Target:
FORGOTTEN RIDDLES - Mayan princess

Download link:
http://trygames.com/game/aff=trygames/vid=964e247a37950f3ba65837557d6652f8

ANALYSIS

TRIGGER:
0045F13C    FF15 54B17800            CALL DWORD PTR DS:[78B154]                      ; kernel32.GetSystemTimeAsFileTime

EXPIRATION:
005867F9    84C0                    TEST AL,AL
005867FB    59                      POP ECX
005867FC    59                      POP ECX
005867FD    74 4D                   JE SHORT Forgotte.0058684C
005867FF    EB 02                   JMP SHORT Forgotte.00586803

WE LOOK FOR THIS, BUT IGNORE CONDITION
BROWSER:
0057EF27    84C0                    TEST AL,AL
0057EF29    EB 02                   JMP SHORT Forgotte.0057EF2D

AFTER HITTING ABOVE HWBP, DO A SEARCH>>FIND ALL COMMANDS FOR:
CALL DWORD PTR DS:[EAX+4]
SET A SWBP ON ALL COMMANDS FOUND FOR ABOVE
F9 RUN, THE 2ND SWBP HIT IS THE ONE!

TRIGGER:
004D0B62    FF15 94B27800            CALL DWORD PTR DS:[78B294]                      ; kernel32.CreateThread

ORIGINAL CALL:
0059232C    FF50 04                   CALL DWORD PTR DS:[EAX+4]
0059232F    51                        PUSH ECX
00592330    EB 02                     JMP SHORT Forgotte.00592334

AFTER:
0059232C    90                        NOP
0059232D    90                        NOP
0059232E    90                        NOP

TIMER:
NEXT: SET A HWBP ON SETTIMER API.
1ST HIT AFTER ABOVE, FIND RETURN PRECEDED BY A CALL:

BEFORE:
00541372    E8 CD0E0500                CALL Forgotte.00592244
00541377    EB 02                      JMP SHORT Forgotte.0054137B

AFTER:
00541372    90                         NOP
00541373    90                         NOP
00541374    90                         NOP
00541375    90                         NOP
00541376    90                         NOP

TRIGGER TO REMOVE ABOVE:
004DFE55    FF15 00B37800   CALL DWORD PTR DS:[78B300]               ; kernel32.FindFirstFileA

FINAL BROWSER:
TRIGGER:
004AA417    FF15 CCB87800           CALL DWORD PTR DS:[78B8CC]                      ; WININET.HttpOpenRequestA

ORIGINAL CALL:
0059232C    FF50 04                   CALL DWORD PTR DS:[EAX+4]
0059232F    51                        PUSH ECX
00592330    EB 02                     JMP SHORT Forgotte.00592334

AFTER:
0059232C    90                        NOP
0059232D    90                        NOP
0059232E    90                        NOP

INLINE PATCH:
BEFORE:
00798B3A    66:61                     POPAW
00798B3C  - FF25 14807900             JMP DWORD PTR DS:[798014]                       ; Forgotte.0061993B

AFTER:
00798B3C  - E9 BF351A00               JMP 0093C100
00798B41    90                        NOP

Code Cave:
0093C100

Inline patch:

0093C100    90                        NOP
0093C101    60                        PUSHAD
0093C102    9C                        PUSHFD
0093C103    A1 54B17800               MOV EAX,DWORD PTR DS:[78B154]
0093C108    A3 E0C09300               MOV DWORD PTR DS:[93C0E0],EAX
0093C10D    C705 54B17800 1FC19300    MOV DWORD PTR DS:[78B154],Forgotte.0093C11F
0093C117    9D                        POPFD
0093C118    61                        POPAD
0093C119  - FF25 14807900             JMP DWORD PTR DS:[798014]                       ; Forgotte.0061993B
0093C11F    60                        PUSHAD
0093C120    9C                        PUSHFD
0093C121    A1 E0C09300               MOV EAX,DWORD PTR DS:[93C0E0]
0093C126    A3 54B17800               MOV DWORD PTR DS:[78B154],EAX
0093C12B    C605 F9675800 32          MOV BYTE PTR DS:[5867F9],32
0093C132    A1 94B27800               MOV EAX,DWORD PTR DS:[78B294]
0093C137    A3 E0C09300               MOV DWORD PTR DS:[93C0E0],EAX
0093C13C    C705 94B27800 4EC19300    MOV DWORD PTR DS:[78B294],Forgotte.0093C14E
0093C146    9D                        POPFD
0093C147    61                        POPAD
0093C148  - FF25 54B17800             JMP DWORD PTR DS:[78B154]                       ; kernel32.GetSystemTimeAsFileTime
0093C14E    60                        PUSHAD
0093C14F    9C                        PUSHFD
0093C150    A1 E0C09300               MOV EAX,DWORD PTR DS:[93C0E0]
0093C155    A3 94B27800               MOV DWORD PTR DS:[78B294],EAX
0093C15A    C605 F9675800 84          MOV BYTE PTR DS:[5867F9],84
0093C161    66:C705 2C235900 9090     MOV WORD PTR DS:[59232C],9090
0093C16A    C605 2E235900 90          MOV BYTE PTR DS:[59232E],90
0093C171    C705 72135400 90909090    MOV DWORD PTR DS:[541372],90909090
0093C17B    C605 76135400 90          MOV BYTE PTR DS:[541376],90
0093C182    A1 00B37800               MOV EAX,DWORD PTR DS:[78B300]
0093C187    A3 E0C09300               MOV DWORD PTR DS:[93C0E0],EAX
0093C18C    C705 00B37800 9EC19300    MOV DWORD PTR DS:[78B300],Forgotte.0093C19E
0093C196    9D                        POPFD
0093C197    61                        POPAD
0093C198  - FF25 94B27800             JMP DWORD PTR DS:[78B294]                       ; kernel32.CreateThread
0093C19E    60                        PUSHAD
0093C19F    9C                        PUSHFD
0093C1A0    A1 E0C09300               MOV EAX,DWORD PTR DS:[93C0E0]
0093C1A5    A3 00B37800               MOV DWORD PTR DS:[78B300],EAX
0093C1AA    66:C705 2C235900 FF50     MOV WORD PTR DS:[59232C],50FF
0093C1B3    C605 2E235900 04          MOV BYTE PTR DS:[59232E],4
0093C1BA    C705 72135400 E8CD0E05    MOV DWORD PTR DS:[541372],50ECDE8
0093C1C4    C605 76135400 00          MOV BYTE PTR DS:[541376],0
0093C1CB    A1 CCB87800               MOV EAX,DWORD PTR DS:[78B8CC]
0093C1D0    A3 E0C09300               MOV DWORD PTR DS:[93C0E0],EAX
0093C1D5    C705 CCB87800 E7C19300    MOV DWORD PTR DS:[78B8CC],Forgotte.0093C1E7
0093C1DF    9D                        POPFD
0093C1E0    61                        POPAD
0093C1E1  - FF25 00B37800             JMP DWORD PTR DS:[78B300]                       ; kernel32.FindFirstFileA
0093C1E7    60                        PUSHAD
0093C1E8    9C                        PUSHFD
0093C1E9    A1 E0C09300               MOV EAX,DWORD PTR DS:[93C0E0]
0093C1EE    A3 CCB87800               MOV DWORD PTR DS:[78B8CC],EAX
0093C1F3    66:C705 2C235900 9090     MOV WORD PTR DS:[59232C],9090
0093C1FC    C605 2E235900 90          MOV BYTE PTR DS:[59232E],90
0093C203    9D                        POPFD
0093C204    61                        POPAD
0093C205  - FF25 CCB87800             JMP DWORD PTR DS:[78B8CC]                       ; WININET.HttpOpenRequestA

STRING:
90609CA154B17800A3E0C09300C70554B178001FC193009D61FF2514807900609C
A1E0C09300A354B17800C605F967580032A194B27800A3E0C09300C70594B27800
4EC193009D61FF2554B17800609CA1E0C09300A394B27800C605F967580084
66C7052C2359009090C6052E23590090C7057213540090909090C6057613540090
A100B37800A3E0C09300C70500B378009EC193009D61FF2594B27800609C
A1E0C09300A300B3780066C7052C235900FF50C6052E23590004C70572135400E8CD0E05
C6057613540000A1CCB87800A3E0C09300C705CCB87800E7C193009D61FF2500B37800
609CA1E0C09300A3CCB8780066C7052C2359009090C6052E235900909D61FF25CCB87800
