Loader

; *******************
; *   Loader 0.1      
; *******************
; *                  
; * Code     : *M*  
; * language : MASM
; *                  
; *******************

.586
.model flat,stdcall
option casemap:none
;===============================================================================
==============

include masm32includewindows.inc
include masm32includeuser32.inc
include masm32includekernel32.inc

includelib masm32libuser32.lib
includelib masm32libkernel32.lib
;===============================================================================
==============

.data

;// Target Process
target db "Conquer.exe",0

;// Injection Values

;Blacknull
        BN1 db 90h,90h
        BN2 db 0EBh

;Multi-Client
        MUL1 db 65h

;// Error Captions
    no_exe db "Conquer.exe not found",0;If file isnt found
    no_inject db "Couldn't Inject",0;If there is an injection error

;// PI
hInstance dd ?
startinfo STARTUPINFO <?>;the startupinfo structure
pi PROCESS_INFORMATION <?>;the process_information structure
;===============================================================================
==============

.code
start:

;// Get handle of loader
    invoke GetModuleHandle,NULL
    mov hInstance,eax

;// Create Process
    invoke CreateProcess,addr target,NULL,NULL,NULL,FALSE,NORMAL_PRIORITY_CLASS, NULL,NULL, addr startinfo,addr pi
    
;If Conquer.exe (target) is not found, Jump to error 1
    cmp eax,0;error ??
    jz error_1

;// Wait till process is in memory
;Set injection time to 0 miliseconds, this is necesary to inject blacknull code before play.exe error
;Not necessary for conquer but if an app had a CRC check, patches could be applied after a certain timeframe
    invoke WaitForInputIdle,pi.hProcess,0


;// Inject Code

;// Blacknull
        invoke WriteProcessMemory, pi.hProcess, 004483AAh, addr BN1, sizeof BN1, NULL
        invoke WriteProcessMemory, pi.hProcess, 004483C2h, addr BN2, sizeof BN2, NULL

;// Multi-Client
        invoke WriteProcessMemory, pi.hProcess, 004E4760h, addr MUL1, sizeof MUL1, NULL

;If code injection is not possible, Jump to error 2:
    cmp eax,0;error??
    jz error_2

;// End and launch apps
    fin:
    invoke ExitProcess,NULL
    error_1:
    invoke MessageBoxA,NULL,addr no_exe,NULL,NULL
    jmp fin
    error_2:
    invoke MessageBoxA,NULL,addr no_inject,NULL,NULL
    jmp fin
end start