Function at 0x4054ac
Capabilities:
Log keystrokes via polling
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x784
push 0
push 0x49ef34
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x49ef38], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x49ef34], eax
mov eax, 0x48df0a
mov dword [0x49ef3c], eax
call fcn.00416200
call fcn.004159b1
call fcn.00414f60
call fcn.004143b3
call fcn.00414141
call fcn.00414037
call fcn.00413720
call fcn.0041331e
call fcn.004132ac
call fcn.00411c45
call fcn.0041054f
call fcn.0041009e
call fcn.0040fdd0
call fcn.0040f701
call fcn.0040f598
call fcn.0040e1f7
call fcn.004104d0
call fcn.0040e7f0
call fcn.00416230
push eax
push eax
call fcn.00413430
push 0x49ef40
call fcn.00416250
call fcn.00416230
push eax
mov edx, dword [0x49ef40]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.0.ogg
call fcn.004162e0
call fcn.00416340
push 0
call fcn.00416382
add dword [esp + 4], edx
call fcn.00413860
call fcn.004163a0
mov ebp, 0x45333e
mov ebx, ebp
mov ebp, 0x4507a8
sub ebx, ebp
push ebx
mov ebp, 0x4507a8
push ebp
push 0
call fcn.004138c0
push 0
call fcn.004136b0
call fcn.00416230
push eax
mov edx, dword [0x49ef40]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.1.ogg
call fcn.004162e0
call fcn.00416340
push 0
call fcn.00416382
add dword [esp + 4], edx
call fcn.00413860
call fcn.004163a0
mov ebp, 0x4562af
mov ebx, ebp
mov ebp, 0x45333e
sub ebx, ebp
push ebx
mov ebp, 0x45333e
push ebp
push 0
call fcn.004138c0
push 0
call fcn.004136b0
call fcn.00416230
push eax
mov edx, dword [0x49ef40]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.3.ogg
call fcn.004162e0
call fcn.00416340
push 0
call fcn.00416382
add dword [esp + 4], edx
call fcn.00413860
call fcn.004163a0
mov ebp, 0x4598e4
mov ebx, ebp
mov ebp, 0x4562af
sub ebx, ebp
push ebx
mov ebp, 0x4562af
push ebp
push 0
call fcn.004138c0
push 0
call fcn.004136b0
call fcn.00416230
push eax
mov edx, dword [0x49ef40]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.4.ogg
call fcn.004162e0
call fcn.00416340
push 0
call fcn.00416382
add dword [esp + 4], edx
call fcn.00413860
call fcn.004163a0
mov ebp, 0x45e2b5
mov ebx, ebp
mov ebp, 0x4598e4
sub ebx, ebp
push ebx
mov ebp, 0x4598e4
push ebp
push 0
call fcn.004138c0
push 0
call fcn.004136b0
call fcn.0040e880
call fcn.00416230
push eax
mov edx, dword [0x49ef40]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.0.ogg
call fcn.004162e0
call fcn.00416340
push 0
call fcn.00416382
add dword [esp + 4], edx
call fcn.0040ea78
call fcn.004163a0
mov dword [0x49ef44], eax
call fcn.00416230
push eax
mov edx, dword [0x49ef40]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.1.ogg
call fcn.004162e0
call fcn.00416340
push 1
call fcn.00416382
add dword [esp + 4], edx
call fcn.0040ea78
call fcn.004163a0
mov dword [0x49ef44], eax
call fcn.00416230
push eax
mov edx, dword [0x49ef40]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.3.ogg
call fcn.004162e0
call fcn.00416340
push 3
call fcn.00416382
add dword [esp + 4], edx
call fcn.0040ea78
call fcn.004163a0
mov dword [0x49ef44], eax
call fcn.00416230
push eax
mov edx, dword [0x49ef40]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.4.ogg
call fcn.004162e0
call fcn.00416340
push 4
call fcn.00416382
add dword [esp + 4], edx
call fcn.0040ea78
call fcn.004163a0
mov dword [0x49ef44], eax
call fcn.004104d0
call fcn.00416230
push eax
push 0
push 0x40
call fcn.00416230
push eax
push eax
call fcn.0040f730
call fcn.00416382
add dword [esp], edx
call fcn.0040bd67
push 0x49ef5c
call fcn.00416250
mov ebp, 0x45e2b5
push ebp
push 0
call fcn.004145bc
and eax, eax
je 0x401f40
mov ebp, 0x46fa6c
push ebp
push 2
call fcn.004145bc
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0x41
push 0x133
push 2
call fcn.00414786
push eax
call fcn.004141c1
call fcn.00414208
push 0x100
push 0x18
push 0x450212
push 1
call fcn.00413332
and eax, eax
je 0x401412
push 0x100
push 0x30
push 0x450212
push 2
call fcn.00413332
and eax, eax
je 0x40142f
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004147a2
and eax, eax
je 0x401513
push 1
call fcn.00414650
push eax
call fcn.00414175
push 1
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040fc10
push eax
push str.zp81926
push 0
push 0
call fcn.0041427f
call fcn.00414208
push 0
push 0x64
push 0xc8
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0x11
call fcn.00414268
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0x49f670
push 0x4507a0
push 8
push 0x65
push 4
call fcn.00413f38
call fcn.00416230
push eax
push eax
call fcn.00413430
push 0x49ef60
call fcn.00416250
call fcn.00416230
push eax
mov edx, dword [0x49ef60]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.Options
call fcn.004162e0
call fcn.00416340
push 0xa
call fcn.00416382
add dword [esp + 4], edx
call fcn.00413860
call fcn.004163a0
and eax, eax
je 0x4015b4
mov ebp, 0x48ca90
mov ebx, ebp
mov ebp, str.MEGA_TRAINER_r_n_r_n_r_nNumpad_1:_Unlimited_Health_r_nNumpad_2:_Money_r_nNumpad_3:_Cop_Upgrade_Points_r_nNumpad_4:_Triad_Upgrade_Points_r_nNumpad_5:_Melee_Statue_Points_r_nNumpad_6:_Face_Meter_Level_r_nNumpad_7:_Triad_Meter_Level_r_nNumpad_8:_Cop_Meter_Level_r_nNumpad_9:_Unlimited_Face_Power_r_nNumpad_:_Unlimited_Ammo_r_nNumpad_0:_No_Reload_r_nNumpad_:_Save_Position_r_nNumpad__:_Teleport_r_n__Key:_Reset_Police_Heat_r_n__Key:_Weak_Enemies
sub ebx, ebp
push ebx
mov ebp, str.MEGA_TRAINER_r_n_r_n_r_nNumpad_1:_Unlimited_Health_r_nNumpad_2:_Money_r_nNumpad_3:_Cop_Upgrade_Points_r_nNumpad_4:_Triad_Upgrade_Points_r_nNumpad_5:_Melee_Statue_Points_r_nNumpad_6:_Face_Meter_Level_r_nNumpad_7:_Triad_Meter_Level_r_nNumpad_8:_Cop_Meter_Level_r_nNumpad_9:_Unlimited_Face_Power_r_nNumpad_:_Unlimited_Ammo_r_nNumpad_0:_No_Reload_r_nNumpad_:_Save_Position_r_nNumpad__:_Teleport_r_n__Key:_Reset_Police_Heat_r_n__Key:_Weak_Enemies
push ebp
push 0xa
call fcn.004138c0
push 0xa
call fcn.004136b0
jmp 0x4015c8
push str.Could_not_install_the_file___Installtion_failed
push str.Error
call fcn.0040f5d5
jmp 0x40b00a
call fcn.00416230
push eax
mov edx, dword [0x49ef60]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.help.txt
call fcn.004162e0
call fcn.00416340
push 0
call fcn.00416382
add dword [esp + 4], edx
call fcn.00413860
call fcn.004163a0
and eax, eax
je 0x401635
mov ebp, 0x48df0a
mov ebx, ebp
mov ebp, 0x48ca90
sub ebx, ebp
push ebx
mov ebp, 0x48ca90
push ebp
push 0
call fcn.004138c0
push 0
call fcn.004136b0
jmp 0x401644
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040f5d5
push 0x49f670
push 0x4507a0
push 8
push 0x65
push 4
call fcn.00413f38
call fcn.00416230
push eax
mov edx, dword [0x49ef60]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.Options
call fcn.004162e0
call fcn.00416340
push 0xa
call fcn.00416382
add dword [esp + 4], edx
call fcn.00413880
call fcn.004163a0
call fcn.00416230
push eax
push eax
push 0xa
call fcn.00413920
mov edx, 0x450087
call fcn.004162e0
push 0x49ef64
call fcn.00416250
call fcn.00416230
push eax
push eax
push 0xa
call fcn.00413920
push 0x49ef68
call fcn.00416250
call fcn.00416230
push eax
push eax
push 0xa
call fcn.00413920
mov ebx, dword [0x49ef6c]
inc ebx
mov ebp, dword [0x49f670]
shl ebx, 2
lea eax, [ebp + ebx]
push eax
call fcn.00416250
inc dword [0x49ef6c]
push 0xa
call fcn.00413a60
mov ebx, eax
cmp ebx, 1
jne 0x4016e0
push 0xa
call fcn.004136b0
fild dword [0x49ef6c]
fmul dword [0x450788]
fstp dword [0x49ef70]
fld dword [0x49ef70]
fmul dword [0x45078c]
fstp dword [0x49ef74]
fld dword [0x49ef70]
fild dword [0x49ef6c]
fdiv dword [0x450790]
fdivp st(1)
fstp dword [0x49ef78]
fld dword [0x49ef74]
fild dword [0x49ef6c]
fdiv dword [0x450790]
fdivp st(1)
fstp dword [0x49ef7c]
fld dword [0x49ef70]
fcomp dword [0x450794]
fnstsw ax
test ah, 1
jne 0x4017a4
mov ebx, dword [0x49ef6c]
cmp ebx, 0x15
jl 0x4017a4
jmp 0x4017ab
mov eax, 1
jmp 0x4017ad
xor eax, eax
and eax, eax
je 0x4017e9
mov dword [0x49ef70], 0x44480000
mov dword [0x49ef74], 0x44c80000
fld dword [0x49ef70]
fdiv dword [0x45078c]
fstp dword [0x49ef78]
fld dword [0x49ef74]
fdiv dword [0x45078c]
fstp dword [0x49ef7c]
push 0x120
fld dword [0x49ef74]
push eax
fistp dword [esp]
fld dword [0x49ef70]
push eax
fistp dword [esp]
push 1
call fcn.004147a2
and eax, eax
je 0x401983
push 1
call fcn.00414650
push eax
call fcn.00414175
push 1
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
mov dword [0x49ef80], 1
mov eax, dword [0x49ef6c]
cmp eax, dword [0x49ef80]
jl 0x4018a1
push 0xff
push 0
push 0
mov eax, 0
call fcn.0040fc10
push eax
mov ebx, dword [0x49ef80]
mov ebp, dword [0x49f670]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49ef80]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe8
push ebx
push 2
call fcn.0041427f
inc dword [0x49ef80]
jno 0x401848
mov dword [0x49ef80], 1
mov eax, dword [0x49ef6c]
cmp eax, dword [0x49ef80]
jl 0x401904
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040fc10
push eax
mov ebx, dword [0x49ef80]
mov ebp, dword [0x49f670]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49ef80]
imul ebx, ebx, 0x1a
add ebx, 0xffffffe6
push ebx
push 0
call fcn.0041427f
inc dword [0x49ef80]
jno 0x4018ab
call fcn.00414208
push 0
fld dword [0x49ef7c]
push eax
fistp dword [esp]
fld dword [0x49ef78]
push eax
fistp dword [esp]
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0x11
call fcn.00414268
fld dword [0x49ef7c]
push eax
fistp dword [esp]
fld dword [0x49ef78]
push eax
fistp dword [esp]
push 0x43
push 7
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0x120
push 0x190
push 0x640
push 1
call fcn.004147a2
and eax, eax
je 0x401a97
push 1
call fcn.00414650
push eax
call fcn.00414175
push 2
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
call fcn.00416230
push eax
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040fc10
push eax
mov edx, dword [0x49ef64]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, dword [0x49ef68]
call fcn.004162e0
call fcn.00416340
push 0
push 0
call fcn.00416382
add dword [esp + 8], edx
call fcn.0041427f
call fcn.004163a0
call fcn.00414208
push 0
push 0x64
push 0x190
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0x11
call fcn.00414268
push 0x64
push 0x190
push 0x28
push 5
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0x90000001
push 0x45001d
push 0
call fcn.00414a26
push eax
push 0
call fcn.00414a44
push eax
push 0
push 0
push 0
call fcn.00411f95
and eax, eax
je 0x401f40
push str.CLOSEBUTTON
push 0x13
push 0x13
push 6
push 0x1e4
push 1
call fcn.004106d9
mov dword [0x49ef44], eax
push str.READMEBUTTON
push 0x20
push 0x11e
push 0x17e
push 0xa
push 3
call fcn.004106d9
mov dword [0x49ef44], eax
push str.TROUBLEBUTTON
push 0x20
push 0x11e
push 0x19c
push 0xa
push 4
call fcn.004106d9
mov dword [0x49ef44], eax
push str.CHBUTTON
push 0x23
push 0xf5
push 1
push 0x23
push 5
call fcn.004106d9
mov dword [0x49ef44], eax
push str.BOXARTBUTTON
push 0x118
push 0xc8
push 0x2d
push 0x132
push 6
call fcn.004106d9
mov dword [0x49ef44], eax
push 0
call fcn.00411fb8
push eax
push 0x80000000
push str.Test
push 0x6b
push 0xc8
push 0
push 0xfffffc18
push 1
call fcn.00411c95
push 0
call fcn.00411fb8
push eax
call fcn.0040c30e
push 0xff
push 0
call fcn.00414786
push eax
push 0
call fcn.00411fb8
push eax
call fcn.0040b052
push 0
push 0
call fcn.00411fd4
call fcn.00416230
push eax
push eax
mov edx, str.http:__www.cheathappens.com_trnflash.asp_id
call fcn.004162e0
mov edx, dword [0x49ef5c]
call fcn.004162e0
call fcn.00416340
push 0xc8
push 0x12c
push 0
push 0
push 2
call fcn.00416382
add dword [esp + 0x14], edx
call fcn.004117c1
call fcn.004163a0
mov dword [0x49ef44], eax
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
mov ebx, eax
and ebx, ebx
jne 0x401c83
push 1
push 1
call fcn.00411fd4
mov dword [0x49ef80], 1
mov eax, 4
cmp eax, dword [0x49ef80]
jl 0x401f40
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004147a2
and eax, eax
je 0x401ddf
push 1
call fcn.00414650
push eax
call fcn.00414175
push 1
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040fc10
push eax
push str.zp81926
push 0
push 0
call fcn.0041427f
call fcn.00414208
push 0
push 0x64
push 0xc8
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0
call fcn.00414268
push 0xff
push 0x44
push 0x44
mov eax, 0x44
call fcn.0040fc10
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.004142ff
push 0x21
call fcn.00414268
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0xff
push 0
call fcn.00414786
push eax
push 0
call fcn.00411fb8
push eax
call fcn.0040b052
push 0x32
call fcn.0040fc29
push 0x120
push 0xfa
push 0x1f4
push 1
call fcn.004147a2
and eax, eax
je 0x401f2a
push 1
call fcn.00414650
push eax
call fcn.00414175
push 1
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040fc10
push eax
push str.zp81926
push 0
push 0
call fcn.0041427f
call fcn.00414208
push 0
push 0x64
push 0xc8
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0
call fcn.00414268
push 0xff
push 0x44
push 0x44
mov eax, 0x44
call fcn.0040fc10
push eax
push 0xe
push 0xaf
push 0x12
push 0x133
call fcn.004142ff
push 0x21
call fcn.00414268
push 0x64
push 0xc8
push 0x12
push 0x133
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0xff
push 0
call fcn.00414786
push eax
push 0
call fcn.00411fb8
push eax
call fcn.0040b052
push 0x32
call fcn.0040fc29
inc dword [0x49ef80]
jno 0x401c8d
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x401f50
push 0x75009553
inc ecx
ret
push 0x12c
call fcn.0040fc29
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004147a2
and eax, eax
je 0x40209b
push 1
call fcn.00414650
push eax
call fcn.00414175
push 1
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040fc10
push eax
push str.Authenticating_Trainer......
push 0
push 0
call fcn.0041427f
call fcn.00414208
push 0
push 0x64
push 0x1f4
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0
call fcn.00414268
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040fc10
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.004142ff
push 0x11
call fcn.00414268
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0xff
push 0
call fcn.00414786
push eax
push 0
call fcn.00411fb8
push eax
call fcn.0040b052
call fcn.00416230
push eax
push eax
call fcn.00416230
push eax
push eax
call fcn.0040f730
call fcn.00416382
add dword [esp], edx
call fcn.00413491
push 0x49ef84
call fcn.00416250
mov edx, dword [0x49ef84]
call fcn.00416230
push eax
call fcn.004162e0
push 0x49ef88
call fcn.00416250
call sub.USER32.DLL_GetForegroundWindow
mov dword [0x49ef8c], eax
push 0x49ef90
push dword [0x49ef8c]
call sub.USER32.DLL_GetWindowThreadProcessId
push dword [0x49ef90]
push dword [0x49ef98]
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x49ef94], eax
mov eax, dword [0x49ef90]
mov dword [0x49ef8c], eax
push 0x3e8
call fcn.0040fe00
mov dword [0x49ef9c], eax
mov edx, dword [0x49ef88]
call fcn.00416230
push eax
call fcn.004162e0
push 0x49efa0
call fcn.00416250
mov eax, dword [0x49efa8]
mov dword [0x49efa4], eax
mov ebp, 0x48df0a
mov dword [0x49ef80], ebp
mov eax, dword [0x49ef80]
call fcn.0040fe20
mov byte [0x49f344], al
mov ebp, 0x48df0d
mov dword [0x49ef80], ebp
mov ebp, 0x48df0d
mov ebx, ebp
add ebx, 0xbb8
cmp ebx, dword [0x49ef80]
jl 0x402207
mov eax, dword [0x49ef80]
call fcn.0040fe20
mov byte [0x49f345], al
movsx ebx, byte [0x49f345]
xor bl, byte [0x49f344]
mov eax, ebx
mov byte [0x49f346], al
movsx ebx, byte [0x49f344]
add ebx, 0x37
mov eax, ebx
mov byte [0x49f344], al
movsx ebx, byte [0x49f344]
cmp ebx, 0xff
jle 0x4021e4
movsx ebx, byte [0x49f344]
add ebx, 0xffffff01
mov eax, ebx
mov byte [0x49f344], al
movsx eax, byte [0x49f346]
push eax
mov eax, dword [0x49ef80]
call fcn.0040fe30
mov dword [0x49ef44], eax
inc dword [0x49ef80]
jno 0x402178
call sub.KERNEL32.dll_GetTickCount
mov dword [0x49efac], eax
call fcn.00416230
push eax
push eax
call fcn.0040f730
push 0x49efb0
call fcn.00416250
call fcn.00416230
push eax
push eax
push dword [0x49efb0]
call fcn.00413491
push 0x49efb0
call fcn.00416250
mov edx, 0x45001d
lea ecx, [0x49efb4]
call fcn.0040d008
mov edx, 0x45001d
lea ecx, [0x49efb8]
call fcn.0040d008
mov edx, 0x45001d
lea ecx, [0x49efbc]
call fcn.0040d008
mov dword [0x49efc0], 0
mov dword [0x49efc4], 0
call fcn.00416230
push eax
push eax
call fcn.00416230
push eax
call fcn.0040f730
call fcn.00416340
push 0
call fcn.00416382
add dword [esp + 4], edx
call fcn.004138a0
call fcn.004163a0
push 0
call fcn.00413b00
mov dword [0x49efc8], eax
mov dword [0x49ef80], 1
mov ebx, dword [0x49efc8]
add ebx, 0xfffffff8
cmp ebx, dword [0x49ef80]
jl 0x40230c
push 0
call fcn.00413b60
mov byte [0x49f347], al
mov ebx, dword [0x49efc4]
movzx eax, byte [0x49f347]
add ebx, eax
mov dword [0x49efc4], ebx
inc dword [0x49ef80]
jno 0x4022cf
push 0
call fcn.00413bc0
mov dword [0x49efcc], eax
push 0
call fcn.00413bc0
mov dword [0x49efd0], eax
push 0
call fcn.004136b0
mov eax, dword [0x49efc4]
mov dword [0x49efd4], eax
push dword [0x49efb0]
push 0
call fcn.004138a0
mov ebx, eax
and ebx, ebx
jle 0x4026b1
mov dword [0x49ef80], 1
mov eax, 0x3b8
cmp eax, dword [0x49ef80]
jl 0x402386
push 0
call fcn.00413c20
mov dword [0x49efd8], eax
inc dword [0x49ef80]
jno 0x402362
mov dword [0x49ef80], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x49ef80]
jl 0x40241c
push 0
call fcn.00413c20
mov dword [0x49efd8], eax
call fcn.00416230
push eax
push eax
call fcn.00416230
push eax
push 0
mov eax, dword [0x49efd8]
cdq
push edx
push eax
call fcn.0040d120
call fcn.00416382
add dword [esp], edx
call fcn.0040d1d0
call fcn.004163a0
mov dword [0x49efd8], eax
mov edx, dword [0x49efb4]
call fcn.00416230
push eax
call fcn.004162e0
call fcn.00416230
push eax
push eax
push dword [0x49efd8]
call fcn.0040d350
pop eax
push 0x49efb4
call fcn.00416250
inc dword [0x49ef80]
jno 0x402390
push dword [0x49efb4]
call fcn.0040c219
mov dword [0x49efd8], eax
mov ebx, dword [0x49efd8]
xor ebx, 0x98989898
mov dword [0x49efd8], ebx
mov eax, dword [0x49efd8]
mov dword [0x49efdc], eax
call fcn.00416230
push eax
push eax
push 0xa
call fcn.00416230
push eax
mov edx, str.0000000000
call fcn.004162e0
call fcn.00416230
push eax
push eax
mov eax, dword [0x49efd8]
cdq
push edx
push eax
call fcn.0040d4e0
pop eax
call fcn.00416382
add dword [esp], edx
call fcn.0040d570
push 0x49efb4
call fcn.00416250
mov dword [0x49ef80], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x49ef80]
jl 0x402526
push 0
call fcn.00413c20
mov dword [0x49efd8], eax
call fcn.00416230
push eax
push eax
call fcn.00416230
push eax
push 0
mov eax, dword [0x49efd8]
cdq
push edx
push eax
call fcn.0040d120
call fcn.00416382
add dword [esp], edx
call fcn.0040d1d0
call fcn.004163a0
mov dword [0x49efd8], eax
mov edx, dword [0x49efb8]
call fcn.00416230
push eax
call fcn.004162e0
call fcn.00416230
push eax
push eax
push dword [0x49efd8]
call fcn.0040d350
pop eax
push 0x49efb8
call fcn.00416250
inc dword [0x49ef80]
jno 0x40249a
push dword [0x49efb8]
call fcn.0040c219
mov dword [0x49efe0], eax
mov dword [0x49ef80], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x49ef80]
jl 0x4025cc
push 0
call fcn.00413c20
mov dword [0x49efd8], eax
call fcn.00416230
push eax
push eax
call fcn.00416230
push eax
push 0
mov eax, dword [0x49efd8]
cdq
push edx
push eax
call fcn.0040d120
call fcn.00416382
add dword [esp], edx
call fcn.0040d1d0
call fcn.004163a0
mov dword [0x49efd8], eax
mov edx, dword [0x49efbc]
call fcn.00416230
push eax
call fcn.004162e0
call fcn.00416230
push eax
push eax
push dword [0x49efd8]
call fcn.0040d350
pop eax
push 0x49efbc
call fcn.00416250
inc dword [0x49ef80]
jno 0x402540
push dword [0x49efbc]
call fcn.0040c219
mov dword [0x49efd8], eax
mov eax, dword [0x49efd8]
mov dword [0x49efe4], eax
mov dword [0x49ef80], 0x3d1
mov eax, dword [0x49efe4]
cmp eax, dword [0x49ef80]
jl 0x402614
push 0
call fcn.00413c20
mov dword [0x49efd8], eax
inc dword [0x49ef80]
jno 0x4025f0
mov eax, dword [0x49efe4]
mov dword [0x49ef80], eax
mov ebx, dword [0x49efe4]
add ebx, 0x12
cmp ebx, dword [0x49ef80]
jl 0x402658
push 0
call fcn.00413c20
mov dword [0x49efd8], eax
mov ebx, dword [0x49efc0]
add ebx, dword [0x49efd8]
mov dword [0x49efc0], ebx
inc dword [0x49ef80]
jno 0x40261e
mov ebx, dword [0x49efe0]
xor ebx, dword [0x49efc0]
mov dword [0x49efe8], ebx
mov ebx, dword [0x49efe8]
and ebx, ebx
jne 0x40267e
mov dword [0x49efe8], 0x63
mov ebx, dword [0x49efe8]
xor ebx, 0x98989898
mov dword [0x49efe8], ebx
mov eax, dword [0x49efdc]
mov dword [0x49efec], eax
mov ebx, dword [0x49efdc]
cmp ebx, dword [0x49efe8]
jne 0x4026aa
jmp 0x4026af
call fcn.00409e38
jmp 0x4026b6
call fcn.00409e38
mov ebx, dword [0x49efd0]
cmp ebx, dword [0x49efc8]
jne 0x4026c6
jmp 0x4026cb
call fcn.00409e38
call sub.KERNEL32.dll_GetTickCount
mov dword [0x49eff0], eax
mov ebx, dword [0x49eff0]
sub ebx, dword [0x49efac]
cmp ebx, 0x3e8
jle 0x4026f0
push 0x9099542
inc eax
ret
mov dword [0x49eff4], 0x45a2a5
push 0x49f678
push 0
push 0x15
push 0x15
push 4
call fcn.00413f38
push 0x49f680
push 0
push 0x15
push 0x15
push 4
call fcn.00413f38
push 0x49f688
push 0
push 0x15
push 0x15
push 4
call fcn.00413f38
push 0x49f690
push 0
push 0x15
push 0x15
push 4
call fcn.00413f38
push 0x49f698
push 0
push 0x15
push 0x15
push 4
call fcn.00413f38
push 0x3e8
call fcn.0040fe00
mov dword [0x49ef9c], eax
push 0x3e8
call fcn.0040fe00
mov dword [0x49eff8], eax
mov dword [0x49ef80], 1
mov eax, 0x14
cmp eax, dword [0x49ef80]
jl 0x402812
mov ebx, dword [0x49ef80]
mov ebp, dword [0x49f680]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x49ef80]
mov ebp, dword [0x49f688]
shl ebx, 2
mov dword [ebp + ebx], 1
mov ebx, dword [0x49ef80]
mov ebp, dword [0x49f690]
shl ebx, 2
mov dword [ebp + ebx], 1
inc dword [0x49ef80]
jno 0x4027b8
mov edx, str.Template
lea ecx, [0x49f014]
call fcn.0040d008
call fcn.00416230
push eax
push eax
call fcn.00413430
push 0x49effc
call fcn.00416250
call fcn.00409fac
call fcn.0040ab1c
call fcn.00409fac
call fcn.00409ed1
call fcn.0040a8e6
call fcn.00409ed1
call fcn.00409718
call fcn.00416230
push eax
mov edx, dword [0x49effc]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.CH.dll
call fcn.004162e0
call fcn.00416340
push 0
call fcn.00416382
add dword [esp + 4], edx
call fcn.00413860
call fcn.004163a0
and eax, eax
je 0x4028c8
mov ebp, 0x48eb0d
mov ebx, ebp
mov ebp, 0x48df0d
sub ebx, ebp
push ebx
mov ebp, 0x48df0d
push ebp
push 0
call fcn.004138c0
push 0
call fcn.004136b0
jmp 0x4028c8
call fcn.00416230
push eax
mov edx, dword [0x49effc]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, str.help.txt
call fcn.004162e0
call fcn.00416340
push 0
call fcn.00416382
add dword [esp + 4], edx
call fcn.00413860
call fcn.004163a0
and eax, eax
je 0x402935
mov ebp, 0x48df0a
mov ebx, ebp
mov ebp, 0x48ca90
sub ebx, ebp
push ebx
mov ebp, 0x48ca90
push ebp
push 0
call fcn.004138c0
push 0
call fcn.004136b0
jmp 0x402944
push str.Could_not_create_HELP.TXT_file.
push str.Error
call fcn.0040f5d5
push str.CH_Trainer_Keys.dat
push 0
call fcn.004138a0
mov dword [0x49ef44], eax
mov ebx, dword [0x49ef44]
and ebx, ebx
jle 0x402976
mov dword [0x49f02c], 1
push 0
call fcn.004136b0
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
and eax, eax
je 0x40298b
jmp 0x4029ba
push dword [0x49efec]
call fcn.0040b39f
mov ebx, eax
and ebx, ebx
jne 0x4029ba
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040f5a6
jmp 0x40b00a
call fcn.00416230
push eax
push eax
call fcn.00413430
mov edx, str.black.txt
call fcn.004162e0
push 0x49f030
call fcn.00416250
mov ebx, dword [0x49f034]
and ebx, ebx
jle 0x402a9c
call fcn.00416230
push eax
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.004162e0
call fcn.00416230
push eax
push eax
mov eax, dword [0x49efec]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.0040d4e0
pop eax
mov edx, str..zip
call fcn.004162e0
push 0x49f038
call fcn.00416250
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x49f03c]
call fcn.0040d008
mov edx, dword [0x49f038]
call fcn.00416230
push eax
call fcn.004162e0
push 0x49f040
call fcn.00416250
mov edx, dword [0x49f03c]
call fcn.00416230
push eax
call fcn.004162e0
push 0x49f044
call fcn.00416250
push 0
push 0
mov eax, dword [0x49f030]
push eax
mov eax, dword [0x49f044]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x49f048], eax
call fcn.00416230
push eax
mov edx, str.http:__www.cheathappens.com_unauthorized_
call fcn.004162e0
call fcn.00416230
push eax
push eax
mov eax, dword [0x49efec]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.0040d4e0
pop eax
mov edx, str..zip
call fcn.004162e0
push 0x49f038
call fcn.00416250
mov edx, str.http:__www.cheathappens.com_unauthorized_0.zip
lea ecx, [0x49f03c]
call fcn.0040d008
mov edx, dword [0x49f038]
call fcn.00416230
push eax
call fcn.004162e0
push 0x49f040
call fcn.00416250
mov edx, dword [0x49f03c]
call fcn.00416230
push eax
call fcn.004162e0
push 0x49f044
call fcn.00416250
push 0
push 0
mov eax, dword [0x49f030]
push eax
mov eax, dword [0x49f044]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x49f048], eax
mov ebx, dword [0x49f048]
and ebx, ebx
jne 0x402b5c
jmp 0x402b8b
push dword [0x49efec]
call fcn.0040b39f
mov ebx, eax
and ebx, ebx
jne 0x402b8b
push 0
push str.This_trainer_must_be_authenticated_before_it_can_be_used._Please_connect_this_computer_to_the_Internet_or_obtain_an_offline_key_from_cheathappens.com_then_re_run_the_trainer.
push str.No_Internet_Connection_
call fcn.0040f5a6
jmp 0x40b00a
push 0
push 0
mov eax, dword [0x49f030]
push eax
mov eax, dword [0x49f040]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x49f04c], eax
call fcn.00416230
push eax
push eax
push 0x45009a
push str.IZnvZalZidZ_ZTraiZnerZ_UsZerZ
call fcn.0040d7e0
push 0x49f050
call fcn.00416250
mov ebx, dword [0x49f04c]
and ebx, ebx
jne 0x402bdf
call fcn.00409e38
call fcn.00416230
push eax
push eax
push str.ZTA.
push dword [0x49f050]
call fcn.0040d7e0
push 0x49f050
call fcn.00416250
mov ebx, dword [0x49f04c]
and ebx, ebx
jne 0x402d5a
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004147a2
and eax, eax
je 0x402d50
push 1
call fcn.00414650
push eax
call fcn.00414175
push 1
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
push 0xff
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040fc10
push eax
push dword [0x49f050]
push 0
push 0
call fcn.0041427f
call fcn.00414208
push 0
push 0x64
push 0x1f4
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0
call fcn.00414268
push 0xff
push 0x28
push 0x28
mov eax, 0xff
call fcn.0040fc10
push eax
push 0x24
push 0x1df
push 1
push 0
call fcn.004142ff
push 0x11
call fcn.00414268
push 0x64
push 0x1f4
push 0xa
push 0xc8
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0xff
push 0
call fcn.00414786
push eax
push 0
call fcn.00411fb8
push eax
call fcn.0040b052
call fcn.00409718
jmp 0x402c00
mov ebx, dword [0x49f048]
and ebx, ebx
je 0x402d7c
push dword [0x49efec]
call fcn.0040b39f
mov ebx, eax
and ebx, ebx
jne 0x402d7c
mov eax, 1
jmp 0x402d7e
xor eax, eax
and eax, eax
je 0x402d8c
mov dword [0x49eff4], 0
mov dword [0x49f054], 3
lea ebp, [0x49f34c]
lea eax, [ebp]
push eax
call sub.USER32.DLL_GetKeyboardState
movsx eax, byte [ebp + 0x90]
push eax
pop dword [0x49f058]
mov ebx, dword [0x49f058]
cmp ebx, 1
jne 0x402dd0
mov edx, str.Run_game_and_press_F1_at_main_menu.__Numlock_is_ON.
lea ecx, [0x49f05c]
call fcn.0040d008
jmp 0x402de0
mov edx, 0x450218
lea ecx, [0x49f05c]
call fcn.0040d008
mov ebx, dword [0x49f054]
cmp ebx, dword [0x49f058]
je 0x402f3e
mov eax, dword [0x49f058]
mov dword [0x49f054], eax
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004147a2
and eax, eax
je 0x402f3e
push 1
call fcn.00414650
push eax
call fcn.00414175
push 1
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040fc10
push eax
push dword [0x49f05c]
push 0
push 0
call fcn.0041427f
call fcn.00414208
push 0
push 0x64
push 0x1f4
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0
call fcn.00414268
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040fc10
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.004142ff
push 0x11
call fcn.00414268
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0xff
push 0
call fcn.00414786
push eax
push 0
call fcn.00411fb8
push eax
call fcn.0040b052
call fcn.00409718
push 0xa
call fcn.0040fc29
push 0x70
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
and ebx, ebx
je 0x402d96
mov edx, 0x450207
lea ecx, [0x49ef88]
call fcn.0040d008
call fcn.00408ae6
mov ebx, dword [0x49ef8c]
and ebx, ebx
jne 0x4030f5
push 4
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push 0x12c
call fcn.0040fc29
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004147a2
and eax, eax
je 0x4030e6
push 1
call fcn.00414650
push eax
call fcn.00414175
push 1
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040fc10
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.0041427f
call fcn.00414208
push 0
push 0x64
push 0x1f4
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0
call fcn.00414268
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040fc10
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.004142ff
push 0x11
call fcn.00414268
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0xff
push 0
call fcn.00414786
push eax
push 0
call fcn.00411fb8
push eax
call fcn.0040b052
push 0x7d0
call fcn.0040fc29
jmp 0x402d5a
mov edx, str.CH.dll
lea ecx, [0x49f060]
call fcn.0040d008
mov edx, dword [0x49effc]
call fcn.00416230
push eax
call fcn.004162e0
mov edx, dword [0x49f060]
call fcn.004162e0
push 0x49efa0
call fcn.00416250
call fcn.00408b2b
mov edx, str.xlive.dll
lea ecx, [0x49f064]
call fcn.0040d008
call fcn.00408ae6
call fcn.00409615
call fcn.00409718
mov ebx, dword [0x49f020]
and ebx, ebx
jne 0x4032b1
mov ebx, dword [0x49f068]
and ebx, ebx
jne 0x4032b1
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004147a2
and eax, eax
je 0x4032ac
push 1
call fcn.00414650
push eax
call fcn.00414175
push 1
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040fc10
push eax
push str.Game_not_Found__Run_Game_and_then_press_F1_at_Main_Menu.
push 0
push 0
call fcn.0041427f
call fcn.00414208
push 0
push 0x64
push 0x1f4
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0
call fcn.00414268
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040fc10
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.004142ff
push 0x11
call fcn.00414268
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0xff
push 0
call fcn.00414786
push eax
push 0
call fcn.00411fb8
push eax
call fcn.0040b052
jmp 0x402d5a
mov ebx, dword [0x49efcc]
cmp ebx, dword [0x49efd4]
jne 0x4032d5
mov ebx, dword [0x49efcc]
and ebx, ebx
je 0x4032d5
mov ebx, dword [0x49efd4]
and ebx, ebx
je 0x4032d5
jmp 0x4032dc
mov eax, 1
jmp 0x4032de
xor eax, eax
and eax, eax
je 0x403335
push 0xa
call fcn.0040fce9
mov ebx, eax
add ebx, 0xa
mov dword [0x49f06c], ebx
push 0x28
call fcn.0040fce9
mov ebx, eax
add ebx, 0x28
mov dword [0x49f070], ebx
mov ebx, dword [0x49f020]
add ebx, dword [0x49f06c]
mov dword [0x49f020], ebx
mov ebx, dword [0x49f068]
add ebx, dword [0x49f070]
mov dword [0x49f068], ebx
call fcn.00409e38
push 3
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push 0x120
push 0xdc
push 0x44c
push 1
call fcn.004147a2
and eax, eax
je 0x40348a
push 1
call fcn.00414650
push eax
call fcn.00414175
push 1
call fcn.00413414
push eax
call fcn.00414251
push 0x11
call fcn.00414268
push 0xff
push 0xa
push 0xa
mov eax, 0xa
call fcn.0040fc10
push eax
push str.Game_found__Trainer_Activated_
push 0
push 0
call fcn.0041427f
call fcn.00414208
push 0
push 0x64
push 0x1f4
push 1
call fcn.004148b7
push 0
call fcn.00414650
push eax
call fcn.00414175
push 0
call fcn.00414268
push 0xff
push 0x2f
push 0xa2
mov eax, 0xf2
call fcn.0040fc10
push eax
push 0x18
push 0x202
push 0x1c2
push 1
call fcn.004142ff
push 0x11
call fcn.00414268
push 0x64
push 0x1f4
push 0x1c5
push 5
push 1
call fcn.00414786
push eax
call fcn.004142cd
call fcn.00414208
push 1
call fcn.0041433a
push 0xff
push 0
call fcn.00414786
push eax
push 0
call fcn.00411fb8
push eax
call fcn.0040b052
mov ebx, dword [0x49f074]
and ebx, ebx
je 0x403798
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xff
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x55
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x8b
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xec
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x83
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xec
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x20
mov ebx, dword [0x49ef9c]
add ebx, 7
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x53
mov ebx, dword [0x49ef9c]
add ebx, 8
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x56
mov ebx, dword [0x49ef9c]
add ebx, 9
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x57
mov ebx, dword [0x49ef9c]
add ebx, 0xa
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x8d
mov ebx, dword [0x49ef9c]
add ebx, 0xb
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x45
mov ebx, dword [0x49ef9c]
add ebx, 0xc
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xe0
mov ebx, dword [0x49ef9c]
add ebx, 0xd
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x33
mov ebx, dword [0x49ef9c]
add ebx, 0xe
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xf6
mov ebx, dword [0x49ef9c]
add ebx, 0xf
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x50
mov ebx, dword [0x49ef9c]
add ebx, 0x10
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xff
mov ebx, dword [0x49ef9c]
add ebx, 0x11
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x75
mov ebx, dword [0x49ef9c]
add ebx, 0x12
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc
mov ebx, dword [0x49ef9c]
add ebx, 0x13
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f074]
add ebx, 0x1000
mov dword [0x49ef80], ebx
mov ebx, dword [0x49f074]
add ebx, 0x200000
cmp ebx, dword [0x49ef80]
jl 0x403798
push dword [0x49ef98]
push 0x14
push dword [0x49eff8]
push dword [0x49ef80]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
push 0x14
push dword [0x49eff8]
push dword [0x49ef9c]
call fcn.0040fe40
mov dword [0x49ef44], eax
mov ebx, dword [0x49ef44]
cmp ebx, 1
jne 0x40378c
mov eax, dword [0x49ef80]
mov dword [0x49f07c], eax
push 0xc2
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 3
push dword [0x49ef9c]
push dword [0x49f07c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
inc dword [0x49ef80]
jno 0x4036ad
mov ebx, dword [0x49f034]
and ebx, ebx
jle 0x4037a7
jmp 0x404f83
mov ebx, dword [0x49eff4]
cmp ebx, 0x45a2a5
jne 0x40384b
mov ebp, dword [0x49f678]
mov dword [ebp + 4], 0x61
mov dword [ebp + 8], 0x62
mov dword [ebp + 0xc], 0x63
mov dword [ebp + 0x10], 0x64
mov dword [ebp + 0x14], 0x65
mov dword [ebp + 0x18], 0x66
mov dword [ebp + 0x1c], 0x67
mov dword [ebp + 0x20], 0x68
mov dword [ebp + 0x24], 0x69
mov dword [ebp + 0x28], 0x6d
mov dword [ebp + 0x2c], 0x6b
mov dword [ebp + 0x30], 0x6a
mov dword [ebp + 0x34], 0x60
mov dword [ebp + 0x38], 0xdb
mov dword [ebp + 0x3c], 0xdd
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x50], 0
push str.CH_Trainer_Keys.dat
push 0
call fcn.004138a0
mov dword [0x49ef44], eax
mov ebx, dword [0x49ef44]
and ebx, ebx
jle 0x4039b5
mov dword [0x49f02c], 1
push 0
call fcn.00413c20
mov dword [0x49f080], eax
mov dword [0x49ef80], 1
mov eax, dword [0x49f080]
cmp eax, dword [0x49ef80]
jl 0x4039ab
call fcn.00416230
push eax
push eax
push 0
call fcn.00413920
push 0x49f084
call fcn.00416250
push dword [0x49f084]
mov edx, 0x4501cf
pop ecx
call fcn.004163d0
je 0x4038e6
mov ebx, dword [0x49ef80]
mov ebp, dword [0x49f680]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x49f084]
mov edx, str.CTRL
pop ecx
call fcn.004163d0
je 0x403910
mov ebx, dword [0x49ef80]
mov ebp, dword [0x49f688]
shl ebx, 2
mov dword [ebp + ebx], 0
push dword [0x49f084]
mov edx, 0x45032a
pop ecx
call fcn.004163d0
je 0x40393a
mov ebx, dword [0x49ef80]
mov ebp, dword [0x49f690]
shl ebx, 2
mov dword [ebp + ebx], 0
push 0
call fcn.00413c20
push eax
mov ebx, dword [0x49ef80]
mov ebp, dword [0x49f678]
shl ebx, 2
pop dword [ebp + ebx]
call fcn.00416230
push eax
push eax
call fcn.00416230
push eax
push 0
mov ebx, dword [0x49ef80]
shl ebx, 2
mov eax, dword [ebp + ebx]
cdq
push edx
push eax
call fcn.0040d120
call fcn.00416382
add dword [esp], edx
call fcn.0040d1d0
call fcn.004163a0
push eax
mov ebx, dword [0x49ef80]
shl ebx, 2
pop dword [ebp + ebx]
inc dword [0x49ef80]
jno 0x403890
push 0
call fcn.004136b0
mov ebx, dword [0x49f020]
add ebx, 0x1c1f82
mov dword [0x49f088], ebx
mov ebx, dword [0x49f020]
add ebx, 0x32e39a
mov dword [0x49f08c], ebx
mov ebx, dword [0x49f020]
add ebx, 0x413683
mov dword [0x49f090], ebx
mov ebx, dword [0x49f020]
add ebx, 0x3c1f98
mov dword [0x49f094], ebx
mov ebx, dword [0x49f020]
add ebx, 0x12721
mov dword [0x49f098], ebx
mov ebx, dword [0x49f020]
add ebx, 0x66f2a6
mov dword [0x49f09c], ebx
mov ebx, dword [0x49f020]
add ebx, 0x4fca76
mov dword [0x49f0a0], ebx
push 0xd9
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x41
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x2c
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xd8
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x71
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x34
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x89
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xd
mov ebx, dword [0x49ef9c]
add ebx, 7
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 8
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x3f
mov ebx, dword [0x49ef9c]
add ebx, 9
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x62
mov ebx, dword [0x49ef9c]
add ebx, 0xa
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 1
mov ebx, dword [0x49ef9c]
add ebx, 0xb
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc3
mov ebx, dword [0x49ef9c]
add ebx, 0xc
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 0xd
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0xe
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0xf
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xa3
mov ebx, dword [0x49ef9c]
add ebx, 0x10
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 4
mov ebx, dword [0x49ef9c]
add ebx, 0x11
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x3f
mov ebx, dword [0x49ef9c]
add ebx, 0x12
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x62
mov ebx, dword [0x49ef9c]
add ebx, 0x13
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 1
mov ebx, dword [0x49ef9c]
add ebx, 0x14
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x8b
mov ebx, dword [0x49ef9c]
add ebx, 0x15
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
add ebx, 0x16
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 0x17
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xb0
mov ebx, dword [0x49ef9c]
add ebx, 0x18
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 2
mov ebx, dword [0x49ef9c]
add ebx, 0x19
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x1a
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x1b
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc3
mov ebx, dword [0x49ef9c]
add ebx, 0x1c
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 0x1d
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x1e
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x1f
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xa3
mov ebx, dword [0x49ef9c]
add ebx, 0x20
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 8
mov ebx, dword [0x49ef9c]
add ebx, 0x21
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x3f
mov ebx, dword [0x49ef9c]
add ebx, 0x22
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x62
mov ebx, dword [0x49ef9c]
add ebx, 0x23
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 1
mov ebx, dword [0x49ef9c]
add ebx, 0x24
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xd9
mov ebx, dword [0x49ef9c]
add ebx, 0x25
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x98
mov ebx, dword [0x49ef9c]
add ebx, 0x26
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xe4
mov ebx, dword [0x49ef9c]
add ebx, 0x27
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 5
mov ebx, dword [0x49ef9c]
add ebx, 0x28
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x29
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x2a
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc3
mov ebx, dword [0x49ef9c]
add ebx, 0x2b
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x2c
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x2d
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x2e
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x2f
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x89
mov ebx, dword [0x49ef9c]
add ebx, 0x30
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x15
mov ebx, dword [0x49ef9c]
add ebx, 0x31
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc
mov ebx, dword [0x49ef9c]
add ebx, 0x32
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x3f
mov ebx, dword [0x49ef9c]
add ebx, 0x33
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x62
mov ebx, dword [0x49ef9c]
add ebx, 0x34
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 1
mov ebx, dword [0x49ef9c]
add ebx, 0x35
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 5
mov ebx, dword [0x49ef9c]
add ebx, 0x36
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x20
mov ebx, dword [0x49ef9c]
add ebx, 0x37
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 1
mov ebx, dword [0x49ef9c]
add ebx, 0x38
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x39
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x3a
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc3
mov ebx, dword [0x49ef9c]
add ebx, 0x3b
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x3c
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x3d
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x3e
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x3f
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x40
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x41
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x42
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x43
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x44
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x45
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x46
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x47
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x48
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x49
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x4a
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x4b
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x4c
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x4d
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x4e
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x4f
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x52
mov ebx, dword [0x49ef9c]
add ebx, 0x50
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x8d
mov ebx, dword [0x49ef9c]
add ebx, 0x51
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x54
mov ebx, dword [0x49ef9c]
add ebx, 0x52
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 0x53
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x38
mov ebx, dword [0x49ef9c]
add ebx, 0x54
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x89
mov ebx, dword [0x49ef9c]
add ebx, 0x55
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x15
mov ebx, dword [0x49ef9c]
add ebx, 0x56
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x10
mov ebx, dword [0x49ef9c]
add ebx, 0x57
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x3f
mov ebx, dword [0x49ef9c]
add ebx, 0x58
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x62
mov ebx, dword [0x49ef9c]
add ebx, 0x59
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 1
mov ebx, dword [0x49ef9c]
add ebx, 0x5a
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x5a
mov ebx, dword [0x49ef9c]
add ebx, 0x5b
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x8b
mov ebx, dword [0x49ef9c]
add ebx, 0x5c
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x44
mov ebx, dword [0x49ef9c]
add ebx, 0x5d
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 0x5e
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x38
mov ebx, dword [0x49ef9c]
add ebx, 0x5f
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc3
mov ebx, dword [0x49ef9c]
add ebx, 0x60
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 0x61
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x62
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x63
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x64
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x65
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x66
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x67
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x68
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x69
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x6a
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x6b
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x6c
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x6d
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x6e
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x6f
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x8d
mov ebx, dword [0x49ef9c]
add ebx, 0x70
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x44
mov ebx, dword [0x49ef9c]
add ebx, 0x71
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x91
mov ebx, dword [0x49ef9c]
add ebx, 0x72
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x7c
mov ebx, dword [0x49ef9c]
add ebx, 0x73
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xa3
mov ebx, dword [0x49ef9c]
add ebx, 0x74
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x14
mov ebx, dword [0x49ef9c]
add ebx, 0x75
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x3f
mov ebx, dword [0x49ef9c]
add ebx, 0x76
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x62
mov ebx, dword [0x49ef9c]
add ebx, 0x77
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 1
mov ebx, dword [0x49ef9c]
add ebx, 0x78
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x8b
mov ebx, dword [0x49ef9c]
add ebx, 0x79
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x44
mov ebx, dword [0x49ef9c]
add ebx, 0x7a
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x91
mov ebx, dword [0x49ef9c]
add ebx, 0x7b
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x7c
mov ebx, dword [0x49ef9c]
add ebx, 0x7c
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc3
mov ebx, dword [0x49ef9c]
add ebx, 0x7d
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x7e
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x7f
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc7
mov ebx, dword [0x49ef9c]
add ebx, 0x80
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
add ebx, 0x81
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 0x82
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x38
mov ebx, dword [0x49ef9c]
add ebx, 0x83
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 5
mov ebx, dword [0x49ef9c]
add ebx, 0x84
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x85
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x86
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x87
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x88
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x89
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x8a
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xd9
mov ebx, dword [0x49ef9c]
add ebx, 0x8b
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xee
mov ebx, dword [0x49ef9c]
add ebx, 0x8c
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc3
mov ebx, dword [0x49ef9c]
add ebx, 0x8d
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 0x8e
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 0x8f
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x39
mov ebx, dword [0x49ef9c]
add ebx, 0x90
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 5
mov ebx, dword [0x49ef9c]
add ebx, 0x91
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x92
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x3f
mov ebx, dword [0x49ef9c]
add ebx, 0x93
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x62
mov ebx, dword [0x49ef9c]
add ebx, 0x94
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 1
mov ebx, dword [0x49ef9c]
add ebx, 0x95
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x74
mov ebx, dword [0x49ef9c]
add ebx, 0x96
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x10
mov ebx, dword [0x49ef9c]
add ebx, 0x97
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x81
mov ebx, dword [0x49ef9c]
add ebx, 0x98
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x78
mov ebx, dword [0x49ef9c]
add ebx, 0x99
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x2c
mov ebx, dword [0x49ef9c]
add ebx, 0x9a
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x9b
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0x9c
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push pe_nt_image_headers32
mov ebx, dword [0x49ef9c]
add ebx, 0x9d
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x3f
mov ebx, dword [0x49ef9c]
add ebx, 0x9e
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x7e
mov ebx, dword [0x49ef9c]
add ebx, 0x9f
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 7
mov ebx, dword [0x49ef9c]
add ebx, 0xa0
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc7
mov ebx, dword [0x49ef9c]
add ebx, 0xa1
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x40
mov ebx, dword [0x49ef9c]
add ebx, 0xa2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x2c
mov ebx, dword [0x49ef9c]
add ebx, 0xa3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0xa4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0xa5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push pe_nt_image_headers32
mov ebx, dword [0x49ef9c]
add ebx, 0xa6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x3f
mov ebx, dword [0x49ef9c]
add ebx, 0xa7
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push pe_nt_image_headers32
mov ebx, dword [0x49ef9c]
add ebx, 0xa8
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x7f
mov ebx, dword [0x49ef9c]
add ebx, 0xa9
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc
mov ebx, dword [0x49ef9c]
add ebx, 0xaa
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 0xab
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xd9
mov ebx, dword [0x49ef9c]
add ebx, 0xac
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x40
mov ebx, dword [0x49ef9c]
add ebx, 0xad
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x2c
mov ebx, dword [0x49ef9c]
add ebx, 0xae
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc3
mov ebx, dword [0x49ef9c]
add ebx, 0xaf
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 0x2ac
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x1091
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x3f00
push ebx
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x1099
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x1123
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x3f04
push ebx
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x10a2
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x3f08
push ebx
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x10b2
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x3f0c
push ebx
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x10c3
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x3f10
push ebx
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x10e8
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x3f14
push ebx
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x1106
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x3f18
push ebx
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov dword [0x49f0a4], 0
mov eax, 0xff
cmp eax, dword [0x49f0a4]
jl 0x404fad
push dword [0x49f0a4]
call sub.USER32.DLL_GetAsyncKeyState
inc dword [0x49f0a4]
jno 0x404f8d
call sub.KERNEL32.dll_IsDebuggerPresent
and eax, eax
je 0x404fbc
push 0x55009553
ret
mov ebp, dword [0x49f678]
push dword [ebp + 4]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 4]
mov ebp, dword [0x49f678]
push dword [ebp + 8]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 8]
mov ebp, dword [0x49f678]
push dword [ebp + 0xc]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0xc]
mov ebp, dword [0x49f678]
push dword [ebp + 0x10]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x10]
mov ebp, dword [0x49f678]
push dword [ebp + 0x14]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x14]
mov ebp, dword [0x49f678]
push dword [ebp + 0x18]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x18]
mov ebp, dword [0x49f678]
push dword [ebp + 0x1c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x1c]
mov ebp, dword [0x49f678]
push dword [ebp + 0x20]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x20]
mov ebp, dword [0x49f678]
push dword [ebp + 0x24]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x24]
mov ebp, dword [0x49f678]
push dword [ebp + 0x28]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x28]
mov ebp, dword [0x49f678]
push dword [ebp + 0x2c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x2c]
mov ebp, dword [0x49f678]
push dword [ebp + 0x30]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x30]
mov ebp, dword [0x49f678]
push dword [ebp + 0x34]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x34]
mov ebp, dword [0x49f678]
push dword [ebp + 0x38]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x38]
mov ebp, dword [0x49f678]
push dword [ebp + 0x3c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x3c]
mov ebp, dword [0x49f678]
push dword [ebp + 0x40]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x40]
mov ebp, dword [0x49f678]
push dword [ebp + 0x44]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x44]
mov ebp, dword [0x49f678]
push dword [ebp + 0x48]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x48]
mov ebp, dword [0x49f678]
push dword [ebp + 0x4c]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x4c]
mov ebp, dword [0x49f678]
push dword [ebp + 0x50]
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
push ebx
mov ebp, dword [0x49f698]
pop dword [ebp + 0x50]
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x49f0a8], ebx
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x49f0ac], ebx
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
mov ebx, eax
and ebx, 1
mov dword [0x49f0b0], ebx
push 1
call fcn.0040fc29
push 0x32
call fcn.0040fce9
mov dword [0x49f0b4], eax
mov ebx, dword [0x49f0b4]
cmp ebx, 0x19
jne 0x405304
mov ebx, dword [0x49efcc]
cmp ebx, dword [0x49efd4]
jne 0x40528b
mov ebx, dword [0x49efcc]
and ebx, ebx
je 0x40528b
mov ebx, dword [0x49efd4]
and ebx, ebx
je 0x40528b
jmp 0x405292
mov eax, 1
jmp 0x405294
xor eax, eax
and eax, eax
je 0x405304
push 0xff
call fcn.0040fce9
mov dword [0x49f06c], eax
push 0x190
call fcn.0040fce9
mov dword [0x49f070], eax
push dword [0x49f06c]
mov eax, dword [0x49ef9c]
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 1
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, dword [0x49f070]
add ebx, 0x1091
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
call fcn.00409e38
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f00
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x2c
mov dword [0x49f0bc], ebx
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f04
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x3a4
mov dword [0x49f0c0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x300
mov dword [0x49f0c4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2fc
mov dword [0x49f0c8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2f8
mov dword [0x49f0cc], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x320
mov dword [0x49f0d0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x324
mov dword [0x49f0d4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x328
mov dword [0x49f0d8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x5e4
mov dword [0x49f0dc], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x5dc
mov dword [0x49f0e0], ebx
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f0c
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f0e4], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x140
mov dword [0x49f0e8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x144
mov dword [0x49f0ec], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x148
mov dword [0x49f0f0], ebx
mov dword [0x49f0f4], 1
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f0f8], eax
mov ebx, dword [0x49f0f8]
and ebx, ebx
je 0x405787
push dword [0x49f0fc]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x40575e
mov dword [0x49f0fc], 1
mov ebx, dword [0x49f100]
and ebx, ebx
jne 0x4056f2
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x1091
sub ebx, dword [0x49f088]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 6
push dword [0x49ef9c]
push dword [0x49f088]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0xd9
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x41
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x2c
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xd8
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x71
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x34
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 6
push dword [0x49ef9c]
push dword [0x49f088]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f00
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x2c
mov dword [0x49f0bc], ebx
mov eax, dword [0x49f0b8]
mov dword [0x49f100], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
jmp 0x405786
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405786
mov dword [0x49f0fc], 0
push 1
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
pop eax
mov ebx, dword [0x49f0fc]
cmp ebx, 1
jne 0x4057cd
push 0x447a0000
mov eax, dword [0x49ef9c]
call fcn.0040fef0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0bc]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 2
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f104], eax
mov ebx, dword [0x49f104]
and ebx, ebx
je 0x405b81
mov ebx, dword [0x49f108]
and ebx, ebx
jne 0x405a2c
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10a1
sub ebx, dword [0x49f08c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xb0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 2
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f04
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f108], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x3a4
mov dword [0x49f0c0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x300
mov dword [0x49f0c4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2fc
mov dword [0x49f0c8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2f8
mov dword [0x49f0cc], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x320
mov dword [0x49f0d0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x324
mov dword [0x49f0d4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x328
mov dword [0x49f0d8], ebx
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0c0]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f10c], eax
add dword [0x49f10c], 0x186a0
push dword [0x49f10c]
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0c0]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 3
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f110], eax
mov ebx, dword [0x49f110]
and ebx, ebx
je 0x405f32
mov ebx, dword [0x49f108]
and ebx, ebx
jne 0x405de0
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10a1
sub ebx, dword [0x49f08c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xb0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 2
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f04
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f108], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x3a4
mov dword [0x49f0c0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x300
mov dword [0x49f0c4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2fc
mov dword [0x49f0c8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2f8
mov dword [0x49f0cc], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x320
mov dword [0x49f0d0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x324
mov dword [0x49f0d4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x328
mov dword [0x49f0d8], ebx
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0c4]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f10c], eax
add dword [0x49f10c], 0x14
push dword [0x49f10c]
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0c4]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 4
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f114], eax
mov ebx, dword [0x49f114]
and ebx, ebx
je 0x4062e3
mov ebx, dword [0x49f108]
and ebx, ebx
jne 0x406191
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10a1
sub ebx, dword [0x49f08c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xb0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 2
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f04
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f108], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x3a4
mov dword [0x49f0c0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x300
mov dword [0x49f0c4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2fc
mov dword [0x49f0c8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2f8
mov dword [0x49f0cc], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x320
mov dword [0x49f0d0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x324
mov dword [0x49f0d4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x328
mov dword [0x49f0d8], ebx
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0c8]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f10c], eax
add dword [0x49f10c], 0x14
push dword [0x49f10c]
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0c8]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 5
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f118], eax
mov ebx, dword [0x49f118]
and ebx, ebx
je 0x406694
mov ebx, dword [0x49f108]
and ebx, ebx
jne 0x406542
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10a1
sub ebx, dword [0x49f08c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xb0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 2
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f04
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f108], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x3a4
mov dword [0x49f0c0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x300
mov dword [0x49f0c4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2fc
mov dword [0x49f0c8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2f8
mov dword [0x49f0cc], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x320
mov dword [0x49f0d0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x324
mov dword [0x49f0d4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x328
mov dword [0x49f0d8], ebx
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0cc]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f10c], eax
add dword [0x49f10c], 0x14
push dword [0x49f10c]
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0cc]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 6
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f11c], eax
mov ebx, dword [0x49f11c]
and ebx, ebx
je 0x406a48
mov ebx, dword [0x49f108]
and ebx, ebx
jne 0x4068f3
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10a1
sub ebx, dword [0x49f08c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xb0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 2
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f04
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f108], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x3a4
mov dword [0x49f0c0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x300
mov dword [0x49f0c4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2fc
mov dword [0x49f0c8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2f8
mov dword [0x49f0cc], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x320
mov dword [0x49f0d0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x324
mov dword [0x49f0d4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x328
mov dword [0x49f0d8], ebx
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0d0]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f10c], eax
add dword [0x49f10c], 0x3e8
push dword [0x49f10c]
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0d0]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 7
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f120], eax
mov ebx, dword [0x49f120]
and ebx, ebx
je 0x406dfc
mov ebx, dword [0x49f108]
and ebx, ebx
jne 0x406ca7
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10a1
sub ebx, dword [0x49f08c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xb0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 2
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f04
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f108], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x3a4
mov dword [0x49f0c0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x300
mov dword [0x49f0c4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2fc
mov dword [0x49f0c8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2f8
mov dword [0x49f0cc], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x320
mov dword [0x49f0d0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x324
mov dword [0x49f0d4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x328
mov dword [0x49f0d8], ebx
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0d4]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f10c], eax
add dword [0x49f10c], 0x3e8
push dword [0x49f10c]
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0d4]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 8
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f124], eax
mov ebx, dword [0x49f124]
and ebx, ebx
je 0x4071b0
mov ebx, dword [0x49f108]
and ebx, ebx
jne 0x40705b
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10a1
sub ebx, dword [0x49f08c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xb0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 2
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f04
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f108], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x3a4
mov dword [0x49f0c0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x300
mov dword [0x49f0c4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2fc
mov dword [0x49f0c8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2f8
mov dword [0x49f0cc], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x320
mov dword [0x49f0d0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x324
mov dword [0x49f0d4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x328
mov dword [0x49f0d8], ebx
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0d8]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f10c], eax
add dword [0x49f10c], 0x3e8
push dword [0x49f10c]
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0d8]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 9
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f128], eax
mov ebx, dword [0x49f128]
and ebx, ebx
je 0x407667
push dword [0x49f12c]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x40763e
mov dword [0x49f12c], 1
mov ebx, dword [0x49f130]
and ebx, ebx
jne 0x4075cf
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10b1
sub ebx, dword [0x49f090]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 6
push dword [0x49ef9c]
push dword [0x49f090]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10a1
sub ebx, dword [0x49f08c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0xd9
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x98
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xe4
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 5
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 6
push dword [0x49ef9c]
push dword [0x49f090]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xb0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 2
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f08
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x5e4
mov dword [0x49f0dc], ebx
mov eax, dword [0x49f0b8]
mov dword [0x49f130], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
jmp 0x407666
mov ebx, 1
cmp ebx, dword [esp]
jne 0x407666
mov dword [0x49f12c], 0
push 1
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
pop eax
mov ebx, dword [0x49f12c]
cmp ebx, 1
jne 0x4076ad
push 0x447a0000
mov eax, dword [0x49ef9c]
call fcn.0040fef0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0dc]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 0xa
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f134], eax
mov ebx, dword [0x49f134]
and ebx, ebx
je 0x4079da
mov ebx, dword [0x49f0e4]
and ebx, ebx
jne 0x4078a4
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10c1
sub ebx, dword [0x49f094]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 5
push dword [0x49ef9c]
push dword [0x49f094]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 5
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x20
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 1
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 5
push dword [0x49ef9c]
push dword [0x49f094]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f0c
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f0e4], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x140
mov dword [0x49f0e8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x144
mov dword [0x49f0ec], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x148
mov dword [0x49f0f0], ebx
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0e8]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040ff00
fstp dword [0x49f138]
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0ec]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040ff00
fstp dword [0x49f13c]
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0f0]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040ff00
fstp dword [0x49f140]
mov dword [0x49f0f4], 0xb
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f144], eax
mov ebx, dword [0x49f144]
and ebx, ebx
je 0x407bd2
fld dword [0x49f138]
fcomp dword [0x450798]
fnstsw ax
test ah, 0x40
jne 0x407bd2
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0e8]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040ff00
fistp dword [0x49f148]
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0ec]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040ff00
fistp dword [0x49f14c]
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0f0]
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040ff00
fadd dword [0x45079c]
fistp dword [0x49f150]
push dword [0x49f138]
mov eax, dword [0x49ef9c]
call fcn.0040fef0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0e8]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push dword [0x49f13c]
mov eax, dword [0x49ef9c]
call fcn.0040fef0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0ec]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push dword [0x49f140]
mov eax, dword [0x49ef9c]
call fcn.0040fef0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0f0]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
mov dword [0x49f0f4], 0xc
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f154], eax
mov ebx, dword [0x49f154]
and ebx, ebx
je 0x407e5c
push dword [0x49f158]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x407e33
mov dword [0x49f158], 1
push 0xe9
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10e1
sub ebx, dword [0x49f098]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 5
push dword [0x49ef9c]
push dword [0x49f098]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x44
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x38
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc3
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 5
push dword [0x49ef9c]
push dword [0x49f098]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f10
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f15c], eax
jmp 0x407e5b
mov ebx, 1
cmp ebx, dword [esp]
jne 0x407e5b
mov dword [0x49f158], 0
push 1
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
pop eax
mov ebx, dword [0x49f158]
cmp ebx, 1
jne 0x407ea2
push 0x3e7
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f15c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 0xd
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f160], eax
mov ebx, dword [0x49f160]
and ebx, ebx
je 0x40812c
push dword [0x49f164]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x408103
mov dword [0x49f164], 1
push 0xe9
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x1101
sub ebx, dword [0x49f09c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 5
push dword [0x49ef9c]
push dword [0x49f09c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x44
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x91
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x7c
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc3
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 5
push dword [0x49ef9c]
push dword [0x49f09c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f14
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f168], eax
jmp 0x40812b
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40812b
mov dword [0x49f164], 0
push 1
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
pop eax
mov ebx, dword [0x49f164]
cmp ebx, 1
jne 0x408172
push 0x3e7
mov eax, dword [0x49ef9c]
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f168]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 0xe
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f16c], eax
mov ebx, dword [0x49f16c]
and ebx, ebx
je 0x4084f7
mov ebx, dword [0x49f108]
and ebx, ebx
jne 0x4083d1
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x10a1
sub ebx, dword [0x49f08c]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0x8b
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x84
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x88
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xb0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 2
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f08c]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0
call fcn.0040ed32
push 0x12c
call fcn.0040fc29
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
mov ebx, dword [0x49f068]
add ebx, 0x3f04
push ebx
push dword [0x49f078]
call sub.KERNEL32.dll_ReadProcessMemory
mov dword [0x49ef44], eax
mov eax, dword [0x49ef9c]
call fcn.0040fee0
mov dword [0x49f0b8], eax
mov eax, dword [0x49f0b8]
mov dword [0x49f108], eax
mov ebx, dword [0x49f0b8]
add ebx, 0x3a4
mov dword [0x49f0c0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x300
mov dword [0x49f0c4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2fc
mov dword [0x49f0c8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x2f8
mov dword [0x49f0cc], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x320
mov dword [0x49f0d0], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x324
mov dword [0x49f0d4], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x328
mov dword [0x49f0d8], ebx
mov ebx, dword [0x49f0b8]
add ebx, 0x5dc
mov dword [0x49f0e0], ebx
push 0xc4bb8000
mov eax, dword [0x49ef9c]
call fcn.0040fef0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 4
push dword [0x49ef9c]
push dword [0x49f0e0]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 0xf
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f170], eax
mov ebx, dword [0x49f170]
and ebx, ebx
je 0x408752
push 0xe8
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x90
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
mov ebx, dword [0x49f068]
add ebx, 0x1121
sub ebx, dword [0x49f0a0]
add ebx, 0xfffffffb
push ebx
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fed0
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f0a0]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
push 0x12c
call fcn.0040fc29
push 0
call fcn.0040ed32
push pe_nt_image_headers32
mov ebx, dword [0x49ef9c]
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x7f
mov ebx, dword [0x49ef9c]
inc ebx
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xc
mov ebx, dword [0x49ef9c]
add ebx, 2
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0
mov ebx, dword [0x49ef9c]
add ebx, 3
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0xd9
mov ebx, dword [0x49ef9c]
add ebx, 4
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x40
mov ebx, dword [0x49ef9c]
add ebx, 5
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push 0x2c
mov ebx, dword [0x49ef9c]
add ebx, 6
mov eax, ebx
call fcn.0040fe30
mov dword [0x49ef44], eax
push dword [0x49ef98]
push 7
push dword [0x49ef9c]
push dword [0x49f0a0]
push dword [0x49f078]
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [0x49ef44], eax
mov dword [0x49f0f4], 0x10
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f174], eax
mov ebx, dword [0x49f174]
and ebx, ebx
je 0x4087bc
mov dword [0x49f0f4], 0x11
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f178], eax
mov ebx, dword [0x49f178]
and ebx, ebx
je 0x408826
mov dword [0x49f0f4], 0x12
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f17c], eax
mov ebx, dword [0x49f17c]
and ebx, ebx
je 0x408890
mov dword [0x49f0f4], 0x13
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f180], eax
mov ebx, dword [0x49f180]
and ebx, ebx
je 0x4088fa
mov dword [0x49f0f4], 0x14
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f690]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f688]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f680]
shl ebx, 2
push dword [ebp + ebx]
mov ebx, dword [0x49f0f4]
mov ebp, dword [0x49f678]
shl ebx, 2
push dword [ebp + ebx]
call fcn.0040b742
mov dword [0x49f184], eax
mov ebx, dword [0x49f184]
and ebx, ebx
je 0x408964
mov dword [0x49f0f8], 0
mov dword [0x49f104], 0
mov dword [0x49f110], 0
mov dword [0x49f114], 0
mov dword [0x49f118], 0
mov dword [0x49f11c], 0
mov dword [0x49f120], 0
mov dword [0x49f124], 0
mov dword [0x49f128], 0
mov dword [0x49f134], 0
mov dword [0x49f144], 0
mov dword [0x49f154], 0
mov dword [0x49f160], 0
mov dword [0x49f16c], 0
mov dword [0x49f170], 0
mov dword [0x49f174], 0
mov dword [0x49f178], 0
mov dword [0x49f17c], 0
mov dword [0x49f180], 0
mov dword [0x49f184], 0
mov ebx, dword [0x49eff4]
cmp ebx, 0x45a2a5
je 0x408a49
push 0
push 3
call fcn.004117e1
call fcn.00409718
push 1
call fcn.0040fc29
mov ebx, dword [0x49efcc]
cmp ebx, dword [0x49efd4]
jne 0x408a7c
mov ebx, dword [0x49efcc]
and ebx, ebx
je 0x408a7c
mov ebx, dword [0x49efd4]
and ebx, ebx
je 0x408a7c
jmp 0x408a83
mov eax, 1
jmp 0x408a85
xor eax, eax
and eax, eax
je 0x408ae1
push 0xa
call fcn.0040fce9
mov ebx, eax
add ebx, 0xa
mov dword [0x49f06c], ebx
push 0x28
call fcn.0040fce9
mov ebx, eax
add ebx, 0x28
mov dword [0x49f070], ebx
mov ebx, dword [0x49f020]
add ebx, dword [0x49f06c]
mov dword [0x49f020], ebx
mov ebx, dword [0x49f068]
add ebx, dword [0x49f070]
mov dword [0x49f068], ebx
call fcn.00409e38
jmp 0x4039b5
jmp 0x404f83
push 0
call 0x40b024
push dword [0x49ef34]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040ee2d
call fcn.0040fdf0
call fcn.00410024
call fcn.004105bf
call fcn.00411ba5
call fcn.004132f0
call fcn.00413710
call fcn.00414385
call fcn.00414fee
ret