Function at 0x401000
Capabilities:
Allocate thread local storage
Check for time delay via gettickcount
Check internet connectivity via wininet

Disassembly:
push 0x768
push 0
push 0x494a6c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x494a70], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x494a6c], eax
mov eax, 0x483a48
mov dword [0x494a74], eax
call fcn.00414410
call fcn.00413bc1
call fcn.00413170
call fcn.004125c3
call fcn.00412351
call fcn.00412247
call fcn.00411930
call fcn.0041152e
call fcn.004114bc
call fcn.0040fe55
call fcn.0040e75f
call fcn.0040e2b5
call fcn.0040df50
call fcn.0040d881
call fcn.0040d718
call fcn.0040c377
call fcn.0040e6e0
call fcn.0040c970
call fcn.00414440
push eax
push eax
call fcn.00411640
push 0x494a78
call fcn.00414460
call fcn.00414440
push eax
mov edx, dword [0x494a78]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.0.ogg
call fcn.004144f0
call fcn.00414550
push 0
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411a70
call fcn.004145b0
mov ebp, 0x45135a
mov ebx, ebp
mov ebp, 0x44e7c4
sub ebx, ebp
push ebx
mov ebp, 0x44e7c4
push ebp
push 0
call fcn.00411ad0
push 0
call fcn.004118c0
call fcn.00414440
push eax
mov edx, dword [0x494a78]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.1.ogg
call fcn.004144f0
call fcn.00414550
push 0
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411a70
call fcn.004145b0
mov ebp, 0x4542cb
mov ebx, ebp
mov ebp, 0x45135a
sub ebx, ebp
push ebx
mov ebp, 0x45135a
push ebp
push 0
call fcn.00411ad0
push 0
call fcn.004118c0
call fcn.00414440
push eax
mov edx, dword [0x494a78]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.3.ogg
call fcn.004144f0
call fcn.00414550
push 0
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411a70
call fcn.004145b0
mov ebp, 0x457900
mov ebx, ebp
mov ebp, 0x4542cb
sub ebx, ebp
push ebx
mov ebp, 0x4542cb
push ebp
push 0
call fcn.00411ad0
push 0
call fcn.004118c0
call fcn.00414440
push eax
mov edx, dword [0x494a78]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.4.ogg
call fcn.004144f0
call fcn.00414550
push 0
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411a70
call fcn.004145b0
mov ebp, 0x45c2d1
mov ebx, ebp
mov ebp, 0x457900
sub ebx, ebp
push ebx
mov ebp, 0x457900
push ebp
push 0
call fcn.00411ad0
call fcn.00414440
push eax
mov edx, dword [0x494a78]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.5.ogg
call fcn.004144f0
call fcn.00414550
push 0
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411a70
call fcn.004145b0
mov ebp, 0x45eede
mov ebx, ebp
mov ebp, 0x45c2d1
sub ebx, ebp
push ebx
mov ebp, 0x45c2d1
push ebp
push 0
call fcn.00411ad0
push 0
call fcn.004118c0
call fcn.0040ca00
call fcn.00414440
push eax
mov edx, dword [0x494a78]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.0.ogg
call fcn.004144f0
call fcn.00414550
push 0
call fcn.00414592
add dword [esp + 4], edx
call fcn.0040cbf8
call fcn.004145b0
mov dword [0x494a7c], eax
call fcn.00414440
push eax
mov edx, dword [0x494a78]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.1.ogg
call fcn.004144f0
call fcn.00414550
push 1
call fcn.00414592
add dword [esp + 4], edx
call fcn.0040cbf8
call fcn.004145b0
mov dword [0x494a7c], eax
call fcn.00414440
push eax
mov edx, dword [0x494a78]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.3.ogg
call fcn.004144f0
call fcn.00414550
push 3
call fcn.00414592
add dword [esp + 4], edx
call fcn.0040cbf8
call fcn.004145b0
mov dword [0x494a7c], eax
call fcn.00414440
push eax
mov edx, dword [0x494a78]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.4.ogg
call fcn.004144f0
call fcn.00414550
push 4
call fcn.00414592
add dword [esp + 4], edx
call fcn.0040cbf8
call fcn.004145b0
mov dword [0x494a7c], eax
call fcn.00414440
push eax
mov edx, dword [0x494a78]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.5.ogg
call fcn.004144f0
call fcn.00414550
push 5
call fcn.00414592
add dword [esp + 4], edx
call fcn.0040cbf8
call fcn.004145b0
mov dword [0x494a7c], eax
call fcn.0040e6e0
call fcn.00414440
push eax
push 0
push 0x40
call fcn.00414440
push eax
push eax
call fcn.0040d8b0
call fcn.00414592
add dword [esp], edx
call fcn.0040a3ea
push 0x494a94
call fcn.00414460
mov ebp, 0x45eede
push ebp
push 0
call fcn.004127cc
and eax, eax
je 0x402008
mov ebp, 0x470695
push ebp
push 2
call fcn.004127cc
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0x41
push 0x133
push 2
call fcn.00412996
push eax
call fcn.004123d1
call fcn.00412418
push 0x100
push 0x18
push 0x44e21b
push 1
call fcn.00411542
and eax, eax
je 0x4014b2
push 0x100
push 0x30
push 0x44e21b
push 2
call fcn.00411542
and eax, eax
je 0x4014cf
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004129b2
and eax, eax
je 0x4015b3
push 1
call fcn.00412860
push eax
call fcn.00412385
push 1
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dd90
push eax
push str.ZJCIQ
push 0
push 0
call fcn.0041248f
call fcn.00412418
push 0
push 0x64
push 0xc8
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0x11
call fcn.00412478
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0x49517c
push 0x44e7bc
push 8
push 0x65
push 4
call fcn.00412148
call fcn.00414440
push eax
push eax
call fcn.00411640
push 0x494a98
call fcn.00414460
call fcn.00414440
push eax
mov edx, dword [0x494a98]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.Options
call fcn.004144f0
call fcn.00414550
push 0xa
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411a70
call fcn.004145b0
and eax, eax
je 0x401654
mov ebp, 0x4817fc
mov ebx, ebp
mov ebp, str.MEGA_TRAINER_r_n1.0.447.0_r_n_r_nNumpad_1:_Super_Health_r_nNumpad_2:_Refill_Intuition_r_nNumpad_3:_Mega_Ammo_r_nNumpad_4:_No_Reload_r_nNumpad_5:_Safehouse_Unlocks_r_nNumpad_6:_Upgrade_Slots_r_nNumpad_7:_Attachment_Upgrades_r_nNumpad_8:_Invisible_Mode_r_nNumpad_9:_No_Recoil_r_nNumpad_0:_Improved_Aim
sub ebx, ebp
push ebx
mov ebp, str.MEGA_TRAINER_r_n1.0.447.0_r_n_r_nNumpad_1:_Super_Health_r_nNumpad_2:_Refill_Intuition_r_nNumpad_3:_Mega_Ammo_r_nNumpad_4:_No_Reload_r_nNumpad_5:_Safehouse_Unlocks_r_nNumpad_6:_Upgrade_Slots_r_nNumpad_7:_Attachment_Upgrades_r_nNumpad_8:_Invisible_Mode_r_nNumpad_9:_No_Recoil_r_nNumpad_0:_Improved_Aim
push ebp
push 0xa
call fcn.00411ad0
push 0xa
call fcn.004118c0
jmp 0x401668
push str.Could_not_install_the_file___Installtion_failed
push str.Error
call fcn.0040d755
jmp 0x40968d
call fcn.00414440
push eax
mov edx, dword [0x494a98]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.help.txt
call fcn.004144f0
call fcn.00414550
push 0
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411a70
call fcn.004145b0
and eax, eax
je 0x4016d5
mov ebp, 0x482e85
mov ebx, ebp
mov ebp, 0x4817fc
sub ebx, ebp
push ebx
mov ebp, 0x4817fc
push ebp
push 0
call fcn.00411ad0
push 0
call fcn.004118c0
jmp 0x4016e4
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040d755
push 0x49517c
push 0x44e7bc
push 8
push 0x65
push 4
call fcn.00412148
call fcn.00414440
push eax
mov edx, dword [0x494a98]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.Options
call fcn.004144f0
call fcn.00414550
push 0xa
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411a90
call fcn.004145b0
call fcn.00414440
push eax
push eax
push 0xa
call fcn.00411b30
mov edx, 0x44e087
call fcn.004144f0
push 0x494a9c
call fcn.00414460
call fcn.00414440
push eax
push eax
push 0xa
call fcn.00411b30
push 0x494aa0
call fcn.00414460
call fcn.00414440
push eax
push eax
push 0xa
call fcn.00411b30
mov ebx, dword [0x494aa4]
inc ebx
mov ebp, dword [0x49517c]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00414460
inc dword [0x494aa4]
push 0xa
call fcn.00411c70
mov ebx, eax
cmp ebx, 1
jne 0x401780
push 0xa
call fcn.004118c0
fild dword [0x494aa4]
fmul dword [0x44e79c]
fstp dword [0x494aa8]
fld dword [0x494aa8]
fmul dword [0x44e7a0]
fstp dword [0x494aac]
fld dword [0x494aa8]
fild dword [0x494aa4]
fdiv dword [0x44e7a4]
fdivp st(1)
fstp dword [0x494ab0]
fld dword [0x494aac]
fild dword [0x494aa4]
fdiv dword [0x44e7a4]
fdivp st(1)
fstp dword [0x494ab4]
fld dword [0x494aa8]
fcomp dword [0x44e7a8]
fnstsw ax
test ah, 1
jne 0x401844
mov ebx, dword [0x494aa4]
cmp ebx, 0x15
jl 0x401844
jmp 0x40184b
mov eax, 1
jmp 0x40184d
xor eax, eax
and eax, eax
je 0x401889
mov dword [0x494aa8], 0x44480000
mov dword [0x494aac], 0x44c80000
fld dword [0x494aa8]
fdiv dword [0x44e7a0]
fstp dword [0x494ab0]
fld dword [0x494aac]
fdiv dword [0x44e7a0]
fstp dword [0x494ab4]
push 0x120
fld dword [0x494aac]
push eax
fistp dword [esp]
fld dword [0x494aa8]
push eax
fistp dword [esp]
push 1
call fcn.004129b2
and eax, eax
je 0x401a23
push 1
call fcn.00412860
push eax
call fcn.00412385
push 1
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
mov dword [0x494ab8], 1
mov eax, dword [0x494aa4]
cmp eax, dword [0x494ab8]
jl 0x401941
push 0xff
push 0
push 0
mov eax, 0
call fcn.0040dd90
push eax
mov ebx, dword [0x494ab8]
mov ebp, dword [0x49517c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494ab8]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe8
push ebx
push 2
call fcn.0041248f
inc dword [0x494ab8]
jno 0x4018e8
mov dword [0x494ab8], 1
mov eax, dword [0x494aa4]
cmp eax, dword [0x494ab8]
jl 0x4019a4
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040dd90
push eax
mov ebx, dword [0x494ab8]
mov ebp, dword [0x49517c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494ab8]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe6
push ebx
push 0
call fcn.0041248f
inc dword [0x494ab8]
jno 0x40194b
call fcn.00412418
push 0
fld dword [0x494ab4]
push eax
fistp dword [esp]
fld dword [0x494ab0]
push eax
fistp dword [esp]
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0x11
call fcn.00412478
fld dword [0x494ab4]
push eax
fistp dword [esp]
fld dword [0x494ab0]
push eax
fistp dword [esp]
push 0x43
push 7
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0x120
push 0x190
push 0x640
push 1
call fcn.004129b2
and eax, eax
je 0x401b37
push 1
call fcn.00412860
push eax
call fcn.00412385
push 2
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
call fcn.00414440
push eax
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dd90
push eax
mov edx, dword [0x494a9c]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, dword [0x494aa0]
call fcn.004144f0
call fcn.00414550
push 0
push 0
call fcn.00414592
add dword [esp + 8], edx
call fcn.0041248f
call fcn.004145b0
call fcn.00412418
push 0
push 0x64
push 0x190
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0x11
call fcn.00412478
push 0x64
push 0x190
push 0x28
push 5
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0x90000001
push 0x44e01d
push 0
call fcn.00412c36
push eax
push 0
call fcn.00412c54
push eax
push 0
push 0
push 0
call fcn.004101a5
and eax, eax
je 0x402008
push str.CLOSEBUTTON
push 0x13
push 0x13
push 6
push 0x1e4
push 1
call fcn.0040e8e9
mov dword [0x494a7c], eax
push str.READMEBUTTON
push 0x20
push 0x11e
push 0x17e
push 0xa
push 3
call fcn.0040e8e9
mov dword [0x494a7c], eax
push str.TROUBLEBUTTON
push 0x20
push 0x11e
push 0x19c
push 0xa
push 4
call fcn.0040e8e9
mov dword [0x494a7c], eax
push str.CHBUTTON
push 0x23
push 0xf5
push 1
push 0x23
push 5
call fcn.0040e8e9
mov dword [0x494a7c], eax
push str.BOXARTBUTTON
push 0x118
push 0xc8
push 0x2d
push 0x132
push 6
call fcn.0040e8e9
mov dword [0x494a7c], eax
push 0x44e1dd
push 0x10e
push 0x122
push 0x41
push 0
push 7
call fcn.0040e8e9
mov dword [0x494a7c], eax
push 0
call fcn.004101c8
push eax
push 0x80000000
push str.Test
push 0x6b
push 0xc8
push 0
push 0xfffffc18
push 1
call fcn.0040fea5
push 0
call fcn.004101c8
push eax
call fcn.0040a991
push 0xff
push 0
call fcn.00412996
push eax
push 0
call fcn.004101c8
push eax
call fcn.004096d5
push 0
push 0
call fcn.004101e4
call fcn.00414440
push eax
push eax
mov edx, str.http:__www.cheathappens.com_trnflash.asp_id
call fcn.004144f0
mov edx, dword [0x494a94]
call fcn.004144f0
call fcn.00414550
push 0xc8
push 0x12c
push 0
push 0
push 2
call fcn.00414592
add dword [esp + 0x14], edx
call fcn.0040f9d1
call fcn.004145b0
mov dword [0x494a7c], eax
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
mov ebx, eax
and ebx, ebx
jne 0x401d4b
push 1
push 1
call fcn.004101e4
mov dword [0x494ab8], 1
mov eax, 4
cmp eax, dword [0x494ab8]
jl 0x402008
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004129b2
and eax, eax
je 0x401ea7
push 1
call fcn.00412860
push eax
call fcn.00412385
push 1
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dd90
push eax
push str.ZJCIQ
push 0
push 0
call fcn.0041248f
call fcn.00412418
push 0
push 0x64
push 0xc8
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0
call fcn.00412478
push 0xff
push 0x44
push 0x44
mov eax, 0x44
call fcn.0040dd90
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.0041250f
push 0x21
call fcn.00412478
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0xff
push 0
call fcn.00412996
push eax
push 0
call fcn.004101c8
push eax
call fcn.004096d5
push 0x32
call fcn.0040dda9
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004129b2
and eax, eax
je 0x401ff2
push 1
call fcn.00412860
push eax
call fcn.00412385
push 1
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040dd90
push eax
push str.ZJCIQ
push 0
push 0
call fcn.0041248f
call fcn.00412418
push 0
push 0x64
push 0xc8
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0
call fcn.00412478
push 0xff
push 0x44
push 0x44
mov eax, 0x44
call fcn.0040dd90
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.0041250f
push 0x21
call fcn.00412478
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0xff
push 0
call fcn.00412996
push eax
push 0
call fcn.004101c8
push eax
call fcn.004096d5
push 0x32
call fcn.0040dda9
inc dword [0x494ab8]
jno 0x401d55
push 0x495184
push 0x44e7bc
push 8
push 0x100
push 4
call fcn.00412148
mov eax, 0x482e85
mov dword [0x494a74], eax
lea ecx, [0x494abc]
mov edx, dword [0x494a74]
call fcn.0040b008
add dword [0x494a74], eax
mov dword [0x494ab8], 1
mov eax, 0xfe
cmp eax, dword [0x494ab8]
jl 0x4020c7
call fcn.00414440
push eax
push eax
push 0x44e031
push dword [0x494ab8]
push dword [0x494abc]
call fcn.0040b0c0
push 0x494ac0
call fcn.00414460
call fcn.00414440
push eax
push eax
push dword [0x494ac0]
call fcn.0040b160
mov ebx, eax
dec ebx
push ebx
push dword [0x494ac0]
call fcn.0040b190
mov ebx, dword [0x494ab8]
mov ebp, dword [0x495184]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00414460
inc dword [0x494ab8]
jno 0x402051
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4020d7
push 0x75009553
inc ecx
ret
push 0x12c
call fcn.0040dda9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004129b2
and eax, eax
je 0x402222
push 1
call fcn.00412860
push eax
call fcn.00412385
push 1
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dd90
push eax
push str.Authenticating_Trainer......
push 0
push 0
call fcn.0041248f
call fcn.00412418
push 0
push 0x64
push 0x1f4
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0
call fcn.00412478
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040dd90
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0041250f
push 0x11
call fcn.00412478
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0xff
push 0
call fcn.00412996
push eax
push 0
call fcn.004101c8
push eax
call fcn.004096d5
call fcn.00414440
push eax
push eax
call fcn.00414440
push eax
push eax
call fcn.0040d8b0
call fcn.00414592
add dword [esp], edx
call fcn.004116a1
push 0x494ac4
call fcn.00414460
mov edx, dword [0x494ac4]
call fcn.00414440
push eax
call fcn.004144f0
push 0x494ac8
call fcn.00414460
call sub.USER32.DLL_GetForegroundWindow
mov dword [0x494acc], eax
push 0x494ad0
push dword [0x494acc]
call sub.USER32.DLL_GetWindowThreadProcessId
push dword [0x494ad0]
push dword [0x494ad8]
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x494ad4], eax
mov eax, dword [0x494ad0]
mov dword [0x494acc], eax
push 0x3e8
call fcn.0040df80
mov dword [0x494adc], eax
mov edx, dword [0x494ac8]
call fcn.00414440
push eax
call fcn.004144f0
push 0x494ae0
call fcn.00414460
mov eax, dword [0x494ae8]
mov dword [0x494ae4], eax
mov ebp, 0x483a48
mov dword [0x494ab8], ebp
mov eax, dword [0x494ab8]
call fcn.0040dfa0
mov byte [0x494e50], al
mov ebp, 0x483a4b
mov dword [0x494ab8], ebp
mov ebp, 0x483a4b
mov ebx, ebp
add ebx, 0xbb8
cmp ebx, dword [0x494ab8]
jl 0x40238e
mov eax, dword [0x494ab8]
call fcn.0040dfa0
mov byte [0x494e51], al
movsx ebx, byte [0x494e51]
xor bl, byte [0x494e50]
mov eax, ebx
mov byte [0x494e52], al
movsx ebx, byte [0x494e50]
add ebx, 0x37
mov eax, ebx
mov byte [0x494e50], al
movsx ebx, byte [0x494e50]
cmp ebx, 0xff
jle 0x40236b
movsx ebx, byte [0x494e50]
add ebx, 0xffffff01
mov eax, ebx
mov byte [0x494e50], al
movsx eax, byte [0x494e52]
push eax
mov eax, dword [0x494ab8]
call fcn.0040dfb0
mov dword [0x494a7c], eax
inc dword [0x494ab8]
jno 0x4022ff
call sub.KERNEL32.dll_GetTickCount
mov dword [0x494aec], eax
call fcn.00414440
push eax
push eax
call fcn.0040d8b0
push 0x494af0
call fcn.00414460
call fcn.00414440
push eax
push eax
push dword [0x494af0]
call fcn.004116a1
push 0x494af0
call fcn.00414460
mov edx, 0x44e01d
lea ecx, [0x494abc]
call fcn.0040b008
mov edx, 0x44e01d
lea ecx, [0x494af4]
call fcn.0040b008
mov edx, 0x44e01d
lea ecx, [0x494af8]
call fcn.0040b008
mov dword [0x494afc], 0
mov dword [0x494b00], 0
call fcn.00414440
push eax
push eax
call fcn.00414440
push eax
call fcn.0040d8b0
call fcn.00414550
push 0
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411ab0
call fcn.004145b0
push 0
call fcn.00411d10
mov dword [0x494b04], eax
mov dword [0x494ab8], 1
mov ebx, dword [0x494b04]
add ebx, 0xfffffff8
cmp ebx, dword [0x494ab8]
jl 0x402493
push 0
call fcn.00411d70
mov byte [0x494e53], al
mov ebx, dword [0x494b00]
movzx eax, byte [0x494e53]
add ebx, eax
mov dword [0x494b00], ebx
inc dword [0x494ab8]
jno 0x402456
push 0
call fcn.00411dd0
mov dword [0x494b08], eax
push 0
call fcn.00411dd0
mov dword [0x494b0c], eax
push 0
call fcn.004118c0
mov eax, dword [0x494b00]
mov dword [0x494b10], eax
push dword [0x494af0]
push 0
call fcn.00411ab0
mov ebx, eax
and ebx, ebx
jle 0x402838
mov dword [0x494ab8], 1
mov eax, 0x3b8
cmp eax, dword [0x494ab8]
jl 0x40250d
push 0
call fcn.00411e30
mov dword [0x494b14], eax
inc dword [0x494ab8]
jno 0x4024e9
mov dword [0x494ab8], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x494ab8]
jl 0x4025a3
push 0
call fcn.00411e30
mov dword [0x494b14], eax
call fcn.00414440
push eax
push eax
call fcn.00414440
push eax
push 0
mov eax, dword [0x494b14]
cdq
push edx
push eax
call fcn.0040b260
call fcn.00414592
add dword [esp], edx
call fcn.0040b310
call fcn.004145b0
mov dword [0x494b14], eax
mov edx, dword [0x494abc]
call fcn.00414440
push eax
call fcn.004144f0
call fcn.00414440
push eax
push eax
push dword [0x494b14]
call fcn.0040b490
pop eax
push 0x494abc
call fcn.00414460
inc dword [0x494ab8]
jno 0x402517
push dword [0x494abc]
call fcn.0040a89c
mov dword [0x494b14], eax
mov ebx, dword [0x494b14]
xor ebx, 0x98989898
mov dword [0x494b14], ebx
mov eax, dword [0x494b14]
mov dword [0x494b18], eax
call fcn.00414440
push eax
push eax
push 0xa
call fcn.00414440
push eax
mov edx, str.0000000000
call fcn.004144f0
call fcn.00414440
push eax
push eax
mov eax, dword [0x494b14]
cdq
push edx
push eax
call fcn.0040b620
pop eax
call fcn.00414592
add dword [esp], edx
call fcn.0040b6b0
push 0x494abc
call fcn.00414460
mov dword [0x494ab8], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x494ab8]
jl 0x4026ad
push 0
call fcn.00411e30
mov dword [0x494b14], eax
call fcn.00414440
push eax
push eax
call fcn.00414440
push eax
push 0
mov eax, dword [0x494b14]
cdq
push edx
push eax
call fcn.0040b260
call fcn.00414592
add dword [esp], edx
call fcn.0040b310
call fcn.004145b0
mov dword [0x494b14], eax
mov edx, dword [0x494af4]
call fcn.00414440
push eax
call fcn.004144f0
call fcn.00414440
push eax
push eax
push dword [0x494b14]
call fcn.0040b490
pop eax
push 0x494af4
call fcn.00414460
inc dword [0x494ab8]
jno 0x402621
push dword [0x494af4]
call fcn.0040a89c
mov dword [0x494b1c], eax
mov dword [0x494ab8], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x494ab8]
jl 0x402753
push 0
call fcn.00411e30
mov dword [0x494b14], eax
call fcn.00414440
push eax
push eax
call fcn.00414440
push eax
push 0
mov eax, dword [0x494b14]
cdq
push edx
push eax
call fcn.0040b260
call fcn.00414592
add dword [esp], edx
call fcn.0040b310
call fcn.004145b0
mov dword [0x494b14], eax
mov edx, dword [0x494af8]
call fcn.00414440
push eax
call fcn.004144f0
call fcn.00414440
push eax
push eax
push dword [0x494b14]
call fcn.0040b490
pop eax
push 0x494af8
call fcn.00414460
inc dword [0x494ab8]
jno 0x4026c7
push dword [0x494af8]
call fcn.0040a89c
mov dword [0x494b14], eax
mov eax, dword [0x494b14]
mov dword [0x494b20], eax
mov dword [0x494ab8], 0x3d1
mov eax, dword [0x494b20]
cmp eax, dword [0x494ab8]
jl 0x40279b
push 0
call fcn.00411e30
mov dword [0x494b14], eax
inc dword [0x494ab8]
jno 0x402777
mov eax, dword [0x494b20]
mov dword [0x494ab8], eax
mov ebx, dword [0x494b20]
add ebx, 0x12
cmp ebx, dword [0x494ab8]
jl 0x4027df
push 0
call fcn.00411e30
mov dword [0x494b14], eax
mov ebx, dword [0x494afc]
add ebx, dword [0x494b14]
mov dword [0x494afc], ebx
inc dword [0x494ab8]
jno 0x4027a5
mov ebx, dword [0x494b1c]
xor ebx, dword [0x494afc]
mov dword [0x494b24], ebx
mov ebx, dword [0x494b24]
and ebx, ebx
jne 0x402805
mov dword [0x494b24], 0x63
mov ebx, dword [0x494b24]
xor ebx, 0x98989898
mov dword [0x494b24], ebx
mov eax, dword [0x494b18]
mov dword [0x494b28], eax
mov ebx, dword [0x494b18]
cmp ebx, dword [0x494b24]
jne 0x402831
jmp 0x402836
call fcn.004084bb
jmp 0x40283d
call fcn.004084bb
mov ebx, dword [0x494b0c]
cmp ebx, dword [0x494b04]
jne 0x40284d
jmp 0x402852
call fcn.004084bb
call sub.KERNEL32.dll_GetTickCount
mov dword [0x494b2c], eax
mov ebx, dword [0x494b2c]
sub ebx, dword [0x494aec]
cmp ebx, 0x3e8
jle 0x402877
push 0x9099542
inc eax
ret
mov dword [0x494b30], 0x45a2a5
push 0x49518c
push 0
push 0x15
push 0x15
push 4
call fcn.00412148
push 0x495194
push 0
push 0x15
push 0x15
push 4
call fcn.00412148
push 0x49519c
push 0
push 0x15
push 0x15
push 4
call fcn.00412148
push 0x4951a4
push 0
push 0x15
push 0x15
push 4
call fcn.00412148
push 0x4951ac
push 0
push 0x15
push 0x15
push 4
call fcn.00412148
push 0x4951b4
push 0
push 0x15
push 0x15
push 4
call fcn.00412148
push 0x3e8
call fcn.0040df80
mov dword [0x494adc], eax
push 0x3e8
call fcn.0040df80
mov dword [0x494b34], eax
mov dword [0x494ab8], 1
mov eax, 0x14
cmp eax, dword [0x494ab8]
jl 0x4029b7
mov ebx, dword [0x494ab8]
mov ebp, dword [0x495194]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x494ab8]
mov ebp, dword [0x49519c]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x494ab8]
mov ebp, dword [0x4951a4]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x494ab8]
jno 0x40295d
mov edx, str.Template
lea ecx, [0x494b50]
call fcn.0040b008
call fcn.00414440
push eax
push eax
call fcn.00411640
push 0x494b38
call fcn.00414460
call fcn.0040862f
call fcn.0040919f
call fcn.0040862f
call fcn.00408554
call fcn.00408f69
call fcn.00408554
call fcn.004077fa
call fcn.00414440
push eax
mov edx, dword [0x494b38]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.CH.dll
call fcn.004144f0
call fcn.00414550
push 0
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411a70
call fcn.004145b0
and eax, eax
je 0x402a6d
mov ebp, 0x48464b
mov ebx, ebp
mov ebp, 0x483a4b
sub ebx, ebp
push ebx
mov ebp, 0x483a4b
push ebp
push 0
call fcn.00411ad0
push 0
call fcn.004118c0
jmp 0x402a6d
call fcn.00414440
push eax
mov edx, dword [0x494b38]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, str.help.txt
call fcn.004144f0
call fcn.00414550
push 0
call fcn.00414592
add dword [esp + 4], edx
call fcn.00411a70
call fcn.004145b0
and eax, eax
je 0x402ada
mov ebp, 0x482e85
mov ebx, ebp
mov ebp, 0x4817fc
sub ebx, ebp
push ebx
mov ebp, 0x4817fc
push ebp
push 0
call fcn.00411ad0
push 0
call fcn.004118c0
jmp 0x402ae9
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040d755
push str.CH_Trainer_Keys.dat
push 0
call fcn.00411ab0
mov dword [0x494a7c], eax
mov ebx, dword [0x494a7c]
and ebx, ebx
jle 0x402b1b
mov dword [0x494b68], 1
push 0
call fcn.004118c0
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
and eax, eax
je 0x402b30
jmp 0x402b5f
push dword [0x494b28]
call fcn.00409a22
mov ebx, eax
and ebx, ebx
jne 0x402b5f
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040d726
jmp 0x40968d
call fcn.00414440
push eax
push eax
call fcn.00411640
mov edx, str.black.txt
call fcn.004144f0
push 0x494b6c
call fcn.00414460
mov ebx, dword [0x494b70]
and ebx, ebx
jle 0x402c41
call fcn.00414440
push eax
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.004144f0
call fcn.00414440
push eax
push eax
mov eax, dword [0x494b28]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.0040b620
pop eax
mov edx, str..zip
call fcn.004144f0
push 0x494b74
call fcn.00414460
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x494b78]
call fcn.0040b008
mov edx, dword [0x494b74]
call fcn.00414440
push eax
call fcn.004144f0
push 0x494b7c
call fcn.00414460
mov edx, dword [0x494b78]
call fcn.00414440
push eax
call fcn.004144f0
push 0x494b80
call fcn.00414460
push 0
push 0
mov eax, dword [0x494b6c]
push eax
mov eax, dword [0x494b80]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x494b84], eax
call fcn.00414440
push eax
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.004144f0
call fcn.00414440
push eax
push eax
mov eax, dword [0x494b28]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.0040b620
pop eax
mov edx, str..zip
call fcn.004144f0
push 0x494b74
call fcn.00414460
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x494b78]
call fcn.0040b008
mov edx, dword [0x494b74]
call fcn.00414440
push eax
call fcn.004144f0
push 0x494b7c
call fcn.00414460
mov edx, dword [0x494b78]
call fcn.00414440
push eax
call fcn.004144f0
push 0x494b80
call fcn.00414460
push 0
push 0
mov eax, dword [0x494b6c]
push eax
mov eax, dword [0x494b80]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x494b84], eax
mov ebx, dword [0x494b84]
and ebx, ebx
jne 0x402d01
jmp 0x402d30
push dword [0x494b28]
call fcn.00409a22
mov ebx, eax
and ebx, ebx
jne 0x402d30
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040d726
jmp 0x40968d
push 0
push 0
mov eax, dword [0x494b6c]
push eax
mov eax, dword [0x494b7c]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x494b88], eax
call fcn.00414440
push eax
push eax
push 0x44e09a
push str.IZnvZalZidZ_ZTraiZnerZ_UsZerZ
call fcn.0040b920
push 0x494b8c
call fcn.00414460
mov ebx, dword [0x494b88]
and ebx, ebx
jne 0x402d84
call fcn.004084bb
call fcn.00414440
push eax
push eax
push str.ZTSA.l
push dword [0x494b8c]
call fcn.0040b920
push 0x494b8c
call fcn.00414460
mov ebx, dword [0x494b88]
and ebx, ebx
jne 0x402eff
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004129b2
and eax, eax
je 0x402ef5
push 1
call fcn.00412860
push eax
call fcn.00412385
push 1
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040dd90
push eax
push dword [0x494b8c]
push 0
push 0
call fcn.0041248f
call fcn.00412418
push 0
push 0x64
push 0x1f4
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0
call fcn.00412478
push 0xff
push 0x28
push 0x28
mov eax, 0xff
call fcn.0040dd90
push eax
push 0x24
push 0x1df
push 1
push 0
call fcn.0041250f
push 0x11
call fcn.00412478
push 0x64
push 0x1f4
push 0xa
push 0xc8
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0xff
push 0
call fcn.00412996
push eax
push 0
call fcn.004101c8
push eax
call fcn.004096d5
call fcn.004077fa
jmp 0x402da5
mov ebx, dword [0x494b84]
and ebx, ebx
je 0x402f21
push dword [0x494b28]
call fcn.00409a22
mov ebx, eax
and ebx, ebx
jne 0x402f21
mov eax, 1
jmp 0x402f23
xor eax, eax
and eax, eax
je 0x402f31
mov dword [0x494b30], 0
mov dword [0x494b90], 3
lea ebp, [0x494e58]
lea eax, [ebp]
push eax
call sub.USER32.DLL_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x494b94]
mov ebx, dword [0x494b94]
cmp ebx, 1
jne 0x402f75
mov edx, str.Run_game_and_press_F1_at_main_menu.__Numlock_is_ON.
lea ecx, [0x494b98]
call fcn.0040b008
jmp 0x402f85
mov edx, 0x44e221
lea ecx, [0x494b98]
call fcn.0040b008
mov ebx, dword [0x494b90]
cmp ebx, dword [0x494b94]
je 0x4030e3
mov eax, dword [0x494b94]
mov dword [0x494b90], eax
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004129b2
and eax, eax
je 0x4030e3
push 1
call fcn.00412860
push eax
call fcn.00412385
push 1
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dd90
push eax
push dword [0x494b98]
push 0
push 0
call fcn.0041248f
call fcn.00412418
push 0
push 0x64
push 0x1f4
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0
call fcn.00412478
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040dd90
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0041250f
push 0x11
call fcn.00412478
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0xff
push 0
call fcn.00412996
push eax
push 0
call fcn.004101c8
push eax
call fcn.004096d5
call fcn.004077fa
push 0xa
call fcn.0040dda9
push 0x70
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
and ebx, ebx
je 0x402f3b
mov edx, str.HMA.exe
lea ecx, [0x494ac8]
call fcn.0040b008
call fcn.00406bc8
mov ebx, dword [0x494acc]
and ebx, ebx
jne 0x40329a
push 4
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
push 0x12c
call fcn.0040dda9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004129b2
and eax, eax
je 0x40328b
push 1
call fcn.00412860
push eax
call fcn.00412385
push 1
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dd90
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.0041248f
call fcn.00412418
push 0
push 0x64
push 0x1f4
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0
call fcn.00412478
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040dd90
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0041250f
push 0x11
call fcn.00412478
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0xff
push 0
call fcn.00412996
push eax
push 0
call fcn.004101c8
push eax
call fcn.004096d5
push 0x7d0
call fcn.0040dda9
jmp 0x402eff
mov edx, str.CH.dll
lea ecx, [0x494b9c]
call fcn.0040b008
mov edx, dword [0x494b38]
call fcn.00414440
push eax
call fcn.004144f0
mov edx, dword [0x494b9c]
call fcn.004144f0
push 0x494ae0
call fcn.00414460
call fcn.00406c0d
mov edx, str.xlive.dll
lea ecx, [0x494ba0]
call fcn.0040b008
call fcn.00406bc8
call fcn.004076f7
call fcn.004077fa
mov ebx, dword [0x494b5c]
and ebx, ebx
jne 0x403456
mov ebx, dword [0x494ba4]
and ebx, ebx
jne 0x403456
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004129b2
and eax, eax
je 0x403451
push 1
call fcn.00412860
push eax
call fcn.00412385
push 1
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dd90
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.0041248f
call fcn.00412418
push 0
push 0x64
push 0x1f4
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0
call fcn.00412478
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040dd90
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0041250f
push 0x11
call fcn.00412478
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0xff
push 0
call fcn.00412996
push eax
push 0
call fcn.004101c8
push eax
call fcn.004096d5
jmp 0x402eff
mov ebx, dword [0x494b08]
cmp ebx, dword [0x494b10]
jne 0x40347a
mov ebx, dword [0x494b08]
and ebx, ebx
je 0x40347a
mov ebx, dword [0x494b10]
and ebx, ebx
je 0x40347a
jmp 0x403481
mov eax, 1
jmp 0x403483
xor eax, eax
and eax, eax
je 0x4034da
push 0xa
call fcn.0040de69
mov ebx, eax
add ebx, 0xa
mov dword [0x494ba8], ebx
push 0x28
call fcn.0040de69
mov ebx, eax
add ebx, 0x28
mov dword [0x494bac], ebx
mov ebx, dword [0x494b5c]
add ebx, dword [0x494ba8]
mov dword [0x494b5c], ebx
mov ebx, dword [0x494ba4]
add ebx, dword [0x494bac]
mov dword [0x494ba4], ebx
call fcn.004084bb
push 3
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004129b2
and eax, eax
je 0x40362f
push 1
call fcn.00412860
push eax
call fcn.00412385
push 1
call fcn.00411624
push eax
call fcn.00412461
push 0x11
call fcn.00412478
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040dd90
push eax
push str.Game_found__Trainer_Activated_
push 0
push 0
call fcn.0041248f
call fcn.00412418
push 0
push 0x64
push 0x1f4
push 1
call fcn.00412ac7
push 0
call fcn.00412860
push eax
call fcn.00412385
push 0
call fcn.00412478
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040dd90
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0041250f
push 0x11
call fcn.00412478
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00412996
push eax
call fcn.004124dd
call fcn.00412418
push 1
call fcn.0041254a
push 0xff
push 0
call fcn.00412996
push eax
push 0
call fcn.004101c8
push eax
call fcn.004096d5
mov ebx, dword [0x494bb0]
and ebx, ebx
je 0x40393d
push 0x8b
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xff
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x55
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x8b
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xec
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x83
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xec
mov ebx, dword [0x494adc]
add ebx, 6
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x20
mov ebx, dword [0x494adc]
add ebx, 7
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x53
mov ebx, dword [0x494adc]
add ebx, 8
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x56
mov ebx, dword [0x494adc]
add ebx, 9
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x57
mov ebx, dword [0x494adc]
add ebx, 0xa
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x8d
mov ebx, dword [0x494adc]
add ebx, 0xb
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x45
mov ebx, dword [0x494adc]
add ebx, 0xc
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xe0
mov ebx, dword [0x494adc]
add ebx, 0xd
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x33
mov ebx, dword [0x494adc]
add ebx, 0xe
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xf6
mov ebx, dword [0x494adc]
add ebx, 0xf
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x50
mov ebx, dword [0x494adc]
add ebx, 0x10
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xff
mov ebx, dword [0x494adc]
add ebx, 0x11
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x75
mov ebx, dword [0x494adc]
add ebx, 0x12
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc
mov ebx, dword [0x494adc]
add ebx, 0x13
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
mov ebx, dword [0x494bb0]
add ebx, 0x1000
mov dword [0x494ab8], ebx
mov ebx, dword [0x494bb0]
add ebx, 0x200000
cmp ebx, dword [0x494ab8]
jl 0x40393d
push dword [0x494ad8]
push 0x14
push dword [0x494b34]
push dword [0x494ab8]
push dword [0x494bb4]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x494a7c], eax
push 0x14
push dword [0x494b34]
push dword [0x494adc]
call fcn.0040dfc0
mov dword [0x494a7c], eax
mov ebx, dword [0x494a7c]
cmp ebx, 1
jne 0x403931
mov eax, dword [0x494ab8]
mov dword [0x494bb8], eax
push 0xc2
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 3
push dword [0x494adc]
push dword [0x494bb8]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
inc dword [0x494ab8]
jno 0x403852
mov ebx, dword [0x494b70]
and ebx, ebx
jle 0x40394c
jmp 0x404c45
mov ebx, dword [0x494b30]
cmp ebx, 0x45a2a5
jne 0x403a35
mov ebp, dword [0x49518c]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0x64
mov dword [ebp + 0x14], 0x65
mov dword [ebp + 0x18], 0x66
mov dword [ebp + 0x1c], 0x67
mov dword [ebp + 0x20], 0x68
mov dword [ebp + 0x24], 0x69
mov dword [ebp + 0x28], 0x60
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x50], 0
mov dword [0x494ab8], 1
mov eax, 0x14
cmp eax, dword [0x494ab8]
jl 0x403a35
mov ebx, dword [0x494ab8]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494ab8]
mov ebp, dword [0x4951ac]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x494ab8]
jno 0x4039fa
push str.CH_Trainer_Keys.dat
push 0
call fcn.00411ab0
mov dword [0x494a7c], eax
mov ebx, dword [0x494a7c]
and ebx, ebx
jle 0x403b9f
mov dword [0x494b68], 1
push 0
call fcn.00411e30
mov dword [0x494bbc], eax
mov dword [0x494ab8], 1
mov eax, dword [0x494bbc]
cmp eax, dword [0x494ab8]
jl 0x403b95
call fcn.00414440
push eax
push eax
push 0
call fcn.00411b30
push 0x494bc0
call fcn.00414460
push dword [0x494bc0]
mov edx, 0x44e1d7
pop ecx
call fcn.004145e0
je 0x403ad0
mov ebx, dword [0x494ab8]
mov ebp, dword [0x495194]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x494bc0]
mov edx, str.CTRL
pop ecx
call fcn.004145e0
je 0x403afa
mov ebx, dword [0x494ab8]
mov ebp, dword [0x49519c]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x494bc0]
mov edx, 0x44e333
pop ecx
call fcn.004145e0
je 0x403b24
mov ebx, dword [0x494ab8]
mov ebp, dword [0x4951a4]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.00411e30
push eax
mov ebx, dword [0x494ab8]
mov ebp, dword [0x49518c]
shl ebx, 2
pop dword [ebp + ebx]
call fcn.00414440
push eax
push eax
call fcn.00414440
push eax
push 0
mov ebx, dword [0x494ab8]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.0040b260
call fcn.00414592
add dword [esp], edx
call fcn.0040b310
call fcn.004145b0
push eax
mov ebx, dword [0x494ab8]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x494ab8]
jno 0x403a7a
push 0
call fcn.004118c0
mov ebx, dword [0x494b5c]
add ebx, 0x5b5a9
mov dword [0x494bc4], ebx
mov ebx, dword [0x494b5c]
add ebx, 0x2c4690
mov dword [0x494bc8], ebx
mov ebx, dword [0x494b5c]
add ebx, 0xa2d89
mov dword [0x494bcc], ebx
mov ebx, dword [0x494b5c]
add ebx, 0x4e5660
mov dword [0x494bd0], ebx
mov ebx, dword [0x494b5c]
add ebx, 0xc115
mov dword [0x494bd4], ebx
mov ebx, dword [0x494b5c]
add ebx, 0xbf8c
mov dword [0x494bd8], ebx
mov ebx, dword [0x494b5c]
add ebx, 0x2780b3
mov dword [0x494bdc], ebx
mov ebx, dword [0x494b5c]
add ebx, 0x506dcc
mov dword [0x494be0], ebx
mov ebx, dword [0x494b5c]
add ebx, 0x2a797
mov dword [0x494be4], ebx
push 0x89
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x15
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x3f
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x7e
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x8b
mov ebx, dword [0x494adc]
add ebx, 6
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x82
mov ebx, dword [0x494adc]
add ebx, 7
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x18
mov ebx, dword [0x494adc]
add ebx, 8
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 2
mov ebx, dword [0x494adc]
add ebx, 9
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0xa
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0xb
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc3
mov ebx, dword [0x494adc]
add ebx, 0xc
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 0xd
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0xe
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0xf
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x8b
mov ebx, dword [0x494adc]
add ebx, 0x10
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x41
mov ebx, dword [0x494adc]
add ebx, 0x11
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc
mov ebx, dword [0x494adc]
add ebx, 0x12
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xd9
mov ebx, dword [0x494adc]
add ebx, 0x13
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x14
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xa3
mov ebx, dword [0x494adc]
add ebx, 0x15
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 4
mov ebx, dword [0x494adc]
add ebx, 0x16
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x3f
mov ebx, dword [0x494adc]
add ebx, 0x17
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x7e
mov ebx, dword [0x494adc]
add ebx, 0x18
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc
mov ebx, dword [0x494adc]
add ebx, 0x19
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc3
mov ebx, dword [0x494adc]
add ebx, 0x1a
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 0x1b
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x1c
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x1d
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x1e
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x1f
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x89
mov ebx, dword [0x494adc]
add ebx, 0x20
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x3d
mov ebx, dword [0x494adc]
add ebx, 0x21
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 8
mov ebx, dword [0x494adc]
add ebx, 0x22
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x3f
mov ebx, dword [0x494adc]
add ebx, 0x23
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x7e
mov ebx, dword [0x494adc]
add ebx, 0x24
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc
mov ebx, dword [0x494adc]
add ebx, 0x25
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xf
mov ebx, dword [0x494adc]
add ebx, 0x26
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xb7
mov ebx, dword [0x494adc]
add ebx, 0x27
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc8
mov ebx, dword [0x494adc]
add ebx, 0x28
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x8b
mov ebx, dword [0x494adc]
add ebx, 0x29
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x47
mov ebx, dword [0x494adc]
add ebx, 0x2a
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x24
mov ebx, dword [0x494adc]
add ebx, 0x2b
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc3
mov ebx, dword [0x494adc]
add ebx, 0x2c
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 0x2d
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x2e
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x2f
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc7
mov ebx, dword [0x494adc]
add ebx, 0x30
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x41
mov ebx, dword [0x494adc]
add ebx, 0x31
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x4c
mov ebx, dword [0x494adc]
add ebx, 0x32
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x33
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x34
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x35
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x36
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x8b
mov ebx, dword [0x494adc]
add ebx, 0x37
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x41
mov ebx, dword [0x494adc]
add ebx, 0x38
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x4c
mov ebx, dword [0x494adc]
add ebx, 0x39
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc3
mov ebx, dword [0x494adc]
add ebx, 0x3a
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 0x3b
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x3c
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x3d
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x3e
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x3f
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x89
mov ebx, dword [0x494adc]
add ebx, 0x40
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xd
mov ebx, dword [0x494adc]
add ebx, 0x41
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc
mov ebx, dword [0x494adc]
add ebx, 0x42
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x3f
mov ebx, dword [0x494adc]
add ebx, 0x43
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x7e
mov ebx, dword [0x494adc]
add ebx, 0x44
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc
mov ebx, dword [0x494adc]
add ebx, 0x45
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xeb
mov ebx, dword [0x494adc]
add ebx, 0x46
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xd8
mov ebx, dword [0x494adc]
add ebx, 0x47
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x48
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x49
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x4a
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x4b
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x4c
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x4d
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x4e
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x4f
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc7
mov ebx, dword [0x494adc]
add ebx, 0x50
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x47
mov ebx, dword [0x494adc]
add ebx, 0x51
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x20
mov ebx, dword [0x494adc]
add ebx, 0x52
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x53
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x54
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x55
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x56
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x8b
mov ebx, dword [0x494adc]
add ebx, 0x57
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x4f
mov ebx, dword [0x494adc]
add ebx, 0x58
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x20
mov ebx, dword [0x494adc]
add ebx, 0x59
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x89
mov ebx, dword [0x494adc]
add ebx, 0x5a
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x4e
mov ebx, dword [0x494adc]
add ebx, 0x5b
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x24
mov ebx, dword [0x494adc]
add ebx, 0x5c
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc3
mov ebx, dword [0x494adc]
add ebx, 0x5d
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x5e
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x5f
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc7
mov ebx, dword [0x494adc]
add ebx, 0x60
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x46
mov ebx, dword [0x494adc]
add ebx, 0x61
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x28
mov ebx, dword [0x494adc]
add ebx, 0x62
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x63
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x64
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x65
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x66
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x8b
mov ebx, dword [0x494adc]
add ebx, 0x67
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x46
mov ebx, dword [0x494adc]
add ebx, 0x68
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x28
mov ebx, dword [0x494adc]
add ebx, 0x69
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x89
mov ebx, dword [0x494adc]
add ebx, 0x6a
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x47
mov ebx, dword [0x494adc]
add ebx, 0x6b
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x10
mov ebx, dword [0x494adc]
add ebx, 0x6c
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc3
mov ebx, dword [0x494adc]
add ebx, 0x6d
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x6e
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x6f
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc7
mov ebx, dword [0x494adc]
add ebx, 0x70
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x47
mov ebx, dword [0x494adc]
add ebx, 0x71
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x18
mov ebx, dword [0x494adc]
add ebx, 0x72
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x73
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x74
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x75
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x76
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc7
mov ebx, dword [0x494adc]
add ebx, 0x77
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x47
mov ebx, dword [0x494adc]
add ebx, 0x78
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x1c
mov ebx, dword [0x494adc]
add ebx, 0x79
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x7a
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x7b
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x7c
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x7d
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc7
mov ebx, dword [0x494adc]
add ebx, 0x7e
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x46
mov ebx, dword [0x494adc]
add ebx, 0x7f
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x1c
mov ebx, dword [0x494adc]
add ebx, 0x80
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x81
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x82
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x83
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x84
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc7
mov ebx, dword [0x494adc]
add ebx, 0x85
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x46
mov ebx, dword [0x494adc]
add ebx, 0x86
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x20
mov ebx, dword [0x494adc]
add ebx, 0x87
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x88
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x89
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x8a
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x8b
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xeb
mov ebx, dword [0x494adc]
add ebx, 0x8c
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc2
mov ebx, dword [0x494adc]
add ebx, 0x8d
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 0x8e
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 0x2ac
push dword [0x494adc]
mov ebx, dword [0x494ba4]
add ebx, 0x1091
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x3f00
push ebx
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494ba4]
add ebx, 0x1093
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x3f04
push ebx
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494ba4]
add ebx, 0x10a7
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x3f08
push ebx
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494ba4]
add ebx, 0x10b3
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x3f0c
push ebx
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494ba4]
add ebx, 0x10d3
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov dword [0x494be8], 0
mov eax, 0xff
cmp eax, dword [0x494be8]
jl 0x404c6f
push dword [0x494be8]
call sub.USER32.DLL_GetAsyncKeyState
inc dword [0x494be8]
jno 0x404c4f
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x404c7e
push 0x55009553
ret
mov ebp, dword [0x49518c]
push dword [ebp + 4]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 4]
mov ebp, dword [0x49518c]
push dword [ebp + 8]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 8]
mov ebp, dword [0x49518c]
push dword [ebp + 0xc]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0xc]
mov ebp, dword [0x49518c]
push dword [ebp + 0x10]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x10]
mov ebp, dword [0x49518c]
push dword [ebp + 0x14]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x14]
mov ebp, dword [0x49518c]
push dword [ebp + 0x18]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x18]
mov ebp, dword [0x49518c]
push dword [ebp + 0x1c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x1c]
mov ebp, dword [0x49518c]
push dword [ebp + 0x20]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x20]
mov ebp, dword [0x49518c]
push dword [ebp + 0x24]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x24]
mov ebp, dword [0x49518c]
push dword [ebp + 0x28]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x28]
mov ebp, dword [0x49518c]
push dword [ebp + 0x2c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x2c]
mov ebp, dword [0x49518c]
push dword [ebp + 0x30]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x30]
mov ebp, dword [0x49518c]
push dword [ebp + 0x34]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x34]
mov ebp, dword [0x49518c]
push dword [ebp + 0x38]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x38]
mov ebp, dword [0x49518c]
push dword [ebp + 0x3c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x3c]
mov ebp, dword [0x49518c]
push dword [ebp + 0x40]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x40]
mov ebp, dword [0x49518c]
push dword [ebp + 0x44]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x44]
mov ebp, dword [0x49518c]
push dword [ebp + 0x48]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x48]
mov ebp, dword [0x49518c]
push dword [ebp + 0x4c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x4c]
mov ebp, dword [0x49518c]
push dword [ebp + 0x50]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4951b4]
pop dword [ebp + 0x50]
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x494bec], ebx
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x494bf0], ebx
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x494bf4], ebx
push 1
call fcn.0040dda9
push 0x32
call fcn.0040de69
mov dword [0x494bf8], eax
mov ebx, dword [0x494bf8]
cmp ebx, 0x19
jne 0x404fc6
mov ebx, dword [0x494b08]
cmp ebx, dword [0x494b10]
jne 0x404f4d
mov ebx, dword [0x494b08]
and ebx, ebx
je 0x404f4d
mov ebx, dword [0x494b10]
and ebx, ebx
je 0x404f4d
jmp 0x404f54
mov eax, 1
jmp 0x404f56
xor eax, eax
and eax, eax
je 0x404fc6
push 0xff
call fcn.0040de69
mov dword [0x494ba8], eax
push 0x190
call fcn.0040de69
mov dword [0x494bac], eax
push dword [0x494ba8]
mov eax, dword [0x494adc]
call fcn.0040dfb0
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 1
push dword [0x494adc]
mov ebx, dword [0x494ba4]
add ebx, dword [0x494bac]
add ebx, 0x1091
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
call fcn.004084bb
mov dword [0x494bfc], 1
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c00], eax
mov ebx, dword [0x494c00]
and ebx, ebx
je 0x4052b0
push 0xe8
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x1091
sub ebx, dword [0x494bc4]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 6
push dword [0x494adc]
push dword [0x494bc4]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
push 0x8b
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x82
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x18
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 2
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 6
push dword [0x494adc]
push dword [0x494bc4]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494ba4]
add ebx, 0x3f00
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x494a7c], eax
mov eax, dword [0x494adc]
call fcn.0040e060
mov dword [0x494c04], eax
mov ebx, dword [0x494c04]
add ebx, 0x218
mov dword [0x494c08], ebx
mov ebx, dword [0x494c04]
add ebx, 0x21c
mov dword [0x494c0c], ebx
push 0x47c35000
mov eax, dword [0x494adc]
call fcn.0040e070
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c0c]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c08]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov dword [0x494bfc], 2
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c10], eax
mov ebx, dword [0x494c10]
and ebx, ebx
je 0x405525
push 0xe8
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x10a1
sub ebx, dword [0x494bc8]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 5
push dword [0x494adc]
push dword [0x494bc8]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
push 0x8b
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x41
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xd9
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 5
push dword [0x494adc]
push dword [0x494bc8]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494ba4]
add ebx, 0x3f04
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x494a7c], eax
mov eax, dword [0x494adc]
call fcn.0040e060
mov dword [0x494c04], eax
mov eax, dword [0x494c04]
mov dword [0x494c14], eax
push 0x42c80000
mov eax, dword [0x494adc]
call fcn.0040e070
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c14]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov dword [0x494bfc], 3
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c18], eax
mov ebx, dword [0x494c18]
and ebx, ebx
je 0x4057d3
push 0xe8
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x10d1
sub ebx, dword [0x494bcc]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 6
push dword [0x494adc]
push dword [0x494bcc]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
push 0xf
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xb7
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc8
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x8b
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x47
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x24
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 6
push dword [0x494adc]
push dword [0x494bcc]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494ba4]
add ebx, 0x3f08
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x494a7c], eax
mov eax, dword [0x494adc]
call fcn.0040e060
mov dword [0x494c04], eax
mov ebx, dword [0x494c04]
add ebx, 0x78
mov dword [0x494c1c], ebx
push 0x3e8
mov eax, dword [0x494adc]
call fcn.0040e080
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 2
push dword [0x494adc]
push dword [0x494c1c]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov dword [0x494bfc], 4
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c20], eax
mov ebx, dword [0x494c20]
and ebx, ebx
je 0x405a84
push 0xe8
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x10d1
sub ebx, dword [0x494bcc]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 6
push dword [0x494adc]
push dword [0x494bcc]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
push 0xf
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xb7
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc8
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x8b
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x47
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x24
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 6
push dword [0x494adc]
push dword [0x494bcc]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494ba4]
add ebx, 0x3f0c
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x494a7c], eax
mov eax, dword [0x494adc]
call fcn.0040e060
mov dword [0x494c04], eax
mov ebx, dword [0x494c04]
add ebx, 0x316
mov dword [0x494c24], ebx
push 0x3e8
mov eax, dword [0x494adc]
call fcn.0040e080
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 2
push dword [0x494adc]
push dword [0x494c24]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov dword [0x494bfc], 5
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c28], eax
mov ebx, dword [0x494c28]
and ebx, ebx
je 0x405c81
push 0xe9
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x10c1
sub ebx, dword [0x494bd0]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 5
push dword [0x494adc]
push dword [0x494bd0]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
push 0x3e8
call fcn.0040dda9
push 0x8b
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x41
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x4c
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xc3
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0xcc
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 5
push dword [0x494adc]
push dword [0x494bd0]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov dword [0x494bfc], 6
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c2c], eax
mov ebx, dword [0x494c2c]
and ebx, ebx
je 0x405eb2
push 0xe8
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x1101
sub ebx, dword [0x494bd4]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 6
push dword [0x494adc]
push dword [0x494bd4]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
push 0x3e8
call fcn.0040dda9
push 0x8b
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x4f
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x20
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x89
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x4e
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x24
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 6
push dword [0x494adc]
push dword [0x494bd4]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov dword [0x494bfc], 7
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c30], eax
mov ebx, dword [0x494c30]
and ebx, ebx
je 0x4060e3
push 0xe8
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x90
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
mov ebx, dword [0x494ba4]
add ebx, 0x10f1
sub ebx, dword [0x494bd8]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 6
push dword [0x494adc]
push dword [0x494bd8]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
push 0x3e8
call fcn.0040dda9
push 0x8b
mov ebx, dword [0x494adc]
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x46
mov ebx, dword [0x494adc]
inc ebx
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x28
mov ebx, dword [0x494adc]
add ebx, 2
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x89
mov ebx, dword [0x494adc]
add ebx, 3
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x47
mov ebx, dword [0x494adc]
add ebx, 4
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push 0x10
mov ebx, dword [0x494adc]
add ebx, 5
mov eax, ebx
call fcn.0040dfb0
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 6
push dword [0x494adc]
push dword [0x494bd8]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
mov dword [0x494bfc], 8
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c34], eax
mov ebx, dword [0x494c34]
and ebx, ebx
je 0x406261
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494bdc]
add ebx, 2
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x494a7c], eax
mov eax, dword [0x494adc]
call fcn.0040e060
mov dword [0x494c04], eax
mov eax, dword [0x494c04]
mov dword [0x494c38], eax
push dword [0x494c3c]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4061fd
mov dword [0x494c3c], 1
push 1
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c38]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
jmp 0x406260
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406260
mov dword [0x494c3c], 0
push 0
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c38]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 1
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
pop eax
mov dword [0x494bfc], 9
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c40], eax
mov ebx, dword [0x494c40]
and ebx, ebx
je 0x4063df
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494be4]
add ebx, 2
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x494a7c], eax
mov eax, dword [0x494adc]
call fcn.0040e060
mov dword [0x494c04], eax
mov eax, dword [0x494c04]
mov dword [0x494c44], eax
push dword [0x494c48]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x40637b
mov dword [0x494c48], 1
push 1
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c44]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
jmp 0x4063de
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4063de
mov dword [0x494c48], 0
push 0
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c44]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 1
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
pop eax
mov dword [0x494bfc], 0xa
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c4c], eax
mov ebx, dword [0x494c4c]
and ebx, ebx
je 0x406622
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494bdc]
add ebx, 2
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x494a7c], eax
mov eax, dword [0x494adc]
call fcn.0040e060
mov dword [0x494c04], eax
mov eax, dword [0x494c04]
mov dword [0x494c50], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
mov ebx, dword [0x494be0]
add ebx, 2
push ebx
push dword [0x494bb4]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x494a7c], eax
mov eax, dword [0x494adc]
call fcn.0040e060
mov dword [0x494c04], eax
mov eax, dword [0x494c04]
mov dword [0x494c54], eax
push dword [0x494c58]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x40657f
mov dword [0x494c58], 1
push 1
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c50]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 1
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c54]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
jmp 0x406621
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406621
mov dword [0x494c58], 0
push 0
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c50]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 0
mov eax, dword [0x494adc]
call fcn.0040e050
mov dword [0x494a7c], eax
push dword [0x494ad8]
push 4
push dword [0x494adc]
push dword [0x494c54]
push dword [0x494bb4]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x494a7c], eax
push 1
call fcn.0040ceb2
push 0x12c
call fcn.0040dda9
pop eax
mov dword [0x494bfc], 0xb
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c5c], eax
mov ebx, dword [0x494c5c]
and ebx, ebx
je 0x40668c
mov dword [0x494bfc], 0xc
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c60], eax
mov ebx, dword [0x494c60]
and ebx, ebx
je 0x4066f6
mov dword [0x494bfc], 0xd
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c64], eax
mov ebx, dword [0x494c64]
and ebx, ebx
je 0x406760
mov dword [0x494bfc], 0xe
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c68], eax
mov ebx, dword [0x494c68]
and ebx, ebx
je 0x4067ca
mov dword [0x494bfc], 0xf
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c6c], eax
mov ebx, dword [0x494c6c]
and ebx, ebx
je 0x406834
mov dword [0x494bfc], 0x10
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c70], eax
mov ebx, dword [0x494c70]
and ebx, ebx
je 0x40689e
mov dword [0x494bfc], 0x11
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c74], eax
mov ebx, dword [0x494c74]
and ebx, ebx
je 0x406908
mov dword [0x494bfc], 0x12
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c78], eax
mov ebx, dword [0x494c78]
and ebx, ebx
je 0x406972
mov dword [0x494bfc], 0x13
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c7c], eax
mov ebx, dword [0x494c7c]
and ebx, ebx
je 0x4069dc
mov dword [0x494bfc], 0x14
mov ebx, dword [0x494bfc]
mov ebp, dword [0x4951a4]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49519c]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x495194]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x494bfc]
mov ebp, dword [0x49518c]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00409dc5
mov dword [0x494c80], eax
mov ebx, dword [0x494c80]
and ebx, ebx
je 0x406a46
mov dword [0x494c00], 0
mov dword [0x494c10], 0
mov dword [0x494c18], 0
mov dword [0x494c20], 0
mov dword [0x494c28], 0
mov dword [0x494c2c], 0
mov dword [0x494c30], 0
mov dword [0x494c34], 0
mov dword [0x494c40], 0
mov dword [0x494c4c], 0
mov dword [0x494c5c], 0
mov dword [0x494c60], 0
mov dword [0x494c64], 0
mov dword [0x494c68], 0
mov dword [0x494c6c], 0
mov dword [0x494c70], 0
mov dword [0x494c74], 0
mov dword [0x494c78], 0
mov dword [0x494c7c], 0
mov dword [0x494c80], 0
mov ebx, dword [0x494b30]
cmp ebx, 0x45a2a5
je 0x406b2b
push 0
push 3
call fcn.0040f9f1
call fcn.004077fa
push 1
call fcn.0040dda9
mov ebx, dword [0x494b08]
cmp ebx, dword [0x494b10]
jne 0x406b5e
mov ebx, dword [0x494b08]
and ebx, ebx
je 0x406b5e
mov ebx, dword [0x494b10]
and ebx, ebx
je 0x406b5e
jmp 0x406b65
mov eax, 1
jmp 0x406b67
xor eax, eax
and eax, eax
je 0x406bc3
push 0xa
call fcn.0040de69
mov ebx, eax
add ebx, 0xa
mov dword [0x494ba8], ebx
push 0x28
call fcn.0040de69
mov ebx, eax
add ebx, 0x28
mov dword [0x494bac], ebx
mov ebx, dword [0x494b5c]
add ebx, dword [0x494ba8]
mov dword [0x494b5c], ebx
mov ebx, dword [0x494ba4]
add ebx, dword [0x494bac]
mov dword [0x494ba4], ebx
call fcn.004084bb
jmp 0x403b9f
jmp 0x404c45
push 0
call 0x4096a7
push dword [0x494a6c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040cfad
call fcn.0040df70
call fcn.0040e23b
call fcn.0040e7cf
call fcn.0040fdb5
call fcn.00411500
call fcn.00411920
call fcn.00412595
call fcn.004131fe
ret