Code:
[ENABLE]
alloc(DetectGM,512)
label(ReturnName)
registersymbol(DetectGM)
DetectGM:
cmp [eax+70],5D4D475B //[GM]
je 00000000
mov [esi+0c],00000000
jmp ReturnName
00553F63: //C7 46 0C 00 00 00 00 89 47 04
jmp DetectGM
nop
nop
ReturnName:
[DISABLE]
dealloc(DetectGM)
unregistersymbol(DetectGM)
00553F63:
mov [esi+0c],00000000
You can update the offsets yourself. There is a tutorial in the release section.
+Report at 1:23AM GMT -8 for original question answered