Function at 0x403e80
Capabilities:
Allocate or change rwx memory
Check for foreground window switch
Create thread
Enumerate process modules
Execute shellcode via indirect call
Inject thread
Log keystrokes via polling
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a691
mov eax, dword fs:[0]
push eax
sub esp, 0x480
mov eax, dword [0x43a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, str.Activate_the_Metin2_Client_and_hit_ENTER
mov byte [ebp - 0x15], 0
mov ecx, 0x43b008
mov dword [ebp - 0x14], 0
mov dword [0x43bdf8], 0x432e78
call fcn.00406f70
push eax
call fcn.00407210
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 4
push 0x23
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, str.searching..
mov ecx, 0x43b008
call fcn.00406f70
push eax
call fcn.00407210
add esp, 4
push 0xd
call esi
test al, 1
jne 0x403f10
push 0x2d
call esi
test al, 1
je 0x403f36
mov edx, str.I_PRESSED_ENTER
mov ecx, 0x43b008
call fcn.00406f70
push eax
call fcn.00407210
add esp, 4
lea eax, [ebp - 0x14]
push eax
call fcn.00401200
mov byte [ebp - 0x15], al
jmp 0x403f39
mov al, byte [ebp - 0x15]
test al, al
je 0x403ee0
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.00403cd0
push 0x224
lea eax, [ebp - 0x48c]
mov dword [0x43bdf4], esi
push 0
push eax
call fcn.0040c640
add esp, 0xc
push esi
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x404036
push 0x220
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.0040c640
add esp, 0xc
mov dword [ebp - 0x260], 0x224
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x40402f
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
nop dword [eax]
nop word [eax + eax]
mov ecx, dword [0x43bdf8]
lea eax, [ebp - 0x240]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404000
test dl, dl
je 0x403ffc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404000
add eax, 2
add ecx, 2
test dl, dl
jne 0x403fe0
xor eax, eax
jmp 0x404005
sbb eax, eax
or eax, 1
test eax, eax
je 0x404019
lea eax, [ebp - 0x260]
push eax
push esi
call edi
test eax, eax
jne 0x403fd0
jmp 0x40402f
mov ecx, 0x89
lea esi, [ebp - 0x260]
lea edi, [ebp - 0x48c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x89
lea esi, [ebp - 0x48c]
mov edi, 0x43bdfc
rep movsd dword es:[edi], dword [esi]
push dword [0x43bdf4]
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x43bdf0], eax
test eax, eax
je 0x404d8f
push 0x432f00
call fcn.004123f7
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov eax, dword [0x43aa80]
nop dword [eax + eax]
cmp dword [0x43aa7c], 0
je 0x4040a6
cmp dword [0x43aa78], 0
je 0x4040a6
test eax, eax
jne 0x4040c1
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff6
mov dword [0x43aa7c], eax
call esi
mov dword [0x43aa78], eax
call edi
mov dword [0x43aa80], eax
jmp 0x404090
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [0x43aa84], 0
jne 0x404100
lea eax, [ebp - 0x20]
push eax
push dword [0x43aa78]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [ebp - 0x20]
and eax, 0xffffffbf
push eax
push dword [0x43aa78]
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ecx, dword [ebp - 0x38]
sub esp, 0x14
mov eax, dword [ebp - 0x30]
add ecx, 0xffffff06
add eax, ecx
push eax
mov eax, dword [ebp - 0x34]
add eax, 0xffffff38
push eax
call fcn.004027b0
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xd
movups xmmword [ecx], xmm0
push str.ExtendedQueue
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
call fcn.004024c0
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 7
movups xmmword [ecx], xmm0
push str.Farmbot
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
call fcn.004024c0
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xa
movups xmmword [ecx], xmm0
push str.AttackMode
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
call fcn.004024c0
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xb
movups xmmword [ecx], xmm0
push str.FlyingStand
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
call fcn.004024c0
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 6
movups xmmword [ecx], xmm0
push str.Stones
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
call fcn.004024c0
push str.module::QualityOfLife
push 0x43aa78
call fcn.00402410
add esp, 8
push str.xxxxxxx____xx____
push 0x432f60
call fcn.00401330
push str.xxxx____xxxxxxxxxx____
push 0x432f8c
mov dword [ebp - 0x2c], eax
call fcn.00401330
push str.xx____xxxxxxxxx____xxxxxxx
push 0x432fc0
mov dword [ebp - 0x28], eax
call fcn.00401330
push str.xxxxxxxxxxxxx____xxxx
push 0x432ff4
mov edi, eax
call fcn.00401330
push str.xx____xxxxxx_____xx____xx_____xx
push 0x433030
call fcn.00401330
lea esi, [eax + 0x19]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x20]
push str.xxxxxx__xxxx_xx_xxx____
push 0x43306c
mov dword [0x43bdc8], eax
call fcn.00401330
lea esi, [eax + 6]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x15]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 1
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov al, byte [ebp - 0x15]
push str.xxxxxxx____xxxx__xxx_____
push 0x4330a0
mov byte [0x43bdd1], al
call fcn.00401330
lea esi, [eax + 0x14]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x15]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 1
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov al, byte [ebp - 0x15]
push str.xxxx____xxxxxxxxx____x____
mov byte [0x43bdd0], al
push 0x4330d8
call fcn.00401330
lea esi, [eax + 4]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x20]
push str.xxxxx____xxxxxxxxx____xx
push 0x433110
mov dword [0x43bdd4], eax
call fcn.00401330
lea esi, [eax + 0x12]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x20]
mov dword [0x43bde4], eax
add eax, 0xffffffc4
push str.xxx____x____xxxxxxxxx_xx____
push 0x43314c
mov dword [0x43bddc], eax
call fcn.00401330
lea esi, [eax + 0x18]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x20]
mov dword [0x43bde8], eax
push str.xxxx____xx____xxxx____xxxx____xxxx____xxx
push 0x433198
call fcn.00401330
lea esi, [eax + 4]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x20]
push eax
push str.Offset::OffsetCActorInstanceRotation__04X_n
push 0x43aa78
mov dword [0x43bdcc], eax
call fcn.00402480
add esp, 0xc
push str.xxxx_xxxx____xxx____
push 0x433208
call fcn.00401330
lea esi, [eax + 9]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x20]
push str.xxxxxxx_____xx____xx_
push 0x433238
mov dword [0x43bdd8], eax
call fcn.00401330
lea esi, [eax + 7]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x24]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push str.x____xxxxxxxx____xx____
push 0x433268
call fcn.00401330
lea esi, [eax + 0xd]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x24]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x24]
push str.xxxxxxxxxxx____xxxxx_
push 0x433298
mov dword [0x43bde0], eax
call fcn.00401330
lea esi, [eax + 0xb]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x24]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push str.xx____xxxxxx____xxxx____
push 0x4332cc
call fcn.00401330
lea esi, [eax + 0x14]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x24]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x24]
push eax
push str._offset:__04X_n
push 0x43aa78
mov dword [0x43bdec], eax
call fcn.00402480
add esp, 0xc
lea eax, [ebp - 0x1c]
lea esi, [edi + 2]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x24]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
mov dword [0x43bda8], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x24]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x24]
push edi
push str.StartCustomEntityList__04X_n
push 0x43aa78
mov dword [0x43bda4], eax
call fcn.00402480
push dword [0x43bda4]
push str.AdressEntityListStart__04X_n
push 0x43aa78
call fcn.00402480
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add esp, 0x18
add esi, 7
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call edi
push 0
push 4
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
push dword [0x43bdf0]
call edi
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
mov dword [ebp - 0x20], esi
call edi
push 0
push 4
lea eax, [ebp - 0x24]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call edi
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov dword [0x43bdc4], eax
add esi, 4
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call edi
push 0
push 4
lea eax, [ebp - 0x28]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
push dword [0x43bdf0]
call edi
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call edi
push 0
push 4
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call edi
mov eax, dword [ebp - 0x2c]
mov esi, dword [0x43bdc4]
mov dword [0x43bdac], eax
add esi, 0xc
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call edi
push 0
push 4
lea eax, [ebp - 0x28]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
push dword [0x43bdf0]
call edi
mov esi, dword [0x43bde4]
lea eax, [ebp - 0x14]
mov edi, dword [ebp - 0x28]
add esi, edi
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x24]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [0x43bddc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
add esi, edi
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + 0x1700]
push eax
push dword [ebp - 0x24]
push dword [0x43bdc4]
push dword [0x43bdac]
push ecx
push edi
push str.CInstanceBaseOwn__04X_nCActorInstance__04X_nClass_CPythonPlayer__04X_nClass_CPythonCharacterManager__04X_nRaceMotion__04X_nSkillStart__04X_nCPythonCharacterManager__04X_n
push 0x43aa78
call fcn.00402480
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x24
push 0
push 0
push 0
push 0x402c10
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4033f0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x402dc0
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x23
call edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x43bde0]
jne 0x404a34
push 0x70
call esi
test al, 1
je 0x404afc
mov eax, dword [0x43c034]
cmp eax, dword [0x43c038]
je 0x404a64
mov dword [0x43c038], eax
cmp byte [0x43bda1], 0
xorps xmm0, xmm0
mov dword [0x43bdb4], 0
sete byte [0x43bda1]
mov dword [0x43bdbc], 0xffffffff
sub esp, 0x18
mov byte [0x43bdb8], 0
mov ecx, esp
mov dword [ebp - 0x264], esp
push 0
movups xmmword [ecx], xmm0
push 0x432c7d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movzx eax, byte [0x43bda1]
push eax
sub esp, 0x18
mov ecx, esp
push 0xd
movups xmmword [ecx], xmm0
push str.ExtendedQueue
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
mov dword [ebp - 4], 0xffffffff
call fcn.004025d0
push 0x78
call edi
push 0x71
call esi
test al, 1
je 0x404b81
cmp byte [0x43bda0], 0
xorps xmm0, xmm0
sete byte [0x43bda0]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x268], esp
push 0
movups xmmword [ecx], xmm0
push 0x432c7d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movzx eax, byte [0x43bda0]
push eax
sub esp, 0x18
mov ecx, esp
push 7
movups xmmword [ecx], xmm0
push str.Farmbot
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
mov dword [ebp - 4], 0xffffffff
call fcn.004025d0
push 0x78
call edi
push 0x72
call esi
test al, 1
je 0x404c06
cmp byte [0x43bda2], 0
xorps xmm0, xmm0
sete byte [0x43bda2]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x268], esp
push 0
movups xmmword [ecx], xmm0
push 0x432c7d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
mov dword [ebp - 4], 2
xorps xmm0, xmm0
movzx eax, byte [0x43bda2]
push eax
sub esp, 0x18
mov ecx, esp
push 0xa
movups xmmword [ecx], xmm0
push str.AttackMode
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
mov dword [ebp - 4], 0xffffffff
call fcn.004025d0
push 0x78
call edi
push 0x73
call esi
test al, 1
je 0x404a34
cmp byte [0x43bda3], 0
lea eax, [ebp - 0x1c]
mov esi, dword [0x43bdc4]
push eax
push 0x40
sete byte [0x43bda3]
add esi, 0xc
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x28]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x14]
add esi, dword [0x43bddc]
push eax
push 0x40
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp byte [0x43bda3], 0
je 0x404cc5
movss xmm0, dword [0x433424]
jmp 0x404ccd
movss xmm0, dword [0x433420]
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
add esi, 0x18ac
movss dword [ebp - 0x24], xmm0
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x24]
push eax
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 4
push esi
push dword [0x43bdf0]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
mov dword [ebp - 0x268], esp
push 0
movups xmmword [ecx], xmm0
push 0x432c7d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
mov dword [ebp - 4], 3
xorps xmm0, xmm0
movzx eax, byte [0x43bda3]
push eax
sub esp, 0x18
mov ecx, esp
push 0xb
movups xmmword [ecx], xmm0
push str.FlyingStand
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00407540
mov dword [ebp - 4], 0xffffffff
call fcn.004025d0
push 0x78
call edi
jmp 0x404a2e
push 0
push str.Fehler
push str.Der_Prozess_konnte_nicht_ge
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040abcc
mov esp, ebp
pop ebp
ret