Function at 0x401000
Capabilities:
Accept command line arguments
Check internet connectivity via wininet
Download url
Receive data

Disassembly:
push 0x8c
push 0
push 0x4cd270
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4cd274], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4cd270], eax
call fcn.00404e20
call fcn.00404dc4
call fcn.00404460
call fcn.004042c5
call fcn.004041c0
call fcn.00403c7c
call fcn.00403b40
call fcn.00403191
call fcn.0040221c
mov eax, dword [0x4cd308]
push eax
push eax
call fcn.00403c98
lea ecx, [0x4cd27c]
pop edx
call fcn.00402000
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd27c]
call fcn.0040411a
lea ecx, [0x4cd27c]
pop edx
call fcn.00402000
mov edx, 0x40701c
lea ecx, [0x4cd280]
call fcn.00402018
mov edx, 0x40701c
lea ecx, [0x4cd284]
call fcn.00402018
mov edx, 0x40701c
lea ecx, [0x4cd288]
call fcn.00402018
mov dword [0x4cd28c], 0
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd308]
call fcn.00403c98
inc dword [0x4cd308]
push 0
mov edx, dword [0x4cc648]
add dword [esp + 4], edx
call fcn.00404650
pop dword [0x4cd308]
push 0
call fcn.00404670
mov dword [0x4cd290], eax
mov dword [0x4cd294], 1
mov ebx, dword [0x4cd290]
add ebx, 0xfffffff8
cmp ebx, dword [0x4cd294]
jl 0x401164
push 0
call fcn.004046e0
mov byte [0x4cd2f8], al
mov ebx, dword [0x4cd298]
movzx eax, byte [0x4cd2f8]
add ebx, eax
mov dword [0x4cd298], ebx
inc dword [0x4cd294]
jmp 0x401127
push 0
call fcn.00404740
mov dword [0x4cd29c], eax
push 0
call fcn.00404740
mov dword [0x4cd2a0], eax
push 0
call fcn.004043f0
mov eax, dword [0x4cd298]
mov dword [0x4cd2a4], eax
push dword [0x4cd27c]
push 0
call fcn.00404650
mov ebx, eax
and ebx, ebx
jle 0x40153e
mov dword [0x4cd294], 1
mov eax, 0x3b8
cmp eax, dword [0x4cd294]
jl 0x4011de
push 0
call fcn.004047a0
mov dword [0x4cd2a8], eax
inc dword [0x4cd294]
jmp 0x4011ba
mov dword [0x4cd294], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x4cd294]
jl 0x401281
push 0
call fcn.004047a0
mov dword [0x4cd2a8], eax
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd308]
push 0
mov eax, dword [0x4cd2a8]
cdq
push edx
push eax
call fcn.004037c0
inc dword [0x4cd308]
mov edx, dword [0x4cc648]
add dword [esp], edx
call fcn.00403220
pop dword [0x4cd308]
mov dword [0x4cd2a8], eax
mov edx, dword [0x4cd280]
push dword [0x4cd308]
call fcn.00404e70
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd2a8]
call fcn.00403310
pop eax
lea ecx, [0x4cd280]
pop edx
call fcn.00402000
inc dword [0x4cd294]
jmp 0x4011e8
push dword [0x4cd280]
call fcn.00401dd2
mov dword [0x4cd2a8], eax
mov ebx, dword [0x4cd2a8]
xor ebx, 0x98989898
mov dword [0x4cd2a8], ebx
mov eax, dword [0x4cd2a8]
mov dword [0x4cd2ac], eax
mov eax, dword [0x4cd308]
push eax
push eax
push 0xa
push dword [0x4cd308]
mov edx, str.0000000000
call fcn.00404e70
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd2a8]
call fcn.00403330
pop eax
inc dword [0x4cd308]
mov edx, dword [0x4cc648]
add dword [esp], edx
call fcn.00403400
lea ecx, [0x4cd280]
pop edx
call fcn.00402000
mov dword [0x4cd294], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x4cd294]
jl 0x40139f
push 0
call fcn.004047a0
mov dword [0x4cd2a8], eax
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd308]
push 0
mov eax, dword [0x4cd2a8]
cdq
push edx
push eax
call fcn.004037c0
inc dword [0x4cd308]
mov edx, dword [0x4cc648]
add dword [esp], edx
call fcn.00403220
pop dword [0x4cd308]
mov dword [0x4cd2a8], eax
mov edx, dword [0x4cd284]
push dword [0x4cd308]
call fcn.00404e70
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd2a8]
call fcn.00403310
pop eax
lea ecx, [0x4cd284]
pop edx
call fcn.00402000
inc dword [0x4cd294]
jmp 0x401306
push dword [0x4cd284]
call fcn.00401dd2
mov dword [0x4cd2b0], eax
mov dword [0x4cd294], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x4cd294]
jl 0x401452
push 0
call fcn.004047a0
mov dword [0x4cd2a8], eax
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd308]
push 0
mov eax, dword [0x4cd2a8]
cdq
push edx
push eax
call fcn.004037c0
inc dword [0x4cd308]
mov edx, dword [0x4cc648]
add dword [esp], edx
call fcn.00403220
pop dword [0x4cd308]
mov dword [0x4cd2a8], eax
mov edx, dword [0x4cd288]
push dword [0x4cd308]
call fcn.00404e70
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd2a8]
call fcn.00403310
pop eax
lea ecx, [0x4cd288]
pop edx
call fcn.00402000
inc dword [0x4cd294]
jmp 0x4013b9
push dword [0x4cd288]
call fcn.00401dd2
mov dword [0x4cd2a8], eax
mov eax, dword [0x4cd2a8]
mov dword [0x4cd2b4], eax
mov dword [0x4cd294], 0x3d1
mov ebx, dword [0x4cd2b4]
dec ebx
cmp ebx, dword [0x4cd294]
jl 0x40149c
push 0
call fcn.004047a0
mov dword [0x4cd2a8], eax
inc dword [0x4cd294]
jmp 0x401476
mov eax, dword [0x4cd2b4]
mov dword [0x4cd294], eax
mov ebx, dword [0x4cd2b4]
add ebx, 0x12
cmp ebx, dword [0x4cd294]
jl 0x4014e0
push 0
call fcn.004047a0
mov dword [0x4cd2a8], eax
mov ebx, dword [0x4cd28c]
add ebx, dword [0x4cd2a8]
mov dword [0x4cd28c], ebx
inc dword [0x4cd294]
jmp 0x4014a6
mov ebx, dword [0x4cd2b0]
xor ebx, dword [0x4cd28c]
mov dword [0x4cd2b8], ebx
mov ebx, dword [0x4cd2b8]
and ebx, ebx
jne 0x401506
mov dword [0x4cd2b8], 0x63
mov ebx, dword [0x4cd2b8]
xor ebx, 0x98989898
mov dword [0x4cd2b8], ebx
mov eax, dword [0x4cd2ac]
mov dword [0x4cd2bc], eax
mov ebx, dword [0x4cd2ac]
cmp ebx, dword [0x4cd2b8]
jne 0x401532
jmp 0x40153c
mov dword [0x4cd2c0], 0x21
jmp 0x401548
mov dword [0x4cd2c0], 0xb
mov ebx, dword [0x4cd2a0]
cmp ebx, dword [0x4cd290]
jne 0x401558
jmp 0x401562
mov dword [0x4cd2c0], 0x37
push 0
push 0
call sub.WININET.dll_InternetGetConnectedState
and eax, eax
je 0x401577
jmp 0x4015a6
push dword [0x4cd2bc]
call fcn.00401a18
mov ebx, eax
and ebx, ebx
jne 0x4015a6
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.00403b4e
mov dword [0x4cd2c0], 0x63
mov eax, dword [0x4cd308]
push eax
push eax
call fcn.0040434f
mov edx, str.black.txt
call fcn.00404e70
lea ecx, [0x4cd2c4]
pop edx
call fcn.00402000
push dword [0x4cd308]
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.00404e70
mov eax, dword [0x4cd308]
push eax
push eax
mov ebx, dword [0x4cd2bc]
xor ebx, 0x7b3d89b
push ebx
call fcn.00403330
pop eax
mov edx, str..zip
call fcn.00404e70
lea ecx, [0x4cd2c8]
pop edx
call fcn.00402000
mov edx, str.http:__www.cheathappens.com_unauthorized_0h.zip
lea ecx, [0x4cd2cc]
call fcn.00402018
mov edx, dword [0x4cd2c8]
push dword [0x4cd308]
call fcn.00404e70
lea ecx, [0x4cd2d0]
pop edx
call fcn.00402000
mov edx, dword [0x4cd2cc]
push dword [0x4cd308]
call fcn.00404e70
lea ecx, [0x4cd2d4]
pop edx
call fcn.00402000
push 0
push 0
mov eax, dword [0x4cd2c4]
push eax
mov eax, dword [0x4cd2d4]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x4cd2d8], eax
mov ebx, dword [0x4cd2d8]
and ebx, ebx
jne 0x401683
jmp 0x4016b2
push dword [0x4cd2bc]
call fcn.00401a18
mov ebx, eax
and ebx, ebx
jne 0x4016b2
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.00403b4e
mov dword [0x4cd2c0], 0xe
push 0
push 0
mov eax, dword [0x4cd2c4]
push eax
mov eax, dword [0x4cd2d0]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x4cd2dc], eax
mov ebx, dword [0x4cd2dc]
and ebx, ebx
jne 0x401704
mov dword [0x4cd2c0], 0x4e
push 0
push str.This_user_has_been_banned.
push str.Invalid_Trainer_User_
call fcn.00403b4e
jmp 0x4019e4
push 1
push str.Customized_for:_phoo0005
push 0
push 0xe6
push dword [0x4cd2e8]
push dword [0x4cd2e4]
push 0x63
call fcn.00402528
mov dword [0x4cd2e0], eax
push 0x5dc
call sub.KERNEL32.dll_Sleep
push 0x63
call fcn.0040208e
mov eax, dword [0x4cd308]
push eax
push eax
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.004041f0
lea ecx, [0x4cd2ec]
pop edx
call fcn.00402000
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd2ec]
call fcn.0040411a
lea ecx, [0x4cd2ec]
pop edx
call fcn.00402000
mov eax, dword [0x4cd308]
push eax
push eax
push 1
push str..exe
push dword [0x4cd2ec]
call fcn.00403470
mov ebx, eax
add ebx, 3
push ebx
push dword [0x4cd2ec]
call fcn.00403550
lea ecx, [0x4cd2ec]
pop edx
call fcn.00402000
push 0x3e8
call fcn.00404240
mov dword [0x4cd2f0], eax
mov eax, dword [0x4cd308]
push eax
push eax
call fcn.0040434f
lea ecx, [0x4cd2f4]
pop edx
call fcn.00402000
push dword [0x4cd308]
mov edx, dword [0x4cd2f4]
push dword [0x4cd308]
call fcn.00404e70
mov edx, str.CH2.dll
call fcn.00404e70
inc dword [0x4cd308]
push 0
mov edx, dword [0x4cc648]
add dword [esp + 4], edx
call fcn.00404590
pop dword [0x4cd308]
and eax, eax
je 0x401853
mov ebp, 0x4cc645
mov ebx, ebp
mov ebp, 0x4cba45
sub ebx, ebp
push ebx
mov ebp, 0x4cba45
push ebp
push 0
call fcn.00404800
push 0
call fcn.004043f0
jmp 0x401867
push str.Could_not_install_the_file___Installtion_failed
push str.Error
call fcn.00403b7d
jmp 0x4019e4
mov ebp, 0x4cba45
mov ebx, ebp
dec ebx
mov dword [0x4cd294], ebx
push dword [0x4cd294]
call fcn.00404260
mov byte [0x4cd2f9], al
mov ebp, 0x407244
mov dword [0x4cd294], ebp
mov ebp, 0x4cba45
cmp ebp, dword [0x4cd294]
jl 0x4018e5
mov eax, dword [0x4cd294]
call fcn.004041a0
mov byte [0x4cd2fa], al
movsx ebx, byte [0x4cd2fa]
xor bl, byte [0x4cd2f9]
xor ebx, dword [0x4cd2c0]
push ebx
pop eax
mov byte [0x4cd2fb], al
movsx eax, byte [0x4cd2fb]
push eax
mov eax, dword [0x4cd294]
call fcn.004041b0
mov dword [0x4cd2e0], eax
inc dword [0x4cd294]
jmp 0x401890
mov eax, dword [0x4cd308]
push eax
push eax
call fcn.00403c98
lea ecx, [0x4cd27c]
pop edx
call fcn.00402000
mov eax, dword [0x4cd308]
push eax
push eax
push dword [0x4cd27c]
call fcn.0040411a
lea ecx, [0x4cd27c]
pop edx
call fcn.00402000
push dword [0x4cd308]
mov edx, dword [0x4cd2f4]
push dword [0x4cd308]
call fcn.00404e70
mov edx, str.Mnn133.tmp
call fcn.00404e70
inc dword [0x4cd308]
push 0
mov edx, dword [0x4cc648]
add dword [esp + 4], edx
call fcn.00404590
pop dword [0x4cd308]
and eax, eax
je 0x40198b
mov ebp, 0x4cba45
mov ebx, ebp
mov ebp, 0x407244
sub ebx, ebp
push ebx
mov ebp, 0x407244
push ebp
push 0
call fcn.00404800
push 0
call fcn.004043f0
jmp 0x40198b
push 0x3e8
call sub.KERNEL32.dll_Sleep
push dword [0x4cd308]
push 0
push 1
push 0x40701c
push str.16744820695884
mov edx, dword [0x4cd2f4]
push dword [0x4cd308]
call fcn.00404e70
mov edx, str.Mnn133.tmp
call fcn.00404e70
inc dword [0x4cd308]
mov edx, dword [0x4cc648]
add dword [esp], edx
call fcn.00403d05
pop dword [0x4cd308]
push 0
call 0x4019fe
push dword [0x4cd270]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040217c
call fcn.004041e0
call fcn.00404297
call fcn.00404450
call fcn.00404dd9
ret