Function at 0x401000
Capabilities:
Allocate thread local storage
Check for time delay via gettickcount
Check internet connectivity via wininet
Download url
Log keystrokes via polling
Receive data

Disassembly:
push 0x71c
push 0
push 0x4a2c64
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4a2c68], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4a2c64], eax
mov eax, 0x491cb1
mov dword [0x4a2c6c], eax
call fcn.00412a70
call fcn.004120b0
call fcn.00411f87
call fcn.00411515
call fcn.00410918
call fcn.004106e9
call fcn.004105a3
call fcn.0040fa60
call fcn.0040f620
call fcn.0040f45f
call fcn.0040db5e
call fcn.0040c429
call fcn.0040befb
call fcn.0040b7ed
call fcn.0040b5ef
call fcn.0040a209
call fcn.0040c3a0
call fcn.0040a800
mov edx, dword [0x4a36e8]
push edx
push edx
call fcn.0040f734
push 0x4a2c70
call fcn.00412af0
push dword [0x4a36e8]
mov edx, dword [0x4a2c70]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.0.ogg
call fcn.00412b70
inc dword [0x4a36e8]
push 0
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040fc00
pop dword [0x4a36e8]
mov ebp, 0x45033e
mov ebx, ebp
mov ebp, 0x44d7a8
sub ebx, ebp
push ebx
mov ebp, 0x44d7a8
push ebp
push 0
call fcn.0040fe30
push 0
call fcn.0040f9e0
push dword [0x4a36e8]
mov edx, dword [0x4a2c70]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.1.ogg
call fcn.00412b70
inc dword [0x4a36e8]
push 0
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040fc00
pop dword [0x4a36e8]
mov ebp, 0x4532af
mov ebx, ebp
mov ebp, 0x45033e
sub ebx, ebp
push ebx
mov ebp, 0x45033e
push ebp
push 0
call fcn.0040fe30
push 0
call fcn.0040f9e0
push dword [0x4a36e8]
mov edx, dword [0x4a2c70]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.3.ogg
call fcn.00412b70
inc dword [0x4a36e8]
push 0
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040fc00
pop dword [0x4a36e8]
mov ebp, 0x4568e4
mov ebx, ebp
mov ebp, 0x4532af
sub ebx, ebp
push ebx
mov ebp, 0x4532af
push ebp
push 0
call fcn.0040fe30
push 0
call fcn.0040f9e0
push dword [0x4a36e8]
mov edx, dword [0x4a2c70]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.4.ogg
call fcn.00412b70
inc dword [0x4a36e8]
push 0
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040fc00
pop dword [0x4a36e8]
mov ebp, 0x45b2b5
mov ebx, ebp
mov ebp, 0x4568e4
sub ebx, ebp
push ebx
mov ebp, 0x4568e4
push ebp
push 0
call fcn.0040fe30
push 0
call fcn.0040f9e0
call fcn.0040a890
push dword [0x4a36e8]
mov edx, dword [0x4a2c70]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.0.ogg
call fcn.00412b70
inc dword [0x4a36e8]
push 0
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040aa88
pop dword [0x4a36e8]
mov dword [0x4a2c74], eax
push dword [0x4a36e8]
mov edx, dword [0x4a2c70]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.1.ogg
call fcn.00412b70
inc dword [0x4a36e8]
push 1
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040aa88
pop dword [0x4a36e8]
mov dword [0x4a2c74], eax
push dword [0x4a36e8]
mov edx, dword [0x4a2c70]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.3.ogg
call fcn.00412b70
inc dword [0x4a36e8]
push 3
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040aa88
pop dword [0x4a36e8]
mov dword [0x4a2c74], eax
push dword [0x4a36e8]
mov edx, dword [0x4a2c70]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.4.ogg
call fcn.00412b70
inc dword [0x4a36e8]
push 4
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040aa88
pop dword [0x4a36e8]
mov dword [0x4a2c74], eax
call fcn.0040c3a0
push dword [0x4a36e8]
push 0
push 0x40
mov edx, dword [0x4a36e8]
push edx
push edx
call fcn.0040b81c
mov edx, dword [0x4928b4]
add dword [esp], edx
call fcn.00408296
push 0x4a2c8c
call fcn.00412af0
mov ebp, 0x45b2b5
push ebp
push 0
call fcn.00410b55
and eax, eax
je 0x401f6f
mov ebp, 0x477725
push ebp
push 2
call fcn.00410b55
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0x41
push 0x133
push 2
call fcn.00410d1f
push eax
call fcn.00410769
call fcn.004107a9
push 0x100
push 0x18
push 0x44d214
push 1
call fcn.0040f634
and eax, eax
je 0x40142d
push 0x100
push 0x30
push 0x44d214
push 2
call fcn.0040f634
and eax, eax
je 0x40144a
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.00410d3b
and eax, eax
je 0x40152e
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 1
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
push 0xff
push 0
push 0
mov eax, 0
call fcn.0040bd10
push eax
push str.Wurmschnitzel
push 0
push 0
call fcn.0041080a
call fcn.004107a9
push 0
push 0x64
push 0xc8
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0x11
call fcn.004107fa
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0x4a3338
push 0x44d7a0
push 8
push 0x65
push 4
call fcn.004104a4
mov edx, dword [0x4a36e8]
push edx
push edx
call fcn.0040f734
push 0x4a2c90
call fcn.00412af0
push dword [0x4a36e8]
mov edx, dword [0x4a2c90]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.Options
call fcn.00412b70
inc dword [0x4a36e8]
push 0xa
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040fc00
pop dword [0x4a36e8]
and eax, eax
je 0x4015d3
mov ebp, 0x4911a1
mov ebx, ebp
mov ebp, str.TRAINER_r_n1.0.7748.0_r_n_r_nNumpad_1:_More_Money_r_nNumpad_2:_Instant_Boulder_r_nNumpad_3:_Castle_Health_r_n
sub ebx, ebp
push ebx
mov ebp, str.TRAINER_r_n1.0.7748.0_r_n_r_nNumpad_1:_More_Money_r_nNumpad_2:_Instant_Boulder_r_nNumpad_3:_Castle_Health_r_n
push ebp
push 0xa
call fcn.0040fe30
push 0xa
call fcn.0040f9e0
jmp 0x4015e7
push str.Could_not_install_the_file___Installtion_failed
push str.Error
call fcn.0040b655
jmp 0x40753a
push dword [0x4a36e8]
mov edx, dword [0x4a2c90]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.help.txt
call fcn.00412b70
inc dword [0x4a36e8]
push 0
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040fc00
pop dword [0x4a36e8]
and eax, eax
je 0x401657
mov ebp, 0x491cb1
mov ebx, ebp
mov ebp, 0x4911a1
sub ebx, ebp
push ebx
mov ebp, 0x4911a1
push ebp
push 0
call fcn.0040fe30
push 0
call fcn.0040f9e0
jmp 0x401666
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040b655
push 0x4a3338
push 0x44d7a0
push 8
push 0x65
push 4
call fcn.004104a4
push dword [0x4a36e8]
mov edx, dword [0x4a2c90]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.Options
call fcn.00412b70
inc dword [0x4a36e8]
push 0xa
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040fcd0
pop dword [0x4a36e8]
mov edx, dword [0x4a36e8]
push edx
push edx
push 0xa
call fcn.0040fe90
mov edx, 0x44d094
call fcn.00412b70
push 0x4a2c94
call fcn.00412af0
mov edx, dword [0x4a36e8]
push edx
push edx
push 0xa
call fcn.0040fe90
push 0x4a2c98
call fcn.00412af0
mov edx, dword [0x4a36e8]
push edx
push edx
push 0xa
call fcn.0040fe90
mov ebx, dword [0x4a2c9c]
inc ebx
mov ebp, dword [0x4a3338]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00412af0
inc dword [0x4a2c9c]
push 0xa
call fcn.0040ffd0
mov ebx, eax
cmp ebx, 1
jne 0x401707
push 0xa
call fcn.0040f9e0
fild dword [0x4a2c9c]
fmul dword [0x44d790]
fstp dword [0x4a2ca0]
fld dword [0x4a2ca0]
fmul dword [0x44d794]
fstp dword [0x4a2ca4]
fld dword [0x4a2ca0]
fild dword [0x4a2c9c]
fdiv dword [0x44d798]
fdivp st(1)
fstp dword [0x4a2ca8]
fld dword [0x4a2ca4]
fild dword [0x4a2c9c]
fdiv dword [0x44d798]
fdivp st(1)
fstp dword [0x4a2cac]
fld dword [0x4a2ca0]
fcomp dword [0x44d79c]
fnstsw ax
test ah, 1
jne 0x4017cc
mov ebx, dword [0x4a2c9c]
cmp ebx, 0x15
jl 0x4017cc
jmp 0x4017d3
mov eax, 1
jmp 0x4017d5
xor eax, eax
and eax, eax
je 0x401811
mov dword [0x4a2ca0], 0x44480000
mov dword [0x4a2ca4], 0x44c80000
fld dword [0x4a2ca0]
fdiv dword [0x44d794]
fstp dword [0x4a2ca8]
fld dword [0x4a2ca4]
fdiv dword [0x44d794]
fstp dword [0x4a2cac]
push 0x120
fld dword [0x4a2ca4]
push eax
fistp dword [esp]
fld dword [0x4a2ca0]
push eax
fistp dword [esp]
push 1
call fcn.00410d3b
and eax, eax
je 0x4019ab
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 1
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
mov dword [0x4a2cb0], 1
mov eax, dword [0x4a2c9c]
cmp eax, dword [0x4a2cb0]
jl 0x4018c9
push 0xff
push 0
push 0
mov eax, 0
call fcn.0040bd10
push eax
mov ebx, dword [0x4a2cb0]
mov ebp, dword [0x4a3338]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2cb0]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe8
push ebx
push 2
call fcn.0041080a
inc dword [0x4a2cb0]
jno 0x401870
mov dword [0x4a2cb0], 1
mov eax, dword [0x4a2c9c]
cmp eax, dword [0x4a2cb0]
jl 0x40192c
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040bd10
push eax
mov ebx, dword [0x4a2cb0]
mov ebp, dword [0x4a3338]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2cb0]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe6
push ebx
push 0
call fcn.0041080a
inc dword [0x4a2cb0]
jno 0x4018d3
call fcn.004107a9
push 0
fld dword [0x4a2cac]
push eax
fistp dword [esp]
fld dword [0x4a2ca8]
push eax
fistp dword [esp]
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0x11
call fcn.004107fa
fld dword [0x4a2cac]
push eax
fistp dword [esp]
fld dword [0x4a2ca8]
push eax
fistp dword [esp]
push 0x43
push 7
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0x120
push 0x190
push 0x640
push 1
call fcn.00410d3b
and eax, eax
je 0x401ac2
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 2
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
push dword [0x4a36e8]
push 0xff
push 0x2e
push 0xa6
mov eax, 0xec
call fcn.0040bd10
push eax
mov edx, dword [0x4a2c94]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, dword [0x4a2c98]
call fcn.00412b70
inc dword [0x4a36e8]
push 0
push 0
mov edx, dword [0x4928b4]
add dword [esp + 8], edx
call fcn.0041080a
pop dword [0x4a36e8]
call fcn.004107a9
push 0
push 0x64
push 0x190
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0x11
call fcn.004107fa
push 0x64
push 0x190
push 0x28
push 5
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0x90000001
push 0x44d02a
push 0
call fcn.00410fd6
push eax
push 0
call fcn.00410ff4
push eax
push 0
push 0
push 0
call fcn.0040dec0
and eax, eax
je 0x401f6f
push str.CLOSEBUTTON
push 0x13
push 0x13
push 6
push 0x1e4
push 1
call fcn.0040c5b3
mov dword [0x4a2c74], eax
push str.READMEBUTTON
push 0x20
push 0x11e
push 0x17e
push 0xa
push 3
call fcn.0040c5b3
mov dword [0x4a2c74], eax
push str.TROUBLEBUTTON
push 0x20
push 0x11e
push 0x19c
push 0xa
push 4
call fcn.0040c5b3
mov dword [0x4a2c74], eax
push str.CHBUTTON
push 0x23
push 0xf5
push 1
push 0x23
push 5
call fcn.0040c5b3
mov dword [0x4a2c74], eax
push str.BOXARTBUTTON
push 0x118
push 0xc8
push 0x2d
push 0x132
push 6
call fcn.0040c5b3
mov dword [0x4a2c74], eax
push 0
call fcn.0040dee3
push eax
push 0x80000000
push str.Test
push 0x6b
push 0xc8
push 0
push 0xfffffc18
push 1
call fcn.0040dbba
push 0
call fcn.0040dee3
push eax
call fcn.00408862
push 0xff
push 0
call fcn.00410d1f
push eax
push 0
call fcn.0040dee3
push eax
call fcn.0040758c
push 0
push 0
call fcn.0040df91
mov edx, dword [0x4a36e8]
push edx
push edx
mov edx, str.http:__www.cheathappens.com_trnflash.asp_id
call fcn.00412b70
mov edx, dword [0x4a2c8c]
call fcn.00412b70
inc dword [0x4a36e8]
push 0xc8
push 0x12c
push 0
push 0
push 2
mov edx, dword [0x4928b4]
add dword [esp + 0x14], edx
call fcn.0040d6b3
pop dword [0x4a36e8]
mov dword [0x4a2c74], eax
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
mov ebx, eax
and ebx, ebx
jne 0x401cb2
push 1
push 1
call fcn.0040df91
mov dword [0x4a2cb0], 1
mov eax, 4
cmp eax, dword [0x4a2cb0]
jl 0x401f6f
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.00410d3b
and eax, eax
je 0x401e0e
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 1
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040bd10
push eax
push str.Wurmschnitzel
push 0
push 0
call fcn.0041080a
call fcn.004107a9
push 0
push 0x64
push 0xc8
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0
call fcn.004107fa
push 0xff
push 0xe8
push 0xe0
mov eax, 0xe0
call fcn.0040bd10
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.0041087f
push 0x21
call fcn.004107fa
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0xff
push 0
call fcn.00410d1f
push eax
push 0
call fcn.0040dee3
push eax
call fcn.0040758c
push 0x32
call fcn.0040bd29
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.00410d3b
and eax, eax
je 0x401f59
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 1
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
push 0xff
push 0
push 0
mov eax, 0
call fcn.0040bd10
push eax
push str.Wurmschnitzel
push 0
push 0
call fcn.0041080a
call fcn.004107a9
push 0
push 0x64
push 0xc8
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0
call fcn.004107fa
push 0xff
push 0xe8
push 0xe0
mov eax, 0xe0
call fcn.0040bd10
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.0041087f
push 0x21
call fcn.004107fa
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0xff
push 0
call fcn.00410d1f
push eax
push 0
call fcn.0040dee3
push eax
call fcn.0040758c
push 0x32
call fcn.0040bd29
inc dword [0x4a2cb0]
jno 0x401cbc
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x401f7f
push 0x75009553
inc ecx
ret
push 0x12c
call fcn.0040bd29
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00410d3b
and eax, eax
je 0x4020ca
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 1
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040bd10
push eax
push str.Authenticating_Trainer......
push 0
push 0
call fcn.0041080a
call fcn.004107a9
push 0
push 0x64
push 0x1f4
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0
call fcn.004107fa
push 0xff
push 0x70
push 0x59
mov eax, 0x57
call fcn.0040bd10
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0041087f
push 0x11
call fcn.004107fa
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0xff
push 0
call fcn.00410d1f
push eax
push 0
call fcn.0040dee3
push eax
call fcn.0040758c
mov edx, dword [0x4a36e8]
push edx
push edx
mov edx, dword [0x4a36e8]
push edx
push edx
call fcn.0040b81c
mov edx, dword [0x4928b4]
add dword [esp], edx
call fcn.0040f795
push 0x4a2cb4
call fcn.00412af0
mov edx, dword [0x4a2cb4]
push dword [0x4a36e8]
call fcn.00412b70
push 0x4a2cb8
call fcn.00412af0
call sub.USER32.DLL_GetForegroundWindow
mov dword [0x4a2cbc], eax
push 0x4a2cc0
push dword [0x4a2cbc]
call sub.USER32.DLL_GetWindowThreadProcessId
push dword [0x4a2cc0]
push dword [0x4a2cc8]
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x4a2cc4], eax
mov eax, dword [0x4a2cc0]
mov dword [0x4a2cbc], eax
push 0x3e8
call fcn.004120e0
mov dword [0x4a2ccc], eax
mov edx, dword [0x4a2cb8]
push dword [0x4a36e8]
call fcn.00412b70
push 0x4a2cd0
call fcn.00412af0
mov eax, dword [0x4a2cd8]
mov dword [0x4a2cd4], eax
mov ebp, 0x491cb1
mov dword [0x4a2cb0], ebp
mov eax, dword [0x4a2cb0]
call fcn.00412100
mov byte [0x4a300c], al
mov ebp, 0x491cb4
mov dword [0x4a2cb0], ebp
mov ebp, 0x491cb4
mov ebx, ebp
add ebx, 0xbb8
cmp ebx, dword [0x4a2cb0]
jl 0x402239
mov eax, dword [0x4a2cb0]
call fcn.00412100
mov byte [0x4a300d], al
movsx ebx, byte [0x4a300d]
xor bl, byte [0x4a300c]
mov eax, ebx
mov byte [0x4a300e], al
movsx ebx, byte [0x4a300c]
add ebx, 0x37
mov eax, ebx
mov byte [0x4a300c], al
movsx ebx, byte [0x4a300c]
cmp ebx, 0xff
jle 0x402216
movsx ebx, byte [0x4a300c]
add ebx, 0xffffff01
mov eax, ebx
mov byte [0x4a300c], al
movsx eax, byte [0x4a300e]
push eax
mov eax, dword [0x4a2cb0]
call fcn.00412110
mov dword [0x4a2c74], eax
inc dword [0x4a2cb0]
jno 0x4021aa
call sub.KERNEL32.dll_GetTickCount
mov dword [0x4a2cdc], eax
mov edx, dword [0x4a36e8]
push edx
push edx
call fcn.0040b81c
push 0x4a2ce0
call fcn.00412af0
mov edx, dword [0x4a36e8]
push edx
push edx
push dword [0x4a2ce0]
call fcn.0040f795
push 0x4a2ce0
call fcn.00412af0
mov edx, 0x44d02a
lea ecx, [0x4a2ce4]
call fcn.00409008
mov edx, 0x44d02a
lea ecx, [0x4a2ce8]
call fcn.00409008
mov edx, 0x44d02a
lea ecx, [0x4a2cec]
call fcn.00409008
mov dword [0x4a2cf0], 0
mov dword [0x4a2cf4], 0
mov edx, dword [0x4a36e8]
push edx
push edx
push dword [0x4a36e8]
call fcn.0040b81c
inc dword [0x4a36e8]
push 0
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040fd80
pop dword [0x4a36e8]
push 0
call fcn.00410070
mov dword [0x4a2cf8], eax
mov dword [0x4a2cb0], 1
mov ebx, dword [0x4a2cf8]
add ebx, 0xfffffff8
cmp ebx, dword [0x4a2cb0]
jl 0x402344
push 0
call fcn.004100d0
mov byte [0x4a300f], al
mov ebx, dword [0x4a2cf4]
movzx eax, byte [0x4a300f]
add ebx, eax
mov dword [0x4a2cf4], ebx
inc dword [0x4a2cb0]
jno 0x402307
push 0
call fcn.00410130
mov dword [0x4a2cfc], eax
push 0
call fcn.00410130
mov dword [0x4a2d00], eax
push 0
call fcn.0040f9e0
mov eax, dword [0x4a2cf4]
mov dword [0x4a2d04], eax
push dword [0x4a2ce0]
push 0
call fcn.0040fd80
mov ebx, eax
and ebx, ebx
jle 0x402704
mov dword [0x4a2cb0], 1
mov eax, 0x3b8
cmp eax, dword [0x4a2cb0]
jl 0x4023be
push 0
call fcn.00410190
mov dword [0x4a2d08], eax
inc dword [0x4a2cb0]
jno 0x40239a
mov dword [0x4a2cb0], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x4a2cb0]
jl 0x40245c
push 0
call fcn.00410190
mov dword [0x4a2d08], eax
mov edx, dword [0x4a36e8]
push edx
push edx
push dword [0x4a36e8]
push 1
mov eax, dword [0x4a2d08]
cdq
push edx
push eax
call fcn.00409130
mov edx, dword [0x4928b4]
add dword [esp], edx
call fcn.004091e0
pop dword [0x4a36e8]
mov dword [0x4a2d08], eax
mov edx, dword [0x4a2ce4]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, dword [0x4a36e8]
push edx
push edx
push dword [0x4a2d08]
call fcn.00409330
pop eax
push 0x4a2ce4
call fcn.00412af0
inc dword [0x4a2cb0]
jno 0x4023c8
push dword [0x4a2ce4]
call fcn.0040876d
mov dword [0x4a2d08], eax
mov ebx, dword [0x4a2d08]
xor ebx, 0x98989898
mov dword [0x4a2d08], ebx
mov eax, dword [0x4a2d08]
mov dword [0x4a2d0c], eax
mov edx, dword [0x4a36e8]
push edx
push edx
push 0xa
push dword [0x4a36e8]
mov edx, str.0000000000
call fcn.00412b70
mov edx, dword [0x4a36e8]
push edx
push edx
mov eax, dword [0x4a2d08]
cdq
push edx
push eax
call fcn.004094c0
pop eax
mov edx, dword [0x4928b4]
add dword [esp], edx
call fcn.00409550
push 0x4a2ce4
call fcn.00412af0
mov dword [0x4a2cb0], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x4a2cb0]
jl 0x402571
push 0
call fcn.00410190
mov dword [0x4a2d08], eax
mov edx, dword [0x4a36e8]
push edx
push edx
push dword [0x4a36e8]
push 1
mov eax, dword [0x4a2d08]
cdq
push edx
push eax
call fcn.00409130
mov edx, dword [0x4928b4]
add dword [esp], edx
call fcn.004091e0
pop dword [0x4a36e8]
mov dword [0x4a2d08], eax
mov edx, dword [0x4a2ce8]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, dword [0x4a36e8]
push edx
push edx
push dword [0x4a2d08]
call fcn.00409330
pop eax
push 0x4a2ce8
call fcn.00412af0
inc dword [0x4a2cb0]
jno 0x4024dd
push dword [0x4a2ce8]
call fcn.0040876d
mov dword [0x4a2d10], eax
mov dword [0x4a2cb0], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x4a2cb0]
jl 0x40261f
push 0
call fcn.00410190
mov dword [0x4a2d08], eax
mov edx, dword [0x4a36e8]
push edx
push edx
push dword [0x4a36e8]
push 1
mov eax, dword [0x4a2d08]
cdq
push edx
push eax
call fcn.00409130
mov edx, dword [0x4928b4]
add dword [esp], edx
call fcn.004091e0
pop dword [0x4a36e8]
mov dword [0x4a2d08], eax
mov edx, dword [0x4a2cec]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, dword [0x4a36e8]
push edx
push edx
push dword [0x4a2d08]
call fcn.00409330
pop eax
push 0x4a2cec
call fcn.00412af0
inc dword [0x4a2cb0]
jno 0x40258b
push dword [0x4a2cec]
call fcn.0040876d
mov dword [0x4a2d08], eax
mov eax, dword [0x4a2d08]
mov dword [0x4a2d14], eax
mov dword [0x4a2cb0], 0x3d1
mov eax, dword [0x4a2d14]
cmp eax, dword [0x4a2cb0]
jl 0x402667
push 0
call fcn.00410190
mov dword [0x4a2d08], eax
inc dword [0x4a2cb0]
jno 0x402643
mov eax, dword [0x4a2d14]
mov dword [0x4a2cb0], eax
mov ebx, dword [0x4a2d14]
add ebx, 0x12
cmp ebx, dword [0x4a2cb0]
jl 0x4026ab
push 0
call fcn.00410190
mov dword [0x4a2d08], eax
mov ebx, dword [0x4a2cf0]
add ebx, dword [0x4a2d08]
mov dword [0x4a2cf0], ebx
inc dword [0x4a2cb0]
jno 0x402671
mov ebx, dword [0x4a2d10]
xor ebx, dword [0x4a2cf0]
mov dword [0x4a2d18], ebx
mov ebx, dword [0x4a2d18]
and ebx, ebx
jne 0x4026d1
mov dword [0x4a2d18], 0x63
mov ebx, dword [0x4a2d18]
xor ebx, 0x98989898
mov dword [0x4a2d18], ebx
mov eax, dword [0x4a2d0c]
mov dword [0x4a2d1c], eax
mov ebx, dword [0x4a2d0c]
cmp ebx, dword [0x4a2d18]
jne 0x4026fd
jmp 0x402702
call fcn.00406333
jmp 0x402709
call fcn.00406333
mov ebx, dword [0x4a2d00]
cmp ebx, dword [0x4a2cf8]
jne 0x402719
jmp 0x40271e
call fcn.00406333
call sub.KERNEL32.dll_GetTickCount
mov dword [0x4a2d20], eax
mov ebx, dword [0x4a2d20]
sub ebx, dword [0x4a2cdc]
cmp ebx, 0x3e8
jle 0x402743
push 0x9099542
inc eax
ret
mov dword [0x4a2d24], 0x45a2a5
push 0x4a3340
push 0
push 0x15
push 0x15
push 4
call fcn.004104a4
push 0x4a3348
push 0
push 0x15
push 0x15
push 4
call fcn.004104a4
push 0x4a3350
push 0
push 0x15
push 0x15
push 4
call fcn.004104a4
push 0x4a3358
push 0
push 0x15
push 0x15
push 4
call fcn.004104a4
push 0x4a3360
push 0
push 0x15
push 0x15
push 4
call fcn.004104a4
push 0x3e8
call fcn.004120e0
mov dword [0x4a2ccc], eax
push 0x3e8
call fcn.004120e0
mov dword [0x4a2d28], eax
mov dword [0x4a2cb0], 1
mov eax, 0x14
cmp eax, dword [0x4a2cb0]
jl 0x402865
mov ebx, dword [0x4a2cb0]
mov ebp, dword [0x4a3348]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x4a2cb0]
mov ebp, dword [0x4a3350]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x4a2cb0]
mov ebp, dword [0x4a3358]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x4a2cb0]
jno 0x40280b
mov edx, str.Template
lea ecx, [0x4a2d44]
call fcn.00409008
mov edx, dword [0x4a36e8]
push edx
push edx
call fcn.0040f734
push 0x4a2d2c
call fcn.00412af0
call fcn.004064a7
call fcn.00407027
call fcn.004064a7
call fcn.004063cc
call fcn.00406dee
call fcn.004063cc
call fcn.00405c0c
push dword [0x4a36e8]
mov edx, dword [0x4a2d2c]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.CH.dll
call fcn.00412b70
inc dword [0x4a36e8]
push 0
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040fc00
pop dword [0x4a36e8]
and eax, eax
je 0x40291f
mov ebp, 0x4928b4
mov ebx, ebp
mov ebp, 0x491cb4
sub ebx, ebp
push ebx
mov ebp, 0x491cb4
push ebp
push 0
call fcn.0040fe30
push 0
call fcn.0040f9e0
jmp 0x40291f
push dword [0x4a36e8]
mov edx, dword [0x4a2d2c]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, str.help.txt
call fcn.00412b70
inc dword [0x4a36e8]
push 0
mov edx, dword [0x4928b4]
add dword [esp + 4], edx
call fcn.0040fc00
pop dword [0x4a36e8]
and eax, eax
je 0x40298f
mov ebp, 0x491cb1
mov ebx, ebp
mov ebp, 0x4911a1
sub ebx, ebp
push ebx
mov ebp, 0x4911a1
push ebp
push 0
call fcn.0040fe30
push 0
call fcn.0040f9e0
jmp 0x40299e
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040b655
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040fd80
mov dword [0x4a2c74], eax
mov ebx, dword [0x4a2c74]
and ebx, ebx
jle 0x4029d0
mov dword [0x4a2d5c], 1
push 0
call fcn.0040f9e0
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
and eax, eax
je 0x4029e5
jmp 0x402a14
push dword [0x4a2d1c]
call fcn.004078d9
mov ebx, eax
and ebx, ebx
jne 0x402a14
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040b626
jmp 0x40753a
mov edx, dword [0x4a36e8]
push edx
push edx
call fcn.0040f734
mov edx, str.black.txt
call fcn.00412b70
push 0x4a2d60
call fcn.00412af0
mov ebx, dword [0x4a2d64]
and ebx, ebx
jle 0x402af8
push dword [0x4a36e8]
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.00412b70
mov edx, dword [0x4a36e8]
push edx
push edx
mov eax, dword [0x4a2d1c]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.004094c0
pop eax
mov edx, str..zip
call fcn.00412b70
push 0x4a2d68
call fcn.00412af0
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x4a2d6c]
call fcn.00409008
mov edx, dword [0x4a2d68]
push dword [0x4a36e8]
call fcn.00412b70
push 0x4a2d70
call fcn.00412af0
mov edx, dword [0x4a2d6c]
push dword [0x4a36e8]
call fcn.00412b70
push 0x4a2d74
call fcn.00412af0
push 0
push 0
mov eax, dword [0x4a2d60]
push eax
mov eax, dword [0x4a2d74]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x4a2d78], eax
push dword [0x4a36e8]
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.00412b70
mov edx, dword [0x4a36e8]
push edx
push edx
mov eax, dword [0x4a2d1c]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.004094c0
pop eax
mov edx, str..zip
call fcn.00412b70
push 0x4a2d68
call fcn.00412af0
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x4a2d6c]
call fcn.00409008
mov edx, dword [0x4a2d68]
push dword [0x4a36e8]
call fcn.00412b70
push 0x4a2d70
call fcn.00412af0
mov edx, dword [0x4a2d6c]
push dword [0x4a36e8]
call fcn.00412b70
push 0x4a2d74
call fcn.00412af0
push 0
push 0
mov eax, dword [0x4a2d60]
push eax
mov eax, dword [0x4a2d74]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x4a2d78], eax
mov ebx, dword [0x4a2d78]
and ebx, ebx
jne 0x402bb9
jmp 0x402be8
push dword [0x4a2d1c]
call fcn.004078d9
mov ebx, eax
and ebx, ebx
jne 0x402be8
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040b626
jmp 0x40753a
push 0
push 0
mov eax, dword [0x4a2d60]
push eax
mov eax, dword [0x4a2d70]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x4a2d7c], eax
mov edx, dword [0x4a36e8]
push edx
push edx
push 0x44d0a7
push str.IZnvZalZidZ_ZTraiZnerZ_UsZerZ
call fcn.004097a0
push 0x4a2d80
call fcn.00412af0
mov ebx, dword [0x4a2d7c]
and ebx, ebx
jne 0x402c3d
call fcn.00406333
mov edx, dword [0x4a36e8]
push edx
push edx
push str.ZTA.l
push dword [0x4a2d80]
call fcn.004097a0
push 0x4a2d80
call fcn.00412af0
mov ebx, dword [0x4a2d7c]
and ebx, ebx
jne 0x402db9
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00410d3b
and eax, eax
je 0x402daf
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 1
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040bd10
push eax
push dword [0x4a2d80]
push 0
push 0
call fcn.0041080a
call fcn.004107a9
push 0
push 0x64
push 0x1f4
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0
call fcn.004107fa
push 0xff
push 0x28
push 0x28
mov eax, 0xff
call fcn.0040bd10
push eax
push 0x24
push 0x1df
push 1
push 0
call fcn.0041087f
push 0x11
call fcn.004107fa
push 0x64
push 0x1f4
push 0xa
push 0xc8
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0xff
push 0
call fcn.00410d1f
push eax
push 0
call fcn.0040dee3
push eax
call fcn.0040758c
call fcn.00405c0c
jmp 0x402c5f
mov ebx, dword [0x4a2d78]
and ebx, ebx
je 0x402ddb
push dword [0x4a2d1c]
call fcn.004078d9
mov ebx, eax
and ebx, ebx
jne 0x402ddb
mov eax, 1
jmp 0x402ddd
xor eax, eax
and eax, eax
je 0x402deb
mov dword [0x4a2d24], 0
mov dword [0x4a2d84], 3
lea ebp, [0x4a3014]
lea eax, [ebp]
push eax
call sub.USER32.DLL_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x4a2d88]
mov ebx, dword [0x4a2d88]
cmp ebx, 1
jne 0x402e2f
mov edx, str.Run_game_and_press_F1_at_main_menu.__Numlock_is_ON.
lea ecx, [0x4a2d8c]
call fcn.00409008
jmp 0x402e3f
mov edx, 0x44d21a
lea ecx, [0x4a2d8c]
call fcn.00409008
mov ebx, dword [0x4a2d84]
cmp ebx, dword [0x4a2d88]
je 0x402f9d
mov eax, dword [0x4a2d88]
mov dword [0x4a2d84], eax
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00410d3b
and eax, eax
je 0x402f9d
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 1
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040bd10
push eax
push dword [0x4a2d8c]
push 0
push 0
call fcn.0041080a
call fcn.004107a9
push 0
push 0x64
push 0x1f4
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0
call fcn.004107fa
push 0xff
push 0x70
push 0x59
mov eax, 0x57
call fcn.0040bd10
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0041087f
push 0x11
call fcn.004107fa
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0xff
push 0
call fcn.00410d1f
push eax
push 0
call fcn.0040dee3
push eax
call fcn.0040758c
call fcn.00405c0c
push 0xa
call fcn.0040bd29
push 0x70
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
and ebx, ebx
je 0x402df5
mov edx, str.RoA.exe
lea ecx, [0x4a2cb8]
call fcn.00409008
call fcn.00404fb8
mov ebx, dword [0x4a2cbc]
and ebx, ebx
jne 0x403154
push 4
call fcn.0040ad54
push 0x12c
call fcn.0040bd29
push 0x12c
call fcn.0040bd29
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00410d3b
and eax, eax
je 0x403145
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 1
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040bd10
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.0041080a
call fcn.004107a9
push 0
push 0x64
push 0x1f4
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0
call fcn.004107fa
push 0xff
push 0x70
push 0x59
mov eax, 0x57
call fcn.0040bd10
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0041087f
push 0x11
call fcn.004107fa
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0xff
push 0
call fcn.00410d1f
push eax
push 0
call fcn.0040dee3
push eax
call fcn.0040758c
push 0x7d0
call fcn.0040bd29
jmp 0x402db9
mov edx, str.CH.dll
lea ecx, [0x4a2d90]
call fcn.00409008
mov edx, dword [0x4a2d2c]
push dword [0x4a36e8]
call fcn.00412b70
mov edx, dword [0x4a2d90]
call fcn.00412b70
push 0x4a2cd0
call fcn.00412af0
call fcn.00404ffd
mov edx, str.xlive.dll
lea ecx, [0x4a2d94]
call fcn.00409008
call fcn.00404fb8
call fcn.00405b08
call fcn.00405c0c
mov ebx, dword [0x4a2d50]
and ebx, ebx
jne 0x403310
mov ebx, dword [0x4a2d98]
and ebx, ebx
jne 0x403310
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00410d3b
and eax, eax
je 0x40330b
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 1
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040bd10
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.0041080a
call fcn.004107a9
push 0
push 0x64
push 0x1f4
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0
call fcn.004107fa
push 0xff
push 0x70
push 0x59
mov eax, 0x57
call fcn.0040bd10
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0041087f
push 0x11
call fcn.004107fa
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0xff
push 0
call fcn.00410d1f
push eax
push 0
call fcn.0040dee3
push eax
call fcn.0040758c
jmp 0x402db9
mov ebx, dword [0x4a2cfc]
cmp ebx, dword [0x4a2d04]
jne 0x403334
mov ebx, dword [0x4a2cfc]
and ebx, ebx
je 0x403334
mov ebx, dword [0x4a2d04]
and ebx, ebx
je 0x403334
jmp 0x40333b
mov eax, 1
jmp 0x40333d
xor eax, eax
and eax, eax
je 0x403394
push 0xa
call fcn.0040bdb3
mov ebx, eax
add ebx, 0xa
mov dword [0x4a2d9c], ebx
push 0x28
call fcn.0040bdb3
mov ebx, eax
add ebx, 0x28
mov dword [0x4a2da0], ebx
mov ebx, dword [0x4a2d50]
add ebx, dword [0x4a2d9c]
mov dword [0x4a2d50], ebx
mov ebx, dword [0x4a2d98]
add ebx, dword [0x4a2da0]
mov dword [0x4a2d98], ebx
call fcn.00406333
push 3
call fcn.0040ad54
push 0x12c
call fcn.0040bd29
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.00410d3b
and eax, eax
je 0x4034e9
push 1
call fcn.00410be9
push eax
call fcn.0041071d
push 1
call fcn.0040f718
push eax
call fcn.004107ea
push 0x11
call fcn.004107fa
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040bd10
push eax
push str.Game_found__Trainer_Activated_
push 0
push 0
call fcn.0041080a
call fcn.004107a9
push 0
push 0x64
push 0x1f4
push 1
call fcn.00410e51
push 0
call fcn.00410be9
push eax
call fcn.0041071d
push 0
call fcn.004107fa
push 0xff
push 0x70
push 0x59
mov eax, 0x57
call fcn.0040bd10
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.0041087f
push 0x11
call fcn.004107fa
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00410d1f
push eax
call fcn.00410854
call fcn.004107a9
push 1
call fcn.004108b4
push 0xff
push 0
call fcn.00410d1f
push eax
push 0
call fcn.0040dee3
push eax
call fcn.0040758c
mov ebx, dword [0x4a2da4]
and ebx, ebx
je 0x4037f7
push 0x8b
mov ebx, dword [0x4a2ccc]
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xff
mov ebx, dword [0x4a2ccc]
inc ebx
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x55
mov ebx, dword [0x4a2ccc]
add ebx, 2
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x8b
mov ebx, dword [0x4a2ccc]
add ebx, 3
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xec
mov ebx, dword [0x4a2ccc]
add ebx, 4
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x83
mov ebx, dword [0x4a2ccc]
add ebx, 5
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xec
mov ebx, dword [0x4a2ccc]
add ebx, 6
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x20
mov ebx, dword [0x4a2ccc]
add ebx, 7
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x53
mov ebx, dword [0x4a2ccc]
add ebx, 8
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x56
mov ebx, dword [0x4a2ccc]
add ebx, 9
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x57
mov ebx, dword [0x4a2ccc]
add ebx, 0xa
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x8d
mov ebx, dword [0x4a2ccc]
add ebx, 0xb
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x45
mov ebx, dword [0x4a2ccc]
add ebx, 0xc
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xe0
mov ebx, dword [0x4a2ccc]
add ebx, 0xd
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x33
mov ebx, dword [0x4a2ccc]
add ebx, 0xe
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xf6
mov ebx, dword [0x4a2ccc]
add ebx, 0xf
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x50
mov ebx, dword [0x4a2ccc]
add ebx, 0x10
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xff
mov ebx, dword [0x4a2ccc]
add ebx, 0x11
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x75
mov ebx, dword [0x4a2ccc]
add ebx, 0x12
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xc
mov ebx, dword [0x4a2ccc]
add ebx, 0x13
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
mov ebx, dword [0x4a2da4]
add ebx, 0x1000
mov dword [0x4a2cb0], ebx
mov ebx, dword [0x4a2da4]
add ebx, 0x200000
cmp ebx, dword [0x4a2cb0]
jl 0x4037f7
push dword [0x4a2cc8]
push 0x14
push dword [0x4a2d28]
push dword [0x4a2cb0]
push dword [0x4a2da8]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a2c74], eax
push 0x14
push dword [0x4a2d28]
push dword [0x4a2ccc]
call fcn.00412120
mov dword [0x4a2c74], eax
mov ebx, dword [0x4a2c74]
cmp ebx, 1
jne 0x4037eb
mov eax, dword [0x4a2cb0]
mov dword [0x4a2dac], eax
push 0xc2
mov ebx, dword [0x4a2ccc]
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xc
mov ebx, dword [0x4a2ccc]
inc ebx
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0
mov ebx, dword [0x4a2ccc]
add ebx, 2
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push dword [0x4a2cc8]
push 3
push dword [0x4a2ccc]
push dword [0x4a2dac]
push dword [0x4a2da8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a2c74], eax
inc dword [0x4a2cb0]
jno 0x40370c
mov ebx, dword [0x4a2d64]
and ebx, ebx
jle 0x403806
jmp 0x40409e
mov ebx, dword [0x4a2d24]
cmp ebx, 0x45a2a5
jne 0x4038aa
mov ebp, dword [0x4a3340]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0x64
mov dword [ebp + 0x14], 0
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x50], 0
push str.CH_Trainer_Keys.dat
push 0
call fcn.0040fd80
mov dword [0x4a2c74], eax
mov ebx, dword [0x4a2c74]
and ebx, ebx
jle 0x403a18
mov dword [0x4a2d5c], 1
push 0
call fcn.00410190
mov dword [0x4a2db0], eax
mov dword [0x4a2cb0], 1
mov eax, dword [0x4a2db0]
cmp eax, dword [0x4a2cb0]
jl 0x403a0e
mov edx, dword [0x4a36e8]
push edx
push edx
push 0
call fcn.0040fe90
push 0x4a2db4
call fcn.00412af0
push dword [0x4a2db4]
mov edx, 0x44d1dc
pop ecx
call fcn.00412bd0
je 0x403946
mov ebx, dword [0x4a2cb0]
mov ebp, dword [0x4a3348]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x4a2db4]
mov edx, str.CTRL
pop ecx
call fcn.00412bd0
je 0x403970
mov ebx, dword [0x4a2cb0]
mov ebp, dword [0x4a3350]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x4a2db4]
mov edx, 0x44d32c
pop ecx
call fcn.00412bd0
je 0x40399a
mov ebx, dword [0x4a2cb0]
mov ebp, dword [0x4a3358]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.00410190
push eax
mov ebx, dword [0x4a2cb0]
mov ebp, dword [0x4a3340]
shl ebx, 2
pop dword [ebp + ebx]
mov edx, dword [0x4a36e8]
push edx
push edx
push dword [0x4a36e8]
push 1
mov ebx, dword [0x4a2cb0]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.00409130
mov edx, dword [0x4928b4]
add dword [esp], edx
call fcn.004091e0
pop dword [0x4a36e8]
push eax
mov ebx, dword [0x4a2cb0]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x4a2cb0]
jno 0x4038ef
push 0
call fcn.0040f9e0
mov ebx, dword [0x4a2d50]
add ebx, 0x1d0440
mov dword [0x4a2db8], ebx
mov ebx, dword [0x4a2d50]
add ebx, 0x17a4a6
mov dword [0x4a2dbc], ebx
mov ebx, dword [0x4a2d50]
add ebx, 0x1600ea
mov dword [0x4a2dc0], ebx
push 0x66
mov ebx, dword [0x4a2ccc]
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x3e
mov ebx, dword [0x4a2ccc]
inc ebx
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x81
mov ebx, dword [0x4a2ccc]
add ebx, 2
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xbc
mov ebx, dword [0x4a2ccc]
add ebx, 3
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x24
mov ebx, dword [0x4a2ccc]
add ebx, 4
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xd4
mov ebx, dword [0x4a2ccc]
add ebx, 5
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0
mov ebx, dword [0x4a2ccc]
add ebx, 6
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0
mov ebx, dword [0x4a2ccc]
add ebx, 7
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0
mov ebx, dword [0x4a2ccc]
add ebx, 8
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xa6
mov ebx, dword [0x4a2ccc]
add ebx, 9
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xa4
mov ebx, dword [0x4a2ccc]
add ebx, 0xa
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x75
mov ebx, dword [0x4a2ccc]
add ebx, 0xb
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 6
mov ebx, dword [0x4a2ccc]
add ebx, 0xc
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x89
mov ebx, dword [0x4a2ccc]
add ebx, 0xd
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x15
mov ebx, dword [0x4a2ccc]
add ebx, 0xe
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0
mov ebx, dword [0x4a2ccc]
add ebx, 0xf
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x3f
mov ebx, dword [0x4a2ccc]
add ebx, 0x10
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xcf
mov ebx, dword [0x4a2ccc]
add ebx, 0x11
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xc
mov ebx, dword [0x4a2ccc]
add ebx, 0x12
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x66
mov ebx, dword [0x4a2ccc]
add ebx, 0x13
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x3e
mov ebx, dword [0x4a2ccc]
add ebx, 0x14
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x81
mov ebx, dword [0x4a2ccc]
add ebx, 0x15
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xbc
mov ebx, dword [0x4a2ccc]
add ebx, 0x16
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x24
mov ebx, dword [0x4a2ccc]
add ebx, 0x17
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xd8
mov ebx, dword [0x4a2ccc]
add ebx, 0x18
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0
mov ebx, dword [0x4a2ccc]
add ebx, 0x19
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0
mov ebx, dword [0x4a2ccc]
add ebx, 0x1a
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0
mov ebx, dword [0x4a2ccc]
add ebx, 0x1b
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xea
mov ebx, dword [0x4a2ccc]
add ebx, 0x1c
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0
mov ebx, dword [0x4a2ccc]
add ebx, 0x1d
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x75
mov ebx, dword [0x4a2ccc]
add ebx, 0x1e
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 6
mov ebx, dword [0x4a2ccc]
add ebx, 0x1f
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x89
mov ebx, dword [0x4a2ccc]
add ebx, 0x20
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x15
mov ebx, dword [0x4a2ccc]
add ebx, 0x21
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 4
mov ebx, dword [0x4a2ccc]
add ebx, 0x22
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x3f
mov ebx, dword [0x4a2ccc]
add ebx, 0x23
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xcf
mov ebx, dword [0x4a2ccc]
add ebx, 0x24
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xc
mov ebx, dword [0x4a2ccc]
add ebx, 0x25
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x8b
mov ebx, dword [0x4a2ccc]
add ebx, 0x26
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x41
mov ebx, dword [0x4a2ccc]
add ebx, 0x27
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x40
mov ebx, dword [0x4a2ccc]
add ebx, 0x28
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x83
mov ebx, dword [0x4a2ccc]
add ebx, 0x29
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xf8
mov ebx, dword [0x4a2ccc]
add ebx, 0x2a
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 1
mov ebx, dword [0x4a2ccc]
add ebx, 0x2b
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0xc3
mov ebx, dword [0x4a2ccc]
add ebx, 0x2c
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x90
mov ebx, dword [0x4a2ccc]
add ebx, 0x2d
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push dword [0x4a2cc8]
push 0x2ac
push dword [0x4a2ccc]
mov ebx, dword [0x4a2d98]
add ebx, 0x1091
push ebx
push dword [0x4a2da8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a2c74], eax
mov ebx, dword [0x4a2d98]
add ebx, 0x3f00
push ebx
mov eax, dword [0x4a2ccc]
call fcn.004121a0
mov dword [0x4a2c74], eax
push dword [0x4a2cc8]
push 4
push dword [0x4a2ccc]
mov ebx, dword [0x4a2d98]
add ebx, 0x10a0
push ebx
push dword [0x4a2da8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a2c74], eax
mov ebx, dword [0x4a2d98]
add ebx, 0x3f04
push ebx
mov eax, dword [0x4a2ccc]
call fcn.004121a0
mov dword [0x4a2c74], eax
push dword [0x4a2cc8]
push 4
push dword [0x4a2ccc]
mov ebx, dword [0x4a2d98]
add ebx, 0x10b3
push ebx
push dword [0x4a2da8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a2c74], eax
push 0xe8
mov ebx, dword [0x4a2ccc]
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x90
mov ebx, dword [0x4a2ccc]
inc ebx
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x90
mov ebx, dword [0x4a2ccc]
add ebx, 2
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x90
mov ebx, dword [0x4a2ccc]
add ebx, 3
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x90
mov ebx, dword [0x4a2ccc]
add ebx, 4
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
push 0x90
mov ebx, dword [0x4a2ccc]
add ebx, 5
mov eax, ebx
call fcn.00412110
mov dword [0x4a2c74], eax
mov ebx, dword [0x4a2d98]
add ebx, 0x1091
sub ebx, dword [0x4a2db8]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x4a2ccc]
inc ebx
mov eax, ebx
call fcn.004121a0
mov dword [0x4a2c74], eax
push dword [0x4a2cc8]
push 6
push dword [0x4a2ccc]
push dword [0x4a2db8]
push dword [0x4a2da8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a2c74], eax
mov dword [0x4a2dc4], 0
mov eax, 0xff
cmp eax, dword [0x4a2dc4]
jl 0x4040c8
push dword [0x4a2dc4]
call sub.USER32.DLL_GetAsyncKeyState
inc dword [0x4a2dc4]
jno 0x4040a8
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x4040d7
push 0x55009553
ret
mov ebp, dword [0x4a3340]
push dword [ebp + 4]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 4]
mov ebp, dword [0x4a3340]
push dword [ebp + 8]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 8]
mov ebp, dword [0x4a3340]
push dword [ebp + 0xc]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0xc]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x10]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x10]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x14]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x14]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x18]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x18]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x1c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x1c]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x20]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x20]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x24]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x24]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x28]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x28]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x2c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x2c]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x30]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x30]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x34]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x34]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x38]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x38]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x3c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x3c]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x40]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x40]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x44]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x44]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x48]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x48]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x4c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x4c]
mov ebp, dword [0x4a3340]
push dword [ebp + 0x50]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x4a3360]
pop dword [ebp + 0x50]
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x4a2dc8], ebx
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x4a2dcc], ebx
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x4a2dd0], ebx
push 1
call fcn.0040bd29
push 0x32
call fcn.0040bdb3
mov dword [0x4a2dd4], eax
mov ebx, dword [0x4a2dd4]
cmp ebx, 0x19
jne 0x40441f
mov ebx, dword [0x4a2cfc]
cmp ebx, dword [0x4a2d04]
jne 0x4043a6
mov ebx, dword [0x4a2cfc]
and ebx, ebx
je 0x4043a6
mov ebx, dword [0x4a2d04]
and ebx, ebx
je 0x4043a6
jmp 0x4043ad
mov eax, 1
jmp 0x4043af
xor eax, eax
and eax, eax
je 0x40441f
push 0xff
call fcn.0040bdb3
mov dword [0x4a2d9c], eax
push 0x190
call fcn.0040bdb3
mov dword [0x4a2da0], eax
push dword [0x4a2d9c]
mov eax, dword [0x4a2ccc]
call fcn.00412110
mov dword [0x4a2c74], eax
push dword [0x4a2cc8]
push 1
push dword [0x4a2ccc]
mov ebx, dword [0x4a2d98]
add ebx, dword [0x4a2da0]
add ebx, 0x1091
push ebx
push dword [0x4a2da8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a2c74], eax
call fcn.00406333
push dword [0x4a2cc8]
push 4
push dword [0x4a2ccc]
mov ebx, dword [0x4a2d98]
add ebx, 0x3f00
push ebx
push dword [0x4a2da8]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a2c74], eax
mov eax, dword [0x4a2ccc]
call fcn.004121b0
mov dword [0x4a2dd8], eax
mov eax, dword [0x4a2dd8]
mov dword [0x4a2ddc], eax
mov ebx, dword [0x4a2dd8]
add ebx, 0x10
mov dword [0x4a2de0], ebx
push dword [0x4a2cc8]
push 4
push dword [0x4a2ccc]
mov ebx, dword [0x4a2d98]
add ebx, 0x3f04
push ebx
push dword [0x4a2da8]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a2c74], eax
mov eax, dword [0x4a2ccc]
call fcn.004121b0
mov dword [0x4a2dd8], eax
mov eax, dword [0x4a2dd8]
mov dword [0x4a2de4], eax
mov dword [0x4a2de8], 1
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2dec], eax
mov ebx, dword [0x4a2dec]
and ebx, ebx
je 0x4045ba
push dword [0x4a2cc8]
push 4
push dword [0x4a2ccc]
push dword [0x4a2ddc]
push dword [0x4a2da8]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x4a2c74], eax
mov eax, dword [0x4a2ccc]
call fcn.004121b0
mov dword [0x4a2df0], eax
add dword [0x4a2df0], 0x3e8
push dword [0x4a2df0]
mov eax, dword [0x4a2ccc]
call fcn.004121a0
mov dword [0x4a2c74], eax
push dword [0x4a2cc8]
push 4
push dword [0x4a2ccc]
push dword [0x4a2ddc]
push dword [0x4a2da8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a2c74], eax
push 0
call fcn.0040ad54
push 0x12c
call fcn.0040bd29
mov dword [0x4a2de8], 2
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2df4], eax
mov ebx, dword [0x4a2df4]
and ebx, ebx
je 0x404673
push 0
mov eax, dword [0x4a2ccc]
call fcn.004121c0
mov dword [0x4a2c74], eax
push dword [0x4a2cc8]
push 4
push dword [0x4a2ccc]
push dword [0x4a2de0]
push dword [0x4a2da8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a2c74], eax
push 0
call fcn.0040ad54
push 0x12c
call fcn.0040bd29
mov dword [0x4a2de8], 3
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2df8], eax
mov ebx, dword [0x4a2df8]
and ebx, ebx
je 0x40472c
push 0x98967f
mov eax, dword [0x4a2ccc]
call fcn.004121a0
mov dword [0x4a2c74], eax
push dword [0x4a2cc8]
push 4
push dword [0x4a2ccc]
push dword [0x4a2de4]
push dword [0x4a2da8]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x4a2c74], eax
push 0
call fcn.0040ad54
push 0x12c
call fcn.0040bd29
mov dword [0x4a2de8], 4
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2dfc], eax
mov ebx, dword [0x4a2dfc]
and ebx, ebx
je 0x404796
mov dword [0x4a2de8], 5
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e00], eax
mov ebx, dword [0x4a2e00]
and ebx, ebx
je 0x404800
mov dword [0x4a2de8], 6
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e04], eax
mov ebx, dword [0x4a2e04]
and ebx, ebx
je 0x40486a
mov dword [0x4a2de8], 7
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e08], eax
mov ebx, dword [0x4a2e08]
and ebx, ebx
je 0x4048d4
mov dword [0x4a2de8], 8
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e0c], eax
mov ebx, dword [0x4a2e0c]
and ebx, ebx
je 0x40493e
mov dword [0x4a2de8], 9
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e10], eax
mov ebx, dword [0x4a2e10]
and ebx, ebx
je 0x4049a8
mov dword [0x4a2de8], 0xa
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e14], eax
mov ebx, dword [0x4a2e14]
and ebx, ebx
je 0x404a12
mov dword [0x4a2de8], 0xb
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e18], eax
mov ebx, dword [0x4a2e18]
and ebx, ebx
je 0x404a7c
mov dword [0x4a2de8], 0xc
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e1c], eax
mov ebx, dword [0x4a2e1c]
and ebx, ebx
je 0x404ae6
mov dword [0x4a2de8], 0xd
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e20], eax
mov ebx, dword [0x4a2e20]
and ebx, ebx
je 0x404b50
mov dword [0x4a2de8], 0xe
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e24], eax
mov ebx, dword [0x4a2e24]
and ebx, ebx
je 0x404bba
mov dword [0x4a2de8], 0xf
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e28], eax
mov ebx, dword [0x4a2e28]
and ebx, ebx
je 0x404c24
mov dword [0x4a2de8], 0x10
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e2c], eax
mov ebx, dword [0x4a2e2c]
and ebx, ebx
je 0x404c8e
mov dword [0x4a2de8], 0x11
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e30], eax
mov ebx, dword [0x4a2e30]
and ebx, ebx
je 0x404cf8
mov dword [0x4a2de8], 0x12
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e34], eax
mov ebx, dword [0x4a2e34]
and ebx, ebx
je 0x404d62
mov dword [0x4a2de8], 0x13
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e38], eax
mov ebx, dword [0x4a2e38]
and ebx, ebx
je 0x404dcc
mov dword [0x4a2de8], 0x14
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3358]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3350]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3348]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x4a2de8]
mov ebp, dword [0x4a3340]
shl ebx, 2
push dword [ebp + ebx]
call fcn.00407c91
mov dword [0x4a2e3c], eax
mov ebx, dword [0x4a2e3c]
and ebx, ebx
je 0x404e36
mov dword [0x4a2dec], 0
mov dword [0x4a2df4], 0
mov dword [0x4a2df8], 0
mov dword [0x4a2dfc], 0
mov dword [0x4a2e00], 0
mov dword [0x4a2e04], 0
mov dword [0x4a2e08], 0
mov dword [0x4a2e0c], 0
mov dword [0x4a2e10], 0
mov dword [0x4a2e14], 0
mov dword [0x4a2e18], 0
mov dword [0x4a2e1c], 0
mov dword [0x4a2e20], 0
mov dword [0x4a2e24], 0
mov dword [0x4a2e28], 0
mov dword [0x4a2e2c], 0
mov dword [0x4a2e30], 0
mov dword [0x4a2e34], 0
mov dword [0x4a2e38], 0
mov dword [0x4a2e3c], 0
mov ebx, dword [0x4a2d24]
cmp ebx, 0x45a2a5
je 0x404f1b
push 0
push 3
call fcn.0040d6d3
call fcn.00405c0c
push 1
call fcn.0040bd29
mov ebx, dword [0x4a2cfc]
cmp ebx, dword [0x4a2d04]
jne 0x404f4e
mov ebx, dword [0x4a2cfc]
and ebx, ebx
je 0x404f4e
mov ebx, dword [0x4a2d04]
and ebx, ebx
je 0x404f4e
jmp 0x404f55
mov eax, 1
jmp 0x404f57
xor eax, eax
and eax, eax
je 0x404fb3
push 0xa
call fcn.0040bdb3
mov ebx, eax
add ebx, 0xa
mov dword [0x4a2d9c], ebx
push 0x28
call fcn.0040bdb3
mov ebx, eax
add ebx, 0x28
mov dword [0x4a2da0], ebx
mov ebx, dword [0x4a2d50]
add ebx, dword [0x4a2d9c]
mov dword [0x4a2d50], ebx
mov ebx, dword [0x4a2d98]
add ebx, dword [0x4a2da0]
mov dword [0x4a2d98], ebx
call fcn.00406333
jmp 0x403a18
jmp 0x40409e
push 0
call 0x407559
call fcn.00412ac0
push dword [0x4a2c64]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040ae5b
call fcn.0040bea3
call fcn.0040c499
call fcn.0040dae0
call fcn.0040f614
call fcn.0040f84b
call fcn.0040fa50
call fcn.0041090c
call fcn.004115a3
call fcn.004120d0
ret