Function at 0x401000
Capabilities:
Allocate thread local storage
Check internet connectivity via wininet
Log keystrokes via polling

Disassembly:
push 0x700
push 0
push 0x499eec
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x499ef0], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x499eec], eax
mov eax, 0x488f29
mov dword [0x499ef4], eax
call fcn.00410af0
call fcn.004102a1
call fcn.0040f850
call fcn.0040eca3
call fcn.0040ea31
call fcn.0040e927
call fcn.0040e010
call fcn.0040dc0e
call fcn.0040db9c
call fcn.0040c535
call fcn.0040ae3f
call fcn.0040a98e
call fcn.0040a6c0
call fcn.0040a171
call fcn.0040a008
call fcn.00408c67
call fcn.0040adc0
call fcn.00409260
call fcn.00410b20
push eax
push eax
call fcn.0040dd20
push 0x499ef8
call fcn.00410b40
call fcn.00410b20
push eax
mov edx, dword [0x499ef8]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.0.ogg
call fcn.00410bd0
call fcn.00410c30
push 0
call fcn.00410c72
add dword [esp + 4], edx
call fcn.0040e150
call fcn.00410c90
mov ebp, 0x44d2aa
mov ebx, ebp
mov ebp, 0x44a714
sub ebx, ebp
push ebx
mov ebp, 0x44a714
push ebp
push 0
call fcn.0040e1b0
push 0
call fcn.0040dfa0
call fcn.00410b20
push eax
mov edx, dword [0x499ef8]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.1.ogg
call fcn.00410bd0
call fcn.00410c30
push 0
call fcn.00410c72
add dword [esp + 4], edx
call fcn.0040e150
call fcn.00410c90
mov ebp, 0x45021b
mov ebx, ebp
mov ebp, 0x44d2aa
sub ebx, ebp
push ebx
mov ebp, 0x44d2aa
push ebp
push 0
call fcn.0040e1b0
push 0
call fcn.0040dfa0
call fcn.00410b20
push eax
mov edx, dword [0x499ef8]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.3.ogg
call fcn.00410bd0
call fcn.00410c30
push 0
call fcn.00410c72
add dword [esp + 4], edx
call fcn.0040e150
call fcn.00410c90
mov ebp, 0x453850
mov ebx, ebp
mov ebp, 0x45021b
sub ebx, ebp
push ebx
mov ebp, 0x45021b
push ebp
push 0
call fcn.0040e1b0
push 0
call fcn.0040dfa0
call fcn.00410b20
push eax
mov edx, dword [0x499ef8]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.4.ogg
call fcn.00410bd0
call fcn.00410c30
push 0
call fcn.00410c72
add dword [esp + 4], edx
call fcn.0040e150
call fcn.00410c90
mov ebp, 0x458221
mov ebx, ebp
mov ebp, 0x453850
sub ebx, ebp
push ebx
mov ebp, 0x453850
push ebp
push 0
call fcn.0040e1b0
push 0
call fcn.0040dfa0
call fcn.004092f0
call fcn.00410b20
push eax
mov edx, dword [0x499ef8]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.0.ogg
call fcn.00410bd0
call fcn.00410c30
push 0
call fcn.00410c72
add dword [esp + 4], edx
call fcn.004094e8
call fcn.00410c90
mov dword [0x499efc], eax
call fcn.00410b20
push eax
mov edx, dword [0x499ef8]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.1.ogg
call fcn.00410bd0
call fcn.00410c30
push 1
call fcn.00410c72
add dword [esp + 4], edx
call fcn.004094e8
call fcn.00410c90
mov dword [0x499efc], eax
call fcn.00410b20
push eax
mov edx, dword [0x499ef8]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.3.ogg
call fcn.00410bd0
call fcn.00410c30
push 3
call fcn.00410c72
add dword [esp + 4], edx
call fcn.004094e8
call fcn.00410c90
mov dword [0x499efc], eax
call fcn.00410b20
push eax
mov edx, dword [0x499ef8]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.4.ogg
call fcn.00410bd0
call fcn.00410c30
push 4
call fcn.00410c72
add dword [esp + 4], edx
call fcn.004094e8
call fcn.00410c90
mov dword [0x499efc], eax
call fcn.0040adc0
call fcn.00410b20
push eax
push 0
push 0x40
call fcn.00410b20
push eax
push eax
call fcn.0040a1a0
call fcn.00410c72
add dword [esp], edx
call fcn.004075b7
push 0x499f14
call fcn.00410b40
mov ebp, 0x458221
push ebp
push 0
call fcn.0040eeac
and eax, eax
je 0x401f6a
mov ebp, 0x474691
push ebp
push 2
call fcn.0040eeac
mov ebp, 0x4869ce
push ebp
push 3
call fcn.0040eeac
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0x41
push 0x133
push 2
call fcn.0040f076
push eax
call fcn.0040eab1
push 0x2e
push 0x133
push 3
call fcn.0040f076
push eax
call fcn.0040eab1
call fcn.0040eaf8
push 0x100
push 0x18
push str.Arial
push 1
call fcn.0040dc22
and eax, eax
je 0x40143c
push 0x100
push 0x30
push str.Arial
push 2
call fcn.0040dc22
and eax, eax
je 0x401459
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.0040f092
and eax, eax
je 0x40153d
push 1
call fcn.0040ef40
push eax
call fcn.0040ea65
push 1
call fcn.0040dd04
push eax
call fcn.0040eb41
push 0x11
call fcn.0040eb58
push 0xff
push 0
push 0
mov eax, 0
call fcn.0040a680
push eax
push str.CHEATHAPPENS_MEMBER
push 0
push 0
call fcn.0040eb6f
call fcn.0040eaf8
push 0
push 0x64
push 0xc8
push 1
call fcn.0040f1a7
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0x11
call fcn.0040eb58
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.0040f076
push eax
call fcn.0040ebbd
call fcn.0040eaf8
push 1
call fcn.0040ec2a
push 0x49a5a4
push 0x44a70c
push 8
push 0x65
push 4
call fcn.0040e828
call fcn.00410b20
push eax
push eax
call fcn.0040dd20
push 0x499f18
call fcn.00410b40
call fcn.00410b20
push eax
mov edx, dword [0x499f18]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.Options
call fcn.00410bd0
call fcn.00410c30
push 0xa
call fcn.00410c72
add dword [esp + 4], edx
call fcn.0040e150
call fcn.00410c90
and eax, eax
je 0x4015de
mov ebp, 0x4880d6
mov ebx, ebp
mov ebp, str.TRAINER_r_n_r_n_r_nOptions_in_Promo_Trainer_r_n_r_nNumpad_3:_Weapon_Stacker__r_n_r_n_r_nOptions_in_Full_Trainer_r_n_r_nNumpad_1:_Unlimited_Health_r_nNumpad_2:_Unlimited_Armor_r_nNumpad_3:_Weapon_Stacker_r_nNumpad_4:_Super_Ammo_r_n
sub ebx, ebp
push ebx
mov ebp, str.TRAINER_r_n_r_n_r_nOptions_in_Promo_Trainer_r_n_r_nNumpad_3:_Weapon_Stacker__r_n_r_n_r_nOptions_in_Full_Trainer_r_n_r_nNumpad_1:_Unlimited_Health_r_nNumpad_2:_Unlimited_Armor_r_nNumpad_3:_Weapon_Stacker_r_nNumpad_4:_Super_Ammo_r_n
push ebp
push 0xa
call fcn.0040e1b0
push 0xa
call fcn.0040dfa0
jmp 0x4015f2
push str.Could_not_install_the_file___Installtion_failed
push str.Error
call fcn.0040a045
jmp 0x406bfd
call fcn.00410b20
push eax
mov edx, dword [0x499f18]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.help.txt
call fcn.00410bd0
call fcn.00410c30
push 0
call fcn.00410c72
add dword [esp + 4], edx
call fcn.0040e150
call fcn.00410c90
and eax, eax
je 0x40165f
mov ebp, 0x488f29
mov ebx, ebp
mov ebp, 0x4880d6
sub ebx, ebp
push ebx
mov ebp, 0x4880d6
push ebp
push 0
call fcn.0040e1b0
push 0
call fcn.0040dfa0
jmp 0x40166e
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040a045
push 0x49a5a4
push 0x44a70c
push 8
push 0x65
push 4
call fcn.0040e828
call fcn.00410b20
push eax
mov edx, dword [0x499f18]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.Options
call fcn.00410bd0
call fcn.00410c30
push 0xa
call fcn.00410c72
add dword [esp + 4], edx
call fcn.0040e170
call fcn.00410c90
call fcn.00410b20
push eax
push eax
push 0xa
call fcn.0040e210
mov edx, 0x44a082
call fcn.00410bd0
push 0x499f1c
call fcn.00410b40
call fcn.00410b20
push eax
push eax
push 0xa
call fcn.0040e210
push 0x499f20
call fcn.00410b40
call fcn.00410b20
push eax
push eax
push 0xa
call fcn.0040e210
mov ebx, dword [0x499f24]
inc ebx
mov ebp, dword [0x49a5a4]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00410b40
inc dword [0x499f24]
push 0xa
call fcn.0040e350
mov ebx, eax
cmp ebx, 1
jne 0x40170a
push 0xa
call fcn.0040dfa0
fild dword [0x499f24]
fmul dword [0x44a6fc]
fstp dword [0x499f28]
fld dword [0x499f28]
fmul dword [0x44a700]
fstp dword [0x499f2c]
fld dword [0x499f28]
fild dword [0x499f24]
fdiv dword [0x44a704]
fdivp st(1)
fstp dword [0x499f30]
fld dword [0x499f2c]
fild dword [0x499f24]
fdiv dword [0x44a704]
fdivp st(1)
fstp dword [0x499f34]
fld dword [0x499f28]
fcomp dword [0x44a708]
fnstsw ax
test ah, 1
jne 0x4017ce
mov ebx, dword [0x499f24]
cmp ebx, 0x15
jl 0x4017ce
jmp 0x4017d5
mov eax, 1
jmp 0x4017d7
xor eax, eax
and eax, eax
je 0x401813
mov dword [0x499f28], 0x44480000
mov dword [0x499f2c], 0x44c80000
fld dword [0x499f28]
fdiv dword [0x44a700]
fstp dword [0x499f30]
fld dword [0x499f2c]
fdiv dword [0x44a700]
fstp dword [0x499f34]
push 0x120
fld dword [0x499f2c]
push eax
fistp dword [esp]
fld dword [0x499f28]
push eax
fistp dword [esp]
push 1
call fcn.0040f092
and eax, eax
je 0x4019ad
push 1
call fcn.0040ef40
push eax
call fcn.0040ea65
push 1
call fcn.0040dd04
push eax
call fcn.0040eb41
push 0x11
call fcn.0040eb58
mov dword [0x499f38], 1
mov eax, dword [0x499f24]
cmp eax, dword [0x499f38]
jl 0x4018cb
push 0xff
push 0
push 0
mov eax, 0
call fcn.0040a680
push eax
mov ebx, dword [0x499f38]
mov ebp, dword [0x49a5a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499f38]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe8
push ebx
push 2
call fcn.0040eb6f
inc dword [0x499f38]
jno 0x401872
mov dword [0x499f38], 1
mov eax, dword [0x499f24]
cmp eax, dword [0x499f38]
jl 0x40192e
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040a680
push eax
mov ebx, dword [0x499f38]
mov ebp, dword [0x49a5a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499f38]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe6
push ebx
push 0
call fcn.0040eb6f
inc dword [0x499f38]
jno 0x4018d5
call fcn.0040eaf8
push 0
fld dword [0x499f34]
push eax
fistp dword [esp]
fld dword [0x499f30]
push eax
fistp dword [esp]
push 1
call fcn.0040f1a7
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0x11
call fcn.0040eb58
fld dword [0x499f34]
push eax
fistp dword [esp]
fld dword [0x499f30]
push eax
fistp dword [esp]
push 0x43
push 7
push 1
call fcn.0040f076
push eax
call fcn.0040ebbd
call fcn.0040eaf8
push 1
call fcn.0040ec2a
push 0x120
push 0x190
push 0x640
push 1
call fcn.0040f092
and eax, eax
je 0x401ac1
push 1
call fcn.0040ef40
push eax
call fcn.0040ea65
push 2
call fcn.0040dd04
push eax
call fcn.0040eb41
push 0x11
call fcn.0040eb58
call fcn.00410b20
push eax
push 0xff
push 0x2e
push 0xa6
mov eax, 0xec
call fcn.0040a680
push eax
mov edx, dword [0x499f1c]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, dword [0x499f20]
call fcn.00410bd0
call fcn.00410c30
push 0
push 0
call fcn.00410c72
add dword [esp + 8], edx
call fcn.0040eb6f
call fcn.00410c90
call fcn.0040eaf8
push 0
push 0x64
push 0x190
push 1
call fcn.0040f1a7
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0x11
call fcn.0040eb58
push 0x64
push 0x190
push 0x28
push 5
push 1
call fcn.0040f076
push eax
call fcn.0040ebbd
call fcn.0040eaf8
push 1
call fcn.0040ec2a
push 0x90000001
push 0x44a018
push 0
call fcn.0040f316
push eax
push 0
call fcn.0040f334
push eax
push 0
push 0
push 0
call fcn.0040c885
and eax, eax
je 0x401f6a
push str.CLOSEBUTTON
push 0x13
push 0x13
push 6
push 0x1e4
push 1
call fcn.0040afc9
mov dword [0x499efc], eax
push str.READMEBUTTON
push 0x20
push 0x11e
push 0x17e
push 0xa
push 3
call fcn.0040afc9
mov dword [0x499efc], eax
push str.TROUBLEBUTTON
push 0x20
push 0x11e
push 0x19c
push 0xa
push 4
call fcn.0040afc9
mov dword [0x499efc], eax
push str.CHBUTTON
push 0x23
push 0xf5
push 1
push 0x23
push 5
call fcn.0040afc9
mov dword [0x499efc], eax
push str.BOXARTBUTTON
push 0x118
push 0xc8
push 0x2d
push 0x132
push 6
call fcn.0040afc9
mov dword [0x499efc], eax
push 0
call fcn.0040c8a8
push eax
push 0x80000000
push str.Test
push 0x6b
push 0xc8
push 0
push 0xfffffc18
push 1
call fcn.0040c585
push 0
call fcn.0040c8a8
push eax
call fcn.00407c99
push 0xff
push 0
call fcn.0040f076
push eax
push 0
call fcn.0040c8a8
push eax
call fcn.00406c45
push 0
push 0
call fcn.0040c8c4
call fcn.00410b20
push eax
push eax
mov edx, str.http:__www.cheathappens.com_trnflash.asp_id
call fcn.00410bd0
mov edx, dword [0x499f14]
call fcn.00410bd0
call fcn.00410c30
push 0xc8
push 0x12c
push 0
push 0
push 2
call fcn.00410c72
add dword [esp + 0x14], edx
call fcn.0040c0b1
call fcn.00410c90
mov dword [0x499efc], eax
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
mov ebx, eax
and ebx, ebx
jne 0x401cad
push 1
push 1
call fcn.0040c8c4
mov dword [0x499f38], 1
mov eax, 4
cmp eax, dword [0x499f38]
jl 0x401f6a
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.0040f092
and eax, eax
je 0x401e09
push 1
call fcn.0040ef40
push eax
call fcn.0040ea65
push 1
call fcn.0040dd04
push eax
call fcn.0040eb41
push 0x11
call fcn.0040eb58
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040a680
push eax
push str.CHEATHAPPENS_MEMBER
push 0
push 0
call fcn.0040eb6f
call fcn.0040eaf8
push 0
push 0x64
push 0xc8
push 1
call fcn.0040f1a7
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0
call fcn.0040eb58
push 0xff
push 0xe8
push 0xe0
mov eax, 0xe0
call fcn.0040a680
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.0040ebef
push 0x21
call fcn.0040eb58
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.0040f076
push eax
call fcn.0040ebbd
call fcn.0040eaf8
push 1
call fcn.0040ec2a
push 0xff
push 0
call fcn.0040f076
push eax
push 0
call fcn.0040c8a8
push eax
call fcn.00406c45
push 0x32
call fcn.0040a699
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.0040f092
and eax, eax
je 0x401f54
push 1
call fcn.0040ef40
push eax
call fcn.0040ea65
push 1
call fcn.0040dd04
push eax
call fcn.0040eb41
push 0x11
call fcn.0040eb58
push 0xff
push 0
push 0
mov eax, 0
call fcn.0040a680
push eax
push str.CHEATHAPPENS_MEMBER
push 0
push 0
call fcn.0040eb6f
call fcn.0040eaf8
push 0
push 0x64
push 0xc8
push 1
call fcn.0040f1a7
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0
call fcn.0040eb58
push 0xff
push 0xe8
push 0xe0
mov eax, 0xe0
call fcn.0040a680
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.0040ebef
push 0x21
call fcn.0040eb58
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.0040f076
push eax
call fcn.0040ebbd
call fcn.0040eaf8
push 1
call fcn.0040ec2a
push 0xff
push 0
call fcn.0040f076
push eax
push 0
call fcn.0040c8a8
push eax
call fcn.00406c45
push 0x32
call fcn.0040a699
inc dword [0x499f38]
jno 0x401cb7
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x401f7a
push 0x75009553
inc ecx
ret
push 0x12c
call fcn.0040a699
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.0040f092
and eax, eax
je 0x4020c5
push 1
call fcn.0040ef40
push eax
call fcn.0040ea65
push 1
call fcn.0040dd04
push eax
call fcn.0040eb41
push 0x11
call fcn.0040eb58
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040a680
push eax
push str.Authenticating_Trainer......
push 0
push 0
call fcn.0040eb6f
call fcn.0040eaf8
push 0
push 0x64
push 0x1f4
push 1
call fcn.0040f1a7
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0
call fcn.0040eb58
push 0xff
push 0x70
push 0x59
mov eax, 0x57
call fcn.0040a680
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0040ebef
push 0x11
call fcn.0040eb58
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.0040f076
push eax
call fcn.0040ebbd
call fcn.0040eaf8
push 1
call fcn.0040ec2a
push 0xff
push 0
call fcn.0040f076
push eax
push 0
call fcn.0040c8a8
push eax
call fcn.00406c45
call fcn.00410b20
push eax
push eax
call fcn.00410b20
push eax
push eax
call fcn.0040a1a0
call fcn.00410c72
add dword [esp], edx
call fcn.0040dd81
push 0x499f3c
call fcn.00410b40
mov edx, dword [0x499f3c]
call fcn.00410b20
push eax
call fcn.00410bd0
push 0x499f40
call fcn.00410b40
call sub.USER32.DLL_GetForegroundWindow
mov dword [0x499f44], eax
push 0x499f48
push dword [0x499f44]
call sub.USER32.DLL_GetWindowThreadProcessId
push dword [0x499f48]
push dword [0x499f50]
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x499f4c], eax
mov eax, dword [0x499f48]
mov dword [0x499f44], eax
push 0x3e8
call fcn.0040a6f0
mov dword [0x499f54], eax
mov edx, dword [0x499f40]
call fcn.00410b20
push eax
call fcn.00410bd0
push 0x499f58
call fcn.00410b40
mov eax, dword [0x499f60]
mov dword [0x499f5c], eax
mov dword [0x499f64], 0x45a2a5
push 0x49a5ac
push 0
push 0x15
push 0x15
push 4
call fcn.0040e828
push 0x49a5b4
push 0
push 0x15
push 0x15
push 4
call fcn.0040e828
push 0x49a5bc
push 0
push 0x15
push 0x15
push 4
call fcn.0040e828
push 0x49a5c4
push 0
push 0x15
push 0x15
push 4
call fcn.0040e828
push 0x49a5cc
push 0
push 0x15
push 0x15
push 4
call fcn.0040e828
push 0x3e8
call fcn.0040a6f0
mov dword [0x499f54], eax
push 0x3e8
call fcn.0040a6f0
mov dword [0x499f68], eax
push 0x4000
call fcn.0040a6f0
mov dword [0x499f6c], eax
push 0x4000
call fcn.0040a6f0
mov dword [0x499f70], eax
push 0x14
call fcn.0040a6f0
mov dword [0x499f74], eax
mov dword [0x499f38], 1
mov eax, 0x14
cmp eax, dword [0x499f38]
jl 0x4022cc
mov ebx, dword [0x499f38]
mov ebp, dword [0x49a5b4]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x499f38]
mov ebp, dword [0x49a5bc]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x499f38]
mov ebp, dword [0x49a5c4]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x499f38]
jno 0x402272
mov edx, str.Template
lea ecx, [0x499f90]
call fcn.00408008
call fcn.00410b20
push eax
push eax
call fcn.0040dd20
push 0x499f78
call fcn.00410b40
call fcn.004052ac
call fcn.00410b20
push eax
mov edx, dword [0x499f78]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.CH.dll
call fcn.00410bd0
call fcn.00410c30
push 0
call fcn.00410c72
add dword [esp + 4], edx
call fcn.0040e150
call fcn.00410c90
and eax, eax
je 0x402364
mov ebp, 0x489b2c
mov ebx, ebp
mov ebp, 0x488f2c
sub ebx, ebp
push ebx
mov ebp, 0x488f2c
push ebp
push 0
call fcn.0040e1b0
push 0
call fcn.0040dfa0
jmp 0x402364
call fcn.00410b20
push eax
mov edx, dword [0x499f78]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, str.help.txt
call fcn.00410bd0
call fcn.00410c30
push 0
call fcn.00410c72
add dword [esp + 4], edx
call fcn.0040e150
call fcn.00410c90
and eax, eax
je 0x4023d1
mov ebp, 0x488f29
mov ebx, ebp
mov ebp, 0x4880d6
sub ebx, ebp
push ebx
mov ebp, 0x4880d6
push ebp
push 0
call fcn.0040e1b0
push 0
call fcn.0040dfa0
jmp 0x4023e0
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040a045
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040e190
mov dword [0x499efc], eax
mov ebx, dword [0x499efc]
and ebx, ebx
jle 0x402412
mov dword [0x499fa8], 1
push 0
call fcn.0040dfa0
mov dword [0x499fac], 3
lea ebp, [0x49a280]
lea eax, [ebp]
push eax
call sub.USER32.DLL_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x499fb0]
mov ebx, dword [0x499fb0]
cmp ebx, 1
jne 0x402456
mov edx, str.Run_game_and_press_F1_WHILE_IN_GAME.__Numlock_is_ON.
lea ecx, [0x499fb4]
call fcn.00408008
jmp 0x402466
mov edx, str.Run_game_and_press_F1_WHILE_IN_GAME.__Numlock_is_OFF.
lea ecx, [0x499fb4]
call fcn.00408008
mov ebx, dword [0x499fac]
cmp ebx, dword [0x499fb0]
je 0x4025c4
mov eax, dword [0x499fb0]
mov dword [0x499fac], eax
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.0040f092
and eax, eax
je 0x4025c4
push 1
call fcn.0040ef40
push eax
call fcn.0040ea65
push 1
call fcn.0040dd04
push eax
call fcn.0040eb41
push 0x11
call fcn.0040eb58
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040a680
push eax
push dword [0x499fb4]
push 0
push 0
call fcn.0040eb6f
call fcn.0040eaf8
push 0
push 0x64
push 0x1f4
push 1
call fcn.0040f1a7
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0
call fcn.0040eb58
push 0xff
push 0x70
push 0x59
mov eax, 0x57
call fcn.0040a680
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0040ebef
push 0x11
call fcn.0040eb58
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.0040f076
push eax
call fcn.0040ebbd
call fcn.0040eaf8
push 1
call fcn.0040ec2a
push 0xff
push 0
call fcn.0040f076
push eax
push 0
call fcn.0040c8a8
push eax
call fcn.00406c45
call fcn.004052ac
push 0xa
call fcn.0040a699
push 0x70
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
and ebx, ebx
je 0x40241c
mov edx, str.SSGame.exe
lea ecx, [0x499f40]
call fcn.00408008
call fcn.0040467a
mov ebx, dword [0x499f44]
and ebx, ebx
jne 0x40277b
push 4
call fcn.004097a2
push 0x12c
call fcn.0040a699
push 0x12c
call fcn.0040a699
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.0040f092
and eax, eax
je 0x40276c
push 1
call fcn.0040ef40
push eax
call fcn.0040ea65
push 1
call fcn.0040dd04
push eax
call fcn.0040eb41
push 0x11
call fcn.0040eb58
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040a680
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_WHILE_IN_GAME.
push 0
push 0
call fcn.0040eb6f
call fcn.0040eaf8
push 0
push 0x64
push 0x1f4
push 1
call fcn.0040f1a7
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0
call fcn.0040eb58
push 0xff
push 0x70
push 0x59
mov eax, 0x57
call fcn.0040a680
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0040ebef
push 0x11
call fcn.0040eb58
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.0040f076
push eax
call fcn.0040ebbd
call fcn.0040eaf8
push 1
call fcn.0040ec2a
push 0xff
push 0
call fcn.0040f076
push eax
push 0
call fcn.0040c8a8
push eax
call fcn.00406c45
push 0x7d0
call fcn.0040a699
jmp 0x402412
mov edx, str.CH.dll
lea ecx, [0x499fb8]
call fcn.00408008
mov edx, dword [0x499f78]
call fcn.00410b20
push eax
call fcn.00410bd0
mov edx, dword [0x499fb8]
call fcn.00410bd0
push 0x499f58
call fcn.00410b40
call fcn.004046bf
mov edx, str.xlive.dll
lea ecx, [0x499fbc]
call fcn.00408008
call fcn.0040467a
call fcn.004051a9
call fcn.004052ac
mov ebx, dword [0x499f9c]
and ebx, ebx
jne 0x402937
mov ebx, dword [0x499fc0]
and ebx, ebx
jne 0x402937
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.0040f092
and eax, eax
je 0x402932
push 1
call fcn.0040ef40
push eax
call fcn.0040ea65
push 1
call fcn.0040dd04
push eax
call fcn.0040eb41
push 0x11
call fcn.0040eb58
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040a680
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_WHILE_IN_GAME.
push 0
push 0
call fcn.0040eb6f
call fcn.0040eaf8
push 0
push 0x64
push 0x1f4
push 1
call fcn.0040f1a7
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0
call fcn.0040eb58
push 0xff
push 0x70
push 0x59
mov eax, 0x57
call fcn.0040a680
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0040ebef
push 0x11
call fcn.0040eb58
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.0040f076
push eax
call fcn.0040ebbd
call fcn.0040eaf8
push 1
call fcn.0040ec2a
push 0xff
push 0
call fcn.0040f076
push eax
push 0
call fcn.0040c8a8
push eax
call fcn.00406c45
jmp 0x402412
push 3
call fcn.004097a2
push 0x12c
call fcn.0040a699
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.0040f092
and eax, eax
je 0x402a8c
push 1
call fcn.0040ef40
push eax
call fcn.0040ea65
push 1
call fcn.0040dd04
push eax
call fcn.0040eb41
push 0x11
call fcn.0040eb58
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040a680
push eax
push str.Game_found__Trainer_Activated_
push 0
push 0
call fcn.0040eb6f
call fcn.0040eaf8
push 0
push 0x64
push 0x1f4
push 1
call fcn.0040f1a7
push 0
call fcn.0040ef40
push eax
call fcn.0040ea65
push 0
call fcn.0040eb58
push 0xff
push 0x70
push 0x59
mov eax, 0x57
call fcn.0040a680
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0040ebef
push 0x11
call fcn.0040eb58
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.0040f076
push eax
call fcn.0040ebbd
call fcn.0040eaf8
push 1
call fcn.0040ec2a
push 0xff
push 0
call fcn.0040f076
push eax
push 0
call fcn.0040c8a8
push eax
call fcn.00406c45
mov ebx, dword [0x499fc4]
and ebx, ebx
je 0x402d9a
push 0x8b
mov ebx, dword [0x499f54]
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xff
mov ebx, dword [0x499f54]
inc ebx
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x55
mov ebx, dword [0x499f54]
add ebx, 2
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x8b
mov ebx, dword [0x499f54]
add ebx, 3
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xec
mov ebx, dword [0x499f54]
add ebx, 4
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x83
mov ebx, dword [0x499f54]
add ebx, 5
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xec
mov ebx, dword [0x499f54]
add ebx, 6
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x20
mov ebx, dword [0x499f54]
add ebx, 7
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x53
mov ebx, dword [0x499f54]
add ebx, 8
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x56
mov ebx, dword [0x499f54]
add ebx, 9
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x57
mov ebx, dword [0x499f54]
add ebx, 0xa
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x8d
mov ebx, dword [0x499f54]
add ebx, 0xb
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x45
mov ebx, dword [0x499f54]
add ebx, 0xc
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xe0
mov ebx, dword [0x499f54]
add ebx, 0xd
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x33
mov ebx, dword [0x499f54]
add ebx, 0xe
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xf6
mov ebx, dword [0x499f54]
add ebx, 0xf
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x50
mov ebx, dword [0x499f54]
add ebx, 0x10
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xff
mov ebx, dword [0x499f54]
add ebx, 0x11
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x75
mov ebx, dword [0x499f54]
add ebx, 0x12
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xc
mov ebx, dword [0x499f54]
add ebx, 0x13
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
mov ebx, dword [0x499fc4]
add ebx, 0x1000
mov dword [0x499f38], ebx
mov ebx, dword [0x499fc4]
add ebx, 0x200000
cmp ebx, dword [0x499f38]
jl 0x402d9a
push dword [0x499f50]
push 0x14
push dword [0x499f68]
push dword [0x499f38]
push dword [0x499fc8]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x499efc], eax
push 0x14
push dword [0x499f68]
push dword [0x499f54]
call fcn.0040a720
mov dword [0x499efc], eax
mov ebx, dword [0x499efc]
cmp ebx, 1
jne 0x402d8e
mov eax, dword [0x499f38]
mov dword [0x499fcc], eax
push 0xc2
mov ebx, dword [0x499f54]
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xc
mov ebx, dword [0x499f54]
inc ebx
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0
mov ebx, dword [0x499f54]
add ebx, 2
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push dword [0x499f50]
push 3
push dword [0x499f54]
push dword [0x499fcc]
push dword [0x499fc8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x499efc], eax
inc dword [0x499f38]
jno 0x402caf
mov ebx, dword [0x499fd0]
and ebx, ebx
jle 0x402da9
jmp 0x403502
mov ebx, dword [0x499f64]
cmp ebx, 0x45a2a5
jne 0x402e4d
mov ebp, dword [0x49a5ac]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0x64
mov dword [ebp + 0x14], 0x65
mov dword [ebp + 0x18], 0x66
mov dword [ebp + 0x1c], 0x67
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x50], 0
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040e190
mov dword [0x499efc], eax
mov ebx, dword [0x499efc]
and ebx, ebx
jle 0x402fb7
mov dword [0x499fa8], 1
push 0
call fcn.0040e3f0
mov dword [0x499fd4], eax
mov dword [0x499f38], 1
mov eax, dword [0x499fd4]
cmp eax, dword [0x499f38]
jl 0x402fad
call fcn.00410b20
push eax
push eax
push 0
call fcn.0040e210
push 0x499fd8
call fcn.00410b40
push dword [0x499fd8]
mov edx, str.SHIFT
pop ecx
call fcn.00410cc0
je 0x402ee8
mov ebx, dword [0x499f38]
mov ebp, dword [0x49a5b4]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x499fd8]
mov edx, str.CTRL
pop ecx
call fcn.00410cc0
je 0x402f12
mov ebx, dword [0x499f38]
mov ebp, dword [0x49a5bc]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x499fd8]
mov edx, 0x44a337
pop ecx
call fcn.00410cc0
je 0x402f3c
mov ebx, dword [0x499f38]
mov ebp, dword [0x49a5c4]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.0040e3f0
push eax
mov ebx, dword [0x499f38]
mov ebp, dword [0x49a5ac]
shl ebx, 2
pop dword [ebp + ebx]
call fcn.00410b20
push eax
push eax
call fcn.00410b20
push eax
push 0
mov ebx, dword [0x499f38]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.00408110
call fcn.00410c72
add dword [esp], edx
call fcn.004081c0
call fcn.00410c90
push eax
mov ebx, dword [0x499f38]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x499f38]
jno 0x402e92
push 0
call fcn.0040dfa0
push 0x8b
mov ebx, dword [0x499f54]
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push pe_nt_image_headers32
mov ebx, dword [0x499f54]
inc ebx
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 4
mov ebx, dword [0x499f54]
add ebx, 2
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 1
mov ebx, dword [0x499f54]
add ebx, 3
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0
mov ebx, dword [0x499f54]
add ebx, 4
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0
mov ebx, dword [0x499f54]
add ebx, 5
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xa3
mov ebx, dword [0x499f54]
add ebx, 6
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0
mov ebx, dword [0x499f54]
add ebx, 7
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x3f
mov ebx, dword [0x499f54]
add ebx, 8
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xed
mov ebx, dword [0x499f54]
add ebx, 9
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 7
mov ebx, dword [0x499f54]
add ebx, 0xa
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x83
mov ebx, dword [0x499f54]
add ebx, 0xb
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x3d
mov ebx, dword [0x499f54]
add ebx, 0xc
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 4
mov ebx, dword [0x499f54]
add ebx, 0xd
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x3f
mov ebx, dword [0x499f54]
add ebx, 0xe
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xed
mov ebx, dword [0x499f54]
add ebx, 0xf
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 7
mov ebx, dword [0x499f54]
add ebx, 0x10
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 1
mov ebx, dword [0x499f54]
add ebx, 0x11
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x75
mov ebx, dword [0x499f54]
add ebx, 0x12
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 6
mov ebx, dword [0x499f54]
add ebx, 0x13
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xd9
mov ebx, dword [0x499f54]
add ebx, 0x14
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x40
mov ebx, dword [0x499f54]
add ebx, 0x15
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x2c
mov ebx, dword [0x499f54]
add ebx, 0x16
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xd9
mov ebx, dword [0x499f54]
add ebx, 0x17
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x58
mov ebx, dword [0x499f54]
add ebx, 0x18
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x28
mov ebx, dword [0x499f54]
add ebx, 0x19
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x83
mov ebx, dword [0x499f54]
add ebx, 0x1a
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x3d
mov ebx, dword [0x499f54]
add ebx, 0x1b
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 8
mov ebx, dword [0x499f54]
add ebx, 0x1c
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x3f
mov ebx, dword [0x499f54]
add ebx, 0x1d
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xed
mov ebx, dword [0x499f54]
add ebx, 0x1e
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 7
mov ebx, dword [0x499f54]
add ebx, 0x1f
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 1
mov ebx, dword [0x499f54]
add ebx, 0x20
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x75
mov ebx, dword [0x499f54]
add ebx, 0x21
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 6
mov ebx, dword [0x499f54]
add ebx, 0x22
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xd9
mov ebx, dword [0x499f54]
add ebx, 0x23
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x40
mov ebx, dword [0x499f54]
add ebx, 0x24
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x2c
mov ebx, dword [0x499f54]
add ebx, 0x25
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xd9
mov ebx, dword [0x499f54]
add ebx, 0x26
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x58
mov ebx, dword [0x499f54]
add ebx, 0x27
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0x30
mov ebx, dword [0x499f54]
add ebx, 0x28
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push 0xc3
mov ebx, dword [0x499f54]
add ebx, 0x29
mov eax, ebx
call fcn.0040a710
mov dword [0x499efc], eax
push dword [0x499f50]
push 0x2ac
push dword [0x499f54]
mov ebx, dword [0x499fc0]
add ebx, 0x1091
push ebx
push dword [0x499fc8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x499efc], eax
mov ebx, dword [0x499fc0]
add ebx, 0x3f00
push ebx
mov eax, dword [0x499f54]
call fcn.0040a7b0
mov dword [0x499efc], eax
push dword [0x499f50]
push 4
push dword [0x499f54]
mov ebx, dword [0x499fc0]
add ebx, 0x1098
push ebx
push dword [0x499fc8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x499efc], eax
mov ebx, dword [0x499fc0]
add ebx, 0x3f04
push ebx
mov eax, dword [0x499f54]
call fcn.0040a7b0
mov dword [0x499efc], eax
push dword [0x499f50]
push 4
push dword [0x499f54]
mov ebx, dword [0x499fc0]
add ebx, 0x109e
push ebx
push dword [0x499fc8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x499efc], eax
mov ebx, dword [0x499fc0]
add ebx, 0x3f08
push ebx
mov eax, dword [0x499f54]
call fcn.0040a7b0
mov dword [0x499efc], eax
push dword [0x499f50]
push 4
push dword [0x499f54]
mov ebx, dword [0x499fc0]
add ebx, 0x10ad
push ebx
push dword [0x499fc8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x499efc], eax
mov dword [0x499fdc], 0
mov eax, 0xff
cmp eax, dword [0x499fdc]
jl 0x40352c
push dword [0x499fdc]
call sub.USER32.DLL_GetAsyncKeyState
inc dword [0x499fdc]
jno 0x40350c
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x40353b
push 0x55009553
ret
mov ebp, dword [0x49a5ac]
push dword [ebp + 4]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 4]
mov ebp, dword [0x49a5ac]
push dword [ebp + 8]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 8]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0xc]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0xc]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x10]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x10]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x14]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x14]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x18]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x18]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x1c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x1c]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x20]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x20]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x24]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x24]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x28]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x28]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x2c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x2c]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x30]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x30]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x34]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x34]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x38]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x38]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x3c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x3c]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x40]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x40]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x44]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x44]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x48]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x48]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x4c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x4c]
mov ebp, dword [0x49a5ac]
push dword [ebp + 0x50]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49a5cc]
pop dword [ebp + 0x50]
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x499fe0], ebx
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x499fe4], ebx
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x499fe8], ebx
push 1
call fcn.0040a699
push dword [0x499f50]
push 4
push dword [0x499f54]
mov ebx, dword [0x499fc0]
add ebx, 0x3f00
push ebx
push dword [0x499fc8]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x499efc], eax
mov eax, dword [0x499f54]
call fcn.0040a7c0
mov dword [0x499fec], eax
mov ebx, dword [0x499fec]
add ebx, 0x34
mov dword [0x499ff0], ebx
mov eax, dword [0x499fec]
mov dword [0x499ff4], eax
mov dword [0x499ff8], 3
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x499ffc], eax
mov ebx, dword [0x499ffc]
and ebx, ebx
je 0x4038fc
mov ebx, dword [0x49a000]
and ebx, ebx
jle 0x4038e3
push 2
mov eax, dword [0x499f54]
call fcn.0040a7b0
mov dword [0x499efc], eax
push dword [0x499f50]
push 4
push dword [0x499f54]
push dword [0x499ff0]
push dword [0x499fc8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x499efc], eax
push 0
call fcn.004097a2
push 0x12c
call fcn.0040a699
jmp 0x4038fc
push 4
call fcn.004097a2
push 0x12c
call fcn.0040a699
call fcn.00404095
mov dword [0x499ff8], 5
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a004], eax
mov ebx, dword [0x49a004]
and ebx, ebx
je 0x403966
mov dword [0x499ff8], 6
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a008], eax
mov ebx, dword [0x49a008]
and ebx, ebx
je 0x4039d0
mov dword [0x499ff8], 7
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a00c], eax
mov ebx, dword [0x49a00c]
and ebx, ebx
je 0x403a3a
mov dword [0x499ff8], 8
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a010], eax
mov ebx, dword [0x49a010]
and ebx, ebx
je 0x403aa4
mov dword [0x499ff8], 9
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a014], eax
mov ebx, dword [0x49a014]
and ebx, ebx
je 0x403b0e
mov dword [0x499ff8], 0xa
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a018], eax
mov ebx, dword [0x49a018]
and ebx, ebx
je 0x403b78
mov dword [0x499ff8], 0xb
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a01c], eax
mov ebx, dword [0x49a01c]
and ebx, ebx
je 0x403be2
mov dword [0x499ff8], 0xc
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a020], eax
mov ebx, dword [0x49a020]
and ebx, ebx
je 0x403c4c
mov dword [0x499ff8], 0xd
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a024], eax
mov ebx, dword [0x49a024]
and ebx, ebx
je 0x403cb6
mov dword [0x499ff8], 0xe
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a028], eax
mov ebx, dword [0x49a028]
and ebx, ebx
je 0x403d20
mov dword [0x499ff8], 0xf
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a02c], eax
mov ebx, dword [0x49a02c]
and ebx, ebx
je 0x403d8a
mov dword [0x499ff8], 0x10
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a030], eax
mov ebx, dword [0x49a030]
and ebx, ebx
je 0x403df4
mov dword [0x499ff8], 0x11
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a034], eax
mov ebx, dword [0x49a034]
and ebx, ebx
je 0x403e5e
mov dword [0x499ff8], 0x12
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a038], eax
mov ebx, dword [0x49a038]
and ebx, ebx
je 0x403ec8
mov dword [0x499ff8], 0x13
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a03c], eax
mov ebx, dword [0x49a03c]
and ebx, ebx
je 0x403f32
mov dword [0x499ff8], 0x14
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5c4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5bc]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5b4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x499ff8]
mov ebp, dword [0x49a5ac]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00406f92
mov dword [0x49a040], eax
mov ebx, dword [0x49a040]
and ebx, ebx
je 0x403f9c
mov dword [0x49a044], 0
mov dword [0x49a048], 0
mov dword [0x499ffc], 0
mov dword [0x49a04c], 0
mov dword [0x49a004], 0
mov dword [0x49a008], 0
mov dword [0x49a00c], 0
mov dword [0x49a010], 0
mov dword [0x49a014], 0
mov dword [0x49a018], 0
mov dword [0x49a01c], 0
mov dword [0x49a020], 0
mov dword [0x49a024], 0
mov dword [0x49a028], 0
mov dword [0x49a02c], 0
mov dword [0x49a030], 0
mov dword [0x49a034], 0
mov dword [0x49a038], 0
mov dword [0x49a03c], 0
mov dword [0x49a040], 0
mov ebx, dword [0x499f64]
cmp ebx, 0x45a2a5
je 0x404081
push 0
push 3
call fcn.0040c0d1
call fcn.004052ac
push 1
call fcn.0040a699
jmp 0x403502
push 0
call 0x406c17
push dword [0x499eec]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040989d
call fcn.0040a6e0
call fcn.0040a914
call fcn.0040aeaf
call fcn.0040c495
call fcn.0040dbe0
call fcn.0040e000
call fcn.0040ec75
call fcn.0040f8de
ret