Function at 0x407eb0
Capabilities:
Log keystrokes via polling
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x7cc
push 0
push 0x4a7394
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4a7398], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4a7394], eax
mov eax, 0x4962ff
mov dword [0x4a739c], eax
call fcn.004190f0
call fcn.00418560
call fcn.00418432
call fcn.004179c0
call fcn.00416dc3
call fcn.00416b60
call fcn.00416953
call fcn.00415e10
call fcn.004159d0
call fcn.0041580f
call fcn.00413f0e
call fcn.004127d9
call fcn.004122b1
call fcn.00411aad
call fcn.004118af
call fcn.004104c9
call fcn.00412750
call fcn.00410ac0
call fcn.00419140
push eax
push eax
call fcn.00415ae4
push 0x4a73a0
call fcn.00419180
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.0.ogg
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
mov ebp, 0x45748e
mov ebx, ebp
mov ebp, 0x4548f8
sub ebx, ebp
push ebx
mov ebp, 0x4548f8
push ebp
push 0
call fcn.004161e0
push 0
call fcn.00415d90
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.1.ogg
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
mov ebp, 0x45a3ff
mov ebx, ebp
mov ebp, 0x45748e
sub ebx, ebp
push ebx
mov ebp, 0x45748e
push ebp
push 0
call fcn.004161e0
push 0
call fcn.00415d90
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.3.ogg
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
mov ebp, 0x45da34
mov ebx, ebp
mov ebp, 0x45a3ff
sub ebx, ebp
push ebx
mov ebp, 0x45a3ff
push ebp
push 0
call fcn.004161e0
push 0
call fcn.00415d90
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.4.ogg
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
mov ebp, 0x462405
mov ebx, ebp
mov ebp, 0x45da34
sub ebx, ebp
push ebx
mov ebp, 0x45da34
push ebp
push 0
call fcn.004161e0
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.5.ogg
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
mov ebp, 0x465012
mov ebx, ebp
mov ebp, 0x462405
sub ebx, ebp
push ebx
mov ebp, 0x462405
push ebp
push 0
call fcn.004161e0
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.6.ogg
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
mov ebp, 0x466eb9
mov ebx, ebp
mov ebp, 0x465012
sub ebx, ebp
push ebx
mov ebp, 0x465012
push ebp
push 0
call fcn.004161e0
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.7.ogg
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
mov ebp, 0x469421
mov ebx, ebp
mov ebp, 0x466eb9
sub ebx, ebp
push ebx
mov ebp, 0x466eb9
push ebp
push 0
call fcn.004161e0
push 0
call fcn.00415d90
call fcn.00410b50
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.0.ogg
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00410d48
call fcn.004192d0
mov dword [0x4a73a4], eax
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.1.ogg
call fcn.00419210
call fcn.00419270
push 1
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00410d48
call fcn.004192d0
mov dword [0x4a73a4], eax
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.3.ogg
call fcn.00419210
call fcn.00419270
push 3
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00410d48
call fcn.004192d0
mov dword [0x4a73a4], eax
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.4.ogg
call fcn.00419210
call fcn.00419270
push 4
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00410d48
call fcn.004192d0
mov dword [0x4a73a4], eax
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.5.ogg
call fcn.00419210
call fcn.00419270
push 5
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00410d48
call fcn.004192d0
mov dword [0x4a73a4], eax
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.6.ogg
call fcn.00419210
call fcn.00419270
push 6
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00410d48
call fcn.004192d0
mov dword [0x4a73a4], eax
call fcn.00419140
push eax
mov edx, dword [0x4a73a0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.7.ogg
call fcn.00419210
call fcn.00419270
push 7
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00410d48
call fcn.004192d0
mov dword [0x4a73a4], eax
call fcn.00412750
call fcn.00419140
push eax
push 0
push 0x40
call fcn.00419140
push eax
push eax
call fcn.00411adc
call fcn.004192b2
add dword [esp], edx
call fcn.0040e606
push 0x4a73bc
call fcn.00419180
mov ebp, 0x469421
push ebp
push 0
call fcn.00417000
and eax, eax
je 0x402148
mov ebp, 0x47abd8
push ebp
push 2
call fcn.00417000
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0x41
push 0x133
push 2
call fcn.004171ca
push eax
call fcn.00416be0
call fcn.00416c27
push 0x100
push 0x18
push 0x454278
push 1
call fcn.004159e4
and eax, eax
je 0x4015f2
push 0x100
push 0x30
push 0x454278
push 2
call fcn.004159e4
and eax, eax
je 0x40160f
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004171e6
and eax, eax
je 0x4016f3
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 1
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.00411fd0
push eax
push str.rhineheart
push 0
push 0
call fcn.00416c9e
call fcn.00416c27
push 0
push 0x64
push 0xc8
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0x11
call fcn.00416c87
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0x4a7af8
push 0x4548f0
push 8
push 0x65
push 4
call fcn.00416854
call fcn.00419140
push eax
push eax
call fcn.00415ae4
push 0x4a73c0
call fcn.00419180
call fcn.00419140
push eax
mov edx, dword [0x4a73c0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.Options
call fcn.00419210
call fcn.00419270
push 0xa
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
and eax, eax
je 0x401794
mov ebp, 0x49356c
mov ebx, ebp
mov ebp, str.ULTIMATE_TRAINER_r_n_self_updating__r_n_r_nNumpad_1:_Manpower_r_nNumpad_2:_Fuel_r_nNumpad_3:_Ammo_r_nNumpad_4:_Command_Points_r_nNumpad_5:_Reset_Population_r_nNumpad_6:_Enemy_Supply_Lines_r_nNumpad_7:_Instant_Troops_r_nNumpad_8:_Instant_Buildings_r_n__Key:_Heal_Selected_Unit_r_n__Key:_Weaken_Selected_Unit_r_n_Key:_Super_Selected_Unit_r_n8_Key:_Heal_Selected_Building_r_n9_Key:_Weaken_Selected_Building_r_n0_Key:_Super_Selected_Building_r_nNumpad_:_Fog_of_War_Off_r_nNumpad__:_Fog_of_War_On_r_nNumpad_.:_Command_Cooldowns
sub ebx, ebp
push ebx
mov ebp, str.ULTIMATE_TRAINER_r_n_self_updating__r_n_r_nNumpad_1:_Manpower_r_nNumpad_2:_Fuel_r_nNumpad_3:_Ammo_r_nNumpad_4:_Command_Points_r_nNumpad_5:_Reset_Population_r_nNumpad_6:_Enemy_Supply_Lines_r_nNumpad_7:_Instant_Troops_r_nNumpad_8:_Instant_Buildings_r_n__Key:_Heal_Selected_Unit_r_n__Key:_Weaken_Selected_Unit_r_n_Key:_Super_Selected_Unit_r_n8_Key:_Heal_Selected_Building_r_n9_Key:_Weaken_Selected_Building_r_n0_Key:_Super_Selected_Building_r_nNumpad_:_Fog_of_War_Off_r_nNumpad__:_Fog_of_War_On_r_nNumpad_.:_Command_Cooldowns
push ebp
push 0xa
call fcn.004161e0
push 0xa
call fcn.00415d90
jmp 0x4017a8
push str.Could_not_install_the_file___Installtion_failed
push str.Error
call fcn.00411915
jmp 0x40d6df
call fcn.00419140
push eax
mov edx, dword [0x4a73c0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.help.txt
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
and eax, eax
je 0x401815
mov ebp, 0x49573c
mov ebx, ebp
mov ebp, 0x49356c
sub ebx, ebp
push ebx
mov ebp, 0x49356c
push ebp
push 0
call fcn.004161e0
push 0
call fcn.00415d90
jmp 0x401824
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.00411915
push 0x4a7af8
push 0x4548f0
push 8
push 0x65
push 4
call fcn.00416854
call fcn.00419140
push eax
mov edx, dword [0x4a73c0]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.Options
call fcn.00419210
call fcn.00419270
push 0xa
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00416080
call fcn.004192d0
call fcn.00419140
push eax
push eax
push 0xa
call fcn.00416240
mov edx, 0x45409e
call fcn.00419210
push 0x4a73c4
call fcn.00419180
call fcn.00419140
push eax
push eax
push 0xa
call fcn.00416240
push 0x4a73c8
call fcn.00419180
call fcn.00419140
push eax
push eax
push 0xa
call fcn.00416240
mov ebx, dword [0x4a73cc]
inc ebx
mov ebp, dword [0x4a7af8]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00419180
inc dword [0x4a73cc]
push 0xa
call fcn.00416380
mov ebx, eax
cmp ebx, 1
jne 0x4018c0
push 0xa
call fcn.00415d90
fild dword [0x4a73cc]
fmul dword [0x4548d0]
fstp dword [0x4a73d0]
fld dword [0x4a73d0]
fmul dword [0x4548d4]
fstp dword [0x4a73d4]
fld dword [0x4a73d0]
fild dword [0x4a73cc]
fdiv dword [0x4548d8]
fdivp st(1)
fstp dword [0x4a73d8]
fld dword [0x4a73d4]
fild dword [0x4a73cc]
fdiv dword [0x4548d8]
fdivp st(1)
fstp dword [0x4a73dc]
fld dword [0x4a73d0]
fcomp dword [0x4548dc]
fnstsw ax
test ah, 1
jne 0x401984
mov ebx, dword [0x4a73cc]
cmp ebx, 0x15
jl 0x401984
jmp 0x40198b
mov eax, 1
jmp 0x40198d
xor eax, eax
and eax, eax
je 0x4019c9
mov dword [0x4a73d0], 0x44480000
mov dword [0x4a73d4], 0x44c80000
fld dword [0x4a73d0]
fdiv dword [0x4548d4]
fstp dword [0x4a73d8]
fld dword [0x4a73d4]
fdiv dword [0x4548d4]
fstp dword [0x4a73dc]
push 0x120
fld dword [0x4a73d4]
push eax
fistp dword [esp]
fld dword [0x4a73d0]
push eax
fistp dword [esp]
push 1
call fcn.004171e6
and eax, eax
je 0x401b63
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 1
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
mov dword [0x4a73e0], 1
mov eax, dword [0x4a73cc]
cmp eax, dword [0x4a73e0]
jl 0x401a81
push 0xff
push 0
push 0
mov eax, 0
call fcn.00411fd0
push eax
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7af8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a73e0]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe8
push ebx
push 2
call fcn.00416c9e
inc dword [0x4a73e0]
jno 0x401a28
mov dword [0x4a73e0], 1
mov eax, dword [0x4a73cc]
cmp eax, dword [0x4a73e0]
jl 0x401ae4
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.00411fd0
push eax
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7af8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a73e0]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe6
push ebx
push 0
call fcn.00416c9e
inc dword [0x4a73e0]
jno 0x401a8b
call fcn.00416c27
push 0
fld dword [0x4a73dc]
push eax
fistp dword [esp]
fld dword [0x4a73d8]
push eax
fistp dword [esp]
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0x11
call fcn.00416c87
fld dword [0x4a73dc]
push eax
fistp dword [esp]
fld dword [0x4a73d8]
push eax
fistp dword [esp]
push 0x43
push 7
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0x120
push 0x190
push 0x640
push 1
call fcn.004171e6
and eax, eax
je 0x401c77
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 2
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
call fcn.00419140
push eax
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.00411fd0
push eax
mov edx, dword [0x4a73c4]
call fcn.00419140
push eax
call fcn.00419210
mov edx, dword [0x4a73c8]
call fcn.00419210
call fcn.00419270
push 0
push 0
call fcn.004192b2
add dword [esp + 8], edx
call fcn.00416c9e
call fcn.004192d0
call fcn.00416c27
push 0
push 0x64
push 0x190
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0x11
call fcn.00416c87
push 0x64
push 0x190
push 0x28
push 5
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0x90000001
push 0x45402a
push 0
call fcn.00417481
push eax
push 0
call fcn.0041749f
push eax
push 0
push 0
push 0
call fcn.00414270
and eax, eax
je 0x402148
push str.CLOSEBUTTON
push 0x13
push 0x13
push 6
push 0x1e4
push 1
call fcn.00412963
mov dword [0x4a73a4], eax
push str.READMEBUTTON
push 0x20
push 0x11e
push 0x17e
push 0xa
push 3
call fcn.00412963
mov dword [0x4a73a4], eax
push str.TROUBLEBUTTON
push 0x20
push 0x11e
push 0x19c
push 0xa
push 4
call fcn.00412963
mov dword [0x4a73a4], eax
push str.CHBUTTON
push 0x23
push 0xf5
push 1
push 0x23
push 5
call fcn.00412963
mov dword [0x4a73a4], eax
push str.BOXARTBUTTON
push 0x118
push 0xc8
push 0x2d
push 0x132
push 6
call fcn.00412963
mov dword [0x4a73a4], eax
push 0x45423a
push 0x10e
push 0x122
push 0x41
push 0
push 7
call fcn.00412963
mov dword [0x4a73a4], eax
push 0
call fcn.00414293
push eax
push 0x80000000
push str.Test
push 0x6b
push 0xc8
push 0
push 0xfffffc18
push 1
call fcn.00413f6a
push 0
call fcn.00414293
push eax
call fcn.0040ede2
push 0xff
push 0
call fcn.004171ca
push eax
push 0
call fcn.00414293
push eax
call fcn.0040d7f1
push 0
push 0
call fcn.00414341
call fcn.00419140
push eax
push eax
mov edx, str.http:__www.cheathappens.com_trnflash.asp_id
call fcn.00419210
mov edx, dword [0x4a73bc]
call fcn.00419210
call fcn.00419270
push 0xc8
push 0x12c
push 0
push 0
push 2
call fcn.004192b2
add dword [esp + 0x14], edx
call fcn.00413a63
call fcn.004192d0
mov dword [0x4a73a4], eax
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
mov ebx, eax
and ebx, ebx
jne 0x401e8b
push 1
push 1
call fcn.00414341
mov dword [0x4a73e0], 1
mov eax, 4
cmp eax, dword [0x4a73e0]
jl 0x402148
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004171e6
and eax, eax
je 0x401fe7
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 1
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.00411fd0
push eax
push str.rhineheart
push 0
push 0
call fcn.00416c9e
call fcn.00416c27
push 0
push 0x64
push 0xc8
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0
call fcn.00416c87
push 0xff
push 0x44
push 0x44
mov eax, 0x44
call fcn.00411fd0
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.00416d22
push 0x21
call fcn.00416c87
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0xff
push 0
call fcn.004171ca
push eax
push 0
call fcn.00414293
push eax
call fcn.0040d7f1
push 0x32
call fcn.00411fe9
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004171e6
and eax, eax
je 0x402132
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 1
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.00411fd0
push eax
push str.rhineheart
push 0
push 0
call fcn.00416c9e
call fcn.00416c27
push 0
push 0x64
push 0xc8
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0
call fcn.00416c87
push 0xff
push 0x44
push 0x44
mov eax, 0x44
call fcn.00411fd0
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.00416d22
push 0x21
call fcn.00416c87
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0xff
push 0
call fcn.004171ca
push eax
push 0
call fcn.00414293
push eax
call fcn.0040d7f1
push 0x32
call fcn.00411fe9
inc dword [0x4a73e0]
jno 0x401e95
push 0x4a7b00
push 0x4548f0
push 8
push 0x100
push 4
call fcn.00416854
mov eax, 0x49573c
mov dword [0x4a739c], eax
lea ecx, [0x4a73e4]
mov edx, dword [0x4a739c]
call fcn.0040f008
add dword [0x4a739c], eax
mov dword [0x4a73e0], 1
mov eax, 0xfe
cmp eax, dword [0x4a73e0]
jl 0x402207
call fcn.00419140
push eax
push eax
push 0x45403e
push dword [0x4a73e0]
push dword [0x4a73e4]
call fcn.0040f0c0
push 0x4a73e8
call fcn.00419180
call fcn.00419140
push eax
push eax
push dword [0x4a73e8]
call fcn.0040f1d0
mov ebx, eax
dec ebx
push ebx
push dword [0x4a73e8]
call fcn.0040f200
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7b00]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00419180
inc dword [0x4a73e0]
jno 0x402191
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x402217
push 0x75009553
inc ecx
ret
push 0x12c
call fcn.00411fe9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004171e6
and eax, eax
je 0x402362
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 1
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.00411fd0
push eax
push str.Authenticating_Trainer......
push 0
push 0
call fcn.00416c9e
call fcn.00416c27
push 0
push 0x64
push 0x1f4
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0
call fcn.00416c87
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.00411fd0
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00416d22
push 0x11
call fcn.00416c87
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0xff
push 0
call fcn.004171ca
push eax
push 0
call fcn.00414293
push eax
call fcn.0040d7f1
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
push eax
call fcn.00411adc
call fcn.004192b2
add dword [esp], edx
call fcn.00415b45
push 0x4a73ec
call fcn.00419180
mov edx, dword [0x4a73ec]
call fcn.00419140
push eax
call fcn.00419210
push 0x4a73f0
call fcn.00419180
call sub.USER32.DLL_GetForegroundWindow
mov dword [0x4a73f4], eax
push 0x4a73f8
push dword [0x4a73f4]
call sub.USER32.DLL_GetWindowThreadProcessId
push dword [0x4a73f8]
push dword [0x4a7400]
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x4a73fc], eax
mov eax, dword [0x4a73f8]
mov dword [0x4a73f4], eax
push 0x3e8
call fcn.00418590
mov dword [0x4a7404], eax
mov edx, dword [0x4a73f0]
call fcn.00419140
push eax
call fcn.00419210
push 0x4a7408
call fcn.00419180
mov eax, dword [0x4a7410]
mov dword [0x4a740c], eax
mov ebp, 0x4962ff
mov dword [0x4a73e0], ebp
mov eax, dword [0x4a73e0]
call fcn.004185b0
mov byte [0x4a77cc], al
mov ebp, 0x496302
mov dword [0x4a73e0], ebp
mov ebp, 0x496302
mov ebx, ebp
add ebx, 0xbb8
cmp ebx, dword [0x4a73e0]
jl 0x4024ce
mov eax, dword [0x4a73e0]
call fcn.004185b0
mov byte [0x4a77cd], al
movsx ebx, byte [0x4a77cd]
xor bl, byte [0x4a77cc]
mov eax, ebx
mov byte [0x4a77ce], al
movsx ebx, byte [0x4a77cc]
add ebx, 0x37
mov eax, ebx
mov byte [0x4a77cc], al
movsx ebx, byte [0x4a77cc]
cmp ebx, 0xff
jle 0x4024ab
movsx ebx, byte [0x4a77cc]
add ebx, 0xffffff01
mov eax, ebx
mov byte [0x4a77cc], al
movsx eax, byte [0x4a77ce]
push eax
mov eax, dword [0x4a73e0]
call fcn.004185c0
mov dword [0x4a73a4], eax
inc dword [0x4a73e0]
jno 0x40243f
push 0x4a7b08
push 0
push 7
push 1
push 8
call fcn.00416854
call sub.KERNEL32.dll_GetTickCount
mov dword [0x4a741c], eax
call fcn.00419140
push eax
push eax
call fcn.00411adc
push 0x4a7420
call fcn.00419180
call fcn.00419140
push eax
push eax
push dword [0x4a7420]
call fcn.00415b45
push 0x4a7420
call fcn.00419180
mov edx, 0x45402a
lea ecx, [0x4a73e4]
call fcn.0040f008
mov edx, 0x45402a
lea ecx, [0x4a7424]
call fcn.0040f008
mov edx, 0x45402a
lea ecx, [0x4a7428]
call fcn.0040f008
mov dword [0x4a742c], 0
mov dword [0x4a7430], 0
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
call fcn.00411adc
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00416130
call fcn.004192d0
push 0
call fcn.00416420
mov dword [0x4a7434], eax
mov dword [0x4a73e0], 1
mov ebx, dword [0x4a7434]
add ebx, 0xfffffff8
cmp ebx, dword [0x4a73e0]
jl 0x4025f1
push 0
call fcn.00416480
mov byte [0x4a77cf], al
mov ebx, dword [0x4a7430]
movzx eax, byte [0x4a77cf]
add ebx, eax
mov dword [0x4a7430], ebx
inc dword [0x4a73e0]
jno 0x4025b4
push 0
call fcn.004164e0
mov dword [0x4a7438], eax
push 0
call fcn.004164e0
mov dword [0x4a743c], eax
push 0
call fcn.00415d90
mov eax, dword [0x4a7430]
mov dword [0x4a7440], eax
push dword [0x4a7420]
push 0
call fcn.00416130
mov ebx, eax
and ebx, ebx
jle 0x402996
mov dword [0x4a73e0], 1
mov eax, 0x3b8
cmp eax, dword [0x4a73e0]
jl 0x40266b
push 0
call fcn.00416540
mov dword [0x4a7444], eax
inc dword [0x4a73e0]
jno 0x402647
mov dword [0x4a73e0], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x4a73e0]
jl 0x402701
push 0
call fcn.00416540
mov dword [0x4a7444], eax
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
push 1
mov eax, dword [0x4a7444]
cdq
push edx
push eax
call fcn.0040f2e0
call fcn.004192b2
add dword [esp], edx
call fcn.0040f390
call fcn.004192d0
mov dword [0x4a7444], eax
mov edx, dword [0x4a73e4]
call fcn.00419140
push eax
call fcn.00419210
call fcn.00419140
push eax
push eax
push dword [0x4a7444]
call fcn.0040f4e0
pop eax
push 0x4a73e4
call fcn.00419180
inc dword [0x4a73e0]
jno 0x402675
push dword [0x4a73e4]
call fcn.0040ead6
mov dword [0x4a7444], eax
mov ebx, dword [0x4a7444]
xor ebx, 0x98989898
mov dword [0x4a7444], ebx
mov eax, dword [0x4a7444]
mov dword [0x4a7448], eax
call fcn.00419140
push eax
push eax
push 0xa
call fcn.00419140
push eax
mov edx, str.0000000000
call fcn.00419210
call fcn.00419140
push eax
push eax
mov eax, dword [0x4a7444]
cdq
push edx
push eax
call fcn.0040f670
pop eax
call fcn.004192b2
add dword [esp], edx
call fcn.0040f700
push 0x4a73e4
call fcn.00419180
mov dword [0x4a73e0], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x4a73e0]
jl 0x40280b
push 0
call fcn.00416540
mov dword [0x4a7444], eax
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
push 1
mov eax, dword [0x4a7444]
cdq
push edx
push eax
call fcn.0040f2e0
call fcn.004192b2
add dword [esp], edx
call fcn.0040f390
call fcn.004192d0
mov dword [0x4a7444], eax
mov edx, dword [0x4a7424]
call fcn.00419140
push eax
call fcn.00419210
call fcn.00419140
push eax
push eax
push dword [0x4a7444]
call fcn.0040f4e0
pop eax
push 0x4a7424
call fcn.00419180
inc dword [0x4a73e0]
jno 0x40277f
push dword [0x4a7424]
call fcn.0040ead6
mov dword [0x4a744c], eax
mov dword [0x4a73e0], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x4a73e0]
jl 0x4028b1
push 0
call fcn.00416540
mov dword [0x4a7444], eax
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
push 1
mov eax, dword [0x4a7444]
cdq
push edx
push eax
call fcn.0040f2e0
call fcn.004192b2
add dword [esp], edx
call fcn.0040f390
call fcn.004192d0
mov dword [0x4a7444], eax
mov edx, dword [0x4a7428]
call fcn.00419140
push eax
call fcn.00419210
call fcn.00419140
push eax
push eax
push dword [0x4a7444]
call fcn.0040f4e0
pop eax
push 0x4a7428
call fcn.00419180
inc dword [0x4a73e0]
jno 0x402825
push dword [0x4a7428]
call fcn.0040ead6
mov dword [0x4a7444], eax
mov eax, dword [0x4a7444]
mov dword [0x4a7450], eax
mov dword [0x4a73e0], 0x3d1
mov eax, dword [0x4a7450]
cmp eax, dword [0x4a73e0]
jl 0x4028f9
push 0
call fcn.00416540
mov dword [0x4a7444], eax
inc dword [0x4a73e0]
jno 0x4028d5
mov eax, dword [0x4a7450]
mov dword [0x4a73e0], eax
mov ebx, dword [0x4a7450]
add ebx, 0x12
cmp ebx, dword [0x4a73e0]
jl 0x40293d
push 0
call fcn.00416540
mov dword [0x4a7444], eax
mov ebx, dword [0x4a742c]
add ebx, dword [0x4a7444]
mov dword [0x4a742c], ebx
inc dword [0x4a73e0]
jno 0x402903
mov ebx, dword [0x4a744c]
xor ebx, dword [0x4a742c]
mov dword [0x4a7454], ebx
mov ebx, dword [0x4a7454]
and ebx, ebx
jne 0x402963
mov dword [0x4a7454], 0x63
mov ebx, dword [0x4a7454]
xor ebx, 0x98989898
mov dword [0x4a7454], ebx
mov eax, dword [0x4a7448]
mov dword [0x4a7458], eax
mov ebx, dword [0x4a7448]
cmp ebx, dword [0x4a7454]
jne 0x40298f
jmp 0x402994
call fcn.0040c50d
jmp 0x40299b
call fcn.0040c50d
mov ebx, dword [0x4a743c]
cmp ebx, dword [0x4a7434]
jne 0x4029ab
jmp 0x4029b0
call fcn.0040c50d
call sub.KERNEL32.dll_GetTickCount
mov dword [0x4a745c], eax
mov ebx, dword [0x4a745c]
sub ebx, dword [0x4a741c]
cmp ebx, 0x3e8
jle 0x4029d5
push 0x9099542
inc eax
ret
mov dword [0x4a7460], 0x45a2a5
mov edx, 0x45402a
lea ecx, [0x4a7464]
call fcn.0040f008
push 0x4a7b10
push 0
push 0x15
push 0x15
push 4
call fcn.00416854
push 0x4a7b18
push 0
push 0x15
push 0x15
push 4
call fcn.00416854
push 0x4a7b20
push 0
push 0x15
push 0x15
push 4
call fcn.00416854
push 0x4a7b28
push 0
push 0x15
push 0x15
push 4
call fcn.00416854
push 0x4a7b30
push 0
push 0x15
push 0x15
push 4
call fcn.00416854
push 0x4a7b38
push 0
push 0x15
push 0x15
push 4
call fcn.00416854
push 0x4a7b40
push 0
push 0x15
push 0xa
push 4
call fcn.00416854
push 0x3e8
call fcn.00418590
mov dword [0x4a7404], eax
push 0x3e8
call fcn.00418590
mov dword [0x4a7468], eax
push 0x4000
call fcn.00418590
mov dword [0x4a746c], eax
push 0x4000
call fcn.00418590
mov dword [0x4a7470], eax
push 0x14
call fcn.00418590
mov dword [0x4a7474], eax
mov dword [0x4a73e0], 1
mov eax, 0x14
cmp eax, dword [0x4a73e0]
jl 0x402b70
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x4a73e0]
jno 0x402b16
mov ebp, dword [0x4a7b40]
mov dword [ebp], 0xcc
mov dword [ebp + 4], 0xffffff
mov dword [ebp + 8], 0xcc0000
mov dword [ebp + 0xc], 0xaa00
mov dword [ebp + 0x10], 0x55ee
mov dword [ebp + 0x14], 0xccff
mov dword [ebp + 0x18], 0x2255
mov dword [ebp + 0x1c], 0x770044
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0x6633ff
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
push 1
push 1
call fcn.00419140
push eax
push eax
mov eax, dword [0x4a7454]
cdq
push edx
push eax
call fcn.0040f670
call fcn.004192b2
add dword [esp], edx
call fcn.0040f770
call fcn.004192b2
add dword [esp], edx
call fcn.0040f390
call fcn.004192d0
mov dword [0x4a7478], eax
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
push 1
push 2
call fcn.00419140
push eax
push eax
mov eax, dword [0x4a7454]
cdq
push edx
push eax
call fcn.0040f670
call fcn.004192b2
add dword [esp], edx
call fcn.0040f770
call fcn.004192b2
add dword [esp], edx
call fcn.0040f390
call fcn.004192d0
mov dword [0x4a747c], eax
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
push 1
push 3
call fcn.00419140
push eax
push eax
mov eax, dword [0x4a7454]
cdq
push edx
push eax
call fcn.0040f670
call fcn.004192b2
add dword [esp], edx
call fcn.0040f770
call fcn.004192b2
add dword [esp], edx
call fcn.0040f390
call fcn.004192d0
mov dword [0x4a7480], eax
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
push 1
push 4
call fcn.00419140
push eax
push eax
mov eax, dword [0x4a7454]
cdq
push edx
push eax
call fcn.0040f670
call fcn.004192b2
add dword [esp], edx
call fcn.0040f770
call fcn.004192b2
add dword [esp], edx
call fcn.0040f390
call fcn.004192d0
mov dword [0x4a7484], eax
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
push 1
push 5
call fcn.00419140
push eax
push eax
mov eax, dword [0x4a7454]
cdq
push edx
push eax
call fcn.0040f670
call fcn.004192b2
add dword [esp], edx
call fcn.0040f770
call fcn.004192b2
add dword [esp], edx
call fcn.0040f390
call fcn.004192d0
mov dword [0x4a7488], eax
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0
call fcn.00416c87
mov ebx, dword [0x4a7478]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1ea
call fcn.00416d22
mov ebx, dword [0x4a747c]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1ed
call fcn.00416d22
mov ebx, dword [0x4a7480]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1f0
call fcn.00416d22
mov ebx, dword [0x4a7484]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1f3
call fcn.00416d22
mov ebx, dword [0x4a7488]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1f6
call fcn.00416d22
call fcn.00416c27
mov edx, str.Template
lea ecx, [0x4a74a4]
call fcn.0040f008
call fcn.00419140
push eax
push eax
call fcn.00415ae4
push 0x4a748c
call fcn.00419180
call fcn.0040d731
call fcn.0040c681
call fcn.0040d1f1
call fcn.0040c681
call fcn.0040c5a6
call fcn.0040cfbb
call fcn.0040c5a6
call fcn.0040b84c
call fcn.00419140
push eax
mov edx, dword [0x4a748c]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.CH.dll
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
and eax, eax
je 0x402edf
mov ebp, 0x496f02
mov ebx, ebp
mov ebp, 0x496302
sub ebx, ebp
push ebx
mov ebp, 0x496302
push ebp
push 0
call fcn.004161e0
push 0
call fcn.00415d90
jmp 0x402edf
call fcn.00419140
push eax
mov edx, dword [0x4a748c]
call fcn.00419140
push eax
call fcn.00419210
mov edx, str.help.txt
call fcn.00419210
call fcn.00419270
push 0
call fcn.004192b2
add dword [esp + 4], edx
call fcn.00415fb0
call fcn.004192d0
and eax, eax
je 0x402f4c
mov ebp, 0x49573c
mov ebx, ebp
mov ebp, 0x49356c
sub ebx, ebp
push ebx
mov ebp, 0x49356c
push ebp
push 0
call fcn.004161e0
push 0
call fcn.00415d90
jmp 0x402f5b
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.00411915
push str.CH_Trainer_Keys.dat
push 0
call fcn.00416130
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a73a4]
and ebx, ebx
jle 0x402f8d
mov dword [0x4a74bc], 1
push 0
call fcn.00415d90
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
and eax, eax
je 0x402fa2
jmp 0x402fd1
push dword [0x4a7458]
call fcn.0040db3e
mov ebx, eax
and ebx, ebx
jne 0x402fd1
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.004118e6
jmp 0x40d6df
call fcn.00419140
push eax
push eax
call fcn.00415ae4
mov edx, str.black.txt
call fcn.00419210
push 0x4a74c0
call fcn.00419180
mov ebx, dword [0x4a74c4]
and ebx, ebx
jle 0x4030b3
call fcn.00419140
push eax
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.00419210
call fcn.00419140
push eax
push eax
mov eax, dword [0x4a7458]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.0040f670
pop eax
mov edx, str..zip
call fcn.00419210
push 0x4a74c8
call fcn.00419180
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x4a74cc]
call fcn.0040f008
mov edx, dword [0x4a74c8]
call fcn.00419140
push eax
call fcn.00419210
push 0x4a74d0
call fcn.00419180
mov edx, dword [0x4a74cc]
call fcn.00419140
push eax
call fcn.00419210
push 0x4a74d4
call fcn.00419180
push 0
push 0
mov eax, dword [0x4a74c0]
push eax
mov eax, dword [0x4a74d4]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x4a74d8], eax
call fcn.00419140
push eax
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.00419210
call fcn.00419140
push eax
push eax
mov eax, dword [0x4a7458]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.0040f670
pop eax
mov edx, str..zip
call fcn.00419210
push 0x4a74c8
call fcn.00419180
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x4a74cc]
call fcn.0040f008
mov edx, dword [0x4a74c8]
call fcn.00419140
push eax
call fcn.00419210
push 0x4a74d0
call fcn.00419180
mov edx, dword [0x4a74cc]
call fcn.00419140
push eax
call fcn.00419210
push 0x4a74d4
call fcn.00419180
push 0
push 0
mov eax, dword [0x4a74c0]
push eax
mov eax, dword [0x4a74d4]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x4a74d8], eax
mov ebx, dword [0x4a74d8]
and ebx, ebx
jne 0x403173
jmp 0x4031a2
push dword [0x4a7458]
call fcn.0040db3e
mov ebx, eax
and ebx, ebx
jne 0x4031a2
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.004118e6
jmp 0x40d6df
push 0
push 0
mov eax, dword [0x4a74c0]
push eax
mov eax, dword [0x4a74d0]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x4a74dc], eax
call fcn.00419140
push eax
push eax
push 0x4540b3
push str.IZnvZalZidZ_ZTraiZnerZ_UsZerZ
call fcn.0040f9d0
push 0x4a74e0
call fcn.00419180
mov ebx, dword [0x4a74dc]
and ebx, ebx
jne 0x4031f6
call fcn.0040c50d
call fcn.00419140
push eax
push eax
push str.ZTlSA.l
push dword [0x4a74e0]
call fcn.0040f9d0
push 0x4a74e0
call fcn.00419180
mov ebx, dword [0x4a74dc]
and ebx, ebx
jne 0x403371
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004171e6
and eax, eax
je 0x403367
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 1
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.00411fd0
push eax
push dword [0x4a74e0]
push 0
push 0
call fcn.00416c9e
call fcn.00416c27
push 0
push 0x64
push 0x1f4
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0
call fcn.00416c87
push 0xff
push 0x28
push 0x28
mov eax, 0xff
call fcn.00411fd0
push eax
push 0x24
push 0x1df
push 1
push 0
call fcn.00416d22
push 0x11
call fcn.00416c87
push 0x64
push 0x1f4
push 0xa
push 0xc8
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0xff
push 0
call fcn.004171ca
push eax
push 0
call fcn.00414293
push eax
call fcn.0040d7f1
call fcn.0040b84c
jmp 0x403217
mov ebx, dword [0x4a74d8]
and ebx, ebx
je 0x403393
push dword [0x4a7458]
call fcn.0040db3e
mov ebx, eax
and ebx, ebx
jne 0x403393
mov eax, 1
jmp 0x403395
xor eax, eax
and eax, eax
je 0x4033a3
mov dword [0x4a7460], 0
mov dword [0x4a74e4], 3
lea ebp, [0x4a77d4]
lea eax, [ebp]
push eax
call sub.USER32.DLL_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x4a74e8]
mov ebx, dword [0x4a74e8]
cmp ebx, 1
jne 0x4033e7
mov edx, str.Run_game_and_press_F1_at_main_menu.__Numlock_is_ON.
lea ecx, [0x4a74ec]
call fcn.0040f008
jmp 0x4033f7
mov edx, 0x45427e
lea ecx, [0x4a74ec]
call fcn.0040f008
mov ebx, dword [0x4a74e4]
cmp ebx, dword [0x4a74e8]
je 0x403555
mov eax, dword [0x4a74e8]
mov dword [0x4a74e4], eax
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004171e6
and eax, eax
je 0x403555
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 1
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.00411fd0
push eax
push dword [0x4a74ec]
push 0
push 0
call fcn.00416c9e
call fcn.00416c27
push 0
push 0x64
push 0x1f4
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0
call fcn.00416c87
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.00411fd0
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00416d22
push 0x11
call fcn.00416c87
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0xff
push 0
call fcn.004171ca
push eax
push 0
call fcn.00414293
push eax
call fcn.0040d7f1
call fcn.0040b84c
push 0xa
call fcn.00411fe9
push 0x70
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 0x8000
and ebx, ebx
je 0x4033ad
mov edx, str.RelicCoH2.exe
lea ecx, [0x4a73f0]
call fcn.0040f008
call fcn.0040ac1a
mov ebx, dword [0x4a73f4]
and ebx, ebx
jne 0x40370f
push 4
call fcn.00411014
push 0x12c
call fcn.00411fe9
push 0x12c
call fcn.00411fe9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004171e6
and eax, eax
je 0x403700
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 1
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.00411fd0
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.00416c9e
call fcn.00416c27
push 0
push 0x64
push 0x1f4
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0
call fcn.00416c87
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.00411fd0
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00416d22
push 0x11
call fcn.00416c87
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0xff
push 0
call fcn.004171ca
push eax
push 0
call fcn.00414293
push eax
call fcn.0040d7f1
push 0x7d0
call fcn.00411fe9
jmp 0x403371
mov edx, str.CH.dll
lea ecx, [0x4a74f0]
call fcn.0040f008
mov edx, dword [0x4a748c]
call fcn.00419140
push eax
call fcn.00419210
mov edx, dword [0x4a74f0]
call fcn.00419210
push 0x4a7408
call fcn.00419180
call fcn.0040ac5f
mov edx, str.xlive.dll
lea ecx, [0x4a74f4]
call fcn.0040f008
call fcn.0040ac1a
call fcn.0040b749
call fcn.0040b84c
mov ebx, dword [0x4a74b0]
and ebx, ebx
jne 0x4038cb
mov ebx, dword [0x4a74f8]
and ebx, ebx
jne 0x4038cb
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004171e6
and eax, eax
je 0x4038c6
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 1
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.00411fd0
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.00416c9e
call fcn.00416c27
push 0
push 0x64
push 0x1f4
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0
call fcn.00416c87
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.00411fd0
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00416d22
push 0x11
call fcn.00416c87
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0xff
push 0
call fcn.004171ca
push eax
push 0
call fcn.00414293
push eax
call fcn.0040d7f1
jmp 0x403371
mov ebx, dword [0x4a7438]
cmp ebx, dword [0x4a7440]
jne 0x4038ef
mov ebx, dword [0x4a7438]
and ebx, ebx
je 0x4038ef
mov ebx, dword [0x4a7440]
and ebx, ebx
je 0x4038ef
jmp 0x4038f6
mov eax, 1
jmp 0x4038f8
xor eax, eax
and eax, eax
je 0x40394f
push 0xa
call fcn.004120a7
mov ebx, eax
add ebx, 0xa
mov dword [0x4a74fc], ebx
push 0x28
call fcn.004120a7
mov ebx, eax
add ebx, 0x28
mov dword [0x4a7500], ebx
mov ebx, dword [0x4a74b0]
add ebx, dword [0x4a74fc]
mov dword [0x4a74b0], ebx
mov ebx, dword [0x4a74f8]
add ebx, dword [0x4a7500]
mov dword [0x4a74f8], ebx
call fcn.0040c50d
push 3
call fcn.00411014
push 0x12c
call fcn.00411fe9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004171e6
and eax, eax
je 0x403aa4
push 1
call fcn.00417094
push eax
call fcn.00416b94
push 1
call fcn.00415ac8
push eax
call fcn.00416c70
push 0x11
call fcn.00416c87
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.00411fd0
push eax
push str.Game_found__Trainer_Activated_
push 0
push 0
call fcn.00416c9e
call fcn.00416c27
push 0
push 0x64
push 0x1f4
push 1
call fcn.004172fc
push 0
call fcn.00417094
push eax
call fcn.00416b94
push 0
call fcn.00416c87
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.00411fd0
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00416d22
push 0x11
call fcn.00416c87
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.004171ca
push eax
call fcn.00416cf0
call fcn.00416c27
push 1
call fcn.00416d5f
push 0xff
push 0
call fcn.004171ca
push eax
push 0
call fcn.00414293
push eax
call fcn.0040d7f1
mov ebx, dword [0x4a7504]
and ebx, ebx
je 0x403db2
push 0x8b
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xff
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x55
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xec
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x83
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xec
mov ebx, dword [0x4a7404]
add ebx, 6
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x20
mov ebx, dword [0x4a7404]
add ebx, 7
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x53
mov ebx, dword [0x4a7404]
add ebx, 8
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x56
mov ebx, dword [0x4a7404]
add ebx, 9
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x57
mov ebx, dword [0x4a7404]
add ebx, 0xa
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8d
mov ebx, dword [0x4a7404]
add ebx, 0xb
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x45
mov ebx, dword [0x4a7404]
add ebx, 0xc
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xe0
mov ebx, dword [0x4a7404]
add ebx, 0xd
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x33
mov ebx, dword [0x4a7404]
add ebx, 0xe
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xf6
mov ebx, dword [0x4a7404]
add ebx, 0xf
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x50
mov ebx, dword [0x4a7404]
add ebx, 0x10
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xff
mov ebx, dword [0x4a7404]
add ebx, 0x11
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x12
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc
mov ebx, dword [0x4a7404]
add ebx, 0x13
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a7504]
add ebx, 0x1000
mov dword [0x4a73e0], ebx
mov ebx, dword [0x4a7504]
add ebx, 0x200000
cmp ebx, dword [0x4a73e0]
jl 0x403db2
push dword [0x4a7400]
push 0x14
push dword [0x4a7468]
push dword [0x4a73e0]
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
push 0x14
push dword [0x4a7468]
push dword [0x4a7404]
call fcn.004185d0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a73a4]
cmp ebx, 1
jne 0x403da6
mov eax, dword [0x4a73e0]
mov dword [0x4a750c], eax
push 0xc2
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 3
push dword [0x4a7404]
push dword [0x4a750c]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
inc dword [0x4a73e0]
jno 0x403cc7
mov ebx, dword [0x4a74c4]
and ebx, ebx
jle 0x403dc1
jmp 0x407a6c
mov ebx, dword [0x4a7460]
cmp ebx, 0x45a2a5
jne 0x403eaa
mov ebp, dword [0x4a7b10]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0x64
mov dword [ebp + 0x14], 0x65
mov dword [ebp + 0x18], 0x66
mov dword [ebp + 0x1c], 0x67
mov dword [ebp + 0x20], 0x68
mov dword [ebp + 0x24], 0xdb
mov dword [ebp + 0x28], 0xdd
mov dword [ebp + 0x2c], 0xdc
mov dword [ebp + 0x30], 0x38
mov dword [ebp + 0x34], 0x39
mov dword [ebp + 0x38], 0x30
mov dword [ebp + 0x3c], 0x6b
mov dword [ebp + 0x40], 0x6d
mov dword [ebp + 0x44], 0x6e
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x50], 0
mov dword [0x4a73e0], 1
mov eax, 0x14
cmp eax, dword [0x4a73e0]
jl 0x403eaa
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7b30]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x4a73e0]
jno 0x403e6f
push str.CH_Trainer_Keys.dat
push 0
call fcn.00416130
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a73a4]
and ebx, ebx
jle 0x404014
mov dword [0x4a74bc], 1
push 0
call fcn.00416540
mov dword [0x4a7510], eax
mov dword [0x4a73e0], 1
mov eax, dword [0x4a7510]
cmp eax, dword [0x4a73e0]
jl 0x40400a
call fcn.00419140
push eax
push eax
push 0
call fcn.00416240
push 0x4a7514
call fcn.00419180
push dword [0x4a7514]
mov edx, 0x454226
pop ecx
call fcn.00419320
je 0x403f45
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x4a7514]
mov edx, str.CTRL
pop ecx
call fcn.00419320
je 0x403f6f
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x4a7514]
mov edx, 0x4543bb
pop ecx
call fcn.00419320
je 0x403f99
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.00416540
push eax
mov ebx, dword [0x4a73e0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
pop dword [ebp + ebx]
call fcn.00419140
push eax
push eax
call fcn.00419140
push eax
push 1
mov ebx, dword [0x4a73e0]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.0040f2e0
call fcn.004192b2
add dword [esp], edx
call fcn.0040f390
call fcn.004192d0
push eax
mov ebx, dword [0x4a73e0]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x4a73e0]
jno 0x403eef
push 0
call fcn.00415d90
mov edx, str.8B_40_086A_005150
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0xfffffffb
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a7524], eax
mov edx, str.8B078B50_14568BCFFFD284C0
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a752c], eax
mov edx, str.8B_06_8B_50_40_538BCEFFD28B06
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a7530], eax
mov edx, str.F3_0F2C4424_04
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a7534], eax
mov edx, str.D87C24_18D95424_18
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0xfffffff5
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a7538], eax
mov edx, str.7B_160F28_D1
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a753c], eax
mov edx, str.0F2F4424_2C76_08
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0xffffffe0
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a7540], eax
mov edx, str.8B_75_108B_0683_E0_1F573C_0C
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a7544], eax
mov edx, str.c74424200
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
push 7
call fcn.00411014
call fcn.0040ab74
mov dword [0x4a7548], 1
mov ebx, dword [0x4a7528]
add ebx, 0x20
mov dword [0x4a754c], ebx
mov eax, dword [0x4a7528]
mov dword [0x4a7550], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a754c]
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a754c], eax
push dword [0x4a7400]
push 0x64
push dword [0x4a7404]
push dword [0x4a754c]
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
call fcn.00419140
push eax
push eax
push dword [0x4a7404]
call fcn.00418660
push 0x4a7554
call fcn.00419180
push dword [0x4a7554]
mov edx, 0x45422c
pop ecx
call fcn.00419320
jne 0x4043f0
inc dword [0x4a7518]
mov ebx, dword [0x4a7518]
cmp ebx, 0x7d0
jle 0x4043eb
jmp 0x40d6df
jmp 0x40431e
push 0
call fcn.00411014
mov ebx, dword [0x4a7528]
add ebx, 0x1a
mov dword [0x4a7558], ebx
mov ebx, dword [0x4a7528]
add ebx, 0x4d
mov dword [0x4a755c], ebx
mov dword [0x4a7548], 0
mov edx, str.8B0B_8B4424_24
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a7560], eax
mov edx, str.7E_044889_43_08
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a7564], eax
mov edx, str.7E_09488986
lea ecx, [0x4a7464]
call fcn.0040f008
call fcn.0040a9d8
mov dword [0x4a7518], 1
mov dword [0x4a751c], 0
push dword [0x4a7464]
call fcn.0040f1d0
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [0x4a7520], ebx
call fcn.0040ab74
mov eax, dword [0x4a7528]
mov dword [0x4a7568], eax
push 0x8b
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x9e
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xbc
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 6
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 7
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 8
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x89
mov ebx, dword [0x4a7404]
add ebx, 9
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1d
mov ebx, dword [0x4a7404]
add ebx, 0xa
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xb
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0xc
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x7e
mov ebx, dword [0x4a7404]
add ebx, 0xd
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xa
mov ebx, dword [0x4a7404]
add ebx, 0xe
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc3
mov ebx, dword [0x4a7404]
add ebx, 0xf
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x10
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x11
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x12
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x13
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x14
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x15
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x16
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x17
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x18
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x19
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x1a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x1b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x1c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x1d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x1e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x1f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x39
mov ebx, dword [0x4a7404]
add ebx, 0x20
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3d
mov ebx, dword [0x4a7404]
add ebx, 0x21
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x22
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x23
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x24
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x25
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x74
mov ebx, dword [0x4a7404]
add ebx, 0x26
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x37
mov ebx, dword [0x4a7404]
add ebx, 0x27
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x89
mov ebx, dword [0x4a7404]
add ebx, 0x28
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3d
mov ebx, dword [0x4a7404]
add ebx, 0x29
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 4
mov ebx, dword [0x4a7404]
add ebx, 0x2a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x2b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x2c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x2d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x83
mov ebx, dword [0x4a7404]
add ebx, 0x2e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3d
mov ebx, dword [0x4a7404]
add ebx, 0x2f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 8
mov ebx, dword [0x4a7404]
add ebx, 0x30
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x31
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x32
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x33
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 1
mov ebx, dword [0x4a7404]
add ebx, 0x34
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x35
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x28
mov ebx, dword [0x4a7404]
add ebx, 0x36
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc7
mov ebx, dword [0x4a7404]
add ebx, 0x37
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x87
mov ebx, dword [0x4a7404]
add ebx, 0x38
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x94
mov ebx, dword [0x4a7404]
add ebx, 0x39
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x3a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x3b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x3c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x3d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x3e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x3f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x40
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc7
mov ebx, dword [0x4a7404]
add ebx, 0x41
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x87
mov ebx, dword [0x4a7404]
add ebx, 0x42
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x98
mov ebx, dword [0x4a7404]
add ebx, 0x43
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x44
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x45
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x46
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x47
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x48
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x49
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x4a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc7
mov ebx, dword [0x4a7404]
add ebx, 0x4b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x87
mov ebx, dword [0x4a7404]
add ebx, 0x4c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x9c
mov ebx, dword [0x4a7404]
add ebx, 0x4d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x4e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x4f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x50
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x51
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x52
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x53
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x54
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc7
mov ebx, dword [0x4a7404]
add ebx, 0x55
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x87
mov ebx, dword [0x4a7404]
add ebx, 0x56
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xa4
mov ebx, dword [0x4a7404]
add ebx, 0x57
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x58
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x59
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x5a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x5b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x5c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x5d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x5e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0x5f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 7
mov ebx, dword [0x4a7404]
add ebx, 0x60
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0x61
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x50
mov ebx, dword [0x4a7404]
add ebx, 0x62
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x14
mov ebx, dword [0x4a7404]
add ebx, 0x63
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc3
mov ebx, dword [0x4a7404]
add ebx, 0x64
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 0x65
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x66
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x67
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x68
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x69
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x83
mov ebx, dword [0x4a7404]
add ebx, 0x6a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x78
mov ebx, dword [0x4a7404]
add ebx, 0x6b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 0x6c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x6d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x6e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x18
mov ebx, dword [0x4a7404]
add ebx, 0x6f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x39
mov ebx, dword [0x4a7404]
add ebx, 0x70
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x2d
mov ebx, dword [0x4a7404]
add ebx, 0x71
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x72
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x73
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x74
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x75
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x76
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x10
mov ebx, dword [0x4a7404]
add ebx, 0x77
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x83
mov ebx, dword [0x4a7404]
add ebx, 0x78
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3d
mov ebx, dword [0x4a7404]
add ebx, 0x79
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc
mov ebx, dword [0x4a7404]
add ebx, 0x7a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x7b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x7c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x7d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 1
mov ebx, dword [0x4a7404]
add ebx, 0x7e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x7f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 7
mov ebx, dword [0x4a7404]
add ebx, 0x80
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc7
mov ebx, dword [0x4a7404]
add ebx, 0x81
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x40
mov ebx, dword [0x4a7404]
add ebx, 0x82
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x28
mov ebx, dword [0x4a7404]
add ebx, 0x83
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x84
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x85
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push pe_nt_image_headers32
mov ebx, dword [0x4a7404]
add ebx, 0x86
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x87
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0x88
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 6
mov ebx, dword [0x4a7404]
add ebx, 0x89
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0x8a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x50
mov ebx, dword [0x4a7404]
add ebx, 0x8b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x40
mov ebx, dword [0x4a7404]
add ebx, 0x8c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc3
mov ebx, dword [0x4a7404]
add ebx, 0x8d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x8e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x8f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0x90
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc3
mov ebx, dword [0x4a7404]
add ebx, 0x91
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3b
mov ebx, dword [0x4a7404]
add ebx, 0x92
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 5
mov ebx, dword [0x4a7404]
add ebx, 0x93
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x94
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x95
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x96
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x97
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x98
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc
mov ebx, dword [0x4a7404]
add ebx, 0x99
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x83
mov ebx, dword [0x4a7404]
add ebx, 0x9a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3d
mov ebx, dword [0x4a7404]
add ebx, 0x9b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x10
mov ebx, dword [0x4a7404]
add ebx, 0x9c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x9d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x9e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x9f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 1
mov ebx, dword [0x4a7404]
add ebx, 0xa0
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0xa1
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 3
mov ebx, dword [0x4a7404]
add ebx, 0xa2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x33
mov ebx, dword [0x4a7404]
add ebx, 0xa3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc0
mov ebx, dword [0x4a7404]
add ebx, 0xa4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc3
mov ebx, dword [0x4a7404]
add ebx, 0xa5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xf3
mov ebx, dword [0x4a7404]
add ebx, 0xa6
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xf
mov ebx, dword [0x4a7404]
add ebx, 0xa7
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x2c
mov ebx, dword [0x4a7404]
add ebx, 0xa8
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x44
mov ebx, dword [0x4a7404]
add ebx, 0xa9
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 0xaa
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 8
mov ebx, dword [0x4a7404]
add ebx, 0xab
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc3
mov ebx, dword [0x4a7404]
add ebx, 0xac
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 0xad
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xae
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xaf
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x83
mov ebx, dword [0x4a7404]
add ebx, 0xb0
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xf8
mov ebx, dword [0x4a7404]
add ebx, 0xb1
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xb2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0xb3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x21
mov ebx, dword [0x4a7404]
add ebx, 0xb4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xeb
mov ebx, dword [0x4a7404]
add ebx, 0xb5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x19
mov ebx, dword [0x4a7404]
add ebx, 0xb6
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 0xb7
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xb8
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xb9
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xba
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xbb
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xbc
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xbd
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xbe
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xbf
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x89
mov ebx, dword [0x4a7404]
add ebx, 0xc0
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xd
mov ebx, dword [0x4a7404]
add ebx, 0xc1
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x14
mov ebx, dword [0x4a7404]
add ebx, 0xc2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0xc3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0xc4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0xc5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xd9
mov ebx, dword [0x4a7404]
add ebx, 0xc6
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x5c
mov ebx, dword [0x4a7404]
add ebx, 0xc7
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 0xc8
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1c
mov ebx, dword [0x4a7404]
add ebx, 0xc9
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0xca
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xce
mov ebx, dword [0x4a7404]
add ebx, 0xcb
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc3
mov ebx, dword [0x4a7404]
add ebx, 0xcc
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 0xcd
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xce
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xcf
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x89
mov ebx, dword [0x4a7404]
add ebx, 0xd0
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xd
mov ebx, dword [0x4a7404]
add ebx, 0xd1
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x18
mov ebx, dword [0x4a7404]
add ebx, 0xd2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0xd3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0xd4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0xd5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xd9
mov ebx, dword [0x4a7404]
add ebx, 0xd6
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x5c
mov ebx, dword [0x4a7404]
add ebx, 0xd7
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 0xd8
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x30
mov ebx, dword [0x4a7404]
add ebx, 0xd9
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0xda
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xce
mov ebx, dword [0x4a7404]
add ebx, 0xdb
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc3
mov ebx, dword [0x4a7404]
add ebx, 0xdc
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 0xdd
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xde
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xdf
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x60
mov ebx, dword [0x4a7404]
add ebx, 0xe0
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x83
mov ebx, dword [0x4a7404]
add ebx, 0xe1
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3d
mov ebx, dword [0x4a7404]
add ebx, 0xe2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1c
mov ebx, dword [0x4a7404]
add ebx, 0xe3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0xe4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0xe5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0xe6
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 1
mov ebx, dword [0x4a7404]
add ebx, 0xe7
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0xe8
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xf
mov ebx, dword [0x4a7404]
add ebx, 0xe9
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
add ebx, 0xea
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x68
mov ebx, dword [0x4a7404]
add ebx, 0xeb
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x5b
mov ebx, dword [0x4a7404]
add ebx, 0xec
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xdd
mov ebx, dword [0x4a7404]
add ebx, 0xed
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x28
mov ebx, dword [0x4a7404]
add ebx, 0xee
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc7
mov ebx, dword [0x4a7404]
add ebx, 0xef
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 5
mov ebx, dword [0x4a7404]
add ebx, 0xf0
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1c
mov ebx, dword [0x4a7404]
add ebx, 0xf1
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0xf2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0xf3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0xf4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xf5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xf6
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xf7
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0xf8
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x83
mov ebx, dword [0x4a7404]
add ebx, 0xf9
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3d
mov ebx, dword [0x4a7404]
add ebx, 0xfa
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1c
mov ebx, dword [0x4a7404]
add ebx, 0xfb
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0xfc
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0xfd
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0xfe
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 2
mov ebx, dword [0x4a7404]
add ebx, 0xff
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x100
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xf
mov ebx, dword [0x4a7404]
add ebx, 0x101
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
add ebx, 0x102
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xd0
mov ebx, dword [0x4a7404]
add ebx, 0x103
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x49
mov ebx, dword [0x4a7404]
add ebx, 0x104
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xa9
mov ebx, dword [0x4a7404]
add ebx, 0x105
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1d
mov ebx, dword [0x4a7404]
add ebx, 0x106
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc7
mov ebx, dword [0x4a7404]
add ebx, 0x107
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 5
mov ebx, dword [0x4a7404]
add ebx, 0x108
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1c
mov ebx, dword [0x4a7404]
add ebx, 0x109
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x10a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x10b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x10c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x10d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x10e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x10f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x110
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x61
mov ebx, dword [0x4a7404]
add ebx, 0x111
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0x112
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x113
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x10
mov ebx, dword [0x4a7404]
add ebx, 0x114
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0x115
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 6
mov ebx, dword [0x4a7404]
add ebx, 0x116
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc3
mov ebx, dword [0x4a7404]
add ebx, 0x117
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x118
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x119
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x11a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x11b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x11c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x11d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x11e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x11f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x81
mov ebx, dword [0x4a7404]
add ebx, 0x120
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xf9
mov ebx, dword [0x4a7404]
add ebx, 0x121
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x122
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x10
mov ebx, dword [0x4a7404]
add ebx, 0x123
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x124
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x125
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x7e
mov ebx, dword [0x4a7404]
add ebx, 0x126
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x27
mov ebx, dword [0x4a7404]
add ebx, 0x127
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x81
mov ebx, dword [0x4a7404]
add ebx, 0x128
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x79
mov ebx, dword [0x4a7404]
add ebx, 0x129
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x10
mov ebx, dword [0x4a7404]
add ebx, 0x12a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x74
mov ebx, dword [0x4a7404]
add ebx, 0x12b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x69
mov ebx, dword [0x4a7404]
add ebx, 0x12c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x63
mov ebx, dword [0x4a7404]
add ebx, 0x12d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x6b
mov ebx, dword [0x4a7404]
add ebx, 0x12e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x12f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1e
mov ebx, dword [0x4a7404]
add ebx, 0x130
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x81
mov ebx, dword [0x4a7404]
add ebx, 0x131
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x79
mov ebx, dword [0x4a7404]
add ebx, 0x132
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x14
mov ebx, dword [0x4a7404]
add ebx, 0x133
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x65
mov ebx, dword [0x4a7404]
add ebx, 0x134
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x72
mov ebx, dword [0x4a7404]
add ebx, 0x135
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x73
mov ebx, dword [0x4a7404]
add ebx, 0x136
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x137
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x138
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x15
mov ebx, dword [0x4a7404]
add ebx, 0x139
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x83
mov ebx, dword [0x4a7404]
add ebx, 0x13a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3d
mov ebx, dword [0x4a7404]
add ebx, 0x13b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x20
mov ebx, dword [0x4a7404]
add ebx, 0x13c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x13d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x13e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x13f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0
mov ebx, dword [0x4a7404]
add ebx, 0x140
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x141
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x13
mov ebx, dword [0x4a7404]
add ebx, 0x142
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x89
mov ebx, dword [0x4a7404]
add ebx, 0x143
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1d
mov ebx, dword [0x4a7404]
add ebx, 0x144
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x20
mov ebx, dword [0x4a7404]
add ebx, 0x145
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x146
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x147
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x148
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x89
mov ebx, dword [0x4a7404]
add ebx, 0x149
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1d
mov ebx, dword [0x4a7404]
add ebx, 0x14a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 0x14b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x14c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x14d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x14e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0x14f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x150
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0x151
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x44
mov ebx, dword [0x4a7404]
add ebx, 0x152
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 0x153
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x28
mov ebx, dword [0x4a7404]
add ebx, 0x154
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc3
mov ebx, dword [0x4a7404]
add ebx, 0x155
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 0x156
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xd
mov ebx, dword [0x4a7404]
add ebx, 0x157
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x20
mov ebx, dword [0x4a7404]
add ebx, 0x158
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x159
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x15a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x15b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xa1
mov ebx, dword [0x4a7404]
add ebx, 0x15c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 0x15d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x15e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x15f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x160
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3b
mov ebx, dword [0x4a7404]
add ebx, 0x161
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc1
mov ebx, dword [0x4a7404]
add ebx, 0x162
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
add ebx, 0x163
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xea
mov ebx, dword [0x4a7404]
add ebx, 0x164
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3b
mov ebx, dword [0x4a7404]
add ebx, 0x165
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xd9
mov ebx, dword [0x4a7404]
add ebx, 0x166
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x7f
mov ebx, dword [0x4a7404]
add ebx, 0x167
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 8
mov ebx, dword [0x4a7404]
add ebx, 0x168
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x89
mov ebx, dword [0x4a7404]
add ebx, 0x169
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1d
mov ebx, dword [0x4a7404]
add ebx, 0x16a
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x20
mov ebx, dword [0x4a7404]
add ebx, 0x16b
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x16c
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x16d
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x16e
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xeb
mov ebx, dword [0x4a7404]
add ebx, 0x16f
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xde
mov ebx, dword [0x4a7404]
add ebx, 0x170
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x89
mov ebx, dword [0x4a7404]
add ebx, 0x171
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x1d
mov ebx, dword [0x4a7404]
add ebx, 0x172
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 0x173
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x3f
mov ebx, dword [0x4a7404]
add ebx, 0x174
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x34
mov ebx, dword [0x4a7404]
add ebx, 0x175
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xb
mov ebx, dword [0x4a7404]
add ebx, 0x176
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xeb
mov ebx, dword [0x4a7404]
add ebx, 0x177
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xd6
mov ebx, dword [0x4a7404]
add ebx, 0x178
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 0x179
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 0x2ac
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x1091
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x3f00
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x109c
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x10b3
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x1103
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x1125
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x3f04
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x10bb
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x3f08
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x10c1
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x3f0c
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x110b
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x3f10
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x112d
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x3f14
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x1153
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x3f18
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x1163
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x3f1c
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x1174
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x1182
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x118c
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x119a
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x3f20
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x11cd
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x11d6
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x11e9
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x11fc
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x3f24
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x11dc
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x11ee
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x1204
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 6
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 7
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x10fb
sub ebx, dword [0x4a7530]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1121
sub ebx, dword [0x4a7534]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1151
sub ebx, dword [0x4a7538]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push 0xeb
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 1
push dword [0x4a7404]
push dword [0x4a753c]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1141
sub ebx, dword [0x4a7540]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1171
sub ebx, dword [0x4a7544]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a7558]
inc ebx
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
mov edi, dword [0x4a74f8]
add edi, 0x117c
sub ebx, edi
add ebx, 0xfffffffc
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x117c
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a755c]
inc ebx
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
mov edi, dword [0x4a74f8]
add edi, 0x1194
sub ebx, edi
add ebx, 0xfffffffc
push ebx
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x1194
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x11b1
sub ebx, dword [0x4a7560]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
mov dword [0x4a7570], 0
mov eax, 0xff
cmp eax, dword [0x4a7570]
jl 0x407a96
push dword [0x4a7570]
call sub.USER32.DLL_GetAsyncKeyState
inc dword [0x4a7570]
jno 0x407a76
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x407aa5
push 0x55009553
ret
push 0x32
call fcn.004120a7
mov dword [0x4a7574], eax
mov ebx, dword [0x4a7574]
cmp ebx, 0x19
jne 0x407b60
mov ebx, dword [0x4a7438]
cmp ebx, dword [0x4a7440]
jne 0x407ae7
mov ebx, dword [0x4a7438]
and ebx, ebx
je 0x407ae7
mov ebx, dword [0x4a7440]
and ebx, ebx
je 0x407ae7
jmp 0x407aee
mov eax, 1
jmp 0x407af0
xor eax, eax
and eax, eax
je 0x407b60
push 0xff
call fcn.004120a7
mov dword [0x4a74fc], eax
push 0x190
call fcn.004120a7
mov dword [0x4a7500], eax
push dword [0x4a74fc]
mov eax, dword [0x4a7404]
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 1
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, dword [0x4a7500]
add ebx, 0x1091
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
call fcn.0040c50d
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a7524]
inc ebx
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a756c]
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov ebx, eax
add ebx, 8
mov dword [0x4a756c], ebx
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a756c]
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
push dword [0x4a756c]
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f00
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f00
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
add ebx, 0x94
mov dword [0x4a7578], ebx
mov ebx, dword [0x4a756c]
add ebx, 0x98
mov dword [0x4a757c], ebx
mov ebx, dword [0x4a756c]
add ebx, 0x9c
mov dword [0x4a7580], ebx
mov ebx, dword [0x4a756c]
add ebx, 0xa4
mov dword [0x4a7584], ebx
mov ebx, dword [0x4a756c]
add ebx, 0x4b8
mov dword [0x4a7588], ebx
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f14
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
add ebx, 0x3c
mov dword [0x4a758c], ebx
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f18
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
add ebx, 0x3c
mov dword [0x4a7590], ebx
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f20
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov eax, dword [0x4a756c]
mov dword [0x4a7594], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f24
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov eax, dword [0x4a756c]
mov dword [0x4a7598], eax
inc dword [0x4a759c]
mov ebx, dword [0x4a759c]
cmp ebx, 0x2711
jle 0x407eb0
mov dword [0x4a759c], 0
push 0
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f20
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f24
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov dword [0x4a75a0], 1
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75a4], eax
mov ebx, dword [0x4a75a4]
and ebx, ebx
je 0x407f69
push 0x497423f0
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a7578]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
mov dword [0x4a75a0], 2
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75a8], eax
mov ebx, dword [0x4a75a8]
and ebx, ebx
je 0x408022
push 0x497423f0
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a757c]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
mov dword [0x4a75a0], 3
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75ac], eax
mov ebx, dword [0x4a75ac]
and ebx, ebx
je 0x4080db
push 0x497423f0
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a7580]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
mov dword [0x4a75a0], 4
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75b0], eax
mov ebx, dword [0x4a75b0]
and ebx, ebx
je 0x408194
push 0x41a00000
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a7584]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
mov dword [0x4a75a0], 5
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75b4], eax
mov ebx, dword [0x4a75b4]
and ebx, ebx
je 0x40824d
push 0
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a7588]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
mov dword [0x4a75a0], 6
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75b8], eax
mov ebx, dword [0x4a75b8]
and ebx, ebx
je 0x408511
push dword [0x4a75bc]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4083fe
mov dword [0x4a75bc], 1
push 1
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f08
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x10b1
sub ebx, dword [0x4a752c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 5
push dword [0x4a7404]
push dword [0x4a752c]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
jmp 0x408510
mov ebx, 1
cmp ebx, dword [esp]
jne 0x408510
mov dword [0x4a75bc], 0
push 0
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f08
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 7
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x50
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x14
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 5
push dword [0x4a7404]
push dword [0x4a752c]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
pop eax
mov dword [0x4a75a0], 7
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75c0], eax
mov ebx, dword [0x4a75c0]
and ebx, ebx
je 0x4087d2
push dword [0x4a73f4]
call fcn.0040ec39
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x10fb
sub ebx, dword [0x4a7530]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 5
push dword [0x4a7404]
push dword [0x4a7530]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
push 1
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f0c
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0xbb8
call fcn.00411fe9
push 0
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f0c
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
push dword [0x4a73f4]
call fcn.0040ec39
push 0x8b
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 6
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x50
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x40
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 5
push dword [0x4a7404]
push dword [0x4a7530]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
mov dword [0x4a75a0], 8
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75c4], eax
mov ebx, dword [0x4a75c4]
and ebx, ebx
je 0x408ac7
push dword [0x4a73f4]
call fcn.0040ec39
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1121
sub ebx, dword [0x4a7534]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7534]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
push 1
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f10
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0xbb8
call fcn.00411fe9
push 0
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f10
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
push dword [0x4a73f4]
call fcn.0040ec39
push 0xf3
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xf
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x2c
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x44
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 4
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7534]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
mov dword [0x4a75a0], 9
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75c8], eax
mov ebx, dword [0x4a75c8]
and ebx, ebx
je 0x408df7
push dword [0x4a73f4]
call fcn.0040ec39
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1151
sub ebx, dword [0x4a7538]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7538]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
push 0
call fcn.00411014
push 0x3e8
call fcn.00411fe9
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f14
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
add ebx, 0x3c
mov dword [0x4a758c], ebx
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a758c]
add ebx, 4
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.004186d0
fistp dword [0x4a75cc]
push dword [0x4a75cc]
fild dword [esp]
fstp dword [esp]
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a758c]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
push dword [0x4a73f4]
call fcn.0040ec39
push 0xd9
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x5c
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x18
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xce
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7538]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
mov dword [0x4a75a0], 0xa
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75d0], eax
mov ebx, dword [0x4a75d0]
and ebx, ebx
je 0x4090e5
push dword [0x4a73f4]
call fcn.0040ec39
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1151
sub ebx, dword [0x4a7538]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7538]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
push 0
call fcn.00411014
push 0x3e8
call fcn.00411fe9
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f14
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
add ebx, 0x3c
mov dword [0x4a758c], ebx
push 0x3f800000
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a758c]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
push dword [0x4a73f4]
call fcn.0040ec39
push 0xd9
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x5c
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x18
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xce
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7538]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
mov dword [0x4a75a0], 0xb
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75d4], eax
mov ebx, dword [0x4a75d4]
and ebx, ebx
je 0x4094a2
push dword [0x4a73f4]
call fcn.0040ec39
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1151
sub ebx, dword [0x4a7538]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7538]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
push 0
call fcn.00411014
push 0x3e8
call fcn.00411fe9
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f14
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
add ebx, 0x3c
mov dword [0x4a758c], ebx
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a758c]
add ebx, 4
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.004186d0
fistp dword [0x4a75cc]
mov ebx, dword [0x4a75cc]
cmp ebx, 0xf4240
jge 0x409319
add dword [0x4a75cc], 0xf4240
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
jmp 0x40934d
mov ebx, dword [0x4a75cc]
cmp ebx, 0xdbba0
jle 0x40934d
mov ebx, dword [0x4a75cc]
add ebx, 0xfff0bdc0
mov dword [0x4a75cc], ebx
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
push dword [0x4a75cc]
fild dword [esp]
fstp dword [esp]
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a758c]
add ebx, 4
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a758c]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
push dword [0x4a73f4]
call fcn.0040ec39
push 0xd9
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x5c
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x18
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xce
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7538]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
mov dword [0x4a75a0], 0xc
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75d8], eax
mov ebx, dword [0x4a75d8]
and ebx, ebx
je 0x4097d2
push dword [0x4a73f4]
call fcn.0040ec39
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1141
sub ebx, dword [0x4a7540]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7540]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
push 0
call fcn.00411014
push 0x3e8
call fcn.00411fe9
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f18
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
add ebx, 0x3c
mov dword [0x4a7590], ebx
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a7590]
add ebx, 4
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.004186d0
fistp dword [0x4a75cc]
push dword [0x4a75cc]
fild dword [esp]
fstp dword [esp]
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a7590]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
push dword [0x4a73f4]
call fcn.0040ec39
push 0xd9
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x5c
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x2c
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xce
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7540]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
mov dword [0x4a75a0], 0xd
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75dc], eax
mov ebx, dword [0x4a75dc]
and ebx, ebx
je 0x409ac0
push dword [0x4a73f4]
call fcn.0040ec39
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1141
sub ebx, dword [0x4a7540]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7540]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
push 0
call fcn.00411014
push 0x3e8
call fcn.00411fe9
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f18
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
add ebx, 0x3c
mov dword [0x4a7590], ebx
push 0x3f800000
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a7590]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
push dword [0x4a73f4]
call fcn.0040ec39
push 0xd9
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x5c
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x2c
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xce
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7540]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
mov dword [0x4a75a0], 0xe
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75e0], eax
mov ebx, dword [0x4a75e0]
and ebx, ebx
je 0x409e7d
push dword [0x4a73f4]
call fcn.0040ec39
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1141
sub ebx, dword [0x4a7540]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7540]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
push 0
call fcn.00411014
push 0x3e8
call fcn.00411fe9
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f18
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.00418650
mov dword [0x4a756c], eax
mov ebx, dword [0x4a756c]
add ebx, 0x3c
mov dword [0x4a7590], ebx
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a7590]
add ebx, 4
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a73a4], eax
mov eax, dword [0x4a7404]
call fcn.004186d0
fistp dword [0x4a75cc]
mov ebx, dword [0x4a75cc]
cmp ebx, 0xf4240
jge 0x409cf4
add dword [0x4a75cc], 0xf4240
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
jmp 0x409d28
mov ebx, dword [0x4a75cc]
cmp ebx, 0xdbba0
jle 0x409d28
mov ebx, dword [0x4a75cc]
add ebx, 0xfff0bdc0
mov dword [0x4a75cc], ebx
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
push dword [0x4a75cc]
fild dword [esp]
fstp dword [esp]
mov eax, dword [0x4a7404]
call fcn.004186c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a7590]
add ebx, 4
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
push dword [0x4a7590]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 1
call fcn.00411014
push 0x12c
call fcn.00411fe9
push dword [0x4a73f4]
call fcn.0040ec39
push 0xd9
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x5c
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x24
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x2c
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xce
mov ebx, dword [0x4a7404]
add ebx, 5
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 6
push dword [0x4a7404]
push dword [0x4a7540]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
mov dword [0x4a75a0], 0xf
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75e4], eax
mov ebx, dword [0x4a75e4]
and ebx, ebx
je 0x40a0e8
push dword [0x4a73f4]
call fcn.0040ec39
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1171
sub ebx, dword [0x4a7544]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 5
push dword [0x4a7404]
push dword [0x4a7544]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
push 0
call fcn.00411014
push 0x3e8
call fcn.00411fe9
push 1
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f1c
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0x12c
call fcn.00411fe9
push dword [0x4a73f4]
call fcn.0040ec39
push 0x8b
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x10
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 6
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 5
push dword [0x4a7404]
push dword [0x4a7544]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
mov dword [0x4a75a0], 0x10
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75e8], eax
mov ebx, dword [0x4a75e8]
and ebx, ebx
je 0x40a353
push dword [0x4a73f4]
call fcn.0040ec39
push 0xe8
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
mov ebx, dword [0x4a74f8]
add ebx, 0x1171
sub ebx, dword [0x4a7544]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 5
push dword [0x4a7404]
push dword [0x4a7544]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
push 0
call fcn.00411014
push 0x3e8
call fcn.00411fe9
push 2
mov eax, dword [0x4a7404]
call fcn.004186b0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 4
push dword [0x4a7404]
mov ebx, dword [0x4a74f8]
add ebx, 0x3f1c
push ebx
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0x12c
call fcn.00411fe9
push dword [0x4a73f4]
call fcn.0040ec39
push 0x8b
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x75
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x10
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x8b
mov ebx, dword [0x4a7404]
add ebx, 3
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 6
mov ebx, dword [0x4a7404]
add ebx, 4
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 5
push dword [0x4a7404]
push dword [0x4a7544]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push dword [0x4a73f4]
call fcn.0040ebcb
mov dword [0x4a75a0], 0x11
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75ec], eax
mov ebx, dword [0x4a75ec]
and ebx, ebx
je 0x40a595
push 0x31
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc0
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 3
push dword [0x4a7404]
push dword [0x4a7564]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0x31
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0xc0
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x90
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 3
push dword [0x4a7404]
push dword [0x4a7568]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0
call fcn.00411014
push 0x12c
call fcn.00411fe9
push 0x7e
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 4
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x48
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 3
push dword [0x4a7404]
push dword [0x4a7564]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
push 0x7e
mov ebx, dword [0x4a7404]
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 9
mov ebx, dword [0x4a7404]
inc ebx
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push 0x48
mov ebx, dword [0x4a7404]
add ebx, 2
mov eax, ebx
call fcn.004185c0
mov dword [0x4a73a4], eax
push dword [0x4a7400]
push 3
push dword [0x4a7404]
push dword [0x4a7568]
push dword [0x4a7508]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a73a4], eax
mov dword [0x4a75a0], 0x12
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75f0], eax
mov ebx, dword [0x4a75f0]
and ebx, ebx
je 0x40a5ff
mov dword [0x4a75a0], 0x13
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75f4], eax
mov ebx, dword [0x4a75f4]
and ebx, ebx
je 0x40a669
mov dword [0x4a75a0], 0x14
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b28]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b20]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b18]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a75a0]
mov ebp, dword [0x4a7b10]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040dee1
mov dword [0x4a75f8], eax
mov ebx, dword [0x4a75f8]
and ebx, ebx
je 0x40a6d3
mov dword [0x4a75a4], 0
mov dword [0x4a75a8], 0
mov dword [0x4a75ac], 0
mov dword [0x4a75b0], 0
mov dword [0x4a75b4], 0
mov dword [0x4a75b8], 0
mov dword [0x4a75c0], 0
mov dword [0x4a75c4], 0
mov dword [0x4a75c8], 0
mov dword [0x4a75d0], 0
mov dword [0x4a75d4], 0
mov dword [0x4a75d8], 0
mov dword [0x4a75dc], 0
mov dword [0x4a75e0], 0
mov dword [0x4a75e4], 0
mov dword [0x4a75e8], 0
mov dword [0x4a75ec], 0
mov dword [0x4a75f0], 0
mov dword [0x4a75f4], 0
mov dword [0x4a75f8], 0
mov ebx, dword [0x4a7460]
cmp ebx, 0x45a2a5
je 0x40a7b8
push 0
push 3
call fcn.00413a83
call fcn.0040b84c
push 1
call fcn.00411fe9
mov ebx, dword [0x4a7438]
cmp ebx, dword [0x4a7440]
jne 0x40a7eb
mov ebx, dword [0x4a7438]
and ebx, ebx
je 0x40a7eb
mov ebx, dword [0x4a7440]
and ebx, ebx
je 0x40a7eb
jmp 0x40a7f2
mov eax, 1
jmp 0x40a7f4
xor eax, eax
and eax, eax
je 0x40a850
push 0xa
call fcn.004120a7
mov ebx, eax
add ebx, 0xa
mov dword [0x4a74fc], ebx
push 0x28
call fcn.004120a7
mov ebx, eax
add ebx, 0x28
mov dword [0x4a7500], ebx
mov ebx, dword [0x4a74b0]
add ebx, dword [0x4a74fc]
mov dword [0x4a74b0], ebx
mov ebx, dword [0x4a74f8]
add ebx, dword [0x4a7500]
mov dword [0x4a74f8], ebx
call fcn.0040c50d
jmp 0x404014
jmp 0x407a6c
push 0
call 0x40d6fe
call fcn.00419120
push dword [0x4a7394]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0041111b
call fcn.00412259
call fcn.00412849
call fcn.00413e90
call fcn.004159c4
call fcn.00415bfb
call fcn.00415e00
call fcn.00416db7
call fcn.00417a4e
call fcn.00418580
ret