Function at 0x5211c5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5211fd
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0051f252
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0051f22a
jmp 0x521209
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5228bf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x522901
call fcn.00528868
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x522901
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5228f8
xor eax, eax
jmp 0x522909
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0052290f
pop edi
pop esi
pop ebx
ret 4

Function at 0x528d98
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x528dc6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x528de4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00528cfe
jmp 0x528de4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x528de4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00528cfe
test edi, edi
mov eax, edi
jne 0x528dce
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x4012d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push edi
mov edi, str.Mousepads_Diablo_II_Identify_Hack
push 0x41
push edi
xor ebp, ebp
push str.For_Diablo_II__Diablo_II_LOD_v1.09_n_nFeatures_:__n_nAll_NPCs_offer_to_identify_items__its_free_before_rescuing_cain_n_nFreeware__to_be_redistributed_free_and_unaltered_n
push ebp
call esi
cmp eax, 2
je 0x4013a0
mov ecx, str.Diablo_II
mov edx, ecx
call fcn.00401020
cmp eax, ebp
mov dword [0x4021b0], eax
jne 0x401314
push 0x10
push edi
push str.Diablo_II_not_loaded
jmp 0x40133b
mov edx, 0x6faa0000
mov ecx, eax
call fcn.0040110f
cmp eax, 0x905a4d
je 0x40133e
push dword [0x4021b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push edi
push str.D2Client.dll_not_loaded__join_a_game
push ebp
jmp 0x40139e
mov ebx, 0x402128
mov edx, dword [ebx]
mov ecx, dword [0x4021b0]
call fcn.0040110f
add ebx, 4
xor ebp, eax
cmp ebx, 0x40213c
jb 0x401343
cmp ebp, 0x3537506a
je 0x401383
cmp ebp, 0x8525ae8b
je 0x401383
push dword [0x4021b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push edi
push str.Unknown_game_version
jmp 0x40139c
call fcn.0040122a
push dword [0x4021b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push edi
push 0x40213c
push 0
call esi
pop edi
pop esi
pop ebp
pop ebx
ret