Function at 0x401000
Capabilities:
Check for time delay via gettickcount
Check internet connectivity via wininet
Download url
Log keystrokes via polling
Parse pe header
Receive data

Disassembly:
push 0x32c
push 0
push 0x54e918
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x54e91c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x54e918], eax
call fcn.0040b240
call fcn.0040b1c4
call fcn.0040a860
call fcn.004095e8
call fcn.00408da2
call fcn.00408c7a
call fcn.004086bf
call fcn.004080a5
call fcn.00407fa0
call fcn.00407903
call fcn.004077c7
call fcn.00406b8b
call fcn.00408600
call fcn.00406cb0
mov dword [0x54e924], eax
mov ebp, str.RIFFp
push ebp
push 0
call fcn.00407122
mov ebp, 0x49d27b
push ebp
push 1
call fcn.00407122
mov ebp, str.RIFF
push ebp
push 3
call fcn.00407122
mov ebp, str.RIFF__f
push ebp
push 4
call fcn.00407122
mov ebp, str.RIFF__
push ebp
push 5
call fcn.00407122
mov ebp, str.RIFF_f_
push ebp
push 6
call fcn.00407122
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4010fa
push 0x75009553
inc ecx
ret
call sub.KERNEL32.dll_GetTickCount
mov dword [0x54e93c], eax
mov eax, dword [0x54f064]
push eax
push eax
call fcn.0040791f
lea ecx, [0x54e940]
pop edx
call fcn.00406000
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54e940]
call fcn.00407ee7
lea ecx, [0x54e940]
pop edx
call fcn.00406000
mov edx, 0x41601c
lea ecx, [0x54e944]
call fcn.00406018
mov edx, 0x41601c
lea ecx, [0x54e948]
call fcn.00406018
mov edx, 0x41601c
lea ecx, [0x54e94c]
call fcn.00406018
mov dword [0x54e950], 0
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54f064]
call fcn.0040791f
inc dword [0x54f064]
push 0
mov edx, dword [0x54d7f0]
add dword [esp + 4], edx
call fcn.0040aa50
pop dword [0x54f064]
push 0
call fcn.0040aa70
mov dword [0x54e954], eax
mov dword [0x54e958], 1
mov ebx, dword [0x54e954]
add ebx, 0xfffffff8
cmp ebx, dword [0x54e958]
jl 0x4011fc
push 0
call fcn.0040aae0
mov byte [0x54eb08], al
mov ebx, dword [0x54e95c]
movzx eax, byte [0x54eb08]
add ebx, eax
mov dword [0x54e95c], ebx
inc dword [0x54e958]
jmp 0x4011bf
push 0
call fcn.0040ab40
mov dword [0x54e960], eax
push 0
call fcn.0040ab40
mov dword [0x54e964], eax
push 0
call fcn.0040a7f0
mov eax, dword [0x54e95c]
mov dword [0x54e968], eax
push dword [0x54e940]
push 0
call fcn.0040aa50
mov ebx, eax
and ebx, ebx
jle 0x4015d3
mov dword [0x54e958], 1
mov eax, 0x3b8
cmp eax, dword [0x54e958]
jl 0x401276
push 0
call fcn.0040aba0
mov dword [0x54e96c], eax
inc dword [0x54e958]
jmp 0x401252
mov dword [0x54e958], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x54e958]
jl 0x401319
push 0
call fcn.0040aba0
mov dword [0x54e96c], eax
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54f064]
push 0
mov eax, dword [0x54e96c]
cdq
push edx
push eax
call fcn.00406630
inc dword [0x54f064]
mov edx, dword [0x54d7f0]
add dword [esp], edx
call fcn.00406130
pop dword [0x54f064]
mov dword [0x54e96c], eax
mov edx, dword [0x54e944]
push dword [0x54f064]
call fcn.0040b290
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54e96c]
call fcn.00406220
pop eax
lea ecx, [0x54e944]
pop edx
call fcn.00406000
inc dword [0x54e958]
jmp 0x401280
push dword [0x54e944]
call fcn.00404ffc
mov dword [0x54e96c], eax
mov ebx, dword [0x54e96c]
xor ebx, 0x98989898
mov dword [0x54e96c], ebx
mov eax, dword [0x54e96c]
mov dword [0x54e970], eax
mov eax, dword [0x54f064]
push eax
push eax
push 0xa
push dword [0x54f064]
mov edx, str.0000000000
call fcn.0040b290
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54e96c]
call fcn.00406240
pop eax
inc dword [0x54f064]
mov edx, dword [0x54d7f0]
add dword [esp], edx
call fcn.00406310
lea ecx, [0x54e944]
pop edx
call fcn.00406000
mov dword [0x54e958], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x54e958]
jl 0x401437
push 0
call fcn.0040aba0
mov dword [0x54e96c], eax
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54f064]
push 0
mov eax, dword [0x54e96c]
cdq
push edx
push eax
call fcn.00406630
inc dword [0x54f064]
mov edx, dword [0x54d7f0]
add dword [esp], edx
call fcn.00406130
pop dword [0x54f064]
mov dword [0x54e96c], eax
mov edx, dword [0x54e948]
push dword [0x54f064]
call fcn.0040b290
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54e96c]
call fcn.00406220
pop eax
lea ecx, [0x54e948]
pop edx
call fcn.00406000
inc dword [0x54e958]
jmp 0x40139e
push dword [0x54e948]
call fcn.00404ffc
mov dword [0x54e974], eax
mov dword [0x54e958], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x54e958]
jl 0x4014ea
push 0
call fcn.0040aba0
mov dword [0x54e96c], eax
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54f064]
push 0
mov eax, dword [0x54e96c]
cdq
push edx
push eax
call fcn.00406630
inc dword [0x54f064]
mov edx, dword [0x54d7f0]
add dword [esp], edx
call fcn.00406130
pop dword [0x54f064]
mov dword [0x54e96c], eax
mov edx, dword [0x54e94c]
push dword [0x54f064]
call fcn.0040b290
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54e96c]
call fcn.00406220
pop eax
lea ecx, [0x54e94c]
pop edx
call fcn.00406000
inc dword [0x54e958]
jmp 0x401451
push dword [0x54e94c]
call fcn.00404ffc
mov dword [0x54e96c], eax
mov eax, dword [0x54e96c]
mov dword [0x54e978], eax
mov dword [0x54e958], 0x3d1
mov ebx, dword [0x54e978]
dec ebx
cmp ebx, dword [0x54e958]
jl 0x401534
push 0
call fcn.0040aba0
mov dword [0x54e96c], eax
inc dword [0x54e958]
jmp 0x40150e
mov eax, dword [0x54e978]
mov dword [0x54e958], eax
mov ebx, dword [0x54e978]
add ebx, 0x12
cmp ebx, dword [0x54e958]
jl 0x401578
push 0
call fcn.0040aba0
mov dword [0x54e96c], eax
mov ebx, dword [0x54e950]
add ebx, dword [0x54e96c]
mov dword [0x54e950], ebx
inc dword [0x54e958]
jmp 0x40153e
mov ebx, dword [0x54e974]
xor ebx, dword [0x54e950]
mov dword [0x54e97c], ebx
mov ebx, dword [0x54e97c]
and ebx, ebx
jne 0x40159e
mov dword [0x54e97c], 0x63
mov ebx, dword [0x54e97c]
xor ebx, 0x98989898
mov dword [0x54e97c], ebx
mov eax, dword [0x54e970]
mov dword [0x54e980], eax
mov ebx, dword [0x54e970]
cmp ebx, dword [0x54e97c]
jne 0x4015ca
jmp 0x4015d1
push 0x75009553
inc ecx
ret
jmp 0x4015da
push 0x25001876
inc eax
ret
mov ebx, dword [0x54e964]
cmp ebx, dword [0x54e954]
jne 0x4015ea
jmp 0x4015f1
push 0x10047665
inc eax
ret
call sub.KERNEL32.dll_GetTickCount
mov dword [0x54e984], eax
mov ebx, dword [0x54e984]
sub ebx, dword [0x54e93c]
cmp ebx, 0x3e8
jle 0x401616
push 0x9099542
inc eax
ret
mov dword [0x54e988], 0x45a2a5
push 5
push 0x54ec0c
push 0
mov edx, dword [0x54ec0c]
call fcn.00406020
mov eax, 0x15
push 4
call fcn.00406040
push 5
push 0x54ec14
push 0
mov edx, dword [0x54ec14]
call fcn.00406020
mov eax, 0x15
push 4
call fcn.00406040
push 5
push 0x54ec1c
push 0
mov edx, dword [0x54ec1c]
call fcn.00406020
mov eax, 0x15
push 4
call fcn.00406040
push 5
push 0x54ec24
push 0
mov edx, dword [0x54ec24]
call fcn.00406020
mov eax, 0x15
push 4
call fcn.00406040
push 5
push 0x54ec2c
push 0
mov edx, dword [0x54ec2c]
call fcn.00406020
mov eax, 0x15
push 4
call fcn.00406040
push 0x3e8
call fcn.00407fd0
mov dword [0x54e98c], eax
mov dword [0x54e958], 1
mov eax, 0x14
cmp eax, dword [0x54e958]
jl 0x401760
mov ebx, dword [0x54e958]
mov ebp, dword [0x54ec14]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x54e958]
mov ebp, dword [0x54ec1c]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x54e958]
mov ebp, dword [0x54ec24]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x54e958]
jmp 0x401706
mov edx, 0x4163ac
lea ecx, [0x54e9a8]
call fcn.00406018
mov eax, dword [0x54f064]
push eax
push eax
call fcn.0040a73d
lea ecx, [0x54e990]
pop edx
call fcn.00406000
push dword [0x54f064]
mov edx, dword [0x54e990]
push dword [0x54f064]
call fcn.0040b290
mov edx, str.CH.dll
call fcn.0040b290
inc dword [0x54f064]
push 0
mov edx, dword [0x54d7f0]
add dword [esp + 4], edx
call fcn.0040a990
pop dword [0x54f064]
and eax, eax
je 0x4017f8
mov ebp, 0x54cd3b
mov ebx, ebp
mov ebp, 0x54c13b
sub ebx, ebp
push ebx
mov ebp, 0x54c13b
push ebp
push 0
call fcn.0040ac00
push 0
call fcn.0040a7f0
jmp 0x4017f8
push dword [0x54f064]
mov edx, dword [0x54e990]
push dword [0x54f064]
call fcn.0040b290
mov edx, str.help.txt
call fcn.0040b290
inc dword [0x54f064]
push 0
mov edx, dword [0x54d7f0]
add dword [esp + 4], edx
call fcn.0040a990
pop dword [0x54f064]
and eax, eax
je 0x401868
mov ebp, 0x54d7ed
mov ebx, ebp
mov ebp, 0x54cd3b
sub ebx, ebp
push ebx
mov ebp, 0x54cd3b
push ebp
push 0
call fcn.0040ac00
push 0
call fcn.0040a7f0
jmp 0x401877
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.00407804
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040aa50
mov dword [0x54e924], eax
mov ebx, dword [0x54e924]
and ebx, ebx
jle 0x4018a9
mov dword [0x54e9c0], 1
push 2
call fcn.0040a7f0
push 0x12c
call sub.KERNEL32.dll_Sleep
call fcn.00405170
push str.Authenticating_Trainer......
push 0
push 8
call fcn.00406c9a
push 0
push 0
call sub.WININET.dll_InternetGetConnectedState
and eax, eax
je 0x4018e1
jmp 0x40190d
push dword [0x54e980]
call fcn.004049ea
mov ebx, eax
and ebx, ebx
jne 0x40190d
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.004077d5
push 0x9099542
inc eax
ret
mov eax, dword [0x54f064]
push eax
push eax
call fcn.0040a73d
mov edx, str.black.txt
call fcn.0040b290
lea ecx, [0x54e9c4]
pop edx
call fcn.00406000
push dword [0x54f064]
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.0040b290
mov eax, dword [0x54f064]
push eax
push eax
mov ebx, dword [0x54e980]
xor ebx, 0x7b3d89b
push ebx
call fcn.00406240
pop eax
mov edx, str..zip
call fcn.0040b290
lea ecx, [0x54e9c8]
pop edx
call fcn.00406000
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x54e9cc]
call fcn.00406018
mov edx, dword [0x54e9c8]
push dword [0x54f064]
call fcn.0040b290
lea ecx, [0x54e9d0]
pop edx
call fcn.00406000
mov edx, dword [0x54e9cc]
push dword [0x54f064]
call fcn.0040b290
lea ecx, [0x54e9d4]
pop edx
call fcn.00406000
push 0
push 0
mov eax, dword [0x54e9c4]
push eax
mov eax, dword [0x54e9d4]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x54e9d8], eax
mov ebx, dword [0x54e9d8]
and ebx, ebx
jne 0x4019ea
jmp 0x401a16
push dword [0x54e980]
call fcn.004049ea
mov ebx, eax
and ebx, ebx
jne 0x401a16
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.004077d5
push 0x9099542
inc eax
ret
push 0
push 0
mov eax, dword [0x54e9c4]
push eax
mov eax, dword [0x54e9d0]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x54e9dc], eax
mov ebx, dword [0x54e9dc]
and ebx, ebx
jne 0x401a6f
push 0
push 3
call fcn.00408e12
push str.Invalid_Trainer_User
push 0
push 8
call fcn.00406c9a
call fcn.0040460f
jmp 0x401a3b
mov ebx, dword [0x54e9d8]
and ebx, ebx
je 0x401a91
push dword [0x54e980]
call fcn.004049ea
mov ebx, eax
and ebx, ebx
jne 0x401a91
mov eax, 1
jmp 0x401a93
xor eax, eax
and eax, eax
je 0x401aa1
mov dword [0x54e988], 0
lea ebp, [0x54eb0c]
lea eax, [ebp]
push eax
call sub.USER32.dll_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x54e9e0]
mov ebx, dword [0x54e9e0]
cmp ebx, 1
jne 0x401adb
mov edx, 0x416074
lea ecx, [0x54e9e4]
call fcn.00406018
jmp 0x401aeb
mov edx, str.OFF.
lea ecx, [0x54e9e4]
call fcn.00406018
mov eax, dword [0x54f064]
push eax
push eax
mov edx, str.Run_Game_and_then_press_F1_at_Main_Menu._Numlock_is
call fcn.0040b290
mov edx, dword [0x54e9e4]
call fcn.0040b290
inc dword [0x54f064]
push 0
push 8
mov edx, dword [0x54d7f0]
add dword [esp + 8], edx
call fcn.00406c9a
pop dword [0x54f064]
mov eax, 0x12c
call fcn.00407e39
mov dword [0x54e9e8], eax
mov ebx, dword [0x54e9e8]
cmp ebx, 0x63
jne 0x401bf6
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54f064]
call fcn.0040791f
inc dword [0x54f064]
push 0
mov edx, dword [0x54d7f0]
add dword [esp + 4], edx
call fcn.0040aa50
pop dword [0x54f064]
push 0
call fcn.0040aa70
mov dword [0x54e954], eax
mov dword [0x54e958], 1
mov ebx, dword [0x54e954]
add ebx, 0xfffffffc
cmp ebx, dword [0x54e958]
jl 0x401bbd
push 0
call fcn.0040aba0
mov dword [0x54e96c], eax
inc dword [0x54e958]
jmp 0x401b95
push 0
call fcn.0040ab40
mov dword [0x54e964], eax
push 0
call fcn.0040a7f0
mov ebx, dword [0x54e964]
cmp ebx, dword [0x54e954]
jne 0x401be6
jmp 0x401be9
inc eax
push esp
ret
mov ebx, dword [0x54e9dc]
and ebx, ebx
jne 0x401bf6
inc eax
push esp
ret
call fcn.0040460f
push 0xa
call sub.KERNEL32.dll_Sleep
push 0x70
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x401aa1
mov edx, str.SilentHill.exe
lea ecx, [0x54e9ec]
call fcn.00406018
call fcn.00403c21
mov ebx, dword [0x54e9f0]
and ebx, ebx
jne 0x401c74
push 0
push 4
call fcn.00407257
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0x12c
call sub.KERNEL32.dll_Sleep
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 8
call fcn.00406c9a
jmp 0x401a6f
mov edx, str.CH.dll
lea ecx, [0x54e9f4]
call fcn.00406018
mov edx, dword [0x54e990]
push dword [0x54f064]
call fcn.0040b290
mov edx, dword [0x54e9f4]
call fcn.0040b290
lea ecx, [0x54e9f8]
pop edx
call fcn.00406000
call fcn.00403c66
mov edx, str.g_SilentHill.sgl
lea ecx, [0x54e998]
call fcn.00406018
call fcn.00403c21
call fcn.0040458a
call fcn.0040460f
mov ebx, dword [0x54e9b4]
and ebx, ebx
jne 0x401cfd
mov ebx, dword [0x54e9fc]
and ebx, ebx
jne 0x401cfd
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 8
call fcn.00406c9a
jmp 0x401a6f
mov ebx, dword [0x54e960]
cmp ebx, dword [0x54e968]
jne 0x401d21
mov ebx, dword [0x54e960]
and ebx, ebx
je 0x401d21
mov ebx, dword [0x54e968]
and ebx, ebx
je 0x401d21
jmp 0x401d28
mov eax, 1
jmp 0x401d2a
xor eax, eax
and eax, eax
je 0x401d7c
mov eax, 0xa
call fcn.00407e39
mov ebx, eax
add ebx, 0xa
mov dword [0x54ea00], ebx
mov eax, 0x28
call fcn.00407e39
mov ebx, eax
add ebx, 0x28
mov dword [0x54ea04], ebx
mov ebx, dword [0x54e9b4]
add ebx, dword [0x54ea00]
mov dword [0x54e9b4], ebx
mov ebx, dword [0x54e9fc]
add ebx, dword [0x54ea04]
mov dword [0x54e9fc], ebx
push 0
push 3
call fcn.00407257
push 0x12c
call sub.KERNEL32.dll_Sleep
push str.Game_found__Trainer_Activated_
push 0
push 8
call fcn.00406c9a
mov ebx, dword [0x54e988]
cmp ebx, 0x45a2a5
jne 0x401e4d
mov ebp, dword [0x54ec0c]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0x64
mov dword [ebp + 0x14], 0
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x50], 0
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040aa50
mov dword [0x54e924], eax
mov ebx, dword [0x54e924]
and ebx, ebx
jle 0x401fc0
mov dword [0x54e9c0], 1
push 0
call fcn.0040aba0
mov dword [0x54ea08], eax
mov dword [0x54e958], 1
mov eax, dword [0x54ea08]
cmp eax, dword [0x54e958]
jl 0x401fb6
mov eax, dword [0x54f064]
push eax
push eax
push 0
call fcn.0040ac60
lea ecx, [0x54ea0c]
pop edx
call fcn.00406000
push dword [0x54ea0c]
mov edx, str.SHIFT
pop ecx
call fcn.0040b2f0
je 0x401eea
mov ebx, dword [0x54e958]
mov ebp, dword [0x54ec14]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x54ea0c]
mov edx, str.CTRL
pop ecx
call fcn.0040b2f0
je 0x401f14
mov ebx, dword [0x54e958]
mov ebp, dword [0x54ec1c]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x54ea0c]
mov edx, 0x4161fb
pop ecx
call fcn.0040b2f0
je 0x401f3e
mov ebx, dword [0x54e958]
mov ebp, dword [0x54ec24]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.0040aba0
push eax
mov ebx, dword [0x54e958]
mov ebp, dword [0x54ec0c]
shl ebx, 2
pop dword [ebp + ebx]
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54f064]
push 0
mov ebx, dword [0x54e958]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.00406630
inc dword [0x54f064]
mov edx, dword [0x54d7f0]
add dword [esp], edx
call fcn.00406130
pop dword [0x54f064]
push eax
mov ebx, dword [0x54e958]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x54e958]
jmp 0x401e92
push 0
call fcn.0040a7f0
push 0x8b
mov ebx, dword [0x54e98c]
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 7
mov ebx, dword [0x54e98c]
inc ebx
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x8b
mov ebx, dword [0x54e98c]
add ebx, 2
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x50
mov ebx, dword [0x54e98c]
add ebx, 3
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 4
mov ebx, dword [0x54e98c]
add ebx, 4
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x9c
mov ebx, dword [0x54e98c]
add ebx, 5
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x60
mov ebx, dword [0x54e98c]
add ebx, 6
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x83
mov ebx, dword [0x54e98c]
add ebx, 7
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x3d
mov ebx, dword [0x54e98c]
add ebx, 8
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 9
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x3f
mov ebx, dword [0x54e98c]
add ebx, 0xa
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x91
mov ebx, dword [0x54e98c]
add ebx, 0xb
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 8
mov ebx, dword [0x54e98c]
add ebx, 0xc
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 1
mov ebx, dword [0x54e98c]
add ebx, 0xd
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x75
mov ebx, dword [0x54e98c]
add ebx, 0xe
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x14
mov ebx, dword [0x54e98c]
add ebx, 0xf
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0xc7
mov ebx, dword [0x54e98c]
add ebx, 0x10
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x87
mov ebx, dword [0x54e98c]
add ebx, 0x11
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x68
mov ebx, dword [0x54e98c]
add ebx, 0x12
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 1
mov ebx, dword [0x54e98c]
add ebx, 0x13
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x14
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x15
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x16
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0xc0
mov ebx, dword [0x54e98c]
add ebx, 0x17
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x79
mov ebx, dword [0x54e98c]
add ebx, 0x18
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x44
mov ebx, dword [0x54e98c]
add ebx, 0x19
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0xc7
mov ebx, dword [0x54e98c]
add ebx, 0x1a
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x87
mov ebx, dword [0x54e98c]
add ebx, 0x1b
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x64
mov ebx, dword [0x54e98c]
add ebx, 0x1c
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 1
mov ebx, dword [0x54e98c]
add ebx, 0x1d
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x1e
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x1f
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x20
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0xc0
mov ebx, dword [0x54e98c]
add ebx, 0x21
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x79
mov ebx, dword [0x54e98c]
add ebx, 0x22
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x44
mov ebx, dword [0x54e98c]
add ebx, 0x23
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x61
mov ebx, dword [0x54e98c]
add ebx, 0x24
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x9d
mov ebx, dword [0x54e98c]
add ebx, 0x25
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0xc3
mov ebx, dword [0x54e98c]
add ebx, 0x26
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
add ebx, 0x27
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x28
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x29
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x2a
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x2b
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x2c
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x2d
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x2e
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x2f
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x8b
mov ebx, dword [0x54e98c]
add ebx, 0x30
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x4e
mov ebx, dword [0x54e98c]
add ebx, 0x31
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x6c
mov ebx, dword [0x54e98c]
add ebx, 0x32
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x9c
mov ebx, dword [0x54e98c]
add ebx, 0x33
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x60
mov ebx, dword [0x54e98c]
add ebx, 0x34
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x83
mov ebx, dword [0x54e98c]
add ebx, 0x35
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x3d
mov ebx, dword [0x54e98c]
add ebx, 0x36
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 4
mov ebx, dword [0x54e98c]
add ebx, 0x37
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x3f
mov ebx, dword [0x54e98c]
add ebx, 0x38
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x91
mov ebx, dword [0x54e98c]
add ebx, 0x39
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 8
mov ebx, dword [0x54e98c]
add ebx, 0x3a
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 1
mov ebx, dword [0x54e98c]
add ebx, 0x3b
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x75
mov ebx, dword [0x54e98c]
add ebx, 0x3c
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 7
mov ebx, dword [0x54e98c]
add ebx, 0x3d
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0xc7
mov ebx, dword [0x54e98c]
add ebx, 0x3e
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x43
mov ebx, dword [0x54e98c]
add ebx, 0x3f
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x1c
mov ebx, dword [0x54e98c]
add ebx, 0x40
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x63
mov ebx, dword [0x54e98c]
add ebx, 0x41
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x42
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x43
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0
mov ebx, dword [0x54e98c]
add ebx, 0x44
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x83
mov ebx, dword [0x54e98c]
add ebx, 0x45
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x3d
mov ebx, dword [0x54e98c]
add ebx, 0x46
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 8
mov ebx, dword [0x54e98c]
add ebx, 0x47
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x3f
mov ebx, dword [0x54e98c]
add ebx, 0x48
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x91
mov ebx, dword [0x54e98c]
add ebx, 0x49
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 8
mov ebx, dword [0x54e98c]
add ebx, 0x4a
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 1
mov ebx, dword [0x54e98c]
add ebx, 0x4b
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x75
mov ebx, dword [0x54e98c]
add ebx, 0x4c
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 6
mov ebx, dword [0x54e98c]
add ebx, 0x4d
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x8b
mov ebx, dword [0x54e98c]
add ebx, 0x4e
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x4b
mov ebx, dword [0x54e98c]
add ebx, 0x4f
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x18
mov ebx, dword [0x54e98c]
add ebx, 0x50
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x89
mov ebx, dword [0x54e98c]
add ebx, 0x51
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x4b
mov ebx, dword [0x54e98c]
add ebx, 0x52
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x14
mov ebx, dword [0x54e98c]
add ebx, 0x53
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x61
mov ebx, dword [0x54e98c]
add ebx, 0x54
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x9d
mov ebx, dword [0x54e98c]
add ebx, 0x55
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x8b
mov ebx, dword [0x54e98c]
add ebx, 0x56
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x43
mov ebx, dword [0x54e98c]
add ebx, 0x57
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x14
mov ebx, dword [0x54e98c]
add ebx, 0x58
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0xc3
mov ebx, dword [0x54e98c]
add ebx, 0x59
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push dword [0x54ea14]
push 0x5a
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, 0x1091
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
mov ebx, dword [0x54e9fc]
add ebx, 0x3f00
push ebx
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, 0x109a
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
mov ebx, dword [0x54e9fc]
add ebx, 0x3f04
push ebx
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, 0x10c8
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
mov ebx, dword [0x54e9fc]
add ebx, 0x3f08
push ebx
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, 0x10d8
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
push 0xe8
mov ebx, dword [0x54e98c]
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
inc ebx
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
add ebx, 2
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
add ebx, 3
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
add ebx, 4
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push dword [0x54ea14]
push 5
push dword [0x54e98c]
mov ebx, dword [0x54e9ac]
add ebx, 0x920695
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
mov ebx, dword [0x54e9fc]
add ebx, 0x1091
mov edi, dword [0x54e9ac]
add edi, 0x920695
sub ebx, edi
add ebx, 0xfffffffb
push ebx
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9ac]
add ebx, 0x920696
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
push 0xe8
mov ebx, dword [0x54e98c]
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
inc ebx
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
add ebx, 2
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
add ebx, 3
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
add ebx, 4
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
add ebx, 5
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push dword [0x54ea14]
push 6
push dword [0x54e98c]
mov ebx, dword [0x54e9ac]
add ebx, 0x92d542
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
mov ebx, dword [0x54e9fc]
add ebx, 0x10c1
mov edi, dword [0x54e9ac]
add edi, 0x92d542
sub ebx, edi
add ebx, 0xfffffffb
push ebx
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9ac]
add ebx, 0x92d543
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
mov dword [0x54ea18], 0
mov eax, 0xff
cmp eax, dword [0x54ea18]
jl 0x402c3b
push dword [0x54ea18]
call sub.USER32.dll_GetAsyncKeyState
inc dword [0x54ea18]
jmp 0x402c1b
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x402c4a
push 0x55009553
ret
mov ebp, dword [0x54ec0c]
push dword [ebp + 4]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 4]
mov ebp, dword [0x54ec0c]
push dword [ebp + 8]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 8]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0xc]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0xc]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x10]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x10]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x14]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x14]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x18]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x18]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x1c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x1c]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x20]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x20]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x24]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x24]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x28]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x28]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x2c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x2c]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x30]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x30]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x34]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x34]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x38]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x38]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x3c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x3c]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x40]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x40]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x44]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x44]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x48]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x48]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x4c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x4c]
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x50]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x54ec2c]
pop dword [ebp + 0x50]
push 0x10
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x54ea1c], eax
push 0x11
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x54ea20], eax
push 0x12
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x54ea24], eax
mov eax, 0x32
call fcn.00407e39
mov dword [0x54e9e8], eax
mov ebx, dword [0x54e9e8]
cmp ebx, 0x19
jne 0x402f0d
mov ebx, dword [0x54e960]
cmp ebx, dword [0x54e968]
jne 0x402e99
mov ebx, dword [0x54e960]
and ebx, ebx
je 0x402e99
mov ebx, dword [0x54e968]
and ebx, ebx
je 0x402e99
jmp 0x402ea0
mov eax, 1
jmp 0x402ea2
xor eax, eax
and eax, eax
je 0x402f0d
mov eax, 0xff
call fcn.00407e39
mov dword [0x54ea00], eax
mov eax, 0x190
call fcn.00407e39
mov dword [0x54ea04], eax
push dword [0x54ea00]
mov eax, dword [0x54e98c]
call fcn.00407f70
mov dword [0x54e924], eax
push dword [0x54ea14]
push 1
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, dword [0x54ea04]
add ebx, 0x1091
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
mov ebp, dword [0x54ec0c]
push dword [ebp + 4]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 4]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 4]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 4]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea28], ebx
mov ebx, dword [0x54ea28]
and ebx, ebx
je 0x40304b
push dword [0x54ea2c]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x402fdb
mov dword [0x54ea2c], 1
push 1
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, 0x3f00
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.00407257
jmp 0x40304a
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40304a
mov dword [0x54ea2c], 0
push 0
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, 0x3f00
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 1
call fcn.00407257
pop eax
mov ebp, dword [0x54ec0c]
push dword [ebp + 8]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 8]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 8]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 8]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea30], ebx
mov ebx, dword [0x54ea30]
and ebx, ebx
je 0x403189
push dword [0x54ea34]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403119
mov dword [0x54ea34], 1
push 1
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, 0x3f04
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.00407257
jmp 0x403188
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403188
mov dword [0x54ea34], 0
push 0
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, 0x3f04
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 1
call fcn.00407257
pop eax
mov ebp, dword [0x54ec0c]
push dword [ebp + 0xc]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0xc]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0xc]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0xc]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea38], ebx
mov ebx, dword [0x54ea38]
and ebx, ebx
je 0x4032c7
push dword [0x54ea3c]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403257
mov dword [0x54ea3c], 1
push 1
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, 0x3f08
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.00407257
jmp 0x4032c6
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4032c6
mov dword [0x54ea3c], 0
push 0
mov eax, dword [0x54e98c]
call fcn.00407f80
mov dword [0x54e924], eax
push dword [0x54ea14]
push 4
push dword [0x54e98c]
mov ebx, dword [0x54e9fc]
add ebx, 0x3f08
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 1
call fcn.00407257
pop eax
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x10]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x10]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x10]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x10]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea40], ebx
mov ebx, dword [0x54ea40]
and ebx, ebx
je 0x40347a
push dword [0x54ea44]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4033d1
mov dword [0x54ea44], 1
push 0x90
mov ebx, dword [0x54e98c]
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
inc ebx
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x90
mov ebx, dword [0x54e98c]
add ebx, 2
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push dword [0x54ea14]
push 3
push dword [0x54e98c]
mov ebx, dword [0x54e9ac]
add ebx, 0x3187cf
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.00407257
jmp 0x403479
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403479
mov dword [0x54ea44], 0
push 0x89
mov ebx, dword [0x54e98c]
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x77
mov ebx, dword [0x54e98c]
inc ebx
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push 0x18
mov ebx, dword [0x54e98c]
add ebx, 2
mov eax, ebx
call fcn.00407f70
mov dword [0x54e924], eax
push dword [0x54ea14]
push 3
push dword [0x54e98c]
mov ebx, dword [0x54e9ac]
add ebx, 0x3187cf
push ebx
push dword [0x54ea10]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x54e924], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 1
call fcn.00407257
pop eax
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x14]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x14]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x14]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x14]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea48], ebx
mov ebx, dword [0x54ea48]
and ebx, ebx
je 0x4034d0
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x18]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x18]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x18]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x18]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea4c], ebx
mov ebx, dword [0x54ea4c]
and ebx, ebx
je 0x403526
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x1c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea50], ebx
mov ebx, dword [0x54ea50]
and ebx, ebx
je 0x40357c
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x20]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x20]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x20]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x20]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea54], ebx
mov ebx, dword [0x54ea54]
and ebx, ebx
je 0x4035d2
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x24]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x24]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x24]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x24]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea58], ebx
mov ebx, dword [0x54ea58]
and ebx, ebx
je 0x403628
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x28]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x28]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x28]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x28]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea5c], ebx
mov ebx, dword [0x54ea5c]
and ebx, ebx
je 0x40367e
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x2c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea60], ebx
mov ebx, dword [0x54ea60]
and ebx, ebx
je 0x4036d4
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x30]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x30]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x30]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x30]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea64], ebx
mov ebx, dword [0x54ea64]
and ebx, ebx
je 0x40372a
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x34]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x34]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x34]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x34]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea68], ebx
mov ebx, dword [0x54ea68]
and ebx, ebx
je 0x403780
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x38]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x38]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x38]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x38]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea6c], ebx
mov ebx, dword [0x54ea6c]
and ebx, ebx
je 0x4037d6
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x3c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea70], ebx
mov ebx, dword [0x54ea70]
and ebx, ebx
je 0x40382c
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x40]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x40]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x40]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x40]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea74], ebx
mov ebx, dword [0x54ea74]
and ebx, ebx
je 0x403882
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x44]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x44]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x44]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x44]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea78], ebx
mov ebx, dword [0x54ea78]
and ebx, ebx
je 0x4038d8
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x48]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x48]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x48]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x48]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea7c], ebx
mov ebx, dword [0x54ea7c]
and ebx, ebx
je 0x40392e
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x4c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea80], ebx
mov ebx, dword [0x54ea80]
and ebx, ebx
je 0x403984
mov ebp, dword [0x54ec0c]
push dword [ebp + 0x50]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x54ec14]
mov edi, dword [ebp + 0x50]
add edi, dword [0x54ea1c]
imul ebx, edi
mov ebp, dword [0x54ec1c]
mov edi, dword [ebp + 0x50]
add edi, dword [0x54ea20]
imul ebx, edi
mov ebp, dword [0x54ec24]
mov edi, dword [ebp + 0x50]
add edi, dword [0x54ea24]
imul ebx, edi
mov dword [0x54ea84], ebx
mov ebx, dword [0x54ea84]
and ebx, ebx
je 0x4039da
mov dword [0x54ea28], 0
mov dword [0x54ea30], 0
mov dword [0x54ea38], 0
mov dword [0x54ea40], 0
mov dword [0x54ea48], 0
mov dword [0x54ea4c], 0
mov dword [0x54ea50], 0
mov dword [0x54ea54], 0
mov dword [0x54ea58], 0
mov dword [0x54ea5c], 0
mov dword [0x54ea60], 0
mov dword [0x54ea64], 0
mov dword [0x54ea68], 0
mov dword [0x54ea6c], 0
mov dword [0x54ea70], 0
mov dword [0x54ea74], 0
mov dword [0x54ea78], 0
mov dword [0x54ea7c], 0
mov dword [0x54ea80], 0
mov dword [0x54ea84], 0
mov ebx, dword [0x54e988]
cmp ebx, 0x45a2a5
je 0x403abf
push 0
push 3
call fcn.00408e12
call fcn.0040460f
push 1
call sub.KERNEL32.dll_Sleep
mov eax, 0x12c
call fcn.00407e39
mov dword [0x54e9e8], eax
mov ebx, dword [0x54e9e8]
cmp ebx, 0x63
jne 0x403b98
mov eax, dword [0x54f064]
push eax
push eax
push dword [0x54f064]
call fcn.0040791f
inc dword [0x54f064]
push 0
mov edx, dword [0x54d7f0]
add dword [esp + 4], edx
call fcn.0040aa50
pop dword [0x54f064]
push 0
call fcn.0040aa70
mov dword [0x54e954], eax
mov dword [0x54e958], 1
mov ebx, dword [0x54e954]
add ebx, 0xfffffffc
cmp ebx, dword [0x54e958]
jl 0x403b5f
push 0
call fcn.0040aba0
mov dword [0x54e96c], eax
inc dword [0x54e958]
jmp 0x403b37
push 0
call fcn.0040ab40
mov dword [0x54e964], eax
push 0
call fcn.0040a7f0
mov ebx, dword [0x54e964]
cmp ebx, dword [0x54e954]
jne 0x403b88
jmp 0x403b8b
inc eax
push esp
ret
mov ebx, dword [0x54e9dc]
and ebx, ebx
jne 0x403b98
inc eax
push esp
ret
mov ebx, dword [0x54e960]
cmp ebx, dword [0x54e968]
jne 0x403bbc
mov ebx, dword [0x54e960]
and ebx, ebx
je 0x403bbc
mov ebx, dword [0x54e968]
and ebx, ebx
je 0x403bbc
jmp 0x403bc3
mov eax, 1
jmp 0x403bc5
xor eax, eax
and eax, eax
je 0x403c1c
mov eax, 0xa
call fcn.00407e39
mov ebx, eax
add ebx, 0xa
mov dword [0x54ea00], ebx
mov eax, 0x28
call fcn.00407e39
mov ebx, eax
add ebx, 0x28
mov dword [0x54ea04], ebx
mov ebx, dword [0x54e9b4]
add ebx, dword [0x54ea00]
mov dword [0x54e9b4], ebx
mov ebx, dword [0x54e9fc]
add ebx, dword [0x54ea04]
mov dword [0x54e9fc], ebx
jmp 0x401fc0
jmp 0x402c11