Function at 0x401028
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x404ec4], eax
push 0
push 0x401028
push 0
push 0x64
push dword [0x404ec4]
call sub.USER32.dll_DialogBoxParamA
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x110
jne 0x40106a
mov eax, dword [ebp + 8]
mov dword [0x404e76], eax
push 0xc8
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
push 0
push 0x50
push 0xfa0
push dword [ebp + 8]
call sub.USER32.dll_SetTimer
call fcn.00402b26
jmp 0x402aee
cmp dword [ebp + 0xc], 0x10
jne 0x40107c
push 0
call sub.KERNEL32.dll_ExitProcess
jmp 0x402aee
cmp dword [ebp + 0xc], 0x113
jne 0x402a1b
cmp dword [ebp + 0x10], 0xfa0
jne 0x402a16
push 0x31
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x40114d
cmp byte [0x404e74], 1
je 0x4010b9
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x4046d5]
push 0x4046d0
push dword [0x4046cc]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4046e1]
push 0x4046dd
push dword [0x4046d9]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4046ea]
push 0x4046e9
push dword [0x4046e5]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4046f7]
push 0x4046f2
push dword [0x4046ee]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x32
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x401229
cmp byte [0x404e74], 1
je 0x401170
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404705]
push 0x4046ff
push dword [0x4046fb]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404714]
push 0x40470d
push dword [0x404709]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404721]
push 0x40471c
push dword [0x404718]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40472f]
push 0x404729
push dword [0x404725]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40473c]
push 0x404737
push dword [0x404733]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x33
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x401305
cmp byte [0x404e74], 1
je 0x40124c
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404749]
push 0x404744
push dword [0x404740]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404755]
push 0x404751
push dword [0x40474d]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404762]
push 0x40475d
push dword [0x404759]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40476f]
push 0x40476a
push dword [0x404766]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40477c]
push 0x404777
push dword [0x404773]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x34
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x40136e
cmp byte [0x404e74], 1
je 0x401324
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404788]
push 0x404784
push dword [0x404780]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404792]
push 0x404790
push dword [0x40478c]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x35
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4013b2
cmp byte [0x404e74], 1
je 0x40138d
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x40479c]
push 0x40479a
push dword [0x404796]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x36
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4014fd
cmp byte [0x404e74], 1
je 0x4013d5
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x4047a9]
push 0x4047a4
push dword [0x4047a0]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4047b7]
push 0x4047b1
push dword [0x4047ad]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4047c5]
push 0x4047bf
push dword [0x4047bb]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4047d2]
push 0x4047cd
push dword [0x4047c9]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4047df]
push 0x4047da
push dword [0x4047d6]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4047eb]
push 0x4047e7
push dword [0x4047e3]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4047f7]
push 0x4047f3
push dword [0x4047ef]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404801]
push 0x4047ff
push dword [0x4047fb]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x401692
cmp byte [0x404e74], 1
je 0x401520
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x40480f]
push 0x404809
push dword [0x404805]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40481a]
push 0x404817
push dword [0x404813]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404825]
push 0x404822
push dword [0x40481e]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40482f]
push 0x40482d
push dword [0x404829]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40483b]
push 0x404837
push dword [0x404833]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404847]
push 0x404843
push dword [0x40483f]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404855]
push 0x40484f
push dword [0x40484b]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404863]
push 0x40485d
push dword [0x404859]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40486e]
push 0x40486b
push dword [0x404867]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404879]
push 0x404876
push dword [0x404872]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4016d6
cmp byte [0x404e74], 1
je 0x4016b1
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404882]
push 0x404881
push dword [0x40487d]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4017fc
cmp byte [0x404e74], 1
je 0x4016f9
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x40488c]
push 0x40488a
push dword [0x404886]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404895]
push 0x404894
push dword [0x404890]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4048a0]
push 0x40489d
push dword [0x404899]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4048aa]
push 0x4048a8
push dword [0x4048a4]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4048b8]
push 0x4048b2
push dword [0x4048ae]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4048c6]
push 0x4048c0
push dword [0x4048bc]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4048d4]
push 0x4048ce
push dword [0x4048ca]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x40188e
cmp byte [0x404e74], 1
je 0x40181f
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x4048e5]
push 0x4048dc
push dword [0x4048d8]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4048f3]
push 0x4048ed
push dword [0x4048e9]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404900]
push 0x4048fb
push dword [0x4048f7]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x401920
cmp byte [0x404e74], 1
je 0x4018b1
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404911]
push 0x404908
push dword [0x404904]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40491f]
push 0x404919
push dword [0x404915]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40492c]
push 0x404927
push dword [0x404923]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x401a90
cmp byte [0x404e74], 1
je 0x401943
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x40493a]
push 0x404934
push dword [0x404930]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404948]
push 0x404942
push dword [0x40493e]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404955]
push 0x404950
push dword [0x40494c]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404963]
push 0x40495d
push dword [0x404959]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404971]
push 0x40496b
push dword [0x404967]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40497e]
push 0x404979
push dword [0x404975]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40498c]
push 0x404986
push dword [0x404982]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x40499a]
push 0x404994
push dword [0x404990]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4049a7]
push 0x4049a2
push dword [0x40499e]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x401b22
cmp byte [0x404e74], 1
je 0x401ab3
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x4049b5]
push 0x4049af
push dword [0x4049ab]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4049c3]
push 0x4049bd
push dword [0x4049b9]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4049d0]
push 0x4049cb
push dword [0x4049c7]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x401bb4
cmp byte [0x404e74], 1
je 0x401b45
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x4049de]
push 0x4049d8
push dword [0x4049d4]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4049ec]
push 0x4049e6
push dword [0x4049e2]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x4049f9]
push 0x4049f4
push dword [0x4049f0]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x402311
cmp byte [0x404e74], 1
je 0x401bd7
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404a07]
push 0x404a01
push dword [0x4049fd]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a15]
push 0x404a0f
push dword [0x404a0b]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a20]
push 0x404a1d
push dword [0x404a19]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a2e]
push 0x404a28
push dword [0x404a24]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a3c]
push 0x404a36
push dword [0x404a32]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a4d]
push 0x404a44
push dword [0x404a40]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a5b]
push 0x404a55
push dword [0x404a51]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a65]
push 0x404a63
push dword [0x404a5f]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a74]
push 0x404a6d
push dword [0x404a69]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a85]
push 0x404a7c
push dword [0x404a78]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a93]
push 0x404a8d
push dword [0x404a89]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404a9d]
push 0x404a9b
push dword [0x404a97]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404aac]
push 0x404aa5
push dword [0x404aa1]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404abd]
push 0x404ab4
push dword [0x404ab0]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404acb]
push 0x404ac5
push dword [0x404ac1]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404ad5]
push 0x404ad3
push dword [0x404acf]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404ae4]
push 0x404add
push dword [0x404ad9]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404af5]
push 0x404aec
push dword [0x404ae8]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b03]
push 0x404afd
push dword [0x404af9]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b0d]
push 0x404b0b
push dword [0x404b07]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b1c]
push 0x404b15
push dword [0x404b11]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b2d]
push 0x404b24
push dword [0x404b20]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b3b]
push 0x404b35
push dword [0x404b31]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b45]
push 0x404b43
push dword [0x404b3f]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b54]
push 0x404b4d
push dword [0x404b49]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b65]
push 0x404b5c
push dword [0x404b58]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b73]
push 0x404b6d
push dword [0x404b69]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b7d]
push 0x404b7b
push dword [0x404b77]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b8c]
push 0x404b85
push dword [0x404b81]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404b9a]
push 0x404b94
push dword [0x404b90]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404ba8]
push 0x404ba2
push dword [0x404b9e]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404bb4]
push 0x404bb0
push dword [0x404bac]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404bbe]
push 0x404bbc
push dword [0x404bb8]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404bcc]
push 0x404bc6
push dword [0x404bc2]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404bda]
push 0x404bd4
push dword [0x404bd0]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404be6]
push 0x404be2
push dword [0x404bde]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404bf0]
push 0x404bee
push dword [0x404bea]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404bfe]
push 0x404bf8
push dword [0x404bf4]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c0c]
push 0x404c06
push dword [0x404c02]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c16]
push 0x404c14
push dword [0x404c10]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c20]
push 0x404c1e
push dword [0x404c1a]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c2a]
push 0x404c28
push dword [0x404c24]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c38]
push 0x404c32
push dword [0x404c2e]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c46]
push 0x404c40
push dword [0x404c3c]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c52]
push 0x404c4e
push dword [0x404c4a]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c5c]
push 0x404c5a
push dword [0x404c56]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c6a]
push 0x404c64
push dword [0x404c60]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c78]
push 0x404c72
push dword [0x404c6e]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c84]
push 0x404c80
push dword [0x404c7c]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404c8e]
push 0x404c8c
push dword [0x404c88]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x40245c
cmp byte [0x404e74], 1
je 0x402334
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404c9f]
push 0x404c96
push dword [0x404c92]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404cad]
push 0x404ca7
push dword [0x404ca3]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404cb7]
push 0x404cb5
push dword [0x404cb1]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404cc6]
push 0x404cbf
push dword [0x404cbb]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404cd7]
push 0x404cce
push dword [0x404cca]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404ce5]
push 0x404cdf
push dword [0x404cdb]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404cef]
push 0x404ced
push dword [0x404ce9]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404cfe]
push 0x404cf7
push dword [0x404cf3]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4024a0
cmp byte [0x404e74], 1
je 0x40247b
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404d07]
push 0x404d06
push dword [0x404d02]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4024e4
cmp byte [0x404e74], 1
je 0x4024bf
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404d10]
push 0x404d0f
push dword [0x404d0b]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x402528
cmp byte [0x404e74], 1
je 0x402503
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404d19]
push 0x404d18
push dword [0x404d14]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x40256c
cmp byte [0x404e74], 1
je 0x402547
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404d22]
push 0x404d21
push dword [0x404d1d]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4025b0
cmp byte [0x404e74], 1
je 0x40258b
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404d2b]
push 0x404d2a
push dword [0x404d26]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4025f4
cmp byte [0x404e74], 1
je 0x4025cf
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404d34]
push 0x404d33
push dword [0x404d2f]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x402638
cmp byte [0x404e74], 1
je 0x402613
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404d3e]
push 0x404d3c
push dword [0x404d38]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4026a1
cmp byte [0x404e74], 1
je 0x402657
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404d4c]
push 0x404d46
push dword [0x404d42]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404d5a]
push 0x404d54
push dword [0x404d50]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4027c7
cmp byte [0x404e74], 1
je 0x4026c4
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404d68]
push 0x404d62
push dword [0x404d5e]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404d76]
push 0x404d70
push dword [0x404d6c]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404d84]
push 0x404d7e
push dword [0x404d7a]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404d92]
push 0x404d8c
push dword [0x404d88]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404da0]
push 0x404d9a
push dword [0x404d96]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404dae]
push 0x404da8
push dword [0x404da4]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404dbc]
push 0x404db6
push dword [0x404db2]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x40280b
cmp byte [0x404e74], 1
je 0x4027e6
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404dca]
push 0x404dc4
push dword [0x404dc0]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x4029a0
cmp byte [0x404e74], 1
je 0x40282e
call fcn.00402af7
jmp 0x402a16
push 0
push word [0x404e69]
push dword [0x404dd8]
push 0x404dd2
push dword [0x404dce]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404de6]
push 0x404de0
push dword [0x404ddc]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404df4]
push 0x404dee
push dword [0x404dea]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404e02]
push 0x404dfc
push dword [0x404df8]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404e10]
push 0x404e0a
push dword [0x404e06]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404e1e]
push 0x404e18
push dword [0x404e14]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404e2c]
push 0x404e26
push dword [0x404e22]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404e3a]
push 0x404e34
push dword [0x404e30]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404e48]
push 0x404e42
push dword [0x404e3e]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404e56]
push 0x404e50
push dword [0x404e4c]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0x2b
call sub.USER32.dll_GetAsyncKeyState
cmp eax, 0
je 0x402a16
cmp byte [0x404e74], 1
je 0x4029bc
call fcn.00402af7
jmp 0x402a16
cmp byte [0x404e68], 0
jne 0x4029ea
push 0
push word [0x404e69]
push dword [0x404e64]
push 0x404e5e
push dword [0x404e5a]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
push 0
push word [0x404e69]
push dword [0x404e64]
push 0x404e5e
push dword [0x404e5a]
push dword [0x404ec0]
call sub.KERNEL32.dll_WriteProcessMemory
mov byte [0x404e68], 1
jmp 0x402aee
cmp dword [ebp + 0xc], 0x111
jne 0x402ae5
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0x14], 0
jne 0x402a36
jmp 0x402aee
mov edx, dword [ebp + 0x10]
shr edx, 0x10
or dx, dx
jne 0x402ae3
cmp ax, 0x65
jne 0x402a91
push 0x404ec0
push 0x404e7c
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
push str.tmnt.exe
call sub.KERNEL32.dll_CreateProcessA
cmp eax, 0
jne 0x402a88
push 0x40
push str.ERROR
push str.Cannot_find_the_game_n__________________________nPlace_the_trainer.exe_to__nyour_game_directory
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
jmp 0x402a8f
mov byte [0x404e74], 1
jmp 0x402ae3
cmp ax, 0x66
jne 0x402aad
push 0x40
push str.Info
push str.Title..........:_TEENAGE_MUTANT_NINJA_TURTLES_nVersion......:_1.0____________________nGFX..........:_Asphyx__Kenet_____________nTrainer......:_DANG
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
jmp 0x402ae3
cmp ax, 0x67
jne 0x402ac9
push 0x40
push str.Info
push str.You_think_you_can_contribute_to_the_scene_too__You_have_one_or_more_ntalents_in:_n__n__suppliers_who_work_for_any_software_shops_stores_like:_nElectronic_Boutique__Babbages__GAME__HMV__Dixons__Virgin_or_nany_software_place_at_all__n__n__suppliers_for_new_unreleased_store_shop_games_that_have_access_to_a_nfast_upload_300k_internet_connection._n__n__network_or_security_administrators_on_fast_10mb_plus_internet_links__nwho_have_full_control_and_responsibility_over_their_fast_links._n__n__supplying_new_unreleased_games__maybe_you_work_at_a_game_util_nmagazine__courier_delivery_firm__newspaper__game_press_marketing_ncompany__distributor__publisher__duplicator__tv_radio_show__shop__nwarehouse__design_firm__language_translation_company__packing_company_nstore_etc_._No_need_for_a_fast_internet_connection_for_this___n__n__you_are_a_coder_who_can_code_your_own_tools_to_automatically_remove_ncommercial_iso_protections_like_the_latest_versions_of_any_of_the_nfollowing:_SafeDisc_or_Securom_or_Tages_or_VOB_or_Laserlok_or_nStarForce._n__n__are_you_able_to_write_your_own_source_code_to_unpack__repack_ncustom_game_related_file_formats._n__nIf_you_can_meet_one_or_more_of_our_above_requests_and_want_to_be_a_part_nof_the_fun_today__e_mail_us._Use_the_contact_information_given_below._n__n________________________________apply_apcsupply.org________________________n
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
jmp 0x402ae3
cmp ax, 0xbba
jne 0x402ae3
push 0
push 0x7d02
push 0x111
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
jmp 0x402aee
mov eax, 0
leave
ret 0x10
mov eax, 1
leave
ret 0x10