASCII "An error has occurred with the hack prevention function.  (Error Code = %x)
The program is shutting down."
005382D4   . 52             PUSH EDX
005382D5   . FF15 34A57300  CALL DWORD PTR DS:[73A534]               ;  EngineCA.00B7121F
005382DB   . 83C4 18        ADD ESP,18
005382DE   . 53             PUSH EBX                                 ; /Style
005382DF   . 68 C8AE7400    PUSH EngineCA.0074AEC8                   ; |Title = "CombatArms"

#define ADDR_BYPASS        0x5381D9 

DWORD WINAPI Bypass( LPVOID lpArgs ) 
{ 
    while( memcmp( ( CONST VOID * )ADDR_BYPASS, ( CONST VOID * )"\x0F\x84\xB4\x00\x00\x00", 6 ) != 0 ) 
        Sleep(100); 

    MEMCPY( ( LPVOID )ADDR_BYPASS, "\x3D\x03\x01\x00\x00", 5 ); 

    // Start here your hook or hack thread 

    return 0; 
} 

BOOL APIENTRY DllMain( HMODULE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved 
                     ) 
{ 
    switch( ul_reason_for_call ) 
    { 
    case DLL_PROCESS_ATTACH: 
        CreateThread( 0, 0, ( LPTHREAD_START_ROUTINE )Bypass, 0, 0, 0 );         
        break; 
    case DLL_THREAD_ATTACH: 
        break; 
    case DLL_THREAD_DETACH: 
        break; 
    case DLL_PROCESS_DETACH: 
        break; 
    } 
    return TRUE; 
}