Function at 0x401000
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push str.Trainer_By_SiMON
push 1
push 0
call sub.KERNEL32.dll_CreateMutexA
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x40101c
jmp 0x401036
push 0x10
push 0x4033ca
push 0x4033cf
push 0
call sub.USER32.dll_MessageBoxA
push 0
call sub.KERNEL32.dll_ExitProcess
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x403533], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [section..data], eax
call sub.KERNEL32.dll_IsDebuggerPresent
cmp eax, 1
je 0x4010ee
push 0x40302d
push 0
call sub.USER32.dll_FindWindowA
test eax, eax
je 0x401071
jmp 0x4010f4
push 0
push 0x4000000
push 3
push 0
push 3
push 0xc0000000
push str..SIWVID
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4010f2
push 0
push 0x4000000
push 3
push 0
push 3
push 0xc0000000
push str..SICE
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4010f2
push 0
push 0x4000000
push 3
push 0
push 3
push 0xc0000000
push str..TRASPY
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4010f4
jmp 0x401117
jmp 0x4010f8
jmp 0x4010f8
jmp 0x4010f8
push 0
call sub.USER32.dll_GetDC
push 0x3d
push str.Hacker_Alert_____Stop_Hacking_My_Trainer_NOW_____YOU_FUCK____
push 0
push 0
push eax
call sub.GDI32.dll_TextOutA
push 0
call sub.KERNEL32.dll_ExitProcess
push 0
push 0x40112d
push 0
push 0x69
push dword [0x403533]
call sub.USER32.dll_DialogBoxParamA
push ebp
mov ebp, esp
push 0x73
push 4
push 0
push dword [ebp + 8]
call sub.USER32.dll_RegisterHotKey
cmp dword [ebp + 0xc], 0x110
jne 0x401301
push 0x31
push 2
push 1
push dword [ebp + 8]
call sub.USER32.dll_RegisterHotKey
push 0x32
push 2
push 2
push dword [ebp + 8]
call sub.USER32.dll_RegisterHotKey
push 0x33
push 2
push 3
push dword [ebp + 8]
call sub.USER32.dll_RegisterHotKey
push 0x31
push 1
push 4
push dword [ebp + 8]
call sub.USER32.dll_RegisterHotKey
push 0x32
push 1
push 5
push dword [ebp + 8]
call sub.USER32.dll_RegisterHotKey
push 0x33
push 1
push 6
push dword [ebp + 8]
call sub.USER32.dll_RegisterHotKey
pushal
push 0
push 0x5a
push 1
push dword [ebp + 8]
call sub.USER32.dll_SetTimer
push 0
push 0x5a
push 2
push dword [ebp + 8]
call sub.USER32.dll_SetTimer
push 0
push 0x258
push 3
push dword [ebp + 8]
call sub.USER32.dll_SetTimer
push 0x69
push dword [0x403533]
call sub.USER32.dll_LoadIconA
mov dword [0x403537], eax
push eax
push 0
push 0x80
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
push str.Trainer_By_SiMON
push 0
push 0xc
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
push 0x8d
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x403553], eax
push str._C__2005___SiMON_STUDiO
push dword [0x403553]
call sub.USER32.dll_SetWindowTextA
push 0x8f
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x403553], eax
push 0x403394
push dword [0x403553]
call sub.USER32.dll_SetWindowTextA
push 0x90
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x403553], eax
push 0x40339d
push dword [0x403553]
call sub.USER32.dll_SetWindowTextA
push 0x91
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x403553], eax
push 0x4033a6
push dword [0x403553]
call sub.USER32.dll_SetWindowTextA
push 0x92
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x403553], eax
push 0x4033af
push dword [0x403553]
call sub.USER32.dll_SetWindowTextA
push 0x93
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x403553], eax
push 0x4033b8
push dword [0x403553]
call sub.USER32.dll_SetWindowTextA
push 0x94
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x403553], eax
push 0x4033c1
push dword [0x403553]
call sub.USER32.dll_SetWindowTextA
pop eax
mov eax, 0
leave
ret 0x10
cmp dword [ebp + 0xc], 0x10
jne 0x401377
push 0x134
push str.Game_hacked_by_SiMON
push 0x40351c
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
cmp eax, 7
je 0x401372
xor eax, eax
push 0
push dword [ebp + 8]
call sub.USER32.dll_UnregisterHotKey
push 1
push dword [ebp + 8]
call sub.USER32.dll_UnregisterHotKey
push 2
push dword [ebp + 8]
call sub.USER32.dll_UnregisterHotKey
push 3
push dword [ebp + 8]
call sub.USER32.dll_UnregisterHotKey
push 4
push dword [ebp + 8]
call sub.USER32.dll_UnregisterHotKey
push 5
push dword [ebp + 8]
call sub.USER32.dll_UnregisterHotKey
push 6
push dword [ebp + 8]
call sub.USER32.dll_UnregisterHotKey
push 0
call sub.KERNEL32.dll_ExitProcess
jmp 0x4016aa
cmp dword [ebp + 0xc], 0x312
jne 0x4014ed
cmp dword [ebp + 0x10], 0
jne 0x4013f9
push 0x40335d
push 0
call sub.USER32.dll_FindWindowA
or eax, eax
jne 0x40139c
jmp 0x4013f4
mov dword [0x40353b], eax
push 0x403543
push dword [0x40353b]
call sub.USER32.dll_GetWindowThreadProcessId
push dword [0x403543]
push 0
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x40353f], eax
push 0x403557
push dword [0x40353f]
call sub.KERNEL32.dll_GetExitCodeProcess
push dword [0x403557]
push dword [0x40353f]
call sub.KERNEL32.dll_TerminateProcess
push dword [0x40353f]
call sub.KERNEL32.dll_CloseHandle
jmp 0x4016aa
cmp dword [ebp + 0x10], 1
jne 0x401421
call fcn.004017e7
push 1
push 0x40352d
push 0x4057b5
push 0x40335d
push 0
call fcn.004016e1
jmp 0x4016aa
cmp dword [ebp + 0x10], 2
jne 0x401449
call fcn.004017e7
push 1
push str.__HHH
push 0x40606e
push 0x40335d
push 0
call fcn.004016e1
jmp 0x4016aa
cmp dword [ebp + 0x10], 3
jne 0x401471
call fcn.004017e7
push 1
push 0x40352f
push 0x40652b
push 0x40335d
push 0
call fcn.004016e1
jmp 0x4016aa
cmp dword [ebp + 0x10], 4
jne 0x401499
call fcn.004017e7
push 1
push 0x403530
push 0x4057b5
push 0x40335d
push 0
call fcn.004016e1
jmp 0x4016aa
cmp dword [ebp + 0x10], 5
jne 0x4014c1
call fcn.004017e7
push 1
push 0x403531
push 0x40606e
push 0x40335d
push 0
call fcn.004016e1
jmp 0x4016aa
cmp dword [ebp + 0x10], 6
jne 0x4016aa
call fcn.004017e7
push 1
push 0x403532
push 0x40652b
push 0x40335d
push 0
call fcn.004016e1
jmp 0x4016aa
cmp dword [ebp + 0xc], 0x111
jne 0x401617
mov eax, dword [ebp + 0x10]
cmp ax, 0x65
jne 0x401528
shr eax, 0x10
or ax, ax
jne 0x4016aa
push 0x40
push 0x4033e2
push 0x4033e7
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
jmp 0x4016aa
cmp ax, 0x66
jne 0x401544
shr eax, 0x10
or ax, ax
jne 0x4016aa
jmp 0x401307
cmp ax, 0x8e
jne 0x40156f
shr eax, 0x10
or ax, ax
jne 0x4016aa
push 0x40
push str.In_Game_HotKeys
push str.SHIFT__F4__
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
jmp 0x4016aa
cmp ax, 0x8f
jne 0x40158b
shr eax, 0x10
or ax, ax
jne 0x4016aa
jmp 0x4013ff
cmp ax, 0x90
jne 0x4015a7
shr eax, 0x10
or ax, ax
jne 0x4016aa
jmp 0x401427
cmp ax, 0x91
jne 0x4015c3
shr eax, 0x10
or ax, ax
jne 0x4016aa
jmp 0x40144f
cmp ax, 0x92
jne 0x4015df
shr eax, 0x10
or ax, ax
jne 0x4016aa
jmp 0x401477
cmp ax, 0x93
jne 0x4015fb
shr eax, 0x10
or ax, ax
jne 0x4016aa
jmp 0x40149f
cmp ax, 0x94
jne 0x4016aa
shr eax, 0x10
or ax, ax
jne 0x401612
jmp 0x4014cb
jmp 0x4016aa
cmp dword [ebp + 0xc], 0x113
jne 0x4016aa
cmp dword [ebp + 0x10], 1
jne 0x40162f
call fcn.004017e7
cmp dword [ebp + 0x10], 2
jne 0x40163a
call fcn.004017e7
cmp dword [ebp + 0x10], 3
jne 0x4016aa
call fcn.004017e7
push esi
push edi
push ebx
push str.kernel32.dll
call sub.KERNEL32.dll_GetModuleHandleA
push 0x40304e
push eax
call sub.KERNEL32.dll_GetProcAddress
cmp byte [eax], 0xcc
je 0x40169a
jne 0x4016a6
push 0
push 1
push 0
mov al, byte [0x40300d]
movzx ax, al
push ax
push 0
mov al, byte [0x40300c]
movzx ax, al
push ax
push dword [0x403008]
call sub.KERNEL32.dll_WriteProcessMemory
leave
ret 0x10
push 0
call sub.KERNEL32.dll_ExitProcess
leave
ret 0x10
mov eax, 0
leave
ret 0x10