alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:


// DiabloImmortal.exe dectect process playing now

// esi = Engine/Binaries/Win64/DiabloImmortal.exe
// esi > hex = 88 45 6E 67 69 6E 65 2F 42 69 6E 61 72 69 65 73 2F 57 69 6E 36 34 2F 44 69 61 62 6C 6F 49 6D 6D 6F 72 74 61 6C 2E 65 78 65 00
// edi = Handle Event: "update processes event"


cmp byte ptr [esi-1],88 // -0x1 ?Engine
jne if00
cmp [esi+0],69676E45 // 0x0 Engine
jne if00
cmp [esi+4],422F656E // 0x4 ne/Binaries
jne if00
cmp [esi+16],62616944 // 0x0 DiabloImmortal.exe
jne if00
cmp [esi+16+4],6D496F6C // 0x4 DiabloImmortal.exe
jne if00
cmp [esi+16+8],74726F6D // 0x8 DiabloImmortal.exe
jne if00

//cmp [edi+0],646E6148 // 0x0 Handle Event: "update processes event"
//jne if00
//cmp [edi+16],636F7270 // 0x16 processes event"
//jne if00
//cmp [edi+20],6E657665 // 0x20 event"
//jne if00
cmp [edi+0],646E6148 // 0x0 Handle Event: "update processes event"
je if00
cmp [edi+0],07A93068 // 0x0 C:/Program Files
je if00
cmp [edi+0],502F3A43 // 0x0 https://level3.s
je if00




mov [esi+16+A],31307472 // DiabloImmortal.exe  >  DiabloImmort99.exe
if00:

// 32bit
// jmp E9 CB 2C 5D 08 > 08A00000
// 0042D330 > 085D2CCB - 08A00000
//   42D335
// 08A00000-0042D330-5  = 85D 2CCB


// jmp 0042D339 >  080A0080
// E9 B4 D2 38 F8 > F838D2B4
// 68 39 D3 42 00 C3 90


movdqu xmm0,[esi]
movdqu xmm1,[esi+10]
// movdqu [edi],xmm0
// movdqu [edi+10],xmm1

exit:
jmp returnhere

"Agent.exe"+3BD330:
jmp newmem
nop
nop
nop
nop
returnhere: