rendered paste bodyPUBLIC AveFix
.DATA
AveStealth dw 'a','v','e','_','s','t','e','a','l','t','h',0
.CODE
AveFix PROC
mov rdi, AveStealth
mov rsi, rdx ; skilldata name buffer
mov ecx, 0Ch ; length of abnormal name including null (12 for ave_stealth)
repe cmpsw ; compare words
jnz short lbNotAVE ; jump back to the server
mov rax, [rbp+0F0h]
mov dword ptr [rax+0D4h], 100000h ; move ave id
mov rax, 8F7386h
jmp rax ; jump to return of skilldata function
lbNotAVE:
mov rax, [rbp+0F0h] ; replace overwritten code
mov rbx, 8F0E3Dh
jmp rbx
AveFix ENDP
END