I must create button and set to him already created font:

_text:004011CB                 push    0               ; lpParam
_text:004011CD                 push    hInstance       ; hInstance
_text:004011D3                 push    7A69h           ; hMenu
_text:004011D8                 push    [ebp+hWnd]      ; hWndParent
_text:004011DB                 push    14h             ; nHeight
_text:004011DD                 push    50h             ; nWidth
_text:004011DF                 push    64h             ; Y
_text:004011E1                 push    64h             ; X
_text:004011E3                 push    50000000h       ; dwStyle
_text:004011E8                 push    offset aExit    ; lpWindowName
_text:004011ED                 push    offset aButton  ; lpClassName
_text:004011F2                 push    20000h          ; dwExStyle
_text:004011F7                 call    CreateWindowExA
_text:004011FC                 mov     dword_0_40307C, eax
_text:00401201                 push    offset aMsSansSerif ; LPCSTR
_text:00401206                 push    0               ; DWORD
_text:00401208                 push    0               ; DWORD
_text:0040120A                 push    0               ; DWORD
_text:0040120C                 push    0               ; DWORD
_text:0040120E                 push    1               ; DWORD
_text:00401210                 push    0               ; DWORD
_text:00401212                 push    0               ; DWORD
_text:00401214                 push    0               ; DWORD
_text:00401216                 push    190h            ; int
_text:0040121B                 push    0               ; int
_text:0040121D                 push    0               ; int
_text:0040121F                 push    0               ; int
_text:00401221                 push    0Bh             ; int
_text:00401223                 call    CreateFontA
_text:00401228                 mov     wParam, eax
_text:0040122D                 push    0               ; lParam
_text:0040122F                 push    wParam          ; wParam
_text:00401235                 push    30h             ; Msg
_text:00401237                 push    dword_0_40307C  ; hWnd
_text:0040123D                 call    SendMessageA
_text:00401242                 jmp     short loc_0_401299

Now I must find some free space for code.. 
heh.. at 'code' it's 100h, but at 'data' it's 200h..

Ok, the new code will starts here 00403088h (0C88h)

Now I change code to:
_text:0040122D                 jmp     00403088h

Now I create button with 'random' caption.. I do 'BUTTON' caption.. like his class..

6A00                   push    0               ; lpParam
FF3560304000           push    hInstance       ; hInstance
68697A0000             push    7A68h           ; hMenu  ; NewID
FF7508                 push    [ebp+hWnd]      ; hWndParent
6A14                   push    14h             ; nHeight
6A50                   push    50h             ; nWidth
6A34                   push    34h             ; Y
6A64                   push    64h             ; X
6800000050             push    50000000h       ; dwStyle
6835304000             push    offset aButton  ; lpWindowName
6835304000             push    offset aButton  ; lpClassName
6800000200             push    20000h          ; dwExStyle
E835E2FFFF             call    CreateWindowExA
A384304000             mov     [00403084h], eax

; now set font to exit button
6A00                   push    0               ; lParam
FF3580304000           push    wParam          ; wParam
6A30                   push    30h             ; Msg
FF357C304000           push    dword_0_40307C  ; hWnd
E857E2FFFF             call    SendMessageA

; now set font to new button
6A00                   push    0               ; lParam
FF3580304000           push    wParam          ; wParam
6A30                   push    30h             ; Msg
FF3584304000           push    dword_0_403084  ; hWnd
E842E2FFFF             call    SendMessageA

E9A8E1FFFF             jmp loc_0_401299


Ok, now reme works correctly with new button :)

Now when someone click to the new button, must show messagebox

_text:004011A3                 cmp     [ebp+Msg], 111h  ; WM_COMMAND
_text:004011AA                 jnz     short loc_0_4011C5
_text:004011AC                 cmp     [ebp+wParam], 7A69h ; ExitBtn
_text:004011B3                 jnz     loc_0_401299  ; I change this!!
_text:004011B9                 push    0               ; nExitCode
_text:004011BB                 call    PostQuitMessage
_text:004011C0                 jmp     loc_0_401299

if command id != 7A69 then end wndproc loop..
Now i must change this to:
_text:004011B3: 0F85381F0000     jnz     004030F1h  ; New code

Now at 004030F1h:

817D10687A0000       cmp [ebp+wParam], 7A68h ; NewBtn
0F859BE1FFFF         jnz 00401299h

Now:

0F31          rdtsc   ; get some random in eax

Now I found 'HEXtoStr' function at 004012C4h..

I think this function have 2 params:

FUNC_01(aRandomNumber: DWORD, lpBuffer: DWORD);

Now:

68F4314000   push 004031F4h  ; some buffer
50           push eax
E8B8E1FFFF   call FUNC_01

6A00         push 0
6857304000   push 00403057h  ; caption "SIZE???"
68F4314000   push 004031F4h  ; string with random number
E954E1FFFF   jmp 00401271    ; show messagebox


Wow ;) reverseme is now broken ! :)


Bye, Bye !
_TeStON_/UnderPl
mailto: teston@chesti.com
http://teston.spox.biz/