Auto-translated
Principle. Before - after. .004855E0: 55 push ebp .004855E1: 8BEC mov ebp,esp .004855E3: 83EC20 sub esp,020 ;' ' .004855E6: 53 push ebx .004855E7: 56 push esi .004855E8: 57 push edi .004855E9: 6A01 2push 1 .004855EB: 6A00 push 0 .004855ED: 6A00 push 0 .004855EF: 6A00 push 0 .004855F1: 8D45E0 lea eax,[ebp][-020] .004855F4: 50 push eax .004855F5: FF15D0965300 call PeekMessageA .004855FB: 85C0 test eax,eax .004855FD: 0F8419000000 jz .00048561C --1 .00485603: 8D45E0 lea eax,[ebp][-020] .00485606: 50 push eax .00485607: FF15CC965300 call TranslateMessage .0048560D: 8D45E0 lea eax,[ebp][-020] .00485610: 50 push eax .00485611: FF15C8965300 call DispatchMessageA .00485617: E9CDFFFFFF jmp .0004855E9 --2 .0048561C: E84F080000 1call .000485E70 --3 .00485621: 8945FC mov [ebp][-4],eax .00485624: 8B45FC mov eax,[ebp][-4] .00485627: 2B05AC375100 sub eax,[0005137AC] --4 .0048562D: 83F814 cmp eax,014 .00485630: 0F8E20000000 jle .000485656 --5 .00485636: 8B45FC mov eax,[ebp][-4] .00485639: A3AC375100 mov [0005137AC],eax --4 .0048563E: 833D243F520000 cmp d,[000523F24],0 .00485645: 0F850B000000 jnz .000485656 --5 .0048564B: 8B0DA8405200 mov ecx,[0005240A8] .00485651: E83AEFF7FF call .000404590 --6 .00485656: 8B45FC 5mov eax,[ebp][-4] .00485659: 2B05A8375100 sub eax,[0005137A8] --7 .0048565F: 3D96000000 cmp eax,000000096 ;' Ц' .00485664: 0F8E34000000 jle .00048569E --8 .0048566A: 8B45FC mov eax,[ebp][-4] .0048566D: A3A8375100 mov [0005137A8],eax --7 .00485672: 6A00 push 0 .00485674: 6A00 push 0 .00485676: 6A00 push 0 .00485678: 8D45E0 lea eax,[ebp][-020] .0048567B: 50 push eax .0048567C: FF15F4965300 call GetMessageA .00485682: 85C0 test eax,eax .00485684: 0F8414000000 jz .00048569E --8 .0048568A: 8D45E0 lea eax,[ebp][-020] .0048568D: 50 push eax .0048568E: FF15CC965300 call TranslateMessage .00485694: 8D45E0 lea eax,[ebp][-020] .00485697: 50 push eax .00485698: FF15C8965300 call DispatchMessageA .0048569E: E900000000 8jmp .0004856A3 --9 .004856A3: 5F 9pop edi .004856A4: 5E pop esi .004856A5: 5B pop ebx .004856A6: C9 leave .004856A7: C3 retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^- .004856A8: CC int 3 .004856A9: CC int 3 .004856AA: CC int 3 .004856AB: CC int 3 .004856AC: CC int 3 .004856AD: CC int 3 .004856AE: CC int 3 .004856AF: CC int 3 .004856B0: 55 push ebp .004855E0: 55 push ebp .004855E1: 8BEC mov ebp,esp .004855E3: 83EC20 sub esp,020 ;' ' .004855E6: 53 push ebx .004855E7: 56 push esi .004855E8: 57 push edi .004855E9: 6A01 2push 1 .004855EB: 6A00 push 0 .004855ED: 6A00 push 0 .004855EF: 6A00 push 0 .004855F1: 8D45E0 lea eax,[ebp][-020] .004855F4: 50 push eax .004855F5: FF15D0965300 call PeekMessageA .004855FB: 85C0 test eax,eax .004855FD: 0F8419000000 jz .00048561C --1 .00485603: 8D45E0 lea eax,[ebp][-020] .00485606: 50 push eax .00485607: FF15CC965300 call TranslateMessage .0048560D: 8D45E0 lea eax,[ebp][-020] .00485610: 50 push eax .00485611: FF15C8965300 call DispatchMessageA .00485617: E9CDFFFFFF jmp .0004855E9 --2 .0048561C: E84F080000 1call .000485E70 --3 .00485621: 8945FC mov [ebp][-4],eax .00485624: 8B45FC mov eax,[ebp][-4] .00485627: 2B05AC375100 sub eax,[0005137AC] --4 .0048562D: 83F814 cmp eax,014 .00485630: 0F8E20000000 jle .000485656 --5 .00485636: 8B45FC mov eax,[ebp][-4] .00485639: A3AC375100 mov [0005137AC],eax --4 .0048563E: 833D243F520000 cmp d,[000523F24],0 .00485645: 0F850B000000 jnz .000485656 --5 .0048564B: 8B0DA8405200 mov ecx,[0005240A8] .00485651: E83AEFF7FF call .000404590 --6 .00485656: 8B45FC 5mov eax,[ebp][-4] .00485659: 2B05A8375100 sub eax,[0005137A8] --7 .0048565F: 3D96000000 cmp eax,000000096 ;' Ц' .00485664: 0F8E34000000 jle .00048569E --8 .0048566A: 8B45FC mov eax,[ebp][-4] .0048566D: A3A8375100 mov [0005137A8],eax --7 .00485672: 6A00 push 0 .00485674: 6A00 push 0 .00485676: 6A00 push 0 .00485678: 8D45E0 lea eax,[ebp][-020] .0048567B: 50 push eax .0048567C: FF15F4965300 call GetMessageA .00485682: 85C0 test eax,eax .00485684: 0F8414000000 jz .00048569E --8 .0048568A: 8D45E0 lea eax,[ebp][-020] .0048568D: 50 push eax .0048568E: FF15CC965300 call TranslateMessage .00485694: 8D45E0 lea eax,[ebp][-020] .00485697: 50 push eax .00485698: FF15C8965300 call DispatchMessageA .0048569E: E900000000 8jmp .0004856A3 --9 .004856A3: 5F 9pop edi .004856A4: 5E pop esi .004856A5: 5B pop ebx .004856A6: C9 leave Changes started here: .004856A7: 6A01 push 1 .004856A9: FF15E8955300 call Sleep Restore the overwritten ret: .004856AF: C3 retn ; -^-^-^-^-^-^-^-^-^-^-^-^-^-^- Another function: .004856B0: 55 push ebp