Function at 0x40a4b0
Capabilities:
Check for time delay via gettickcount
Hide graphical window
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
mov eax, dword [0x43300c]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, dl
push edi
mov edi, ecx
mov dword [esp + 0x18], esi
imul eax, edi, 0x6c
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x50de48], 0
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x581388], eax
movzx ecx, bl
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x40a522
lea eax, [ebx + 0x58132c]
push eax
push ecx
push str.header:_0x_x__ip_addr:__s
push 1
call fcn.00419440
mov ecx, dword [esp + 0x24]
add esp, 0x10
cmp ecx, 0x18
ja case.0x40a532.2
movzx eax, byte [ecx + 0x40ade0]
jmp dword [eax*4 + 0x40adb0]
mov edx, edi
mov ecx, esi
call fcn.0040ae00
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
mov word [esp + 0x10], 0x4c1
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x40a572
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x12], al
lea eax, [esp + 0x10]
push 4
push eax
push edi
mov byte [esp + 0x1f], 1
call fcn.00418270
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x581384], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
mov edx, edi
mov ecx, esi
call fcn.0040b430
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
cmp dword [0x50979c], edi
jne 0x40ad99
cmp dword [esi + 0x10], 0
jne 0x40a5ed
mov eax, dword [0x50976c]
xor ecx, ecx
mov dword [0x509770], eax
mov dword [0x509784], ecx
jmp 0x40a5f3
mov ecx, dword [0x60517c]
inc ecx
cmp dword [esi + 8], 0
mov dword [0x60517c], ecx
jle 0x40ad99
mov eax, 0xffffffec
lea ebx, [esi + 0x14]
sub eax, esi
mov dword [esp + 0x10], eax
mov ecx, dword [0x509770]
cmp ecx, dword [0x509774]
je 0x40a62c
mov al, byte [ebx]
mov byte [ecx], al
inc dword [0x509770]
jmp 0x40a638
push ebx
push ecx
mov ecx, 0x50976c
call fcn.004136e0
mov edi, dword [0x509770]
mov eax, edi
mov edx, dword [0x50976c]
sub eax, edx
inc dword [0x509784]
mov dword [esp + 0x14], edx
cmp eax, dword [esi + 0xc]
jne 0x40a6e8
mov ecx, dword [0x509778]
sub edi, edx
mov eax, dword [0x509780]
sub eax, ecx
mov dword [esp + 0x18], ecx
mov dword [0x50977c], ecx
cmp edi, eax
jbe 0x40a691
push edi
mov ecx, 0x509778
call fcn.00413820
mov ecx, dword [0x509778]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
push edi
push edx
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [esp + 0x24]
add esp, 0xc
add eax, edi
mov byte [0x509798], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x50977c], eax
call edi
sub eax, dword [0x5097b0]
cmp eax, 0x3e8
jae 0x40a6cb
inc dword [0x5097a8]
jmp 0x40a6ea
call edi
mov dword [0x5097b0], eax
mov eax, dword [0x5097a8]
mov dword [0x5097ac], eax
mov dword [0x5097a8], 0
jmp 0x40a6ea
jae 0x40a70f
mov eax, dword [esp + 0x10]
inc ebx
add eax, ebx
cmp eax, dword [esi + 8]
jl 0x40a612
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
push str._ScreenShow__ERROR__Buffer_length_bigger_then_expected_size_
push 1
call fcn.00419440
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
cmp edi, dword [0x50979c]
jne 0x40ad99
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call esi
push 0xa
push edi
mov dword [esp + 0x1c], eax
call esi
push edi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
cmp eax, ecx
jle 0x40a78c
cmp esi, dword [ebx + 8]
jle 0x40a78c
mov dword [0x5097a0], ecx
mov eax, dword [ebx + 8]
mov dword [0x5097a4], eax
jmp 0x40a7a1
mov dword [0x5097a0], eax
mov dword [0x5097a4], esi
mov dword [0x5097b8], 0x64
mov al, byte [ebx + 0xc]
push 0x401
push dword [0x50978c]
mov byte [0x5097bc], al
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
push 0
push 0
push 0x14b
push edi
call ebx
xor esi, esi
cmp byte [0x5097bc], 0
jbe 0x40a80e
nop dword [eax]
inc esi
lea eax, [esp + 0x60]
push esi
push str.Display:__d
push eax
call fcn.00401700
add esp, 0xc
lea eax, [esp + 0x60]
push eax
push 0
push 0x143
push edi
call ebx
movzx eax, byte [0x5097bc]
cmp esi, eax
jl 0x40a7e0
push 0
push 0
push 0x14e
push edi
call ebx
mov eax, dword [0x5097a4]
push 1
add eax, 0x1e
mov byte [0x509788], 1
push eax
push dword [0x5097a0]
push 0
push 0
push dword [0x50978c]
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push dword [0x50978c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
cmp byte [esi + 6], 1
jne 0x40a8ca
push 0
push 0
push 0x1009
push dword [0x433364]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x433378]
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x427990
push 0x3f5
push dword [0x433368]
mov dword [0x43337c], eax
call esi
push 0x427990
push 0x3f6
push dword [0x433368]
call esi
push 0x427990
push 0x3f7
push dword [0x433368]
call esi
mov esi, dword [esp + 0x18]
cmp edi, dword [0x43335c]
je 0x40a8e2
xor ecx, ecx
mov dword [0x43335c], edi
mov dword [0x433360], ecx
jmp 0x40a8e8
mov ecx, dword [0x433360]
cmp byte [esi + 5], 0
mov dword [esp + 0x14], 0
jbe 0x40aa2e
mov ebx, dword [esp + 0x18]
lea edx, [esi + 7]
mov dword [esp + 0x10], edx
nop word [eax + eax]
mov eax, dword [0x43337c]
cmp eax, dword [0x433380]
je 0x40a934
mov ecx, 0x4a
mov esi, edx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
add dword [0x43337c], 0x128
jmp 0x40a940
push edx
push eax
mov ecx, 0x433378
call fcn.0040fb10
push 0
push 0
push 0x1004
push dword [0x433364]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [esp + 0x10]
mov edi, eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 0
add esi, 0x24
mov dword [esp + 0x40], 0x32
push 0x1007
push dword [0x433364]
mov dword [esp + 0x34], edi
lea ecx, [esi - 0x20]
mov dword [esp + 0x38], 0
mov dword [esp + 0x44], ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
push dword [eax]
lea eax, [esp + 0x58]
push 0x427998
push eax
call fcn.00401700
add esp, 0xc
mov dword [esp + 0x68], 1
lea eax, [esp + 0x54]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x60]
push eax
push edi
push 0x102e
push dword [0x433364]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x60]
mov dword [esp + 0x68], 2
push eax
push edi
push 0x102e
push dword [0x433364]
mov dword [esp + 0x84], esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x433360]
mov edi, dword [esp + 0x14]
inc ecx
mov edx, dword [esp + 0x10]
inc edi
mov dword [0x433360], ecx
add edx, 0x128
movzx eax, byte [ebx + 5]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edx
cmp edi, eax
jl 0x40a910
push ecx
lea eax, [esp + 0xa4]
push str.Total_process:__d
push eax
call fcn.00401700
add esp, 0xc
lea eax, [esp + 0xa0]
push eax
push dword [0x433368]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
push dword [0x433354]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40aaeb
add esi, 5
sub esp, 0x18
mov edx, esp
mov ecx, esi
mov dword [edx], 0
lea edi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40aaa8
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.00401960
call fcn.00418de0
add esp, 0x18
push 0x40
push str.INFO
push str.Dump_data_successfully_copied_to_clipboard_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
push 0x10
push str.INFO
push str.Cant_open_clipboard_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x10], 0
jne 0x40ab38
mov eax, dword [0x6050d0]
xor ecx, ecx
mov dword [0x6050d4], eax
mov eax, dword [0x6050dc]
mov dword [0x6050e0], eax
mov dword [0x6050e8], ecx
jmp 0x40ab3e
mov ecx, dword [0x605178]
inc ecx
cmp dword [esi + 8], 0
mov dword [0x605178], ecx
jle 0x40ad99
mov eax, 0xffffffec
lea ebx, [esi + 0x14]
sub eax, esi
mov dword [esp + 0x10], eax
nop dword [eax]
mov ecx, dword [0x6050d4]
cmp ecx, dword [0x6050d8]
je 0x40ab7a
mov al, byte [ebx]
mov byte [ecx], al
inc dword [0x6050d4]
jmp 0x40ab86
push ebx
push ecx
mov ecx, 0x6050d0
call fcn.004136e0
mov edi, dword [0x6050d4]
mov eax, edi
mov edx, dword [0x6050d0]
sub eax, edx
inc dword [0x6050e8]
mov dword [esp + 0x18], edx
cmp eax, dword [esi + 0xc]
jne 0x40abff
mov ecx, dword [0x6050dc]
sub edi, edx
mov eax, dword [0x6050e4]
sub eax, ecx
mov dword [esp + 0x14], ecx
mov dword [0x6050e0], ecx
cmp edi, eax
jbe 0x40abdb
push edi
mov ecx, 0x6050dc
call fcn.00413820
mov ecx, dword [0x6050dc]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
push edi
push edx
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [esp + 0x20]
add esp, 0xc
add eax, edi
mov dword [0x6050e0], eax
push dword [esp + 0x1c]
sub esp, 8
call fcn.004132e0
jmp 0x40ac10
jb 0x40ac10
push str.ERROR__Buffer_length_bigger_then_expected_size_
push 2
call fcn.00419440
add esp, 8
mov eax, dword [esp + 0x10]
inc ebx
add eax, ebx
cmp eax, dword [esi + 8]
jl 0x40ab60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
movq xmm0, qword [esi + 4]
movq qword [ebx + 0x58136c], xmm0
movzx eax, word [esi + 0xc]
mov word [ebx + 0x581374], ax
movzx eax, byte [esi + 0xe]
mov byte [ebx + 0x581376], al
movq xmm0, qword [esi + 0xf]
movq qword [ebx + 0x581377], xmm0
movzx eax, word [esi + 0x17]
mov word [ebx + 0x58137f], ax
movzx eax, byte [esi + 0x19]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ea
push dword [0x60508c]
mov byte [ebx + 0x581381], al
call esi
push 0x3ed
push dword [0x60508c]
call esi
push 0
push 0
push 0x188
push eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x40acb6
xor eax, eax
jmp 0x40acd0
push 0
push eax
push 0x199
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_SendMessageA]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
cmp eax, edi
je 0x40acf8
push str._AccountInfo__Error._Incorrect_Index_
push 1
call fcn.00419440
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
push 0x3fa
push dword [0x60508c]
call esi
push 0x3fb
push dword [0x60508c]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebx + 0x58136c]
mov edi, eax
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
call esi
lea ecx, [ebx + 0x581377]
push ecx
push edi
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
push esi
call fcn.0040ed20
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
push esi
call fcn.0040ef70
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret
push str.Detect_Wrong_Packet
push 1
call fcn.00419440
add esp, 8
mov ecx, 0x50df60
push edi
call fcn.004184a0
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00423570
mov esp, ebp
pop ebp
ret