Function at 0x409bb0
Capabilities:
Check for time delay via gettickcount
Hide graphical window
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
mov eax, dword [0x48b034]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, dl
push edi
mov edi, ecx
mov dword [esp + 0x18], esi
imul eax, edi, 0x6c
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x565e70], 0
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x5d9578], eax
movzx ecx, bl
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
je 0x409c22
lea eax, [ebx + 0x5d951c]
push eax
push ecx
push str.header:_0x_x__ip_addr:__s
push 1
call fcn.00418b60
mov ecx, dword [esp + 0x24]
add esp, 0x10
cmp ecx, 0x18
ja case.0x409c32.2
movzx eax, byte [ecx + 0x40a4e0]
jmp dword [eax*4 + 0x40a4b0]
mov edx, edi
mov ecx, esi
call fcn.0040a500
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
mov word [esp + 0x10], 0x4c1
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x409c72
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x12], al
lea eax, [esp + 0x10]
push 4
push eax
push edi
mov byte [esp + 0x1f], 1
call fcn.00417990
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x5d9574], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
mov edx, edi
mov ecx, esi
call fcn.0040ab40
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
cmp dword [0x5617c4], edi
jne 0x40a499
cmp dword [esi + 0x10], 0
jne 0x409ced
mov eax, dword [0x561794]
xor ecx, ecx
mov dword [0x561798], eax
mov dword [0x5617ac], ecx
jmp 0x409cf3
mov ecx, dword [0x65d36c]
inc ecx
cmp dword [esi + 8], 0
mov dword [0x65d36c], ecx
jle 0x40a499
mov eax, 0xffffffec
lea ebx, [esi + 0x14]
sub eax, esi
mov dword [esp + 0x10], eax
mov ecx, dword [0x561798]
cmp ecx, dword [0x56179c]
je 0x409d2c
mov al, byte [ebx]
mov byte [ecx], al
inc dword [0x561798]
jmp 0x409d38
push ebx
push ecx
mov ecx, 0x561794
call fcn.00412de0
mov edi, dword [0x561798]
mov eax, edi
mov edx, dword [0x561794]
sub eax, edx
inc dword [0x5617ac]
mov dword [esp + 0x14], edx
cmp eax, dword [esi + 0xc]
jne 0x409de8
mov ecx, dword [0x5617a0]
sub edi, edx
mov eax, dword [0x5617a8]
sub eax, ecx
mov dword [esp + 0x18], ecx
mov dword [0x5617a4], ecx
cmp edi, eax
jbe 0x409d91
push edi
mov ecx, 0x5617a0
call fcn.00412f20
mov ecx, dword [0x5617a0]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
push edi
push edx
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [esp + 0x24]
add esp, 0xc
add eax, edi
mov byte [0x5617c0], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x5617a4], eax
call edi
sub eax, dword [0x5617d8]
cmp eax, 0x3e8
jae 0x409dcb
inc dword [0x5617d0]
jmp 0x409dea
call edi
mov dword [0x5617d8], eax
mov eax, dword [0x5617d0]
mov dword [0x5617d4], eax
mov dword [0x5617d0], 0
jmp 0x409dea
jae 0x409e0f
mov eax, dword [esp + 0x10]
inc ebx
add eax, ebx
cmp eax, dword [esi + 8]
jl 0x409d12
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
push str._ScreenShow__ERROR__Buffer_length_bigger_then_expected_size_
push 1
call fcn.00418b60
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
cmp edi, dword [0x5617c4]
jne 0x40a499
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call esi
push 0xa
push edi
mov dword [esp + 0x1c], eax
call esi
push edi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
cmp eax, ecx
jle 0x409e8c
cmp esi, dword [ebx + 8]
jle 0x409e8c
mov dword [0x5617c8], ecx
mov eax, dword [ebx + 8]
mov dword [0x5617cc], eax
jmp 0x409ea1
mov dword [0x5617c8], eax
mov dword [0x5617cc], esi
mov dword [0x5617e0], 0x64
mov al, byte [ebx + 0xc]
push 0x401
push dword [0x5617b4]
mov byte [0x5617e4], al
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
push 0
push 0
push 0x14b
push edi
call ebx
xor esi, esi
cmp byte [0x5617e4], 0
jbe 0x409f0e
nop dword [eax]
inc esi
lea eax, [esp + 0x60]
push esi
push str.Display:__d
push eax
call fcn.004016f0
add esp, 0xc
lea eax, [esp + 0x60]
push eax
push 0
push 0x143
push edi
call ebx
movzx eax, byte [0x5617e4]
cmp esi, eax
jl 0x409ee0
push 0
push 0
push 0x14e
push edi
call ebx
mov eax, dword [0x5617cc]
push 1
add eax, 0x1e
mov byte [0x5617b0], 1
push eax
push dword [0x5617c8]
push 0
push 0
push dword [0x5617b4]
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push dword [0x5617b4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
cmp byte [esi + 6], 1
jne 0x409fca
push 0
push 0
push 0x1009
push dword [0x48b38c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x48b3a0]
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x47b596
push 0x3f5
push dword [0x48b390]
mov dword [0x48b3a4], eax
call esi
push 0x47b597
push 0x3f6
push dword [0x48b390]
call esi
push 0x47b59b
push 0x3f7
push dword [0x48b390]
call esi
mov esi, dword [esp + 0x18]
cmp edi, dword [0x48b384]
je 0x409fe2
xor ecx, ecx
mov dword [0x48b384], edi
mov dword [0x48b388], ecx
jmp 0x409fe8
mov ecx, dword [0x48b388]
cmp byte [esi + 5], 0
mov dword [esp + 0x14], 0
jbe 0x40a12e
mov ebx, dword [esp + 0x18]
lea edx, [esi + 7]
mov dword [esp + 0x10], edx
nop word [eax + eax]
mov eax, dword [0x48b3a4]
cmp eax, dword [0x48b3a8]
je 0x40a034
mov ecx, 0x4a
mov esi, edx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
add dword [0x48b3a4], 0x128
jmp 0x40a040
push edx
push eax
mov ecx, 0x48b3a0
call fcn.0040f210
push 0
push 0
push 0x1004
push dword [0x48b38c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [esp + 0x10]
mov edi, eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 0
add esi, 0x24
mov dword [esp + 0x40], 0x32
push 0x1007
push dword [0x48b38c]
mov dword [esp + 0x34], edi
lea ecx, [esi - 0x20]
mov dword [esp + 0x38], 0
mov dword [esp + 0x44], ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
push dword [eax]
lea eax, [esp + 0x58]
push 0x47e7fc
push eax
call fcn.004016f0
add esp, 0xc
mov dword [esp + 0x68], 1
lea eax, [esp + 0x54]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x60]
push eax
push edi
push 0x102e
push dword [0x48b38c]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x60]
mov dword [esp + 0x68], 2
push eax
push edi
push 0x102e
push dword [0x48b38c]
mov dword [esp + 0x84], esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x48b388]
mov edi, dword [esp + 0x14]
inc ecx
mov edx, dword [esp + 0x10]
inc edi
mov dword [0x48b388], ecx
add edx, 0x128
movzx eax, byte [ebx + 5]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edx
cmp edi, eax
jl 0x40a010
push ecx
lea eax, [esp + 0xa4]
push str.Total_process:__d
push eax
call fcn.004016f0
add esp, 0xc
lea eax, [esp + 0xa0]
push eax
push dword [0x48b390]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
push dword [0x48b37c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40a1eb
add esi, 5
sub esp, 0x18
mov edx, esp
mov ecx, esi
mov dword [edx], 0
lea edi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a1a8
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.00401950
call fcn.00418500
add esp, 0x18
push 0x40
push 0x47e814
push 0x47e81c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
push 0x10
push 0x47e848
push 0x47e850
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x10], 0
jne 0x40a238
mov eax, dword [0x65d2c0]
xor ecx, ecx
mov dword [0x65d2c4], eax
mov eax, dword [0x65d2cc]
mov dword [0x65d2d0], eax
mov dword [0x65d2d8], ecx
jmp 0x40a23e
mov ecx, dword [0x65d368]
inc ecx
cmp dword [esi + 8], 0
mov dword [0x65d368], ecx
jle 0x40a499
mov eax, 0xffffffec
lea ebx, [esi + 0x14]
sub eax, esi
mov dword [esp + 0x10], eax
nop dword [eax]
mov ecx, dword [0x65d2c4]
cmp ecx, dword [0x65d2c8]
je 0x40a27a
mov al, byte [ebx]
mov byte [ecx], al
inc dword [0x65d2c4]
jmp 0x40a286
push ebx
push ecx
mov ecx, 0x65d2c0
call fcn.00412de0
mov edi, dword [0x65d2c4]
mov eax, edi
mov edx, dword [0x65d2c0]
sub eax, edx
inc dword [0x65d2d8]
mov dword [esp + 0x18], edx
cmp eax, dword [esi + 0xc]
jne 0x40a2ff
mov ecx, dword [0x65d2cc]
sub edi, edx
mov eax, dword [0x65d2d4]
sub eax, ecx
mov dword [esp + 0x14], ecx
mov dword [0x65d2d0], ecx
cmp edi, eax
jbe 0x40a2db
push edi
mov ecx, 0x65d2cc
call fcn.00412f20
mov ecx, dword [0x65d2cc]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
push edi
push edx
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [esp + 0x20]
add esp, 0xc
add eax, edi
mov dword [0x65d2d0], eax
push dword [esp + 0x1c]
sub esp, 8
call fcn.004129e0
jmp 0x40a310
jb 0x40a310
push str.ERROR__Buffer_length_bigger_then_expected_size_
push 2
call fcn.00418b60
add esp, 8
mov eax, dword [esp + 0x10]
inc ebx
add eax, ebx
cmp eax, dword [esi + 8]
jl 0x40a260
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
movq xmm0, qword [esi + 4]
movq qword [ebx + 0x5d955c], xmm0
movzx eax, word [esi + 0xc]
mov word [ebx + 0x5d9564], ax
movzx eax, byte [esi + 0xe]
mov byte [ebx + 0x5d9566], al
movq xmm0, qword [esi + 0xf]
movq qword [ebx + 0x5d9567], xmm0
movzx eax, word [esi + 0x17]
mov word [ebx + 0x5d956f], ax
movzx eax, byte [esi + 0x19]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ea
push dword [0x65d27c]
mov byte [ebx + 0x5d9571], al
call esi
push 0x3ed
push dword [0x65d27c]
call esi
push 0
push 0
push 0x188
push eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x40a3b6
xor eax, eax
jmp 0x40a3d0
push 0
push eax
push 0x199
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_SendMessageA]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
cmp eax, edi
je 0x40a3f8
push str._AccountInfo__Error._Incorrect_Index_
push 1
call fcn.00418b60
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
push 0x3fa
push dword [0x65d27c]
call esi
push 0x3fb
push dword [0x65d27c]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebx + 0x5d955c]
mov edi, eax
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
call esi
lea ecx, [ebx + 0x5d9567]
push ecx
push edi
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
push esi
call fcn.0040e420
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
push esi
call fcn.0040e670
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
push str.Detect_Wrong_Packet
push 1
call fcn.00418b60
add esp, 8
mov ecx, 0x565f88
push edi
call fcn.00417bc0
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret