Function at 0x401000
Capabilities:
Allocate thread local storage
Check for time delay via gettickcount
Check internet connectivity via wininet

Disassembly:
push 0x7fc
push 0
push 0x49c21c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x49c220], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x49c21c], eax
mov eax, 0x48b153
mov dword [0x49c224], eax
call fcn.004159b0
call fcn.00415161
call fcn.00414710
call fcn.00413b63
call fcn.004138f1
call fcn.004137e7
call fcn.00412ed0
call fcn.00412abc
call fcn.00412a4a
call fcn.004113db
call fcn.0040f74f
call fcn.0040f2a5
call fcn.0040ef50
call fcn.0040e881
call fcn.0040e718
call fcn.0040d377
call fcn.0040f6d0
call fcn.0040d970
call fcn.004159e0
push eax
push eax
call fcn.00412be4
push 0x49c228
call fcn.00415a00
call fcn.004159e0
push eax
mov edx, dword [0x49c228]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.0.ogg
call fcn.00415a90
call fcn.00415af0
push 0
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413010
call fcn.00415b50
mov ebp, 0x452496
mov ebx, ebp
mov ebp, 0x44f900
sub ebx, ebp
push ebx
mov ebp, 0x44f900
push ebp
push 0
call fcn.00413070
push 0
call fcn.00412e60
call fcn.004159e0
push eax
mov edx, dword [0x49c228]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.1.ogg
call fcn.00415a90
call fcn.00415af0
push 0
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413010
call fcn.00415b50
mov ebp, 0x455407
mov ebx, ebp
mov ebp, 0x452496
sub ebx, ebp
push ebx
mov ebp, 0x452496
push ebp
push 0
call fcn.00413070
push 0
call fcn.00412e60
call fcn.004159e0
push eax
mov edx, dword [0x49c228]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.3.ogg
call fcn.00415a90
call fcn.00415af0
push 0
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413010
call fcn.00415b50
mov ebp, 0x458a3c
mov ebx, ebp
mov ebp, 0x455407
sub ebx, ebp
push ebx
mov ebp, 0x455407
push ebp
push 0
call fcn.00413070
push 0
call fcn.00412e60
call fcn.004159e0
push eax
mov edx, dword [0x49c228]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.4.ogg
call fcn.00415a90
call fcn.00415af0
push 0
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413010
call fcn.00415b50
mov ebp, 0x45d40d
mov ebx, ebp
mov ebp, 0x458a3c
sub ebx, ebp
push ebx
mov ebp, 0x458a3c
push ebp
push 0
call fcn.00413070
call fcn.004159e0
push eax
mov edx, dword [0x49c228]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.5.ogg
call fcn.00415a90
call fcn.00415af0
push 0
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413010
call fcn.00415b50
mov ebp, 0x46001a
mov ebx, ebp
mov ebp, 0x45d40d
sub ebx, ebp
push ebx
mov ebp, 0x45d40d
push ebp
push 0
call fcn.00413070
push 0
call fcn.00412e60
call fcn.0040da00
call fcn.004159e0
push eax
mov edx, dword [0x49c228]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.0.ogg
call fcn.00415a90
call fcn.00415af0
push 0
call fcn.00415b32
add dword [esp + 4], edx
call fcn.0040dbf8
call fcn.00415b50
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
mov edx, dword [0x49c228]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.1.ogg
call fcn.00415a90
call fcn.00415af0
push 1
call fcn.00415b32
add dword [esp + 4], edx
call fcn.0040dbf8
call fcn.00415b50
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
mov edx, dword [0x49c228]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.3.ogg
call fcn.00415a90
call fcn.00415af0
push 3
call fcn.00415b32
add dword [esp + 4], edx
call fcn.0040dbf8
call fcn.00415b50
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
mov edx, dword [0x49c228]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.4.ogg
call fcn.00415a90
call fcn.00415af0
push 4
call fcn.00415b32
add dword [esp + 4], edx
call fcn.0040dbf8
call fcn.00415b50
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
mov edx, dword [0x49c228]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.5.ogg
call fcn.00415a90
call fcn.00415af0
push 5
call fcn.00415b32
add dword [esp + 4], edx
call fcn.0040dbf8
call fcn.00415b50
mov dword [0x49c22c], eax
call fcn.0040f6d0
call fcn.004159e0
push eax
push 0
push 0x40
call fcn.004159e0
push eax
push eax
call fcn.0040e8b0
call fcn.00415b32
add dword [esp], edx
call fcn.0040ae46
push 0x49c244
call fcn.00415a00
mov ebp, 0x46001a
push ebp
push 0
call fcn.00413d6c
and eax, eax
je 0x402008
mov ebp, 0x4717d1
push ebp
push 2
call fcn.00413d6c
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0x41
push 0x133
push 2
call fcn.00413f36
push eax
call fcn.00413971
call fcn.004139b8
push 0x100
push 0x18
push 0x44f27a
push 1
call fcn.00412ad0
and eax, eax
je 0x4014b2
push 0x100
push 0x30
push 0x44f27a
push 2
call fcn.00412ad0
and eax, eax
je 0x4014cf
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.00413f52
and eax, eax
je 0x4015b3
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 1
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040ed90
push eax
push str.leesiokei
push 0
push 0
call fcn.00413a2f
call fcn.004139b8
push 0
push 0x64
push 0xc8
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0x11
call fcn.00413a18
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0x49c9b8
push 0x44f8f8
push 8
push 0x65
push 4
call fcn.004136e8
call fcn.004159e0
push eax
push eax
call fcn.00412be4
push 0x49c248
call fcn.00415a00
call fcn.004159e0
push eax
mov edx, dword [0x49c248]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.Options
call fcn.00415a90
call fcn.00415af0
push 0xa
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413010
call fcn.00415b50
and eax, eax
je 0x401654
mov ebp, 0x488b72
mov ebx, ebp
mov ebp, str.MEGA_TRAINER_r_n_r_n_r_nF1_key:_Stat_Editor_r_nNumpad_1:_Reset_Mood_r_nNumpad_2:_Reset_Stat_modifiers_r_nNumpad_3:_Reset_Needs_r_nNumpad_4:_Freeze_Day_Timer_r_nNumpad_5:_Instant_Day_over_r_nNumpad_6:_Unlimited_Command_Bar_r_nNumpad_7:_Unlimited_Training_Energy_r_n
sub ebx, ebp
push ebx
mov ebp, str.MEGA_TRAINER_r_n_r_n_r_nF1_key:_Stat_Editor_r_nNumpad_1:_Reset_Mood_r_nNumpad_2:_Reset_Stat_modifiers_r_nNumpad_3:_Reset_Needs_r_nNumpad_4:_Freeze_Day_Timer_r_nNumpad_5:_Instant_Day_over_r_nNumpad_6:_Unlimited_Command_Bar_r_nNumpad_7:_Unlimited_Training_Energy_r_n
push ebp
push 0xa
call fcn.00413070
push 0xa
call fcn.00412e60
jmp 0x401668
push str.Could_not_install_the_file___Installtion_failed
push str.Error
call fcn.0040e755
jmp 0x40a0e9
call fcn.004159e0
push eax
mov edx, dword [0x49c248]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.help.txt
call fcn.00415a90
call fcn.00415af0
push 0
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413010
call fcn.00415b50
and eax, eax
je 0x4016d5
mov ebp, 0x48a590
mov ebx, ebp
mov ebp, 0x488b72
sub ebx, ebp
push ebx
mov ebp, 0x488b72
push ebp
push 0
call fcn.00413070
push 0
call fcn.00412e60
jmp 0x4016e4
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040e755
push 0x49c9b8
push 0x44f8f8
push 8
push 0x65
push 4
call fcn.004136e8
call fcn.004159e0
push eax
mov edx, dword [0x49c248]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.Options
call fcn.00415a90
call fcn.00415af0
push 0xa
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413030
call fcn.00415b50
call fcn.004159e0
push eax
push eax
push 0xa
call fcn.004130d0
mov edx, 0x44f087
call fcn.00415a90
push 0x49c24c
call fcn.00415a00
call fcn.004159e0
push eax
push eax
push 0xa
call fcn.004130d0
push 0x49c250
call fcn.00415a00
call fcn.004159e0
push eax
push eax
push 0xa
call fcn.004130d0
mov ebx, dword [0x49c254]
inc ebx
mov ebp, dword [0x49c9b8]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00415a00
inc dword [0x49c254]
push 0xa
call fcn.00413210
mov ebx, eax
cmp ebx, 1
jne 0x401780
push 0xa
call fcn.00412e60
fild dword [0x49c254]
fmul dword [0x44f8d8]
fstp dword [0x49c258]
fld dword [0x49c258]
fmul dword [0x44f8dc]
fstp dword [0x49c25c]
fld dword [0x49c258]
fild dword [0x49c254]
fdiv dword [0x44f8e0]
fdivp st(1)
fstp dword [0x49c260]
fld dword [0x49c25c]
fild dword [0x49c254]
fdiv dword [0x44f8e0]
fdivp st(1)
fstp dword [0x49c264]
fld dword [0x49c258]
fcomp dword [0x44f8e4]
fnstsw ax
test ah, 1
jne 0x401844
mov ebx, dword [0x49c254]
cmp ebx, 0x15
jl 0x401844
jmp 0x40184b
mov eax, 1
jmp 0x40184d
xor eax, eax
and eax, eax
je 0x401889
mov dword [0x49c258], 0x44480000
mov dword [0x49c25c], 0x44c80000
fld dword [0x49c258]
fdiv dword [0x44f8dc]
fstp dword [0x49c260]
fld dword [0x49c25c]
fdiv dword [0x44f8dc]
fstp dword [0x49c264]
push 0x120
fld dword [0x49c25c]
push eax
fistp dword [esp]
fld dword [0x49c258]
push eax
fistp dword [esp]
push 1
call fcn.00413f52
and eax, eax
je 0x401a23
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 1
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
mov dword [0x49c268], 1
mov eax, dword [0x49c254]
cmp eax, dword [0x49c268]
jl 0x401941
push 0xff
push 0
push 0
mov eax, 0
call fcn.0040ed90
push eax
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9b8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c268]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe8
push ebx
push 2
call fcn.00413a2f
inc dword [0x49c268]
jno 0x4018e8
mov dword [0x49c268], 1
mov eax, dword [0x49c254]
cmp eax, dword [0x49c268]
jl 0x4019a4
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040ed90
push eax
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9b8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c268]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe6
push ebx
push 0
call fcn.00413a2f
inc dword [0x49c268]
jno 0x40194b
call fcn.004139b8
push 0
fld dword [0x49c264]
push eax
fistp dword [esp]
fld dword [0x49c260]
push eax
fistp dword [esp]
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0x11
call fcn.00413a18
fld dword [0x49c264]
push eax
fistp dword [esp]
fld dword [0x49c260]
push eax
fistp dword [esp]
push 0x43
push 7
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0x120
push 0x190
push 0x640
push 1
call fcn.00413f52
and eax, eax
je 0x401b37
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 2
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
call fcn.004159e0
push eax
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040ed90
push eax
mov edx, dword [0x49c24c]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, dword [0x49c250]
call fcn.00415a90
call fcn.00415af0
push 0
push 0
call fcn.00415b32
add dword [esp + 8], edx
call fcn.00413a2f
call fcn.00415b50
call fcn.004139b8
push 0
push 0x64
push 0x190
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0x11
call fcn.00413a18
push 0x64
push 0x190
push 0x28
push 5
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0x90000001
push 0x44f01d
push 0
call fcn.004141d6
push eax
push 0
call fcn.004141f4
push eax
push 0
push 0
push 0
call fcn.0041172b
and eax, eax
je 0x402008
push str.CLOSEBUTTON
push 0x13
push 0x13
push 6
push 0x1e4
push 1
call fcn.0040f8d9
mov dword [0x49c22c], eax
push str.READMEBUTTON
push 0x20
push 0x11e
push 0x17e
push 0xa
push 3
call fcn.0040f8d9
mov dword [0x49c22c], eax
push str.TROUBLEBUTTON
push 0x20
push 0x11e
push 0x19c
push 0xa
push 4
call fcn.0040f8d9
mov dword [0x49c22c], eax
push str.CHBUTTON
push 0x23
push 0xf5
push 1
push 0x23
push 5
call fcn.0040f8d9
mov dword [0x49c22c], eax
push str.BOXARTBUTTON
push 0x118
push 0xc8
push 0x2d
push 0x132
push 6
call fcn.0040f8d9
mov dword [0x49c22c], eax
push 0x44f23c
push 0x10e
push 0x122
push 0x41
push 0
push 7
call fcn.0040f8d9
mov dword [0x49c22c], eax
push 0
call fcn.0041174e
push eax
push 0x80000000
push str.Test
push 0x6b
push 0xc8
push 0
push 0xfffffc18
push 1
call fcn.0041142b
push 0
call fcn.0041174e
push eax
call fcn.0040b3ed
push 0xff
push 0
call fcn.00413f36
push eax
push 0
call fcn.0041174e
push eax
call fcn.0040a131
push 0
push 0
call fcn.0041176a
call fcn.004159e0
push eax
push eax
mov edx, str.http:__www.cheathappens.com_trnflash.asp_id
call fcn.00415a90
mov edx, dword [0x49c244]
call fcn.00415a90
call fcn.00415af0
push 0xc8
push 0x12c
push 0
push 0
push 2
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.004109c1
call fcn.00415b50
mov dword [0x49c22c], eax
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
mov ebx, eax
and ebx, ebx
jne 0x401d4b
push 1
push 1
call fcn.0041176a
mov dword [0x49c268], 1
mov eax, 4
cmp eax, dword [0x49c268]
jl 0x402008
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.00413f52
and eax, eax
je 0x401ea7
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 1
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040ed90
push eax
push str.leesiokei
push 0
push 0
call fcn.00413a2f
call fcn.004139b8
push 0
push 0x64
push 0xc8
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0
call fcn.00413a18
push 0xff
push 0x44
push 0x44
mov eax, 0x44
call fcn.0040ed90
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.00413aaf
push 0x21
call fcn.00413a18
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0xff
push 0
call fcn.00413f36
push eax
push 0
call fcn.0041174e
push eax
call fcn.0040a131
push 0x32
call fcn.0040eda9
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.00413f52
and eax, eax
je 0x401ff2
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 1
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040ed90
push eax
push str.leesiokei
push 0
push 0
call fcn.00413a2f
call fcn.004139b8
push 0
push 0x64
push 0xc8
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0
call fcn.00413a18
push 0xff
push 0x44
push 0x44
mov eax, 0x44
call fcn.0040ed90
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.00413aaf
push 0x21
call fcn.00413a18
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0xff
push 0
call fcn.00413f36
push eax
push 0
call fcn.0041174e
push eax
call fcn.0040a131
push 0x32
call fcn.0040eda9
inc dword [0x49c268]
jno 0x401d55
push 0x49c9c0
push 0x44f8f8
push 8
push 0x100
push 4
call fcn.004136e8
mov eax, 0x48a590
mov dword [0x49c224], eax
lea ecx, [0x49c26c]
mov edx, dword [0x49c224]
call fcn.0040c008
add dword [0x49c224], eax
mov dword [0x49c268], 1
mov eax, 0xfe
cmp eax, dword [0x49c268]
jl 0x4020c7
call fcn.004159e0
push eax
push eax
push 0x44f031
push dword [0x49c268]
push dword [0x49c26c]
call fcn.0040c0c0
push 0x49c270
call fcn.00415a00
call fcn.004159e0
push eax
push eax
push dword [0x49c270]
call fcn.0040c160
mov ebx, eax
dec ebx
push ebx
push dword [0x49c270]
call fcn.0040c190
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9c0]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00415a00
inc dword [0x49c268]
jno 0x402051
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4020d7
push 0x75009553
inc ecx
ret
push 0x12c
call fcn.0040eda9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00413f52
and eax, eax
je 0x402222
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 1
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040ed90
push eax
push str.Authenticating_Trainer......
push 0
push 0
call fcn.00413a2f
call fcn.004139b8
push 0
push 0x64
push 0x1f4
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0
call fcn.00413a18
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040ed90
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00413aaf
push 0x11
call fcn.00413a18
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0xff
push 0
call fcn.00413f36
push eax
push 0
call fcn.0041174e
push eax
call fcn.0040a131
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push eax
call fcn.0040e8b0
call fcn.00415b32
add dword [esp], edx
call fcn.00412c45
push 0x49c274
call fcn.00415a00
mov edx, dword [0x49c274]
call fcn.004159e0
push eax
call fcn.00415a90
push 0x49c278
call fcn.00415a00
call sub.USER32.DLL_GetForegroundWindow
mov dword [0x49c27c], eax
push 0x49c280
push dword [0x49c27c]
call sub.USER32.DLL_GetWindowThreadProcessId
push dword [0x49c280]
push dword [0x49c288]
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x49c284], eax
mov eax, dword [0x49c280]
mov dword [0x49c27c], eax
push 0x3e8
call fcn.0040ef80
mov dword [0x49c28c], eax
mov edx, dword [0x49c278]
call fcn.004159e0
push eax
call fcn.00415a90
push 0x49c290
call fcn.00415a00
mov eax, dword [0x49c298]
mov dword [0x49c294], eax
mov ebp, 0x48b153
mov dword [0x49c268], ebp
mov eax, dword [0x49c268]
call fcn.0040efa0
mov byte [0x49c68c], al
mov ebp, 0x48b156
mov dword [0x49c268], ebp
mov ebp, 0x48b156
mov ebx, ebp
add ebx, 0xbb8
cmp ebx, dword [0x49c268]
jl 0x40238e
mov eax, dword [0x49c268]
call fcn.0040efa0
mov byte [0x49c68d], al
movsx ebx, byte [0x49c68d]
xor bl, byte [0x49c68c]
mov eax, ebx
mov byte [0x49c68e], al
movsx ebx, byte [0x49c68c]
add ebx, 0x37
mov eax, ebx
mov byte [0x49c68c], al
movsx ebx, byte [0x49c68c]
cmp ebx, 0xff
jle 0x40236b
movsx ebx, byte [0x49c68c]
add ebx, 0xffffff01
mov eax, ebx
mov byte [0x49c68c], al
movsx eax, byte [0x49c68e]
push eax
mov eax, dword [0x49c268]
call fcn.0040efb0
mov dword [0x49c22c], eax
inc dword [0x49c268]
jno 0x4022ff
call sub.KERNEL32.dll_GetTickCount
mov dword [0x49c29c], eax
call fcn.004159e0
push eax
push eax
call fcn.0040e8b0
push 0x49c2a0
call fcn.00415a00
call fcn.004159e0
push eax
push eax
push dword [0x49c2a0]
call fcn.00412c45
push 0x49c2a0
call fcn.00415a00
mov edx, 0x44f01d
lea ecx, [0x49c26c]
call fcn.0040c008
mov edx, 0x44f01d
lea ecx, [0x49c2a4]
call fcn.0040c008
mov edx, 0x44f01d
lea ecx, [0x49c2a8]
call fcn.0040c008
mov dword [0x49c2ac], 0
mov dword [0x49c2b0], 0
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
call fcn.0040e8b0
call fcn.00415af0
push 0
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413050
call fcn.00415b50
push 0
call fcn.004132b0
mov dword [0x49c2b4], eax
mov dword [0x49c268], 1
mov ebx, dword [0x49c2b4]
add ebx, 0xfffffff8
cmp ebx, dword [0x49c268]
jl 0x402493
push 0
call fcn.00413310
mov byte [0x49c68f], al
mov ebx, dword [0x49c2b0]
movzx eax, byte [0x49c68f]
add ebx, eax
mov dword [0x49c2b0], ebx
inc dword [0x49c268]
jno 0x402456
push 0
call fcn.00413370
mov dword [0x49c2b8], eax
push 0
call fcn.00413370
mov dword [0x49c2bc], eax
push 0
call fcn.00412e60
mov eax, dword [0x49c2b0]
mov dword [0x49c2c0], eax
push dword [0x49c2a0]
push 0
call fcn.00413050
mov ebx, eax
and ebx, ebx
jle 0x402838
mov dword [0x49c268], 1
mov eax, 0x3b8
cmp eax, dword [0x49c268]
jl 0x40250d
push 0
call fcn.004133d0
mov dword [0x49c2c4], eax
inc dword [0x49c268]
jno 0x4024e9
mov dword [0x49c268], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x49c268]
jl 0x4025a3
push 0
call fcn.004133d0
mov dword [0x49c2c4], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0
mov eax, dword [0x49c2c4]
cdq
push edx
push eax
call fcn.0040c260
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c2c4], eax
mov edx, dword [0x49c26c]
call fcn.004159e0
push eax
call fcn.00415a90
call fcn.004159e0
push eax
push eax
push dword [0x49c2c4]
call fcn.0040c490
pop eax
push 0x49c26c
call fcn.00415a00
inc dword [0x49c268]
jno 0x402517
push dword [0x49c26c]
call fcn.0040b2f8
mov dword [0x49c2c4], eax
mov ebx, dword [0x49c2c4]
xor ebx, 0x98989898
mov dword [0x49c2c4], ebx
mov eax, dword [0x49c2c4]
mov dword [0x49c2c8], eax
call fcn.004159e0
push eax
push eax
push 0xa
call fcn.004159e0
push eax
mov edx, str.0000000000
call fcn.00415a90
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c2c4]
cdq
push edx
push eax
call fcn.0040c620
pop eax
call fcn.00415b32
add dword [esp], edx
call fcn.0040c6b0
push 0x49c26c
call fcn.00415a00
mov dword [0x49c268], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x49c268]
jl 0x4026ad
push 0
call fcn.004133d0
mov dword [0x49c2c4], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0
mov eax, dword [0x49c2c4]
cdq
push edx
push eax
call fcn.0040c260
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c2c4], eax
mov edx, dword [0x49c2a4]
call fcn.004159e0
push eax
call fcn.00415a90
call fcn.004159e0
push eax
push eax
push dword [0x49c2c4]
call fcn.0040c490
pop eax
push 0x49c2a4
call fcn.00415a00
inc dword [0x49c268]
jno 0x402621
push dword [0x49c2a4]
call fcn.0040b2f8
mov dword [0x49c2cc], eax
mov dword [0x49c268], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x49c268]
jl 0x402753
push 0
call fcn.004133d0
mov dword [0x49c2c4], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0
mov eax, dword [0x49c2c4]
cdq
push edx
push eax
call fcn.0040c260
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c2c4], eax
mov edx, dword [0x49c2a8]
call fcn.004159e0
push eax
call fcn.00415a90
call fcn.004159e0
push eax
push eax
push dword [0x49c2c4]
call fcn.0040c490
pop eax
push 0x49c2a8
call fcn.00415a00
inc dword [0x49c268]
jno 0x4026c7
push dword [0x49c2a8]
call fcn.0040b2f8
mov dword [0x49c2c4], eax
mov eax, dword [0x49c2c4]
mov dword [0x49c2d0], eax
mov dword [0x49c268], 0x3d1
mov eax, dword [0x49c2d0]
cmp eax, dword [0x49c268]
jl 0x40279b
push 0
call fcn.004133d0
mov dword [0x49c2c4], eax
inc dword [0x49c268]
jno 0x402777
mov eax, dword [0x49c2d0]
mov dword [0x49c268], eax
mov ebx, dword [0x49c2d0]
add ebx, 0x12
cmp ebx, dword [0x49c268]
jl 0x4027df
push 0
call fcn.004133d0
mov dword [0x49c2c4], eax
mov ebx, dword [0x49c2ac]
add ebx, dword [0x49c2c4]
mov dword [0x49c2ac], ebx
inc dword [0x49c268]
jno 0x4027a5
mov ebx, dword [0x49c2cc]
xor ebx, dword [0x49c2ac]
mov dword [0x49c2d4], ebx
mov ebx, dword [0x49c2d4]
and ebx, ebx
jne 0x402805
mov dword [0x49c2d4], 0x63
mov ebx, dword [0x49c2d4]
xor ebx, 0x98989898
mov dword [0x49c2d4], ebx
mov eax, dword [0x49c2c8]
mov dword [0x49c2d8], eax
mov ebx, dword [0x49c2c8]
cmp ebx, dword [0x49c2d4]
jne 0x402831
jmp 0x402836
call fcn.00408f17
jmp 0x40283d
call fcn.00408f17
mov ebx, dword [0x49c2bc]
cmp ebx, dword [0x49c2b4]
jne 0x40284d
jmp 0x402852
call fcn.00408f17
call sub.KERNEL32.dll_GetTickCount
mov dword [0x49c2dc], eax
mov ebx, dword [0x49c2dc]
sub ebx, dword [0x49c29c]
cmp ebx, 0x3e8
jle 0x402877
push 0x9099542
inc eax
ret
mov dword [0x49c2e0], 0x45a2a5
push 0x49c9c8
push 0
push 0x15
push 0x15
push 4
call fcn.004136e8
push 0x49c9d0
push 0
push 0x15
push 0x15
push 4
call fcn.004136e8
push 0x49c9d8
push 0
push 0x15
push 0x15
push 4
call fcn.004136e8
push 0x49c9e0
push 0
push 0x15
push 0x15
push 4
call fcn.004136e8
push 0x49c9e8
push 0
push 0x15
push 0x15
push 4
call fcn.004136e8
push 0x49c9f0
push 0
push 0x15
push 0x15
push 4
call fcn.004136e8
push 0x49c9f8
push 0
push 0x15
push 0xa
push 4
call fcn.004136e8
push 0x3e8
call fcn.0040ef80
mov dword [0x49c28c], eax
push 0x3e8
call fcn.0040ef80
mov dword [0x49c2e4], eax
mov dword [0x49c268], 1
mov eax, 0x14
cmp eax, dword [0x49c268]
jl 0x4029d5
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9d0]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9d8]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9e0]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x49c268]
jno 0x40297b
mov ebp, dword [0x49c9f8]
mov dword [ebp], 0xcc
mov dword [ebp + 4], 0xffffff
mov dword [ebp + 8], 0xcc0000
mov dword [ebp + 0xc], 0xaa00
mov dword [ebp + 0x10], 0x55ee
mov dword [ebp + 0x14], 0xccff
mov dword [ebp + 0x18], 0x2255
mov dword [ebp + 0x1c], 0x770044
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0x6633ff
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 1
push 1
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c2d4]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415b32
add dword [esp], edx
call fcn.0040c720
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c2e8], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 1
push 2
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c2d4]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415b32
add dword [esp], edx
call fcn.0040c720
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c2ec], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 1
push 3
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c2d4]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415b32
add dword [esp], edx
call fcn.0040c720
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c2f0], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 1
push 4
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c2d4]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415b32
add dword [esp], edx
call fcn.0040c720
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c2f4], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 1
push 5
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c2d4]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415b32
add dword [esp], edx
call fcn.0040c720
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c2f8], eax
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0
call fcn.00413a18
mov ebx, dword [0x49c2e8]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1ea
call fcn.00413aaf
mov ebx, dword [0x49c2ec]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1ed
call fcn.00413aaf
mov ebx, dword [0x49c2f0]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1f0
call fcn.00413aaf
mov ebx, dword [0x49c2f4]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1f3
call fcn.00413aaf
mov ebx, dword [0x49c2f8]
shl ebx, 2
push dword [ebp + ebx]
push 2
push 2
push 0x144
push 0x1f6
call fcn.00413aaf
call fcn.004139b8
mov edx, str.Template
lea ecx, [0x49c314]
call fcn.0040c008
call fcn.004159e0
push eax
push eax
call fcn.00412be4
push 0x49c2fc
call fcn.00415a00
call fcn.0040908b
call fcn.00409bfb
call fcn.0040908b
call fcn.00408fb0
call fcn.004099c5
call fcn.00408fb0
call fcn.00408256
call fcn.004159e0
push eax
mov edx, dword [0x49c2fc]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.CH.dll
call fcn.00415a90
call fcn.00415af0
push 0
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413010
call fcn.00415b50
and eax, eax
je 0x402d3f
mov ebp, 0x48bd56
mov ebx, ebp
mov ebp, 0x48b156
sub ebx, ebp
push ebx
mov ebp, 0x48b156
push ebp
push 0
call fcn.00413070
push 0
call fcn.00412e60
jmp 0x402d3f
call fcn.004159e0
push eax
mov edx, dword [0x49c2fc]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, str.help.txt
call fcn.00415a90
call fcn.00415af0
push 0
call fcn.00415b32
add dword [esp + 4], edx
call fcn.00413010
call fcn.00415b50
and eax, eax
je 0x402dac
mov ebp, 0x48a590
mov ebx, ebp
mov ebp, 0x488b72
sub ebx, ebp
push ebx
mov ebp, 0x488b72
push ebp
push 0
call fcn.00413070
push 0
call fcn.00412e60
jmp 0x402dbb
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040e755
push str.CH_Trainer_Keys.dat
push 0
call fcn.00413050
mov dword [0x49c22c], eax
mov ebx, dword [0x49c22c]
and ebx, ebx
jle 0x402ded
mov dword [0x49c32c], 1
push 0
call fcn.00412e60
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
and eax, eax
je 0x402e02
jmp 0x402e31
push dword [0x49c2d8]
call fcn.0040a47e
mov ebx, eax
and ebx, ebx
jne 0x402e31
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040e726
jmp 0x40a0e9
call fcn.004159e0
push eax
push eax
call fcn.00412be4
mov edx, str.black.txt
call fcn.00415a90
push 0x49c330
call fcn.00415a00
mov ebx, dword [0x49c334]
and ebx, ebx
jle 0x402f13
call fcn.004159e0
push eax
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.00415a90
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c2d8]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.0040c620
pop eax
mov edx, str..zip
call fcn.00415a90
push 0x49c338
call fcn.00415a00
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x49c33c]
call fcn.0040c008
mov edx, dword [0x49c338]
call fcn.004159e0
push eax
call fcn.00415a90
push 0x49c340
call fcn.00415a00
mov edx, dword [0x49c33c]
call fcn.004159e0
push eax
call fcn.00415a90
push 0x49c344
call fcn.00415a00
push 0
push 0
mov eax, dword [0x49c330]
push eax
mov eax, dword [0x49c344]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x49c348], eax
call fcn.004159e0
push eax
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.00415a90
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c2d8]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.0040c620
pop eax
mov edx, str..zip
call fcn.00415a90
push 0x49c338
call fcn.00415a00
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x49c33c]
call fcn.0040c008
mov edx, dword [0x49c338]
call fcn.004159e0
push eax
call fcn.00415a90
push 0x49c340
call fcn.00415a00
mov edx, dword [0x49c33c]
call fcn.004159e0
push eax
call fcn.00415a90
push 0x49c344
call fcn.00415a00
push 0
push 0
mov eax, dword [0x49c330]
push eax
mov eax, dword [0x49c344]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x49c348], eax
mov ebx, dword [0x49c348]
and ebx, ebx
jne 0x402fd3
jmp 0x403002
push dword [0x49c2d8]
call fcn.0040a47e
mov ebx, eax
and ebx, ebx
jne 0x403002
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040e726
jmp 0x40a0e9
push 0
push 0
mov eax, dword [0x49c330]
push eax
mov eax, dword [0x49c340]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x49c34c], eax
call fcn.004159e0
push eax
push eax
push 0x44f0ad
push str.IZnvZalZidZ_ZTraiZnerZ_UsZerZ
call fcn.0040c9a0
push 0x49c350
call fcn.00415a00
mov ebx, dword [0x49c34c]
and ebx, ebx
jne 0x403056
call fcn.00408f17
call fcn.004159e0
push eax
push eax
push str.ZTSA.l
push dword [0x49c350]
call fcn.0040c9a0
push 0x49c350
call fcn.00415a00
mov ebx, dword [0x49c34c]
and ebx, ebx
jne 0x4031d1
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00413f52
and eax, eax
je 0x4031c7
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 1
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040ed90
push eax
push dword [0x49c350]
push 0
push 0
call fcn.00413a2f
call fcn.004139b8
push 0
push 0x64
push 0x1f4
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0
call fcn.00413a18
push 0xff
push 0x28
push 0x28
mov eax, 0xff
call fcn.0040ed90
push eax
push 0x24
push 0x1df
push 1
push 0
call fcn.00413aaf
push 0x11
call fcn.00413a18
push 0x64
push 0x1f4
push 0xa
push 0xc8
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0xff
push 0
call fcn.00413f36
push eax
push 0
call fcn.0041174e
push eax
call fcn.0040a131
call fcn.00408256
jmp 0x403077
mov ebx, dword [0x49c348]
and ebx, ebx
je 0x4031f3
push dword [0x49c2d8]
call fcn.0040a47e
mov ebx, eax
and ebx, ebx
jne 0x4031f3
mov eax, 1
jmp 0x4031f5
xor eax, eax
and eax, eax
je 0x403203
mov dword [0x49c2e0], 0
mov dword [0x49c354], 3
lea ebp, [0x49c694]
lea eax, [ebp]
push eax
call sub.USER32.DLL_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x49c358]
mov ebx, dword [0x49c358]
cmp ebx, 1
jne 0x403247
mov edx, str.Run_game_and_press_F1_at_main_menu.__Numlock_is_ON.
lea ecx, [0x49c35c]
call fcn.0040c008
jmp 0x403257
mov edx, 0x44f280
lea ecx, [0x49c35c]
call fcn.0040c008
mov ebx, dword [0x49c354]
cmp ebx, dword [0x49c358]
je 0x4033b5
mov eax, dword [0x49c358]
mov dword [0x49c354], eax
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00413f52
and eax, eax
je 0x4033b5
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 1
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040ed90
push eax
push dword [0x49c35c]
push 0
push 0
call fcn.00413a2f
call fcn.004139b8
push 0
push 0x64
push 0x1f4
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0
call fcn.00413a18
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040ed90
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00413aaf
push 0x11
call fcn.00413a18
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0xff
push 0
call fcn.00413f36
push eax
push 0
call fcn.0041174e
push eax
call fcn.0040a131
call fcn.00408256
push 0xa
call fcn.0040eda9
push 0x70
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
and ebx, ebx
je 0x40320d
mov edx, str.LoF.exe
lea ecx, [0x49c278]
call fcn.0040c008
call fcn.00407624
mov ebx, dword [0x49c27c]
and ebx, ebx
jne 0x40356c
push 4
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
push 0x12c
call fcn.0040eda9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00413f52
and eax, eax
je 0x40355d
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 1
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040ed90
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.00413a2f
call fcn.004139b8
push 0
push 0x64
push 0x1f4
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0
call fcn.00413a18
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040ed90
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00413aaf
push 0x11
call fcn.00413a18
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0xff
push 0
call fcn.00413f36
push eax
push 0
call fcn.0041174e
push eax
call fcn.0040a131
push 0x7d0
call fcn.0040eda9
jmp 0x4031d1
mov edx, str.CH.dll
lea ecx, [0x49c360]
call fcn.0040c008
mov edx, dword [0x49c2fc]
call fcn.004159e0
push eax
call fcn.00415a90
mov edx, dword [0x49c360]
call fcn.00415a90
push 0x49c290
call fcn.00415a00
call fcn.00407669
mov edx, str.xlive.dll
lea ecx, [0x49c364]
call fcn.0040c008
call fcn.00407624
call fcn.00408153
call fcn.00408256
mov ebx, dword [0x49c320]
and ebx, ebx
jne 0x403728
mov ebx, dword [0x49c368]
and ebx, ebx
jne 0x403728
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00413f52
and eax, eax
je 0x403723
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 1
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040ed90
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.00413a2f
call fcn.004139b8
push 0
push 0x64
push 0x1f4
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0
call fcn.00413a18
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040ed90
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00413aaf
push 0x11
call fcn.00413a18
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0xff
push 0
call fcn.00413f36
push eax
push 0
call fcn.0041174e
push eax
call fcn.0040a131
jmp 0x4031d1
mov ebx, dword [0x49c2b8]
cmp ebx, dword [0x49c2c0]
jne 0x40374c
mov ebx, dword [0x49c2b8]
and ebx, ebx
je 0x40374c
mov ebx, dword [0x49c2c0]
and ebx, ebx
je 0x40374c
jmp 0x403753
mov eax, 1
jmp 0x403755
xor eax, eax
and eax, eax
je 0x4037ac
push 0xa
call fcn.0040ee69
mov ebx, eax
add ebx, 0xa
mov dword [0x49c36c], ebx
push 0x28
call fcn.0040ee69
mov ebx, eax
add ebx, 0x28
mov dword [0x49c370], ebx
mov ebx, dword [0x49c320]
add ebx, dword [0x49c36c]
mov dword [0x49c320], ebx
mov ebx, dword [0x49c368]
add ebx, dword [0x49c370]
mov dword [0x49c368], ebx
call fcn.00408f17
push 3
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00413f52
and eax, eax
je 0x403901
push 1
call fcn.00413e00
push eax
call fcn.00413925
push 1
call fcn.00412bc8
push eax
call fcn.00413a01
push 0x11
call fcn.00413a18
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040ed90
push eax
push str.Game_found__Trainer_Activated_
push 0
push 0
call fcn.00413a2f
call fcn.004139b8
push 0
push 0x64
push 0x1f4
push 1
call fcn.00414067
push 0
call fcn.00413e00
push eax
call fcn.00413925
push 0
call fcn.00413a18
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040ed90
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.00413aaf
push 0x11
call fcn.00413a18
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00413f36
push eax
call fcn.00413a7d
call fcn.004139b8
push 1
call fcn.00413aea
push 0xff
push 0
call fcn.00413f36
push eax
push 0
call fcn.0041174e
push eax
call fcn.0040a131
mov ebx, dword [0x49c374]
and ebx, ebx
je 0x403c0f
push 0x8b
mov ebx, dword [0x49c28c]
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xff
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x55
mov ebx, dword [0x49c28c]
add ebx, 2
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x8b
mov ebx, dword [0x49c28c]
add ebx, 3
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xec
mov ebx, dword [0x49c28c]
add ebx, 4
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x83
mov ebx, dword [0x49c28c]
add ebx, 5
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xec
mov ebx, dword [0x49c28c]
add ebx, 6
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x20
mov ebx, dword [0x49c28c]
add ebx, 7
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x53
mov ebx, dword [0x49c28c]
add ebx, 8
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x56
mov ebx, dword [0x49c28c]
add ebx, 9
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x57
mov ebx, dword [0x49c28c]
add ebx, 0xa
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x8d
mov ebx, dword [0x49c28c]
add ebx, 0xb
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x45
mov ebx, dword [0x49c28c]
add ebx, 0xc
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xe0
mov ebx, dword [0x49c28c]
add ebx, 0xd
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x33
mov ebx, dword [0x49c28c]
add ebx, 0xe
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xf6
mov ebx, dword [0x49c28c]
add ebx, 0xf
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x50
mov ebx, dword [0x49c28c]
add ebx, 0x10
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xff
mov ebx, dword [0x49c28c]
add ebx, 0x11
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x75
mov ebx, dword [0x49c28c]
add ebx, 0x12
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc
mov ebx, dword [0x49c28c]
add ebx, 0x13
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
mov ebx, dword [0x49c374]
add ebx, 0x1000
mov dword [0x49c268], ebx
mov ebx, dword [0x49c374]
add ebx, 0x200000
cmp ebx, dword [0x49c268]
jl 0x403c0f
push dword [0x49c288]
push 0x14
push dword [0x49c2e4]
push dword [0x49c268]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
push 0x14
push dword [0x49c2e4]
push dword [0x49c28c]
call fcn.0040efc0
mov dword [0x49c22c], eax
mov ebx, dword [0x49c22c]
cmp ebx, 1
jne 0x403c03
mov eax, dword [0x49c268]
mov dword [0x49c37c], eax
push 0xc2
mov ebx, dword [0x49c28c]
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 2
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push dword [0x49c288]
push 3
push dword [0x49c28c]
push dword [0x49c37c]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
inc dword [0x49c268]
jno 0x403b24
mov ebx, dword [0x49c334]
and ebx, ebx
jle 0x403c1e
jmp 0x40516e
mov ebx, dword [0x49c2e0]
cmp ebx, 0x45a2a5
jne 0x403d07
mov ebp, dword [0x49c9c8]
mov dword [ebp + 4], 0x70
mov dword [ebp + 8], 0x61
mov dword [ebp + 0xc], 0x62
mov dword [ebp + 0x10], 0x63
mov dword [ebp + 0x14], 0x64
mov dword [ebp + 0x18], 0x65
mov dword [ebp + 0x1c], 0x66
mov dword [ebp + 0x20], 0x67
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x50], 0
mov dword [0x49c268], 1
mov eax, 0x14
cmp eax, dword [0x49c268]
jl 0x403d07
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9e8]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x49c268]
jno 0x403ccc
push str.CH_Trainer_Keys.dat
push 0
call fcn.00413050
mov dword [0x49c22c], eax
mov ebx, dword [0x49c22c]
and ebx, ebx
jle 0x403e71
mov dword [0x49c32c], 1
push 0
call fcn.004133d0
mov dword [0x49c380], eax
mov dword [0x49c268], 1
mov eax, dword [0x49c380]
cmp eax, dword [0x49c268]
jl 0x403e67
call fcn.004159e0
push eax
push eax
push 0
call fcn.004130d0
push 0x49c384
call fcn.00415a00
push dword [0x49c384]
mov edx, 0x44f236
pop ecx
call fcn.00415b80
je 0x403da2
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9d0]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x49c384]
mov edx, str.CTRL
pop ecx
call fcn.00415b80
je 0x403dcc
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9d8]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x49c384]
mov edx, 0x44f3cd
pop ecx
call fcn.00415b80
je 0x403df6
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9e0]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.004133d0
push eax
mov ebx, dword [0x49c268]
mov ebp, dword [0x49c9c8]
shl ebx, 2
pop dword [ebp + ebx]
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0
mov ebx, dword [0x49c268]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.0040c260
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
push eax
mov ebx, dword [0x49c268]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x49c268]
jno 0x403d4c
push 0
call fcn.00412e60
mov ebx, dword [0x49c320]
add ebx, 0x52de60
mov dword [0x49c388], ebx
mov ebx, dword [0x49c320]
add ebx, 0x36b5e2
mov dword [0x49c38c], ebx
mov ebx, dword [0x49c320]
add ebx, 0x3b4d40
mov dword [0x49c390], ebx
mov ebx, dword [0x49c320]
add ebx, 0x1a7b7a
mov dword [0x49c394], ebx
push 0x89
mov ebx, dword [0x49c28c]
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x15
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 2
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x3f
mov ebx, dword [0x49c28c]
add ebx, 3
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xb7
mov ebx, dword [0x49c28c]
add ebx, 4
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 4
mov ebx, dword [0x49c28c]
add ebx, 5
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x89
mov ebx, dword [0x49c28c]
add ebx, 6
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x2d
mov ebx, dword [0x49c28c]
add ebx, 7
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 4
mov ebx, dword [0x49c28c]
add ebx, 8
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x3f
mov ebx, dword [0x49c28c]
add ebx, 9
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xb7
mov ebx, dword [0x49c28c]
add ebx, 0xa
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 4
mov ebx, dword [0x49c28c]
add ebx, 0xb
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xf
mov ebx, dword [0x49c28c]
add ebx, 0xc
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xbe
mov ebx, dword [0x49c28c]
add ebx, 0xd
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x11
mov ebx, dword [0x49c28c]
add ebx, 0xe
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x89
mov ebx, dword [0x49c28c]
add ebx, 0xf
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x54
mov ebx, dword [0x49c28c]
add ebx, 0x10
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x24
mov ebx, dword [0x49c28c]
add ebx, 0x11
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x2c
mov ebx, dword [0x49c28c]
add ebx, 0x12
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc3
mov ebx, dword [0x49c28c]
add ebx, 0x13
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x14
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x15
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x16
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x17
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x18
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x19
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x1a
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x1b
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x1c
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x1d
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x1e
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x1f
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x89
mov ebx, dword [0x49c28c]
add ebx, 0x20
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x35
mov ebx, dword [0x49c28c]
add ebx, 0x21
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 8
mov ebx, dword [0x49c28c]
add ebx, 0x22
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x3f
mov ebx, dword [0x49c28c]
add ebx, 0x23
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xb7
mov ebx, dword [0x49c28c]
add ebx, 0x24
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 4
mov ebx, dword [0x49c28c]
add ebx, 0x25
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x83
mov ebx, dword [0x49c28c]
add ebx, 0x26
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x3d
mov ebx, dword [0x49c28c]
add ebx, 0x27
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc
mov ebx, dword [0x49c28c]
add ebx, 0x28
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x3f
mov ebx, dword [0x49c28c]
add ebx, 0x29
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xb7
mov ebx, dword [0x49c28c]
add ebx, 0x2a
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 4
mov ebx, dword [0x49c28c]
add ebx, 0x2b
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 1
mov ebx, dword [0x49c28c]
add ebx, 0x2c
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x75
mov ebx, dword [0x49c28c]
add ebx, 0x2d
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 6
mov ebx, dword [0x49c28c]
add ebx, 0x2e
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xdd
mov ebx, dword [0x49c28c]
add ebx, 0x2f
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xd8
mov ebx, dword [0x49c28c]
add ebx, 0x30
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xd8
mov ebx, dword [0x49c28c]
add ebx, 0x31
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x46
mov ebx, dword [0x49c28c]
add ebx, 0x32
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc
mov ebx, dword [0x49c28c]
add ebx, 0x33
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc3
mov ebx, dword [0x49c28c]
add ebx, 0x34
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xd9
mov ebx, dword [0x49c28c]
add ebx, 0x35
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x5e
mov ebx, dword [0x49c28c]
add ebx, 0x36
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 8
mov ebx, dword [0x49c28c]
add ebx, 0x37
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xd8
mov ebx, dword [0x49c28c]
add ebx, 0x38
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x46
mov ebx, dword [0x49c28c]
add ebx, 0x39
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc
mov ebx, dword [0x49c28c]
add ebx, 0x3a
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc3
mov ebx, dword [0x49c28c]
add ebx, 0x3b
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x3c
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x3d
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x3e
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x3f
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xd9
mov ebx, dword [0x49c28c]
add ebx, 0x40
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x44
mov ebx, dword [0x49c28c]
add ebx, 0x41
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x24
mov ebx, dword [0x49c28c]
add ebx, 0x42
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 8
mov ebx, dword [0x49c28c]
add ebx, 0x43
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x83
mov ebx, dword [0x49c28c]
add ebx, 0x44
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x3d
mov ebx, dword [0x49c28c]
add ebx, 0x45
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x10
mov ebx, dword [0x49c28c]
add ebx, 0x46
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x3f
mov ebx, dword [0x49c28c]
add ebx, 0x47
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xb7
mov ebx, dword [0x49c28c]
add ebx, 0x48
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 4
mov ebx, dword [0x49c28c]
add ebx, 0x49
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 1
mov ebx, dword [0x49c28c]
add ebx, 0x4a
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x75
mov ebx, dword [0x49c28c]
add ebx, 0x4b
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 3
mov ebx, dword [0x49c28c]
add ebx, 0x4c
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xdd
mov ebx, dword [0x49c28c]
add ebx, 0x4d
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xd8
mov ebx, dword [0x49c28c]
add ebx, 0x4e
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc3
mov ebx, dword [0x49c28c]
add ebx, 0x4f
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xd9
mov ebx, dword [0x49c28c]
add ebx, 0x50
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x58
mov ebx, dword [0x49c28c]
add ebx, 0x51
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x48
mov ebx, dword [0x49c28c]
add ebx, 0x52
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc3
mov ebx, dword [0x49c28c]
add ebx, 0x53
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x54
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x55
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x56
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x57
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x58
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x59
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x5a
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x5b
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x5c
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x5d
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x5e
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x5f
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xd9
mov ebx, dword [0x49c28c]
add ebx, 0x60
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x91
mov ebx, dword [0x49c28c]
add ebx, 0x61
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x58
mov ebx, dword [0x49c28c]
add ebx, 0x62
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 1
mov ebx, dword [0x49c28c]
add ebx, 0x63
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x64
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x65
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x83
mov ebx, dword [0x49c28c]
add ebx, 0x66
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x3d
mov ebx, dword [0x49c28c]
add ebx, 0x67
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x14
mov ebx, dword [0x49c28c]
add ebx, 0x68
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x3f
mov ebx, dword [0x49c28c]
add ebx, 0x69
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xb7
mov ebx, dword [0x49c28c]
add ebx, 0x6a
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 4
mov ebx, dword [0x49c28c]
add ebx, 0x6b
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 1
mov ebx, dword [0x49c28c]
add ebx, 0x6c
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x75
mov ebx, dword [0x49c28c]
add ebx, 0x6d
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xa
mov ebx, dword [0x49c28c]
add ebx, 0x6e
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc7
mov ebx, dword [0x49c28c]
add ebx, 0x6f
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x81
mov ebx, dword [0x49c28c]
add ebx, 0x70
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x58
mov ebx, dword [0x49c28c]
add ebx, 0x71
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 1
mov ebx, dword [0x49c28c]
add ebx, 0x72
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x73
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x74
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x75
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x76
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc8
mov ebx, dword [0x49c28c]
add ebx, 0x77
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x42
mov ebx, dword [0x49c28c]
add ebx, 0x78
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push pe_nt_image_headers32
mov ebx, dword [0x49c28c]
add ebx, 0x79
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x7c
mov ebx, dword [0x49c28c]
add ebx, 0x7a
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x24
mov ebx, dword [0x49c28c]
add ebx, 0x7b
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x10
mov ebx, dword [0x49c28c]
add ebx, 0x7c
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0
mov ebx, dword [0x49c28c]
add ebx, 0x7d
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0xc3
mov ebx, dword [0x49c28c]
add ebx, 0x7e
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 0x7f
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push dword [0x49c288]
push 0x2ac
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x1091
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
mov ebx, dword [0x49c368]
add ebx, 0x3f00
push ebx
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x1093
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
mov ebx, dword [0x49c368]
add ebx, 0x3f04
push ebx
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x1099
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
mov ebx, dword [0x49c368]
add ebx, 0x3f08
push ebx
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x10b3
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
mov ebx, dword [0x49c368]
add ebx, 0x3f0c
push ebx
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x10b9
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
mov ebx, dword [0x49c368]
add ebx, 0x3f10
push ebx
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x10d7
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
mov ebx, dword [0x49c368]
add ebx, 0x3f14
push ebx
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x10f9
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 0xe8
mov ebx, dword [0x49c28c]
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 2
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 3
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 4
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 5
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 6
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
mov ebx, dword [0x49c368]
add ebx, 0x1091
sub ebx, dword [0x49c388]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 7
push dword [0x49c28c]
push dword [0x49c388]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 0xe8
mov ebx, dword [0x49c28c]
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 2
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 3
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 4
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 5
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
mov ebx, dword [0x49c368]
add ebx, 0x10b1
sub ebx, dword [0x49c38c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 6
push dword [0x49c28c]
push dword [0x49c38c]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 0xe8
mov ebx, dword [0x49c28c]
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 2
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 3
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 4
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 5
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 6
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
mov ebx, dword [0x49c368]
add ebx, 0x10d1
sub ebx, dword [0x49c390]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 7
push dword [0x49c28c]
push dword [0x49c390]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 0xe8
mov ebx, dword [0x49c28c]
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 2
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 3
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 4
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
push 0x90
mov ebx, dword [0x49c28c]
add ebx, 5
mov eax, ebx
call fcn.0040efb0
mov dword [0x49c22c], eax
mov ebx, dword [0x49c368]
add ebx, 0x10f1
sub ebx, dword [0x49c394]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49c28c]
inc ebx
mov eax, ebx
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 6
push dword [0x49c28c]
push dword [0x49c394]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
mov dword [0x49c398], 0
mov eax, 0xff
cmp eax, dword [0x49c398]
jl 0x405198
push dword [0x49c398]
call sub.USER32.DLL_GetAsyncKeyState
inc dword [0x49c398]
jno 0x405178
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4051a7
push 0x55009553
ret
mov ebp, dword [0x49c9c8]
push dword [ebp + 4]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 4]
mov ebp, dword [0x49c9c8]
push dword [ebp + 8]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 8]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0xc]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0xc]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x10]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x10]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x14]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x14]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x18]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x18]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x1c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x1c]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x20]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x20]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x24]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x24]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x28]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x28]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x2c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x2c]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x30]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x30]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x34]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x34]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x38]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x38]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x3c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x3c]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x40]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x40]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x44]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x44]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x48]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x48]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x4c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x4c]
mov ebp, dword [0x49c9c8]
push dword [ebp + 0x50]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49c9f0]
pop dword [ebp + 0x50]
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x49c39c], ebx
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x49c3a0], ebx
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x49c3a4], ebx
push 1
call fcn.0040eda9
push 0x32
call fcn.0040ee69
mov dword [0x49c3a8], eax
mov ebx, dword [0x49c3a8]
cmp ebx, 0x19
jne 0x4054ef
mov ebx, dword [0x49c2b8]
cmp ebx, dword [0x49c2c0]
jne 0x405476
mov ebx, dword [0x49c2b8]
and ebx, ebx
je 0x405476
mov ebx, dword [0x49c2c0]
and ebx, ebx
je 0x405476
jmp 0x40547d
mov eax, 1
jmp 0x40547f
xor eax, eax
and eax, eax
je 0x4054ef
push 0xff
call fcn.0040ee69
mov dword [0x49c36c], eax
push 0x190
call fcn.0040ee69
mov dword [0x49c370], eax
push dword [0x49c36c]
mov eax, dword [0x49c28c]
call fcn.0040efb0
mov dword [0x49c22c], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, dword [0x49c370]
add ebx, 0x1091
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.00408f17
mov dword [0x49c3ac], 1
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c3b0], eax
mov ebx, dword [0x49c3b0]
and ebx, ebx
je 0x40675a
push 0x12c
call fcn.0040eda9
push 0
call fcn.0040deb2
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f00
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040f060
mov ebx, eax
add ebx, 0x40
mov dword [0x49c3b4], ebx
mov ebx, dword [0x49c3b4]
add ebx, 0xf
mov dword [0x49c3b8], ebx
mov ebx, dword [0x49c3b4]
add ebx, 0xe
mov dword [0x49c3bc], ebx
mov ebx, dword [0x49c3b4]
add ebx, 0xd
mov dword [0x49c3c0], ebx
mov ebx, dword [0x49c3b4]
add ebx, 0xc
mov dword [0x49c3c4], ebx
mov ebx, dword [0x49c3b4]
add ebx, 0xb
mov dword [0x49c3c8], ebx
mov ebx, dword [0x49c3b4]
add ebx, 0xa
mov dword [0x49c3cc], ebx
mov ebx, dword [0x49c3b4]
add ebx, 9
mov dword [0x49c3d0], ebx
mov ebx, dword [0x49c3b4]
add ebx, 8
mov dword [0x49c3d4], ebx
mov ebx, dword [0x49c3b4]
add ebx, 7
mov dword [0x49c3d8], ebx
mov ebx, dword [0x49c3b4]
add ebx, 6
mov dword [0x49c3dc], ebx
mov ebx, dword [0x49c3b4]
add ebx, 4
mov dword [0x49c3e0], ebx
mov ebx, dword [0x49c3b4]
add ebx, 3
mov dword [0x49c3e4], ebx
mov ebx, dword [0x49c3b4]
add ebx, 2
mov dword [0x49c3e8], ebx
mov ebx, dword [0x49c3b4]
inc ebx
mov dword [0x49c3ec], ebx
mov ebx, dword [0x49c3b4]
mov dword [0x49c3f0], ebx
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3b8]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c3f4], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3bc]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c3f8], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3c0]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c3fc], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3c4]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c400], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3c8]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c404], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3cc]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c408], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3d0]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c40c], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3d4]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c410], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3d8]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c414], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3dc]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c418], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3e0]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c41c], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3e4]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c420], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3e8]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c424], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3ec]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c428], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3f0]
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040efa0
mov dword [0x49c42c], eax
push 0x80c80001
push str.Dragon_Age_Origins_Item_Editor
push 0x29e
push 0x226
push 0xc8
push 0x1c2
push 2
call fcn.0041172b
mov dword [0x49c22c], eax
push 2
call fcn.0041174e
push eax
call fcn.004109e1
push 0x10
push 0x44f27a
push 0
call fcn.00412bb2
and eax, eax
je 0x405a24
push 0
call fcn.00412bc8
push eax
push 0xffffffff
call fcn.004109e7
push str.Teamwork
push 0x28
push 0x132
push 0x14
push 0x14
push 0x32
call fcn.00410b94
push str.Determination
push 0x28
push 0x132
push 0x3c
push 0x14
push 0x33
call fcn.00410b94
push str.Leadership
push 0x28
push 0x132
push 0x64
push 0x14
push 0x34
call fcn.00410b94
push str.Creativity
push 0x28
push 0x132
push 0x8c
push 0x14
push 0x35
call fcn.00410b94
push str.Positioning
push 0x28
push 0x132
push 0xb4
push 0x14
push 0x36
call fcn.00410b94
push str.Dribbling
push 0x28
push 0x132
push 0xdc
push 0x14
push 0x37
call fcn.00410b94
push str.Marking
push 0x28
push 0x132
push 0x104
push 0x14
push 0x38
call fcn.00410b94
push str.Passing
push 0x28
push 0x132
push 0x12c
push 0x14
push 0x39
call fcn.00410b94
push str.FreeKicks
push 0x28
push 0x132
push 0x154
push 0x14
push 0x3a
call fcn.00410b94
push str.Finishing
push 0x28
push 0x132
push 0x17c
push 0x14
push 0x3b
call fcn.00410b94
push str.NaturalFitness
push 0x28
push 0x132
push 0x1a4
push 0x14
push 0x3c
call fcn.00410b94
push str.Strength
push 0x28
push 0x132
push 0x1cc
push 0x14
push 0x3d
call fcn.00410b94
push str.AerialAbility
push 0x28
push 0x132
push 0x1f4
push 0x14
push 0x3e
call fcn.00410b94
push str.Stamina
push 0x28
push 0x132
push 0x21c
push 0x14
push 0x3f
call fcn.00410b94
push str.Speed
push 0x28
push 0x132
push 0x244
push 0x14
push 0x40
call fcn.00410b94
push str.PRESS_F1_TO_CLOSE_WINDOW
push 0x28
push 0x190
push 0x26c
push 0x64
push 0x41
call fcn.00410b94
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c3f4]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x14
push 0x12c
push 0x46
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c3f8]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x3c
push 0x12c
push 0x47
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c3fc]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x64
push 0x12c
push 0x48
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c400]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x8c
push 0x12c
push 0x49
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c404]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0xb4
push 0x12c
push 0x4a
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c408]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0xdc
push 0x12c
push 0x4b
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c40c]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x104
push 0x12c
push 0x4c
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c410]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x12c
push 0x12c
push 0x4d
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c414]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x154
push 0x12c
push 0x4e
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c418]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x17c
push 0x12c
push 0x4f
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c41c]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x1a4
push 0x12c
push 0x50
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c420]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x1cc
push 0x12c
push 0x51
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c424]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x1f4
push 0x12c
push 0x52
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c428]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x21c
push 0x12c
push 0x53
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
call fcn.004159e0
push eax
push 0x2001
call fcn.004159e0
push eax
push eax
mov eax, dword [0x49c42c]
cdq
push edx
push eax
call fcn.0040c620
call fcn.00415af0
push 0x28
push 0xc8
push 0x244
push 0x12c
push 0x54
call fcn.00415b32
add dword [esp + 0x14], edx
call fcn.00410c6e
call fcn.00415b50
push 0xa
call fcn.0040eda9
call fcn.004117d6
mov dword [0x49c230], eax
push 0x70
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x406104
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x46
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c430], eax
push dword [0x49c430]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3b8]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x47
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c434], eax
push dword [0x49c434]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3bc]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x48
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c438], eax
push dword [0x49c438]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3c0]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x49
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c43c], eax
push dword [0x49c43c]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3c4]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x4a
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c440], eax
push dword [0x49c440]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3c8]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x4b
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c444], eax
push dword [0x49c444]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3cc]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x4c
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c448], eax
push dword [0x49c448]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3d0]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x4d
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c44c], eax
push dword [0x49c44c]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3d4]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x4e
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c450], eax
push dword [0x49c450]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3d8]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x4f
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c450], eax
push dword [0x49c450]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3dc]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push dword [0x49c288]
push 1
push dword [0x49c28c]
mov ebx, dword [0x49c3dc]
dec ebx
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x50
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c450], eax
push dword [0x49c450]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3e0]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x51
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c450], eax
push dword [0x49c450]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3e4]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x52
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c450], eax
push dword [0x49c450]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3e8]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x53
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c450], eax
push dword [0x49c450]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3ec]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
call fcn.004159e0
push eax
push eax
call fcn.004159e0
push eax
push 0x54
call fcn.00410d73
call fcn.00415b32
add dword [esp], edx
call fcn.0040c310
call fcn.00415b50
mov dword [0x49c450], eax
push dword [0x49c450]
mov eax, dword [0x49c28c]
call fcn.0040efb0
push dword [0x49c288]
push 1
push dword [0x49c28c]
push dword [0x49c3f0]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 2
call fcn.0041124d
push 0x12c
call fcn.0040eda9
push 1
call fcn.0040deb2
mov dword [0x49c3ac], 2
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c454], eax
mov ebx, dword [0x49c454]
and ebx, ebx
je 0x406880
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f04
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040f060
mov dword [0x49c3b4], eax
mov ebx, dword [0x49c3b4]
add ebx, 0x7e
mov dword [0x49c268], ebx
mov ebx, dword [0x49c3b4]
add ebx, 0xa6
cmp ebx, dword [0x49c268]
jl 0x40686c
push 0
mov eax, dword [0x49c28c]
call fcn.0040f070
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
push dword [0x49c268]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
add dword [0x49c268], 4
jno 0x406814
push 0
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
mov dword [0x49c3ac], 3
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c458], eax
mov ebx, dword [0x49c458]
and ebx, ebx
je 0x4069a9
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f04
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040f060
mov dword [0x49c3b4], eax
mov ebx, dword [0x49c3b4]
add ebx, 0xb9
mov dword [0x49c268], ebx
mov ebx, dword [0x49c3b4]
add ebx, 0xf5
cmp ebx, dword [0x49c268]
jl 0x406995
push 0
mov eax, dword [0x49c28c]
call fcn.0040f070
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
push dword [0x49c268]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
add dword [0x49c268], 4
jno 0x40693d
push 0
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
mov dword [0x49c3ac], 4
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c45c], eax
mov ebx, dword [0x49c45c]
and ebx, ebx
je 0x406ad2
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f04
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040f060
mov dword [0x49c3b4], eax
mov ebx, dword [0x49c3b4]
add ebx, 0xf9
mov dword [0x49c268], ebx
mov ebx, dword [0x49c3b4]
add ebx, 0x10d
cmp ebx, dword [0x49c268]
jl 0x406abe
push 0
mov eax, dword [0x49c28c]
call fcn.0040f070
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
push dword [0x49c268]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
add dword [0x49c268], 4
jno 0x406a66
push 0
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
mov dword [0x49c3ac], 5
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c460], eax
mov ebx, dword [0x49c460]
and ebx, ebx
je 0x406c1a
push dword [0x49c464]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406baf
mov dword [0x49c464], 1
push 1
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f0c
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 0
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
jmp 0x406c19
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406c19
mov dword [0x49c464], 0
push 0
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f0c
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 1
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
pop eax
mov dword [0x49c3ac], 6
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c468], eax
mov ebx, dword [0x49c468]
and ebx, ebx
je 0x406d1a
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f08
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49c22c], eax
mov eax, dword [0x49c28c]
call fcn.0040f060
mov ebx, eax
add ebx, 8
mov dword [0x49c3b4], ebx
push 0x47629000
mov eax, dword [0x49c28c]
call fcn.0040f070
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
push dword [0x49c3b4]
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 0
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
mov dword [0x49c3ac], 7
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c46c], eax
mov ebx, dword [0x49c46c]
and ebx, ebx
je 0x406e62
push dword [0x49c470]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406df7
mov dword [0x49c470], 1
push 1
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f10
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 0
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
jmp 0x406e61
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406e61
mov dword [0x49c470], 0
push 0
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f10
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 1
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
pop eax
mov dword [0x49c3ac], 8
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c474], eax
mov ebx, dword [0x49c474]
and ebx, ebx
je 0x406faa
push dword [0x49c478]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406f3f
mov dword [0x49c478], 1
push 1
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f14
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 0
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
jmp 0x406fa9
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406fa9
mov dword [0x49c478], 0
push 0
mov eax, dword [0x49c28c]
call fcn.0040f050
mov dword [0x49c22c], eax
push dword [0x49c288]
push 4
push dword [0x49c28c]
mov ebx, dword [0x49c368]
add ebx, 0x3f14
push ebx
push dword [0x49c378]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49c22c], eax
push 1
call fcn.0040deb2
push 0x12c
call fcn.0040eda9
pop eax
mov dword [0x49c3ac], 9
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c47c], eax
mov ebx, dword [0x49c47c]
and ebx, ebx
je 0x407014
mov dword [0x49c3ac], 0xa
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c480], eax
mov ebx, dword [0x49c480]
and ebx, ebx
je 0x40707e
mov dword [0x49c3ac], 0xb
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c484], eax
mov ebx, dword [0x49c484]
and ebx, ebx
je 0x4070e8
mov dword [0x49c3ac], 0xc
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c488], eax
mov ebx, dword [0x49c488]
and ebx, ebx
je 0x407152
mov dword [0x49c3ac], 0xd
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c48c], eax
mov ebx, dword [0x49c48c]
and ebx, ebx
je 0x4071bc
mov dword [0x49c3ac], 0xe
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c490], eax
mov ebx, dword [0x49c490]
and ebx, ebx
je 0x407226
mov dword [0x49c3ac], 0xf
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c494], eax
mov ebx, dword [0x49c494]
and ebx, ebx
je 0x407290
mov dword [0x49c3ac], 0x10
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c498], eax
mov ebx, dword [0x49c498]
and ebx, ebx
je 0x4072fa
mov dword [0x49c3ac], 0x11
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c49c], eax
mov ebx, dword [0x49c49c]
and ebx, ebx
je 0x407364
mov dword [0x49c3ac], 0x12
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c4a0], eax
mov ebx, dword [0x49c4a0]
and ebx, ebx
je 0x4073ce
mov dword [0x49c3ac], 0x13
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c4a4], eax
mov ebx, dword [0x49c4a4]
and ebx, ebx
je 0x407438
mov dword [0x49c3ac], 0x14
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9e0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d8]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9d0]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49c3ac]
mov ebp, dword [0x49c9c8]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040a821
mov dword [0x49c4a8], eax
mov ebx, dword [0x49c4a8]
and ebx, ebx
je 0x4074a2
mov dword [0x49c3b0], 0
mov dword [0x49c454], 0
mov dword [0x49c458], 0
mov dword [0x49c45c], 0
mov dword [0x49c460], 0
mov dword [0x49c468], 0
mov dword [0x49c46c], 0
mov dword [0x49c474], 0
mov dword [0x49c47c], 0
mov dword [0x49c480], 0
mov dword [0x49c484], 0
mov dword [0x49c488], 0
mov dword [0x49c48c], 0
mov dword [0x49c490], 0
mov dword [0x49c494], 0
mov dword [0x49c498], 0
mov dword [0x49c49c], 0
mov dword [0x49c4a0], 0
mov dword [0x49c4a4], 0
mov dword [0x49c4a8], 0
mov ebx, dword [0x49c2e0]
cmp ebx, 0x45a2a5
je 0x407587
push 0
push 3
call fcn.00410dd9
call fcn.00408256
push 1
call fcn.0040eda9
mov ebx, dword [0x49c2b8]
cmp ebx, dword [0x49c2c0]
jne 0x4075ba
mov ebx, dword [0x49c2b8]
and ebx, ebx
je 0x4075ba
mov ebx, dword [0x49c2c0]
and ebx, ebx
je 0x4075ba
jmp 0x4075c1
mov eax, 1
jmp 0x4075c3
xor eax, eax
and eax, eax
je 0x40761f
push 0xa
call fcn.0040ee69
mov ebx, eax
add ebx, 0xa
mov dword [0x49c36c], ebx
push 0x28
call fcn.0040ee69
mov ebx, eax
add ebx, 0x28
mov dword [0x49c370], ebx
mov ebx, dword [0x49c320]
add ebx, dword [0x49c36c]
mov dword [0x49c320], ebx
mov ebx, dword [0x49c368]
add ebx, dword [0x49c370]
mov dword [0x49c368], ebx
call fcn.00408f17
jmp 0x403e71
jmp 0x40516e
push 0
call 0x40a103
push dword [0x49c21c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040dfad
call fcn.0040ef70
call fcn.0040f22b
call fcn.0040f7bf
call fcn.0041133b
call fcn.00412a8e
call fcn.00412ec0
call fcn.00413b35
call fcn.0041479e
ret