Function at 0x401000
Capabilities:
Allocate thread local storage
Authenticate hmac
Check for time delay via gettickcount
Check internet connectivity via wininet
Download url
Log keystrokes via polling
Parse pe header
Receive data

Disassembly:
push 0x7cc
push 0
push 0x497400
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x497404], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x497400], eax
mov eax, 0x486386
mov dword [0x497408], eax
call fcn.00414fe0
call fcn.00414470
call fcn.0041434b
call fcn.004138d9
call fcn.00412cdc
call fcn.00412a79
call fcn.00412933
call fcn.00411df0
call fcn.004119b0
call fcn.004117ef
call fcn.0040feee
call fcn.0040e7b9
call fcn.0040e291
call fcn.0040da8d
call fcn.0040d88f
call fcn.0040c4a9
call fcn.0040e730
call fcn.0040caa0
call fcn.00415030
push eax
push eax
call fcn.00411ac4
push 0x49740c
call fcn.00415070
call fcn.00415030
push eax
mov edx, dword [0x49740c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.0.ogg
call fcn.00415100
call fcn.00415160
push 0
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00411f90
call fcn.004151c0
mov ebp, 0x45336e
mov ebx, ebp
mov ebp, 0x4507d8
sub ebx, ebp
push ebx
mov ebp, 0x4507d8
push ebp
push 0
call fcn.004121c0
push 0
call fcn.00411d70
call fcn.00415030
push eax
mov edx, dword [0x49740c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.1.ogg
call fcn.00415100
call fcn.00415160
push 0
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00411f90
call fcn.004151c0
mov ebp, 0x4562df
mov ebx, ebp
mov ebp, 0x45336e
sub ebx, ebp
push ebx
mov ebp, 0x45336e
push ebp
push 0
call fcn.004121c0
push 0
call fcn.00411d70
call fcn.00415030
push eax
mov edx, dword [0x49740c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.3.ogg
call fcn.00415100
call fcn.00415160
push 0
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00411f90
call fcn.004151c0
mov ebp, 0x459914
mov ebx, ebp
mov ebp, 0x4562df
sub ebx, ebp
push ebx
mov ebp, 0x4562df
push ebp
push 0
call fcn.004121c0
push 0
call fcn.00411d70
call fcn.00415030
push eax
mov edx, dword [0x49740c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.4.ogg
call fcn.00415100
call fcn.00415160
push 0
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00411f90
call fcn.004151c0
mov ebp, 0x45e2e5
mov ebx, ebp
mov ebp, 0x459914
sub ebx, ebp
push ebx
mov ebp, 0x459914
push ebp
push 0
call fcn.004121c0
call fcn.00415030
push eax
mov edx, dword [0x49740c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.5.ogg
call fcn.00415100
call fcn.00415160
push 0
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00411f90
call fcn.004151c0
mov ebp, 0x460ef2
mov ebx, ebp
mov ebp, 0x45e2e5
sub ebx, ebp
push ebx
mov ebp, 0x45e2e5
push ebp
push 0
call fcn.004121c0
push 0
call fcn.00411d70
call fcn.0040cb30
call fcn.00415030
push eax
mov edx, dword [0x49740c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.0.ogg
call fcn.00415100
call fcn.00415160
push 0
call fcn.004151a2
add dword [esp + 4], edx
call fcn.0040cd28
call fcn.004151c0
mov dword [0x497410], eax
call fcn.00415030
push eax
mov edx, dword [0x49740c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.1.ogg
call fcn.00415100
call fcn.00415160
push 1
call fcn.004151a2
add dword [esp + 4], edx
call fcn.0040cd28
call fcn.004151c0
mov dword [0x497410], eax
call fcn.00415030
push eax
mov edx, dword [0x49740c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.3.ogg
call fcn.00415100
call fcn.00415160
push 3
call fcn.004151a2
add dword [esp + 4], edx
call fcn.0040cd28
call fcn.004151c0
mov dword [0x497410], eax
call fcn.00415030
push eax
mov edx, dword [0x49740c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.4.ogg
call fcn.00415100
call fcn.00415160
push 4
call fcn.004151a2
add dword [esp + 4], edx
call fcn.0040cd28
call fcn.004151c0
mov dword [0x497410], eax
call fcn.00415030
push eax
mov edx, dword [0x49740c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.5.ogg
call fcn.00415100
call fcn.00415160
push 5
call fcn.004151a2
add dword [esp + 4], edx
call fcn.0040cd28
call fcn.004151c0
mov dword [0x497410], eax
call fcn.0040e730
call fcn.00415030
push eax
push 0
push 0x40
call fcn.00415030
push eax
push eax
call fcn.0040dabc
call fcn.004151a2
add dword [esp], edx
call fcn.0040a186
push 0x497428
call fcn.00415070
mov ebp, 0x460ef2
push ebp
push 0
call fcn.00412f19
and eax, eax
je 0x402008
mov ebp, 0x4726a9
push ebp
push 2
call fcn.00412f19
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0x41
push 0x133
push 2
call fcn.004130e3
push eax
call fcn.00412af9
call fcn.00412b40
push 0x100
push 0x18
push 0x450228
push 1
call fcn.004119c4
and eax, eax
je 0x4014b2
push 0x100
push 0x30
push 0x450228
push 2
call fcn.004119c4
and eax, eax
je 0x4014cf
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004130ff
and eax, eax
je 0x4015b3
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 1
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dfb0
push eax
push str.theroc44
push 0
push 0
call fcn.00412bb7
call fcn.00412b40
push 0
push 0x64
push 0xc8
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0x11
call fcn.00412ba0
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0x497b6c
push 0x4507d0
push 8
push 0x65
push 4
call fcn.00412834
call fcn.00415030
push eax
push eax
call fcn.00411ac4
push 0x49742c
call fcn.00415070
call fcn.00415030
push eax
mov edx, dword [0x49742c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.Options
call fcn.00415100
call fcn.00415160
push 0xa
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00411f90
call fcn.004151c0
and eax, eax
je 0x401654
mov ebp, 0x4840e2
mov ebx, ebp
mov ebp, str.MEGA_TRAINER_r_nVer.1.03_r_n_r_nNumpad_1:_Unlimited_Health_r_nNumpad_2:_Unlimited_Stamina_r_nNumpad_3:_Easy_Kills_r_nNumpad_4:_Unlimited_Item_Use_r_nNumpad_5:_Unlimited_Spell_Ammo_r_nNumpad_6:_Unlimited_Weight_r_nNumpad_7:_Unlimited_Durability_r_nNumpad_8:_Add_Souls_r_nNumpad_9:_Add_Soul_Memory_r_nNumpad_0:_Reset_Level_r_nNumpad_:_Super_Stats_r_nNumpad__:_Reset_Stats_r_nNumpad__:_Unlimited_Torch_r_nNumpad_:_Reset_Soul_Memory
sub ebx, ebp
push ebx
mov ebp, str.MEGA_TRAINER_r_nVer.1.03_r_n_r_nNumpad_1:_Unlimited_Health_r_nNumpad_2:_Unlimited_Stamina_r_nNumpad_3:_Easy_Kills_r_nNumpad_4:_Unlimited_Item_Use_r_nNumpad_5:_Unlimited_Spell_Ammo_r_nNumpad_6:_Unlimited_Weight_r_nNumpad_7:_Unlimited_Durability_r_nNumpad_8:_Add_Souls_r_nNumpad_9:_Add_Soul_Memory_r_nNumpad_0:_Reset_Level_r_nNumpad_:_Super_Stats_r_nNumpad__:_Reset_Stats_r_nNumpad__:_Unlimited_Torch_r_nNumpad_:_Reset_Soul_Memory
push ebp
push 0xa
call fcn.004121c0
push 0xa
call fcn.00411d70
jmp 0x401668
push str.Could_not_install_the_file___Installtion_failed
push str.Error
call fcn.0040d8f5
jmp 0x4093f2
call fcn.00415030
push eax
mov edx, dword [0x49742c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.help.txt
call fcn.00415100
call fcn.00415160
push 0
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00411f90
call fcn.004151c0
and eax, eax
je 0x4016d5
mov ebp, 0x4857c3
mov ebx, ebp
mov ebp, 0x4840e2
sub ebx, ebp
push ebx
mov ebp, 0x4840e2
push ebp
push 0
call fcn.004121c0
push 0
call fcn.00411d70
jmp 0x4016e4
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040d8f5
push 0x497b6c
push 0x4507d0
push 8
push 0x65
push 4
call fcn.00412834
call fcn.00415030
push eax
mov edx, dword [0x49742c]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.Options
call fcn.00415100
call fcn.00415160
push 0xa
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00412060
call fcn.004151c0
call fcn.00415030
push eax
push eax
push 0xa
call fcn.00412220
mov edx, 0x450094
call fcn.00415100
push 0x497430
call fcn.00415070
call fcn.00415030
push eax
push eax
push 0xa
call fcn.00412220
push 0x497434
call fcn.00415070
call fcn.00415030
push eax
push eax
push 0xa
call fcn.00412220
mov ebx, dword [0x497438]
inc ebx
mov ebp, dword [0x497b6c]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00415070
inc dword [0x497438]
push 0xa
call fcn.00412360
mov ebx, eax
cmp ebx, 1
jne 0x401780
push 0xa
call fcn.00411d70
fild dword [0x497438]
fmul dword [0x4507b0]
fstp dword [0x49743c]
fld dword [0x49743c]
fmul dword [0x4507b4]
fstp dword [0x497440]
fld dword [0x49743c]
fild dword [0x497438]
fdiv dword [0x4507b8]
fdivp st(1)
fstp dword [0x497444]
fld dword [0x497440]
fild dword [0x497438]
fdiv dword [0x4507b8]
fdivp st(1)
fstp dword [0x497448]
fld dword [0x49743c]
fcomp dword [0x4507bc]
fnstsw ax
test ah, 1
jne 0x401844
mov ebx, dword [0x497438]
cmp ebx, 0x15
jl 0x401844
jmp 0x40184b
mov eax, 1
jmp 0x40184d
xor eax, eax
and eax, eax
je 0x401889
mov dword [0x49743c], 0x44480000
mov dword [0x497440], 0x44c80000
fld dword [0x49743c]
fdiv dword [0x4507b4]
fstp dword [0x497444]
fld dword [0x497440]
fdiv dword [0x4507b4]
fstp dword [0x497448]
push 0x120
fld dword [0x497440]
push eax
fistp dword [esp]
fld dword [0x49743c]
push eax
fistp dword [esp]
push 1
call fcn.004130ff
and eax, eax
je 0x401a23
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 1
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
mov dword [0x49744c], 1
mov eax, dword [0x497438]
cmp eax, dword [0x49744c]
jl 0x401941
push 0xff
push 0
push 0
mov eax, 0
call fcn.0040dfb0
push eax
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b6c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49744c]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe8
push ebx
push 2
call fcn.00412bb7
inc dword [0x49744c]
jno 0x4018e8
mov dword [0x49744c], 1
mov eax, dword [0x497438]
cmp eax, dword [0x49744c]
jl 0x4019a4
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040dfb0
push eax
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b6c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49744c]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe6
push ebx
push 0
call fcn.00412bb7
inc dword [0x49744c]
jno 0x40194b
call fcn.00412b40
push 0
fld dword [0x497448]
push eax
fistp dword [esp]
fld dword [0x497444]
push eax
fistp dword [esp]
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0x11
call fcn.00412ba0
fld dword [0x497448]
push eax
fistp dword [esp]
fld dword [0x497444]
push eax
fistp dword [esp]
push 0x43
push 7
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0x120
push 0x190
push 0x640
push 1
call fcn.004130ff
and eax, eax
je 0x401b37
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 2
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
call fcn.00415030
push eax
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dfb0
push eax
mov edx, dword [0x497430]
call fcn.00415030
push eax
call fcn.00415100
mov edx, dword [0x497434]
call fcn.00415100
call fcn.00415160
push 0
push 0
call fcn.004151a2
add dword [esp + 8], edx
call fcn.00412bb7
call fcn.004151c0
call fcn.00412b40
push 0
push 0x64
push 0x190
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0x11
call fcn.00412ba0
push 0x64
push 0x190
push 0x28
push 5
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0x90000001
push 0x45002a
push 0
call fcn.0041339a
push eax
push 0
call fcn.004133b8
push eax
push 0
push 0
push 0
call fcn.00410250
and eax, eax
je 0x402008
push str.CLOSEBUTTON
push 0x13
push 0x13
push 6
push 0x1e4
push 1
call fcn.0040e943
mov dword [0x497410], eax
push str.READMEBUTTON
push 0x20
push 0x11e
push 0x17e
push 0xa
push 3
call fcn.0040e943
mov dword [0x497410], eax
push str.TROUBLEBUTTON
push 0x20
push 0x11e
push 0x19c
push 0xa
push 4
call fcn.0040e943
mov dword [0x497410], eax
push str.CHBUTTON
push 0x23
push 0xf5
push 1
push 0x23
push 5
call fcn.0040e943
mov dword [0x497410], eax
push str.BOXARTBUTTON
push 0x118
push 0xc8
push 0x2d
push 0x132
push 6
call fcn.0040e943
mov dword [0x497410], eax
push 0x4501ea
push 0x10e
push 0x122
push 0x41
push 0
push 7
call fcn.0040e943
mov dword [0x497410], eax
push 0
call fcn.00410273
push eax
push 0x80000000
push str.Test
push 0x6b
push 0xc8
push 0
push 0xfffffc18
push 1
call fcn.0040ff4a
push 0
call fcn.00410273
push eax
call fcn.0040a886
push 0xff
push 0
call fcn.004130e3
push eax
push 0
call fcn.00410273
push eax
call fcn.00409444
push 0
push 0
call fcn.00410321
call fcn.00415030
push eax
push eax
mov edx, str.http:__www.cheathappens.com_trnflash.asp_id
call fcn.00415100
mov edx, dword [0x497428]
call fcn.00415100
call fcn.00415160
push 0xc8
push 0x12c
push 0
push 0
push 2
call fcn.004151a2
add dword [esp + 0x14], edx
call fcn.0040fa43
call fcn.004151c0
mov dword [0x497410], eax
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
mov ebx, eax
and ebx, ebx
jne 0x401d4b
push 1
push 1
call fcn.00410321
mov dword [0x49744c], 1
mov eax, 4
cmp eax, dword [0x49744c]
jl 0x402008
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004130ff
and eax, eax
je 0x401ea7
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 1
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dfb0
push eax
push str.theroc44
push 0
push 0
call fcn.00412bb7
call fcn.00412b40
push 0
push 0x64
push 0xc8
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0
call fcn.00412ba0
push 0xff
push 0x44
push 0x44
mov eax, 0x44
call fcn.0040dfb0
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.00412c3b
push 0x21
call fcn.00412ba0
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0xff
push 0
call fcn.004130e3
push eax
push 0
call fcn.00410273
push eax
call fcn.00409444
push 0x32
call fcn.0040dfc9
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004130ff
and eax, eax
je 0x401ff2
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 1
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040dfb0
push eax
push str.theroc44
push 0
push 0
call fcn.00412bb7
call fcn.00412b40
push 0
push 0x64
push 0xc8
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0
call fcn.00412ba0
push 0xff
push 0x44
push 0x44
mov eax, 0x44
call fcn.0040dfb0
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.00412c3b
push 0x21
call fcn.00412ba0
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0xff
push 0
call fcn.004130e3
push eax
push 0
call fcn.00410273
push eax
call fcn.00409444
push 0x32
call fcn.0040dfc9
inc dword [0x49744c]
jno 0x401d55
push 0x497b74
push 0x4507d0
push 8
push 0x100
push 4
call fcn.00412834
mov eax, 0x4857c3
mov dword [0x497408], eax
lea ecx, [0x497450]
mov edx, dword [0x497408]
call fcn.0040b008
add dword [0x497408], eax
mov dword [0x49744c], 1
mov eax, 0xfe
cmp eax, dword [0x49744c]
jl 0x4020c7
call fcn.00415030
push eax
push eax
push 0x45003e
push dword [0x49744c]
push dword [0x497450]
call fcn.0040b0c0
push 0x497454
call fcn.00415070
call fcn.00415030
push eax
push eax
push dword [0x497454]
call fcn.0040b1d0
mov ebx, eax
dec ebx
push ebx
push dword [0x497454]
call fcn.0040b200
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b74]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00415070
inc dword [0x49744c]
jno 0x402051
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4020d7
push 0x75009553
inc ecx
ret
push 0x12c
call fcn.0040dfc9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004130ff
and eax, eax
je 0x402222
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 1
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dfb0
push eax
push str.Authenticating_Trainer......
push 0
push 0
call fcn.00412bb7
call fcn.00412b40
push 0
push 0x64
push 0x1f4
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0
call fcn.00412ba0
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040dfb0
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00412c3b
push 0x11
call fcn.00412ba0
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0xff
push 0
call fcn.004130e3
push eax
push 0
call fcn.00410273
push eax
call fcn.00409444
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
push eax
call fcn.0040dabc
call fcn.004151a2
add dword [esp], edx
call fcn.00411b25
push 0x497458
call fcn.00415070
mov edx, dword [0x497458]
call fcn.00415030
push eax
call fcn.00415100
push 0x49745c
call fcn.00415070
call sub.USER32.DLL_GetForegroundWindow
mov dword [0x497460], eax
push 0x497464
push dword [0x497460]
call sub.USER32.DLL_GetWindowThreadProcessId
push dword [0x497464]
push dword [0x49746c]
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x497468], eax
mov eax, dword [0x497464]
mov dword [0x497460], eax
push 0x3e8
call fcn.004144a0
mov dword [0x497470], eax
mov edx, dword [0x49745c]
call fcn.00415030
push eax
call fcn.00415100
push 0x497474
call fcn.00415070
mov eax, dword [0x49747c]
mov dword [0x497478], eax
mov ebp, 0x486386
mov dword [0x49744c], ebp
mov eax, dword [0x49744c]
call fcn.004144c0
mov byte [0x497840], al
mov ebp, 0x486389
mov dword [0x49744c], ebp
mov ebp, 0x486389
mov ebx, ebp
add ebx, 0xbb8
cmp ebx, dword [0x49744c]
jl 0x40238e
mov eax, dword [0x49744c]
call fcn.004144c0
mov byte [0x497841], al
movsx ebx, byte [0x497841]
xor bl, byte [0x497840]
mov eax, ebx
mov byte [0x497842], al
movsx ebx, byte [0x497840]
add ebx, 0x37
mov eax, ebx
mov byte [0x497840], al
movsx ebx, byte [0x497840]
cmp ebx, 0xff
jle 0x40236b
movsx ebx, byte [0x497840]
add ebx, 0xffffff01
mov eax, ebx
mov byte [0x497840], al
movsx eax, byte [0x497842]
push eax
mov eax, dword [0x49744c]
call fcn.004144d0
mov dword [0x497410], eax
inc dword [0x49744c]
jno 0x4022ff
call sub.KERNEL32.dll_GetTickCount
mov dword [0x497480], eax
call fcn.00415030
push eax
push eax
call fcn.0040dabc
push 0x497484
call fcn.00415070
call fcn.00415030
push eax
push eax
push dword [0x497484]
call fcn.00411b25
push 0x497484
call fcn.00415070
mov edx, 0x45002a
lea ecx, [0x497450]
call fcn.0040b008
mov edx, 0x45002a
lea ecx, [0x497488]
call fcn.0040b008
mov edx, 0x45002a
lea ecx, [0x49748c]
call fcn.0040b008
mov dword [0x497490], 0
mov dword [0x497494], 0
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
call fcn.0040dabc
call fcn.00415160
push 0
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00412110
call fcn.004151c0
push 0
call fcn.00412400
mov dword [0x497498], eax
mov dword [0x49744c], 1
mov ebx, dword [0x497498]
add ebx, 0xfffffff8
cmp ebx, dword [0x49744c]
jl 0x402493
push 0
call fcn.00412460
mov byte [0x497843], al
mov ebx, dword [0x497494]
movzx eax, byte [0x497843]
add ebx, eax
mov dword [0x497494], ebx
inc dword [0x49744c]
jno 0x402456
push 0
call fcn.004124c0
mov dword [0x49749c], eax
push 0
call fcn.004124c0
mov dword [0x4974a0], eax
push 0
call fcn.00411d70
mov eax, dword [0x497494]
mov dword [0x4974a4], eax
push dword [0x497484]
push 0
call fcn.00412110
mov ebx, eax
and ebx, ebx
jle 0x402838
mov dword [0x49744c], 1
mov eax, 0x3b8
cmp eax, dword [0x49744c]
jl 0x40250d
push 0
call fcn.00412520
mov dword [0x4974a8], eax
inc dword [0x49744c]
jno 0x4024e9
mov dword [0x49744c], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x49744c]
jl 0x4025a3
push 0
call fcn.00412520
mov dword [0x4974a8], eax
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
push 1
mov eax, dword [0x4974a8]
cdq
push edx
push eax
call fcn.0040b2e0
call fcn.004151a2
add dword [esp], edx
call fcn.0040b390
call fcn.004151c0
mov dword [0x4974a8], eax
mov edx, dword [0x497450]
call fcn.00415030
push eax
call fcn.00415100
call fcn.00415030
push eax
push eax
push dword [0x4974a8]
call fcn.0040b4e0
pop eax
push 0x497450
call fcn.00415070
inc dword [0x49744c]
jno 0x402517
push dword [0x497450]
call fcn.0040a656
mov dword [0x4974a8], eax
mov ebx, dword [0x4974a8]
xor ebx, 0x98989898
mov dword [0x4974a8], ebx
mov eax, dword [0x4974a8]
mov dword [0x4974ac], eax
call fcn.00415030
push eax
push eax
push 0xa
call fcn.00415030
push eax
mov edx, str.0000000000
call fcn.00415100
call fcn.00415030
push eax
push eax
mov eax, dword [0x4974a8]
cdq
push edx
push eax
call fcn.0040b670
pop eax
call fcn.004151a2
add dword [esp], edx
call fcn.0040b700
push 0x497450
call fcn.00415070
mov dword [0x49744c], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x49744c]
jl 0x4026ad
push 0
call fcn.00412520
mov dword [0x4974a8], eax
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
push 1
mov eax, dword [0x4974a8]
cdq
push edx
push eax
call fcn.0040b2e0
call fcn.004151a2
add dword [esp], edx
call fcn.0040b390
call fcn.004151c0
mov dword [0x4974a8], eax
mov edx, dword [0x497488]
call fcn.00415030
push eax
call fcn.00415100
call fcn.00415030
push eax
push eax
push dword [0x4974a8]
call fcn.0040b4e0
pop eax
push 0x497488
call fcn.00415070
inc dword [0x49744c]
jno 0x402621
push dword [0x497488]
call fcn.0040a656
mov dword [0x4974b0], eax
mov dword [0x49744c], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x49744c]
jl 0x402753
push 0
call fcn.00412520
mov dword [0x4974a8], eax
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
push 1
mov eax, dword [0x4974a8]
cdq
push edx
push eax
call fcn.0040b2e0
call fcn.004151a2
add dword [esp], edx
call fcn.0040b390
call fcn.004151c0
mov dword [0x4974a8], eax
mov edx, dword [0x49748c]
call fcn.00415030
push eax
call fcn.00415100
call fcn.00415030
push eax
push eax
push dword [0x4974a8]
call fcn.0040b4e0
pop eax
push 0x49748c
call fcn.00415070
inc dword [0x49744c]
jno 0x4026c7
push dword [0x49748c]
call fcn.0040a656
mov dword [0x4974a8], eax
mov eax, dword [0x4974a8]
mov dword [0x4974b4], eax
mov dword [0x49744c], 0x3d1
mov eax, dword [0x4974b4]
cmp eax, dword [0x49744c]
jl 0x40279b
push 0
call fcn.00412520
mov dword [0x4974a8], eax
inc dword [0x49744c]
jno 0x402777
mov eax, dword [0x4974b4]
mov dword [0x49744c], eax
mov ebx, dword [0x4974b4]
add ebx, 0x12
cmp ebx, dword [0x49744c]
jl 0x4027df
push 0
call fcn.00412520
mov dword [0x4974a8], eax
mov ebx, dword [0x497490]
add ebx, dword [0x4974a8]
mov dword [0x497490], ebx
inc dword [0x49744c]
jno 0x4027a5
mov ebx, dword [0x4974b0]
xor ebx, dword [0x497490]
mov dword [0x4974b8], ebx
mov ebx, dword [0x4974b8]
and ebx, ebx
jne 0x402805
mov dword [0x4974b8], 0x63
mov ebx, dword [0x4974b8]
xor ebx, 0x98989898
mov dword [0x4974b8], ebx
mov eax, dword [0x4974ac]
mov dword [0x4974bc], eax
mov ebx, dword [0x4974ac]
cmp ebx, dword [0x4974b8]
jne 0x402831
jmp 0x402836
call fcn.00408220
jmp 0x40283d
call fcn.00408220
mov ebx, dword [0x4974a0]
cmp ebx, dword [0x497498]
jne 0x40284d
jmp 0x402852
call fcn.00408220
call sub.KERNEL32.dll_GetTickCount
mov dword [0x4974c0], eax
mov ebx, dword [0x4974c0]
sub ebx, dword [0x497480]
cmp ebx, 0x3e8
jle 0x402877
push 0x9099542
inc eax
ret
mov dword [0x4974c4], 0x45a2a5
push 0x497b7c
push 0
push 0x15
push 0x15
push 4
call fcn.00412834
push 0x497b84
push 0
push 0x15
push 0x15
push 4
call fcn.00412834
push 0x497b8c
push 0
push 0x15
push 0x15
push 4
call fcn.00412834
push 0x497b94
push 0
push 0x15
push 0x15
push 4
call fcn.00412834
push 0x497b9c
push 0
push 0x15
push 0x15
push 4
call fcn.00412834
push 0x497ba4
push 0
push 0x15
push 0x15
push 4
call fcn.00412834
push 0x497bac
push 0
push 0x15
push 0xa
push 4
call fcn.00412834
push 0x3e8
call fcn.004144a0
mov dword [0x497470], eax
push 0x3e8
call fcn.004144a0
mov dword [0x4974c8], eax
push 0x4000
call fcn.004144a0
mov dword [0x4974cc], eax
push 0x4000
call fcn.004144a0
mov dword [0x4974d0], eax
push 0x14
call fcn.004144a0
mov dword [0x4974d4], eax
mov dword [0x49744c], 1
mov eax, 0x14
cmp eax, dword [0x49744c]
jl 0x402a02
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b84]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b8c]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b94]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x49744c]
jno 0x4029a8
mov ebp, dword [0x497bac]
mov dword [ebp], 0xcc
mov dword [ebp + 4], 0xffffff
mov dword [ebp + 8], 0xcc0000
mov dword [ebp + 0xc], 0xaa00
mov dword [ebp + 0x10], 0x55ee
mov dword [ebp + 0x14], 0xccff
mov dword [ebp + 0x18], 0x2255
mov dword [ebp + 0x1c], 0x770044
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0x6633ff
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
push 1
push 1
call fcn.00415030
push eax
push eax
mov eax, dword [0x4974b8]
cdq
push edx
push eax
call fcn.0040b670
call fcn.004151a2
add dword [esp], edx
call fcn.0040b770
call fcn.004151a2
add dword [esp], edx
call fcn.0040b390
call fcn.004151c0
mov dword [0x4974d8], eax
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
push 1
push 2
call fcn.00415030
push eax
push eax
mov eax, dword [0x4974b8]
cdq
push edx
push eax
call fcn.0040b670
call fcn.004151a2
add dword [esp], edx
call fcn.0040b770
call fcn.004151a2
add dword [esp], edx
call fcn.0040b390
call fcn.004151c0
mov dword [0x4974dc], eax
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
push 1
push 3
call fcn.00415030
push eax
push eax
mov eax, dword [0x4974b8]
cdq
push edx
push eax
call fcn.0040b670
call fcn.004151a2
add dword [esp], edx
call fcn.0040b770
call fcn.004151a2
add dword [esp], edx
call fcn.0040b390
call fcn.004151c0
mov dword [0x4974e0], eax
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
push 1
push 4
call fcn.00415030
push eax
push eax
mov eax, dword [0x4974b8]
cdq
push edx
push eax
call fcn.0040b670
call fcn.004151a2
add dword [esp], edx
call fcn.0040b770
call fcn.004151a2
add dword [esp], edx
call fcn.0040b390
call fcn.004151c0
mov dword [0x4974e4], eax
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
push 1
push 5
call fcn.00415030
push eax
push eax
mov eax, dword [0x4974b8]
cdq
push edx
push eax
call fcn.0040b670
call fcn.004151a2
add dword [esp], edx
call fcn.0040b770
call fcn.004151a2
add dword [esp], edx
call fcn.0040b390
call fcn.004151c0
mov dword [0x4974e8], eax
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0
call fcn.00412ba0
mov ebx, dword [0x4974d8]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1ea
call fcn.00412c3b
mov ebx, dword [0x4974dc]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1ed
call fcn.00412c3b
mov ebx, dword [0x4974e0]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1f0
call fcn.00412c3b
mov ebx, dword [0x4974e4]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1f3
call fcn.00412c3b
mov ebx, dword [0x4974e8]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1f6
call fcn.00412c3b
call fcn.00412b40
mov edx, str.Template
lea ecx, [0x497504]
call fcn.0040b008
call fcn.00415030
push eax
push eax
call fcn.00411ac4
push 0x4974ec
call fcn.00415070
call fcn.00408394
call fcn.00408f04
call fcn.00408394
call fcn.004082b9
call fcn.00408cce
call fcn.004082b9
call fcn.0040755f
call fcn.00415030
push eax
mov edx, dword [0x4974ec]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.CH.dll
call fcn.00415100
call fcn.00415160
push 0
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00411f90
call fcn.004151c0
and eax, eax
je 0x402d6c
mov ebp, 0x486f89
mov ebx, ebp
mov ebp, 0x486389
sub ebx, ebp
push ebx
mov ebp, 0x486389
push ebp
push 0
call fcn.004121c0
push 0
call fcn.00411d70
jmp 0x402d6c
call fcn.00415030
push eax
mov edx, dword [0x4974ec]
call fcn.00415030
push eax
call fcn.00415100
mov edx, str.help.txt
call fcn.00415100
call fcn.00415160
push 0
call fcn.004151a2
add dword [esp + 4], edx
call fcn.00411f90
call fcn.004151c0
and eax, eax
je 0x402dd9
mov ebp, 0x4857c3
mov ebx, ebp
mov ebp, 0x4840e2
sub ebx, ebp
push ebx
mov ebp, 0x4840e2
push ebp
push 0
call fcn.004121c0
push 0
call fcn.00411d70
jmp 0x402de8
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040d8f5
push str.CH_Trainer_Keys.dat
push 0
call fcn.00412110
mov dword [0x497410], eax
mov ebx, dword [0x497410]
and ebx, ebx
jle 0x402e1a
mov dword [0x49751c], 1
push 0
call fcn.00411d70
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
and eax, eax
je 0x402e2f
jmp 0x402e5e
push dword [0x4974bc]
call fcn.00409791
mov ebx, eax
and ebx, ebx
jne 0x402e5e
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040d8c6
jmp 0x4093f2
call fcn.00415030
push eax
push eax
call fcn.00411ac4
mov edx, str.black.txt
call fcn.00415100
push 0x497520
call fcn.00415070
mov ebx, dword [0x497524]
and ebx, ebx
jle 0x402f40
call fcn.00415030
push eax
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.00415100
call fcn.00415030
push eax
push eax
mov eax, dword [0x4974bc]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.0040b670
pop eax
mov edx, str..zip
call fcn.00415100
push 0x497528
call fcn.00415070
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x49752c]
call fcn.0040b008
mov edx, dword [0x497528]
call fcn.00415030
push eax
call fcn.00415100
push 0x497530
call fcn.00415070
mov edx, dword [0x49752c]
call fcn.00415030
push eax
call fcn.00415100
push 0x497534
call fcn.00415070
push 0
push 0
mov eax, dword [0x497520]
push eax
mov eax, dword [0x497534]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x497538], eax
call fcn.00415030
push eax
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.00415100
call fcn.00415030
push eax
push eax
mov eax, dword [0x4974bc]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.0040b670
pop eax
mov edx, str..zip
call fcn.00415100
push 0x497528
call fcn.00415070
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x49752c]
call fcn.0040b008
mov edx, dword [0x497528]
call fcn.00415030
push eax
call fcn.00415100
push 0x497530
call fcn.00415070
mov edx, dword [0x49752c]
call fcn.00415030
push eax
call fcn.00415100
push 0x497534
call fcn.00415070
push 0
push 0
mov eax, dword [0x497520]
push eax
mov eax, dword [0x497534]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x497538], eax
mov ebx, dword [0x497538]
and ebx, ebx
jne 0x403000
jmp 0x40302f
push dword [0x4974bc]
call fcn.00409791
mov ebx, eax
and ebx, ebx
jne 0x40302f
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040d8c6
jmp 0x4093f2
push 0
push 0
mov eax, dword [0x497520]
push eax
mov eax, dword [0x497530]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x49753c], eax
call fcn.00415030
push eax
push eax
push 0x4500a7
push str.IZnvZalZidZ_ZTraiZnerZ_UsZerZ
call fcn.0040b9d0
push 0x497540
call fcn.00415070
mov ebx, dword [0x49753c]
and ebx, ebx
jne 0x403083
call fcn.00408220
call fcn.00415030
push eax
push eax
push str.ZTSA.l
push dword [0x497540]
call fcn.0040b9d0
push 0x497540
call fcn.00415070
mov ebx, dword [0x49753c]
and ebx, ebx
jne 0x4031fe
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004130ff
and eax, eax
je 0x4031f4
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 1
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040dfb0
push eax
push dword [0x497540]
push 0
push 0
call fcn.00412bb7
call fcn.00412b40
push 0
push 0x64
push 0x1f4
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0
call fcn.00412ba0
push 0xff
push 0x28
push 0x28
mov eax, 0xff
call fcn.0040dfb0
push eax
push 0x24
push 0x1df
push 1
push 0
call fcn.00412c3b
push 0x11
call fcn.00412ba0
push 0x64
push 0x1f4
push 0xa
push 0xc8
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0xff
push 0
call fcn.004130e3
push eax
push 0
call fcn.00410273
push eax
call fcn.00409444
call fcn.0040755f
jmp 0x4030a4
mov ebx, dword [0x497538]
and ebx, ebx
je 0x403220
push dword [0x4974bc]
call fcn.00409791
mov ebx, eax
and ebx, ebx
jne 0x403220
mov eax, 1
jmp 0x403222
xor eax, eax
and eax, eax
je 0x403230
mov dword [0x4974c4], 0
mov dword [0x497544], 3
lea ebp, [0x497848]
lea eax, [ebp]
push eax
call sub.USER32.DLL_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x497548]
mov ebx, dword [0x497548]
cmp ebx, 1
jne 0x403274
mov edx, str.Run_game_and_press_F1_at_main_menu.__Numlock_is_ON.
lea ecx, [0x49754c]
call fcn.0040b008
jmp 0x403284
mov edx, 0x45022e
lea ecx, [0x49754c]
call fcn.0040b008
mov ebx, dword [0x497544]
cmp ebx, dword [0x497548]
je 0x4033e2
mov eax, dword [0x497548]
mov dword [0x497544], eax
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004130ff
and eax, eax
je 0x4033e2
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 1
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dfb0
push eax
push dword [0x49754c]
push 0
push 0
call fcn.00412bb7
call fcn.00412b40
push 0
push 0x64
push 0x1f4
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0
call fcn.00412ba0
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040dfb0
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00412c3b
push 0x11
call fcn.00412ba0
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0xff
push 0
call fcn.004130e3
push eax
push 0
call fcn.00410273
push eax
call fcn.00409444
call fcn.0040755f
push 0xa
call fcn.0040dfc9
push 0x70
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 0x8000
and ebx, ebx
je 0x40323a
mov edx, str.DarkSoulsII.exe
lea ecx, [0x49745c]
call fcn.0040b008
call fcn.0040692d
mov ebx, dword [0x497460]
and ebx, ebx
jne 0x40359c
push 4
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
push 0x12c
call fcn.0040dfc9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004130ff
and eax, eax
je 0x40358d
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 1
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dfb0
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.00412bb7
call fcn.00412b40
push 0
push 0x64
push 0x1f4
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0
call fcn.00412ba0
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040dfb0
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00412c3b
push 0x11
call fcn.00412ba0
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0xff
push 0
call fcn.004130e3
push eax
push 0
call fcn.00410273
push eax
call fcn.00409444
push 0x7d0
call fcn.0040dfc9
jmp 0x4031fe
mov edx, str.CH.dll
lea ecx, [0x497550]
call fcn.0040b008
mov edx, dword [0x4974ec]
call fcn.00415030
push eax
call fcn.00415100
mov edx, dword [0x497550]
call fcn.00415100
push 0x497474
call fcn.00415070
call fcn.00406972
mov edx, str.xlive.dll
lea ecx, [0x497554]
call fcn.0040b008
call fcn.0040692d
call fcn.0040745c
call fcn.0040755f
mov ebx, dword [0x497510]
and ebx, ebx
jne 0x403758
mov ebx, dword [0x497558]
and ebx, ebx
jne 0x403758
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004130ff
and eax, eax
je 0x403753
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 1
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dfb0
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.00412bb7
call fcn.00412b40
push 0
push 0x64
push 0x1f4
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0
call fcn.00412ba0
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040dfb0
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00412c3b
push 0x11
call fcn.00412ba0
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0xff
push 0
call fcn.004130e3
push eax
push 0
call fcn.00410273
push eax
call fcn.00409444
jmp 0x4031fe
mov ebx, dword [0x49749c]
cmp ebx, dword [0x4974a4]
jne 0x40377c
mov ebx, dword [0x49749c]
and ebx, ebx
je 0x40377c
mov ebx, dword [0x4974a4]
and ebx, ebx
je 0x40377c
jmp 0x403783
mov eax, 1
jmp 0x403785
xor eax, eax
and eax, eax
je 0x4037dc
push 0xa
call fcn.0040e087
mov ebx, eax
add ebx, 0xa
mov dword [0x49755c], ebx
push 0x28
call fcn.0040e087
mov ebx, eax
add ebx, 0x28
mov dword [0x497560], ebx
mov ebx, dword [0x497510]
add ebx, dword [0x49755c]
mov dword [0x497510], ebx
mov ebx, dword [0x497558]
add ebx, dword [0x497560]
mov dword [0x497558], ebx
call fcn.00408220
push 3
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004130ff
and eax, eax
je 0x403931
push 1
call fcn.00412fad
push eax
call fcn.00412aad
push 1
call fcn.00411aa8
push eax
call fcn.00412b89
push 0x11
call fcn.00412ba0
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dfb0
push eax
push str.Game_found__Trainer_Activated_
push 0
push 0
call fcn.00412bb7
call fcn.00412b40
push 0
push 0x64
push 0x1f4
push 1
call fcn.00413215
push 0
call fcn.00412fad
push eax
call fcn.00412aad
push 0
call fcn.00412ba0
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040dfb0
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00412c3b
push 0x11
call fcn.00412ba0
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.004130e3
push eax
call fcn.00412c09
call fcn.00412b40
push 1
call fcn.00412c78
push 0xff
push 0
call fcn.004130e3
push eax
push 0
call fcn.00410273
push eax
call fcn.00409444
mov ebx, dword [0x497564]
and ebx, ebx
je 0x403c3f
push 0x8b
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xff
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x55
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x8b
mov ebx, dword [0x497470]
add ebx, 3
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xec
mov ebx, dword [0x497470]
add ebx, 4
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x83
mov ebx, dword [0x497470]
add ebx, 5
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xec
mov ebx, dword [0x497470]
add ebx, 6
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x20
mov ebx, dword [0x497470]
add ebx, 7
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x53
mov ebx, dword [0x497470]
add ebx, 8
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x56
mov ebx, dword [0x497470]
add ebx, 9
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x57
mov ebx, dword [0x497470]
add ebx, 0xa
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x8d
mov ebx, dword [0x497470]
add ebx, 0xb
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x45
mov ebx, dword [0x497470]
add ebx, 0xc
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xe0
mov ebx, dword [0x497470]
add ebx, 0xd
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x33
mov ebx, dword [0x497470]
add ebx, 0xe
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xf6
mov ebx, dword [0x497470]
add ebx, 0xf
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x50
mov ebx, dword [0x497470]
add ebx, 0x10
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xff
mov ebx, dword [0x497470]
add ebx, 0x11
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x75
mov ebx, dword [0x497470]
add ebx, 0x12
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xc
mov ebx, dword [0x497470]
add ebx, 0x13
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
mov ebx, dword [0x497564]
add ebx, 0x1000
mov dword [0x49744c], ebx
mov ebx, dword [0x497564]
add ebx, 0x200000
cmp ebx, dword [0x49744c]
jl 0x403c3f
push dword [0x49746c]
push 0x14
push dword [0x4974c8]
push dword [0x49744c]
push dword [0x497568]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x497410], eax
push 0x14
push dword [0x4974c8]
push dword [0x497470]
call fcn.004144e0
mov dword [0x497410], eax
mov ebx, dword [0x497410]
cmp ebx, 1
jne 0x403c33
mov eax, dword [0x49744c]
mov dword [0x49756c], eax
push 0xc2
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xc
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 3
push dword [0x497470]
push dword [0x49756c]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
inc dword [0x49744c]
jno 0x403b54
mov ebx, dword [0x497524]
and ebx, ebx
jle 0x403c4e
jmp 0x404cac
mov ebx, dword [0x4974c4]
cmp ebx, 0x45a2a5
jne 0x403d37
mov ebp, dword [0x497b7c]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0x64
mov dword [ebp + 0x14], 0x65
mov dword [ebp + 0x18], 0x66
mov dword [ebp + 0x1c], 0x67
mov dword [ebp + 0x20], 0x68
mov dword [ebp + 0x24], 0x69
mov dword [ebp + 0x28], 0x60
mov dword [ebp + 0x2c], 0x6a
mov dword [ebp + 0x30], 0x6f
mov dword [ebp + 0x34], 0x6d
mov dword [ebp + 0x38], 0x6b
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x50], 0
mov dword [0x49744c], 1
mov eax, 0x14
cmp eax, dword [0x49744c]
jl 0x403d37
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b9c]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x49744c]
jno 0x403cfc
push str.CH_Trainer_Keys.dat
push 0
call fcn.00412110
mov dword [0x497410], eax
mov ebx, dword [0x497410]
and ebx, ebx
jle 0x403ea1
mov dword [0x49751c], 1
push 0
call fcn.00412520
mov dword [0x497570], eax
mov dword [0x49744c], 1
mov eax, dword [0x497570]
cmp eax, dword [0x49744c]
jl 0x403e97
call fcn.00415030
push eax
push eax
push 0
call fcn.00412220
push 0x497574
call fcn.00415070
push dword [0x497574]
mov edx, 0x4501e4
pop ecx
call fcn.00415210
je 0x403dd2
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b84]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x497574]
mov edx, str.CTRL
pop ecx
call fcn.00415210
je 0x403dfc
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b8c]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x497574]
mov edx, 0x450340
pop ecx
call fcn.00415210
je 0x403e26
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b94]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.00412520
push eax
mov ebx, dword [0x49744c]
mov ebp, dword [0x497b7c]
shl ebx, 2
pop dword [ebp + ebx]
call fcn.00415030
push eax
push eax
call fcn.00415030
push eax
push 1
mov ebx, dword [0x49744c]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.0040b2e0
call fcn.004151a2
add dword [esp], edx
call fcn.0040b390
call fcn.004151c0
push eax
mov ebx, dword [0x49744c]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x49744c]
jno 0x403d7c
push 0
call fcn.00411d70
mov dword [0x497578], 0x400000
mov ebx, dword [0x497510]
sub ebx, dword [0x497578]
add ebx, 0x733663
mov dword [0x49757c], ebx
mov ebx, dword [0x497510]
sub ebx, dword [0x497578]
add ebx, 0x5f41a2
mov dword [0x497580], ebx
mov ebx, dword [0x497510]
sub ebx, dword [0x497578]
add ebx, 0x5f64b2
mov dword [0x497584], ebx
mov ebx, dword [0x497510]
sub ebx, dword [0x497578]
add ebx, 0x5ef429
mov dword [0x497588], ebx
mov ebx, dword [0x497510]
sub ebx, dword [0x497578]
add ebx, 0x736ce4
mov dword [0x49758c], ebx
mov ebx, dword [0x497510]
sub ebx, dword [0x497578]
add ebx, 0x664ba0
mov dword [0x497590], ebx
mov ebx, dword [0x497510]
sub ebx, dword [0x497578]
add ebx, 0x5bb661
mov dword [0x497594], ebx
mov ebx, dword [0x497510]
sub ebx, dword [0x497578]
add ebx, 0x5f941e
mov dword [0x497598], ebx
push 0x89
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x15
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x3f
mov ebx, dword [0x497470]
add ebx, 3
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x1d
mov ebx, dword [0x497470]
add ebx, 4
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xe
mov ebx, dword [0x497470]
add ebx, 5
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x83
mov ebx, dword [0x497470]
add ebx, 6
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x3d
mov ebx, dword [0x497470]
add ebx, 7
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 4
mov ebx, dword [0x497470]
add ebx, 8
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x3f
mov ebx, dword [0x497470]
add ebx, 9
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x1d
mov ebx, dword [0x497470]
add ebx, 0xa
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xe
mov ebx, dword [0x497470]
add ebx, 0xb
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 1
mov ebx, dword [0x497470]
add ebx, 0xc
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x75
mov ebx, dword [0x497470]
add ebx, 0xd
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xc
mov ebx, dword [0x497470]
add ebx, 0xe
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x8b
mov ebx, dword [0x497470]
add ebx, 0xf
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x82
mov ebx, dword [0x497470]
add ebx, 0x10
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 4
mov ebx, dword [0x497470]
add ebx, 0x11
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 1
mov ebx, dword [0x497470]
add ebx, 0x12
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x13
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x14
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x89
mov ebx, dword [0x497470]
add ebx, 0x15
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x82
mov ebx, dword [0x497470]
add ebx, 0x16
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xfc
mov ebx, dword [0x497470]
add ebx, 0x17
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x18
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x19
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x1a
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x83
mov ebx, dword [0x497470]
add ebx, 0x1b
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x3d
mov ebx, dword [0x497470]
add ebx, 0x1c
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 8
mov ebx, dword [0x497470]
add ebx, 0x1d
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x3f
mov ebx, dword [0x497470]
add ebx, 0x1e
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x1d
mov ebx, dword [0x497470]
add ebx, 0x1f
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xe
mov ebx, dword [0x497470]
add ebx, 0x20
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 1
mov ebx, dword [0x497470]
add ebx, 0x21
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x75
mov ebx, dword [0x497470]
add ebx, 0x22
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xc
mov ebx, dword [0x497470]
add ebx, 0x23
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x8b
mov ebx, dword [0x497470]
add ebx, 0x24
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x82
mov ebx, dword [0x497470]
add ebx, 0x25
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x48
mov ebx, dword [0x497470]
add ebx, 0x26
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 1
mov ebx, dword [0x497470]
add ebx, 0x27
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x28
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x29
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x89
mov ebx, dword [0x497470]
add ebx, 0x2a
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x82
mov ebx, dword [0x497470]
add ebx, 0x2b
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x40
mov ebx, dword [0x497470]
add ebx, 0x2c
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 1
mov ebx, dword [0x497470]
add ebx, 0x2d
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x2e
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x2f
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x8b
mov ebx, dword [0x497470]
add ebx, 0x30
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x82
mov ebx, dword [0x497470]
add ebx, 0x31
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xfc
mov ebx, dword [0x497470]
add ebx, 0x32
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x33
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x34
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x35
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xc3
mov ebx, dword [0x497470]
add ebx, 0x36
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 0x37
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x38
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x39
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x3a
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x3b
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x3c
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x3d
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x3e
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x3f
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x89
mov ebx, dword [0x497470]
add ebx, 0x40
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x8e
mov ebx, dword [0x497470]
add ebx, 0x41
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xfc
mov ebx, dword [0x497470]
add ebx, 0x42
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x43
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x44
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x45
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x39
mov ebx, dword [0x497470]
add ebx, 0x46
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x35
mov ebx, dword [0x497470]
add ebx, 0x47
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x48
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x3f
mov ebx, dword [0x497470]
add ebx, 0x49
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x1d
mov ebx, dword [0x497470]
add ebx, 0x4a
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xe
mov ebx, dword [0x497470]
add ebx, 0x4b
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x74
mov ebx, dword [0x497470]
add ebx, 0x4c
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x13
mov ebx, dword [0x497470]
add ebx, 0x4d
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x83
mov ebx, dword [0x497470]
add ebx, 0x4e
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x3d
mov ebx, dword [0x497470]
add ebx, 0x4f
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xc
mov ebx, dword [0x497470]
add ebx, 0x50
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x3f
mov ebx, dword [0x497470]
add ebx, 0x51
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x1d
mov ebx, dword [0x497470]
add ebx, 0x52
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xe
mov ebx, dword [0x497470]
add ebx, 0x53
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 1
mov ebx, dword [0x497470]
add ebx, 0x54
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x75
mov ebx, dword [0x497470]
add ebx, 0x55
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xa
mov ebx, dword [0x497470]
add ebx, 0x56
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xc7
mov ebx, dword [0x497470]
add ebx, 0x57
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x86
mov ebx, dword [0x497470]
add ebx, 0x58
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xfc
mov ebx, dword [0x497470]
add ebx, 0x59
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x5a
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x5b
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0
mov ebx, dword [0x497470]
add ebx, 0x5c
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xff
mov ebx, dword [0x497470]
add ebx, 0x5d
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xff
mov ebx, dword [0x497470]
add ebx, 0x5e
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xff
mov ebx, dword [0x497470]
add ebx, 0x5f
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xff
mov ebx, dword [0x497470]
add ebx, 0x60
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xc3
mov ebx, dword [0x497470]
add ebx, 0x61
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 0x2ac
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x1091
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
mov ebx, dword [0x497558]
add ebx, 0x3f00
push ebx
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x1093
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x10d9
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
mov ebx, dword [0x497558]
add ebx, 0x3f04
push ebx
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x1099
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
mov ebx, dword [0x497558]
add ebx, 0x3f08
push ebx
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x10ae
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
mov ebx, dword [0x497558]
add ebx, 0x3f0c
push ebx
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x10e1
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0xe8
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 3
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 4
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 5
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
mov ebx, dword [0x497558]
add ebx, 0x1091
sub ebx, dword [0x49757c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 6
push dword [0x497470]
push dword [0x49757c]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0xe8
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 3
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 4
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 5
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
mov ebx, dword [0x497558]
add ebx, 0x10d1
sub ebx, dword [0x497594]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 6
push dword [0x497470]
push dword [0x497594]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
mov dword [0x49759c], 0
mov eax, 0xff
cmp eax, dword [0x49759c]
jl 0x404cd6
push dword [0x49759c]
call sub.USER32.DLL_GetAsyncKeyState
inc dword [0x49759c]
jno 0x404cb6
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x404ce5
push 0x55009553
ret
push 0x32
call fcn.0040e087
mov dword [0x4975a0], eax
mov ebx, dword [0x4975a0]
cmp ebx, 0x19
jne 0x404da0
mov ebx, dword [0x49749c]
cmp ebx, dword [0x4974a4]
jne 0x404d27
mov ebx, dword [0x49749c]
and ebx, ebx
je 0x404d27
mov ebx, dword [0x4974a4]
and ebx, ebx
je 0x404d27
jmp 0x404d2e
mov eax, 1
jmp 0x404d30
xor eax, eax
and eax, eax
je 0x404da0
push 0xff
call fcn.0040e087
mov dword [0x49755c], eax
push 0x190
call fcn.0040e087
mov dword [0x497560], eax
push dword [0x49755c]
mov eax, dword [0x497470]
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 1
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, dword [0x497560]
add ebx, 0x1091
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
call fcn.00408220
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x3f00
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x497410], eax
mov eax, dword [0x497470]
call fcn.00414570
mov dword [0x4975a4], eax
mov ebx, dword [0x4975a4]
add ebx, 0x378
mov dword [0x4975a8], ebx
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975a8]
push dword [0x497568]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x497410], eax
mov eax, dword [0x497470]
call fcn.00414570
mov dword [0x4975a4], eax
mov ebx, dword [0x4975a4]
add ebx, 0xe8
mov dword [0x4975ac], ebx
mov ebx, dword [0x4975a4]
add ebx, 0xf0
mov dword [0x4975b0], ebx
mov ebx, dword [0x4975a4]
add ebx, 0xf8
mov dword [0x4975b4], ebx
mov ebx, dword [0x4975a4]
add ebx, 0xcc
mov dword [0x4975b8], ebx
mov ebx, dword [0x4975a4]
add ebx, 4
mov dword [0x4975bc], ebx
mov ebx, dword [0x4975a4]
add ebx, 6
mov dword [0x4975c0], ebx
mov ebx, dword [0x4975a4]
add ebx, 8
mov dword [0x4975c4], ebx
mov ebx, dword [0x4975a4]
add ebx, 0xa
mov dword [0x4975c8], ebx
mov ebx, dword [0x4975a4]
add ebx, 0xc
mov dword [0x4975cc], ebx
mov ebx, dword [0x4975a4]
add ebx, 0xe
mov dword [0x4975d0], ebx
mov ebx, dword [0x4975a4]
add ebx, 0x10
mov dword [0x4975d4], ebx
mov ebx, dword [0x4975a4]
add ebx, 0x12
mov dword [0x4975d8], ebx
mov ebx, dword [0x4975a4]
add ebx, 0x14
mov dword [0x4975dc], ebx
mov dword [0x4975e0], 1
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x4975e4], eax
mov ebx, dword [0x4975e4]
and ebx, ebx
je 0x40503c
push dword [0x4975e8]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x404fd1
mov dword [0x4975e8], 1
push 1
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x3f04
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
jmp 0x40503b
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40503b
mov dword [0x4975e8], 0
push 0
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x3f04
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 1
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
pop eax
mov dword [0x4975e0], 2
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x4975ec], eax
mov ebx, dword [0x4975ec]
and ebx, ebx
je 0x405184
push dword [0x4975f0]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x405119
mov dword [0x4975f0], 1
push 1
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x3f08
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
jmp 0x405183
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405183
mov dword [0x4975f0], 0
push 0
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x3f08
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 1
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
pop eax
mov dword [0x4975e0], 3
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x4975f4], eax
mov ebx, dword [0x4975f4]
and ebx, ebx
je 0x4052cc
push dword [0x4975f8]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x405261
mov dword [0x4975f8], 1
push 1
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x3f0c
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
jmp 0x4052cb
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4052cb
mov dword [0x4975f8], 0
push 0
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
mov ebx, dword [0x497558]
add ebx, 0x3f0c
push ebx
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 1
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
pop eax
mov dword [0x4975e0], 4
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x4975fc], eax
mov ebx, dword [0x4975fc]
and ebx, ebx
je 0x4055c3
push dword [0x497600]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x405482
mov dword [0x497600], 1
push 0x90
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 3
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x497580]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 3
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x497584]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
jmp 0x4055c2
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4055c2
mov dword [0x497600], 0
push 0x66
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x29
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x5e
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x18
mov ebx, dword [0x497470]
add ebx, 3
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x497580]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0x66
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x29
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x5e
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x18
mov ebx, dword [0x497470]
add ebx, 3
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x497584]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 1
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
pop eax
mov dword [0x4975e0], 5
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497604], eax
mov ebx, dword [0x497604]
and ebx, ebx
je 0x405772
push dword [0x497608]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4056d5
mov dword [0x497608], 1
push 0x90
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x90
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 3
push dword [0x497470]
push dword [0x497588]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
jmp 0x405771
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405771
mov dword [0x497608], 0
push 0x88
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x43
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x18
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 3
push dword [0x497470]
push dword [0x497588]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 1
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
pop eax
mov dword [0x4975e0], 6
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x49760c], eax
mov ebx, dword [0x49760c]
and ebx, ebx
je 0x4058e2
push dword [0x497610]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x405863
mov dword [0x497610], 1
push 0xeb
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x69
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 2
push dword [0x497470]
push dword [0x49758c]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
jmp 0x4058e1
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4058e1
mov dword [0x497610], 0
push 0x74
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x69
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 2
push dword [0x497470]
push dword [0x49758c]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 1
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
pop eax
mov dword [0x4975e0], 7
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497614], eax
mov ebx, dword [0x497614]
and ebx, ebx
je 0x405a52
push dword [0x497618]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4059d3
mov dword [0x497618], 1
push 0xeb
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x29
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 2
push dword [0x497470]
push dword [0x497590]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
jmp 0x405a51
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405a51
mov dword [0x497618], 0
push 0x74
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x29
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 2
push dword [0x497470]
push dword [0x497590]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 1
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
pop eax
mov dword [0x4975e0], 8
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x49761c], eax
mov ebx, dword [0x49761c]
and ebx, ebx
je 0x405b50
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975ac]
push dword [0x497568]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x497410], eax
mov eax, dword [0x497470]
call fcn.00414570
mov dword [0x497620], eax
add dword [0x497620], 0x2710
push dword [0x497620]
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975ac]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
mov dword [0x4975e0], 9
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497624], eax
mov ebx, dword [0x497624]
and ebx, ebx
je 0x405c75
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975b0]
push dword [0x497568]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x497410], eax
mov eax, dword [0x497470]
call fcn.00414570
mov dword [0x497620], eax
add dword [0x497620], 0x2710
push dword [0x497620]
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975b0]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975b4]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
mov dword [0x4975e0], 0xa
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497628], eax
mov ebx, dword [0x497628]
and ebx, ebx
je 0x405d2e
push 1
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975b8]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
mov dword [0x4975e0], 0xb
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x49762c], eax
mov ebx, dword [0x49762c]
and ebx, ebx
je 0x405f23
push 0x62
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975bc]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975c0]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975c4]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975c8]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975cc]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975d0]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975d4]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975d8]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975dc]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
mov dword [0x4975e0], 0xc
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497630], eax
mov ebx, dword [0x497630]
and ebx, ebx
je 0x406118
push 5
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975bc]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975c0]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975c4]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975c8]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975cc]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975d0]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975d4]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975d8]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975dc]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
mov dword [0x4975e0], 0xd
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497634], eax
mov ebx, dword [0x497634]
and ebx, ebx
je 0x4062fb
push dword [0x497638]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406244
mov dword [0x497638], 1
push 0xf2
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xf
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x58
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xc0
mov ebx, dword [0x497470]
add ebx, 3
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x497598]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
jmp 0x4062fa
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4062fa
mov dword [0x497638], 0
push 0xf2
mov ebx, dword [0x497470]
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xf
mov ebx, dword [0x497470]
inc ebx
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0x5c
mov ebx, dword [0x497470]
add ebx, 2
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push 0xc1
mov ebx, dword [0x497470]
add ebx, 3
mov eax, ebx
call fcn.004144d0
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x497598]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 1
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
pop eax
mov dword [0x4975e0], 0xe
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x49763c], eax
mov ebx, dword [0x49763c]
and ebx, ebx
je 0x4063b4
push 0
mov eax, dword [0x497470]
call fcn.00414560
mov dword [0x497410], eax
push dword [0x49746c]
push 4
push dword [0x497470]
push dword [0x4975b0]
push dword [0x497568]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x497410], eax
push 0
call fcn.0040cff4
push 0x12c
call fcn.0040dfc9
mov dword [0x4975e0], 0xf
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497640], eax
mov ebx, dword [0x497640]
and ebx, ebx
je 0x40641e
mov dword [0x4975e0], 0x10
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497644], eax
mov ebx, dword [0x497644]
and ebx, ebx
je 0x406488
mov dword [0x4975e0], 0x11
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497648], eax
mov ebx, dword [0x497648]
and ebx, ebx
je 0x4064f2
mov dword [0x4975e0], 0x12
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x49764c], eax
mov ebx, dword [0x49764c]
and ebx, ebx
je 0x40655c
mov dword [0x4975e0], 0x13
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497650], eax
mov ebx, dword [0x497650]
and ebx, ebx
je 0x4065c6
mov dword [0x4975e0], 0x14
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b94]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b8c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b84]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4975e0]
mov ebp, dword [0x497b7c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409b34
mov dword [0x497654], eax
mov ebx, dword [0x497654]
and ebx, ebx
je 0x406630
mov dword [0x4975e4], 0
mov dword [0x4975ec], 0
mov dword [0x4975f4], 0
mov dword [0x4975fc], 0
mov dword [0x497604], 0
mov dword [0x49760c], 0
mov dword [0x497614], 0
mov dword [0x49761c], 0
mov dword [0x497624], 0
mov dword [0x497628], 0
mov dword [0x49762c], 0
mov dword [0x497630], 0
mov dword [0x497634], 0
mov dword [0x49763c], 0
mov dword [0x497640], 0
mov dword [0x497644], 0
mov dword [0x497648], 0
mov dword [0x49764c], 0
mov dword [0x497650], 0
mov dword [0x497654], 0
mov ebx, dword [0x4974c4]
cmp ebx, 0x45a2a5
je 0x406715
push 0
push 3
call fcn.0040fa63
call fcn.0040755f
push 1
call fcn.0040dfc9
mov ebx, dword [0x49749c]
cmp ebx, dword [0x4974a4]
jne 0x406748
mov ebx, dword [0x49749c]
and ebx, ebx
je 0x406748
mov ebx, dword [0x4974a4]
and ebx, ebx
je 0x406748
jmp 0x40674f
mov eax, 1
jmp 0x406751
xor eax, eax
and eax, eax
je 0x4067ad
push 0xa
call fcn.0040e087
mov ebx, eax
add ebx, 0xa
mov dword [0x49755c], ebx
push 0x28
call fcn.0040e087
mov ebx, eax
add ebx, 0x28
mov dword [0x497560], ebx
mov ebx, dword [0x497510]
add ebx, dword [0x49755c]
mov dword [0x497510], ebx
mov ebx, dword [0x497558]
add ebx, dword [0x497560]
mov dword [0x497558], ebx
call fcn.00408220
jmp 0x403ea1
jmp 0x404cac
push 0
call 0x409411
call fcn.00415010
push dword [0x497400]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040d0fb
call fcn.0040e239
call fcn.0040e829
call fcn.0040fe70
call fcn.004119a4
call fcn.00411bdb
call fcn.00411de0
call fcn.00412cd0
call fcn.00413967
call fcn.00414490
ret