// ODbgScript plugin v1.66.3
//---------------------------
bc
bphwcall
gpa "VirtualAlloc", "kernel32.dll"
bp $RESULT
_Next:
esto
cmp [esp+8], 3b6
jne _Next
find [esp], #8B4818518B55088B4210508B4DC051E8#
cmp $RESULT, 0
je _Error
bc
go $RESULT + 14
dm [esp], 10000, "c:\没有JJ.exe"
MSG "文件已存于 c:\没有JJ.exe"
ret
_Error:
MSG "失败"
ret