Removing reduntand code ²

After reading bobsobol's guide, I've found these routines:

Spoiler:

00431150 . 83EC 28 SUB ESP,28
00431153 . 53 PUSH EBX
00431154 . 55 PUSH EBP
00431155 . 8B2D 84825C00 MOV EBP,DWORD PTR DS:[<&USER32.GetWindow>; USER32.GetWindowTextA
0043115B . 56 PUSH ESI
0043115C . 8B7424 38 MOV ESI,DWORD PTR SS:[ESP+38]
00431160 . 57 PUSH EDI
00431161 . 6A 47 PUSH 47 ; /Count = 47 (71.)
00431163 . 33C0 XOR EAX,EAX ; |
00431165 . 68 68A17A00 PUSH game.007AA168 ; |Buffer = game.007AA168
0043116A . 56 PUSH ESI ; |hWnd
0043116B . BF 04A55C00 MOV EDI,game.005CA504 ; |
00431170 . 894424 40 MOV DWORD PTR SS:[ESP+40],EAX ; |
00431174 . 894424 34 MOV DWORD PTR SS:[ESP+34],EAX ; |
00431178 . 894424 1C MOV DWORD PTR SS:[ESP+1C],EAX ; |
0043117C . FFD5 CALL EBP ; \GetWindowTextA
0043117E . 8B1D C8825C00 MOV EBX,DWORD PTR DS:[<&USER32.GetClassN>; USER32.GetClassNameA
00431184 . 6A 1E PUSH 1E ; /Count = 1E (30.)
00431186 . 68 08A17A00 PUSH game.007AA108 ; |Buffer = game.007AA108
0043118B . 56 PUSH ESI ; |hWnd
0043118C . FFD3 CALL EBX ; \GetClassNameA
0043118E . 33C0 XOR EAX,EAX
00431190 . 894424 1C MOV DWORD PTR SS:[ESP+1C],EAX
00431194 . 894424 14 MOV DWORD PTR SS:[ESP+14],EAX
00431198 . 6A 09 PUSH 9 ; /Count = 9
0043119A . 8D4424 20 LEA EAX,DWORD PTR SS:[ESP+20] ; |
0043119E . 50 PUSH EAX ; |Buffer
0043119F . 56 PUSH ESI ; |hWnd
004311A0 . FFD5 CALL EBP ; \GetWindowTextA
004311A2 . 6A 06 PUSH 6 ; /Count = 6
004311A4 . 8D4C24 18 LEA ECX,DWORD PTR SS:[ESP+18] ; |
004311A8 . 51 PUSH ECX ; |Buffer
004311A9 . 56 PUSH ESI ; |hWnd
004311AA . FFD3 CALL EBX ; \GetClassNameA
004311AC . 8BF7 MOV ESI,EDI
004311AE . 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C]
004311B2 > 8A10 MOV DL,BYTE PTR DS:[EAX]
004311B4 . 8A1E MOV BL,BYTE PTR DS:[ESI]
004311B6 . 8ACA MOV CL,DL
004311B8 . 3AD3 CMP DL,BL
004311BA . 75 1E JNZ SHORT game.004311DA
004311BC . 84C9 TEST CL,CL
004311BE . 74 16 JE SHORT game.004311D6
004311C0 . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
004311C3 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
004311C6 . 8ACA MOV CL,DL
004311C8 . 3AD3 CMP DL,BL
004311CA . 75 0E JNZ SHORT game.004311DA
004311CC . 83C0 02 ADD EAX,2
004311CF . 83C6 02 ADD ESI,2
004311D2 . 84C9 TEST CL,CL
004311D4 .^75 DC JNZ SHORT game.004311B2
004311D6 > 33C0 XOR EAX,EAX
004311D8 . EB 05 JMP SHORT game.004311DF
004311DA > 1BC0 SBB EAX,EAX
004311DC . 83D8 FF SBB EAX,-1
004311DF > 85C0 TEST EAX,EAX
004311E1 . 75 43 JNZ SHORT game.00431226
004311E3 . BE FCA45C00 MOV ESI,game.005CA4FC ; ASCII "#3277"
004311E8 . 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14]
004311EC . 8D6424 00 LEA ESP,DWORD PTR SS:[ESP]
004311F0 > 8A10 MOV DL,BYTE PTR DS:[EAX]
004311F2 . 8A1E MOV BL,BYTE PTR DS:[ESI]
004311F4 . 8ACA MOV CL,DL
004311F6 . 3AD3 CMP DL,BL
004311F8 . 75 1E JNZ SHORT game.00431218
004311FA . 84C9 TEST CL,CL
004311FC . 74 16 JE SHORT game.00431214
004311FE . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
00431201 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
00431204 . 8ACA MOV CL,DL
00431206 . 3AD3 CMP DL,BL
00431208 . 75 0E JNZ SHORT game.00431218
0043120A . 83C0 02 ADD EAX,2
0043120D . 83C6 02 ADD ESI,2
00431210 . 84C9 TEST CL,CL
00431212 .^75 DC JNZ SHORT game.004311F0
00431214 > 33C0 XOR EAX,EAX
00431216 . EB 05 JMP SHORT game.0043121D
00431218 > 1BC0 SBB EAX,EAX
0043121A . 83D8 FF SBB EAX,-1
0043121D > 85C0 TEST EAX,EAX
0043121F . BF 01000000 MOV EDI,1
00431224 . 74 04 JE SHORT game.0043122A
00431226 > 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10]
0043122A > BE F0A45C00 MOV ESI,game.005CA4F0 ; ASCII "GameHack"
0043122F . 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C]
00431233 > 8A10 MOV DL,BYTE PTR DS:[EAX]
00431235 . 8A1E MOV BL,BYTE PTR DS:[ESI]
00431237 . 8ACA MOV CL,DL
00431239 . 3AD3 CMP DL,BL
0043123B . 75 1E JNZ SHORT game.0043125B
0043123D . 84C9 TEST CL,CL
0043123F . 74 16 JE SHORT game.00431257
00431241 . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
00431244 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
00431247 . 8ACA MOV CL,DL
00431249 . 3AD3 CMP DL,BL
0043124B . 75 0E JNZ SHORT game.0043125B
0043124D . 83C0 02 ADD EAX,2
00431250 . 83C6 02 ADD ESI,2
00431253 . 84C9 TEST CL,CL
00431255 .^75 DC JNZ SHORT game.00431233
00431257 > 33C0 XOR EAX,EAX
00431259 . EB 05 JMP SHORT game.00431260
0043125B > 1BC0 SBB EAX,EAX
0043125D . 83D8 FF SBB EAX,-1
00431260 > 85C0 TEST EAX,EAX
00431262 . 75 3E JNZ SHORT game.004312A2
00431264 . BE FCA45C00 MOV ESI,game.005CA4FC ; ASCII "#3277"
00431269 . 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14]
0043126D . 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
00431270 > 8A10 MOV DL,BYTE PTR DS:[EAX]
00431272 . 8A1E MOV BL,BYTE PTR DS:[ESI]
00431274 . 8ACA MOV CL,DL
00431276 . 3AD3 CMP DL,BL
00431278 . 75 1E JNZ SHORT game.00431298
0043127A . 84C9 TEST CL,CL
0043127C . 74 16 JE SHORT game.00431294
0043127E . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
00431281 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
00431284 . 8ACA MOV CL,DL
00431286 . 3AD3 CMP DL,BL
00431288 . 75 0E JNZ SHORT game.00431298
0043128A . 83C0 02 ADD EAX,2
0043128D . 83C6 02 ADD ESI,2
00431290 . 84C9 TEST CL,CL
00431292 .^75 DC JNZ SHORT game.00431270
00431294 > 33C0 XOR EAX,EAX
00431296 . EB 05 JMP SHORT game.0043129D
00431298 > 1BC0 SBB EAX,EAX
0043129A . 83D8 FF SBB EAX,-1
0043129D > 85C0 TEST EAX,EAX
0043129F . 75 01 JNZ SHORT game.004312A2
004312A1 . 47 INC EDI
004312A2 > BE E4A45C00 MOV ESI,game.005CA4E4 ; ASCII " "
004312A7 . 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C]
004312AB . EB 03 JMP SHORT game.004312B0
004312AD 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
004312B0 > 8A10 MOV DL,BYTE PTR DS:[EAX]
004312B2 . 8A1E MOV BL,BYTE PTR DS:[ESI]
004312B4 . 8ACA MOV CL,DL
004312B6 . 3AD3 CMP DL,BL
004312B8 . 75 1E JNZ SHORT game.004312D8
004312BA . 84C9 TEST CL,CL
004312BC . 74 16 JE SHORT game.004312D4
004312BE . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
004312C1 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
004312C4 . 8ACA MOV CL,DL
004312C6 . 3AD3 CMP DL,BL
004312C8 . 75 0E JNZ SHORT game.004312D8
004312CA . 83C0 02 ADD EAX,2
004312CD . 83C6 02 ADD ESI,2
004312D0 . 84C9 TEST CL,CL
004312D2 .^75 DC JNZ SHORT game.004312B0
004312D4 > 33C0 XOR EAX,EAX
004312D6 . EB 05 JMP SHORT game.004312DD
004312D8 > 1BC0 SBB EAX,EAX
004312DA . 83D8 FF SBB EAX,-1
004312DD > 85C0 TEST EAX,EAX
004312DF . 75 41 JNZ SHORT game.00431322
004312E1 . BE DCA45C00 MOV ESI,game.005CA4DC ; ASCII "#2770"
004312E6 . 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14]
004312EA . 8D9B 00000000 LEA EBX,DWORD PTR DS:[EBX]
004312F0 > 8A10 MOV DL,BYTE PTR DS:[EAX]
004312F2 . 8A1E MOV BL,BYTE PTR DS:[ESI]
004312F4 . 8ACA MOV CL,DL
004312F6 . 3AD3 CMP DL,BL
004312F8 . 75 1E JNZ SHORT game.00431318
004312FA . 84C9 TEST CL,CL
004312FC . 74 16 JE SHORT game.00431314
004312FE . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
00431301 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
00431304 . 8ACA MOV CL,DL
00431306 . 3AD3 CMP DL,BL
00431308 . 75 0E JNZ SHORT game.00431318
0043130A . 83C0 02 ADD EAX,2
0043130D . 83C6 02 ADD ESI,2
00431310 . 84C9 TEST CL,CL
00431312 .^75 DC JNZ SHORT game.004312F0
00431314 > 33C0 XOR EAX,EAX
00431316 . EB 05 JMP SHORT game.0043131D
00431318 > 1BC0 SBB EAX,EAX
0043131A . 83D8 FF SBB EAX,-1
0043131D > 85C0 TEST EAX,EAX
0043131F . 75 01 JNZ SHORT game.00431322
00431321 . 47 INC EDI
00431322 > BE D0A45C00 MOV ESI,game.005CA4D0
00431327 . 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C]
0043132B . EB 03 JMP SHORT game.00431330
0043132D 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
00431330 > 8A10 MOV DL,BYTE PTR DS:[EAX]
00431332 . 8A1E MOV BL,BYTE PTR DS:[ESI]
00431334 . 8ACA MOV CL,DL
00431336 . 3AD3 CMP DL,BL
00431338 . 75 1E JNZ SHORT game.00431358
0043133A . 84C9 TEST CL,CL
0043133C . 74 16 JE SHORT game.00431354
0043133E . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
00431341 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
00431344 . 8ACA MOV CL,DL
00431346 . 3AD3 CMP DL,BL
00431348 . 75 0E JNZ SHORT game.00431358
0043134A . 83C0 02 ADD EAX,2
0043134D . 83C6 02 ADD ESI,2
00431350 . 84C9 TEST CL,CL
00431352 .^75 DC JNZ SHORT game.00431330
00431354 > 33C0 XOR EAX,EAX
00431356 . EB 05 JMP SHORT game.0043135D
00431358 > 1BC0 SBB EAX,EAX
0043135A . 83D8 FF SBB EAX,-1
0043135D > 85C0 TEST EAX,EAX
0043135F . 75 41 JNZ SHORT game.004313A2
00431361 . BE DCA45C00 MOV ESI,game.005CA4DC ; ASCII "#2770"
00431366 . 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14]
0043136A . 8D9B 00000000 LEA EBX,DWORD PTR DS:[EBX]
00431370 > 8A10 MOV DL,BYTE PTR DS:[EAX]
00431372 . 8A1E MOV BL,BYTE PTR DS:[ESI]
00431374 . 8ACA MOV CL,DL
00431376 . 3AD3 CMP DL,BL
00431378 . 75 1E JNZ SHORT game.00431398
0043137A . 84C9 TEST CL,CL
0043137C . 74 16 JE SHORT game.00431394
0043137E . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
00431381 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
00431384 . 8ACA MOV CL,DL
00431386 . 3AD3 CMP DL,BL
00431388 . 75 0E JNZ SHORT game.00431398
0043138A . 83C0 02 ADD EAX,2
0043138D . 83C6 02 ADD ESI,2
00431390 . 84C9 TEST CL,CL
00431392 .^75 DC JNZ SHORT game.00431370
00431394 > 33C0 XOR EAX,EAX
00431396 . EB 05 JMP SHORT game.0043139D
00431398 > 1BC0 SBB EAX,EAX
0043139A . 83D8 FF SBB EAX,-1
0043139D > 85C0 TEST EAX,EAX
0043139F . 75 01 JNZ SHORT game.004313A2
004313A1 . 47 INC EDI
004313A2 > BE C4A45C00 MOV ESI,game.005CA4C4
004313A7 . 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C]
004313AB . EB 03 JMP SHORT game.004313B0
004313AD 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
004313B0 > 8A10 MOV DL,BYTE PTR DS:[EAX]
004313B2 . 8A1E MOV BL,BYTE PTR DS:[ESI]
004313B4 . 8ACA MOV CL,DL
004313B6 . 3AD3 CMP DL,BL
004313B8 . 75 1E JNZ SHORT game.004313D8
004313BA . 84C9 TEST CL,CL
004313BC . 74 16 JE SHORT game.004313D4
004313BE . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
004313C1 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
004313C4 . 8ACA MOV CL,DL
004313C6 . 3AD3 CMP DL,BL
004313C8 . 75 0E JNZ SHORT game.004313D8
004313CA . 83C0 02 ADD EAX,2
004313CD . 83C6 02 ADD ESI,2
004313D0 . 84C9 TEST CL,CL
004313D2 .^75 DC JNZ SHORT game.004313B0
004313D4 > 33C0 XOR EAX,EAX
004313D6 . EB 05 JMP SHORT game.004313DD
004313D8 > 1BC0 SBB EAX,EAX
004313DA . 83D8 FF SBB EAX,-1
004313DD > 85C0 TEST EAX,EAX
004313DF . 75 41 JNZ SHORT game.00431422
004313E1 . BE DCA45C00 MOV ESI,game.005CA4DC ; ASCII "#2770"
004313E6 . 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14]
004313EA . 8D9B 00000000 LEA EBX,DWORD PTR DS:[EBX]
004313F0 > 8A10 MOV DL,BYTE PTR DS:[EAX]
004313F2 . 8A1E MOV BL,BYTE PTR DS:[ESI]
004313F4 . 8ACA MOV CL,DL
004313F6 . 3AD3 CMP DL,BL
004313F8 . 75 1E JNZ SHORT game.00431418
004313FA . 84C9 TEST CL,CL
004313FC . 74 16 JE SHORT game.00431414
004313FE . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
00431401 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
00431404 . 8ACA MOV CL,DL
00431406 . 3AD3 CMP DL,BL
00431408 . 75 0E JNZ SHORT game.00431418
0043140A . 83C0 02 ADD EAX,2
0043140D . 83C6 02 ADD ESI,2
00431410 . 84C9 TEST CL,CL
00431412 .^75 DC JNZ SHORT game.004313F0
00431414 > 33C0 XOR EAX,EAX
00431416 . EB 05 JMP SHORT game.0043141D
00431418 > 1BC0 SBB EAX,EAX
0043141A . 83D8 FF SBB EAX,-1
0043141D > 85C0 TEST EAX,EAX
0043141F . 75 01 JNZ SHORT game.00431422
00431421 . 47 INC EDI
00431422 > BE B8A45C00 MOV ESI,game.005CA4B8 ; ASCII "Game Mas"
00431427 . 8D4424 1C LEA EAX,DWORD PTR SS:[ESP+1C]
0043142B . EB 03 JMP SHORT game.00431430
0043142D 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
00431430 > 8A10 MOV DL,BYTE PTR DS:[EAX]
00431432 . 8A1E MOV BL,BYTE PTR DS:[ESI]
00431434 . 8ACA MOV CL,DL
00431436 . 3AD3 CMP DL,BL
00431438 . 75 1E JNZ SHORT game.00431458
0043143A . 84C9 TEST CL,CL
0043143C . 74 16 JE SHORT game.00431454
0043143E . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
00431441 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
00431444 . 8ACA MOV CL,DL
00431446 . 3AD3 CMP DL,BL
00431448 . 75 0E JNZ SHORT game.00431458
0043144A . 83C0 02 ADD EAX,2
0043144D . 83C6 02 ADD ESI,2
00431450 . 84C9 TEST CL,CL
00431452 .^75 DC JNZ SHORT game.00431430
00431454 > 33C0 XOR EAX,EAX
00431456 . EB 05 JMP SHORT game.0043145D
00431458 > 1BC0 SBB EAX,EAX
0043145A . 83D8 FF SBB EAX,-1
0043145D > 85C0 TEST EAX,EAX
0043145F . 75 41 JNZ SHORT game.004314A2
00431461 . BE B0A45C00 MOV ESI,game.005CA4B0 ; ASCII "TWME1"
00431466 . 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14]
0043146A . 8D9B 00000000 LEA EBX,DWORD PTR DS:[EBX]
00431470 > 8A10 MOV DL,BYTE PTR DS:[EAX]
00431472 . 8A1E MOV BL,BYTE PTR DS:[ESI]
00431474 . 8ACA MOV CL,DL
00431476 . 3AD3 CMP DL,BL
00431478 . 75 1E JNZ SHORT game.00431498
0043147A . 84C9 TEST CL,CL
0043147C . 74 16 JE SHORT game.00431494
0043147E . 8A50 01 MOV DL,BYTE PTR DS:[EAX+1]
00431481 . 8A5E 01 MOV BL,BYTE PTR DS:[ESI+1]
00431484 . 8ACA MOV CL,DL
00431486 . 3AD3 CMP DL,BL
00431488 . 75 0E JNZ SHORT game.00431498
0043148A . 83C0 02 ADD EAX,2
0043148D . 83C6 02 ADD ESI,2
00431490 . 84C9 TEST CL,CL
00431492 .^75 DC JNZ SHORT game.00431470
00431494 > 33C0 XOR EAX,EAX
00431496 . EB 05 JMP SHORT game.0043149D
00431498 > 1BC0 SBB EAX,EAX
0043149A . 83D8 FF SBB EAX,-1
0043149D > 85C0 TEST EAX,EAX
0043149F . 75 01 JNZ SHORT game.004314A2
004314A1 . 47 INC EDI
004314A2 > 85FF TEST EDI,EDI
004314A4 . 5F POP EDI
004314A5 . 5E POP ESI
004314A6 . 5D POP EBP
004314A7 . 5B POP EBX
004314A8 . 74 10 JE SHORT game.004314BA
004314AA . 68 68A17A00 PUSH game.007AA168 ; /String2 = ""
004314AF . 68 B0A17A00 PUSH game.007AA1B0 ; |String1 = game.007AA1B0
004314B4 . FF15 34825C00 CALL DWORD PTR DS:[<&KERNEL32.lstrcpyA>] ; \lstrcpyA
004314BA > B8 01000000 MOV EAX,1
004314BF . 83C4 28 ADD ESP,28
004314C2 . C2 0800 RETN 8

It seems to be useless, as Olly doesnt show any calls or jmp in the first line.
Also this routine:

Spoiler:

00431500 . 83EC 68 SUB ESP,68
00431503 . 53 PUSH EBX
00431504 . 55 PUSH EBP
00431505 . 56 PUSH ESI
00431506 . 8B7424 78 MOV ESI,DWORD PTR SS:[ESP+78]
0043150A . 57 PUSH EDI
0043150B . 6A 47 PUSH 47 ; /Count = 47 (71.)
0043150D . 68 68A17A00 PUSH game.007AA168 ; |Buffer = game.007AA168
00431512 . 56 PUSH ESI ; |hWnd
00431513 . FF15 84825C00 CALL DWORD PTR DS:[<&USER32.GetWindowTex>; \GetWindowTextA
00431519 . 6A 1E PUSH 1E ; /Count = 1E (30.)
0043151B . 68 08A17A00 PUSH game.007AA108 ; |Buffer = game.007AA108
00431520 . 56 PUSH ESI ; |hWnd
00431521 . FF15 C8825C00 CALL DWORD PTR DS:[<&USER32.GetClassName>; \GetClassNameA
00431527 . 8B2D 34825C00 MOV EBP,DWORD PTR DS:[<&KERNEL32.lstrcpy>; Internat._lstrcpy
0043152D . 68 68A17A00 PUSH game.007AA168 ; /String2 = ""
00431532 . 8D4424 34 LEA EAX,DWORD PTR SS:[ESP+34] ; |
00431536 . 50 PUSH EAX ; |String1
00431537 . FFD5 CALL EBP ; \lstrcpyA
00431539 . 68 08A17A00 PUSH game.007AA108 ; /String2 = ""
0043153E . 8D4C24 14 LEA ECX,DWORD PTR SS:[ESP+14] ; |
00431542 . 51 PUSH ECX ; |String1
00431543 . FFD5 CALL EBP ; \lstrcpyA
00431545 . 8B35 D8825C00 MOV ESI,DWORD PTR DS:[<&USER32.CharLower>; USER32.CharLowerA
0043154B . 8D5424 30 LEA EDX,DWORD PTR SS:[ESP+30]
0043154F . 52 PUSH EDX ; /StringOrChar
00431550 . FFD6 CALL ESI ; \CharLowerA
00431552 . 8D4424 10 LEA EAX,DWORD PTR SS:[ESP+10]
00431556 . 50 PUSH EAX ; /StringOrChar
00431557 . FFD6 CALL ESI ; \CharLowerA
00431559 . A1 B8A27A00 MOV EAX,DWORD PTR DS:[7AA2B8]
0043155E . 33DB XOR EBX,EBX
00431560 . 85C0 TEST EAX,EAX
00431562 . 0F8E 8A000000 JLE game.004315F2
00431568 . BE C8A27A00 MOV ESI,game.007AA2C8
0043156D . 8D49 00 LEA ECX,DWORD PTR DS:[ECX]
00431570 > 8A4E F4 MOV CL,BYTE PTR DS:[ESI-C]
00431573 . 84C9 TEST CL,CL
00431575 . 8D46 F4 LEA EAX,DWORD PTR DS:[ESI-C]
00431578 . 74 50 JE SHORT game.004315CA
0043157A . 50 PUSH EAX
0043157B . 8D4C24 34 LEA ECX,DWORD PTR SS:[ESP+34]
0043157F . 51 PUSH ECX
00431580 . BF 01000000 MOV EDI,1
00431585 . E8 766A1800 CALL game.005B8000
0043158A . 83C4 08 ADD ESP,8
0043158D . 85C0 TEST EAX,EAX
0043158F . 74 17 JE SHORT game.004315A8
00431591 . 803E 00 CMP BYTE PTR DS:[ESI],0
00431594 . 74 14 JE SHORT game.004315AA
00431596 . 8D5424 30 LEA EDX,DWORD PTR SS:[ESP+30]
0043159A . 56 PUSH ESI
0043159B . 52 PUSH EDX
0043159C . E8 5F6A1800 CALL game.005B8000
004315A1 . 83C4 08 ADD ESP,8
004315A4 . 85C0 TEST EAX,EAX
004315A6 . 75 02 JNZ SHORT game.004315AA
004315A8 > 33FF XOR EDI,EDI
004315AA > 8A4E 0C MOV CL,BYTE PTR DS:[ESI+C]
004315AD . 84C9 TEST CL,CL
004315AF . 8D46 0C LEA EAX,DWORD PTR DS:[ESI+C]
004315B2 . 74 12 JE SHORT game.004315C6
004315B4 . 50 PUSH EAX
004315B5 . 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14]
004315B9 . 50 PUSH EAX
004315BA . E8 416A1800 CALL game.005B8000
004315BF . 83C4 08 ADD ESP,8
004315C2 . 85C0 TEST EAX,EAX
004315C4 . 74 04 JE SHORT game.004315CA
004315C6 > 85FF TEST EDI,EDI
004315C8 . 75 1C JNZ SHORT game.004315E6
004315CA > A1 B8A27A00 MOV EAX,DWORD PTR DS:[7AA2B8]
004315CF . 43 INC EBX
004315D0 . 83C6 24 ADD ESI,24
004315D3 . 3BD8 CMP EBX,EAX
004315D5 .^7C 99 JL SHORT game.00431570
004315D7 . 5F POP EDI
004315D8 . 5E POP ESI
004315D9 . 5D POP EBP
004315DA . B8 01000000 MOV EAX,1
004315DF . 5B POP EBX
004315E0 . 83C4 68 ADD ESP,68
004315E3 . C2 0800 RETN 8
004315E6 > 68 68A17A00 PUSH game.007AA168
004315EB . 68 B0A17A00 PUSH game.007AA1B0
004315F0 . FFD5 CALL EBP
004315F2 > 5F POP EDI
004315F3 . 5E POP ESI
004315F4 . 5D POP EBP
004315F5 . B8 01000000 MOV EAX,1
004315FA . 5B POP EBX
004315FB . 83C4 68 ADD ESP,68
004315FE . C2 0800 RETN 8

This would give alot of free space.
Do you think it is safe to clear it?

Not in kPT 1.98.4... probably because I did not removed X-trap (only disable it), I might need it one day... but thats the case only if this is part of X-trap code and not part of some PT security.
Same thing for the 2nd function, its in my client and its clearly doing "something".

As for your free space problem, I don't see what difference it would make if you add new section.

PS. what client you are using?

KPT 1988.

But IDK if this is for xtrap or not, my client doesnt load xtrap.

Than my question is: did you removed X-trap or only disable it, just like me?

If you removed it using bobsobol guide than this might be some unused code that bobsobol missed.
If you just disable it than I can clearly say that those functions are used when you login to PT (just when you appear ON PT map).

Or somewhere between 1984 -> 1988 they where disabled.
If you upload your game.exe I can check that for you.

I removed using bobsobol guide, not just disabling the TerminateProcess call.

About the game, i'll post it in the release sections.

as Vormav said,the two routines are parts of XTRAP.the easy way to make it clear is to make bp on the routine header by od.

I already did, they arent called.
But i maybe be called another time by some JMP ECX+OFFSET

That way, olly doesnt show where the routine is beeing called from. Thats why I came here.

here..
004314D0 /$ 6A 00 push 0 ; /lParam = 0
004314D2 |. 68 50114300 push 00431150 ; |Callback = game.00431150
004314D7 |. C605 B0A17A00>mov byte ptr [7AA1B0], 0 ; |
004314DE |. FF15 CC825C00 call dword ptr [<&USER32.EnumWindows>>; \EnumWindows
004314E4 |. A0 B0A17A00 mov al, byte ptr [7AA1B0]
004314E9 |. F6D8 neg al
004314EB |. 1BC0 sbb eax, eax
004314ED |. 25 B0A17A00 and eax, 7AA1B0
004314F2 \. C3 ret

indeed, this routine is , somehow, used in these places:

0043165E |> 6A 00 PUSH 0 ; /lParam = 0
00431660 |. 68 00154300 PUSH game.00431500 ; |Callback = game.00431500
00431665 |. C605 B0A17A00 >MOV BYTE PTR DS:[7AA1B0],0 ; |
0043166C |. FF15 CC825C00 CALL DWORD PTR DS:[<&USER32.EnumWindows>>; \EnumWindows

and

0043169F |> 6A 00 PUSH 0 ; /lParam = 0
004316A1 |. 68 00154300 PUSH game.00431500 ; |Callback = game.00431500
004316A6 |. C605 B0A17A00 >MOV BYTE PTR DS:[7AA1B0],0 ; |
004316AD |. FF15 CC825C00 CALL DWORD PTR DS:[<&USER32.EnumWindows>>; \EnumWindows

--EDIT--
arrgh, almost =P thanks rxaicy.

---------- Post added at 03:15 PM ---------- Previous post was at 03:10 PM ----------

its safe to remove it, along with these routines thar are calling them?

i am sorry , i am wrong ,they are not prts of XTRAP, it is just checking the game by API,such as EnumWindows,GetWindowsTextA,GetClassNameA,then by comparing something to achieve its effect...

So, there is no point in removing it, right?

Nope... don't, those functions are important, how did you get idea that those functions are unused? >=P

I just thought because they didnt have that black border in the left. :P

There are many routines which only become called dynamically as the game runs.

I usually set an IBP in OD, and playtest every function I can think of. It's very hard though, and lead to the problem that was found in one of the Butchered v3 clients.

Imagine if the routine is only called dynamically if the current players class is Priestess, and they are ageing a weapon which is currently +8... That's an extreme example, and I'm pretty sure the ageing routines aren't that complex... but some of the monster death routines are specific to class, currently active quests etc.

So if in doubt, it's probably best to leave them alone.

Another method I sometimes try (if I want to find out where a routine *might* be used) is to search for binary references to it's address. ie. Do a binary search across the entire memory range for the DWord that is it's start address.

As you say, these things usually end up being a Mov EDI, DWord [ECX*4+TableOffset] : Call EDI. But the table could be in any memory address, .text, .data, .rdata and it could be moved from it's initial address during runtime, so you'd still have to do the search several times, before starting WinMain(), before logging in, and after logging in... especially with different character classes.

You will probably also hit "false positives". Which is to say, you will probably find that there are some 4 byte combinations which just happen to be the same as the address of your routine, even though they are never used in that way... but that's always the problem, and power of Hex.

Oh yea... "Why not just add sections?" well, there are good reasons for adding sections, if you do it properly, most notably that you are not restricted (beyond the 2Gig memory limit) as to how much, or where you add your section. But let me give you some of the negative aspects of that method.

If you used something like ToPo, and don't remove the resource section first, and then replace it after, you make resource editing (especially adding) very hard.
If you don't set the memory permissions Read, Write, Execute, Initialized, Uninitialized etc. correctly you can open your program to malicious alterations that weren't there before, and if you set "initialized data" and "executable" and "writeable" then you are opening yourself up to DEP errors for anyone who (sensibly) sets DEP to default on.
If you move key routines for item tables, levelling tables and so on into a new section you are probably bypassing many existing securities in PT as per *CLSAFE_CODE and FuncBox etc... because the original memory space is included in those hashing algorithms, but new sections will be unknown to them. (You could find those routines and modify them so they do know about them)

Nothing insurmountable, but lots of things to be wary of, I think you'll agree. :wink:

Additionally, even if I move a routine into a new section, I like to NOP out the old routine, otherwise searching for code similar to the routine I'm looking for will show up multiple code sections, some of which have been disabled long ago... and that's just down right confusing for development. I think you know I also like to make extensive use of labels in Olly, just as I would when writing in a assembler source for later compilation... I often label disabled routines as such and sometimes comment what I believed they did before they where removed, or make a note of where the routine was moved to if that was the point. These only follow the .udd files Olly creates, and the moment you change the name or location of the file, the .udd is ignored... it also isn't portable across even minor versions of Olly, so I tend to keep a backup by exporting the Names table from Olly and keeping it as a CSV... then I have to manually go to all those addresses when I start a new development fork and put all the labels and comments back in manually. (I have asked if it would be possible to implement a routine to import comments and labels in Olly, but have had no response. I can also manually edit the .udd files from the version of Olly I like to use to map them from one file path to another, but that's really getting OT.)

There is also the third option which we haven't discussed here. Putting your new code and data into a DLL. This has an equal list of positive and negative, features and issues associated with it.

Quote:

Originally Posted by bobsobol

Oh yea... "Why not just add sections?" well, there are good reasons for adding sections, if you do it properly, most notably that you are not restricted (beyond the 2Gig memory limit) as to how much, or where you add your section. But let me give you some of the negative aspects of that method.

For client 2GB limit is not a problem I never passed that limit on game.exe or server.exe (I am sure that for real server 2GB for PT is not enough).
So I can't tell if "this" will work but did you try 4-gigabyte tuning?
Some OS (like 2003) have /3GB switch that you add to boot.ini to increase virtual space.
On 64bit OS PT should be able to get 4GB instead of 2GB, you just need to select "App can handle >2gb address space" flag.
But I have no way to test that on PT (putting trashes into PT memory would not be real test) so I can't tell for sure.

Quote:

Originally Posted by bobsobol

If you used something like ToPo, and don't remove the resource section first, and then replace it after, you make resource editing (especially adding) very hard.
If you don't set the memory permissions Read, Write, Execute, Initialized, Uninitialized etc. correctly you can open your program to malicious alterations that weren't there before, and if you set "initialized data" and "executable" and "writeable" then you are opening yourself up to DEP errors for anyone who (sensibly) sets DEP to default on.

Those problems will only pop ip if you do it wrong, you can also have memory leak in dll. -KPT-Endless-Tower-Update-V2.2 is an example how to NOT add new code to a game :)
I never used DEP... :)

Quote:

Originally Posted by bobsobol

If you move key routines for item tables, levelling tables and so on into a new section you are probably bypassing many existing securities in PT as per *CLSAFE_CODE and FuncBox etc... because the original memory space is included in those hashing algorithms, but new sections will be unknown to them. (You could find those routines and modify them so they do know about them)

Quote:

Originally Posted by Vormav

For client 2GB limit is not a problem I never passed that limit on game.exe or server.exe (I am sure that for real server 2GB for PT is not enough).
So I can't tell if "this" will work but did you try 4-gigabyte tuning?
Some OS (like 2003) have /3GB switch that you add to boot.ini to increase virtual space.
On 64bit OS PT should be able to get 4GB instead of 2GB, you just need to select "App can handle >2gb address space" flag.
But I have no way to test that on PT (putting trashes into PT memory would not be real test) so I can't tell for sure.

All agreed, and quite correct

Quote:

Originally Posted by Vormav

Those problems will only pop ip if you do it wrong, you can also have memory leak in dll. -KPT-Endless-Tower-Update-V2.2 is an example how to NOT add new code to a game :)

Agreed. I did say there where as many pros and cons to using DLLs, some are slightly different, some are exactly the same, and some are different sides of the same coin

Quote:

Originally Posted by Vormav

I never used DEP... :)

But I know you use Linux? You can't turn DEP off with a Linux kernel and a CPU that supports it... I always keep DEP enabled except for excluded applications, and frown on anything I have to add to the exclusion list.

Quote:

Originally Posted by Vormav

Well I am not sure about that, if X-trap is not guarding memory (because people disable it anyway) than if I move old code to new section and fix all offsets to it than it will work same way it was working before. Memory mapped files might be more confusing.

The FuncBox is a contiguous checksum read from the .text section of the PE (last time I looked) so if you put crucial code outside .text section, it is not included... that's not a trivial matter of updating pointers, it's a radical change to the functionality of the routine.

I can do that, and I'm pretty sure you can... but can most people here? And that's the point about using tools like ToPo or just making any old section and dumping Code, Constants and Variables all in the same section.

Quote:

Originally Posted by Vormav

I sometimes going a bit more extreme than just that, giving functions names, putting pseudocode with fixed names of variables under assembly just to understand some part of code ;)

Agreed. But it all depends how deep you need to go, and what you are trying to understand.

Quote:

Originally Posted by Vormav

Dll might be easier for developing but I think that adding new section is more rewarding in the end. New section giving you more integrity with .exe and I would not put code that control user EXP into dll... :)

I wouldn't worry about it in a DLL any more than I'd worry about having the item table or translation in an external data file... it just needs to be checked and verified as valid and unaltered, that's all.

I'm happier to break the server down into lots of DLLs than the client though... especially as I can unload startup code after the server is up and going that way, to free some memory again. And who is going to modify the DLLs on my server but me? :wink: