Function at 0x44bda0
Capabilities:
Check for time delay via gettickcount
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x4090
call fcn.004c78a0
push ebx
push ebp
push esi
push edi
mov ebp, ecx
cmp byte [ebp], 0x3e
jne 0x44be47
mov ecx, dword [0x4e9150]
mov edx, str.UseErrorLevel
call fcn.0049a8f0
test eax, eax
mov ecx, 0x4e9a70
mov al, 3
setne bl
cmp al, byte [ebp + 1]
mov byte [esp + 0x18], bl
sbb eax, eax
and eax, dword [0x4e9104]
push eax
push 1
push dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
push dword [0x4e9150]
mov al, bl
xor al, 1
movzx eax, al
push eax
push dword [0x4e914c]
push 0
push dword [0x4e9148]
call fcn.00447f20
test eax, eax
jne 0x44be47
test bl, bl
je 0x44be3d
mov ecx, dword [0x4e7934]
push 1
push eax
push 0xffffffffffffffff
push str.ERROR
call fcn.0049e6b0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp]
cmp al, 0x5d
jne 0x44bf7c
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
mov ecx, dword [0x4e9148]
xor edx, edx
push 0
call fcn.0041c000
mov bh, al
add esp, 0xc
mov byte [esp + 0x14], bh
test bh, bh
jne 0x44bebc
mov ecx, dword [0x4e9148]
lea edx, [esp + 0x30]
push 0
call fcn.0046c120
add esp, 4
mov dword [esp + 0x2c], eax
test eax, eax
je 0x44be9e
cmp eax, 0xc
jl 0x44be9e
cmp eax, 0x2b
jle 0x44bec4
mov ecx, dword [0x4e7934]
push 1
push 0
push 0xffffffffffffffff
push 0x4d07c0
call fcn.0049e6b0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov esi, dword [0x4e914c]
mov byte [esp + 0x15], 0
mov dword [esp + 0x28], 1
mov byte [esp + 0x16], 1
mov bl, byte [esi]
mov dword [esp + 0x20], 0
test bl, bl
je 0x44bf5e
nop word [eax + eax]
movzx eax, bl
test eax, 0xffffff80
je 0x44befe
xor eax, eax
jmp 0x44bf09
push 2
push eax
call fcn.004b47c1
add esp, 8
mov cl, bl
and cl, 0xdf
test eax, eax
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
cmp dl, 0x44
je 0x44bf51
cmp dl, 0x4c
je 0x44bf47
cmp dl, 0x54
jne 0x44bf56
lea ecx, [esi + 1]
mov byte [esp + 0x16], 0
call fcn.00427480
mulsd xmm0, qword [0x4dd1a8]
cvttsd2si eax, xmm0
mov dword [esp + 0x20], eax
jmp 0x44bf56
mov dword [esp + 0x28], 0
jmp 0x44bf56
mov byte [esp + 0x15], 1
mov bl, byte [esi + 1]
inc esi
test bl, bl
jne 0x44bef0
lea eax, [esp + 0x98]
mov dword [esp + 0x90], 0
mov dword [esp + 0x88], eax
jmp 0x44c019
mov edx, dword [0x4e9148]
mov ecx, dword [0x4e9150]
cmp al, 0x3e
je 0x44bf95
cmp al, 0x5c
je 0x44bf99
cmp byte [ecx], 0
jne 0x44bf9e
cmp al, 0x5c
jne 0x44bfec
cmp byte [edx], 0
je 0x44bfec
cmp al, 0x5c
mov byte [esp + 0x16], 0
cmove ecx, edx
call fcn.00427480
mulsd xmm0, qword [0x4dd1a8]
mov bl, byte [esp + 0x14]
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], bl
mov dword [esp + 0x2c], edx
cvttsd2si ecx, xmm0
mov dword [esp + 0x20], ecx
cmp ecx, 1
mov cl, byte [esp + 0x14]
mov byte [esp + 0x15], cl
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
jge 0x44c019
mov dword [esp + 0x20], 0x1f4
jmp 0x44c019
mov al, byte [esp + 0x14]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov al, byte [esp + 0x14]
mov byte [esp + 0x15], al
mov eax, dword [esp + 0x24]
mov byte [esp + 0x16], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], eax
mov al, byte [ebp]
cmp al, 0x3e
je 0x44c039
mov ecx, dword [0x4e7934]
push 1
push 0
push 0xffffffffffffffff
push 0x4d03bc
call fcn.0049e6b0
mov al, byte [ebp]
cmp al, 0x5c
jne 0x44c050
push 1
mov ecx, ebp
call fcn.0043a010
mov byte [esp + 0x17], 1
cmp eax, 1
je 0x44c055
mov byte [esp + 0x17], 0
xor edi, edi
lea ebx, [esp + 0x98]
cmp byte [ebp + 1], 0
mov ecx, 0x4001
jbe 0x44c0be
nop dword [eax]
test ecx, ecx
jne 0x44c07e
mov dword [esp + edi*4 + 0x38], 0x4d0335
jmp 0x44c0b5
lea esi, [ecx - 1]
mov dword [esp + edi*4 + 0x38], ebx
push esi
push dword [edi*4 + 0x4e9148]
push ebx
call fcn.004b9880
mov ecx, ebx
mov byte [esi + ebx], 0
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44c0a0
sub ecx, edx
inc ecx
add ebx, ecx
lea ecx, [esp + 0x4099]
sub ecx, ebx
movzx eax, byte [ebp + 1]
inc edi
cmp edi, eax
jl 0x44c070
mov eax, dword fs:[0x24]
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [esp + 0x18], edi
mov ebx, dword [0x4e498c]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x48]
movzx eax, byte [ebp]
add eax, 0xffffffc2
cmp eax, 0x40
ja case.0x44c0f9.63
movzx eax, byte [eax + 0x44c498]
jmp dword [eax*4 + 0x44c478]
mov al, byte [ebp + 1]
mov ecx, 0x4d0335
cmp al, 4
mov edi, 0x4d0335
push 0
cmova ecx, edx
mov esi, 0x4d0335
cmp al, 3
mov edx, 0x4d0335
push 0
cmova edi, dword [esp + 0x4c]
cmp al, 1
push 1
cmova esi, dword [esp + 0x48]
test al, al
push 0
cmovne edx, dword [esp + 0x48]
push ecx
push edi
push esi
mov ecx, ebx
call fcn.0049fa10
add esp, 0x1c
test eax, eax
jne 0x44c3f4
mov edi, dword [esp + 0x18]
jmp case.0x44c0f9.63
mov al, byte [ebp + 1]
mov edi, 0x4d0335
cmp al, 4
mov esi, 0x4d0335
push 0
cmova edi, edx
mov ecx, 0x4d0335
push 0
cmp al, 3
mov edx, 0x4d0335
push 0
cmova esi, dword [esp + 0x50]
cmp al, 1
push 0
cmova ecx, dword [esp + 0x4c]
test al, al
push edi
cmovne edx, dword [esp + 0x4c]
push esi
push ecx
mov ecx, ebx
call fcn.0049fa10
add esp, 0x1c
test eax, eax
je 0x44c3f4
mov edi, dword [esp + 0x18]
jmp case.0x44c0f9.63
mov cl, byte [ebp + 1]
mov edi, 0x4d0335
cmp cl, 4
mov esi, 0x4d0335
push 1
cmova edi, edx
mov eax, 0x4d0335
cmp cl, 3
mov edx, 0x4d0335
push edi
cmova esi, dword [esp + 0x4c]
cmp cl, 1
push esi
cmova eax, dword [esp + 0x48]
test cl, cl
push eax
cmovne edx, dword [esp + 0x48]
mov ecx, ebx
call fcn.0049f890
add esp, 0x10
test eax, eax
jne 0x44c3f4
mov edi, dword [esp + 0x18]
jmp case.0x44c0f9.63
mov cl, byte [ebp + 1]
mov edi, 0x4d0335
cmp cl, 4
mov esi, 0x4d0335
push 1
cmova edi, edx
mov eax, 0x4d0335
cmp cl, 3
mov edx, 0x4d0335
push edi
cmova esi, dword [esp + 0x4c]
cmp cl, 1
push esi
cmova eax, dword [esp + 0x48]
test cl, cl
push eax
cmovne edx, dword [esp + 0x48]
mov ecx, ebx
call fcn.0049f890
add esp, 0x10
test eax, eax
je 0x44c3f4
mov edi, dword [esp + 0x18]
jmp case.0x44c0f9.63
cmp byte [esp + 0x17], 0
je 0x44c270
call dword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
jne 0x44c43b
jmp case.0x44c0f9.63
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x44c43b
push 0xf
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x44c43b
jmp case.0x44c0f9.63
mov al, byte [esp + 0x14]
test al, al
je 0x44c2b1
mov edx, dword [esp + 0x28]
mov cl, al
call fcn.0046c2e0
cmp al, byte [esp + 0x15]
je 0x44c43b
jmp case.0x44c0f9.63
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x88]
mov ecx, dword [esp + 0x2c]
push 0
push eax
call fcn.0046c380
add esp, 8
xorps xmm1, xmm1
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jnp 0x44c2dc
mov al, 1
jmp 0x44c2de
xor al, al
cmp al, byte [esp + 0x15]
je 0x44c43b
jmp case.0x44c0f9.63
test esi, esi
je 0x44c455
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x24], 0x103
jne 0x44c448
mov eax, dword [esp + 0x34]
cmp dword [0x4e9a38], eax
jne 0x44c3c9
cmp byte [esp + 0x16], 0
jne 0x44c33c
mov esi, dword [esp + 0x20]
add esi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
sub ecx, eax
cmp ecx, 5
jle 0x44c3d6
mov edx, 1
mov ecx, 0x8000012f
call fcn.00401a30
mov ebx, dword [0x4e498c]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x48]
test al, al
je 0x44c0e2
cmp byte [ebx + 0xd9], 0
je 0x44c0e2
mov eax, dword [0x4e8470]
mov ecx, 0x190
test eax, eax
cmovne ecx, eax
cmp dword [ecx*4 + 0x4e8ab4], ebp
jne 0x44c393
cmp dword [ecx*4 + 0x4e8474], edi
je 0x44c0e2
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [eax*4 + 0x4e8ab8], ebp
mov dword [eax*4 + 0x4e8478], edi
inc eax
mov dword [0x4e8470], eax
cmp eax, 0x190
jl 0x44c0e2
mov dword [0x4e8470], 0
jmp 0x44c0da
mov esi, dword [esp + 0x20]
add esi, edi
cmp byte [esp + 0x16], 0
jne 0x44c3e7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub esi, eax
cmp esi, 5
jle 0x44be9e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44c0d4
mov eax, dword [0x4e498c]
cmp dword [eax + 0x54], 0xffffffff
jle 0x44c43b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4e9a38], eax
je 0x44c428
mov eax, dword [0x4e498c]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4e498c]
mov edx, 1
mov ecx, dword [ecx + 0x54]
call fcn.00401a30
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
jmp 0x44c45b
xor eax, eax
mov dword [esp + 0x24], eax
mov ecx, dword [0x4e7934]
push 0x18
cdq
push edx
push eax
call fcn.00401520
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret