; injection caves for debugging message hack use32 include "%INCLUDE%\MACRO\STRUCT.INC" include "%INCLUDE%\MACRO\STDCALL.INC" include "%INCLUDE%\EQUATES\KERNEL32.INC" include "%INCLUDE%\EQUATES\USER32.INC" include "%INCLUDE%\EQUATES\GDI32.INC" align 40h devdbg_50C6B900: ; called by 50C41972 push ebp call @F @@: pop ebp sub ebp,$6B900 + $5 + $1 ; call to devedit.5081B015 (takes 2 params) mov eax,[ebp+$6E610] push eax ; make space for a DWORD push esp ; address to previously pushed DWORD push eax mov ecx,[eax] call dword [ecx+44h] ; call to devedit.5081ACAD (takes 2 args) ; the pushed DWORD remains safely on stack ;mov eax,[$50C6E610] ;push esi ; buffer ;push eax ;mov ecx,[eax] ;call dword [ecx+48h] ; last call to devedit.5081AD18 (takes 6 params) pop edx ; restore the stacked DWORD mov eax,[ebp+$6E610] push 0 push 1 push 0 mov ecx,[esi] ; esi = ptr to line push ecx push edx push eax mov ecx,[eax] call dword [ecx+18h] pop ebp retn