Return to Answer

The joy of shared instructions! Here are a couple of ideas for you to consider, both of which I'm going to be using Cheat Engine to demonstrate because it's fast becoming the superior dynamic analysis tool for game-hacking.

Something else you can do from that list of addresses is hit Ctrl + R to view the contents of registers. There, you can usually find a register containing a different value between all addresses (you'll want to look for a differing value that's NOT a dynamic memory addresses, because that value will change when restarting the game).

'S' lets your view the stack. There, you can look for values to differentiate. 'F' lets you view the contents of the FPU, and XMM registers. Sometimes, the latter can be helpful because, say, the FPU might have been used ONLY for health and not for any other values that shared instruction is writing to.

label(customCode)
label(restoreFlags)
label(originalCode)
label(return)

customCode:
  pushf //Preserve flags register by pushing onto the stack
  cmp ebx,2B //Does ebx contain the offset you're interested in?
  jne restoreFlags //If not, restore flags register and resume normal execution
  mov eax,(float)100 //If so, move a custom health value into eax for originalCode
  //Execution flow from here moves to restoreFlags

restoreFlags:
  popf //Restore flags register
  //Execution flow from here moves to originalCode

originalCode:
  mov [edx+0C],eax //eax contains either value from normal execution, or custom health
  jmp return //Return to the point we injected and resume normal execution

The joy of shared instructions! Here are a couple of ideas for you to consider, both of which I'm going to be using Cheat Engine to demonstrate, because it's fast becoming the superior dynamic analysis tool for game-hacking.

Something else you can do from that list of addresses is hit Ctrl + R to view the contents of registers. There, you can usually find a register containing a different value between all addresses (you'll want to look for a differing value that's NOT a dynamic memory address, because that value will change when restarting the game).

'S' lets you view the stack. There, you can look for values to differentiate. 'F' lets you view the contents of the FPU, and XMM registers. Sometimes, the latter can be helpful because, say, the FPU might have been used ONLY for health and not for any other values that shared instruction is writing to.

label(customCode)
label(restoreFlags)
label(originalCode)
label(return)

customCode:
  pushf //Preserve flags register by pushing onto the stack
  cmp ebx,2B //Does ebx contain the value you're interested in?
  jne restoreFlags //If not, restore flags register and resume normal execution
  mov eax,(float)100 //If so, move a custom health value into eax for originalCode
  //Execution flow from here moves to restoreFlags

restoreFlags:
  popf //Restore flags register
  //Execution flow from here moves to originalCode

originalCode:
  mov [edx+0C],eax //eax contains either value from normal execution, or custom health
  jmp return //Return to the point we injected and resume normal execution

In that case, your health address is being pointed to by [ecx+0C]. The value there is being moved into the eax register. What you could do is create a code injection at that instruction with which to write a custom health value to [ecx+0C] before the mov instruction runs. This is easy to do with Cheat Engine (via its native code injection functionality), but otherwise requires you to look into code-caving.

In that case, your health address is being pointed to by [ecx+0C]. The value there is being moved into the eax register. What you could do is create a code injection at that instruction with which to write a custom health value to [ecx+0C] before the mov instruction runs. That would change the actual value of health, and thus that custom value is then read from the address. This is easy to do with Cheat Engine (via its native code injection functionality), but otherwise requires you to look into code-caving.

Finally, when viewing the contents of registers, there are two little buttons on that window: 'S' and 'F'. 'S' lets your view the stack. There, you can look for values to differentiate. 'F' lets you view the contents of the FPU, and XMM registers. Sometimes, the latter can be helpful because, say, the FPU might have been used ONLY for health and not for any other values that shared instruction is writing to.

label(customCode)
label(restoreFlags)
label(originalCode)
label(return)

customCode:
  pushf //Preserve flags register by pushing onto the stack
  cmp ebx,2B //Does ebx contain the offset you're interested in?
  jne restoreFlags //If not, restore flags register and resume normal execution
  mov eax,(float)100 //If so, move a custom health value into eax for originalCode

restoreFlags:
  popf //Restore flags register

originalCode:
  mov [edx+0C],eax //eax contains either value from normal execution, or custom health
  jmp return //Return to the point we injected and resume normal execution

Finally, when viewing the contents of registers, there are two little buttons on that window: 'S' and 'F'. 

'S' lets your view the stack. There, you can look for values to differentiate. 'F' lets you view the contents of the FPU, and XMM registers. Sometimes, the latter can be helpful because, say, the FPU might have been used ONLY for health and not for any other values that shared instruction is writing to.

label(customCode)
label(restoreFlags)
label(originalCode)
label(return)

customCode:
  pushf //Preserve flags register by pushing onto the stack
  cmp ebx,2B //Does ebx contain the offset you're interested in?
  jne restoreFlags //If not, restore flags register and resume normal execution
  mov eax,(float)100 //If so, move a custom health value into eax for originalCode
  //Execution flow from here moves to restoreFlags

restoreFlags:
  popf //Restore flags register
  //Execution flow from here moves to originalCode

originalCode:
  mov [edx+0C],eax //eax contains either value from normal execution, or custom health
  jmp return //Return to the point we injected and resume normal execution