Function at 0x401000
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x4b8
push 0
push 0x48b200
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x48b204], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x48b200], eax
push 0x488983
pop dword [0x48b208]
call fcn.0040ccf0
call fcn.0040cbfb
call fcn.0040c2a0
call fcn.0040aff8
call fcn.0040a7b2
call fcn.0040a68a
call fcn.0040a0cf
call fcn.00409ba0
call fcn.00409a00
call fcn.00408dec
call fcn.00408cb0
call fcn.00408b8b
push 5
push 0x48b670
push 0
mov edx, dword [0x48b670]
call fcn.00408000
mov eax, 0x1a0b
push 4
call fcn.00408020
mov dword [0x48b20c], 1
mov eax, 0x258
cmp eax, dword [0x48b20c]
jl 0x4010ec
mov eax, 8
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x4010b9
mov dword [0x48b20c], 1
mov eax, 0x1f4
cmp eax, dword [0x48b20c]
jl 0x401129
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x4010f6
mov dword [0x48b20c], 1
mov eax, 0x190
cmp eax, dword [0x48b20c]
jl 0x401166
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x401133
mov dword [0x48b20c], 1
mov eax, 0x12c
cmp eax, dword [0x48b20c]
jl 0x4011a3
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x401170
mov dword [0x48b20c], 1
mov eax, 0x190
cmp eax, dword [0x48b20c]
jl 0x4011e0
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x4011ad
mov dword [0x48b20c], 1
mov eax, 0x1f4
cmp eax, dword [0x48b20c]
jl 0x40121d
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x4011ea
mov dword [0x48b20c], 1
mov eax, 0x258
cmp eax, dword [0x48b20c]
jl 0x40125a
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x401227
mov dword [0x48b20c], 1
mov eax, 0x258
cmp eax, dword [0x48b20c]
jl 0x401297
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x401264
mov dword [0x48b20c], 1
mov eax, 0x1f4
cmp eax, dword [0x48b20c]
jl 0x4012d4
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x4012a1
mov dword [0x48b20c], 1
mov eax, 0x190
cmp eax, dword [0x48b20c]
jl 0x401311
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x4012de
mov dword [0x48b20c], 1
mov eax, 0x12c
cmp eax, dword [0x48b20c]
jl 0x40134e
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x40131b
mov dword [0x48b20c], 1
mov eax, 0xc8
cmp eax, dword [0x48b20c]
jl 0x40138b
mov eax, 4
call fcn.00409879
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b670]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x401358
call fcn.0040a010
mov eax, dword [0x48b884]
push eax
push eax
call fcn.0040c14d
lea ecx, [0x48b210]
pop edx
call fcn.00408070
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.0.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c3d0
pop dword [0x48b884]
mov ebp, 0x47d423
mov ebx, ebp
mov ebp, 0x47b783
sub ebx, ebp
push ebx
mov ebp, 0x47b783
push ebp
push 0
call fcn.0040c4b0
push 0
call fcn.0040c230
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.1.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c3d0
pop dword [0x48b884]
mov ebp, 0x47ef43
mov ebx, ebp
mov ebp, 0x47d423
sub ebx, ebp
push ebx
mov ebp, 0x47d423
push ebp
push 0
call fcn.0040c4b0
push 0
call fcn.0040c230
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.3.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c3d0
pop dword [0x48b884]
mov ebp, 0x481f63
mov ebx, ebp
mov ebp, 0x47ef43
sub ebx, ebp
push ebx
mov ebp, 0x47ef43
push ebp
push 0
call fcn.0040c4b0
push 0
call fcn.0040c230
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.4.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c3d0
pop dword [0x48b884]
mov ebp, 0x486183
mov ebx, ebp
mov ebp, 0x481f63
sub ebx, ebp
push ebx
mov ebp, 0x481f63
push ebp
push 0
call fcn.0040c4b0
push 0
call fcn.0040c230
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.5.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c3d0
pop dword [0x48b884]
mov ebp, 0x487523
mov ebx, ebp
mov ebp, 0x486183
sub ebx, ebp
push ebx
mov ebp, 0x486183
push ebp
push 0
call fcn.0040c4b0
push 0
call fcn.0040c230
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.6.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c3d0
pop dword [0x48b884]
mov ebp, 0x488983
mov ebx, ebp
mov ebp, 0x487523
sub ebx, ebp
push ebx
mov ebp, 0x487523
push ebp
push 0
call fcn.0040c4b0
push 0
call fcn.0040c230
call fcn.00409359
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.0.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040938e
pop dword [0x48b884]
mov dword [0x48b214], eax
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.1.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 1
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040938e
pop dword [0x48b884]
mov dword [0x48b214], eax
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.3.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 3
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040938e
pop dword [0x48b884]
mov dword [0x48b214], eax
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.4.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 4
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040938e
pop dword [0x48b884]
mov dword [0x48b214], eax
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.5.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 5
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040938e
pop dword [0x48b884]
mov dword [0x48b214], eax
push dword [0x48b884]
mov edx, dword [0x48b210]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.6.mp3
call fcn.0040cd40
inc dword [0x48b884]
push 6
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040938e
pop dword [0x48b884]
mov dword [0x48b214], eax
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4017dd
push 0x75009553
inc ecx
ret
push 0x12c
call sub.KERNEL32.dll_Sleep
call fcn.00406eee
push str.Authenticating_Trainer......
push 0
push 8
call fcn.00408c9a
mov eax, dword [0x48b884]
push eax
push eax
mov eax, dword [0x48b884]
push eax
push eax
call fcn.00408e08
inc dword [0x48b884]
mov edx, dword [0x489f78]
add dword [esp], edx
call fcn.0040992d
lea ecx, [0x48b22c]
pop edx
call fcn.00408070
mov edx, dword [0x48b22c]
push dword [0x48b884]
call fcn.0040cd40
lea ecx, [0x48b230]
pop edx
call fcn.00408070
call sub.USER32.dll_GetForegroundWindow
mov dword [0x48b234], eax
push 0x48b238
push dword [0x48b234]
call sub.USER32.dll_GetWindowThreadProcessId
push dword [0x48b238]
push dword [0x48b240]
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x48b23c], eax
mov eax, dword [0x48b238]
mov dword [0x48b234], eax
push 0x3e8
call fcn.00409a30
mov dword [0x48b244], eax
mov edx, dword [0x48b230]
push dword [0x48b884]
call fcn.0040cd40
lea ecx, [0x48b248]
pop edx
call fcn.00408070
mov eax, dword [0x48b250]
mov dword [0x48b24c], eax
mov ebp, 0x488983
mov dword [0x48b20c], ebp
mov eax, dword [0x48b20c]
call fcn.004099b0
mov byte [0x48b568], al
mov ebp, 0x488986
mov dword [0x48b20c], ebp
mov ebp, 0x488986
mov ebx, ebp
add ebx, 0xbb8
cmp ebx, dword [0x48b20c]
jl 0x401978
mov eax, dword [0x48b20c]
call fcn.004099b0
mov byte [0x48b569], al
movsx ebx, byte [0x48b569]
xor bl, byte [0x48b568]
push ebx
pop eax
mov byte [0x48b56a], al
movsx ebx, byte [0x48b568]
add ebx, 0x37
push ebx
pop eax
mov byte [0x48b568], al
movsx ebx, byte [0x48b568]
cmp ebx, 0xff
jle 0x401956
movsx ebx, byte [0x48b568]
add ebx, 0xffffff01
push ebx
pop eax
mov byte [0x48b568], al
movsx eax, byte [0x48b56a]
push eax
mov eax, dword [0x48b20c]
call fcn.004099c0
mov dword [0x48b214], eax
inc dword [0x48b20c]
jmp 0x4018ea
call sub.KERNEL32.dll_GetTickCount
mov dword [0x48b254], eax
mov eax, dword [0x48b884]
push eax
push eax
call fcn.00408e08
lea ecx, [0x48b258]
pop edx
call fcn.00408070
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b258]
call fcn.0040992d
lea ecx, [0x48b258]
pop edx
call fcn.00408070
mov edx, 0x42401c
lea ecx, [0x48b25c]
call fcn.00408088
mov edx, 0x42401c
lea ecx, [0x48b260]
call fcn.00408088
mov edx, 0x42401c
lea ecx, [0x48b264]
call fcn.00408088
mov dword [0x48b268], 0
mov dword [0x48b26c], 0
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b884]
call fcn.00408e08
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c490
pop dword [0x48b884]
push 0
call fcn.0040c510
mov dword [0x48b270], eax
mov dword [0x48b20c], 1
mov ebx, dword [0x48b270]
add ebx, 0xfffffff8
cmp ebx, dword [0x48b20c]
jl 0x401a84
push 0
call fcn.0040c580
mov byte [0x48b56b], al
mov ebx, dword [0x48b26c]
movzx eax, byte [0x48b56b]
add ebx, eax
mov dword [0x48b26c], ebx
inc dword [0x48b20c]
jmp 0x401a47
push 0
call fcn.0040c5e0
mov dword [0x48b274], eax
push 0
call fcn.0040c5e0
mov dword [0x48b278], eax
push 0
call fcn.0040c230
mov eax, dword [0x48b26c]
mov dword [0x48b27c], eax
push dword [0x48b258]
push 0
call fcn.0040c490
mov ebx, eax
and ebx, ebx
jle 0x401e5e
mov dword [0x48b20c], 1
mov eax, 0x3b8
cmp eax, dword [0x48b20c]
jl 0x401afe
push 0
call fcn.0040c640
mov dword [0x48b280], eax
inc dword [0x48b20c]
jmp 0x401ada
mov dword [0x48b20c], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x48b20c]
jl 0x401ba1
push 0
call fcn.0040c640
mov dword [0x48b280], eax
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b884]
push 0
mov eax, dword [0x48b280]
cdq
push edx
push eax
call fcn.00408630
inc dword [0x48b884]
mov edx, dword [0x489f78]
add dword [esp], edx
call fcn.00408130
pop dword [0x48b884]
mov dword [0x48b280], eax
mov edx, dword [0x48b25c]
push dword [0x48b884]
call fcn.0040cd40
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b280]
call fcn.00408220
pop eax
lea ecx, [0x48b25c]
pop edx
call fcn.00408070
inc dword [0x48b20c]
jmp 0x401b08
push dword [0x48b25c]
call fcn.00406d7a
mov dword [0x48b280], eax
mov ebx, dword [0x48b280]
xor ebx, 0x98989898
mov dword [0x48b280], ebx
mov eax, dword [0x48b280]
mov dword [0x48b284], eax
mov eax, dword [0x48b884]
push eax
push eax
push 0xa
push dword [0x48b884]
mov edx, str.0000000000
call fcn.0040cd40
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b280]
call fcn.00408240
pop eax
inc dword [0x48b884]
mov edx, dword [0x489f78]
add dword [esp], edx
call fcn.00408310
lea ecx, [0x48b25c]
pop edx
call fcn.00408070
mov dword [0x48b20c], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x48b20c]
jl 0x401cbf
push 0
call fcn.0040c640
mov dword [0x48b280], eax
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b884]
push 0
mov eax, dword [0x48b280]
cdq
push edx
push eax
call fcn.00408630
inc dword [0x48b884]
mov edx, dword [0x489f78]
add dword [esp], edx
call fcn.00408130
pop dword [0x48b884]
mov dword [0x48b280], eax
mov edx, dword [0x48b260]
push dword [0x48b884]
call fcn.0040cd40
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b280]
call fcn.00408220
pop eax
lea ecx, [0x48b260]
pop edx
call fcn.00408070
inc dword [0x48b20c]
jmp 0x401c26
push dword [0x48b260]
call fcn.00406d7a
mov dword [0x48b288], eax
mov dword [0x48b20c], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x48b20c]
jl 0x401d72
push 0
call fcn.0040c640
mov dword [0x48b280], eax
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b884]
push 0
mov eax, dword [0x48b280]
cdq
push edx
push eax
call fcn.00408630
inc dword [0x48b884]
mov edx, dword [0x489f78]
add dword [esp], edx
call fcn.00408130
pop dword [0x48b884]
mov dword [0x48b280], eax
mov edx, dword [0x48b264]
push dword [0x48b884]
call fcn.0040cd40
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b280]
call fcn.00408220
pop eax
lea ecx, [0x48b264]
pop edx
call fcn.00408070
inc dword [0x48b20c]
jmp 0x401cd9
push dword [0x48b264]
call fcn.00406d7a
mov dword [0x48b280], eax
mov eax, dword [0x48b280]
mov dword [0x48b28c], eax
mov dword [0x48b20c], 0x3d1
mov ebx, dword [0x48b28c]
dec ebx
cmp ebx, dword [0x48b20c]
jl 0x401dbc
push 0
call fcn.0040c640
mov dword [0x48b280], eax
inc dword [0x48b20c]
jmp 0x401d96
mov eax, dword [0x48b28c]
mov dword [0x48b20c], eax
mov ebx, dword [0x48b28c]
add ebx, 0x12
cmp ebx, dword [0x48b20c]
jl 0x401e00
push 0
call fcn.0040c640
mov dword [0x48b280], eax
mov ebx, dword [0x48b268]
add ebx, dword [0x48b280]
mov dword [0x48b268], ebx
inc dword [0x48b20c]
jmp 0x401dc6
mov ebx, dword [0x48b288]
xor ebx, dword [0x48b268]
mov dword [0x48b290], ebx
mov ebx, dword [0x48b290]
and ebx, ebx
jne 0x401e26
mov dword [0x48b290], 0x63
mov ebx, dword [0x48b290]
xor ebx, 0x98989898
mov dword [0x48b290], ebx
mov eax, dword [0x48b284]
mov dword [0x48b294], eax
mov ebx, dword [0x48b284]
cmp ebx, dword [0x48b290]
jne 0x401e52
jmp 0x401e5c
jmp fcn.0040672a
jmp 0x401e68
jmp fcn.0040672a
mov ebx, dword [0x48b278]
cmp ebx, dword [0x48b270]
jne 0x401e78
jmp 0x401e82
jmp fcn.0040672a
call sub.KERNEL32.dll_GetTickCount
mov dword [0x48b298], eax
mov ebx, dword [0x48b298]
sub ebx, dword [0x48b254]
cmp ebx, 0x3e8
jle 0x401ea7
push 0x9099542
inc eax
ret
mov dword [0x48b29c], 0x45a2a5
push 5
push 0x48b678
push 0
mov edx, dword [0x48b678]
call fcn.00408000
mov eax, 0x15
push 4
call fcn.00408020
push 5
push 0x48b680
push 0
mov edx, dword [0x48b680]
call fcn.00408000
mov eax, 0x15
push 4
call fcn.00408020
push 5
push 0x48b688
push 0
mov edx, dword [0x48b688]
call fcn.00408000
mov eax, 0x15
push 4
call fcn.00408020
push 5
push 0x48b690
push 0
mov edx, dword [0x48b690]
call fcn.00408000
mov eax, 0x15
push 4
call fcn.00408020
push 5
push 0x48b698
push 0
mov edx, dword [0x48b698]
call fcn.00408000
mov eax, 0x15
push 4
call fcn.00408020
push 0x3e8
call fcn.00409a30
mov dword [0x48b244], eax
push 0x3e8
call fcn.00409a30
mov dword [0x48b2a0], eax
mov dword [0x48b20c], 1
mov eax, 0x14
cmp eax, dword [0x48b20c]
jl 0x402000
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b680]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b688]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b690]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x48b20c]
jmp 0x401fa6
mov edx, str.Template
lea ecx, [0x48b2bc]
call fcn.00408088
mov eax, dword [0x48b884]
push eax
push eax
call fcn.0040c14d
lea ecx, [0x48b2a4]
pop edx
call fcn.00408070
call fcn.00405695
call fcn.00406202
call fcn.00405695
call fcn.004055bb
call int.00405fd4
call fcn.004055bb
call fcn.00405224
push dword [0x48b884]
mov edx, dword [0x48b2a4]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.CH.dll
call fcn.0040cd40
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c3d0
pop dword [0x48b884]
and eax, eax
je 0x4020bb
mov ebp, 0x489586
mov ebx, ebp
mov ebp, 0x488986
sub ebx, ebp
push ebx
mov ebp, 0x488986
push ebp
push 0
call fcn.0040c4b0
push 0
call fcn.0040c230
jmp 0x4020bb
push dword [0x48b884]
mov edx, dword [0x48b2a4]
push dword [0x48b884]
call fcn.0040cd40
mov edx, str.help.txt
call fcn.0040cd40
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c3d0
pop dword [0x48b884]
and eax, eax
je 0x40212b
mov ebp, 0x489f75
mov ebx, ebp
mov ebp, 0x489586
sub ebx, ebp
push ebx
mov ebp, 0x489586
push ebp
push 0
call fcn.0040c4b0
push 0
call fcn.0040c230
jmp 0x40213a
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.00408ced
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040c490
mov dword [0x48b214], eax
mov ebx, dword [0x48b214]
and ebx, ebx
jle 0x40216c
mov dword [0x48b2d4], 1
push 0
call fcn.0040c230
push 0
push 0
call sub.WININET.dll_InternetGetConnectedState
and eax, eax
je 0x402181
jmp 0x4021b0
push dword [0x48b294]
call fcn.00406768
mov ebx, eax
and ebx, ebx
jne 0x4021b0
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.00408cbe
jmp fcn.0040672a
push str.Authenticating_Trainer......
push 0
push 8
call fcn.00408c9a
mov eax, dword [0x48b884]
push eax
push eax
call fcn.0040c14d
mov edx, str.black.txt
call fcn.0040cd40
lea ecx, [0x48b2d8]
pop edx
call fcn.00408070
mov ebx, dword [0x48b2dc]
and ebx, ebx
jle 0x4022a3
push dword [0x48b884]
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.0040cd40
mov eax, dword [0x48b884]
push eax
push eax
mov ebx, dword [0x48b294]
xor ebx, 0x7b3d89b
push ebx
call fcn.00408240
pop eax
mov edx, str..zip
call fcn.0040cd40
lea ecx, [0x48b2e0]
pop edx
call fcn.00408070
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x48b2e4]
call fcn.00408088
mov edx, dword [0x48b2e0]
push dword [0x48b884]
call fcn.0040cd40
lea ecx, [0x48b2e8]
pop edx
call fcn.00408070
mov edx, dword [0x48b2e4]
push dword [0x48b884]
call fcn.0040cd40
lea ecx, [0x48b2ec]
pop edx
call fcn.00408070
push 0
push 0
mov eax, dword [0x48b2d8]
push eax
mov eax, dword [0x48b2ec]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x48b2f0], eax
push dword [0x48b884]
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.0040cd40
mov eax, dword [0x48b884]
push eax
push eax
mov ebx, dword [0x48b294]
xor ebx, 0x7b3d89b
push ebx
call fcn.00408240
pop eax
mov edx, str..zip
call fcn.0040cd40
lea ecx, [0x48b2e0]
pop edx
call fcn.00408070
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x48b2e4]
call fcn.00408088
mov edx, dword [0x48b2e0]
push dword [0x48b884]
call fcn.0040cd40
lea ecx, [0x48b2e8]
pop edx
call fcn.00408070
mov edx, dword [0x48b2e4]
push dword [0x48b884]
call fcn.0040cd40
lea ecx, [0x48b2ec]
pop edx
call fcn.00408070
push 0
push 0
mov eax, dword [0x48b2d8]
push eax
mov eax, dword [0x48b2ec]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x48b2f0], eax
mov ebx, dword [0x48b2f0]
and ebx, ebx
jne 0x40235e
jmp 0x40238d
push dword [0x48b294]
call fcn.00406768
mov ebx, eax
and ebx, ebx
jne 0x40238d
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.00408cbe
jmp fcn.0040672a
push 0
push 0
mov eax, dword [0x48b2d8]
push eax
mov eax, dword [0x48b2e8]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x48b2f4], eax
mov ebx, dword [0x48b2f4]
and ebx, ebx
jne 0x4023eb
push 0
push 3
call fcn.0040a822
push str.Invalid_Trainer_User
push 0
push 8
call fcn.00408c9a
call fcn.00405224
call fcn.00405522
jmp 0x4023b2
mov ebx, dword [0x48b2f0]
and ebx, ebx
je 0x40240d
push dword [0x48b294]
call fcn.00406768
mov ebx, eax
and ebx, ebx
jne 0x40240d
mov eax, 1
jmp 0x40240f
xor eax, eax
and eax, eax
je 0x40241d
mov dword [0x48b29c], 0
lea ebp, [0x48b570]
lea eax, [ebp]
push eax
call sub.USER32.dll_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x48b2f8]
mov ebx, dword [0x48b2f8]
cmp ebx, 1
jne 0x402457
mov edx, 0x42407e
lea ecx, [0x48b2fc]
call fcn.00408088
jmp 0x402467
mov edx, str.OFF.
lea ecx, [0x48b2fc]
call fcn.00408088
mov eax, dword [0x48b884]
push eax
push eax
mov edx, str.Run_Game_and_then_press_F1_at_Main_Menu._Numlock_is
call fcn.0040cd40
mov edx, dword [0x48b2fc]
call fcn.0040cd40
inc dword [0x48b884]
push 0
push 8
mov edx, dword [0x489f78]
add dword [esp + 8], edx
call fcn.00408c9a
pop dword [0x48b884]
mov eax, 0x7530
call fcn.00409879
mov dword [0x48b300], eax
mov ebx, dword [0x48b300]
cmp ebx, 0x63
jne 0x402580
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b884]
call fcn.00408e08
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c490
pop dword [0x48b884]
push 0
call fcn.0040c510
mov dword [0x48b270], eax
mov dword [0x48b20c], 1
mov ebx, dword [0x48b270]
add ebx, 0xfffffffc
cmp ebx, dword [0x48b20c]
jl 0x402539
push 0
call fcn.0040c640
mov dword [0x48b280], eax
inc dword [0x48b20c]
jmp 0x402511
push 0
call fcn.0040c5e0
mov dword [0x48b278], eax
push 0
call fcn.0040c230
mov ebx, dword [0x48b278]
cmp ebx, dword [0x48b270]
jne 0x402562
jmp 0x40256c
jmp fcn.0040672a
mov ebx, dword [0x48b2f4]
and ebx, ebx
jne 0x402580
jmp fcn.0040672a
call fcn.00405224
push 0xa
call sub.KERNEL32.dll_Sleep
push 0x70
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x40241d
mov edx, str.sweaw.exe
lea ecx, [0x48b230]
call fcn.00408088
call fcn.00404462
mov ebx, dword [0x48b234]
and ebx, ebx
jne 0x4025fe
push 0
push 4
call fcn.00409502
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0x12c
call sub.KERNEL32.dll_Sleep
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 8
call fcn.00408c9a
jmp 0x4023eb
mov edx, str.CH.dll
lea ecx, [0x48b304]
call fcn.00408088
mov edx, dword [0x48b2a4]
push dword [0x48b884]
call fcn.0040cd40
mov edx, dword [0x48b304]
call fcn.0040cd40
lea ecx, [0x48b248]
pop edx
call fcn.00408070
call fcn.004044a7
mov edx, str.xlive.dll
lea ecx, [0x48b308]
call fcn.00408088
call fcn.00404462
call fcn.00405110
call fcn.00405224
mov ebx, dword [0x48b2c8]
and ebx, ebx
jne 0x402687
mov ebx, dword [0x48b30c]
and ebx, ebx
jne 0x402687
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 8
call fcn.00408c9a
jmp 0x4023eb
mov ebx, dword [0x48b274]
cmp ebx, dword [0x48b27c]
jne 0x4026ab
mov ebx, dword [0x48b274]
and ebx, ebx
je 0x4026ab
mov ebx, dword [0x48b27c]
and ebx, ebx
je 0x4026ab
jmp 0x4026b2
mov eax, 1
jmp 0x4026b4
xor eax, eax
and eax, eax
je 0x402710
mov eax, 0xa
call fcn.00409879
mov ebx, eax
add ebx, 0xa
mov dword [0x48b310], ebx
mov eax, 0x28
call fcn.00409879
mov ebx, eax
add ebx, 0x28
mov dword [0x48b314], ebx
mov ebx, dword [0x48b2c8]
add ebx, dword [0x48b310]
mov dword [0x48b2c8], ebx
mov ebx, dword [0x48b30c]
add ebx, dword [0x48b314]
mov dword [0x48b30c], ebx
jmp fcn.0040672a
push 0
push 3
call fcn.00409502
push 0x12c
call sub.KERNEL32.dll_Sleep
push str.Game_found__Trainer_Activated_
push 0
push 8
call fcn.00408c9a
mov ebx, dword [0x48b318]
and ebx, ebx
je 0x402a4a
push 0x8b
mov ebx, dword [0x48b244]
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xff
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x55
mov ebx, dword [0x48b244]
add ebx, 2
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x8b
mov ebx, dword [0x48b244]
add ebx, 3
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xec
mov ebx, dword [0x48b244]
add ebx, 4
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x83
mov ebx, dword [0x48b244]
add ebx, 5
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xec
mov ebx, dword [0x48b244]
add ebx, 6
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x20
mov ebx, dword [0x48b244]
add ebx, 7
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x53
mov ebx, dword [0x48b244]
add ebx, 8
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x56
mov ebx, dword [0x48b244]
add ebx, 9
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x57
mov ebx, dword [0x48b244]
add ebx, 0xa
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x8d
mov ebx, dword [0x48b244]
add ebx, 0xb
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x45
mov ebx, dword [0x48b244]
add ebx, 0xc
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xe0
mov ebx, dword [0x48b244]
add ebx, 0xd
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x33
mov ebx, dword [0x48b244]
add ebx, 0xe
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xf6
mov ebx, dword [0x48b244]
add ebx, 0xf
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x50
mov ebx, dword [0x48b244]
add ebx, 0x10
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xff
mov ebx, dword [0x48b244]
add ebx, 0x11
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x75
mov ebx, dword [0x48b244]
add ebx, 0x12
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xc
mov ebx, dword [0x48b244]
add ebx, 0x13
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
mov ebx, dword [0x48b318]
add ebx, 0x1000
mov dword [0x48b20c], ebx
mov ebx, dword [0x48b318]
add ebx, 0x200000
cmp ebx, dword [0x48b20c]
jl 0x402a4a
push dword [0x48b240]
push 0x14
push dword [0x48b2a0]
push dword [0x48b20c]
push dword [0x48b31c]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48b214], eax
push 0x14
push dword [0x48b2a0]
push dword [0x48b244]
call fcn.00409a50
mov dword [0x48b214], eax
mov ebx, dword [0x48b214]
cmp ebx, 1
jne 0x402a3f
mov eax, dword [0x48b20c]
mov dword [0x48b320], eax
push 0xc2
mov ebx, dword [0x48b244]
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xc
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0
mov ebx, dword [0x48b244]
add ebx, 2
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push dword [0x48b240]
push 3
push dword [0x48b244]
push dword [0x48b320]
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
inc dword [0x48b20c]
jmp 0x402960
mov ebx, dword [0x48b2dc]
and ebx, ebx
jle 0x402a59
jmp 0x4034d9
mov ebx, dword [0x48b29c]
cmp ebx, 0x45a2a5
jne 0x402afd
mov ebp, dword [0x48b678]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0x64
mov dword [ebp + 0x14], 0
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x50], 0
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040c490
mov dword [0x48b214], eax
mov ebx, dword [0x48b214]
and ebx, ebx
jle 0x402c70
mov dword [0x48b2d4], 1
push 0
call fcn.0040c640
mov dword [0x48b324], eax
mov dword [0x48b20c], 1
mov eax, dword [0x48b324]
cmp eax, dword [0x48b20c]
jl 0x402c66
mov eax, dword [0x48b884]
push eax
push eax
push 0
call fcn.0040c6a0
lea ecx, [0x48b328]
pop edx
call fcn.00408070
push dword [0x48b328]
mov edx, str.SHIFT
pop ecx
call fcn.0040cda0
je 0x402b9a
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b680]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x48b328]
mov edx, str.CTRL
pop ecx
call fcn.0040cda0
je 0x402bc4
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b688]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x48b328]
mov edx, 0x424219
pop ecx
call fcn.0040cda0
je 0x402bee
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b690]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.0040c640
push eax
mov ebx, dword [0x48b20c]
mov ebp, dword [0x48b678]
shl ebx, 2
pop dword [ebp + ebx]
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b884]
push 0
mov ebx, dword [0x48b20c]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.00408630
inc dword [0x48b884]
mov edx, dword [0x489f78]
add dword [esp], edx
call fcn.00408130
pop dword [0x48b884]
push eax
mov ebx, dword [0x48b20c]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48b20c]
jmp 0x402b42
push 0
call fcn.0040c230
mov ebx, dword [0x48b2c8]
add ebx, 0x5f2f
mov dword [0x48b32c], ebx
mov ebx, dword [0x48b2c8]
add ebx, 0x186b07
mov dword [0x48b330], ebx
mov ebx, dword [0x48b2c8]
add ebx, 0x186b2d
mov dword [0x48b334], ebx
mov ebx, dword [0x48b2c8]
add ebx, 0x2cab00
mov dword [0x48b338], ebx
push 0xd9
mov ebx, dword [0x48b244]
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x40
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x54
mov ebx, dword [0x48b244]
add ebx, 2
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xd9
mov ebx, dword [0x48b244]
add ebx, 3
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x7c
mov ebx, dword [0x48b244]
add ebx, 4
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x24
mov ebx, dword [0x48b244]
add ebx, 5
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xa
mov ebx, dword [0x48b244]
add ebx, 6
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xa3
mov ebx, dword [0x48b244]
add ebx, 7
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0
mov ebx, dword [0x48b244]
add ebx, 8
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x3f
mov ebx, dword [0x48b244]
add ebx, 9
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xe4
mov ebx, dword [0x48b244]
add ebx, 0xa
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xd
mov ebx, dword [0x48b244]
add ebx, 0xb
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xc3
mov ebx, dword [0x48b244]
add ebx, 0xc
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 0xd
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0
mov ebx, dword [0x48b244]
add ebx, 0xe
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0
mov ebx, dword [0x48b244]
add ebx, 0xf
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xd9
mov ebx, dword [0x48b244]
add ebx, 0x10
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x41
mov ebx, dword [0x48b244]
add ebx, 0x11
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x14
mov ebx, dword [0x48b244]
add ebx, 0x12
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xd8
mov ebx, dword [0x48b244]
add ebx, 0x13
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x71
mov ebx, dword [0x48b244]
add ebx, 0x14
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 8
mov ebx, dword [0x48b244]
add ebx, 0x15
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x9c
mov ebx, dword [0x48b244]
add ebx, 0x16
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x60
mov ebx, dword [0x48b244]
add ebx, 0x17
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x83
mov ebx, dword [0x48b244]
add ebx, 0x18
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x3d
mov ebx, dword [0x48b244]
add ebx, 0x19
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 4
mov ebx, dword [0x48b244]
add ebx, 0x1a
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x3f
mov ebx, dword [0x48b244]
add ebx, 0x1b
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xe4
mov ebx, dword [0x48b244]
add ebx, 0x1c
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xd
mov ebx, dword [0x48b244]
add ebx, 0x1d
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 1
mov ebx, dword [0x48b244]
add ebx, 0x1e
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x75
mov ebx, dword [0x48b244]
add ebx, 0x1f
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x11
mov ebx, dword [0x48b244]
add ebx, 0x20
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x66
mov ebx, dword [0x48b244]
add ebx, 0x21
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x3e
mov ebx, dword [0x48b244]
add ebx, 0x22
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x81
mov ebx, dword [0x48b244]
add ebx, 0x23
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x7c
mov ebx, dword [0x48b244]
add ebx, 0x24
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x24
mov ebx, dword [0x48b244]
add ebx, 0x25
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x3c
mov ebx, dword [0x48b244]
add ebx, 0x26
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xbe
mov ebx, dword [0x48b244]
add ebx, 0x27
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xb9
mov ebx, dword [0x48b244]
add ebx, 0x28
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x75
mov ebx, dword [0x48b244]
add ebx, 0x29
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 7
mov ebx, dword [0x48b244]
add ebx, 0x2a
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xc7
mov ebx, dword [0x48b244]
add ebx, 0x2b
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x41
mov ebx, dword [0x48b244]
add ebx, 0x2c
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x10
mov ebx, dword [0x48b244]
add ebx, 0x2d
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 1
mov ebx, dword [0x48b244]
add ebx, 0x2e
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0
mov ebx, dword [0x48b244]
add ebx, 0x2f
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0
mov ebx, dword [0x48b244]
add ebx, 0x30
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0
mov ebx, dword [0x48b244]
add ebx, 0x31
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x61
mov ebx, dword [0x48b244]
add ebx, 0x32
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x9d
mov ebx, dword [0x48b244]
add ebx, 0x33
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xc3
mov ebx, dword [0x48b244]
add ebx, 0x34
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 0x35
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push dword [0x48b240]
push 0x2ac
push dword [0x48b244]
mov ebx, dword [0x48b30c]
add ebx, 0x1091
push ebx
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
mov ebx, dword [0x48b30c]
add ebx, 0x3f00
push ebx
mov eax, dword [0x48b244]
call fcn.004099d0
mov dword [0x48b214], eax
push dword [0x48b240]
push 4
push dword [0x48b244]
mov ebx, dword [0x48b30c]
add ebx, 0x1099
push ebx
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
mov ebx, dword [0x48b30c]
add ebx, 0x3f04
push ebx
mov eax, dword [0x48b244]
call fcn.004099d0
mov dword [0x48b214], eax
push dword [0x48b240]
push 4
push dword [0x48b244]
mov ebx, dword [0x48b30c]
add ebx, 0x10ab
push ebx
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
push 0xe8
mov ebx, dword [0x48b244]
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 2
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 3
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 4
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 5
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 6
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
mov ebx, dword [0x48b30c]
add ebx, 0x1091
sub ebx, dword [0x48b32c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099d0
mov dword [0x48b214], eax
push dword [0x48b240]
push 7
push dword [0x48b244]
push dword [0x48b32c]
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
push 0xe8
mov ebx, dword [0x48b244]
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 2
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 3
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 4
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
add ebx, 5
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
mov ebx, dword [0x48b30c]
add ebx, 0x10a1
sub ebx, dword [0x48b338]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099d0
mov dword [0x48b214], eax
push dword [0x48b240]
push 6
push dword [0x48b244]
push dword [0x48b338]
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
mov dword [0x48b33c], 0
mov eax, 0xff
cmp eax, dword [0x48b33c]
jl 0x403503
push dword [0x48b33c]
call sub.USER32.dll_GetAsyncKeyState
inc dword [0x48b33c]
jmp 0x4034e3
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x403512
push 0x55009553
ret
mov ebp, dword [0x48b678]
push dword [ebp + 4]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 4]
mov ebp, dword [0x48b678]
push dword [ebp + 8]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 8]
mov ebp, dword [0x48b678]
push dword [ebp + 0xc]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0xc]
mov ebp, dword [0x48b678]
push dword [ebp + 0x10]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x10]
mov ebp, dword [0x48b678]
push dword [ebp + 0x14]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x14]
mov ebp, dword [0x48b678]
push dword [ebp + 0x18]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x18]
mov ebp, dword [0x48b678]
push dword [ebp + 0x1c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x1c]
mov ebp, dword [0x48b678]
push dword [ebp + 0x20]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x20]
mov ebp, dword [0x48b678]
push dword [ebp + 0x24]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x24]
mov ebp, dword [0x48b678]
push dword [ebp + 0x28]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x28]
mov ebp, dword [0x48b678]
push dword [ebp + 0x2c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x2c]
mov ebp, dword [0x48b678]
push dword [ebp + 0x30]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x30]
mov ebp, dword [0x48b678]
push dword [ebp + 0x34]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x34]
mov ebp, dword [0x48b678]
push dword [ebp + 0x38]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x38]
mov ebp, dword [0x48b678]
push dword [ebp + 0x3c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x3c]
mov ebp, dword [0x48b678]
push dword [ebp + 0x40]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x40]
mov ebp, dword [0x48b678]
push dword [ebp + 0x44]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x44]
mov ebp, dword [0x48b678]
push dword [ebp + 0x48]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x48]
mov ebp, dword [0x48b678]
push dword [ebp + 0x4c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x4c]
mov ebp, dword [0x48b678]
push dword [ebp + 0x50]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48b698]
pop dword [ebp + 0x50]
push 0x10
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x48b340], eax
push 0x11
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x48b344], eax
push 0x12
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x48b348], eax
mov eax, 0x32
call fcn.00409879
mov dword [0x48b300], eax
mov ebx, dword [0x48b300]
cmp ebx, 0x19
jne 0x4037df
mov ebx, dword [0x48b274]
cmp ebx, dword [0x48b27c]
jne 0x403761
mov ebx, dword [0x48b274]
and ebx, ebx
je 0x403761
mov ebx, dword [0x48b27c]
and ebx, ebx
je 0x403761
jmp 0x403768
mov eax, 1
jmp 0x40376a
xor eax, eax
and eax, eax
je 0x4037df
mov eax, 0xff
call fcn.00409879
mov dword [0x48b310], eax
mov eax, 0x190
call fcn.00409879
mov dword [0x48b314], eax
push dword [0x48b310]
mov eax, dword [0x48b244]
call fcn.004099c0
mov dword [0x48b214], eax
push dword [0x48b240]
push 1
push dword [0x48b244]
mov ebx, dword [0x48b30c]
add ebx, dword [0x48b314]
add ebx, 0x1091
push ebx
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
jmp fcn.0040672a
push dword [0x48b240]
push 4
push dword [0x48b244]
mov ebx, dword [0x48b30c]
add ebx, 0x3f00
push ebx
push dword [0x48b31c]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48b214], eax
mov eax, dword [0x48b244]
call fcn.004099e0
mov ebx, eax
add ebx, 0x54
mov dword [0x48b34c], ebx
mov ebp, dword [0x48b678]
push dword [ebp + 4]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 4]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 4]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 4]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b350], ebx
mov ebx, dword [0x48b350]
and ebx, ebx
je 0x4038f7
push 0x4b18967f
mov eax, dword [0x48b244]
call fcn.004099f0
mov dword [0x48b214], eax
push dword [0x48b240]
push 4
push dword [0x48b244]
push dword [0x48b34c]
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
push dword [0x48b240]
push 4
push dword [0x48b244]
mov ebx, dword [0x48b34c]
add ebx, 4
push ebx
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
push 0
push 0
call fcn.00409502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48b678]
push dword [ebp + 8]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 8]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 8]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 8]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b354], ebx
mov ebx, dword [0x48b354]
and ebx, ebx
je 0x403b14
push dword [0x48b358]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403a36
mov dword [0x48b358], 1
push 0x90
mov ebx, dword [0x48b244]
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push dword [0x48b240]
push 2
push dword [0x48b244]
push dword [0x48b330]
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0x90
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push dword [0x48b240]
push 2
push dword [0x48b244]
push dword [0x48b334]
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
push 0
push 5
call fcn.00409502
push 0x12c
call sub.KERNEL32.dll_Sleep
jmp 0x403b13
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403b13
mov dword [0x48b358], 0
push 3
mov ebx, dword [0x48b244]
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xd8
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push dword [0x48b240]
push 2
push dword [0x48b244]
push dword [0x48b330]
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
push 3
mov ebx, dword [0x48b244]
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push 0xd8
mov ebx, dword [0x48b244]
inc ebx
mov eax, ebx
call fcn.004099c0
mov dword [0x48b214], eax
push dword [0x48b240]
push 2
push dword [0x48b244]
push dword [0x48b334]
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
push 0
push 6
call fcn.00409502
push 0x12c
call sub.KERNEL32.dll_Sleep
pop eax
mov ebp, dword [0x48b678]
push dword [ebp + 0xc]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0xc]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0xc]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0xc]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b35c], ebx
mov ebx, dword [0x48b35c]
and ebx, ebx
je 0x403c52
push dword [0x48b360]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403be2
mov dword [0x48b360], 1
push 1
mov eax, dword [0x48b244]
call fcn.004099d0
mov dword [0x48b214], eax
push dword [0x48b240]
push 4
push dword [0x48b244]
mov ebx, dword [0x48b30c]
add ebx, 0x3f04
push ebx
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
push 0
push 5
call fcn.00409502
push 0x12c
call sub.KERNEL32.dll_Sleep
jmp 0x403c51
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403c51
mov dword [0x48b360], 0
push 0
mov eax, dword [0x48b244]
call fcn.004099d0
mov dword [0x48b214], eax
push dword [0x48b240]
push 4
push dword [0x48b244]
mov ebx, dword [0x48b30c]
add ebx, 0x3f04
push ebx
push dword [0x48b31c]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48b214], eax
push 0
push 6
call fcn.00409502
push 0x12c
call sub.KERNEL32.dll_Sleep
pop eax
mov ebp, dword [0x48b678]
push dword [ebp + 0x10]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x10]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x10]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x10]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b364], ebx
mov ebx, dword [0x48b364]
and ebx, ebx
je 0x403ca8
mov ebp, dword [0x48b678]
push dword [ebp + 0x14]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x14]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x14]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x14]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b368], ebx
mov ebx, dword [0x48b368]
and ebx, ebx
je 0x403cfe
mov ebp, dword [0x48b678]
push dword [ebp + 0x18]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x18]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x18]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x18]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b36c], ebx
mov ebx, dword [0x48b36c]
and ebx, ebx
je 0x403d54
mov ebp, dword [0x48b678]
push dword [ebp + 0x1c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b370], ebx
mov ebx, dword [0x48b370]
and ebx, ebx
je 0x403daa
mov ebp, dword [0x48b678]
push dword [ebp + 0x20]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x20]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x20]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x20]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b374], ebx
mov ebx, dword [0x48b374]
and ebx, ebx
je 0x403e00
mov ebp, dword [0x48b678]
push dword [ebp + 0x24]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x24]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x24]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x24]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b378], ebx
mov ebx, dword [0x48b378]
and ebx, ebx
je 0x403e56
mov ebp, dword [0x48b678]
push dword [ebp + 0x28]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x28]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x28]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x28]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b37c], ebx
mov ebx, dword [0x48b37c]
and ebx, ebx
je 0x403eac
mov ebp, dword [0x48b678]
push dword [ebp + 0x2c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b380], ebx
mov ebx, dword [0x48b380]
and ebx, ebx
je 0x403f02
mov ebp, dword [0x48b678]
push dword [ebp + 0x30]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x30]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x30]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x30]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b384], ebx
mov ebx, dword [0x48b384]
and ebx, ebx
je 0x403f58
mov ebp, dword [0x48b678]
push dword [ebp + 0x34]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x34]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x34]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x34]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b388], ebx
mov ebx, dword [0x48b388]
and ebx, ebx
je 0x403fae
mov ebp, dword [0x48b678]
push dword [ebp + 0x38]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x38]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x38]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x38]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b38c], ebx
mov ebx, dword [0x48b38c]
and ebx, ebx
je 0x404004
mov ebp, dword [0x48b678]
push dword [ebp + 0x3c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b390], ebx
mov ebx, dword [0x48b390]
and ebx, ebx
je 0x40405a
mov ebp, dword [0x48b678]
push dword [ebp + 0x40]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x40]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x40]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x40]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b394], ebx
mov ebx, dword [0x48b394]
and ebx, ebx
je 0x4040b0
mov ebp, dword [0x48b678]
push dword [ebp + 0x44]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x44]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x44]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x44]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b398], ebx
mov ebx, dword [0x48b398]
and ebx, ebx
je 0x404106
mov ebp, dword [0x48b678]
push dword [ebp + 0x48]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x48]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x48]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x48]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b39c], ebx
mov ebx, dword [0x48b39c]
and ebx, ebx
je 0x40415c
mov ebp, dword [0x48b678]
push dword [ebp + 0x4c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b3a0], ebx
mov ebx, dword [0x48b3a0]
and ebx, ebx
je 0x4041b2
mov ebp, dword [0x48b678]
push dword [ebp + 0x50]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48b680]
mov edi, dword [ebp + 0x50]
add edi, dword [0x48b340]
imul ebx, edi
mov ebp, dword [0x48b688]
mov edi, dword [ebp + 0x50]
add edi, dword [0x48b344]
imul ebx, edi
mov ebp, dword [0x48b690]
mov edi, dword [ebp + 0x50]
add edi, dword [0x48b348]
imul ebx, edi
mov dword [0x48b3a4], ebx
mov ebx, dword [0x48b3a4]
and ebx, ebx
je 0x404208
mov dword [0x48b350], 0
mov dword [0x48b354], 0
mov dword [0x48b35c], 0
mov dword [0x48b364], 0
mov dword [0x48b368], 0
mov dword [0x48b36c], 0
mov dword [0x48b370], 0
mov dword [0x48b374], 0
mov dword [0x48b378], 0
mov dword [0x48b37c], 0
mov dword [0x48b380], 0
mov dword [0x48b384], 0
mov dword [0x48b388], 0
mov dword [0x48b38c], 0
mov dword [0x48b390], 0
mov dword [0x48b394], 0
mov dword [0x48b398], 0
mov dword [0x48b39c], 0
mov dword [0x48b3a0], 0
mov dword [0x48b3a4], 0
mov ebx, dword [0x48b29c]
cmp ebx, 0x45a2a5
je 0x4042ed
push 0
push 3
call fcn.0040a822
call fcn.00405224
push 1
call sub.KERNEL32.dll_Sleep
mov eax, 0xbb8
call fcn.00409879
mov dword [0x48b300], eax
mov ebx, dword [0x48b300]
cmp ebx, 0x63
jne 0x4043d4
mov eax, dword [0x48b884]
push eax
push eax
push dword [0x48b884]
call fcn.00408e08
inc dword [0x48b884]
push 0
mov edx, dword [0x489f78]
add dword [esp + 4], edx
call fcn.0040c490
pop dword [0x48b884]
push 0
call fcn.0040c510
mov dword [0x48b270], eax
mov dword [0x48b20c], 1
mov ebx, dword [0x48b270]
add ebx, 0xfffffffc
cmp ebx, dword [0x48b20c]
jl 0x40438d
push 0
call fcn.0040c640
mov dword [0x48b280], eax
inc dword [0x48b20c]
jmp 0x404365
push 0
call fcn.0040c5e0
mov dword [0x48b278], eax
push 0
call fcn.0040c230
mov ebx, dword [0x48b278]
cmp ebx, dword [0x48b270]
jne 0x4043b6
jmp 0x4043c0
jmp fcn.0040672a
mov ebx, dword [0x48b2f4]
and ebx, ebx
jne 0x4043d4
jmp fcn.0040672a
mov ebx, dword [0x48b274]
cmp ebx, dword [0x48b27c]
jne 0x4043f8
mov ebx, dword [0x48b274]
and ebx, ebx
je 0x4043f8
mov ebx, dword [0x48b27c]
and ebx, ebx
je 0x4043f8
jmp 0x4043ff
mov eax, 1
jmp 0x404401
xor eax, eax
and eax, eax
je 0x40445d
mov eax, 0xa
call fcn.00409879
mov ebx, eax
add ebx, 0xa
mov dword [0x48b310], ebx
mov eax, 0x28
call fcn.00409879
mov ebx, eax
add ebx, 0x28
mov dword [0x48b314], ebx
mov ebx, dword [0x48b2c8]
add ebx, dword [0x48b310]
mov dword [0x48b2c8], ebx
mov ebx, dword [0x48b30c]
add ebx, dword [0x48b314]
mov dword [0x48b30c], ebx
call fcn.00405522
jmp 0x402c70
jmp 0x4034d9