Function at 0x40ab40
Capabilities:
Check for time delay via gettickcount
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x48b034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x80
lea eax, [ebp - 0xe8]
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x164], ebx
push 0
push eax
mov dword [ebp - 0x140], esi
call sub.VCRUNTIME140.dll_memset
mov al, byte [esi + 4]
add esp, 0xc
mov byte [ebp - 0x111], al
movzx eax, al
cmp eax, 0xb
ja case.default.0x40ab91
jmp dword [eax*4 + 0x40b678]
mov word [ebp - 0x110], 0x5c1
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x40abb5
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x10e], al
mov al, byte [ebp - 0x111]
mov byte [ebp - 0x10c], al
lea eax, [ebp - 0x110]
push 5
push eax
push ebx
mov byte [ebp - 0x10d], 3
call fcn.00417990
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40ac73
movups xmm0, xmmword [ebp - 0x150]
push str.DUMP_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x160]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.DUMP_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40ad14
movups xmm0, xmmword [ebp - 0x160]
push str.EXECUTABLE_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.EXECUTABLE_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40adb5
movups xmm0, xmmword [ebp - 0x160]
push str.FILE_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.FILE_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40ae56
movups xmm0, xmmword [ebp - 0x160]
push str.FILE_MAPPING_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.FILE_MAPPING_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40aef7
movups xmm0, xmmword [ebp - 0x160]
push str.LIBRARY_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.LIBRARY_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40af98
movups xmm0, xmmword [ebp - 0x160]
push str.REGISTRY_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.REGISTRY_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40b039
movups xmm0, xmmword [ebp - 0x160]
push str.MEMORY_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.MEMORY_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40b0da
movups xmm0, xmmword [ebp - 0x160]
push str.WINDOW_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.WINDOW_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40b17b
movups xmm0, xmmword [ebp - 0x160]
push str.MACRO_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.MACRO_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40b21c
movups xmm0, xmmword [ebp - 0x160]
push str.DEBUGGER_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.DEBUGGER_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40b2bd
movups xmm0, xmmword [ebp - 0x160]
push str.KERNEL_DETECTION
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b36d
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.KERNEL_DETECTION
jmp 0x40b36d
imul edi, ebx, 0x6c
movups xmm0, xmmword [edi + 0x5d9538]
mov eax, dword [edi + 0x5d9558]
mov dword [ebp - 0x11c], eax
movups xmmword [ebp - 0x160], xmm0
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [edi + 0x5d9548]
movups xmmword [ebp - 0x150], xmm0
movups xmmword [ebp - 0x12c], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x118], eax
mov eax, dword [0x48b374]
cmp eax, dword [0x48b378]
je 0x40b356
movups xmm0, xmmword [ebp - 0x160]
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x150]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [eax + 0x20], xmm0
add dword [0x48b374], 0x28
jmp 0x40b368
lea ecx, [ebp - 0x13c]
push ecx
push eax
mov ecx, 0x48b370
call fcn.0040c3f0
push str.DEFAULT_DETECTION
lea eax, [ebp - 0xe8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
add esp, 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x108], xmm0
movups xmmword [ebp - 0xf8], xmm0
push 0x47d528
push 0x20
push eax
push 0x47b4d3
push 0x47d538
push 0x47d53c
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x64], xmm0
movups xmmword [ebp - 0x54], xmm0
call esi
push 0x47d550
push 0x20
lea eax, [ebp - 0x24]
push eax
push 0x47b532
push str.DataBase
push 0x47d56c
call esi
push 0x47d580
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x47b533
push 0x47d590
push 0x47d598
call esi
push 0x47d5ac
push 0x20
lea eax, [ebp - 0x64]
push eax
push 0x47b55a
push str.Pass
push 0x47d5c4
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x47d5d8
push 0
push 0x47d5e8
push 0x47d5f4
call esi
push 0x47d608
push 0
push 0x47d618
push 0x47d620
mov dword [ebp - 0x16c], eax
call esi
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 0x168], eax
mov word [ebp - 0x110], 0x5c1
mov bl, byte [ecx + 4]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jns 0x40b47d
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x10e], al
lea eax, [ebp - 0x110]
push 5
push eax
push dword [ebp - 0x164]
mov byte [ebp - 0x10d], 3
mov byte [ebp - 0x10c], bl
call fcn.00417990
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [ebp - 0x24]
push eax
push 0x20
push 0x498818
call esi
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push 0x20
push 0x498838
call esi
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
push 0x20
push 0x498858
call esi
mov esi, dword [sym.imp.ODBC32.dll_SQLAllocHandle]
add esp, 0xc
push 0x498810
push dword [0x49880c]
push 2
call esi
test ax, 0xfffe
jne 0x40b531
push 0xfffffffffffffffd
push 0x498858
push 0xfffffffffffffffd
push 0x498838
push 0xfffffffffffffffd
push 0x498818
push dword [0x498810]
call dword [sym.imp.ODBC32.dll_SQLConnect]
test ax, 0xfffe
jne 0x40b531
push 0x498814
push dword [0x498810]
push 3
call esi
test ax, 0xfffe
je 0x40b540
push str._Silent_GameGuard_____DataBase__:_Cannot_connect_
push 1
call fcn.00418b60
add esp, 8
mov eax, dword [ebp - 0x140]
lea ebx, [edi + 0x5d9538]
mov dword [ebp - 0x140], ebx
lea edi, [edi + 0x5d951c]
lea ecx, [eax + 0x5b]
push ecx
lea edx, [eax + 0x1b]
mov dword [ebp - 0x164], ecx
push edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0x110], edx
lea esi, [eax + 5]
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x140]
push edi
push ebx
push esi
push str.INSERT_INTO_SGG_HISTORY_DETECTIONS__Account__Player__IpAddress__HardwareId__DetectionType__CaptionName__Date__VALUES___s__s__s__s__s__s_getdate___
push 0x498808
call fcn.0040fe90
add esp, 0x24
lea eax, [ebp - 0xe8]
push eax
push edi
push ebx
push esi
push str._Silent_GameGuard_____HackDetected__:_Account:___s___Player:___s___IpAddress:__s__DetectionType:__s
push 1
call fcn.00418b60
push str._Silent_GameGuard_____HackDetected__:_Hack_Log_History_updated_Successfully
push 1
call fcn.00418b60
add esp, 0x20
cmp dword [ebp - 0x16c], 1
jne 0x40b666
mov eax, dword [ebp - 0x168]
push esi
test eax, eax
je 0x40b5fa
push eax
push str.UPDATE_Character_SET_UnBanDate__DATEADD_DAY___d__getdate____CtlCode__1_WHERE_AccountID___s
push 0x498808
call fcn.0040fe90
mov eax, dword [ebp - 0x168]
push eax
push esi
push str._Silent_GameGuard_____HackDetected__:_Account:___s__Characters_Blocked_For___d__Days_Successfully
push 1
call fcn.00418b60
add esp, 0x20
jmp 0x40b61c
push str.UPDATE_Character_SET_CtlCode__1_WHERE_AccountID___s
push 0x498808
call fcn.0040fe90
add esp, 0xc
push esi
push str._Silent_GameGuard_____HackDetected__:_Account:___s__Game_Characters_Banned_Permanently_Successfully
push 1
call fcn.00418b60
add esp, 0xc
push dword [0x498814]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x498814]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push dword [ebp - 0x164]
lea eax, [ebp - 0xe8]
push dword [ebp - 0x110]
push eax
push dword [ebp - 0x140]
push edi
push ebx
push esi
push str._Silent_GameGuard_____HackDetected___Account:___s___Player:___s__IpAddress:__s__HardwareId:__s__DetectionType:__s__CaptionName:__s__ProcessName:__s
push 1
push 0x48b3b8
call fcn.0040d610
add esp, 0x28
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046bb5b
mov esp, ebp
pop ebp
ret