Function at 0x401000
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x4fc
push 0
push 0x48fa5c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x48fa60], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x48fa5c], eax
push 0x48c8c7
pop dword [0x48fa64]
call fcn.0040ece0
call fcn.0040ebeb
call fcn.0040e290
call fcn.0040cfe8
call fcn.0040c7a2
call fcn.0040c67a
call fcn.0040c0bf
call fcn.0040bb90
call fcn.0040b9f0
call fcn.0040adec
call fcn.0040acb0
call fcn.0040ab8b
inc dword [0x48fa68]
mov edx, str.this_is_so_stupid_that_virus_checkers_mark_our_LEGIT_programs_as_suspicious.
lea ecx, [0x48fa6c]
call fcn.0040a008
push 5
push 0x48ff10
push 0
mov edx, dword [0x48ff10]
call fcn.0040a010
mov eax, 0x1a0b
push 4
call fcn.0040a030
mov dword [0x48fa70], 1
mov eax, 0x258
cmp eax, dword [0x48fa70]
jl 0x401102
mov eax, 8
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x4010cf
mov dword [0x48fa70], 1
mov eax, 0x1f4
cmp eax, dword [0x48fa70]
jl 0x40113f
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x40110c
mov dword [0x48fa70], 1
mov eax, 0x190
cmp eax, dword [0x48fa70]
jl 0x40117c
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x401149
mov dword [0x48fa70], 1
mov eax, 0x12c
cmp eax, dword [0x48fa70]
jl 0x4011b9
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x401186
mov dword [0x48fa70], 1
mov eax, 0x190
cmp eax, dword [0x48fa70]
jl 0x4011f6
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x4011c3
mov dword [0x48fa70], 1
mov eax, 0x1f4
cmp eax, dword [0x48fa70]
jl 0x401233
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x401200
mov dword [0x48fa70], 1
mov eax, 0x258
cmp eax, dword [0x48fa70]
jl 0x401270
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x40123d
mov dword [0x48fa70], 1
mov eax, 0x258
cmp eax, dword [0x48fa70]
jl 0x4012ad
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x40127a
mov dword [0x48fa70], 1
mov eax, 0x1f4
cmp eax, dword [0x48fa70]
jl 0x4012ea
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x4012b7
mov dword [0x48fa70], 1
mov eax, 0x190
cmp eax, dword [0x48fa70]
jl 0x401327
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x4012f4
mov dword [0x48fa70], 1
mov eax, 0x12c
cmp eax, dword [0x48fa70]
jl 0x401364
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x401331
mov dword [0x48fa70], 1
mov eax, 0xc8
cmp eax, dword [0x48fa70]
jl 0x4013a1
mov eax, 4
call fcn.0040b879
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff10]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x40136e
call fcn.0040c000
mov eax, dword [0x490124]
push eax
push eax
call fcn.0040e13d
lea ecx, [0x48fa74]
pop edx
call fcn.0040a080
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.0.mp3
call fcn.0040ed30
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e3c0
pop dword [0x490124]
mov ebp, 0x481367
mov ebx, ebp
mov ebp, 0x47f6c7
sub ebx, ebp
push ebx
mov ebp, 0x47f6c7
push ebp
push 0
call fcn.0040e4a0
push 0
call fcn.0040e220
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.1.mp3
call fcn.0040ed30
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e3c0
pop dword [0x490124]
mov ebp, 0x482e87
mov ebx, ebp
mov ebp, 0x481367
sub ebx, ebp
push ebx
mov ebp, 0x481367
push ebp
push 0
call fcn.0040e4a0
push 0
call fcn.0040e220
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.3.mp3
call fcn.0040ed30
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e3c0
pop dword [0x490124]
mov ebp, 0x485ea7
mov ebx, ebp
mov ebp, 0x482e87
sub ebx, ebp
push ebx
mov ebp, 0x482e87
push ebp
push 0
call fcn.0040e4a0
push 0
call fcn.0040e220
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.4.mp3
call fcn.0040ed30
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e3c0
pop dword [0x490124]
mov ebp, 0x48a0c7
mov ebx, ebp
mov ebp, 0x485ea7
sub ebx, ebp
push ebx
mov ebp, 0x485ea7
push ebp
push 0
call fcn.0040e4a0
push 0
call fcn.0040e220
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.5.mp3
call fcn.0040ed30
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e3c0
pop dword [0x490124]
mov ebp, 0x48b467
mov ebx, ebp
mov ebp, 0x48a0c7
sub ebx, ebp
push ebx
mov ebp, 0x48a0c7
push ebp
push 0
call fcn.0040e4a0
push 0
call fcn.0040e220
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.6.mp3
call fcn.0040ed30
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e3c0
pop dword [0x490124]
mov ebp, 0x48c8c7
mov ebx, ebp
mov ebp, 0x48b467
sub ebx, ebp
push ebx
mov ebp, 0x48b467
push ebp
push 0
call fcn.0040e4a0
push 0
call fcn.0040e220
call fcn.0040b359
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.0.mp3
call fcn.0040ed30
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040b38e
pop dword [0x490124]
mov dword [0x48fa78], eax
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.1.mp3
call fcn.0040ed30
inc dword [0x490124]
push 1
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040b38e
pop dword [0x490124]
mov dword [0x48fa78], eax
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.3.mp3
call fcn.0040ed30
inc dword [0x490124]
push 3
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040b38e
pop dword [0x490124]
mov dword [0x48fa78], eax
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.4.mp3
call fcn.0040ed30
inc dword [0x490124]
push 4
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040b38e
pop dword [0x490124]
mov dword [0x48fa78], eax
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.5.mp3
call fcn.0040ed30
inc dword [0x490124]
push 5
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040b38e
pop dword [0x490124]
mov dword [0x48fa78], eax
push dword [0x490124]
mov edx, dword [0x48fa74]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.6.mp3
call fcn.0040ed30
inc dword [0x490124]
push 6
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040b38e
pop dword [0x490124]
mov dword [0x48fa78], eax
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4017f3
push 0x75009553
inc ecx
ret
push 0x12c
call sub.KERNEL32.dll_Sleep
call fcn.00409e2c
push str.Authenticating_Trainer......
push 0
push 8
call fcn.0040ac9a
mov eax, dword [0x490124]
push eax
push eax
mov eax, dword [0x490124]
push eax
push eax
call fcn.0040ae08
inc dword [0x490124]
mov edx, dword [0x48e7d4]
add dword [esp], edx
call fcn.0040b92d
lea ecx, [0x48fa90]
pop edx
call fcn.0040a080
mov edx, dword [0x48fa90]
push dword [0x490124]
call fcn.0040ed30
lea ecx, [0x48fa94]
pop edx
call fcn.0040a080
call sub.USER32.dll_GetForegroundWindow
mov dword [0x48fa98], eax
push 0x48fa9c
push dword [0x48fa98]
call sub.USER32.dll_GetWindowThreadProcessId
push dword [0x48fa9c]
push dword [0x48faa4]
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x48faa0], eax
mov eax, dword [0x48fa9c]
mov dword [0x48fa98], eax
push 0x3e8
call fcn.0040ba20
mov dword [0x48faa8], eax
mov edx, dword [0x48fa94]
push dword [0x490124]
call fcn.0040ed30
lea ecx, [0x48faac]
pop edx
call fcn.0040a080
mov eax, dword [0x48fab4]
mov dword [0x48fab0], eax
mov ebp, 0x48c8c7
mov dword [0x48fa70], ebp
mov eax, dword [0x48fa70]
call fcn.0040b9b0
mov byte [0x48fe08], al
mov ebp, 0x48c8ca
mov dword [0x48fa70], ebp
mov ebp, 0x48c8ca
mov ebx, ebp
add ebx, 0xbb8
cmp ebx, dword [0x48fa70]
jl 0x40198e
mov eax, dword [0x48fa70]
call fcn.0040b9b0
mov byte [0x48fe09], al
movsx ebx, byte [0x48fe09]
xor bl, byte [0x48fe08]
push ebx
pop eax
mov byte [0x48fe0a], al
movsx ebx, byte [0x48fe08]
add ebx, 0x37
push ebx
pop eax
mov byte [0x48fe08], al
movsx ebx, byte [0x48fe08]
cmp ebx, 0xff
jle 0x40196c
movsx ebx, byte [0x48fe08]
add ebx, 0xffffff01
push ebx
pop eax
mov byte [0x48fe08], al
movsx eax, byte [0x48fe0a]
push eax
mov eax, dword [0x48fa70]
call fcn.0040b9c0
mov dword [0x48fa78], eax
inc dword [0x48fa70]
jmp 0x401900
call sub.KERNEL32.dll_GetTickCount
mov dword [0x48fab8], eax
mov eax, dword [0x490124]
push eax
push eax
call fcn.0040ae08
lea ecx, [0x48fabc]
pop edx
call fcn.0040a080
mov eax, dword [0x490124]
push eax
push eax
push dword [0x48fabc]
call fcn.0040b92d
lea ecx, [0x48fabc]
pop edx
call fcn.0040a080
mov edx, 0x42601c
lea ecx, [0x48fac0]
call fcn.0040a008
mov edx, 0x42601c
lea ecx, [0x48fac4]
call fcn.0040a008
mov edx, 0x42601c
lea ecx, [0x48fac8]
call fcn.0040a008
mov dword [0x48facc], 0
mov dword [0x48fad0], 0
mov eax, dword [0x490124]
push eax
push eax
push dword [0x490124]
call fcn.0040ae08
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e480
pop dword [0x490124]
push 0
call fcn.0040e500
mov dword [0x48fad4], eax
mov dword [0x48fa70], 1
mov ebx, dword [0x48fad4]
add ebx, 0xfffffff8
cmp ebx, dword [0x48fa70]
jl 0x401a9a
push 0
call fcn.0040e570
mov byte [0x48fe0b], al
mov ebx, dword [0x48fad0]
movzx eax, byte [0x48fe0b]
add ebx, eax
mov dword [0x48fad0], ebx
inc dword [0x48fa70]
jmp 0x401a5d
push 0
call fcn.0040e5d0
mov dword [0x48fad8], eax
push 0
call fcn.0040e5d0
mov dword [0x48fadc], eax
push 0
call fcn.0040e220
mov eax, dword [0x48fad0]
mov dword [0x48fae0], eax
push dword [0x48fabc]
push 0
call fcn.0040e480
mov ebx, eax
and ebx, ebx
jle 0x401e74
mov dword [0x48fa70], 1
mov eax, 0x3b8
cmp eax, dword [0x48fa70]
jl 0x401b14
push 0
call fcn.0040e630
mov dword [0x48fae4], eax
inc dword [0x48fa70]
jmp 0x401af0
mov dword [0x48fa70], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x48fa70]
jl 0x401bb7
push 0
call fcn.0040e630
mov dword [0x48fae4], eax
mov eax, dword [0x490124]
push eax
push eax
push dword [0x490124]
push 0
mov eax, dword [0x48fae4]
cdq
push edx
push eax
call fcn.0040a630
inc dword [0x490124]
mov edx, dword [0x48e7d4]
add dword [esp], edx
call fcn.0040a130
pop dword [0x490124]
mov dword [0x48fae4], eax
mov edx, dword [0x48fac0]
push dword [0x490124]
call fcn.0040ed30
mov eax, dword [0x490124]
push eax
push eax
push dword [0x48fae4]
call fcn.0040a220
pop eax
lea ecx, [0x48fac0]
pop edx
call fcn.0040a080
inc dword [0x48fa70]
jmp 0x401b1e
push dword [0x48fac0]
call fcn.00409cb8
mov dword [0x48fae4], eax
mov ebx, dword [0x48fae4]
xor ebx, 0x98989898
mov dword [0x48fae4], ebx
mov eax, dword [0x48fae4]
mov dword [0x48fae8], eax
mov eax, dword [0x490124]
push eax
push eax
push 0xa
push dword [0x490124]
mov edx, str.0000000000
call fcn.0040ed30
mov eax, dword [0x490124]
push eax
push eax
push dword [0x48fae4]
call fcn.0040a240
pop eax
inc dword [0x490124]
mov edx, dword [0x48e7d4]
add dword [esp], edx
call fcn.0040a310
lea ecx, [0x48fac0]
pop edx
call fcn.0040a080
mov dword [0x48fa70], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x48fa70]
jl 0x401cd5
push 0
call fcn.0040e630
mov dword [0x48fae4], eax
mov eax, dword [0x490124]
push eax
push eax
push dword [0x490124]
push 0
mov eax, dword [0x48fae4]
cdq
push edx
push eax
call fcn.0040a630
inc dword [0x490124]
mov edx, dword [0x48e7d4]
add dword [esp], edx
call fcn.0040a130
pop dword [0x490124]
mov dword [0x48fae4], eax
mov edx, dword [0x48fac4]
push dword [0x490124]
call fcn.0040ed30
mov eax, dword [0x490124]
push eax
push eax
push dword [0x48fae4]
call fcn.0040a220
pop eax
lea ecx, [0x48fac4]
pop edx
call fcn.0040a080
inc dword [0x48fa70]
jmp 0x401c3c
push dword [0x48fac4]
call fcn.00409cb8
mov dword [0x48faec], eax
mov dword [0x48fa70], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x48fa70]
jl 0x401d88
push 0
call fcn.0040e630
mov dword [0x48fae4], eax
mov eax, dword [0x490124]
push eax
push eax
push dword [0x490124]
push 0
mov eax, dword [0x48fae4]
cdq
push edx
push eax
call fcn.0040a630
inc dword [0x490124]
mov edx, dword [0x48e7d4]
add dword [esp], edx
call fcn.0040a130
pop dword [0x490124]
mov dword [0x48fae4], eax
mov edx, dword [0x48fac8]
push dword [0x490124]
call fcn.0040ed30
mov eax, dword [0x490124]
push eax
push eax
push dword [0x48fae4]
call fcn.0040a220
pop eax
lea ecx, [0x48fac8]
pop edx
call fcn.0040a080
inc dword [0x48fa70]
jmp 0x401cef
push dword [0x48fac8]
call fcn.00409cb8
mov dword [0x48fae4], eax
mov eax, dword [0x48fae4]
mov dword [0x48faf0], eax
mov dword [0x48fa70], 0x3d1
mov ebx, dword [0x48faf0]
dec ebx
cmp ebx, dword [0x48fa70]
jl 0x401dd2
push 0
call fcn.0040e630
mov dword [0x48fae4], eax
inc dword [0x48fa70]
jmp 0x401dac
mov eax, dword [0x48faf0]
mov dword [0x48fa70], eax
mov ebx, dword [0x48faf0]
add ebx, 0x12
cmp ebx, dword [0x48fa70]
jl 0x401e16
push 0
call fcn.0040e630
mov dword [0x48fae4], eax
mov ebx, dword [0x48facc]
add ebx, dword [0x48fae4]
mov dword [0x48facc], ebx
inc dword [0x48fa70]
jmp 0x401ddc
mov ebx, dword [0x48faec]
xor ebx, dword [0x48facc]
mov dword [0x48faf4], ebx
mov ebx, dword [0x48faf4]
and ebx, ebx
jne 0x401e3c
mov dword [0x48faf4], 0x63
mov ebx, dword [0x48faf4]
xor ebx, 0x98989898
mov dword [0x48faf4], ebx
mov eax, dword [0x48fae8]
mov dword [0x48faf8], eax
mov ebx, dword [0x48fae8]
cmp ebx, dword [0x48faf4]
jne 0x401e68
jmp 0x401e72
jmp 0x409668
jmp 0x401e7e
jmp 0x409668
mov ebx, dword [0x48fadc]
cmp ebx, dword [0x48fad4]
jne 0x401e8e
jmp 0x401e98
jmp 0x409668
call sub.KERNEL32.dll_GetTickCount
mov dword [0x48fafc], eax
mov ebx, dword [0x48fafc]
sub ebx, dword [0x48fab8]
cmp ebx, 0x3e8
jle 0x401ebd
push 0x9099542
inc eax
ret
mov dword [0x48fb00], 0x45a2a5
push 5
push 0x48ff18
push 0
mov edx, dword [0x48ff18]
call fcn.0040a010
mov eax, 0x15
push 4
call fcn.0040a030
push 5
push 0x48ff20
push 0
mov edx, dword [0x48ff20]
call fcn.0040a010
mov eax, 0x15
push 4
call fcn.0040a030
push 5
push 0x48ff28
push 0
mov edx, dword [0x48ff28]
call fcn.0040a010
mov eax, 0x15
push 4
call fcn.0040a030
push 5
push 0x48ff30
push 0
mov edx, dword [0x48ff30]
call fcn.0040a010
mov eax, 0x15
push 4
call fcn.0040a030
push 5
push 0x48ff38
push 0
mov edx, dword [0x48ff38]
call fcn.0040a010
mov eax, 0x15
push 4
call fcn.0040a030
push 0x3e8
call fcn.0040ba20
mov dword [0x48faa8], eax
push 0x3e8
call fcn.0040ba20
mov dword [0x48fb04], eax
mov dword [0x48fa70], 1
mov eax, 0x14
cmp eax, dword [0x48fa70]
jl 0x402016
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff20]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff28]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff30]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x48fa70]
jmp 0x401fbc
mov edx, str.Template
lea ecx, [0x48fb20]
call fcn.0040a008
mov eax, dword [0x490124]
push eax
push eax
call fcn.0040e13d
lea ecx, [0x48fb08]
pop edx
call fcn.0040a080
call fcn.004085d3
call fcn.00409140
call fcn.004085d3
call fcn.004084f9
call fcn.00408f12
call fcn.004084f9
call fcn.00408162
push dword [0x490124]
mov edx, dword [0x48fb08]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.CH.dll
call fcn.0040ed30
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e3c0
pop dword [0x490124]
and eax, eax
je 0x4020d1
mov ebp, 0x48d4ca
mov ebx, ebp
mov ebp, 0x48c8ca
sub ebx, ebp
push ebx
mov ebp, 0x48c8ca
push ebp
push 0
call fcn.0040e4a0
push 0
call fcn.0040e220
jmp 0x4020d1
push dword [0x490124]
mov edx, dword [0x48fb08]
push dword [0x490124]
call fcn.0040ed30
mov edx, str.help.txt
call fcn.0040ed30
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e3c0
pop dword [0x490124]
and eax, eax
je 0x402141
mov ebp, 0x48e7d3
mov ebx, ebp
mov ebp, 0x48d4ca
sub ebx, ebp
push ebx
mov ebp, 0x48d4ca
push ebp
push 0
call fcn.0040e4a0
push 0
call fcn.0040e220
jmp 0x402150
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040aced
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040e480
mov dword [0x48fa78], eax
mov ebx, dword [0x48fa78]
and ebx, ebx
jle 0x402182
mov dword [0x48fb38], 1
push 0
call fcn.0040e220
push 0
push 0
call sub.WININET.dll_InternetGetConnectedState
and eax, eax
je 0x402197
jmp 0x4021c6
push dword [0x48faf8]
call fcn.004096a6
mov ebx, eax
and ebx, ebx
jne 0x4021c6
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040acbe
jmp 0x409668
push str.Authenticating_Trainer......
push 0
push 8
call fcn.0040ac9a
mov eax, dword [0x490124]
push eax
push eax
call fcn.0040e13d
mov edx, str.black.txt
call fcn.0040ed30
lea ecx, [0x48fb3c]
pop edx
call fcn.0040a080
mov ebx, dword [0x48fb40]
and ebx, ebx
jle 0x4022b9
push dword [0x490124]
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.0040ed30
mov eax, dword [0x490124]
push eax
push eax
mov ebx, dword [0x48faf8]
xor ebx, 0x7b3d89b
push ebx
call fcn.0040a240
pop eax
mov edx, str..zip
call fcn.0040ed30
lea ecx, [0x48fb44]
pop edx
call fcn.0040a080
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x48fb48]
call fcn.0040a008
mov edx, dword [0x48fb44]
push dword [0x490124]
call fcn.0040ed30
lea ecx, [0x48fb4c]
pop edx
call fcn.0040a080
mov edx, dword [0x48fb48]
push dword [0x490124]
call fcn.0040ed30
lea ecx, [0x48fb50]
pop edx
call fcn.0040a080
push 0
push 0
mov eax, dword [0x48fb3c]
push eax
mov eax, dword [0x48fb50]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x48fb54], eax
push dword [0x490124]
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.0040ed30
mov eax, dword [0x490124]
push eax
push eax
mov ebx, dword [0x48faf8]
xor ebx, 0x7b3d89b
push ebx
call fcn.0040a240
pop eax
mov edx, str..zip
call fcn.0040ed30
lea ecx, [0x48fb44]
pop edx
call fcn.0040a080
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x48fb48]
call fcn.0040a008
mov edx, dword [0x48fb44]
push dword [0x490124]
call fcn.0040ed30
lea ecx, [0x48fb4c]
pop edx
call fcn.0040a080
mov edx, dword [0x48fb48]
push dword [0x490124]
call fcn.0040ed30
lea ecx, [0x48fb50]
pop edx
call fcn.0040a080
push 0
push 0
mov eax, dword [0x48fb3c]
push eax
mov eax, dword [0x48fb50]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x48fb54], eax
mov ebx, dword [0x48fb54]
and ebx, ebx
jne 0x402374
jmp 0x4023a3
push dword [0x48faf8]
call fcn.004096a6
mov ebx, eax
and ebx, ebx
jne 0x4023a3
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040acbe
jmp 0x409668
push 0
push 0
mov eax, dword [0x48fb3c]
push eax
mov eax, dword [0x48fb4c]
push eax
push 0
call sub.URLMON.dll_URLDownloadToFileA
mov dword [0x48fb58], eax
mov ebx, dword [0x48fb58]
and ebx, ebx
jne 0x402401
push 0
push 3
call fcn.0040c812
push str.Invalid_Trainer_User
push 0
push 8
call fcn.0040ac9a
call fcn.00408162
call fcn.00408460
jmp 0x4023c8
mov ebx, dword [0x48fb54]
and ebx, ebx
je 0x402423
push dword [0x48faf8]
call fcn.004096a6
mov ebx, eax
and ebx, ebx
jne 0x402423
mov eax, 1
jmp 0x402425
xor eax, eax
and eax, eax
je 0x402433
mov dword [0x48fb00], 0
lea ebp, [0x48fe10]
lea eax, [ebp]
push eax
call sub.USER32.dll_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x48fb5c]
mov ebx, dword [0x48fb5c]
cmp ebx, 1
jne 0x40246d
mov edx, 0x42607e
lea ecx, [0x48fb60]
call fcn.0040a008
jmp 0x40247d
mov edx, str.OFF.
lea ecx, [0x48fb60]
call fcn.0040a008
mov eax, dword [0x490124]
push eax
push eax
mov edx, str.Run_Game_and_then_press_F1_at_Main_Menu._Numlock_is
call fcn.0040ed30
mov edx, dword [0x48fb60]
call fcn.0040ed30
inc dword [0x490124]
push 0
push 8
mov edx, dword [0x48e7d4]
add dword [esp + 8], edx
call fcn.0040ac9a
pop dword [0x490124]
mov eax, 0x7530
call fcn.0040b879
mov dword [0x48fb64], eax
mov ebx, dword [0x48fb64]
cmp ebx, 0x63
jne 0x402596
mov eax, dword [0x490124]
push eax
push eax
push dword [0x490124]
call fcn.0040ae08
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e480
pop dword [0x490124]
push 0
call fcn.0040e500
mov dword [0x48fad4], eax
mov dword [0x48fa70], 1
mov ebx, dword [0x48fad4]
add ebx, 0xfffffffc
cmp ebx, dword [0x48fa70]
jl 0x40254f
push 0
call fcn.0040e630
mov dword [0x48fae4], eax
inc dword [0x48fa70]
jmp 0x402527
push 0
call fcn.0040e5d0
mov dword [0x48fadc], eax
push 0
call fcn.0040e220
mov ebx, dword [0x48fadc]
cmp ebx, dword [0x48fad4]
jne 0x402578
jmp 0x402582
jmp 0x409668
mov ebx, dword [0x48fb58]
and ebx, ebx
jne 0x402596
jmp 0x409668
call fcn.00408162
push 0xa
call sub.KERNEL32.dll_Sleep
push 0x70
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
and ebx, ebx
je 0x402433
mov edx, str.deadrising2.exe
lea ecx, [0x48fa94]
call fcn.0040a008
call fcn.00407403
mov ebx, dword [0x48fa98]
and ebx, ebx
jne 0x402614
push 0
push 4
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
push 0x12c
call sub.KERNEL32.dll_Sleep
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 8
call fcn.0040ac9a
jmp 0x402401
mov edx, str.CH.dll
lea ecx, [0x48fb68]
call fcn.0040a008
mov edx, dword [0x48fb08]
push dword [0x490124]
call fcn.0040ed30
mov edx, dword [0x48fb68]
call fcn.0040ed30
lea ecx, [0x48faac]
pop edx
call fcn.0040a080
call fcn.00407448
mov edx, str.xlive.dll
lea ecx, [0x48fb6c]
call fcn.0040a008
call fcn.00407403
call fcn.004080b1
call fcn.00408162
mov ebx, dword [0x48fb2c]
and ebx, ebx
jne 0x40269d
mov ebx, dword [0x48fb70]
and ebx, ebx
jne 0x40269d
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 8
call fcn.0040ac9a
jmp 0x402401
mov ebx, dword [0x48fad8]
cmp ebx, dword [0x48fae0]
jne 0x4026c1
mov ebx, dword [0x48fad8]
and ebx, ebx
je 0x4026c1
mov ebx, dword [0x48fae0]
and ebx, ebx
je 0x4026c1
jmp 0x4026c8
mov eax, 1
jmp 0x4026ca
xor eax, eax
and eax, eax
je 0x402726
mov eax, 0xa
call fcn.0040b879
mov ebx, eax
add ebx, 0xa
mov dword [0x48fb74], ebx
mov eax, 0x28
call fcn.0040b879
mov ebx, eax
add ebx, 0x28
mov dword [0x48fb78], ebx
mov ebx, dword [0x48fb2c]
add ebx, dword [0x48fb74]
mov dword [0x48fb2c], ebx
mov ebx, dword [0x48fb70]
add ebx, dword [0x48fb78]
mov dword [0x48fb70], ebx
jmp 0x409668
push 0
push 3
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
push str.Game_found__Trainer_Activated_
push 0
push 8
call fcn.0040ac9a
mov ebx, dword [0x48fb7c]
and ebx, ebx
je 0x402a60
push 0x8b
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xff
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x55
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x8b
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xec
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x83
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xec
mov ebx, dword [0x48faa8]
add ebx, 6
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x20
mov ebx, dword [0x48faa8]
add ebx, 7
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x53
mov ebx, dword [0x48faa8]
add ebx, 8
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x56
mov ebx, dword [0x48faa8]
add ebx, 9
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x57
mov ebx, dword [0x48faa8]
add ebx, 0xa
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x8d
mov ebx, dword [0x48faa8]
add ebx, 0xb
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x45
mov ebx, dword [0x48faa8]
add ebx, 0xc
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xe0
mov ebx, dword [0x48faa8]
add ebx, 0xd
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x33
mov ebx, dword [0x48faa8]
add ebx, 0xe
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xf6
mov ebx, dword [0x48faa8]
add ebx, 0xf
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x50
mov ebx, dword [0x48faa8]
add ebx, 0x10
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xff
mov ebx, dword [0x48faa8]
add ebx, 0x11
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x75
mov ebx, dword [0x48faa8]
add ebx, 0x12
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc
mov ebx, dword [0x48faa8]
add ebx, 0x13
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb7c]
add ebx, 0x1000
mov dword [0x48fa70], ebx
mov ebx, dword [0x48fb7c]
add ebx, 0x200000
cmp ebx, dword [0x48fa70]
jl 0x402a60
push dword [0x48faa4]
push 0x14
push dword [0x48fb04]
push dword [0x48fa70]
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
push 0x14
push dword [0x48fb04]
push dword [0x48faa8]
call fcn.0040ba40
mov dword [0x48fa78], eax
mov ebx, dword [0x48fa78]
cmp ebx, 1
jne 0x402a55
mov eax, dword [0x48fa70]
mov dword [0x48fb84], eax
push 0xc2
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 3
push dword [0x48faa8]
push dword [0x48fb84]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
inc dword [0x48fa70]
jmp 0x402976
mov ebx, dword [0x48fb40]
and ebx, ebx
jle 0x402a6f
jmp 0x4050ea
mov ebx, dword [0x48fb00]
cmp ebx, 0x45a2a5
jne 0x402b13
mov ebp, dword [0x48ff18]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0x64
mov dword [ebp + 0x14], 0x65
mov dword [ebp + 0x18], 0x66
mov dword [ebp + 0x1c], 0x67
mov dword [ebp + 0x20], 0x68
mov dword [ebp + 0x24], 0x69
mov dword [ebp + 0x28], 0x60
mov dword [ebp + 0x2c], 0x6a
mov dword [ebp + 0x30], 0x6b
mov dword [ebp + 0x34], 0x6d
mov dword [ebp + 0x38], 0x6f
mov dword [ebp + 0x3c], 0xdb
mov dword [ebp + 0x40], 0xdd
mov dword [ebp + 0x44], 0x6e
mov dword [ebp + 0x48], 0xbd
mov dword [ebp + 0x4c], 0xbb
mov dword [ebp + 0x50], 0xba
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040e480
mov dword [0x48fa78], eax
mov ebx, dword [0x48fa78]
and ebx, ebx
jle 0x402c86
mov dword [0x48fb38], 1
push 0
call fcn.0040e630
mov dword [0x48fb88], eax
mov dword [0x48fa70], 1
mov eax, dword [0x48fb88]
cmp eax, dword [0x48fa70]
jl 0x402c7c
mov eax, dword [0x490124]
push eax
push eax
push 0
call fcn.0040e690
lea ecx, [0x48fb8c]
pop edx
call fcn.0040a080
push dword [0x48fb8c]
mov edx, str.SHIFT
pop ecx
call fcn.0040ed90
je 0x402bb0
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff20]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x48fb8c]
mov edx, str.CTRL
pop ecx
call fcn.0040ed90
je 0x402bda
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff28]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x48fb8c]
mov edx, 0x426219
pop ecx
call fcn.0040ed90
je 0x402c04
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff30]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.0040e630
push eax
mov ebx, dword [0x48fa70]
mov ebp, dword [0x48ff18]
shl ebx, 2
pop dword [ebp + ebx]
mov eax, dword [0x490124]
push eax
push eax
push dword [0x490124]
push 0
mov ebx, dword [0x48fa70]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.0040a630
inc dword [0x490124]
mov edx, dword [0x48e7d4]
add dword [esp], edx
call fcn.0040a130
pop dword [0x490124]
push eax
mov ebx, dword [0x48fa70]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x48fa70]
jmp 0x402b58
push 0
call fcn.0040e220
mov ebx, dword [0x48fb2c]
add ebx, 0x42ccdf
mov dword [0x48fb90], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x414c36
mov dword [0x48fb94], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x414bbf
mov dword [0x48fb98], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x1ff0cb
mov dword [0x48fb9c], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x1ff0fb
mov dword [0x48fba0], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x1ff131
mov dword [0x48fba4], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x1ff167
mov dword [0x48fba8], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x1ff19d
mov dword [0x48fbac], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x401b04
mov dword [0x48fbb0], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0xc8846
mov dword [0x48fbb4], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0xd2d8c
mov dword [0x48fbb8], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x33d46f
mov dword [0x48fbbc], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x33d494
mov dword [0x48fbc0], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x962ff
mov dword [0x48fbc4], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x256b72
mov dword [0x48fbc8], ebx
mov ebx, dword [0x48fb2c]
add ebx, 0x2bb178
mov dword [0x48fbcc], ebx
push 0x9c
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x60
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x89
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xd
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3f
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 3
mov ebx, dword [0x48faa8]
add ebx, 6
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 7
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x83
mov ebx, dword [0x48faa8]
add ebx, 8
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3d
mov ebx, dword [0x48faa8]
add ebx, 9
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 4
mov ebx, dword [0x48faa8]
add ebx, 0xa
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3f
mov ebx, dword [0x48faa8]
add ebx, 0xb
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 3
mov ebx, dword [0x48faa8]
add ebx, 0xc
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 0xd
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 1
mov ebx, dword [0x48faa8]
add ebx, 0xe
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x75
mov ebx, dword [0x48faa8]
add ebx, 0xf
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 7
mov ebx, dword [0x48faa8]
add ebx, 0x10
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc7
mov ebx, dword [0x48faa8]
add ebx, 0x11
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x41
mov ebx, dword [0x48faa8]
add ebx, 0x12
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x2c
mov ebx, dword [0x48faa8]
add ebx, 0x13
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x14
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x15
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x96
mov ebx, dword [0x48faa8]
add ebx, 0x16
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x44
mov ebx, dword [0x48faa8]
add ebx, 0x17
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x61
mov ebx, dword [0x48faa8]
add ebx, 0x18
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x9d
mov ebx, dword [0x48faa8]
add ebx, 0x19
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xf3
mov ebx, dword [0x48faa8]
add ebx, 0x1a
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xf
mov ebx, dword [0x48faa8]
add ebx, 0x1b
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x10
mov ebx, dword [0x48faa8]
add ebx, 0x1c
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x41
mov ebx, dword [0x48faa8]
add ebx, 0x1d
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x2c
mov ebx, dword [0x48faa8]
add ebx, 0x1e
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc3
mov ebx, dword [0x48faa8]
add ebx, 0x1f
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x20
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x21
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x22
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x23
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x24
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x25
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x26
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x27
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x28
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x29
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x2a
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x2b
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x2c
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x2d
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x2e
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x2f
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x9c
mov ebx, dword [0x48faa8]
add ebx, 0x30
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x60
mov ebx, dword [0x48faa8]
add ebx, 0x31
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x83
mov ebx, dword [0x48faa8]
add ebx, 0x32
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3d
mov ebx, dword [0x48faa8]
add ebx, 0x33
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 8
mov ebx, dword [0x48faa8]
add ebx, 0x34
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3f
mov ebx, dword [0x48faa8]
add ebx, 0x35
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 3
mov ebx, dword [0x48faa8]
add ebx, 0x36
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 0x37
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 1
mov ebx, dword [0x48faa8]
add ebx, 0x38
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x75
mov ebx, dword [0x48faa8]
add ebx, 0x39
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xb
mov ebx, dword [0x48faa8]
add ebx, 0x3a
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3e
mov ebx, dword [0x48faa8]
add ebx, 0x3b
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc7
mov ebx, dword [0x48faa8]
add ebx, 0x3c
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x85
mov ebx, dword [0x48faa8]
add ebx, 0x3d
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xfc
mov ebx, dword [0x48faa8]
add ebx, 0x3e
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x3f
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x40
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x41
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x42
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x43
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc6
mov ebx, dword [0x48faa8]
add ebx, 0x44
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x42
mov ebx, dword [0x48faa8]
add ebx, 0x45
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x61
mov ebx, dword [0x48faa8]
add ebx, 0x46
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x9d
mov ebx, dword [0x48faa8]
add ebx, 0x47
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xd9
mov ebx, dword [0x48faa8]
add ebx, 0x48
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x85
mov ebx, dword [0x48faa8]
add ebx, 0x49
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xfc
mov ebx, dword [0x48faa8]
add ebx, 0x4a
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x4b
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x4c
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x4d
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc3
mov ebx, dword [0x48faa8]
add ebx, 0x4e
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 0x4f
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x83
mov ebx, dword [0x48faa8]
add ebx, 0x50
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3d
mov ebx, dword [0x48faa8]
add ebx, 0x51
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc
mov ebx, dword [0x48faa8]
add ebx, 0x52
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3f
mov ebx, dword [0x48faa8]
add ebx, 0x53
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 3
mov ebx, dword [0x48faa8]
add ebx, 0x54
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 0x55
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 1
mov ebx, dword [0x48faa8]
add ebx, 0x56
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x75
mov ebx, dword [0x48faa8]
add ebx, 0x57
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x1e
mov ebx, dword [0x48faa8]
add ebx, 0x58
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc7
mov ebx, dword [0x48faa8]
add ebx, 0x59
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x86
mov ebx, dword [0x48faa8]
add ebx, 0x5a
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xfc
mov ebx, dword [0x48faa8]
add ebx, 0x5b
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x5c
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x5d
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x5e
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x5f
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc0
mov ebx, dword [0x48faa8]
add ebx, 0x60
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x79
mov ebx, dword [0x48faa8]
add ebx, 0x61
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x44
mov ebx, dword [0x48faa8]
add ebx, 0x62
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc7
mov ebx, dword [0x48faa8]
add ebx, 0x63
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x86
mov ebx, dword [0x48faa8]
add ebx, 0x64
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x78
mov ebx, dword [0x48faa8]
add ebx, 0x65
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 1
mov ebx, dword [0x48faa8]
add ebx, 0x66
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x67
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x68
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x69
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc0
mov ebx, dword [0x48faa8]
add ebx, 0x6a
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x79
mov ebx, dword [0x48faa8]
add ebx, 0x6b
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x44
mov ebx, dword [0x48faa8]
add ebx, 0x6c
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc7
mov ebx, dword [0x48faa8]
add ebx, 0x6d
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push pe_nt_image_headers32
mov ebx, dword [0x48faa8]
add ebx, 0x6e
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xf4
mov ebx, dword [0x48faa8]
add ebx, 0x6f
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x70
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x71
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x72
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x73
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc0
mov ebx, dword [0x48faa8]
add ebx, 0x74
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x79
mov ebx, dword [0x48faa8]
add ebx, 0x75
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x44
mov ebx, dword [0x48faa8]
add ebx, 0x76
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xd9
mov ebx, dword [0x48faa8]
add ebx, 0x77
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x86
mov ebx, dword [0x48faa8]
add ebx, 0x78
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xfc
mov ebx, dword [0x48faa8]
add ebx, 0x79
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x7a
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x7b
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x7c
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc3
mov ebx, dword [0x48faa8]
add ebx, 0x7d
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x7e
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x7f
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x89
mov ebx, dword [0x48faa8]
add ebx, 0x80
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xd
mov ebx, dword [0x48faa8]
add ebx, 0x81
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x10
mov ebx, dword [0x48faa8]
add ebx, 0x82
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3f
mov ebx, dword [0x48faa8]
add ebx, 0x83
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 3
mov ebx, dword [0x48faa8]
add ebx, 0x84
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 0x85
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x8b
mov ebx, dword [0x48faa8]
add ebx, 0x86
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x69
mov ebx, dword [0x48faa8]
add ebx, 0x87
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x1c
mov ebx, dword [0x48faa8]
add ebx, 0x88
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x8b
mov ebx, dword [0x48faa8]
add ebx, 0x89
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xd8
mov ebx, dword [0x48faa8]
add ebx, 0x8a
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc3
mov ebx, dword [0x48faa8]
add ebx, 0x8b
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x8c
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x8d
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x8e
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x8f
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x83
mov ebx, dword [0x48faa8]
add ebx, 0x90
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3d
mov ebx, dword [0x48faa8]
add ebx, 0x91
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x14
mov ebx, dword [0x48faa8]
add ebx, 0x92
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3f
mov ebx, dword [0x48faa8]
add ebx, 0x93
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xf6
mov ebx, dword [0x48faa8]
add ebx, 0x94
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 1
mov ebx, dword [0x48faa8]
add ebx, 0x95
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0x96
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x74
mov ebx, dword [0x48faa8]
add ebx, 0x97
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 9
mov ebx, dword [0x48faa8]
add ebx, 0x98
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x8b
mov ebx, dword [0x48faa8]
add ebx, 0x99
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3d
mov ebx, dword [0x48faa8]
add ebx, 0x9a
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x14
mov ebx, dword [0x48faa8]
add ebx, 0x9b
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3f
mov ebx, dword [0x48faa8]
add ebx, 0x9c
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 3
mov ebx, dword [0x48faa8]
add ebx, 0x9d
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 0x9e
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x89
mov ebx, dword [0x48faa8]
add ebx, 0x9f
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x78
mov ebx, dword [0x48faa8]
add ebx, 0xa0
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x30
mov ebx, dword [0x48faa8]
add ebx, 0xa1
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x8b
mov ebx, dword [0x48faa8]
add ebx, 0xa2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x78
mov ebx, dword [0x48faa8]
add ebx, 0xa3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x30
mov ebx, dword [0x48faa8]
add ebx, 0xa4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x8b
mov ebx, dword [0x48faa8]
add ebx, 0xa5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xe9
mov ebx, dword [0x48faa8]
add ebx, 0xa6
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc3
mov ebx, dword [0x48faa8]
add ebx, 0xa7
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xa8
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xa9
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xaa
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xab
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xac
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xad
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xae
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xaf
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x83
mov ebx, dword [0x48faa8]
add ebx, 0xb0
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3d
mov ebx, dword [0x48faa8]
add ebx, 0xb1
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x18
mov ebx, dword [0x48faa8]
add ebx, 0xb2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3f
mov ebx, dword [0x48faa8]
add ebx, 0xb3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 3
mov ebx, dword [0x48faa8]
add ebx, 0xb4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 0xb5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 1
mov ebx, dword [0x48faa8]
add ebx, 0xb6
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x75
mov ebx, dword [0x48faa8]
add ebx, 0xb7
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xa
mov ebx, dword [0x48faa8]
add ebx, 0xb8
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc7
mov ebx, dword [0x48faa8]
add ebx, 0xb9
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push pe_nt_image_headers32
mov ebx, dword [0x48faa8]
add ebx, 0xba
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 8
mov ebx, dword [0x48faa8]
add ebx, 0xbb
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 0xbc
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xbd
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xbe
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xbf
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xc0
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xc1
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x49
mov ebx, dword [0x48faa8]
add ebx, 0xc2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xd9
mov ebx, dword [0x48faa8]
add ebx, 0xc3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push pe_nt_image_headers32
mov ebx, dword [0x48faa8]
add ebx, 0xc4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 8
mov ebx, dword [0x48faa8]
add ebx, 0xc5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 0xc6
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xc7
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xc8
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc3
mov ebx, dword [0x48faa8]
add ebx, 0xc9
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xca
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xcb
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xcc
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xcd
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xce
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xcf
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x9c
mov ebx, dword [0x48faa8]
add ebx, 0xd0
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x60
mov ebx, dword [0x48faa8]
add ebx, 0xd1
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x83
mov ebx, dword [0x48faa8]
add ebx, 0xd2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3d
mov ebx, dword [0x48faa8]
add ebx, 0xd3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 8
mov ebx, dword [0x48faa8]
add ebx, 0xd4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x3f
mov ebx, dword [0x48faa8]
add ebx, 0xd5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 3
mov ebx, dword [0x48faa8]
add ebx, 0xd6
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 0xd7
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 1
mov ebx, dword [0x48faa8]
add ebx, 0xd8
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x75
mov ebx, dword [0x48faa8]
add ebx, 0xd9
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xa
mov ebx, dword [0x48faa8]
add ebx, 0xda
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc7
mov ebx, dword [0x48faa8]
add ebx, 0xdb
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push pe_nt_image_headers32
mov ebx, dword [0x48faa8]
add ebx, 0xdc
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x1c
mov ebx, dword [0x48faa8]
add ebx, 0xdd
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 1
mov ebx, dword [0x48faa8]
add ebx, 0xde
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xdf
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xe0
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x63
mov ebx, dword [0x48faa8]
add ebx, 0xe1
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xe2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xe3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xe4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x61
mov ebx, dword [0x48faa8]
add ebx, 0xe5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x9d
mov ebx, dword [0x48faa8]
add ebx, 0xe6
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x8b
mov ebx, dword [0x48faa8]
add ebx, 0xe7
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push pe_nt_image_headers32
mov ebx, dword [0x48faa8]
add ebx, 0xe8
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x1c
mov ebx, dword [0x48faa8]
add ebx, 0xe9
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 1
mov ebx, dword [0x48faa8]
add ebx, 0xea
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xeb
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xec
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc3
mov ebx, dword [0x48faa8]
add ebx, 0xed
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 0x2ac
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x1091
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x3f00
push ebx
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x1095
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x3f04
push ebx
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x109b
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x3f08
push ebx
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x10c5
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x1165
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x3f0c
push ebx
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x10e3
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x3f10
push ebx
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x1113
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x3f14
push ebx
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x1123
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x112c
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x3f18
push ebx
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x1143
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0xe8
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x1091
sub ebx, dword [0x48fb90]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 5
push dword [0x48faa8]
push dword [0x48fb90]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0xe8
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x10c1
sub ebx, dword [0x48fb94]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fb94]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0xe8
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x10e1
sub ebx, dword [0x48fb9c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fb9c]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x10e1
sub ebx, dword [0x48fba0]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fba0]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x10e1
sub ebx, dword [0x48fba4]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fba4]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x10e1
sub ebx, dword [0x48fba8]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fba8]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x10e1
sub ebx, dword [0x48fbac]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fbac]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0xe8
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x1111
sub ebx, dword [0x48fbb0]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 5
push dword [0x48faa8]
push dword [0x48fbb0]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0xe8
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x1121
sub ebx, dword [0x48fbb4]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 5
push dword [0x48faa8]
push dword [0x48fbb4]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0xe8
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x1141
sub ebx, dword [0x48fbcc]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fbcc]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0xe8
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
mov ebx, dword [0x48fb70]
add ebx, 0x1161
sub ebx, dword [0x48fb98]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fb98]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
mov dword [0x48fbd0], 0
mov eax, 0xff
cmp eax, dword [0x48fbd0]
jl 0x405114
push dword [0x48fbd0]
call sub.USER32.dll_GetAsyncKeyState
inc dword [0x48fbd0]
jmp 0x4050f4
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x405123
push 0x55009553
ret
mov ebp, dword [0x48ff18]
push dword [ebp + 4]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 4]
mov ebp, dword [0x48ff18]
push dword [ebp + 8]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 8]
mov ebp, dword [0x48ff18]
push dword [ebp + 0xc]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0xc]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x10]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x10]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x14]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x14]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x18]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x18]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x1c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x1c]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x20]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x20]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x24]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x24]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x28]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x28]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x2c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x2c]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x30]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x30]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x34]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x34]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x38]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x38]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x3c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x3c]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x40]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x40]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x44]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x44]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x48]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x48]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x4c]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x4c]
mov ebp, dword [0x48ff18]
push dword [ebp + 0x50]
call sub.USER32.dll_GetAsyncKeyState
push eax
mov ebp, dword [0x48ff38]
pop dword [ebp + 0x50]
push 0x10
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x48fbd4], eax
push 0x11
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x48fbd8], eax
push 0x12
call sub.USER32.dll_GetAsyncKeyState
mov dword [0x48fbdc], eax
mov eax, 0x32
call fcn.0040b879
mov dword [0x48fb64], eax
mov ebx, dword [0x48fb64]
cmp ebx, 0x19
jne 0x4053f0
mov ebx, dword [0x48fad8]
cmp ebx, dword [0x48fae0]
jne 0x405372
mov ebx, dword [0x48fad8]
and ebx, ebx
je 0x405372
mov ebx, dword [0x48fae0]
and ebx, ebx
je 0x405372
jmp 0x405379
mov eax, 1
jmp 0x40537b
xor eax, eax
and eax, eax
je 0x4053f0
mov eax, 0xff
call fcn.0040b879
mov dword [0x48fb74], eax
mov eax, 0x190
call fcn.0040b879
mov dword [0x48fb78], eax
push dword [0x48fb74]
mov eax, dword [0x48faa8]
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 1
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, dword [0x48fb78]
add ebx, 0x1091
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
jmp 0x409668
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f00
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov dword [0x48fbe0], eax
mov ebx, dword [0x48fbe0]
add ebx, 0x5c
mov dword [0x48fbe4], ebx
mov ebx, dword [0x48fbe0]
add ebx, 0x24
mov dword [0x48fbe8], ebx
mov ebx, dword [0x48fbe0]
add ebx, 0x20
mov dword [0x48fbec], ebx
mov ebx, dword [0x48fbe0]
add ebx, 0x38
mov dword [0x48fbf0], ebx
mov ebx, dword [0x48fbe0]
add ebx, 0x54
mov dword [0x48fbf4], ebx
mov ebx, dword [0x48fbe0]
add ebx, 0x58
mov dword [0x48fbf8], ebx
mov ebx, dword [0x48fbe0]
add ebx, 0x60
mov dword [0x48fbfc], ebx
mov ebx, dword [0x48fbe0]
add ebx, 0x64
mov dword [0x48fc00], ebx
mov ebx, dword [0x48fbe0]
add ebx, 0x70
mov dword [0x48fc04], ebx
mov ebx, dword [0x48fbe0]
add ebx, 0x37c
mov dword [0x48fc08], ebx
mov ebx, dword [0x48fbe0]
add ebx, 0x20
mov dword [0x48fbec], ebx
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f10
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov ebx, eax
add ebx, 0x1c
mov dword [0x48fc0c], ebx
mov ebp, dword [0x48ff18]
push dword [ebp + 4]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 4]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 4]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 4]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc10], ebx
mov ebx, dword [0x48fc10]
and ebx, ebx
je 0x405656
push dword [0x48fc14]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4055e6
mov dword [0x48fc14], 1
push 1
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f04
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 5
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
jmp 0x405655
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405655
mov dword [0x48fc14], 0
push 0
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f04
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 6
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
pop eax
mov ebp, dword [0x48ff18]
push dword [ebp + 8]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 8]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 8]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 8]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc18], ebx
mov ebx, dword [0x48fc18]
and ebx, ebx
je 0x405794
push dword [0x48fc1c]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x405724
mov dword [0x48fc1c], 1
push 1
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f08
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 5
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
jmp 0x405793
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405793
mov dword [0x48fc1c], 0
push 0
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f08
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 6
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
pop eax
mov ebp, dword [0x48ff18]
push dword [ebp + 0xc]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0xc]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0xc]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0xc]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc20], ebx
mov ebx, dword [0x48fc20]
and ebx, ebx
je 0x405883
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fc04]
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov dword [0x48fc24], eax
add dword [0x48fc24], 0x7a120
push dword [0x48fc24]
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fc04]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x10]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x10]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x10]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x10]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc28], ebx
mov ebx, dword [0x48fc28]
and ebx, ebx
je 0x405972
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbf0]
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov dword [0x48fc24], eax
add dword [0x48fc24], 0x7d0
push dword [0x48fc24]
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbf0]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x14]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x14]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x14]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x14]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc2c], ebx
mov ebx, dword [0x48fc2c]
and ebx, ebx
je 0x405a1c
push 7
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbf4]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x18]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x18]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x18]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x18]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc30], ebx
mov ebx, dword [0x48fc30]
and ebx, ebx
je 0x405ac6
push 3
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbf8]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x1c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x1c]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc34], ebx
mov ebx, dword [0x48fc34]
and ebx, ebx
je 0x405b70
push 0xc
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbe4]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x20]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x20]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x20]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x20]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc38], ebx
mov ebx, dword [0x48fc38]
and ebx, ebx
je 0x405c1a
push 0xc
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbfc]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x24]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x24]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x24]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x24]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc3c], ebx
mov ebx, dword [0x48fc3c]
and ebx, ebx
je 0x405cc4
push 5
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fc00]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x28]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x28]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x28]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x28]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc40], ebx
mov ebx, dword [0x48fc40]
and ebx, ebx
je 0x405d6e
push 0x14c09
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fc08]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x2c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x2c]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc44], ebx
mov ebx, dword [0x48fc44]
and ebx, ebx
je 0x405e88
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbe8]
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov dword [0x48fc24], eax
add dword [0x48fc24], 0x2710
push dword [0x48fc24]
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbe8]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fbe8]
add ebx, 4
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x30]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x30]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x30]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x30]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc48], ebx
mov ebx, dword [0x48fc48]
and ebx, ebx
je 0x405f88
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbec]
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov dword [0x48fc24], eax
inc dword [0x48fc24]
mov ebx, dword [0x48fc24]
cmp ebx, 0x63
jle 0x405f33
mov dword [0x48fc24], 0x63
push dword [0x48fc24]
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbec]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x34]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x34]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x34]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x34]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc4c], ebx
mov ebx, dword [0x48fc4c]
and ebx, ebx
je 0x406088
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbec]
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov dword [0x48fc24], eax
dec dword [0x48fc24]
mov ebx, dword [0x48fc24]
cmp ebx, 1
jge 0x406033
mov dword [0x48fc24], 1
push dword [0x48fc24]
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fbec]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x38]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x38]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x38]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x38]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc50], ebx
mov ebx, dword [0x48fc50]
and ebx, ebx
je 0x4061c6
push dword [0x48fc54]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406156
mov dword [0x48fc54], 1
push 1
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f0c
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 5
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
jmp 0x4061c5
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4061c5
mov dword [0x48fc54], 0
push 0
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f0c
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 6
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
pop eax
mov ebp, dword [0x48ff18]
push dword [ebp + 0x3c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x3c]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc58], ebx
mov ebx, dword [0x48fc58]
and ebx, ebx
je 0x40635d
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fc0c]
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov dword [0x48fc24], eax
dec dword [0x48fc24]
mov ebx, dword [0x48fc24]
and ebx, ebx
jge 0x406308
mov dword [0x48fc24], 0x3b
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fc0c]
add ebx, 0xfffffffc
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov dword [0x48fb78], eax
dec dword [0x48fb78]
mov ebx, dword [0x48fb78]
and ebx, ebx
jge 0x4062c8
mov dword [0x48fb78], 0
push dword [0x48fb78]
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fc0c]
add ebx, 0xfffffffc
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push dword [0x48fc24]
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fc0c]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x28
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x40]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x40]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x40]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x40]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc5c], ebx
mov ebx, dword [0x48fc5c]
and ebx, ebx
je 0x4064f6
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fc0c]
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov dword [0x48fc24], eax
inc dword [0x48fc24]
mov ebx, dword [0x48fc24]
cmp ebx, 0x3b
jle 0x4064a1
mov dword [0x48fc24], 0
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fc0c]
add ebx, 0xfffffffc
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x48fa78], eax
mov eax, dword [0x48faa8]
call fcn.0040b9e0
mov dword [0x48fb78], eax
inc dword [0x48fb78]
mov ebx, dword [0x48fb78]
cmp ebx, 0x17
jle 0x406461
mov dword [0x48fb78], 0
push dword [0x48fb78]
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fc0c]
add ebx, 0xfffffffc
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push dword [0x48fc24]
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
push dword [0x48fc0c]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 0
call fcn.0040b502
push 0x28
call sub.KERNEL32.dll_Sleep
mov ebp, dword [0x48ff18]
push dword [ebp + 0x44]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x44]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x44]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x44]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc60], ebx
mov ebx, dword [0x48fc60]
and ebx, ebx
je 0x4068f1
push dword [0x48fc64]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406689
mov dword [0x48fc64], 1
push pe_nt_image_headers32
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f14
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fbb8]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 5
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
jmp 0x4068f0
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4067bf
mov dword [0x48fc64], 2
push 1
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f14
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fbb8]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 5
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
jmp 0x4068f0
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4068f0
mov dword [0x48fc64], 0
push 0
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f14
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0xf
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x84
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xa1
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fbb8]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 6
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
pop eax
mov ebp, dword [0x48ff18]
push dword [ebp + 0x48]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x48]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x48]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x48]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc68], ebx
mov ebx, dword [0x48fc68]
and ebx, ebx
je 0x406b0e
push dword [0x48fc6c]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406a30
mov dword [0x48fc6c], 1
push 0x90
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 2
push dword [0x48faa8]
push dword [0x48fbbc]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 2
push dword [0x48faa8]
push dword [0x48fbc0]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 5
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
jmp 0x406b0d
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406b0d
mov dword [0x48fc6c], 0
push 0x74
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x38
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 2
push dword [0x48faa8]
push dword [0x48fbbc]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0x74
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x33
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 2
push dword [0x48faa8]
push dword [0x48fbc0]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 6
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
pop eax
mov ebp, dword [0x48ff18]
push dword [ebp + 0x4c]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x4c]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc70], ebx
mov ebx, dword [0x48fc70]
and ebx, ebx
je 0x40706b
push dword [0x48fc74]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x406ded
mov dword [0x48fc74], 1
push 0xe9
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xa2
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x90
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fbc4]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0xc7
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x46
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x5c
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 6
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 6
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xc7
mov ebx, dword [0x48faa8]
add ebx, 7
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x46
mov ebx, dword [0x48faa8]
add ebx, 8
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x60
mov ebx, dword [0x48faa8]
add ebx, 9
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xa
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xb
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xc
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xd
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 0xe
push dword [0x48faa8]
push dword [0x48fbc8]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 5
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
jmp 0x40706a
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40706a
mov dword [0x48fc74], 0
push 0xf
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x85
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xa1
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 6
push dword [0x48faa8]
push dword [0x48fbc4]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push pe_nt_image_headers32
mov ebx, dword [0x48faa8]
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xbc
mov ebx, dword [0x48faa8]
inc ebx
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x24
mov ebx, dword [0x48faa8]
add ebx, 2
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x48
mov ebx, dword [0x48faa8]
add ebx, 3
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 2
mov ebx, dword [0x48faa8]
add ebx, 4
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 5
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 6
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 7
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xf
mov ebx, dword [0x48faa8]
add ebx, 8
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0x84
mov ebx, dword [0x48faa8]
add ebx, 9
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0xb4
mov ebx, dword [0x48faa8]
add ebx, 0xa
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xb
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xc
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push 0
mov ebx, dword [0x48faa8]
add ebx, 0xd
mov eax, ebx
call fcn.0040b9c0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 0xe
push dword [0x48faa8]
push dword [0x48fbc8]
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 6
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
pop eax
mov ebp, dword [0x48ff18]
push dword [ebp + 0x50]
call sub.USER32.dll_GetAsyncKeyState
mov ebx, eax
mov ebp, dword [0x48ff20]
mov edi, dword [ebp + 0x50]
add edi, dword [0x48fbd4]
imul ebx, edi
mov ebp, dword [0x48ff28]
mov edi, dword [ebp + 0x50]
add edi, dword [0x48fbd8]
imul ebx, edi
mov ebp, dword [0x48ff30]
mov edi, dword [ebp + 0x50]
add edi, dword [0x48fbdc]
imul ebx, edi
mov dword [0x48fc78], ebx
mov ebx, dword [0x48fc78]
and ebx, ebx
je 0x4071a9
push dword [0x48fc7c]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x407139
mov dword [0x48fc7c], 1
push 1
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f18
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 5
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
jmp 0x4071a8
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4071a8
mov dword [0x48fc7c], 0
push 0
mov eax, dword [0x48faa8]
call fcn.0040b9d0
mov dword [0x48fa78], eax
push dword [0x48faa4]
push 4
push dword [0x48faa8]
mov ebx, dword [0x48fb70]
add ebx, 0x3f18
push ebx
push dword [0x48fb80]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x48fa78], eax
push 0
push 6
call fcn.0040b502
push 0x12c
call sub.KERNEL32.dll_Sleep
pop eax
mov dword [0x48fc10], 0
mov dword [0x48fc18], 0
mov dword [0x48fc20], 0
mov dword [0x48fc28], 0
mov dword [0x48fc2c], 0
mov dword [0x48fc30], 0
mov dword [0x48fc34], 0
mov dword [0x48fc38], 0
mov dword [0x48fc3c], 0
mov dword [0x48fc40], 0
mov dword [0x48fc44], 0
mov dword [0x48fc48], 0
mov dword [0x48fc4c], 0
mov dword [0x48fc50], 0
mov dword [0x48fc58], 0
mov dword [0x48fc5c], 0
mov dword [0x48fc60], 0
mov dword [0x48fc68], 0
mov dword [0x48fc70], 0
mov dword [0x48fc78], 0
mov ebx, dword [0x48fb00]
cmp ebx, 0x45a2a5
je 0x40728e
push 0
push 3
call fcn.0040c812
call fcn.00408162
push 1
call sub.KERNEL32.dll_Sleep
mov eax, 0xbb8
call fcn.0040b879
mov dword [0x48fb64], eax
mov ebx, dword [0x48fb64]
cmp ebx, 0x63
jne 0x407375
mov eax, dword [0x490124]
push eax
push eax
push dword [0x490124]
call fcn.0040ae08
inc dword [0x490124]
push 0
mov edx, dword [0x48e7d4]
add dword [esp + 4], edx
call fcn.0040e480
pop dword [0x490124]
push 0
call fcn.0040e500
mov dword [0x48fad4], eax
mov dword [0x48fa70], 1
mov ebx, dword [0x48fad4]
add ebx, 0xfffffffc
cmp ebx, dword [0x48fa70]
jl 0x40732e
push 0
call fcn.0040e630
mov dword [0x48fae4], eax
inc dword [0x48fa70]
jmp 0x407306
push 0
call fcn.0040e5d0
mov dword [0x48fadc], eax
push 0
call fcn.0040e220
mov ebx, dword [0x48fadc]
cmp ebx, dword [0x48fad4]
jne 0x407357
jmp 0x407361
jmp 0x409668
mov ebx, dword [0x48fb58]
and ebx, ebx
jne 0x407375
jmp 0x409668
mov ebx, dword [0x48fad8]
cmp ebx, dword [0x48fae0]
jne 0x407399
mov ebx, dword [0x48fad8]
and ebx, ebx
je 0x407399
mov ebx, dword [0x48fae0]
and ebx, ebx
je 0x407399
jmp 0x4073a0
mov eax, 1
jmp 0x4073a2
xor eax, eax
and eax, eax
je 0x4073fe
mov eax, 0xa
call fcn.0040b879
mov ebx, eax
add ebx, 0xa
mov dword [0x48fb74], ebx
mov eax, 0x28
call fcn.0040b879
mov ebx, eax
add ebx, 0x28
mov dword [0x48fb78], ebx
mov ebx, dword [0x48fb2c]
add ebx, dword [0x48fb74]
mov dword [0x48fb2c], ebx
mov ebx, dword [0x48fb70]
add ebx, dword [0x48fb78]
mov dword [0x48fb70], ebx
call fcn.00408460
jmp 0x402c86
jmp 0x4050ea
push 0
call 0x409682
push dword [0x48fa5c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040b2bc
call fcn.0040ba10
call fcn.0040bb62
call fcn.0040c091
call fcn.0040cf48
call fcn.0040e280
call fcn.0040ec00
ret