Function at 0x401000
Capabilities:
Authenticate hmac
Check for time delay via gettickcount
Check internet connectivity via wininet
Download url
Log keystrokes via polling
Parse pe header
Receive data
Resolve function by parsing pe exports

Disassembly:
push 0x3bc
push 0
push 0x539964
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x539968], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x539964], eax
call fcn.0040f2f0
call fcn.0040f274
call fcn.0040e910
call fcn.0040d698
call fcn.0040ce52
call fcn.0040cd2a
call fcn.0040c76f
call fcn.0040c155
call fcn.0040bfc0
call fcn.0040b903
call fcn.0040b7c7
call fcn.0040ab8b
call fcn.0040c6b0
call fcn.0040acb0
mov dword [0x539970], eax
mov ebp, str.RIFFp
push ebp
push 0
call fcn.0040b122
mov ebp, 0x487716
push ebp
push 1
call fcn.0040b122
mov ebp, str.RIFF
push ebp
push 3
call fcn.0040b122
mov ebp, str.RIFF__f
push ebp
push 4
call fcn.0040b122
mov ebp, str.RIFF__
push ebp
push 5
call fcn.0040b122
mov ebp, str.RIFF_f_
push ebp
push 6
call fcn.0040b122
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4010fa
push 0x75009553
inc ecx
ret
call sub.KERNEL32.dll_GetTickCount
mov dword [0x539988], eax
mov eax, dword [0x53a144]
push eax
push eax
call fcn.0040b91f
lea ecx, [0x53998c]
pop edx
call fcn.0040a000
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x53998c]
call fcn.0040bee7
lea ecx, [0x53998c]
pop edx
call fcn.0040a000
mov edx, 0x41a01c
lea ecx, [0x539990]
call fcn.0040a018
mov edx, 0x41a01c
lea ecx, [0x539994]
call fcn.0040a018
mov edx, 0x41a01c
lea ecx, [0x539998]
call fcn.0040a018
mov dword [0x53999c], 0
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x53a144]
call fcn.0040b91f
inc dword [0x53a144]
push 0
mov edx, dword [0x53883c]
add dword [esp + 4], edx
call fcn.0040eb00
pop dword [0x53a144]
push 0
call fcn.0040eb20
mov dword [0x5399a0], eax
mov dword [0x5399a4], 1
mov ebx, dword [0x5399a0]
add ebx, 0xfffffff8
cmp ebx, dword [0x5399a4]
jl 0x4011fc
push 0
call fcn.0040eb90
mov byte [0x539be4], al
mov ebx, dword [0x5399a8]
movzx eax, byte [0x539be4]
add ebx, eax
mov dword [0x5399a8], ebx
inc dword [0x5399a4]
jmp 0x4011bf
push 0
call fcn.0040ebf0
mov dword [0x5399ac], eax
push 0
call fcn.0040ebf0
mov dword [0x5399b0], eax
push 0
call fcn.0040e8a0
mov eax, dword [0x5399a8]
mov dword [0x5399b4], eax
push dword [0x53998c]
push 0
call fcn.0040eb00
mov ebx, eax
and ebx, ebx
jle 0x4015d3
mov dword [0x5399a4], 1
mov eax, 0x3b8
cmp eax, dword [0x5399a4]
jl 0x401276
push 0
call fcn.0040ec50
mov dword [0x5399b8], eax
inc dword [0x5399a4]
jmp 0x401252
mov dword [0x5399a4], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x5399a4]
jl 0x401319
push 0
call fcn.0040ec50
mov dword [0x5399b8], eax
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x53a144]
push 0
mov eax, dword [0x5399b8]
cdq
push edx
push eax
call fcn.0040a630
inc dword [0x53a144]
mov edx, dword [0x53883c]
add dword [esp], edx
call fcn.0040a130
pop dword [0x53a144]
mov dword [0x5399b8], eax
mov edx, dword [0x539990]
push dword [0x53a144]
call fcn.0040f340
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x5399b8]
call fcn.0040a220
pop eax
lea ecx, [0x539990]
pop edx
call fcn.0040a000
inc dword [0x5399a4]
jmp 0x401280
push dword [0x539990]
call fcn.00409109
mov dword [0x5399b8], eax
mov ebx, dword [0x5399b8]
xor ebx, 0x98989898
mov dword [0x5399b8], ebx
mov eax, dword [0x5399b8]
mov dword [0x5399bc], eax
mov eax, dword [0x53a144]
push eax
push eax
push 0xa
push dword [0x53a144]
mov edx, str.0000000000
call fcn.0040f340
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x5399b8]
call fcn.0040a240
pop eax
inc dword [0x53a144]
mov edx, dword [0x53883c]
add dword [esp], edx
call fcn.0040a310
lea ecx, [0x539990]
pop edx
call fcn.0040a000
mov dword [0x5399a4], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x5399a4]
jl 0x401437
push 0
call fcn.0040ec50
mov dword [0x5399b8], eax
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x53a144]
push 0
mov eax, dword [0x5399b8]
cdq
push edx
push eax
call fcn.0040a630
inc dword [0x53a144]
mov edx, dword [0x53883c]
add dword [esp], edx
call fcn.0040a130
pop dword [0x53a144]
mov dword [0x5399b8], eax
mov edx, dword [0x539994]
push dword [0x53a144]
call fcn.0040f340
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x5399b8]
call fcn.0040a220
pop eax
lea ecx, [0x539994]
pop edx
call fcn.0040a000
inc dword [0x5399a4]
jmp 0x40139e
push dword [0x539994]
call fcn.00409109
mov dword [0x5399c0], eax
mov dword [0x5399a4], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x5399a4]
jl 0x4014ea
push 0
call fcn.0040ec50
mov dword [0x5399b8], eax
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x53a144]
push 0
mov eax, dword [0x5399b8]
cdq
push edx
push eax
call fcn.0040a630
inc dword [0x53a144]
mov edx, dword [0x53883c]
add dword [esp], edx
call fcn.0040a130
pop dword [0x53a144]
mov dword [0x5399b8], eax
mov edx, dword [0x539998]
push dword [0x53a144]
call fcn.0040f340
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x5399b8]
call fcn.0040a220
pop eax
lea ecx, [0x539998]
pop edx
call fcn.0040a000
inc dword [0x5399a4]
jmp 0x401451
push dword [0x539998]
call fcn.00409109
mov dword [0x5399b8], eax
mov eax, dword [0x5399b8]
mov dword [0x5399c4], eax
mov dword [0x5399a4], 0x3d1
mov ebx, dword [0x5399c4]
dec ebx
cmp ebx, dword [0x5399a4]
jl 0x401534
push 0
call fcn.0040ec50
mov dword [0x5399b8], eax
inc dword [0x5399a4]
jmp 0x40150e
mov eax, dword [0x5399c4]
mov dword [0x5399a4], eax
mov ebx, dword [0x5399c4]
add ebx, 0x12
cmp ebx, dword [0x5399a4]
jl 0x401578
push 0
call fcn.0040ec50
mov dword [0x5399b8], eax
mov ebx, dword [0x53999c]
add ebx, dword [0x5399b8]
mov dword [0x53999c], ebx
inc dword [0x5399a4]
jmp 0x40153e
mov ebx, dword [0x5399c0]
xor ebx, dword [0x53999c]
mov dword [0x5399c8], ebx
mov ebx, dword [0x5399c8]
and ebx, ebx
jne 0x40159e
mov dword [0x5399c8], 0x63
mov ebx, dword [0x5399c8]
xor ebx, 0x98989898
mov dword [0x5399c8], ebx
mov eax, dword [0x5399bc]
mov dword [0x5399cc], eax
mov ebx, dword [0x5399bc]
cmp ebx, dword [0x5399c8]
jne 0x4015ca
jmp 0x4015d1
push 0x75009553
inc ecx
ret
jmp 0x4015da
push 0x25001876
inc eax
ret
mov ebx, dword [0x5399b0]
cmp ebx, dword [0x5399a0]
jne 0x4015ea
jmp 0x4015f1
push 0x10047665
inc eax
ret
call sub.KERNEL32.dll_GetTickCount
mov dword [0x5399d0], eax
mov ebx, dword [0x5399d0]
sub ebx, dword [0x539988]
cmp ebx, 0x3e8
jle 0x401616
push 0x9099542
inc eax
ret
mov dword [0x5399d4], 0x45a2a5
push 5
push 0x539ce8
push 0
mov edx, dword [0x539ce8]
call fcn.0040a020
mov eax, 0x15
push 4
call fcn.0040a040
push 5
push 0x539cf0
push 0
mov edx, dword [0x539cf0]
call fcn.0040a020
mov eax, 0x15
push 4
call fcn.0040a040
push 5
push 0x539cf8
push 0
mov edx, dword [0x539cf8]
call fcn.0040a020
mov eax, 0x15
push 4
call fcn.0040a040
push 5
push 0x539d00
push 0
mov edx, dword [0x539d00]
call fcn.0040a020
mov eax, 0x15
push 4
call fcn.0040a040
push 5
push 0x539d08
push 0
mov edx, dword [0x539d08]
call fcn.0040a020
mov eax, 0x15
push 4
call fcn.0040a040
push 0x3e8
call fcn.0040bff0
mov dword [0x5399d8], eax
push 0x3e8
call fcn.0040bff0
mov dword [0x5399dc], eax
mov dword [0x5399a4], 1
mov eax, 0x14
cmp eax, dword [0x5399a4]
jl 0x40176f
mov ebx, dword [0x5399a4]
mov ebp, dword [0x539cf0]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x5399a4]
mov ebp, dword [0x539cf8]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x5399a4]
mov ebp, dword [0x539d00]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x5399a4]
jmp 0x401715
mov edx, str.Template
lea ecx, [0x5399f8]
call fcn.0040a018
mov eax, dword [0x53a144]
push eax
push eax
call fcn.0040e7ed
lea ecx, [0x5399e0]
pop edx
call fcn.0040a000
push dword [0x53a144]
mov edx, dword [0x5399e0]
push dword [0x53a144]
call fcn.0040f340
mov edx, str.CH.dll
call fcn.0040f340
inc dword [0x53a144]
push 0
mov edx, dword [0x53883c]
add dword [esp + 4], edx
call fcn.0040ea40
pop dword [0x53a144]
and eax, eax
je 0x401807
mov ebp, 0x5371d6
mov ebx, ebp
mov ebp, 0x5365d6
sub ebx, ebp
push ebx
mov ebp, 0x5365d6
push ebp
push 0
call fcn.0040ecb0
push 0
call fcn.0040e8a0
jmp 0x401807
push dword [0x53a144]
mov edx, dword [0x5399e0]
push dword [0x53a144]
call fcn.0040f340
mov edx, str.help.txt
call fcn.0040f340
inc dword [0x53a144]
push 0
mov edx, dword [0x53883c]
add dword [esp + 4], edx
call fcn.0040ea40
pop dword [0x53a144]
and eax, eax
je 0x401877
mov ebp, 0x538839
mov ebx, ebp
mov ebp, 0x5371d6
sub ebx, ebp
push ebx
mov ebp, 0x5371d6
push ebp
push 0
call fcn.0040ecb0
push 0
call fcn.0040e8a0
jmp 0x401886
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040b804
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040eb00
mov dword [0x539970], eax
mov ebx, dword [0x539970]
and ebx, ebx
jle 0x4018b8
mov dword [0x539a10], 1
push 2
call fcn.0040e8a0
push 0x12c
call sub.KERNEL32.dll_Sleep
call fcn.0040927d
push str.Authenticating_Trainer......
push 0
push 8
call fcn.0040ac9a
push 0
push 0
call sub.WININET.dll_InternetGetConnectedState
and eax, eax
je 0x4018f0
jmp 0x40191c
push dword [0x5399cc]
call fcn.00408af7
mov ebx, eax
and ebx, ebx
jne 0x40191c
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040b7d5
push 0x9099542
inc eax
ret
mov eax, dword [0x53a144]
push eax
push eax
call fcn.0040e7ed
mov edx, str.black.txt
call fcn.0040f340
lea ecx, [0x539a14]
pop edx
call fcn.0040a000
push dword [0x53a144]
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.0040f340
mov eax, dword [0x53a144]
push eax
push eax
mov ebx, dword [0x5399cc]
xor ebx, 0x7b3d89b
push ebx
call fcn.0040a240
pop eax
mov edx, str..zip
call fcn.0040f340
lea ecx, [0x539a18]
pop edx
call fcn.0040a000
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x539a1c]
call fcn.0040a018
mov edx, dword [0x539a18]
push dword [0x53a144]
call fcn.0040f340
lea ecx, [0x539a20]
pop edx
call fcn.0040a000
mov edx, dword [0x539a1c]
push dword [0x53a144]
call fcn.0040f340
lea ecx, [0x539a24]
pop edx
call fcn.0040a000
push 0
push 0
mov eax, dword [0x539a14]
push eax
mov eax, dword [0x539a24]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x539a28], eax
mov ebx, dword [0x539a28]
and ebx, ebx
jne 0x4019f9
jmp 0x401a25
push dword [0x5399cc]
call fcn.00408af7
mov ebx, eax
and ebx, ebx
jne 0x401a25
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040b7d5
push 0x9099542
inc eax
ret
push 0
push 0
mov eax, dword [0x539a14]
push eax
mov eax, dword [0x539a20]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x539a2c], eax
mov ebx, dword [0x539a2c]
and ebx, ebx
jne 0x401a7e
push 0
push 3
call fcn.0040cec2
push str.Invalid_Trainer_User
push 0
push 8
call fcn.0040ac9a
call fcn.0040871c
jmp 0x401a4a
mov ebx, dword [0x539a28]
and ebx, ebx
je 0x401aa0
push dword [0x5399cc]
call fcn.00408af7
mov ebx, eax
and ebx, ebx
jne 0x401aa0
mov eax, 1
jmp 0x401aa2
xor eax, eax
and eax, eax
je 0x401ab0
mov dword [0x5399d4], 0
lea ebp, [0x539be8]
lea eax, [ebp]
push eax
call sub.USER32.dll_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x539a30]
mov ebx, dword [0x539a30]
cmp ebx, 1
jne 0x401aea
mov edx, 0x41a0c9
lea ecx, [0x539a34]
call fcn.0040a018
jmp 0x401afa
mov edx, str.OFF.
lea ecx, [0x539a34]
call fcn.0040a018
mov eax, dword [0x53a144]
push eax
push eax
mov edx, str.Run_Game_and_then_press_F1_at_Main_Menu._Numlock_is
call fcn.0040f340
mov edx, dword [0x539a34]
call fcn.0040f340
inc dword [0x53a144]
push 0
push 8
mov edx, dword [0x53883c]
add dword [esp + 8], edx
call fcn.0040ac9a
pop dword [0x53a144]
mov eax, 0x12c
call fcn.0040be39
mov dword [0x539a38], eax
mov ebx, dword [0x539a38]
cmp ebx, 0x63
jne 0x401c05
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x53a144]
call fcn.0040b91f
inc dword [0x53a144]
push 0
mov edx, dword [0x53883c]
add dword [esp + 4], edx
call fcn.0040eb00
pop dword [0x53a144]
push 0
call fcn.0040eb20
mov dword [0x5399a0], eax
mov dword [0x5399a4], 1
mov ebx, dword [0x5399a0]
add ebx, 0xfffffffc
cmp ebx, dword [0x5399a4]
jl 0x401bcc
push 0
call fcn.0040ec50
mov dword [0x5399b8], eax
inc dword [0x5399a4]
jmp 0x401ba4
push 0
call fcn.0040ebf0
mov dword [0x5399b0], eax
push 0
call fcn.0040e8a0
mov ebx, dword [0x5399b0]
cmp ebx, dword [0x5399a0]
jne 0x401bf5
jmp 0x401bf8
inc eax
push esp
ret
mov ebx, dword [0x539a2c]
and ebx, ebx
jne 0x401c05
inc eax
push esp
ret
call fcn.0040871c
push 0xa
call sub.KERNEL32.dll_Sleep
push 0x70
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x401ab0
mov edx, str.prototypef.exe
lea ecx, [0x539a3c]
call fcn.0040a018
call fcn.00407d02
mov ebx, dword [0x539a40]
and ebx, ebx
jne 0x401c83
push 0
push 4
call fcn.0040b257
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0x12c
call sub.KERNEL32.dll_Sleep
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 8
call fcn.0040ac9a
jmp 0x401a7e
mov edx, str.CH.dll
lea ecx, [0x539a44]
call fcn.0040a018
mov edx, dword [0x5399e0]
push dword [0x53a144]
call fcn.0040f340
mov edx, dword [0x539a44]
call fcn.0040f340
lea ecx, [0x539a48]
pop edx
call fcn.0040a000
call fcn.00407d47
mov edx, str.prototypeenginef.dll
lea ecx, [0x5399e8]
call fcn.0040a018
mov edx, str.xlive.dll
lea ecx, [0x539a4c]
call fcn.0040a018
call fcn.00407d02
call fcn.0040866b
call fcn.0040871c
mov ebx, dword [0x539a04]
and ebx, ebx
jne 0x401d1c
mov ebx, dword [0x539a50]
and ebx, ebx
jne 0x401d1c
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 8
call fcn.0040ac9a
jmp 0x401a7e
mov ebx, dword [0x5399ac]
cmp ebx, dword [0x5399b4]
jne 0x401d40
mov ebx, dword [0x5399ac]
and ebx, ebx
je 0x401d40
mov ebx, dword [0x5399b4]
and ebx, ebx
je 0x401d40
jmp 0x401d47
mov eax, 1
jmp 0x401d49
xor eax, eax
and eax, eax
je 0x401d9b
mov eax, 0xa
call fcn.0040be39
mov ebx, eax
add ebx, 0xa
mov dword [0x539a54], ebx
mov eax, 0x28
call fcn.0040be39
mov ebx, eax
add ebx, 0x28
mov dword [0x539a58], ebx
mov ebx, dword [0x539a04]
add ebx, dword [0x539a54]
mov dword [0x539a04], ebx
mov ebx, dword [0x539a50]
add ebx, dword [0x539a58]
mov dword [0x539a50], ebx
push 0
push 3
call fcn.0040b257
push 0x12c
call sub.KERNEL32.dll_Sleep
push str.Game_found__Trainer_Activated_
push 0
push 8
call fcn.0040ac9a
mov ebx, dword [0x539a5c]
and ebx, ebx
je 0x4020d5
push 0x8b
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xff
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x55
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8b
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xec
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xec
mov ebx, dword [0x5399d8]
add ebx, 6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x20
mov ebx, dword [0x5399d8]
add ebx, 7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x53
mov ebx, dword [0x5399d8]
add ebx, 8
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x56
mov ebx, dword [0x5399d8]
add ebx, 9
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x57
mov ebx, dword [0x5399d8]
add ebx, 0xa
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8d
mov ebx, dword [0x5399d8]
add ebx, 0xb
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x45
mov ebx, dword [0x5399d8]
add ebx, 0xc
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xe0
mov ebx, dword [0x5399d8]
add ebx, 0xd
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x33
mov ebx, dword [0x5399d8]
add ebx, 0xe
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xf6
mov ebx, dword [0x5399d8]
add ebx, 0xf
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x50
mov ebx, dword [0x5399d8]
add ebx, 0x10
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xff
mov ebx, dword [0x5399d8]
add ebx, 0x11
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0x12
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
add ebx, 0x13
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
mov ebx, dword [0x539a5c]
add ebx, 0x1000
mov dword [0x5399a4], ebx
mov ebx, dword [0x539a5c]
add ebx, 0x100000
cmp ebx, dword [0x5399a4]
jl 0x4020d5
push dword [0x539a64]
push 0x14
push dword [0x5399dc]
push dword [0x5399a4]
push dword [0x539a60]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x539970], eax
push 0x14
push dword [0x5399dc]
push dword [0x5399d8]
call fcn.0040c010
mov dword [0x539970], eax
mov ebx, dword [0x539970]
cmp ebx, 1
jne 0x4020ca
mov eax, dword [0x5399a4]
mov dword [0x539a68], eax
push 0xc2
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 3
push dword [0x5399d8]
push dword [0x539a68]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
inc dword [0x5399a4]
jmp 0x401feb
mov ebx, dword [0x5399d4]
cmp ebx, 0x45a2a5
jne 0x402179
mov ebp, dword [0x539ce8]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0x64
mov dword [ebp + 0x14], 0x65
mov dword [ebp + 0x18], 0x66
mov dword [ebp + 0x1c], 0x67
mov dword [ebp + 0x20], 0x68
mov dword [ebp + 0x24], 0x6e
mov dword [ebp + 0x28], 0x6b
mov dword [ebp + 0x2c], 0x6d
mov dword [ebp + 0x30], 0x69
mov dword [ebp + 0x34], 0x60
mov dword [ebp + 0x38], 0x6f
mov dword [ebp + 0x3c], 0x6a
mov dword [ebp + 0x40], 0x25
mov dword [ebp + 0x44], 0x26
mov dword [ebp + 0x48], 0x28
mov dword [ebp + 0x4c], 0x27
mov dword [ebp + 0x50], 0
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040eb00
mov dword [0x539970], eax
mov ebx, dword [0x539970]
and ebx, ebx
jle 0x4022ec
mov dword [0x539a10], 1
push 0
call fcn.0040ec50
mov dword [0x539a6c], eax
mov dword [0x5399a4], 1
mov eax, dword [0x539a6c]
cmp eax, dword [0x5399a4]
jl 0x4022e2
mov eax, dword [0x53a144]
push eax
push eax
push 0
call fcn.0040ed10
lea ecx, [0x539a70]
pop edx
call fcn.0040a000
push dword [0x539a70]
mov edx, str.SHIFT
pop ecx
call fcn.0040f3a0
je 0x402216
mov ebx, dword [0x5399a4]
mov ebp, dword [0x539cf0]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x539a70]
mov edx, str.CTRL
pop ecx
call fcn.0040f3a0
je 0x402240
mov ebx, dword [0x5399a4]
mov ebp, dword [0x539cf8]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x539a70]
mov edx, 0x41a241
pop ecx
call fcn.0040f3a0
je 0x40226a
mov ebx, dword [0x5399a4]
mov ebp, dword [0x539d00]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.0040ec50
push eax
mov ebx, dword [0x5399a4]
mov ebp, dword [0x539ce8]
shl ebx, 2
pop dword [ebp + ebx]
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x53a144]
push 0
mov ebx, dword [0x5399a4]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.0040a630
inc dword [0x53a144]
mov edx, dword [0x53883c]
add dword [esp], edx
call fcn.0040a130
pop dword [0x53a144]
push eax
mov ebx, dword [0x5399a4]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x5399a4]
jmp 0x4021be
push 0
call fcn.0040e8a0
mov ebx, dword [0x5399fc]
add ebx, 0x2c2973
mov dword [0x539a74], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x8348d0
mov dword [0x539a78], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x47205d
mov dword [0x539a7c], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x66d122
mov dword [0x539a80], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x59af17
mov dword [0x539a84], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x2b7b72
mov dword [0x539a88], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x823089
mov dword [0x539a8c], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x48a84f
mov dword [0x539a90], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x579a30
mov dword [0x539a94], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x3cfd03
mov dword [0x539a98], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x8263ac
mov dword [0x539a9c], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x2aeef5
mov dword [0x539aa0], ebx
mov ebx, dword [0x5399fc]
add ebx, 0x82f9dd
mov dword [0x539aa4], ebx
mov dword [0x539aa8], 0xc330418b
mov ebx, dword [0x5399fc]
add ebx, 0x100000
mov dword [0x539aac], ebx
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539aac]
push dword [0x539a60]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x539970], eax
mov eax, dword [0x5399d8]
call fcn.0040bf80
mov dword [0x539970], eax
mov ebx, dword [0x539970]
cmp ebx, dword [0x539aa8]
je 0x402487
push 0x5dc
call sub.KERNEL32.dll_Sleep
push 0
push 1
call fcn.0040b257
push str.Trainer_and_Game_Versions_do_not_match.__Please_check_versions.__Press_F1.
push 0
push 8
call fcn.0040ac9a
call fcn.0040871c
push 0xa
call sub.KERNEL32.dll_Sleep
push 0x70
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x40244f
jmp 0x408ab9
push 0x9c
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x60
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3d
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 8
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 8
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 9
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 7
mov ebx, dword [0x5399d8]
add ebx, 0xa
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc7
mov ebx, dword [0x5399d8]
add ebx, 0xb
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x41
mov ebx, dword [0x5399d8]
add ebx, 0xc
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
add ebx, 0xd
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xe
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xf
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x96
mov ebx, dword [0x5399d8]
add ebx, 0x10
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x45
mov ebx, dword [0x5399d8]
add ebx, 0x11
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x61
mov ebx, dword [0x5399d8]
add ebx, 0x12
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9d
mov ebx, dword [0x5399d8]
add ebx, 0x13
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x89
mov ebx, dword [0x5399d8]
add ebx, 0x14
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xd
mov ebx, dword [0x5399d8]
add ebx, 0x15
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x16
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0x17
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x18
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0x19
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xd9
mov ebx, dword [0x5399d8]
add ebx, 0x1a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x41
mov ebx, dword [0x5399d8]
add ebx, 0x1b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
add ebx, 0x1c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xd9
mov ebx, dword [0x5399d8]
add ebx, 0x1d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x58
mov ebx, dword [0x5399d8]
add ebx, 0x1e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x10
mov ebx, dword [0x5399d8]
add ebx, 0x1f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc3
mov ebx, dword [0x5399d8]
add ebx, 0x20
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 0x21
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x22
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x23
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x24
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x25
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x26
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x27
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x28
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x29
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x2a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x2b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x2c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x2d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x2e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x2f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x30
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x60
mov ebx, dword [0x5399d8]
add ebx, 0x31
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x66
mov ebx, dword [0x5399d8]
add ebx, 0x32
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3e
mov ebx, dword [0x5399d8]
add ebx, 0x33
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x81
mov ebx, dword [0x5399d8]
add ebx, 0x34
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x7c
mov ebx, dword [0x5399d8]
add ebx, 0x35
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0x36
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x58
mov ebx, dword [0x5399d8]
add ebx, 0x37
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xcf
mov ebx, dword [0x5399d8]
add ebx, 0x38
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x55
mov ebx, dword [0x5399d8]
add ebx, 0x39
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0x3a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x16
mov ebx, dword [0x5399d8]
add ebx, 0x3b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 0x3c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3d
mov ebx, dword [0x5399d8]
add ebx, 0x3d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
add ebx, 0x3e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0x3f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x40
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0x41
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 0x42
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0x43
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xd
mov ebx, dword [0x5399d8]
add ebx, 0x44
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x89
mov ebx, dword [0x5399d8]
add ebx, 0x45
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xd
mov ebx, dword [0x5399d8]
add ebx, 0x46
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 4
mov ebx, dword [0x5399d8]
add ebx, 0x47
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0x48
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x49
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0x4a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc7
mov ebx, dword [0x5399d8]
add ebx, 0x4b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x41
mov ebx, dword [0x5399d8]
add ebx, 0x4c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
add ebx, 0x4d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x4e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x40
mov ebx, dword [0x5399d8]
add ebx, 0x4f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x50
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x46
mov ebx, dword [0x5399d8]
add ebx, 0x51
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xe9
mov ebx, dword [0x5399d8]
add ebx, 0x52
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x89
mov ebx, dword [0x5399d8]
add ebx, 0x53
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x54
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x55
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x56
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 0x57
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x58
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x59
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x5a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x5b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x5c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x5d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x5e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x5f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8b
mov ebx, dword [0x5399d8]
add ebx, 0x60
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8e
mov ebx, dword [0x5399d8]
add ebx, 0x61
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 8
mov ebx, dword [0x5399d8]
add ebx, 0x62
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 0x63
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x64
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x65
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xa3
mov ebx, dword [0x5399d8]
add ebx, 0x66
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x10
mov ebx, dword [0x5399d8]
add ebx, 0x67
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0x68
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x69
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0x6a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc3
mov ebx, dword [0x5399d8]
add ebx, 0x6b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x6c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x6d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x6e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x6f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x70
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x60
mov ebx, dword [0x5399d8]
add ebx, 0x71
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 0x72
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3d
mov ebx, dword [0x5399d8]
add ebx, 0x73
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x14
mov ebx, dword [0x5399d8]
add ebx, 0x74
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0x75
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x76
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0x77
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 0x78
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0x79
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x12
mov ebx, dword [0x5399d8]
add ebx, 0x7a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc7
mov ebx, dword [0x5399d8]
add ebx, 0x7b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 0x7c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x7f
mov ebx, dword [0x5399d8]
add ebx, 0x7d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x96
mov ebx, dword [0x5399d8]
add ebx, 0x7e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x98
mov ebx, dword [0x5399d8]
add ebx, 0x7f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x80
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x61
mov ebx, dword [0x5399d8]
add ebx, 0x81
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9d
mov ebx, dword [0x5399d8]
add ebx, 0x82
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xb8
mov ebx, dword [0x5399d8]
add ebx, 0x83
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x7f
mov ebx, dword [0x5399d8]
add ebx, 0x84
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x96
mov ebx, dword [0x5399d8]
add ebx, 0x85
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x98
mov ebx, dword [0x5399d8]
add ebx, 0x86
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x87
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x89
mov ebx, dword [0x5399d8]
add ebx, 0x88
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x46
mov ebx, dword [0x5399d8]
add ebx, 0x89
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x30
mov ebx, dword [0x5399d8]
add ebx, 0x8a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xeb
mov ebx, dword [0x5399d8]
add ebx, 0x8b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 5
mov ebx, dword [0x5399d8]
add ebx, 0x8c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x61
mov ebx, dword [0x5399d8]
add ebx, 0x8d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9d
mov ebx, dword [0x5399d8]
add ebx, 0x8e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x89
mov ebx, dword [0x5399d8]
add ebx, 0x8f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x46
mov ebx, dword [0x5399d8]
add ebx, 0x90
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x30
mov ebx, dword [0x5399d8]
add ebx, 0x91
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc3
mov ebx, dword [0x5399d8]
add ebx, 0x92
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 0x93
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x94
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x95
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x96
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x97
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x98
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x99
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x9a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x9b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x9c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x9d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x9e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x9f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0xa0
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x60
mov ebx, dword [0x5399d8]
add ebx, 0xa1
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x39
mov ebx, dword [0x5399d8]
add ebx, 0xa2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3d
mov ebx, dword [0x5399d8]
add ebx, 0xa3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xa4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0xa5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0xa6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0xa7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x74
mov ebx, dword [0x5399d8]
add ebx, 0xa8
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x18
mov ebx, dword [0x5399d8]
add ebx, 0xa9
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x39
mov ebx, dword [0x5399d8]
add ebx, 0xaa
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3d
mov ebx, dword [0x5399d8]
add ebx, 0xab
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 4
mov ebx, dword [0x5399d8]
add ebx, 0xac
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0xad
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0xae
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0xaf
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x74
mov ebx, dword [0x5399d8]
add ebx, 0xb0
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x10
mov ebx, dword [0x5399d8]
add ebx, 0xb1
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 0xb2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3d
mov ebx, dword [0x5399d8]
add ebx, 0xb3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x18
mov ebx, dword [0x5399d8]
add ebx, 0xb4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0xb5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0xb6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0xb7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 0xb8
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0xb9
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 7
mov ebx, dword [0x5399d8]
add ebx, 0xba
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc7
mov ebx, dword [0x5399d8]
add ebx, 0xbb
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x47
mov ebx, dword [0x5399d8]
add ebx, 0xbc
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
add ebx, 0xbd
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xbe
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xbf
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xc0
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xc1
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x61
mov ebx, dword [0x5399d8]
add ebx, 0xc2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9d
mov ebx, dword [0x5399d8]
add ebx, 0xc3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xf3
mov ebx, dword [0x5399d8]
add ebx, 0xc4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xf
mov ebx, dword [0x5399d8]
add ebx, 0xc5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x10
mov ebx, dword [0x5399d8]
add ebx, 0xc6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x47
mov ebx, dword [0x5399d8]
add ebx, 0xc7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
add ebx, 0xc8
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc3
mov ebx, dword [0x5399d8]
add ebx, 0xc9
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xca
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xcb
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xcc
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xcd
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xce
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xcf
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xf3
mov ebx, dword [0x5399d8]
add ebx, 0xd0
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xf
mov ebx, dword [0x5399d8]
add ebx, 0xd1
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x10
mov ebx, dword [0x5399d8]
add ebx, 0xd2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x43
mov ebx, dword [0x5399d8]
add ebx, 0xd3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3c
mov ebx, dword [0x5399d8]
add ebx, 0xd4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x89
mov ebx, dword [0x5399d8]
add ebx, 0xd5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1d
mov ebx, dword [0x5399d8]
add ebx, 0xd6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1c
mov ebx, dword [0x5399d8]
add ebx, 0xd7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0xd8
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0xd9
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0xda
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc3
mov ebx, dword [0x5399d8]
add ebx, 0xdb
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xdc
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xdd
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xde
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xdf
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x66
mov ebx, dword [0x5399d8]
add ebx, 0xe0
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3e
mov ebx, dword [0x5399d8]
add ebx, 0xe1
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x81
mov ebx, dword [0x5399d8]
add ebx, 0xe2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x7c
mov ebx, dword [0x5399d8]
add ebx, 0xe3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0xe4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x58
mov ebx, dword [0x5399d8]
add ebx, 0xe5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xd0
mov ebx, dword [0x5399d8]
add ebx, 0xe6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x69
mov ebx, dword [0x5399d8]
add ebx, 0xe7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0xe8
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x10
mov ebx, dword [0x5399d8]
add ebx, 0xe9
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 0xea
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3d
mov ebx, dword [0x5399d8]
add ebx, 0xeb
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x20
mov ebx, dword [0x5399d8]
add ebx, 0xec
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0xed
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0xee
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0xef
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 0xf0
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0xf1
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 7
mov ebx, dword [0x5399d8]
add ebx, 0xf2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc7
mov ebx, dword [0x5399d8]
add ebx, 0xf3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x41
mov ebx, dword [0x5399d8]
add ebx, 0xf4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
add ebx, 0xf5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0xf6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x40
mov ebx, dword [0x5399d8]
add ebx, 0xf7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0xf8
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x46
mov ebx, dword [0x5399d8]
add ebx, 0xf9
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x66
mov ebx, dword [0x5399d8]
add ebx, 0xfa
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3e
mov ebx, dword [0x5399d8]
add ebx, 0xfb
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x81
mov ebx, dword [0x5399d8]
add ebx, 0xfc
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x7c
mov ebx, dword [0x5399d8]
add ebx, 0xfd
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0xfe
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x58
mov ebx, dword [0x5399d8]
add ebx, 0xff
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x2e
mov ebx, dword [0x5399d8]
add ebx, 0x100
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xef
mov ebx, dword [0x5399d8]
add ebx, 0x101
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0x102
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x11
mov ebx, dword [0x5399d8]
add ebx, 0x103
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 0x104
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3d
mov ebx, dword [0x5399d8]
add ebx, 0x105
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0x106
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0x107
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x108
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0x109
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x10a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x74
mov ebx, dword [0x5399d8]
add ebx, 0x10b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 8
mov ebx, dword [0x5399d8]
add ebx, 0x10c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xa1
mov ebx, dword [0x5399d8]
add ebx, 0x10d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0x10e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0x10f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x110
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0x111
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x89
mov ebx, dword [0x5399d8]
add ebx, 0x112
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x41
mov ebx, dword [0x5399d8]
add ebx, 0x113
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
add ebx, 0x114
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x61
mov ebx, dword [0x5399d8]
add ebx, 0x115
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9d
mov ebx, dword [0x5399d8]
add ebx, 0x116
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xd9
mov ebx, dword [0x5399d8]
add ebx, 0x117
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x41
mov ebx, dword [0x5399d8]
add ebx, 0x118
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc
mov ebx, dword [0x5399d8]
add ebx, 0x119
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8b
mov ebx, dword [0x5399d8]
add ebx, 0x11a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x44
mov ebx, dword [0x5399d8]
add ebx, 0x11b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0x11c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 8
mov ebx, dword [0x5399d8]
add ebx, 0x11d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc3
mov ebx, dword [0x5399d8]
add ebx, 0x11e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 0x11f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x120
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x121
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x122
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x123
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x124
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x125
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x126
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x127
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x128
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x129
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x12a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x12b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x12c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x12d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x12e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x12f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x89
mov ebx, dword [0x5399d8]
add ebx, 0x130
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x44
mov ebx, dword [0x5399d8]
add ebx, 0x131
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0x132
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0x133
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x89
mov ebx, dword [0x5399d8]
add ebx, 0x134
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x6c
mov ebx, dword [0x5399d8]
add ebx, 0x135
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0x136
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x18
mov ebx, dword [0x5399d8]
add ebx, 0x137
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x138
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x60
mov ebx, dword [0x5399d8]
add ebx, 0x139
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 0x13a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3d
mov ebx, dword [0x5399d8]
add ebx, 0x13b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x28
mov ebx, dword [0x5399d8]
add ebx, 0x13c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0x13d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x13e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0x13f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 0x140
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0x141
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 6
mov ebx, dword [0x5399d8]
add ebx, 0x142
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x61
mov ebx, dword [0x5399d8]
add ebx, 0x143
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9d
mov ebx, dword [0x5399d8]
add ebx, 0x144
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 0x145
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xf8
mov ebx, dword [0x5399d8]
add ebx, 0x146
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x26
mov ebx, dword [0x5399d8]
add ebx, 0x147
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc3
mov ebx, dword [0x5399d8]
add ebx, 0x148
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x61
mov ebx, dword [0x5399d8]
add ebx, 0x149
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9d
mov ebx, dword [0x5399d8]
add ebx, 0x14a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc3
mov ebx, dword [0x5399d8]
add ebx, 0x14b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x14c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x14d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x14e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x14f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8b
mov ebx, dword [0x5399d8]
add ebx, 0x150
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x49
mov ebx, dword [0x5399d8]
add ebx, 0x151
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x30
mov ebx, dword [0x5399d8]
add ebx, 0x152
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8b
mov ebx, dword [0x5399d8]
add ebx, 0x153
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 4
mov ebx, dword [0x5399d8]
add ebx, 0x154
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x81
mov ebx, dword [0x5399d8]
add ebx, 0x155
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x156
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x60
mov ebx, dword [0x5399d8]
add ebx, 0x157
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 0x158
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3d
mov ebx, dword [0x5399d8]
add ebx, 0x159
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x2c
mov ebx, dword [0x5399d8]
add ebx, 0x15a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x3f
mov ebx, dword [0x5399d8]
add ebx, 0x15b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9c
mov ebx, dword [0x5399d8]
add ebx, 0x15c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 0x15d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 0x15e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0x15f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0x160
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x66
mov ebx, dword [0x5399d8]
add ebx, 0x161
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x81
mov ebx, dword [0x5399d8]
add ebx, 0x162
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x7c
mov ebx, dword [0x5399d8]
add ebx, 0x163
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0x164
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x48
mov ebx, dword [0x5399d8]
add ebx, 0x165
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x20
mov ebx, dword [0x5399d8]
add ebx, 0x166
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x58
mov ebx, dword [0x5399d8]
add ebx, 0x167
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 0x168
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 0x169
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0x16a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x19
mov ebx, dword [0x5399d8]
add ebx, 0x16b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x66
mov ebx, dword [0x5399d8]
add ebx, 0x16c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x81
mov ebx, dword [0x5399d8]
add ebx, 0x16d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x7c
mov ebx, dword [0x5399d8]
add ebx, 0x16e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 0x16f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x64
mov ebx, dword [0x5399d8]
add ebx, 0x170
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 0x171
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 5
mov ebx, dword [0x5399d8]
add ebx, 0x172
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 0x173
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 0x174
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x75
mov ebx, dword [0x5399d8]
add ebx, 0x175
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xe
mov ebx, dword [0x5399d8]
add ebx, 0x176
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8b
mov ebx, dword [0x5399d8]
add ebx, 0x177
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xf9
mov ebx, dword [0x5399d8]
add ebx, 0x178
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xb9
mov ebx, dword [0x5399d8]
add ebx, 0x179
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x21
mov ebx, dword [0x5399d8]
add ebx, 0x17a
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x17b
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x17c
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 0x17d
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x33
mov ebx, dword [0x5399d8]
add ebx, 0x17e
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc0
mov ebx, dword [0x5399d8]
add ebx, 0x17f
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 0x180
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xe8
mov ebx, dword [0x5399d8]
add ebx, 0x181
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 0x182
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xf3
mov ebx, dword [0x5399d8]
add ebx, 0x183
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xab
mov ebx, dword [0x5399d8]
add ebx, 0x184
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x61
mov ebx, dword [0x5399d8]
add ebx, 0x185
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x9d
mov ebx, dword [0x5399d8]
add ebx, 0x186
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc3
mov ebx, dword [0x5399d8]
add ebx, 0x187
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 0x188
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x1091
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f00
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x10a7
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x1135
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f04
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x10d8
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x113d
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f08
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x1095
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f0c
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x10cf
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f10
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x10f8
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f14
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x1105
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f18
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x1145
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f1c
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x1168
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f20
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x117d
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f24
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x1197
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x119f
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f28
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x11cd
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x3f2c
push ebx
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x11eb
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0xe8
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x1091
sub ebx, dword [0x539a74]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 6
push dword [0x5399d8]
push dword [0x539a74]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0xe8
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x10c1
sub ebx, dword [0x539a78]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 7
push dword [0x5399d8]
push dword [0x539a78]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0xe8
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x10f1
sub ebx, dword [0x539a80]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 6
push dword [0x5399d8]
push dword [0x539a80]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0xe8
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x5e
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc3
mov ebx, dword [0x5399d8]
add ebx, 6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x1101
sub ebx, dword [0x539a84]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 7
push dword [0x5399d8]
push dword [0x539a84]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0xe8
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x1131
sub ebx, dword [0x539a88]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 5
push dword [0x5399d8]
push dword [0x539a88]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0xe8
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x1161
sub ebx, dword [0x539a8c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 5
push dword [0x5399d8]
push dword [0x539a8c]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0xe8
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x11c1
sub ebx, dword [0x539a9c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 8
push dword [0x5399d8]
push dword [0x539a9c]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0xe8
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
mov ebx, dword [0x539a50]
add ebx, 0x11e1
sub ebx, dword [0x539aa4]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 6
push dword [0x5399d8]
push dword [0x539aa4]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov dword [0x539ab0], 0
mov eax, 0xff
cmp eax, dword [0x539ab0]
jl 0x405b30
push dword [0x539ab0]
call sub.USER32.dll_GetAsyncKeyState
inc dword [0x539ab0]
jmp 0x405b10
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x405b3f
push 0x55009553
ret
mov ebp, dword [0x539ce8]
push dword [ebp + 4]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 4]
mov ebp, dword [0x539ce8]
push dword [ebp + 8]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 8]
mov ebp, dword [0x539ce8]
push dword [ebp + 0xc]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0xc]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x10]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x10]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x14]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x14]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x18]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x18]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x1c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x1c]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x20]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x20]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x24]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x24]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x28]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x28]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x2c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x2c]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x30]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x30]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x34]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x34]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x38]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x38]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x3c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x3c]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x40]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x40]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x44]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x44]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x48]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x48]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x4c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x4c]
mov ebp, dword [0x539ce8]
push dword [ebp + 0x50]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x539d08]
pop dword [ebp + 0x50]
push 0x10
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x539ab4], eax
push 0x11
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x539ab8], eax
push 0x12
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x539abc], eax
mov eax, 0x32
call fcn.0040be39
mov dword [0x539a38], eax
mov ebx, dword [0x539a38]
cmp ebx, 0x19
jne 0x405e02
mov ebx, dword [0x5399ac]
cmp ebx, dword [0x5399b4]
jne 0x405d8e
mov ebx, dword [0x5399ac]
and ebx, ebx
je 0x405d8e
mov ebx, dword [0x5399b4]
and ebx, ebx
je 0x405d8e
jmp 0x405d95
mov eax, 1
jmp 0x405d97
xor eax, eax
and eax, eax
je 0x405e02
mov eax, 0xff
call fcn.0040be39
mov dword [0x539a54], eax
mov eax, 0x190
call fcn.0040be39
mov dword [0x539a58], eax
push dword [0x539a54]
mov eax, dword [0x5399d8]
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 1
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, dword [0x539a58]
add ebx, 0x1091
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f10
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x539970], eax
mov eax, dword [0x5399d8]
call fcn.0040bf80
mov dword [0x539ac0], eax
mov ebx, dword [0x539ac0]
add ebx, 0x30
mov dword [0x539ac4], ebx
mov ebx, dword [0x539ac0]
add ebx, 0x38
mov dword [0x539ac8], ebx
mov ebx, dword [0x539ac0]
add ebx, 0x34
mov dword [0x539acc], ebx
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f1c
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x539970], eax
mov eax, dword [0x5399d8]
call fcn.0040bf80
mov dword [0x539ac0], eax
mov ebx, dword [0x539ac0]
add ebx, 0x3c
mov dword [0x539ad0], ebx
mov ebp, dword [0x539ce8]
push dword [ebp + 4]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 4]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 4]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 4]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539ad4], ebx
mov ebx, dword [0x539ad4]
and ebx, ebx
je 0x405ff6
push dword [0x539ad8]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x405f86
mov dword [0x539ad8], 1
push 1
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f08
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
jmp 0x405ff5
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405ff5
mov dword [0x539ad8], 0
push 0
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f08
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 6
call fcn.0040b257
pop eax
mov ebp, dword [0x539ce8]
push dword [ebp + 8]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 8]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 8]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 8]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539adc], ebx
mov ebx, dword [0x539adc]
and ebx, ebx
je 0x406134
push dword [0x539ae0]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4060c4
mov dword [0x539ae0], 1
push 1
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f0c
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
jmp 0x406133
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406133
mov dword [0x539ae0], 0
push 0
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f0c
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 6
call fcn.0040b257
pop eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0xc]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0xc]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0xc]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0xc]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539ae4], ebx
mov ebx, dword [0x539ae4]
and ebx, ebx
je 0x40630d
push dword [0x539ae8]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406251
mov dword [0x539ae8], 1
push 0x90
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539a7c]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
jmp 0x40630c
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40630c
mov dword [0x539ae8], 0
push 0x83
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x46
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1c
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xff
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539a7c]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 6
call fcn.0040b257
pop eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x10]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x10]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x10]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x10]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539aec], ebx
mov ebx, dword [0x539aec]
and ebx, ebx
je 0x40644b
push dword [0x539af0]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4063db
mov dword [0x539af0], 1
push 1
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f14
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
jmp 0x40644a
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40644a
mov dword [0x539af0], 0
push 0
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f14
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 6
call fcn.0040b257
pop eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x14]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x14]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x14]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x14]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539af4], ebx
mov ebx, dword [0x539af4]
and ebx, ebx
je 0x406589
push dword [0x539af8]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406519
mov dword [0x539af8], 1
push 1
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f18
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
jmp 0x406588
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406588
mov dword [0x539af8], 0
push 0
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f18
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 6
call fcn.0040b257
pop eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x18]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x18]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x18]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x18]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539afc], ebx
mov ebx, dword [0x539afc]
and ebx, ebx
je 0x4066a1
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ac4]
push dword [0x539a60]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x539970], eax
mov eax, dword [0x5399d8]
call fcn.0040bfa0
fistp dword [0x539b00]
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ac8]
push dword [0x539a60]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x539970], eax
mov eax, dword [0x5399d8]
call fcn.0040bfa0
fistp dword [0x539b04]
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539acc]
push dword [0x539a60]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x539970], eax
mov eax, dword [0x5399d8]
call fcn.0040bfa0
fistp dword [0x539b08]
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.0040b257
mov ebp, dword [0x539ce8]
push dword [ebp + 0x1c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b0c], ebx
mov ebx, dword [0x539b0c]
and ebx, ebx
je 0x40688d
mov ebx, dword [0x539b00]
and ebx, ebx
je 0x40688d
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ac4]
push dword [0x539a60]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x539970], eax
mov eax, dword [0x5399d8]
call fcn.0040bfa0
fistp dword [0x539b10]
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ac8]
push dword [0x539a60]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x539970], eax
mov eax, dword [0x5399d8]
call fcn.0040bfa0
fistp dword [0x539b14]
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539acc]
push dword [0x539a60]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x539970], eax
mov eax, dword [0x5399d8]
call fcn.0040bfa0
fistp dword [0x539b18]
push dword [0x539b00]
fild dword [esp]
fstp dword [esp]
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ac4]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push dword [0x539b04]
fild dword [esp]
fstp dword [esp]
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ac8]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push dword [0x539b08]
fild dword [esp]
fstp dword [esp]
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539acc]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.0040b257
mov ebp, dword [0x539ce8]
push dword [ebp + 0x20]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x20]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x20]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x20]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b1c], ebx
mov ebx, dword [0x539b1c]
and ebx, ebx
je 0x4069d4
mov ebx, dword [0x539b10]
and ebx, ebx
je 0x4069d4
push dword [0x539b10]
fild dword [esp]
fstp dword [esp]
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ac4]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push dword [0x539b14]
fild dword [esp]
fstp dword [esp]
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ac8]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push dword [0x539b18]
fild dword [esp]
fstp dword [esp]
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539acc]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.0040b257
mov ebp, dword [0x539ce8]
push dword [ebp + 0x24]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x24]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x24]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x24]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b20], ebx
mov ebx, dword [0x539b20]
and ebx, ebx
je 0x406a7e
push 0x3e800000
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ad0]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.0040b257
mov ebp, dword [0x539ce8]
push dword [ebp + 0x28]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x28]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x28]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x28]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b24], ebx
mov ebx, dword [0x539b24]
and ebx, ebx
je 0x406b28
push 0x40400000
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ad0]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.0040b257
mov ebp, dword [0x539ce8]
push dword [ebp + 0x2c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b28], ebx
mov ebx, dword [0x539b28]
and ebx, ebx
je 0x406bd2
push 0x3f800000
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
push dword [0x539ad0]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.0040b257
mov ebp, dword [0x539ce8]
push dword [ebp + 0x30]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x30]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x30]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x30]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b2c], ebx
mov ebx, dword [0x539b2c]
and ebx, ebx
je 0x406e7b
push dword [0x539b30]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406d57
mov dword [0x539b30], 1
push 0x90
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 8
push dword [0x5399d8]
push dword [0x539a90]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
jmp 0x406e7a
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406e7a
mov dword [0x539b30], 0
push 0xf3
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xf
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x11
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8e
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x84
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x10
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 8
push dword [0x5399d8]
push dword [0x539a90]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 6
call fcn.0040b257
pop eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x34]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x34]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x34]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x34]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b34], ebx
mov ebx, dword [0x539b34]
and ebx, ebx
je 0x407158
push dword [0x539b38]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x40701a
mov dword [0x539b38], 1
push 0xb8
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xc2
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 8
mov ebx, dword [0x5399d8]
add ebx, 6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 8
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 9
push dword [0x5399d8]
push dword [0x539a94]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
jmp 0x407157
mov ebx, 1
cmp ebx, dword [esp]
jne 0x407157
mov dword [0x539b38], 0
push 0x8b
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x44
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x24
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 4
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x83
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0xf8
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 6
mov ebx, dword [0x5399d8]
add ebx, 6
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x77
mov ebx, dword [0x5399d8]
add ebx, 7
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x1f
mov ebx, dword [0x5399d8]
add ebx, 8
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 9
push dword [0x5399d8]
push dword [0x539a94]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 6
call fcn.0040b257
pop eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x38]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x38]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x38]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x38]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b3c], ebx
mov ebx, dword [0x539b3c]
and ebx, ebx
je 0x407296
push dword [0x539b40]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x407226
mov dword [0x539b40], 1
push 1
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f20
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
jmp 0x407295
mov ebx, 1
cmp ebx, dword [esp]
jne 0x407295
mov dword [0x539b40], 0
push 0
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f20
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 6
call fcn.0040b257
pop eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x3c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b44], ebx
mov ebx, dword [0x539b44]
and ebx, ebx
je 0x4074d7
push dword [0x539b48]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4073e7
mov dword [0x539b48], 1
push 0xe9
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x33
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 6
push dword [0x5399d8]
push dword [0x539a98]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
jmp 0x4074d6
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4074d6
mov dword [0x539b48], 0
push 0xf
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8b
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x32
mov ebx, dword [0x5399d8]
add ebx, 2
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 1
mov ebx, dword [0x5399d8]
add ebx, 3
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 4
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0
mov ebx, dword [0x5399d8]
add ebx, 5
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 6
push dword [0x5399d8]
push dword [0x539a98]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 6
call fcn.0040b257
pop eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x40]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x40]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x40]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x40]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b4c], ebx
mov ebx, dword [0x539b4c]
and ebx, ebx
je 0x4076d4
push dword [0x539b50]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x407606
mov dword [0x539b50], 1
push 1
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f28
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0xf
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x85
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 2
push dword [0x5399d8]
mov ebx, dword [0x539a9c]
add ebx, 8
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
jmp 0x4076d3
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4076d3
mov dword [0x539b50], 0
push 0
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f28
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0xf
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x8e
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 2
push dword [0x5399d8]
mov ebx, dword [0x539a9c]
add ebx, 8
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 6
call fcn.0040b257
pop eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x44]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x44]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x44]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x44]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b54], ebx
mov ebx, dword [0x539b54]
and ebx, ebx
je 0x407821
push 0x497423f0
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f24
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 2
push dword [0x5399d8]
push dword [0x539aa0]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
push 0
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f24
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x48]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x48]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x48]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x48]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b58], ebx
mov ebx, dword [0x539b58]
and ebx, ebx
je 0x40796e
push 0x3e800000
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f24
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push 0x90
mov ebx, dword [0x5399d8]
inc ebx
mov eax, ebx
call fcn.0040bf70
mov dword [0x539970], eax
push dword [0x539a64]
push 2
push dword [0x5399d8]
push dword [0x539aa0]
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0
push 5
call fcn.0040b257
push 0
mov eax, dword [0x5399d8]
call fcn.0040bfb0
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f24
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x4c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b5c], ebx
mov ebx, dword [0x539b5c]
and ebx, ebx
je 0x407a65
push 1
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f2c
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
push 0
push 5
call fcn.0040b257
push 0x1388
call sub.KERNEL32.dll_Sleep
push 0
mov eax, dword [0x5399d8]
call fcn.0040bf90
mov dword [0x539970], eax
push dword [0x539a64]
push 4
push dword [0x5399d8]
mov ebx, dword [0x539a50]
add ebx, 0x3f2c
push ebx
push dword [0x539a60]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x539970], eax
mov ebp, dword [0x539ce8]
push dword [ebp + 0x50]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x539cf0]
mov edi, dword [ebp + 0x50]
add edi, dword [0x539ab4]
imul ebx, edi
mov ebp, dword [0x539cf8]
mov edi, dword [ebp + 0x50]
add edi, dword [0x539ab8]
imul ebx, edi
mov ebp, dword [0x539d00]
mov edi, dword [ebp + 0x50]
add edi, dword [0x539abc]
imul ebx, edi
mov dword [0x539b60], ebx
mov ebx, dword [0x539b60]
and ebx, ebx
je 0x407abb
mov dword [0x539ad4], 0
mov dword [0x539adc], 0
mov dword [0x539ae4], 0
mov dword [0x539aec], 0
mov dword [0x539af4], 0
mov dword [0x539afc], 0
mov dword [0x539b0c], 0
mov dword [0x539b1c], 0
mov dword [0x539b20], 0
mov dword [0x539b24], 0
mov dword [0x539b28], 0
mov dword [0x539b2c], 0
mov dword [0x539b34], 0
mov dword [0x539b3c], 0
mov dword [0x539b44], 0
mov dword [0x539b4c], 0
mov dword [0x539b54], 0
mov dword [0x539b58], 0
mov dword [0x539b5c], 0
mov dword [0x539b60], 0
mov ebx, dword [0x5399d4]
cmp ebx, 0x45a2a5
je 0x407ba0
push 0
push 3
call fcn.0040cec2
call fcn.0040871c
push 1
call sub.KERNEL32.dll_Sleep
mov eax, 0x12c
call fcn.0040be39
mov dword [0x539a38], eax
mov ebx, dword [0x539a38]
cmp ebx, 0x63
jne 0x407c79
mov eax, dword [0x53a144]
push eax
push eax
push dword [0x53a144]
call fcn.0040b91f
inc dword [0x53a144]
push 0
mov edx, dword [0x53883c]
add dword [esp + 4], edx
call fcn.0040eb00
pop dword [0x53a144]
push 0
call fcn.0040eb20
mov dword [0x5399a0], eax
mov dword [0x5399a4], 1
mov ebx, dword [0x5399a0]
add ebx, 0xfffffffc
cmp ebx, dword [0x5399a4]
jl 0x407c40
push 0
call fcn.0040ec50
mov dword [0x5399b8], eax
inc dword [0x5399a4]
jmp 0x407c18
push 0
call fcn.0040ebf0
mov dword [0x5399b0], eax
push 0
call fcn.0040e8a0
mov ebx, dword [0x5399b0]
cmp ebx, dword [0x5399a0]
jne 0x407c69
jmp 0x407c6c
inc eax
push esp
ret
mov ebx, dword [0x539a2c]
and ebx, ebx
jne 0x407c79
inc eax
push esp
ret
mov ebx, dword [0x5399ac]
cmp ebx, dword [0x5399b4]
jne 0x407c9d
mov ebx, dword [0x5399ac]
and ebx, ebx
je 0x407c9d
mov ebx, dword [0x5399b4]
and ebx, ebx
je 0x407c9d
jmp 0x407ca4
mov eax, 1
jmp 0x407ca6
xor eax, eax
and eax, eax
je 0x407cfd
mov eax, 0xa
call fcn.0040be39
mov ebx, eax
add ebx, 0xa
mov dword [0x539a54], ebx
mov eax, 0x28
call fcn.0040be39
mov ebx, eax
add ebx, 0x28
mov dword [0x539a58], ebx
mov ebx, dword [0x539a04]
add ebx, dword [0x539a54]
mov dword [0x539a04], ebx
mov ebx, dword [0x539a50]
add ebx, dword [0x539a58]
mov dword [0x539a50], ebx
jmp 0x4022ec
jmp 0x405b06
push 0
call 0x408ad3
push dword [0x539964]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040ae92
call fcn.0040bfe0
call fcn.0040c127
call fcn.0040c741
call fcn.0040d5f8
call fcn.0040e900
call fcn.0040f289
ret