globalalloc(test,$100000)

// test 1: AOB should include instructino after the two we want to inject,
// the masked call, and the instruction afater which is different
// go to test+21 in the disassembler and try template

label(end1)
label(end2)

test:
// filler to get disassemblery on the right instructions
  db 90 90 90 90 90 90 90 90
  movzx edx,al
  test edx,edx
  jne end1               // short jump, should be same in other script
  mov eax,[ebp+08]
  push ecx
  fld dword ptr [eax+24]
  fstp dword ptr [esp]
  mov ecx,[ebp+08]
  push ecx
  fld dword ptr [ecx+20] // code inject here
  fstp dword ptr [esp]   // code inject here
  lea ecx,[ebp-000001DC] // should not be masked, 8 character hex ends in FFFF
  call 00619C40          // 4 bytes after call should be masked
  push eax
  lea ecx,[ebp-000001D4] // should not be masked, hex ends in FFFF
  call 00619540
end1:
  dq 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

test+1000: // different call should be masked and not unique, instruction after call is different
// filler to get disassemblery on the right instructions
  db 90 90 90 90 90 90 90 90
  movzx edx,al
  test edx,edx
  jne end2
  mov eax,[ebp+08]
  push ecx
  fld dword ptr [eax+24]
  fstp dword ptr [esp]
  mov ecx,[ebp+08]
  push ecx
  fld dword ptr [ecx+20] // code inject here
  fstp dword ptr [esp]   // code inject here
  lea ecx,[ebp-000001DC]
  call 00619C40          // different bytes, should be masked
  push ecx               // different instruction, will end the AOB
  lea ecx,[ebp-000001D4]
  call 00619540
end2:
  dq 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

{
005A1889 - 0FB6 D0               - movzx edx,al
005A188C - 85 D2                 - test edx,edx
005A188E - 75 58                 - jne 005A18E8
005A1890 - 8B 45 08              - mov eax,[ebp+08]
005A1893 - 51                    - push ecx
005A1894 - D9 40 24              - fld dword ptr [eax+24]
005A1897 - D9 1C 24              - fstp dword ptr [esp]
005A189A - 8B 4D 08              - mov ecx,[ebp+08]
005A189D - 51                    - push ecx
005A189E - D9 41 20              - fld dword ptr [ecx+20]
005A18A1 - D9 1C 24              - fstp dword ptr [esp]
005A18A4 - 8D 8D 24FEFFFF        - lea ecx,[ebp-000001DC]
005A18AA - E8 91830700           - call 00619C40
005A18AF - 50                    - push eax
005A18B0 - 8D 8D 2CFEFFFF        - lea ecx,[ebp-000001D4]
005A18B6 - E8 857C0700           - call 00619540
}