Target: Jigsaw Medley 2

Download Link:
http://trygames.com/game/aff=trygames/vid=3c009c127cd1b130ddeef1de0b731084

ANALYSIS:

GetTickCount DWORD:
MOV DWORD PTR DS:[7CF1AC],-1

Jump to code cave:
00828B3C  |.- FF25 14808200         JMP DWORD PTR DS:[828014]                      ;  dumped1.00614491

Trigger API functions(DWORDS):

kernel32.GetSystemTimeAsFileTime: 00812160
kernel32.CreateThread:		  008122A0
kernel32.FindFirstFileA:	  0081230C
WININET.HttpOpenRequestA:	  00812788

Expiration:
006CF01C    84C0                    TEST AL,AL

Browser:
0066AE02    84C0                    TEST AL,AL

Checkpoint:
00565964    A1 6AD77200             MOV EAX,DWORD PTR DS:[72D76A]
DS:[0072D76A]=A4A6C3CC
EAX=02330958

Goodboy/badboy:
006A0DC9    84C0                    TEST AL,AL

Code cave:
009EA000

Inline patch:

009EA000    60                      PUSHAD
009EA001    9C                      PUSHFD
009EA002    A1 60218100             MOV EAX,DWORD PTR DS:[812160]
009EA007    A3 F09F9E00             MOV DWORD PTR DS:[9E9FF0],EAX
009EA00C    C705 60218100 1EA09E00  MOV DWORD PTR DS:[812160],JigsawMe.009EA01E
009EA016    9D                      POPFD
009EA017    61                      POPAD
009EA018  - FF25 14808200           JMP DWORD PTR DS:[828014]                      ; JigsawMe.00614491
009EA01E    60                      PUSHAD
009EA01F    9C                      PUSHFD
009EA020    A1 F09F9E00             MOV EAX,DWORD PTR DS:[9E9FF0]
009EA025    A3 60218100             MOV DWORD PTR DS:[812160],EAX
009EA02A    C605 1CF06C00 32        MOV BYTE PTR DS:[6CF01C],32
009EA031    A1 A0228100             MOV EAX,DWORD PTR DS:[8122A0]
009EA036    A3 F09F9E00             MOV DWORD PTR DS:[9E9FF0],EAX
009EA03B    C705 A0228100 4DA09E00  MOV DWORD PTR DS:[8122A0],JigsawMe.009EA04D
009EA045    9D                      POPFD
009EA046    61                      POPAD
009EA047  - FF25 60218100           JMP DWORD PTR DS:[812160]                      ; kernel32.GetSystemTimeAsFileTime
009EA04D    60                      PUSHAD
009EA04E    9C                      PUSHFD
009EA04F    A1 F09F9E00             MOV EAX,DWORD PTR DS:[9E9FF0]
009EA054    A3 A0228100             MOV DWORD PTR DS:[8122A0],EAX
009EA059    C605 1CF06C00 84        MOV BYTE PTR DS:[6CF01C],84
009EA060    C605 02AE6600 32        MOV BYTE PTR DS:[66AE02],32
009EA067    C705 6AD77200 CCC3A6A4  MOV DWORD PTR DS:[72D76A],A4A6C3CC
009EA071    66:C705 C90D6A00 B301   MOV WORD PTR DS:[6A0DC9],1B3
009EA07A    A1 0C238100             MOV EAX,DWORD PTR DS:[81230C]
009EA07F    A3 F09F9E00             MOV DWORD PTR DS:[9E9FF0],EAX
009EA084    C705 0C238100 96A09E00  MOV DWORD PTR DS:[81230C],JigsawMe.009EA096
009EA08E    9D                      POPFD
009EA08F    61                      POPAD
009EA090  - FF25 A0228100           JMP DWORD PTR DS:[8122A0]                      ; kernel32.CreateThread
009EA096    60                      PUSHAD
009EA097    9C                      PUSHFD
009EA098    A1 F09F9E00             MOV EAX,DWORD PTR DS:[9E9FF0]
009EA09D    A3 0C238100             MOV DWORD PTR DS:[81230C],EAX
009EA0A2    C605 02AE6600 84        MOV BYTE PTR DS:[66AE02],84
009EA0A9    66:C705 C90D6A00 84C0   MOV WORD PTR DS:[6A0DC9],0C084
009EA0B2    9D                      POPFD
009EA0B3    61                      POPAD
009EA0B4  - FF25 0C238100           JMP DWORD PTR DS:[81230C]                      ; kernel32.FindFirstFileA

Inline patch binary string:

90 60 9C A1 60 21 81 00 A3 F0 9F 9E 00 C7 05 60 21 81 00 1E A0 9E 00 9D 61 FF 25 14 80 82 00 60
9C A1 F0 9F 9E 00 A3 60 21 81 00 C6 05 1C F0 6C 00 32 A1 A0 22 81 00 A3 F0 9F 9E 00 C7 05 A0 22
81 00 4D A0 9E 00 9D 61 FF 25 60 21 81 00 60 9C A1 F0 9F 9E 00 A3 A0 22 81 00 C6 05 1C F0 6C 00
84 C6 05 02 AE 66 00 32 C7 05 6A D7 72 00 CC C3 A6 A4 66 C7 05 C9 0D 6A 00 B3 01 A1 0C 23 81 00
A3 F0 9F 9E 00 C7 05 0C 23 81 00 96 A0 9E 00 9D 61 FF 25 A0 22 81 00 60 9C A1 F0 9F 9E 00 A3 0C
23 81 00 C6 05 02 AE 66 00 84 66 C7 05 C9 0D 6A 00 84 C0 9D 61 FF 25 0C 23 81 00



