Detected Detour

 
void HideModule(HINSTANCE hModule)
{
        DWORD dwPEB_LDR_DATA = 0;
        _asm
        {
        pushad;
        pushfd;
        mov eax, fs:[30h];
        mov eax, [eax+0Ch];
        mov dwPEB_LDR_DATA, eax;
        mov esi, [eax+0Ch];
        mov edx, [eax+10h];
        LoopInLoadOrderModuleList:
                lodsd;
                mov esi, eax;
                mov ecx, [eax+18h];
                cmp ecx, hModule;
                jne SkipA
                mov ebx, [eax]
                mov ecx, [eax+4]
                mov [ecx], ebx
                mov [ebx+4], ecx
                jmp InMemoryOrderModuleList
        SkipA:
                cmp edx, esi
                jne LoopInLoadOrderModuleList
InMemoryOrderModuleList:
        mov eax, dwPEB_LDR_DATA
        mov esi, [eax+14h]
        mov edx, [eax+18h]
        LoopInMemoryOrderModuleList:
                lodsd
                mov esi, eax
                mov ecx, [eax+10h]
                cmp ecx, hModule
                jne SkipB
                mov ebx, [eax]
                mov ecx, [eax+4]
                mov [ecx], ebx
                mov [ebx+4], ecx
                jmp InInitializationOrderModuleList
        SkipB:
                cmp edx, esi
                jne LoopInMemoryOrderModuleList
InInitializationOrderModuleList:
        mov eax, dwPEB_LDR_DATA
        mov esi, [eax+1Ch]
        mov edx, [eax+20h]
        LoopInInitializationOrderModuleList:
                lodsd
                mov esi, eax      
                mov ecx, [eax+08h]
                cmp ecx, hModule      
                jne SkipC
                mov ebx, [eax]
                mov ecx, [eax+4]
                mov [ecx], ebx
                mov [ebx+4], ecx
                jmp Finished
        SkipC:
                cmp edx, esi
                jne LoopInInitializationOrderModuleList
        Finished:
                popfd;
                popad;
        }
}

 
DWORD WINAPI FreezeXTrap()
{
    while(1)
    {
        DWORD XTrapPID = GetProcessId("XTrap.xt");
 
        if(XTrapPID != 0)
        {
			_NtSuspendProcess NtSuspendProcess = (_NtSuspendProcess) GetProcAddress( GetModuleHandle( "ntdll" ), "NtSuspendProcess" ); 
            HANDLE XTrap = OpenProcess(PROCESS_ALL_ACCESS, false, XTrapPID);
            NtSuspendProcess(XTrap);
 
            return 0;
        }
        Sleep(5000);
    }
}

 
DWORD WINAPI HookThread(void)
{
	while(!hModule)
	{
		hModule = GetModuleHandle ("d3d9.dll");
		Sleep(200);
	}
 
	dwGlobal = dwFindPattern((DWORD)hModule, 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
	memcpy(&VTableStart, (void*)(dwGlobal+2), 4);
	pEndScene = ( EndScene_t )HookVTable( (DWORD**) dwGlobal, 42, (PBYTE) hkEndScene);
	return 0;
}

 
PBYTE HookVTable(DWORD** VTablePtr, int VTableIndex, PBYTE HookPtr)
{
	DWORD oldProtect;
	VirtualProtect((void*)((*VTablePtr)+(VTableIndex*sizeof(DWORD))),sizeof(DWORD),PAGE_EXECUTE_READWRITE,&oldProtect);
	PBYTE original=((BYTE*)(*VTablePtr)[VTableIndex]);
	(*VTablePtr)[VTableIndex]=(DWORD)HookPtr;
	VirtualProtect((void*)((*VTablePtr)+(VTableIndex*sizeof(DWORD))),sizeof(DWORD),oldProtect,&oldProtect);
	return original;
}