|
The code
[ENABLE]
alloc(newmem,2048) //2kb should be enough
label(exit)
label(returnhere)
4241AC:
jmp newmem
returnhere:
newmem:
cmp [10044FE8],ff
je exit
mov [10044FE4],00
pushad
pushfd
push 00000000
push 10000000
push 10003480
push 02
call SetWindowsHookExA
mov [10044FE8],ff
popfd
popad
exit:
mov ecx,[ebp-0c]
pop edi
pop esi
jmp returnhere
UnhookWindowsHookEx:
ret 0004
[DISABLE]
4241AC:
mov ecx,[ebp-0c]
pop edi
pop esi
10044FE4:
nop
UnhookWindowsHookEx:
ret 0004
|