Push 0044EBD8???you at the right line, it says the command is a function, effected by the user,and probably the protection we are looking for (notice the words: Jmp = Jamp,Call = Call, Push = Push)??? now that we got the right line we have to find her