Code:
Func ControlIsHovered($hHandle,$hWnd,$idControl,$dwHoveringAddress, $iSleep = 5)
$hKernel32 = _WinAPI_GetModuleHandle("Kernel32.dll")
$hUser32 = _WinAPI_GetModuleHandle("User32.dll")
$dwKernel32Sleep = _WinAPI_GetProcAddress($hKernel32, "Sleep")
$dwUser32GetForegroundWindow = _WinAPI_GetProcAddress($hUser32, "GetForegroundWindow")
$dwUser32GetWindowRect = _WinAPI_GetProcAddress($hUser32, "GetWindowRect")
$dwUser32GetPhysicalCursorPos = _WinAPI_GetProcAddress($hUser32, "GetPhysicalCursorPos")
$dwPage = "0x" & Hex(VirtualAllocEx($hHandle,0,0x128,0x3000,0x40),8)
$dwButtonPos = "0x" & Hex(VirtualAllocEx($hHandle,0,0x16,0x3000,0x40),8)
$dwWindowPos = "0x" & Hex(VirtualAllocEx($hHandle,0,0x16,0x3000,0x40),8)
$dwCursorPos = "0x" & Hex(VirtualAllocEx($hHandle,0,0x16,0x3000,0x40),8)
$aControlPosition = ControlGetPos($hWnd,"",$idControl)
$aWindowPosition = WinGetPos($Form1)
$aClientSize = WinGetClientSize($Form1)
$iBarSize = $aWindowPosition[3] - $aClientSize[1]
$aControlPosition[1] = $aControlPosition[1] + $iBarSize
$sBytes = Calculate($dwPage, _
"0xC705-" & $dwHoveringAddress & "-00000000" _ ; mov dword ptr [$dwHoveringAddress],0
& "6A" & Hex($iSleep,2) _ ; push xx
& "E8|" & $dwKernel32Sleep & "|" _ ; call Kernel32.Sleep
& "BE-" & Hex($hWnd,8) & "-" _ ; mov esi, hWnd
& "E8|" & $dwUser32GetForegroundWindow & "|" _ ; call User32.GetForegroundWindow
& "39F0" _ ; cmp eax,esi
& "75E1" _ ; jne dwPage
& "BB-" & $dwWindowPos & "-" _ ; mov ebx,$dwWindowPos
& "53" _ ; push ebx
& "56" _ ; push esi
& "E8|" & $dwUser32GetWindowRect & "|" _ ; call User32.GetWindowRect
& "A1-" & $dwButtonPos & "-" _ ; mov eax, [$dwButtonPos]
& "0103" _ ; add [ebx],eax
& "8B03" _ ; mov eax,[ebx]
& "0305-" & Hex($dwButtonPos+0x8,8) & "-" _ ; add eax, [$dwButtonPos+8]
& "894308" _ ; mov [ebx+08],eax
& "A1-" & Hex($dwButtonPos+0x4,8) & "-" _ ; add eax, [$dwButtonPos+4]
& "014304" _ ; add [ebx+04],eax
& "8B4304" _ ; mov eax,[ebx+04]
& "0305-" & Hex($dwButtonPos+0xC,8) & "-" _ ; add eax, [$dwButtonPos+C]
& "89430C" _ ; mov [ebx+0C],eax
& "BE-" & $dwCursorPos & "-" _ ; mov esi, $dwCursorPos
& "56" _ ; push esi
& "E8|" & $dwUser32GetPhysicalCursorPos & "|" _ ; call User32.GetPhysicalCursorPos
& "8B7E04" _ ; mov edi,[esi+04]
& "8B36" _ ; mov esi,[esi]
& "3B33" _ ; cmp esi,[ebx]
& "729B" _ ; jb dwPage
& "3B7B04" _ ; cmp edi,[ebx+04]
& "7296" _ ; jb dwPage
& "3B7308" _ ; cmp esi,[ebx+08]
& "7791" _ ; ja dwPage
& "3B7B0C" _ ; cmp edi,[ebx+0C]
& "778C" _ ; ja dwPage
& "C705-" & $dwHoveringAddress & "-01000000" _ ; mov dword ptr [$dwHoveringAddress], 1
& "EB8A") ; jmp dwPage+0xA
WriteProcessMemory($hHandle,$dwPage,"0x" & $sBytes,"Byte[" & StringLen($sBytes)/2 & "]")
For $i = 0 To 3
WriteProcessMemory($hHandle,$dwButtonPos+($i*4),$aControlPosition[$i],"dword")
Next
$hThread = CreateRemoteThread($hHandle,$dwPage)
Return $hThread
EndFunc