Function at 0x411f73
Capabilities:
Check for time delay via gettickcount
Identify system language via api

Disassembly:
mov eax, 0x42fe98
call fcn.0042e9c0
sub esp, 0x50
movsx eax, word [0x438c24]
push ebx
push esi
push edi
mov esi, ecx
push eax
push 0xef03ffff
mov dword [ebp - 0x30], esi
call fcn.0040a933
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
pop ecx
xor ebx, ebx
pop ecx
mov dword [0x438c48], eax
mov dword [ebp - 0x14], ebx
call edi
add word [0x438c32], ax
push 0xb9cdffff
movsx eax, byte [0x438c19]
push eax
call fcn.0040aac5
pop ecx
mov dword [0x438c4c], eax
mov eax, dword [esi + 0x28]
pop ecx
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x48]
mov ecx, dword [0x438c58]
inc ecx
add word [0x438c24], cx
mov cl, byte [0x438c38]
add cl, byte [0x438c18]
cmp eax, ebx
mov byte [0x438c21], cl
jl 0x412553
cmp dword [ebp - 0x14], ebx
je 0x412553
movsx eax, byte [0x438c1c]
add eax, 0x73c9ffff
mov dword [0x438c44], eax
movsx eax, cl
push eax
push 0x84b7ffff
call fcn.0040aac5
add dword [0x438c48], eax
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
je 0x412553
push str._D_3
lea eax, [ebp - 0x1c]
push dword [ebp - 0x14]
push eax
call fcn.00410631
push dword [0x438c40]
push 0xf337ffff
call fcn.0040aa18
push 0x6ae9ffff
push 0x43c5ffff
mov dword [0x438c50], eax
call fcn.0040aa4f
mov word [0x438c2e], ax
mov eax, dword [ebp - 0x14]
add esp, 0x10
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ax, word [0x438c28]
mov dword [ebp - 0x14], ebx
dec ax
add word [0x438c2c], ax
inc byte [0x438c1c]
cmp dword [ebp - 0x1c], ebx
je 0x412553
mov al, byte [ebp - 0xd]
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x4c], al
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
push ebx
lea eax, [ebp - 0x5c]
push dword [ebp - 0x1c]
mov ecx, esi
mov byte [ebp - 4], 1
push eax
call fcn.00412aca
push eax
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00417eac
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.0041e670
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
cmp eax, ebx
je 0x412100
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push 0x4381e8
push eax
call dword [ecx]
mov eax, dword [0x438c4c]
push 0xda73ffff
dec eax
mov byte [ebp - 4], 3
mov word [0x438c2e], ax
movsx eax, byte [0x438c1f]
push eax
call fcn.0040aa83
add word [0x438c28], ax
mov al, byte [0x438c28]
sub byte [0x438c1f], al
mov eax, dword [ebp - 0x28]
pop ecx
cmp eax, ebx
pop ecx
je 0x41246c
mov dword [ebp - 0x20], ebx
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push 1
pop esi
mov byte [ebp - 4], 4
push esi
push eax
call dword [ecx + 0x10]
mov cx, word [0x438c22]
mov dword [ebp - 0x38], eax
cmp cx, bx
jne 0x412172
cmp word [0x438c2c], bx
jne 0x412172
xor edx, edx
jmp 0x412174
mov edx, esi
add dword [0x438c38], edx
cmp cx, bx
jne 0x41218e
cmp dword [0x438c3c], ebx
mov word [0x438c34], bx
je 0x412195
mov word [0x438c34], si
cmp dword [ebp - 0x38], ebx
jl 0x41245b
push 0xcb59ffff
push 0xdba3ffff
call fcn.0040aac5
add byte [0x438c1c], al
push 0x9461ffff
push 0x44c1ffff
call fcn.0040a96f
add word [0x438c28], ax
add esp, 0x10
call edi
mov ecx, dword [0x438c4c]
push dword [0x438c48]
mov dword [0x438c3c], eax
movsx eax, word [0x438c2c]
push 0x9865ffff
lea eax, [ecx + eax - 0x60100001]
mov dword [0x438c4c], eax
call fcn.0040a9a5
add byte [0x438c20], al
push dword [0x438c4c]
movsx eax, word [0x438c22]
or byte [0x438c19], 0xff
push eax
call fcn.0040a96f
add esp, 0x10
mov dword [0x438c38], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add word [0x438c24], ax
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x38]
mov ecx, dword [eax]
push edx
lea edx, [ebp - 0x2c]
push edx
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x412436
movsx eax, byte [0x438c21]
and eax, 0x988bffff
mov dword [ebp - 0x18], ebx
add dword [0x438c5c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x412278
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push 0x4381d8
push eax
call dword [ecx]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
push eax
mov byte [ebp - 4], 5
call dword [ecx + 8]
push 0x6543ffff
push 0x3c2fffff
call fcn.0040a9de
mov word [0x438c32], ax
mov eax, dword [ebp - 0x18]
pop ecx
cmp eax, ebx
pop ecx
je 0x41240b
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0x48]
push dword [0x438c4c]
mov esi, eax
push 0xa999ffff
call fcn.0040a9a5
push dword [0x438c38]
mov word [0x438c24], ax
push 0x8317ffff
call fcn.0040aa83
add dword [0x438c40], eax
add esp, 0x10
xor eax, eax
cmp byte [0x438c18], bl
setne al
add dword [0x438c38], eax
cmp esi, ebx
jl 0x41242d
cmp dword [ebp - 0x14], ebx
je 0x41242d
push 0x28d3ffff
push 0xeaa7ffff
push dword [0x438c54]
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov byte [0x438c1f], al
mov eax, dword [0x438c48]
neg eax
mov word [0x438c32], ax
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.00417b2d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
add dword [0x438c54], eax
push 0xfc13ffff
movsx eax, word [0x438c28]
push eax
call fcn.0040a9a5
pop ecx
mov dword [0x438c40], eax
mov eax, dword [ebp - 0x14]
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
or byte [0x438c21], 0xff
mov eax, 0x789ffff
sub eax, dword [0x438c50]
mov dword [ebp - 0x14], ebx
mov dword [0x438c38], eax
call edi
add dword [0x438c50], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add byte [0x438c21], al
cmp dword [ebp - 0x24], ebx
je 0x41242d
push 0xad15ffff
push 0xf9adffff
call fcn.0040a8f9
add dword [0x438c3c], eax
push 0x141ffff
push 0xc971ffff
call fcn.0040a9a5
add word [0x438c32], ax
add esp, 0x10
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x5c]
push ebx
push dword [ebp - 0x24]
push eax
call fcn.00412aca
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 7
call fcn.00417d4d
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 6
call fcn.0041e670
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 5
cmp eax, ebx
je 0x412408
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 4
cmp eax, ebx
je 0x412419
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x38]
push edx
lea edx, [ebp - 0x2c]
mov ecx, dword [eax]
push edx
push 1
jmp 0x41223f
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 4
jmp 0x41240f
movsx eax, word [0x438c2a]
push eax
push 0x3675ffff
call fcn.0040a933
mov dword [0x438c5c], eax
mov al, byte [0x438c1f]
pop ecx
neg al
pop ecx
mov byte [0x438c1a], al
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x41246c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
movsx eax, word [0x438c24]
push eax
push 0xeb69ffff
xor esi, esi
call fcn.0040a96f
mov word [0x438c30], ax
or al, 0xff
sub al, byte [0x438c40]
dec byte [0x438c1e]
push 0x639ffff
mov byte [0x438c18], al
movsx eax, byte [0x438c19]
push eax
call fcn.0040a9a5
add byte [0x438c19], al
mov eax, dword [ebp - 0x48]
add esp, 0x10
cmp eax, dword [ebp - 0x44]
je 0x4124f7
movsx edi, word [0x438c2c]
or edi, 0xc3ebffff
add eax, 4
add dword [0x438c54], edi
inc dword [0x438c4c]
mov edx, dword [eax]
cmp edx, ebx
jne 0x4124e2
xor ecx, ecx
jmp 0x4124ea
mov ecx, dword [eax + 4]
sub ecx, edx
sar ecx, 2
add eax, 0x10
add esi, ecx
lea ecx, [eax - 4]
cmp ecx, dword [ebp - 0x44]
jne 0x4124cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x438c48], eax
mov ax, word [0x438c5c]
add ax, word [0x438c30]
add word [0x438c24], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, ebx
mov word [0x438c30], ax
jne 0x412564
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x412537
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.00417d1a
mov eax, dword [ebp - 0x1c]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x412553
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov byte [0x438c1a], al
mov al, byte [0x438c2c]
add byte [0x438c20], al
mov dword [0x438c38], 1
movsx ax, byte [0x438c1f]
dec eax
add word [0x438c2c], ax
movsx eax, word [0x438c30]
push eax
push eax
call fcn.0040a9de
mov dword [0x438c5c], eax
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv esi
movsx eax, byte [0x438c21]
push eax
mov dword [ebp - 0x2c], ebx
movsx eax, word [0x438c28]
push eax
mov dword [ebp - 0x24], edx
call fcn.0040ab0e
or word [0x438c24], 0xffff
mov byte [0x438c21], al
mov eax, dword [ebp - 0x48]
add esp, 0x10
cmp eax, dword [ebp - 0x44]
mov edi, eax
je 0x412a75
push 0x8977ffff
push 0x4f6fffff
call fcn.0040a9a5
mov dword [0x438c48], eax
mov al, byte [0x438c1f]
add byte [0x438c19], al
mov eax, dword [edi + 4]
pop ecx
cmp eax, ebx
pop ecx
je 0x4128d6
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 2
cmp dword [ebp - 0x24], ecx
jae 0x4128d6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
dec eax
add word [0x438c30], ax
xor eax, eax
cmp byte [0x438c1d], bl
setne al
add dword [0x438c5c], eax
cmp dword [ebp - 0x2c], ebx
je 0x41292c
push 0xdd9ffff
push 0x46fdffff
call fcn.0040aa83
push dword [0x438c44]
mov dword [0x438c40], eax
push dword [0x438c50]
call fcn.0040ab0e
mov word [0x438c34], ax
movsx eax, byte [0x438c1e]
push eax
movsx eax, byte [0x438c1c]
push eax
call fcn.0040a8f9
mov word [0x438c26], ax
mov eax, dword [ebp - 0x28]
add esp, 0x18
cmp eax, ebx
je 0x412a3c
mov dword [ebp - 0x18], ebx
movsx cx, byte [0x438c1b]
or edx, 0xffffffff
mov byte [ebp - 4], 8
sub edx, ecx
mov word [0x438c2e], dx
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push 1
push eax
call dword [ecx + 0x10]
cmp byte [0x438c1f], bl
mov esi, eax
je 0x4126e2
cmp dword [0x438c44], ebx
mov byte [0x438c1b], 1
jne 0x4126e8
mov byte [0x438c1b], bl
mov al, byte [0x438c34]
push 0x7aa9ffff
inc al
add byte [0x438c1c], al
movsx eax, word [0x438c2a]
push eax
call fcn.0040aa18
add dword [0x438c54], eax
pop ecx
cmp esi, ebx
pop ecx
jl 0x412a2b
mov al, byte [0x438c2e]
mov byte [0x438c18], al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
add dword [0x438c5c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
dec edx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
movsx eax, word [0x438c28]
push 0x313dffff
push eax
call fcn.0040a8f9
mov byte [0x438c20], al
xor eax, eax
cmp byte [0x438c21], bl
pop ecx
pop ecx
lea edx, [ebp - 0x3c]
setne al
add byte [0x438c21], al
mov eax, dword [ebp - 0x18]
push edx
lea edx, [ebp - 0x38]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x412a2b
push dword [0x438c50]
push dword [0x438c58]
call fcn.0040aa18
mov byte [0x438c20], al
mov eax, dword [ebp - 0x38]
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0x20], ebx
je 0x4127b3
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push 0x4381d8
push eax
call dword [ecx]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
mov byte [ebp - 4], 9
call dword [ecx + 8]
mov al, byte [0x438c50]
inc al
add byte [0x438c1a], al
mov ax, word [0x438c2e]
inc ax
cmp dword [ebp - 0x20], ebx
mov word [0x438c34], ax
je 0x412a2b
push 0xa0d9ffff
push 0x922dffff
call fcn.0040aa18
pop ecx
mov word [0x438c2c], ax
mov eax, dword [ebp - 0x20]
pop ecx
lea edx, [ebp - 0x14]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x48]
cmp eax, ebx
jl 0x4128b2
cmp dword [ebp - 0x14], ebx
je 0x4128b2
xor eax, eax
cmp word [0x438c2a], bx
setne al
add dword [0x438c44], eax
movsx eax, byte [0x438c1e]
push eax
movsx eax, word [0x438c26]
push eax
call fcn.0040a9de
add dword [0x438c3c], eax
pop ecx
pop ecx
mov word [0x438c2e], bx
mov dword [ebp - 0x34], ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xa
call fcn.00417b2d
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
cmp word [0x438c30], bx
mov dword [ebp - 0x14], ebx
setne al
add byte [0x438c1a], al
xor eax, eax
cmp dword [0x438c3c], ebx
setne al
mov dword [0x438c54], eax
xor eax, eax
cmp byte [0x438c18], bl
setne al
mov dword [0x438c38], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [ebp - 0x34]
mov byte [0x438c1b], al
cmp esi, ebx
jne 0x4129b5
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 8
cmp eax, ebx
je 0x4128c3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x412918
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x412918
mov ax, word [0x438c2a]
inc word [0x438c2e]
inc ax
push 0x607fffff
push 0xf609ffff
mov word [0x438c34], ax
call fcn.0040aa83
pop ecx
mov word [0x438c34], ax
pop ecx
mov ecx, dword [edi + 4]
cmp ecx, ebx
jne 0x41290d
xor eax, eax
jmp 0x412915
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
sub dword [ebp - 0x24], eax
add edi, 0x10
inc dword [ebp - 0x2c]
cmp edi, dword [ebp - 0x44]
jne 0x4125e9
jmp 0x412a75
movsx eax, word [0x438c2a]
movsx ecx, word [0x438c34]
imul eax, ecx
mov ecx, dword [0x438c44]
lea eax, [ecx + eax + 0x7ce3ffff]
mov dword [0x438c44], eax
movsx eax, byte [0x438c20]
push eax
movsx eax, byte [0x438c21]
push eax
call fcn.0040ab0e
add dword [0x438c54], eax
mov esi, dword [ebp - 0x1c]
pop ecx
pop ecx
push dword [ebp - 0x24]
mov ecx, edi
call fcn.00417db7
push dword [eax]
mov ecx, dword [ebp - 0x30]
push esi
call fcn.00413dbc
mov ax, word [0x438c4c]
add ax, word [0x438c2c]
inc byte [0x438c1f]
mov word [0x438c2a], ax
mov ax, word [0x438c48]
or ax, word [0x438c24]
mov word [0x438c30], ax
jmp 0x412a75
push dword [ebp - 0x24]
mov ecx, edi
call fcn.00417db7
push dword [eax]
mov ecx, dword [ebp - 0x30]
push esi
call fcn.00413dbc
push 0xe4c3ffff
call dword [sym.imp.USER32.dll_IsMenu]
add byte [0x438c20], al
mov ax, word [0x438c30]
sub ax, word [0x438c38]
mov byte [ebp - 4], 9
add word [0x438c34], ax
mov eax, dword [ebp - 0x34]
inc word [0x438c2a]
cmp eax, ebx
je 0x412a07
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 8
cmp eax, ebx
je 0x412a18
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x412a75
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x412a75
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x412a3c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [0x438c4c], ebx
jne 0x412a53
cmp byte [0x438c1e], bl
mov word [0x438c2c], bx
je 0x412a5c
mov word [0x438c2c], 1
movsx eax, word [0x438c34]
push eax
push 0xe4a3ffff
call fcn.0040a9de
pop ecx
mov byte [0x438c21], al
pop ecx
movsx eax, byte [0x438c20]
push eax
push 0xbeabffff
call fcn.0040aac5
add dword [0x438c40], eax
mov eax, dword [ebp - 0x28]
inc word [0x438c34]
pop ecx
cmp eax, ebx
pop ecx
mov byte [ebp - 4], 1
je 0x412aa7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.00417d1a
mov eax, dword [ebp - 0x1c]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x412ac3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
jmp 0x412555