Function at 0x401000
Capabilities:
Authenticate hmac
Check for time delay via gettickcount
Check internet connectivity via wininet
Download url
Log keystrokes via polling
Parse pe header
Receive data
Resolve function by parsing pe exports

Disassembly:
push 0x2ec
push 0
push 0x535b48
call sub.CRTDLL.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x535b4c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x535b48], eax
call fcn.004137a8
call fcn.00412f0b
call fcn.00411846
call fcn.00410f17
call fcn.00410eb4
call fcn.004107a7
call fcn.00407e12
call fcn.00407d00
call fcn.004076d0
call fcn.00407570
call fcn.00406aef
call fcn.00413820
call fcn.00408439
call fcn.00406c50
mov dword [0x535cb8], eax
mov ebp, str.RIFFp
push ebp
push 0
call fcn.004070e0
mov ebp, 0x482b0c
push ebp
push 1
call fcn.004070e0
mov ebp, str.RIFF
push ebp
push 3
call fcn.004070e0
mov ebp, str.RIFF__f
push ebp
push 4
call fcn.004070e0
mov ebp, str.RIFF__
push ebp
push 5
call fcn.004070e0
mov ebp, str.RIFF_f_
push ebp
push 6
call fcn.004070e0
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4010fa
push 0x75009553
inc ecx
ret
call sub.KERNEL32.dll_GetTickCount
mov dword [0x535b7c], eax
push dword [0x536554]
call fcn.004076f0
sub esp, 4
lea ecx, [0x535ba4]
pop edx
call fcn.00406000
push dword [0x536554]
push dword [0x535ba4]
call fcn.00407c90
sub esp, 4
lea ecx, [0x535ba4]
pop edx
call fcn.00406000
mov edx, 0x416073
lea ecx, [0x535b60]
call fcn.00406010
mov edx, 0x416073
lea ecx, [0x535b70]
call fcn.00406010
mov edx, 0x416073
lea ecx, [0x535b90]
call fcn.00406010
mov dword [0x535c64], 0
push dword [0x536554]
push dword [0x536554]
call fcn.004076f0
sub esp, 4
inc dword [0x536554]
push 0
mov edx, dword [0x532ecc]
add dword [esp + 4], edx
call fcn.0041305c
pop dword [0x536554]
push 0
call fcn.00413090
mov dword [0x535bb8], eax
mov dword [0x535c1c], 1
mov ebx, dword [0x535bb8]
add ebx, 0xfffffffc
cmp ebx, dword [0x535c1c]
jl 0x4011ed
push 0
call fcn.00413120
mov dword [0x535b5c], eax
inc dword [0x535c1c]
jmp 0x4011c5
push 0
call fcn.00413170
mov dword [0x535ba8], eax
push 0
call fcn.00412e87
push dword [0x535ba4]
push 0
call fcn.0041305c
mov ebx, eax
and ebx, ebx
jle 0x4015b7
mov dword [0x535c1c], 1
mov eax, 0x3b8
cmp eax, dword [0x535c1c]
jl 0x40124e
push 0
call fcn.00413120
mov dword [0x535b5c], eax
inc dword [0x535c1c]
jmp 0x40122a
mov dword [0x535c1c], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x535c1c]
jl 0x4012f5
push 0
call fcn.00413120
mov dword [0x535b5c], eax
push dword [0x536554]
push dword [0x536554]
push 0
mov eax, dword [0x535b5c]
cdq
push edx
push eax
call fcn.004065f0
sub esp, 4
inc dword [0x536554]
mov edx, dword [0x532ecc]
add dword [esp], edx
call fcn.004060e0
pop dword [0x536554]
mov dword [0x535b5c], eax
mov edx, dword [0x535b60]
push dword [0x536554]
call fcn.00413870
push dword [0x536554]
push dword [0x535b5c]
call fcn.00406150
sub esp, 4
pop eax
lea ecx, [0x535b60]
pop edx
call fcn.00406000
inc dword [0x535c1c]
jmp 0x401258
push dword [0x535b60]
call fcn.00404d52
mov dword [0x535b5c], eax
mov ebx, dword [0x535b5c]
xor ebx, 0x98989898
mov dword [0x535b5c], ebx
push dword [0x535b5c]
pop dword [0x535ce0]
push dword [0x536554]
push 0xa
push dword [0x536554]
mov edx, 0x416087
call fcn.00413870
push dword [0x536554]
push dword [0x535b5c]
call fcn.00406170
sub esp, 4
pop eax
inc dword [0x536554]
mov edx, dword [0x532ecc]
add dword [esp], edx
call fcn.00406260
sub esp, 4
lea ecx, [0x535b60]
pop edx
call fcn.00406000
mov dword [0x535c1c], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x535c1c]
jl 0x40141d
push 0
call fcn.00413120
mov dword [0x535b5c], eax
push dword [0x536554]
push dword [0x536554]
push 0
mov eax, dword [0x535b5c]
cdq
push edx
push eax
call fcn.004065f0
sub esp, 4
inc dword [0x536554]
mov edx, dword [0x532ecc]
add dword [esp], edx
call fcn.004060e0
pop dword [0x536554]
mov dword [0x535b5c], eax
mov edx, dword [0x535b70]
push dword [0x536554]
call fcn.00413870
push dword [0x536554]
push dword [0x535b5c]
call fcn.00406150
sub esp, 4
pop eax
lea ecx, [0x535b70]
pop edx
call fcn.00406000
inc dword [0x535c1c]
jmp 0x401380
push dword [0x535b70]
call fcn.00404d52
mov dword [0x535c6c], eax
mov dword [0x535c1c], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x535c1c]
jl 0x4014d4
push 0
call fcn.00413120
mov dword [0x535b5c], eax
push dword [0x536554]
push dword [0x536554]
push 0
mov eax, dword [0x535b5c]
cdq
push edx
push eax
call fcn.004065f0
sub esp, 4
inc dword [0x536554]
mov edx, dword [0x532ecc]
add dword [esp], edx
call fcn.004060e0
pop dword [0x536554]
mov dword [0x535b5c], eax
mov edx, dword [0x535b90]
push dword [0x536554]
call fcn.00413870
push dword [0x536554]
push dword [0x535b5c]
call fcn.00406150
sub esp, 4
pop eax
lea ecx, [0x535b90]
pop edx
call fcn.00406000
inc dword [0x535c1c]
jmp 0x401437
push dword [0x535b90]
call fcn.00404d52
mov dword [0x535b5c], eax
push dword [0x535b5c]
pop dword [0x535c68]
mov dword [0x535c1c], 0x3d1
mov ebx, dword [0x535c68]
dec ebx
cmp ebx, dword [0x535c1c]
jl 0x401520
push 0
call fcn.00413120
mov dword [0x535b5c], eax
inc dword [0x535c1c]
jmp 0x4014fa
push dword [0x535c68]
pop dword [0x535c1c]
mov ebx, dword [0x535c68]
add ebx, 0x12
cmp ebx, dword [0x535c1c]
jl 0x401566
push 0
call fcn.00413120
mov dword [0x535b5c], eax
mov ebx, dword [0x535c64]
add ebx, dword [0x535b5c]
mov dword [0x535c64], ebx
inc dword [0x535c1c]
jmp 0x40152c
mov ebx, dword [0x535c6c]
xor ebx, dword [0x535c64]
mov dword [0x535ce8], ebx
mov ebx, dword [0x535ce8]
and ebx, ebx
jne 0x40158c
mov dword [0x535ce8], 0x63
mov ebx, dword [0x535ce8]
xor ebx, 0x98989898
mov dword [0x535ce8], ebx
mov ebx, dword [0x535ce0]
cmp ebx, dword [0x535ce8]
jne 0x4015ae
jmp 0x4015b5
push 0x75009553
inc ecx
ret
jmp 0x4015be
push 0x25001876
inc eax
ret
mov ebx, dword [0x535ba8]
cmp ebx, dword [0x535bb8]
jne 0x4015ce
jmp 0x4015d5
push 0x10047665
inc eax
ret
call sub.KERNEL32.dll_GetTickCount
mov dword [0x535be4], eax
mov ebx, dword [0x535be4]
sub ebx, dword [0x535b7c]
cmp ebx, 0x3e8
jle 0x4015fa
push 0x9099542
inc eax
ret
push 5
push 0x535dfc
push 0
mov edx, dword [0x535dfc]
call fcn.00406018
mov eax, 0xd
push 4
call fcn.00539000
push 5
push 0x535e04
push 0
mov edx, dword [0x535e04]
call fcn.00406018
mov eax, 0xd
push 4
call fcn.00539000
push 5
push 0x535e0c
push 0
mov edx, dword [0x535e0c]
call fcn.00406018
mov eax, 0xd
push 4
call fcn.00539000
push 5
push 0x535e14
push 0
mov edx, dword [0x535e14]
call fcn.00406018
mov eax, 0xd
push 4
call fcn.00539000
push 5
push 0x535e1c
push 0
mov edx, dword [0x535e1c]
call fcn.00406018
mov eax, 0xd
push 4
call fcn.00539000
push 0x3e8
call fcn.00407d44
mov dword [0x535b80], eax
mov dword [0x535c1c], 1
mov eax, 0xc
cmp eax, dword [0x535c1c]
jl 0x40173a
mov ebx, dword [0x535c1c]
mov ebp, dword [0x535e04]
sal ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x535c1c]
mov ebp, dword [0x535e0c]
sal ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x535c1c]
mov ebp, dword [0x535e14]
sal ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x535c1c]
jmp 0x4016e0
mov edx, 0x416092
lea ecx, [0x535c00]
call fcn.00406010
push dword [0x536554]
call fcn.00412dc0
sub esp, 4
lea ecx, [0x535bd8]
pop edx
call fcn.00406000
push dword [0x536554]
mov edx, dword [0x535bd8]
push dword [0x536554]
call fcn.00413870
mov edx, str.CH.dll
call fcn.00413870
inc dword [0x536554]
push 0
mov edx, dword [0x532ecc]
add dword [esp + 4], edx
call fcn.0041302e
pop dword [0x536554]
and eax, eax
je 0x4017d4
mov ebp, 0x5325cc
mov ebx, ebp
mov ebp, 0x5319cc
sub ebx, ebp
push ebx
mov ebp, 0x5319cc
push ebp
push 0
call fcn.004131c0
push 0
call fcn.00412e87
jmp 0x4017d4
push dword [0x536554]
mov edx, dword [0x535bd8]
push dword [0x536554]
call fcn.00413870
mov edx, str.help.txt
call fcn.00413870
inc dword [0x536554]
push 0
mov edx, dword [0x532ecc]
add dword [esp + 4], edx
call fcn.0041302e
pop dword [0x536554]
and eax, eax
je 0x401844
mov ebp, 0x532ecb
mov ebx, ebp
mov ebp, 0x5325cc
sub ebx, ebp
push ebx
mov ebp, 0x5325cc
push ebp
push 0
call fcn.004131c0
push 0
call fcn.00412e87
jmp 0x401853
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.004075b1
push str.CH_Trainer_Keys.dat
push 0
call fcn.0041305c
mov dword [0x535cb8], eax
mov ebx, dword [0x535cb8]
and ebx, ebx
jle 0x401885
mov dword [0x535bd4], 1
push 2
call fcn.00412e87
mov eax, 0x12c
call fcn.00539050
call fcn.00404bc5
push str.Authenticating_Trainer......
push 0
push 8
call fcn.00406c33
push dword [0x535ce0]
pop dword [0x535ce4]
push 0
push 0
call sub.WININET.dll_InternetGetConnectedState
and eax, eax
je 0x4018c9
jmp 0x4018f5
push dword [0x535ce4]
call fcn.00404e40
mov ebx, eax
and ebx, ebx
jne 0x4018f5
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.00407580
push 0x9099542
inc eax
ret
push dword [0x536554]
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.00413870
push dword [0x536554]
mov ebx, dword [0x535ce4]
xor ebx, 0x7b3d89b
push ebx
call fcn.00406170
sub esp, 4
pop eax
mov edx, str..zip
call fcn.00413870
lea ecx, [0x535cec]
pop edx
call fcn.00406000
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x535cf0]
call fcn.00406010
mov edx, dword [0x535cec]
push dword [0x536554]
call fcn.00413870
lea ecx, [0x535cd8]
pop edx
call fcn.00406000
mov edx, dword [0x535cf0]
push dword [0x536554]
call fcn.00413870
lea ecx, [0x535cdc]
pop edx
call fcn.00406000
push 0
push 0
push 0
mov eax, dword [0x535cdc]
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov dword [0x535bb4], eax
mov ebx, dword [0x535bb4]
and ebx, ebx
jne 0x4019b1
jmp 0x4019dd
push dword [0x535ce4]
call fcn.00404e40
mov ebx, eax
and ebx, ebx
jne 0x4019dd
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.00407580
push 0x9099542
inc eax
ret
push 0
push 0
push 0
mov eax, dword [0x535cd8]
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov dword [0x535bb0], eax
mov ebx, dword [0x535bb0]
and ebx, ebx
jne 0x401a35
push 0
push 3
call fcn.00410f80
push str.Invalid_Trainer_User
push 0
push 8
call fcn.00406c33
call fcn.00404504
jmp 0x401a01
lea ebp, [0x535cfc]
lea eax, [ebp]
push eax
call sub.USER32.dll_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x535c70]
mov ebx, dword [0x535c70]
cmp ebx, 1
jne 0x401a6f
mov edx, 0x416258
lea ecx, [0x535c74]
call fcn.00406010
jmp 0x401a7f
mov edx, str.OFF.
lea ecx, [0x535c74]
call fcn.00406010
push dword [0x536554]
push dword [0x536554]
mov edx, str.Run_Game_and_then_press_F1_at_Main_Menu._Numlock_is
call fcn.00413870
mov edx, dword [0x535c74]
call fcn.00413870
inc dword [0x536554]
push 0
push 8
mov edx, dword [0x532ecc]
add dword [esp + 8], edx
call fcn.00406c33
pop dword [0x536554]
mov eax, 0x12c
call fcn.005390b9
mov dword [0x535bac], eax
mov ebx, dword [0x535bac]
cmp ebx, 0x63
jne 0x401b91
push dword [0x536554]
push dword [0x536554]
call fcn.004076f0
sub esp, 4
inc dword [0x536554]
push 0
mov edx, dword [0x532ecc]
add dword [esp + 4], edx
call fcn.0041305c
pop dword [0x536554]
push 0
call fcn.00413090
mov dword [0x535bb8], eax
mov dword [0x535c1c], 1
mov ebx, dword [0x535bb8]
add ebx, 0xfffffffc
cmp ebx, dword [0x535c1c]
jl 0x401b58
push 0
call fcn.00413120
mov dword [0x535b5c], eax
inc dword [0x535c1c]
jmp 0x401b30
push 0
call fcn.00413170
mov dword [0x535ba8], eax
push 0
call fcn.00412e87
mov ebx, dword [0x535ba8]
cmp ebx, dword [0x535bb8]
jne 0x401b81
jmp 0x401b84
inc eax
push esp
ret
mov ebx, dword [0x535bb0]
and ebx, ebx
jne 0x401b91
inc eax
push esp
ret
call fcn.00404504
mov eax, 0xa
call fcn.00539050
push 0x70
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x401a35
mov edx, str.Warhammer.exe
lea ecx, [0x535ca4]
call fcn.00406010
call fcn.00403af8
mov ebx, dword [0x535c18]
and ebx, ebx
jne 0x401c0f
push 0
push 4
call fcn.00407100
mov eax, 0x12c
call fcn.00539050
mov eax, 0x12c
call fcn.00539050
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 8
call fcn.00406c33
jmp 0x401a35
mov edx, str.CH.dll
lea ecx, [0x535b9c]
call fcn.00406010
mov edx, dword [0x535bd8]
push dword [0x536554]
call fcn.00413870
mov edx, dword [0x535b9c]
call fcn.00413870
lea ecx, [0x535bfc]
pop edx
call fcn.00406000
call fcn.00403b3d
call fcn.00403af8
call fcn.00404479
call fcn.00404504
mov ebx, dword [0x535ca0]
and ebx, ebx
jne 0x401c92
mov ebx, dword [0x535b98]
and ebx, ebx
jne 0x401c92
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 8
call fcn.00406c33
jmp 0x401a35
push 0
push 3
call fcn.00407100
mov eax, 0x12c
call fcn.00539050
push str.Game_found__Trainer_Activated_
push 0
push 8
call fcn.00406c33
mov ebp, dword [0x535dfc]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 0
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x30], 0
push str.CH_Trainer_Keys.dat
push 0
call fcn.0041305c
mov dword [0x535cb8], eax
mov ebx, dword [0x535cb8]
and ebx, ebx
jle 0x401e90
mov dword [0x535bd4], 1
push 0
call fcn.00413120
mov dword [0x535c7c], eax
mov dword [0x535c1c], 1
mov eax, dword [0x535c7c]
cmp eax, dword [0x535c1c]
jl 0x401e86
push dword [0x536554]
push 0
call fcn.00413220
sub esp, 4
lea ecx, [0x535cc4]
pop edx
call fcn.00406000
push dword [0x535cc4]
mov edx, str.SHIFT
pop ecx
call fcn.005391a0
je 0x401db8
mov ebx, dword [0x535c1c]
mov ebp, dword [0x535e04]
sal ebx, 2
mov dword [ebp + ebx], 0
push dword [0x535cc4]
mov edx, str.CTRL
pop ecx
call fcn.005391a0
je 0x401de2
mov ebx, dword [0x535c1c]
mov ebp, dword [0x535e0c]
sal ebx, 2
mov dword [ebp + ebx], 0
push dword [0x535cc4]
mov edx, 0x416307
pop ecx
call fcn.005391a0
je 0x401e0c
mov ebx, dword [0x535c1c]
mov ebp, dword [0x535e14]
sal ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.00413120
push eax
mov ebx, dword [0x535c1c]
mov ebp, dword [0x535dfc]
sal ebx, 2
pop dword [ebp + ebx]
push dword [0x536554]
push dword [0x536554]
push 0
mov ebx, dword [0x535c1c]
sal ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.004065f0
sub esp, 4
inc dword [0x536554]
mov edx, dword [0x532ecc]
add dword [esp], edx
call fcn.004060e0
pop dword [0x536554]
push eax
mov ebx, dword [0x535c1c]
sal ebx, 2
pop dword [ebp + ebx]
inc dword [0x535c1c]
jmp 0x401d5e
push 0
call fcn.00412e87
push 0x8b
mov ebx, dword [0x535b80]
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x82
mov ebx, dword [0x535b80]
inc ebx
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xa4
mov ebx, dword [0x535b80]
add ebx, 2
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 3
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 4
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 5
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x9c
mov ebx, dword [0x535b80]
add ebx, 6
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x60
mov ebx, dword [0x535b80]
add ebx, 7
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x83
mov ebx, dword [0x535b80]
add ebx, 8
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x3d
mov ebx, dword [0x535b80]
add ebx, 9
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0xa
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x3f
mov ebx, dword [0x535b80]
add ebx, 0xb
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x26
mov ebx, dword [0x535b80]
add ebx, 0xc
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x1f
mov ebx, dword [0x535b80]
add ebx, 0xd
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 1
mov ebx, dword [0x535b80]
add ebx, 0xe
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x75
mov ebx, dword [0x535b80]
add ebx, 0xf
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xc
mov ebx, dword [0x535b80]
add ebx, 0x10
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x8b
mov ebx, dword [0x535b80]
add ebx, 0x11
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x8a
mov ebx, dword [0x535b80]
add ebx, 0x12
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xa8
mov ebx, dword [0x535b80]
add ebx, 0x13
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x14
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x15
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x16
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x89
mov ebx, dword [0x535b80]
add ebx, 0x17
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x8a
mov ebx, dword [0x535b80]
add ebx, 0x18
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xa4
mov ebx, dword [0x535b80]
add ebx, 0x19
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x1a
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x1b
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x1c
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x61
mov ebx, dword [0x535b80]
add ebx, 0x1d
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x9d
mov ebx, dword [0x535b80]
add ebx, 0x1e
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xc3
mov ebx, dword [0x535b80]
add ebx, 0x1f
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x20
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x21
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x22
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x23
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x24
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x25
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x26
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x27
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x28
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x29
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x2a
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x2b
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x2c
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x2d
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x2e
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x2f
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x8b
mov ebx, dword [0x535b80]
add ebx, 0x30
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push pe_nt_image_headers32
mov ebx, dword [0x535b80]
add ebx, 0x31
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xc4
mov ebx, dword [0x535b80]
add ebx, 0x32
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 1
mov ebx, dword [0x535b80]
add ebx, 0x33
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x34
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x35
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x9c
mov ebx, dword [0x535b80]
add ebx, 0x36
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x60
mov ebx, dword [0x535b80]
add ebx, 0x37
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x85
mov ebx, dword [0x535b80]
add ebx, 0x38
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xc0
mov ebx, dword [0x535b80]
add ebx, 0x39
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x74
mov ebx, dword [0x535b80]
add ebx, 0x3a
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x10
mov ebx, dword [0x535b80]
add ebx, 0x3b
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x83
mov ebx, dword [0x535b80]
add ebx, 0x3c
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x3d
mov ebx, dword [0x535b80]
add ebx, 0x3d
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 4
mov ebx, dword [0x535b80]
add ebx, 0x3e
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x3f
mov ebx, dword [0x535b80]
add ebx, 0x3f
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x26
mov ebx, dword [0x535b80]
add ebx, 0x40
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x1f
mov ebx, dword [0x535b80]
add ebx, 0x41
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 1
mov ebx, dword [0x535b80]
add ebx, 0x42
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x75
mov ebx, dword [0x535b80]
add ebx, 0x43
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 7
mov ebx, dword [0x535b80]
add ebx, 0x44
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xc7
mov ebx, dword [0x535b80]
add ebx, 0x45
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x40
mov ebx, dword [0x535b80]
add ebx, 0x46
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x58
mov ebx, dword [0x535b80]
add ebx, 0x47
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x63
mov ebx, dword [0x535b80]
add ebx, 0x48
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x49
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x4a
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x4b
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x61
mov ebx, dword [0x535b80]
add ebx, 0x4c
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x9d
mov ebx, dword [0x535b80]
add ebx, 0x4d
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xc3
mov ebx, dword [0x535b80]
add ebx, 0x4e
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 0x4f
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x50
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x51
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x52
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x53
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x54
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x55
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x56
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x57
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x58
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x59
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x5a
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x5b
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x5c
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x5d
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x5e
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x5f
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x69
mov ebx, dword [0x535b80]
add ebx, 0x60
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xc9
mov ebx, dword [0x535b80]
add ebx, 0x61
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x64
mov ebx, dword [0x535b80]
add ebx, 0x62
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 3
mov ebx, dword [0x535b80]
add ebx, 0x63
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x64
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x65
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x9c
mov ebx, dword [0x535b80]
add ebx, 0x66
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x60
mov ebx, dword [0x535b80]
add ebx, 0x67
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x83
mov ebx, dword [0x535b80]
add ebx, 0x68
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x3d
mov ebx, dword [0x535b80]
add ebx, 0x69
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 8
mov ebx, dword [0x535b80]
add ebx, 0x6a
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x3f
mov ebx, dword [0x535b80]
add ebx, 0x6b
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x26
mov ebx, dword [0x535b80]
add ebx, 0x6c
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x1f
mov ebx, dword [0x535b80]
add ebx, 0x6d
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 1
mov ebx, dword [0x535b80]
add ebx, 0x6e
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x75
mov ebx, dword [0x535b80]
add ebx, 0x6f
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xc
mov ebx, dword [0x535b80]
add ebx, 0x70
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x8b
mov ebx, dword [0x535b80]
add ebx, 0x71
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x81
mov ebx, dword [0x535b80]
add ebx, 0x72
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x78
mov ebx, dword [0x535b80]
add ebx, 0x73
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xb2
mov ebx, dword [0x535b80]
add ebx, 0x74
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xe3
mov ebx, dword [0x535b80]
add ebx, 0x75
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x76
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xc7
mov ebx, dword [0x535b80]
add ebx, 0x77
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0
mov ebx, dword [0x535b80]
add ebx, 0x78
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xf0
mov ebx, dword [0x535b80]
add ebx, 0x79
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x23
mov ebx, dword [0x535b80]
add ebx, 0x7a
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x74
mov ebx, dword [0x535b80]
add ebx, 0x7b
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x49
mov ebx, dword [0x535b80]
add ebx, 0x7c
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x61
mov ebx, dword [0x535b80]
add ebx, 0x7d
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x9d
mov ebx, dword [0x535b80]
add ebx, 0x7e
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0xc3
mov ebx, dword [0x535b80]
add ebx, 0x7f
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push dword [0x535c78]
push pe_nt_image_headers32
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x1091
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
mov ebx, dword [0x535b98]
add ebx, 0x3f00
push ebx
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x109b
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
mov ebx, dword [0x535b98]
add ebx, 0x3f04
push ebx
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x10cf
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
mov ebx, dword [0x535b98]
add ebx, 0x3f08
push ebx
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x10fb
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535ca0]
add ebx, 0x20eccb
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x535cb8], eax
mov eax, dword [0x535b80]
call fcn.00539190
mov dword [0x535c08], eax
push dword [0x535c08]
mov eax, dword [0x535b80]
call fcn.00539180
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x1104
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0xe8
mov ebx, dword [0x535b80]
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
inc ebx
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 2
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 3
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 4
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 5
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push dword [0x535c78]
push 6
push dword [0x535b80]
mov ebx, dword [0x535ca0]
add ebx, 0x2111bc
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
mov ebx, dword [0x535b98]
add ebx, 0x1091
mov edi, dword [0x535ca0]
add edi, 0x2111bc
sub ebx, edi
add ebx, 0xfffffffb
push ebx
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535ca0]
add ebx, 0x2111bd
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0xe8
mov ebx, dword [0x535b80]
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
inc ebx
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 2
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 3
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 4
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 5
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push dword [0x535c78]
push 6
push dword [0x535b80]
mov ebx, dword [0x535ca0]
add ebx, 0x2f7f44
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
mov ebx, dword [0x535b98]
add ebx, 0x10c1
mov edi, dword [0x535ca0]
add edi, 0x2f7f44
sub ebx, edi
add ebx, 0xfffffffb
push ebx
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535ca0]
add ebx, 0x2f7f45
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0xe8
mov ebx, dword [0x535b80]
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
inc ebx
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 2
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 3
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 4
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push 0x90
mov ebx, dword [0x535b80]
add ebx, 5
mov eax, ebx
call fcn.00539170
mov dword [0x535cb8], eax
push dword [0x535c78]
push 6
push dword [0x535b80]
mov ebx, dword [0x535ca0]
add ebx, 0x20ecc3
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
mov ebx, dword [0x535b98]
add ebx, 0x10f1
mov edi, dword [0x535ca0]
add edi, 0x20ecc3
sub ebx, edi
add ebx, 0xfffffffb
push ebx
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535ca0]
add ebx, 0x20ecc4
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
mov dword [0x535ca8], 0
mov eax, 0xff
cmp eax, dword [0x535ca8]
jl 0x40309c
push dword [0x535ca8]
call sub.USER32.dll_GetAsyncKeyState
inc dword [0x535ca8]
jmp 0x40307c
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4030ab
push 0x55009553
ret
mov ebp, dword [0x535dfc]
push dword [ebp + 4]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 4]
mov ebp, dword [0x535dfc]
push dword [ebp + 8]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 8]
mov ebp, dword [0x535dfc]
push dword [ebp + 0xc]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 0xc]
mov ebp, dword [0x535dfc]
push dword [ebp + 0x10]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 0x10]
mov ebp, dword [0x535dfc]
push dword [ebp + 0x14]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 0x14]
mov ebp, dword [0x535dfc]
push dword [ebp + 0x18]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 0x18]
mov ebp, dword [0x535dfc]
push dword [ebp + 0x1c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 0x1c]
mov ebp, dword [0x535dfc]
push dword [ebp + 0x20]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 0x20]
mov ebp, dword [0x535dfc]
push dword [ebp + 0x24]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 0x24]
mov ebp, dword [0x535dfc]
push dword [ebp + 0x28]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 0x28]
mov ebp, dword [0x535dfc]
push dword [ebp + 0x2c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 0x2c]
mov ebp, dword [0x535dfc]
push dword [ebp + 0x30]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x535e1c]
pop dword [ebp + 0x30]
push 0x10
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x535c58], eax
push 0x11
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x535c24], eax
push 0x12
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x535c20], eax
mov ebp, dword [0x535dfc]
push dword [ebp + 4]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 4]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 4]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 4]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c28], ebx
mov ebx, dword [0x535c28]
and ebx, ebx
je 0x403336
push dword [0x535c90]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4032c6
mov dword [0x535c90], 1
push 1
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x3f00
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0
push 0
call fcn.00407100
mov eax, 0x12c
call fcn.00539050
jmp 0x403335
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403335
mov dword [0x535c90], 0
push 0
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x3f00
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0
push 1
call fcn.00407100
mov eax, 0x12c
call fcn.00539050
pop eax
mov ebp, dword [0x535dfc]
push dword [ebp + 8]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 8]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 8]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 8]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c38], ebx
mov ebx, dword [0x535c38]
and ebx, ebx
je 0x403474
push dword [0x535c0c]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403404
mov dword [0x535c0c], 1
push 1
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x3f04
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0
push 0
call fcn.00407100
mov eax, 0x12c
call fcn.00539050
jmp 0x403473
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403473
mov dword [0x535c0c], 0
push 0
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x3f04
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0
push 1
call fcn.00407100
mov eax, 0x12c
call fcn.00539050
pop eax
mov ebp, dword [0x535dfc]
push dword [ebp + 0xc]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 0xc]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 0xc]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 0xc]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c3c], ebx
mov ebx, dword [0x535c3c]
and ebx, ebx
je 0x4035b2
push dword [0x535c04]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403542
mov dword [0x535c04], 1
push 1
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x3f08
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0
push 0
call fcn.00407100
mov eax, 0x12c
call fcn.00539050
jmp 0x4035b1
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4035b1
mov dword [0x535c04], 0
push 0
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x3f048
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0
push 1
call fcn.00407100
mov eax, 0x12c
call fcn.00539050
pop eax
mov ebp, dword [0x535dfc]
push dword [ebp + 0x10]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 0x10]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 0x10]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 0x10]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c40], ebx
mov ebx, dword [0x535c40]
and ebx, ebx
je 0x403608
mov ebp, dword [0x535dfc]
push dword [ebp + 0x14]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 0x14]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 0x14]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 0x14]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c44], ebx
mov ebx, dword [0x535c44]
and ebx, ebx
je 0x403746
push dword [0x535c04]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4036d6
mov dword [0x535c04], 1
push 1
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x3f0c
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0
push 0
call fcn.00407100
mov eax, 0x12c
call fcn.00539050
jmp 0x403745
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403745
mov dword [0x535c04], 0
push 0
mov eax, dword [0x535b80]
call fcn.00539180
mov dword [0x535cb8], eax
push dword [0x535c78]
push 4
push dword [0x535b80]
mov ebx, dword [0x535b98]
add ebx, 0x3f0c
push ebx
push dword [0x535b68]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x535cb8], eax
push 0
push 1
call fcn.00407100
mov eax, 0x12c
call fcn.00539050
pop eax
mov ebp, dword [0x535dfc]
push dword [ebp + 0x18]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 0x18]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 0x18]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 0x18]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c48], ebx
mov ebx, dword [0x535c48]
and ebx, ebx
je 0x40379c
mov ebp, dword [0x535dfc]
push dword [ebp + 0x1c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c4c], ebx
mov ebx, dword [0x535c4c]
and ebx, ebx
je 0x4037f2
mov ebp, dword [0x535dfc]
push dword [ebp + 0x20]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 0x20]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 0x20]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 0x20]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c50], ebx
mov ebx, dword [0x535c50]
and ebx, ebx
je 0x403848
mov ebp, dword [0x535dfc]
push dword [ebp + 0x24]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 0x24]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 0x24]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 0x24]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c54], ebx
mov ebx, dword [0x535c54]
and ebx, ebx
je 0x40389e
mov ebp, dword [0x535dfc]
push dword [ebp + 0x28]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 0x28]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 0x28]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 0x28]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c2c], ebx
mov ebx, dword [0x535c2c]
and ebx, ebx
je 0x4038f4
mov ebp, dword [0x535dfc]
push dword [ebp + 0x2c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c30], ebx
mov ebx, dword [0x535c30]
and ebx, ebx
je 0x40394a
mov ebp, dword [0x535dfc]
push dword [ebp + 0x30]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x535e04]
mov edi, dword [ebp + 0x30]
add edi, dword [0x535c58]
imul ebx, edi
mov ebp, dword [0x535e0c]
mov edi, dword [ebp + 0x30]
add edi, dword [0x535c24]
imul ebx, edi
mov ebp, dword [0x535e14]
mov edi, dword [ebp + 0x30]
add edi, dword [0x535c20]
imul ebx, edi
mov dword [0x535c34], ebx
mov ebx, dword [0x535c34]
and ebx, ebx
je 0x4039a0
mov dword [0x535c28], 0
mov dword [0x535c38], 0
mov dword [0x535c3c], 0
mov dword [0x535c40], 0
mov dword [0x535c44], 0
mov dword [0x535c48], 0
mov dword [0x535c4c], 0
mov dword [0x535c50], 0
mov dword [0x535c54], 0
mov dword [0x535c2c], 0
mov dword [0x535c30], 0
mov dword [0x535c34], 0
call fcn.00404504
mov eax, 1
call fcn.00539050
mov eax, 0x12c
call fcn.005390b9
mov dword [0x535bac], eax
mov ebx, dword [0x535bac]
cmp ebx, 0x63
jne 0x403af3
push dword [0x536554]
push dword [0x536554]
call fcn.004076f0
sub esp, 4
inc dword [0x536554]
push 0
mov edx, dword [0x532ecc]
add dword [esp + 4], edx
call fcn.0041305c
pop dword [0x536554]
push 0
call fcn.00413090
mov dword [0x535bb8], eax
mov dword [0x535c1c], 1
mov ebx, dword [0x535bb8]
add ebx, 0xfffffffc
cmp ebx, dword [0x535c1c]
jl 0x403aba
push 0
call fcn.00413120
mov dword [0x535b5c], eax
inc dword [0x535c1c]
jmp 0x403a92
push 0
call fcn.00413170
mov dword [0x535ba8], eax
push 0
call fcn.00412e87
mov ebx, dword [0x535ba8]
cmp ebx, dword [0x535bb8]
jne 0x403ae3
jmp 0x403ae6
inc eax
push esp
ret
mov ebx, dword [0x535bb0]
and ebx, ebx
jne 0x403af3
inc eax
push esp
ret
jmp 0x403072