Function at 0x576511e0
Capabilities:
Check for time delay via gettickcount
Read .ini file
Read file on windows

Disassembly:
mov eax, 0x3460
call fcn.576616a0
mov al, byte [0x576876ec]
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov byte [esp + 0x32c], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x32d]
rep stosd dword es:[edi], eax
mov cx, word [0x576876e8]
mov edx, dword [esp + 0x3474]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov word [esp + 0x1470], cx
mov ecx, 0x7ff
xor eax, eax
lea edi, [esp + 0x1472]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
lea eax, [esp + 0x330]
push str..pipe_s
push eax
mov dword [esp + 0x24], ebx
call sub.MSVCRT.dll_sprintf
mov eax, dword [0x5768a0d4]
add esp, 0xc
cmp eax, 5
jb 0x576513f5
push str.GlobalSecuPrintShareMemory
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
test esi, esi
mov dword [esp + 0x1c], esi
jne 0x57651297
push str.HOOK
call fcn.57653a20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3460
ret 4
push 0x62208
push 0
push 0
push 0xf001f
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x576512d5
push 0x57683218
call fcn.57653a20
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3460
ret 4
call fcn.5765f2c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], eax
xor ebp, ebp
lea esi, [ebx + 0x2104]
mov dword [esp + 0x14], ebp
lea edi, [ebx + 4]
mov ecx, dword [esp + 0x3474]
push edi
push ecx
call fcn.576611e0
add esp, 8
test eax, eax
jne 0x5765130d
cmp dword [esi], 3
je 0x57651322
inc ebp
add esi, 4
add edi, 0x104
cmp ebp, 0x20
jl 0x576512f3
mov esi, dword [esp + 0x14]
jmp 0x5765134c
mov edx, ebp
mov ecx, 0x800
shl edx, 0xd
lea edi, [esp + 0x1470]
lea esi, [edx + ebx + 0x2184]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + ebp*4 + 0x2104], 4
mov esi, 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esp + 0x10]
cmp eax, 0x2710
ja 0x5765137d
mov ecx, dword [esp + 0x18]
call fcn.57652040
test eax, eax
je 0x57651372
call edi
mov dword [esp + 0x10], eax
xor ebp, ebp
cmp esi, ebp
jne 0x576513d8
jmp 0x576512e4
lea esi, [ebx + 0x2104]
lea edi, [ebx + 4]
mov ebp, 0x20
mov eax, dword [esp + 0x3474]
push edi
push eax
call fcn.576611e0
add esp, 8
test eax, eax
jne 0x576513a6
mov dword [esi], 0xf
add esi, 4
add edi, 0x104
dec ebp
jne 0x5765138b
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.5765f2d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3460
ret 4
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.5765f2d0
mov ebx, dword [esp + 0x18]
jmp 0x57651458
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 3
push 0
push 0
lea eax, [esp + 0x340]
push SysReAllocStringLen
push eax
call fcn.57661420
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x57651434
push 0x64
call edi
push 0x57683208
call fcn.57653a20
add esp, 4
jmp 0x576513fb
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x1478]
push 0x2000
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
cmp word [esp + 0x1470], 0x53
je 0x5765147d
mov eax, dword [esp + 0x1470]
and eax, 0xffff
push eax
push str.ptr__s___LS
call fcn.57653a20
add esp, 8
mov cx, word [0x576876e8]
xor eax, eax
mov word [esp + 0x430], cx
mov ecx, 0x81
lea edi, [esp + 0x432]
mov edx, dword [esp + 0x147a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x430]
push 0x576831f0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x434]
mov dword [esp + 0x434], edx
push eax
call sub.MSVCRT.dll_wcscmp
add esp, 8
test eax, eax
jne 0x57651598
push 0x576831e4
call fcn.57653a20
mov cx, word [0x576876e8]
xor eax, eax
mov word [esp + 0x128], cx
mov ecx, 0x81
lea edi, [esp + 0x12a]
add esp, 4
rep stosd dword es:[edi], eax
lea edx, [esp + 0x147e]
xor esi, esi
push edx
push str.GetAuthData_strBuf:__s
stosw word es:[edi], ax
call fcn.57653a20
add esp, 8
lea eax, [esp + 0x124]
lea ecx, [esp + 0x147e]
push eax
push ecx
mov ecx, ebx
call fcn.57651040
test eax, eax
je 0x5765156d
lea edx, [esp + 0x124]
push edx
push str.GetAuthData_strCode:__s
call fcn.57653a20
lea eax, [esp + 0x12c]
push 0x576831ac
push eax
call sub.MSVCRT.dll_wcscmp
add esp, 0x10
test eax, eax
jne 0x5765156d
mov dword [ebx + 4], 1
jmp 0x57651570
mov dword [ebx + 4], ebp
mov ecx, dword [ebx + 4]
lea edx, [esp + 0x124]
push ecx
push edx
push str.GetAuthData_GetParserErrLog:__s___m_bConnect__d
call fcn.57653a20
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3460
ret 4
lea eax, [esp + 0x430]
push 0x57683174
push eax
call sub.MSVCRT.dll_wcscmp
add esp, 8
test eax, eax
jne 0x57651647
mov ecx, 0x3d4
mov edi, 0x57687878
rep stosd dword es:[edi], eax
push 0x57687878
mov ecx, 0x57689480
call fcn.5765dfc0
mov ecx, 0x41
xor eax, eax
mov edi, 0x57688950
push 0x57687aa4
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x57688b58
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x57688d60
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x57688f68
push 0x5768316c
push 0x57688950
rep stosd dword es:[edi], eax
call sub.MSVCRT.dll_swprintf
add esp, 0xc
push 0x576879b4
push 0x5768316c
push 0x57688d60
call sub.MSVCRT.dll_swprintf
add esp, 0xc
mov esi, 1
mov eax, esi
mov dword [ebx + 4], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3460
ret 4
lea ecx, [esp + 0x430]
push 0x57683164
push ecx
call sub.MSVCRT.dll_wcscmp
add esp, 8
test eax, eax
jne 0x57651717
mov ecx, 0x3d4
mov edi, 0x57687878
rep stosd dword es:[edi], eax
push 0x57687878
mov ecx, 0x57689480
call fcn.5765dfc0
mov ecx, 0x41
xor eax, eax
mov edi, 0x57688950
push 0x57687aa4
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x57688b58
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x57688d60
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x57688f68
push 0x5768316c
push 0x57688950
rep stosd dword es:[edi], eax
call sub.MSVCRT.dll_swprintf
add esp, 0xc
push 0x576879b4
push 0x5768316c
push 0x57688d60
call sub.MSVCRT.dll_swprintf
mov dx, word [esp + 0x148a]
lea eax, [esp + 0x1c]
mov word [esp + 0x1e], bp
push eax
mov word [esp + 0x20], dx
mov word [esp + 0x22], bp
call sub.MSVCRT.dll__wtoi
add esp, 0x10
mov esi, 1
mov dword [ebx + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3460
ret 4
push 0x57683154
call fcn.57653a20
mov dx, word [0x576876e8]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x846]
mov word [esp + 0x844], dx
mov word [esp + 0x63c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x63e]
mov word [esp + 0xe5c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe5e]
mov word [esp + 0xa4c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa4e]
mov word [esp + 0xc54], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xc56]
mov word [esp + 0x1064], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1066]
mov word [esp + 0x126c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x126e]
add esp, 4
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1268]
lea edx, [esp + 0x1060]
stosw word es:[edi], ax
push ecx
lea eax, [esp + 0xc54]
push edx
lea ecx, [esp + 0xa50]
push eax
lea edx, [esp + 0xe64]
push ecx
lea eax, [esp + 0x648]
push edx
lea ecx, [esp + 0x854]
push eax
lea edx, [esp + 0x1492]
push ecx
push edx
mov ecx, ebx
call fcn.576510a0
test eax, eax
je 0x57651ac2
push str.AuthData_Parsing_OK
call fcn.57653a20
mov al, byte [0x576876ec]
mov ecx, 0x40
mov byte [esp + 0x128], al
xor eax, eax
lea edi, [esp + 0x129]
add esp, 4
rep stosd dword es:[edi], eax
push 0x576894a4
lea ecx, [esp + 0x128]
push 0x104
push ecx
stosw word es:[edi], ax
push 0x576876ec
push 0x57683138
push str.Setup
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x1060]
push 0x576831ac
push edx
call sub.MSVCRT.dll_wcscmp
add esp, 8
test eax, eax
jne 0x576518a5
mov dword [ebx + 4], 1
jmp 0x576518b5
push 0x57683128
call fcn.57653a20
add esp, 4
mov dword [ebx + 4], ebp
lea eax, [esp + 0xa48]
push eax
push 0x5768316c
push 0x57688950
call sub.MSVCRT.dll_swprintf
add esp, 0xc
lea ecx, [esp + 0xc50]
push ecx
push 0x5768316c
push 0x57688b58
call sub.MSVCRT.dll_swprintf
add esp, 0xc
lea edx, [esp + 0x638]
push edx
push 0x5768316c
push 0x57688d60
call sub.MSVCRT.dll_swprintf
add esp, 0xc
lea eax, [esp + 0xe58]
push eax
push 0x5768316c
push 0x57688f68
call sub.MSVCRT.dll_swprintf
add esp, 0xc
lea ecx, [esp + 0x1268]
push ecx
push 0x5768316c
push 0x57689170
call sub.MSVCRT.dll_swprintf
mov dl, byte [0x576876ec]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], dl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x30]
lea ecx, [esp + 0x850]
push eax
push ecx
call fcn.57661030
mov al, byte [esp + 0x13c]
add esp, 0x18
test al, al
jne 0x5765197b
mov al, byte [esp + 0x20]
test al, al
jne 0x57651996
lea edx, [esp + 0x20]
lea eax, [esp + 0x124]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x57651a30
lea ecx, [esp + 0x20]
lea edx, [esp + 0x124]
push ecx
push edx
push str.strOwnerSabeon_blank_or_strOwnerSabeon_:__s__szSabeon_:__s
call fcn.57653a20
mov ecx, 0x3d4
xor eax, eax
mov edi, 0x57687878
add esp, 0xc
rep stosd dword es:[edi], eax
push 0x57687878
mov ecx, 0x57689480
call fcn.5765dfc0
cmp dword [0x57687878], ebp
jne 0x57651a1c
push str.GetCertifyFromServerW
call fcn.57653a20
add esp, 4
lea eax, [esp + 0xc50]
lea ecx, [esp + 0xa48]
lea edx, [esp + 0xe58]
push eax
push ecx
lea eax, [esp + 0x640]
push edx
lea ecx, [esp + 0x84c]
push eax
push ecx
mov ecx, 0x57689480
call fcn.5765e0d0
mov esi, eax
cmp esi, ebp
jne 0x57651a8f
jmp 0x57651a82
push 0x576830bc
call fcn.57653a20
add esp, 4
mov esi, 1
jmp 0x57651a8f
lea edx, [esp + 0x20]
lea eax, [esp + 0x124]
push edx
push eax
push str.strOwnerSabeon_:__s___szSabeon_:__s
call fcn.57653a20
add esp, 0xc
lea ecx, [esp + 0xc50]
lea edx, [esp + 0xa48]
lea eax, [esp + 0xe58]
push ecx
push edx
lea ecx, [esp + 0x640]
push eax
lea edx, [esp + 0x84c]
push ecx
push edx
mov ecx, 0x57689480
call fcn.5765e0d0
mov esi, eax
cmp esi, ebp
jne 0x57651a8f
push str.GetCertifyFromServerW_failed
call fcn.57653a20
add esp, 4
cmp word [0x576883a0], bp
je 0x57651ad1
mov ecx, 0x57689480
call fcn.5765eb00
test eax, eax
jne 0x57651ad1
push str.GetOverlayFile_fail
call fcn.57653a20
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3460
ret 4
push 0x5768305c
call fcn.57653a20
add esp, 4
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3460
ret 4