Function at 0x40b430
Capabilities:
Check for time delay via gettickcount
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x43300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x80
lea eax, [ebp - 0xe8]
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x164], ebx
push 0
push eax
mov dword [ebp - 0x140], esi
call sub.VCRUNTIME140.dll_memset
mov al, byte [esi + 4]
add esp, 0xc
mov byte [ebp - 0x111], al
movzx eax, al
cmp eax, 0xb
ja case.default.0x40b481
jmp dword [eax*4 + 0x40bf68]
mov word [ebp - 0x110], 0x5c1
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x40b4a5
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x10e], al
mov al, byte [ebp - 0x111]
mov byte [ebp - 0x10c], al
lea eax, [ebp - 0x110]
push 5
push eax
push ebx
mov byte [ebp - 0x10d], 3
call fcn.00418270
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423570
mov esp, ebp
pop ebp
ret
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40b563
movups xmm0, xmmword [ebp - 0x150]
push str.DUMP_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x160]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.DUMP_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40b604
movups xmm0, xmmword [ebp - 0x160]
push str.EXECUTABLE_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.EXECUTABLE_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40b6a5
movups xmm0, xmmword [ebp - 0x160]
push str.FILE_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.FILE_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40b746
movups xmm0, xmmword [ebp - 0x160]
push str.FILE_MAPPING_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.FILE_MAPPING_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40b7e7
movups xmm0, xmmword [ebp - 0x160]
push str.LIBRARY_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.LIBRARY_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40b888
movups xmm0, xmmword [ebp - 0x160]
push str.REGISTRY_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.REGISTRY_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40b929
movups xmm0, xmmword [ebp - 0x160]
push str.MEMORY_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.MEMORY_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40b9ca
movups xmm0, xmmword [ebp - 0x160]
push str.WINDOW_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.WINDOW_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40ba6b
movups xmm0, xmmword [ebp - 0x160]
push str.MACRO_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.MACRO_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40bb0c
movups xmm0, xmmword [ebp - 0x160]
push str.DEBUGGER_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.DEBUGGER_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40bbad
movups xmm0, xmmword [ebp - 0x160]
push str.KERNEL_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc5d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.KERNEL_DETECTION
jmp 0x40bc5d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x581348]
mov eax, dword [edi + 0x581368]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x581358]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x43334c]
cmp eax, dword [0x433350]
je 0x40bc46
movups xmm0, xmmword [ebp - 0x160]
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x43334c], 0x28
jmp 0x40bc58
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x433348
call fcn.0040cce0
push str.DEFAULT_DETECTION
lea eax, [ebp - 0xe8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x108], xmm0
movups xmmword [ebp - 0xf8], xmm0
push str..Settings.ini
push 0x20
push eax
push 0x427990
push 0x428420
push str.SilentGameGuardInfo
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x64], xmm0
movups xmmword [ebp - 0x54], xmm0
call esi
push str..Settings.ini
push 0x20
lea eax, [ebp - 0x24]
push eax
push 0x427990
push str.DataBase
push str.SilentGameGuardInfo
call esi
push str..Settings.ini
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x427990
push str.User
push str.SilentGameGuardInfo
call esi
push str..Settings.ini
push 0x20
lea eax, [ebp - 0x64]
push eax
push 0x427990
push str.Pass
push str.SilentGameGuardInfo
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str.._Settings.ini
push 0
push str.AutoBlock
push str.SilentGameGuardInfo
call esi
push str.._Settings.ini
push 0
push str.Days
push str.SilentGameGuardInfo
mov dword [ebp - 0x16c], eax
call esi
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 0x168], eax
mov word [ebp - 0x110], 0x5c1
mov bl, byte [ecx + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x40bd6d
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x10e], al
lea eax, [ebp - 0x110]
push 5
push eax
push dword [ebp - 0x164]
mov byte [ebp - 0x10d], 3
mov byte [ebp - 0x10c], bl
call fcn.00418270
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [ebp - 0x24]
push eax
push 0x20
push 0x4407f0
call esi
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push 0x20
push 0x440810
call esi
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
push 0x20
push 0x440830
call esi
mov esi, dword [sym.imp.ODBC32.dll_SQLAllocHandle]
add esp, 0xc
push 0x4407e8
push dword [0x4407e4]
push 2
call esi
test ax, 0xfffe
jne 0x40be21
push 0xfffffffffffffffd
push 0x440830
push 0xfffffffffffffffd
push 0x440810
push 0xfffffffffffffffd
push 0x4407f0
push dword [0x4407e8]
call dword [sym.imp.ODBC32.dll_SQLConnect]
test ax, 0xfffe
jne 0x40be21
push 0x4407ec
push dword [0x4407e8]
push 3
call esi
test ax, 0xfffe
je 0x40be30
push str._Silent_GameGuard_____DataBase__:_Cannot_connect_
push 1
call fcn.00419440
add esp, 8
mov eax, dword [ebp - 0x140]
lea ebx, [edi + 0x581348]
mov dword [ebp - 0x140], ebx
lea edi, [edi + 0x58132c]
lea ecx, [eax + 0x5b]
push ecx
lea edx, [eax + 0x1b]
mov dword [ebp - 0x164], ecx
push edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0x110], edx
lea esi, [eax + 5]
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x140]
push edi
push ebx
push esi
push str.INSERT_INTO_SGG_HISTORY_DETECTIONS__Account__Player__IpAddress__HardwareId__DetectionType__CaptionName__Date__VALUES___s__s__s__s__s__s_getdate___
push 0x4407e0
call fcn.00410790
add esp, 0x24
lea eax, [ebp - 0xe8]
push eax
push edi
push ebx
push esi
push str._Silent_GameGuard_____HackDetected__:_Account:___s___Player:___s___IpAddress:__s__DetectionType:__s
push 1
call fcn.00419440
push str._Silent_GameGuard_____HackDetected__:_Hack_Log_History_updated_Successfully
push 1
call fcn.00419440
add esp, 0x20
cmp dword [ebp - 0x16c], 1
jne 0x40bf56
mov eax, dword [ebp - 0x168]
push esi
test eax, eax
je 0x40beea
push eax
push str.UPDATE_Character_SET_UnBanDate__DATEADD_DAY___d__getdate____CtlCode__1_WHERE_AccountID___s
push 0x4407e0
call fcn.00410790
mov eax, dword [ebp - 0x168]
push eax
push esi
push str._Silent_GameGuard_____HackDetected__:_Account:___s__Characters_Blocked_For___d__Days_Successfully
push 1
call fcn.00419440
add esp, 0x20
jmp 0x40bf0c
push str.UPDATE_Character_SET_CtlCode__1_WHERE_AccountID___s
push 0x4407e0
call fcn.00410790
add esp, 0xc
push esi
push str._Silent_GameGuard_____HackDetected__:_Account:___s__Game_Characters_Banned_Permanently_Successfully
push 1
call fcn.00419440
add esp, 0xc
push dword [0x4407ec]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x4407ec]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push dword [ebp - 0x164]
lea eax, [ebp - 0xe8]
push dword [ebp - 0x110]
push eax
push dword [ebp - 0x140]
push edi
push ebx
push esi
push str._Silent_GameGuard_____HackDetected___Account:___s___Player:___s__IpAddress:__s__HardwareId:__s__DetectionType:__s__CaptionName:__s__ProcessName:__s
push 1
push 0x433390
call fcn.0040df10
add esp, 0x28
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00423570
mov esp, ebp
pop ebp
ret