Function at 0x4cff00
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4cff30
push esi
call fcn.004cf670
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x4cff29
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4cffb3
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x4cff9f
mov eax, dword [esi + 8]
test eax, eax
je 0x4cff54
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4cff9b
cmp eax, 2
je 0x4cff9f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4cff47
cmp eax, 3
je 0x4cff7a
cmp eax, 1
jne 0x4cff47
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4cff47
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4cff47
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.004cffe0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4cffd3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004cffe0
add esp, 4
pop esi
ret

Function at 0x4cffe0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xcc
je 0x4d0008
mov eax, dword [esi + 0x180]
push esi
call dword [eax]
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x180]
mov al, byte [ecx + 8]
test al, al
je 0x4d0033
mov edx, dword [esi]
push esi
mov dword [edx + 0x14], 0x30
mov eax, dword [esi]
call dword [eax]
mov ecx, dword [esi + 0x180]
add esp, 4
mov al, byte [ecx + 8]
test al, al
jne 0x4d0015
mov cl, byte [esi + 0x41]
xor edx, edx
test cl, cl
setne dl
add edx, 0xcd
mov al, 1
mov dword [esi + 0x14], edx
pop esi
ret

Function at 0x4dd3c1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4dd3f9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004e0ee4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004e0ebc
jmp 0x4dd405
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4def6c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4defae
call fcn.004f81f1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4defae
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4defa5
xor eax, eax
jmp 0x4defb6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004defbc
pop edi
pop esi
pop ebx
ret 4