Target: Baby Luv

Download Link:
http://trygames.com/game/aff=trygames/vid=dab85b8a2761513727aa83320906a9f4

ANALYSIS

GetTickCount DWORD:
MOV DWORD PTR DS:[6A5B04],-1

Jump to code cave:
006C7B3C    FF25 14706C00           JMP DWORD PTR DS:[6C7014]


Trigger API functions(DWORDS):

kernel32.GetSystemTimeAsFileTime: 006AB1DC
kernel32.CreateThread:		  006AB31C
kernel32.FindFirstFileA:	  006AB388
WININET.HttpOpenRequestA:	  006AC48C

Expiration:
00608DD4    84C0                    TEST AL,AL

Browser:
005C1BDA    84C0                    TEST AL,AL

Checkpoint:
00565964    A1 6AD77200             MOV EAX,DWORD PTR DS:[72D76A]
DS:[0062A40D]=1487AC5C


Goodboy/badboy:
005CF5CA    84C0                    TEST AL,AL

Code cave:
007F1000

Inline patch:

007F0FFF   .  90                    NOP
007F1000   .  60                    PUSHAD
007F1001   .  9C                    PUSHFD
007F1002   .  A1 DCB16A00           MOV EAX,DWORD PTR DS:[6AB1DC]
007F1007   .  A3 F00F7F00           MOV DWORD PTR DS:[7F0FF0],EAX
007F100C   .  C705 DCB16A00 1E107F0>MOV DWORD PTR DS:[6AB1DC],babyluv.007F101E
007F1016   .  9D                    POPFD
007F1017   .  61                    POPAD
007F1018   .- FF25 14706C00         JMP DWORD PTR DS:[6C7014]                      ;  babyluv.00588347
007F101E   .  60                    PUSHAD
007F101F   .  9C                    PUSHFD
007F1020   .  A1 F00F7F00           MOV EAX,DWORD PTR DS:[7F0FF0]
007F1025   .  A3 DCB16A00           MOV DWORD PTR DS:[6AB1DC],EAX
007F102A   .  C605 D48D6000 32      MOV BYTE PTR DS:[608DD4],32
007F1031   .  A1 1CB36A00           MOV EAX,DWORD PTR DS:[6AB31C]
007F1036   .  A3 F00F7F00           MOV DWORD PTR DS:[7F0FF0],EAX
007F103B   .  C705 1CB36A00 4D107F0>MOV DWORD PTR DS:[6AB31C],babyluv.007F104D
007F1045   .  9D                    POPFD
007F1046   .  61                    POPAD
007F1047   .- FF25 DCB16A00         JMP DWORD PTR DS:[6AB1DC]                      ;  kernel32.GetSystemTimeAsFileTime
007F104D   .  60                    PUSHAD
007F104E   .  9C                    PUSHFD
007F104F   .  A1 F00F7F00           MOV EAX,DWORD PTR DS:[7F0FF0]
007F1054   .  A3 1CB36A00           MOV DWORD PTR DS:[6AB31C],EAX
007F1059   .  C605 D48D6000 84      MOV BYTE PTR DS:[608DD4],84
007F1060   .  C605 DA1B5C00 32      MOV BYTE PTR DS:[5C1BDA],32
007F1067   .  C705 0DA46200 5CAC871>MOV DWORD PTR DS:[62A40D],1487AC5C
007F1071   .  66:C705 CAF55C00 B301 MOV WORD PTR DS:[5CF5CA],1B3
007F107A   .  A1 88B36A00           MOV EAX,DWORD PTR DS:[6AB388]
007F107F   .  A3 F00F7F00           MOV DWORD PTR DS:[7F0FF0],EAX
007F1084   .  C705 88B36A00 96107F0>MOV DWORD PTR DS:[6AB388],babyluv.007F1096
007F108E   .  9D                    POPFD
007F108F   .  61                    POPAD
007F1090   .- FF25 1CB36A00         JMP DWORD PTR DS:[6AB31C]                      ;  kernel32.CreateThread
007F1096   .  60                    PUSHAD
007F1097   .  9C                    PUSHFD
007F1098   .  A1 F00F7F00           MOV EAX,DWORD PTR DS:[7F0FF0]
007F109D   .  A3 88B36A00           MOV DWORD PTR DS:[6AB388],EAX
007F10A2   .  C605 DA1B5C00 84      MOV BYTE PTR DS:[5C1BDA],84
007F10A9   .  66:C705 CAF55C00 84C0 MOV WORD PTR DS:[5CF5CA],0C084
007F10B2   .  A1 8CC46A00           MOV EAX,DWORD PTR DS:[6AC48C]
007F10B7   .  A3 F00F7F00           MOV DWORD PTR DS:[7F0FF0],EAX
007F10BC   .  C705 8CC46A00 CE107F0>MOV DWORD PTR DS:[6AC48C],babyluv.007F10CE
007F10C6   .  9D                    POPFD
007F10C7   .  61                    POPAD
007F10C8   .- FF25 88B36A00         JMP DWORD PTR DS:[6AB388]                      ;  kernel32.FindFirstFileA
007F10CE   .  60                    PUSHAD
007F10CF   .  9C                    PUSHFD
007F10D0   .  C605 DA1B5C00 32      MOV BYTE PTR DS:[5C1BDA],32
007F10D7   .  C705 0DA46200 5CAC871>MOV DWORD PTR DS:[62A40D],1487AC5C
007F10E1   .  A1 F00F7F00           MOV EAX,DWORD PTR DS:[7F0FF0]
007F10E6   .  A3 8CC46A00           MOV DWORD PTR DS:[6AC48C],EAX
007F10EB   .  9D                    POPFD
007F10EC   .  61                    POPAD
007F10ED   .- FF25 8CC46A00         JMP DWORD PTR DS:[6AC48C]
007F10F3      90                    NOP

Inline template string:

90 60 9C A1 DC B1 6A 00 A3 F0 0F 7F 00 C7 05 DC B1 6A 00 1E 10 7F 00 9D 61 FF 25 14 70 6C 00 60
9C A1 F0 0F 7F 00 A3 DC B1 6A 00 C6 05 D4 8D 60 00 32 A1 1C B3 6A 00 A3 F0 0F 7F 00 C7 05 1C B3
6A 00 4D 10 7F 00 9D 61 FF 25 DC B1 6A 00 60 9C A1 F0 0F 7F 00 A3 1C B3 6A 00 C6 05 D4 8D 60 00
84 C6 05 DA 1B 5C 00 32 C7 05 0D A4 62 00 5C AC 87 14 66 C7 05 CA F5 5C 00 B3 01 A1 88 B3 6A 00
A3 F0 0F 7F 00 C7 05 88 B3 6A 00 96 10 7F 00 9D 61 FF 25 1C B3 6A 00 60 9C A1 F0 0F 7F 00 A3 88
B3 6A 00 C6 05 DA 1B 5C 00 84 66 C7 05 CA F5 5C 00 84 C0 A1 8C C4 6A 00 A3 F0 0F 7F 00 C7 05 8C
C4 6A 00 CE 10 7F 00 9D 61 FF 25 88 B3 6A 00 60 9C C6 05 DA 1B 5C 00 32 C7 05 0D A4 62 00 5C AC
87 14 A1 F0 0F 7F 00 A3 8C C4 6A 00 9D 61 FF 25 8C C4 6A 00 90








